# Flog Txt Version 1 # Analyzer Version: 3.1.2 # Analyzer Build Date: Oct 28 2019 11:51:53 # Log Creation Date: 24.11.2019 10:39:10.520 Process: id = "1" image_name = "egui.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\egui.exe" page_root = "0x4f6bb000" os_pid = "0x96c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\egui.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0x970 [0023.376] LoadLibraryA (lpLibFileName="KERNEL32.DLL") returned 0x76c20000 [0023.377] GetProcAddress (hModule=0x76c20000, lpProcName="SetFileAttributesW") returned 0x76c4d4f7 [0023.377] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileType") returned 0x76c33531 [0023.377] GetProcAddress (hModule=0x76c20000, lpProcName="SetFileTime") returned 0x76c4ecbb [0023.377] GetProcAddress (hModule=0x76c20000, lpProcName="QueryDosDeviceW") returned 0x76c5ceec [0023.377] GetProcAddress (hModule=0x76c20000, lpProcName="GetACP") returned 0x76c3179c [0023.377] GetProcAddress (hModule=0x76c20000, lpProcName="CloseHandle") returned 0x76c31410 [0023.377] GetProcAddress (hModule=0x76c20000, lpProcName="LocalFree") returned 0x76c32d3c [0023.377] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcessId") returned 0x76c311f8 [0023.378] GetProcAddress (hModule=0x76c20000, lpProcName="SizeofResource") returned 0x76c35ac9 [0023.378] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualProtect") returned 0x76c3435f [0023.378] GetProcAddress (hModule=0x76c20000, lpProcName="QueryPerformanceFrequency") returned 0x76c341f0 [0023.378] GetProcAddress (hModule=0x76c20000, lpProcName="IsDebuggerPresent") returned 0x76c34a5d [0023.378] GetProcAddress (hModule=0x76c20000, lpProcName="FindNextFileW") returned 0x76c354ee [0023.378] GetProcAddress (hModule=0x76c20000, lpProcName="GetFullPathNameW") returned 0x76c340d4 [0023.378] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualFree") returned 0x76c3186e [0023.378] GetProcAddress (hModule=0x76c20000, lpProcName="ExitProcess") returned 0x76c37a10 [0023.378] GetProcAddress (hModule=0x76c20000, lpProcName="HeapAlloc") returned 0x7715e026 [0023.378] GetProcAddress (hModule=0x76c20000, lpProcName="GetCPInfoExW") returned 0x76c5af0b [0023.378] GetProcAddress (hModule=0x76c20000, lpProcName="RtlUnwind") returned 0x76c5d1c3 [0023.378] GetProcAddress (hModule=0x76c20000, lpProcName="GetCPInfo") returned 0x76c35189 [0023.378] GetProcAddress (hModule=0x76c20000, lpProcName="EnumSystemLocalesW") returned 0x76cb425f [0023.378] GetProcAddress (hModule=0x76c20000, lpProcName="GetStdHandle") returned 0x76c351b3 [0023.379] GetProcAddress (hModule=0x76c20000, lpProcName="FileTimeToLocalFileTime") returned 0x76c3e29e [0023.379] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleHandleW") returned 0x76c334b0 [0023.379] GetProcAddress (hModule=0x76c20000, lpProcName="FreeLibrary") returned 0x76c334c8 [0023.379] GetProcAddress (hModule=0x76c20000, lpProcName="TryEnterCriticalSection") returned 0x77162500 [0023.379] GetProcAddress (hModule=0x76c20000, lpProcName="HeapDestroy") returned 0x76c335b7 [0023.379] GetProcAddress (hModule=0x76c20000, lpProcName="FileTimeToDosDateTime") returned 0x76c4c86d [0023.379] GetProcAddress (hModule=0x76c20000, lpProcName="ReadFile") returned 0x76c33ed3 [0023.379] GetProcAddress (hModule=0x76c20000, lpProcName="DosDateTimeToFileTime") returned 0x76c4effe [0023.379] GetProcAddress (hModule=0x76c20000, lpProcName="GetUserDefaultLCID") returned 0x76c33da5 [0023.379] GetProcAddress (hModule=0x76c20000, lpProcName="HeapSize") returned 0x77163002 [0023.379] GetProcAddress (hModule=0x76c20000, lpProcName="GetLastError") returned 0x76c311c0 [0023.379] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleFileNameW") returned 0x76c34950 [0023.379] GetProcAddress (hModule=0x76c20000, lpProcName="SetLastError") returned 0x76c311a9 [0023.380] GetProcAddress (hModule=0x76c20000, lpProcName="GlobalAlloc") returned 0x76c3588e [0023.380] GetProcAddress (hModule=0x76c20000, lpProcName="GlobalUnlock") returned 0x76c4cfdf [0023.380] GetProcAddress (hModule=0x76c20000, lpProcName="FindResourceW") returned 0x76c35971 [0023.380] GetProcAddress (hModule=0x76c20000, lpProcName="CreateThread") returned 0x76c334d5 [0023.380] GetProcAddress (hModule=0x76c20000, lpProcName="CompareStringW") returned 0x76c33bca [0023.380] GetProcAddress (hModule=0x76c20000, lpProcName="CopyFileW") returned 0x76c5830d [0023.380] GetProcAddress (hModule=0x76c20000, lpProcName="MapViewOfFile") returned 0x76c318f1 [0023.380] GetProcAddress (hModule=0x76c20000, lpProcName="CreateMutexW") returned 0x76c3424c [0023.380] GetProcAddress (hModule=0x76c20000, lpProcName="LoadLibraryA") returned 0x76c349d7 [0023.380] GetProcAddress (hModule=0x76c20000, lpProcName="GetVolumeInformationW") returned 0x76c4c860 [0023.380] GetProcAddress (hModule=0x76c20000, lpProcName="ResetEvent") returned 0x76c316dd [0023.380] GetProcAddress (hModule=0x76c20000, lpProcName="MulDiv") returned 0x76c31b80 [0023.380] GetProcAddress (hModule=0x76c20000, lpProcName="FreeResource") returned 0x76c4d3db [0023.381] GetProcAddress (hModule=0x76c20000, lpProcName="GetDriveTypeW") returned 0x76c3418b [0023.381] GetProcAddress (hModule=0x76c20000, lpProcName="GetVersion") returned 0x76c34467 [0023.381] GetProcAddress (hModule=0x76c20000, lpProcName="RaiseException") returned 0x76c358a6 [0023.381] GetProcAddress (hModule=0x76c20000, lpProcName="MoveFileW") returned 0x76c49af0 [0023.381] GetProcAddress (hModule=0x76c20000, lpProcName="GlobalAddAtomW") returned 0x76c33215 [0023.381] GetProcAddress (hModule=0x76c20000, lpProcName="FormatMessageW") returned 0x76c34620 [0023.381] GetProcAddress (hModule=0x76c20000, lpProcName="SwitchToThread") returned 0x76c4efec [0023.381] GetProcAddress (hModule=0x76c20000, lpProcName="GetExitCodeThread") returned 0x76c4d5b5 [0023.381] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentThread") returned 0x76c317ec [0023.381] GetProcAddress (hModule=0x76c20000, lpProcName="LocalFileTimeToFileTime") returned 0x76c5d50e [0023.381] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileAttributesExW") returned 0x76c34574 [0023.381] GetProcAddress (hModule=0x76c20000, lpProcName="LoadLibraryExW") returned 0x76c3495d [0023.381] GetProcAddress (hModule=0x76c20000, lpProcName="LockResource") returned 0x76c35959 [0023.381] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentThreadId") returned 0x76c31450 [0023.382] GetProcAddress (hModule=0x76c20000, lpProcName="UnhandledExceptionFilter") returned 0x76c5772f [0023.382] GetProcAddress (hModule=0x76c20000, lpProcName="GlobalFindAtomW") returned 0x76c4cd80 [0023.382] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualQuery") returned 0x76c3445a [0023.382] GetProcAddress (hModule=0x76c20000, lpProcName="GlobalFree") returned 0x76c35558 [0023.382] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualQueryEx") returned 0x76cb45cf [0023.382] GetProcAddress (hModule=0x76c20000, lpProcName="Sleep") returned 0x76c310ff [0023.382] GetProcAddress (hModule=0x76c20000, lpProcName="SetVolumeLabelW") returned 0x76cb255b [0023.382] GetProcAddress (hModule=0x76c20000, lpProcName="EnterCriticalSection") returned 0x771522b0 [0023.382] GetProcAddress (hModule=0x76c20000, lpProcName="SetFilePointer") returned 0x76c317d1 [0023.382] GetProcAddress (hModule=0x76c20000, lpProcName="FlushFileBuffers") returned 0x76c3469b [0023.382] GetProcAddress (hModule=0x76c20000, lpProcName="LoadResource") returned 0x76c3594c [0023.384] GetProcAddress (hModule=0x76c20000, lpProcName="SuspendThread") returned 0x76c57d7e [0023.384] GetProcAddress (hModule=0x76c20000, lpProcName="GetTickCount") returned 0x76c3110c [0023.384] GetProcAddress (hModule=0x76c20000, lpProcName="GetTempFileNameW") returned 0x76c5d1b6 [0023.384] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileSize") returned 0x76c3196e [0023.384] GetProcAddress (hModule=0x76c20000, lpProcName="GlobalDeleteAtom") returned 0x76c4cdad [0023.384] GetProcAddress (hModule=0x76c20000, lpProcName="GetStartupInfoW") returned 0x76c34d40 [0023.384] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileAttributesW") returned 0x76c31b18 [0023.384] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentDirectoryW") returned 0x76c35611 [0023.384] GetProcAddress (hModule=0x76c20000, lpProcName="SetCurrentDirectoryW") returned 0x76c41260 [0023.384] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSection") returned 0x77162c42 [0023.384] GetProcAddress (hModule=0x76c20000, lpProcName="GetThreadPriority") returned 0x76c343bf [0023.384] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcess") returned 0x76c31809 [0023.384] GetProcAddress (hModule=0x76c20000, lpProcName="GlobalLock") returned 0x76c4d0a7 [0023.384] GetProcAddress (hModule=0x76c20000, lpProcName="SetThreadPriority") returned 0x76c332bb [0023.385] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualAlloc") returned 0x76c31856 [0023.385] GetProcAddress (hModule=0x76c20000, lpProcName="GetTempPathW") returned 0x76c4d4dc [0023.385] GetProcAddress (hModule=0x76c20000, lpProcName="GetCommandLineW") returned 0x76c35223 [0023.385] GetProcAddress (hModule=0x76c20000, lpProcName="GetSystemInfo") returned 0x76c349ca [0023.385] GetProcAddress (hModule=0x76c20000, lpProcName="LeaveCriticalSection") returned 0x77152270 [0023.385] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcAddress") returned 0x76c31222 [0023.385] GetProcAddress (hModule=0x76c20000, lpProcName="ResumeThread") returned 0x76c343ef [0023.385] GetProcAddress (hModule=0x76c20000, lpProcName="GetLogicalDriveStringsW") returned 0x76cb436f [0023.385] GetProcAddress (hModule=0x76c20000, lpProcName="GetVersionExW") returned 0x76c31ae5 [0023.385] GetProcAddress (hModule=0x76c20000, lpProcName="VerifyVersionInfoW") returned 0x76c4d423 [0023.385] GetProcAddress (hModule=0x76c20000, lpProcName="HeapCreate") returned 0x76c34a2d [0023.385] GetProcAddress (hModule=0x76c20000, lpProcName="GetDiskFreeSpaceW") returned 0x76c4f7aa [0023.385] GetProcAddress (hModule=0x76c20000, lpProcName="VerSetConditionMask") returned 0x771a92b9 [0023.386] GetProcAddress (hModule=0x76c20000, lpProcName="FindFirstFileW") returned 0x76c34435 [0023.386] GetProcAddress (hModule=0x76c20000, lpProcName="GetUserDefaultUILanguage") returned 0x76c344ab [0023.386] GetProcAddress (hModule=0x76c20000, lpProcName="GetConsoleOutputCP") returned 0x76c49b0f [0023.386] GetProcAddress (hModule=0x76c20000, lpProcName="UnmapViewOfFile") returned 0x76c31826 [0023.386] GetProcAddress (hModule=0x76c20000, lpProcName="GetConsoleCP") returned 0x76cd7bff [0023.386] GetProcAddress (hModule=0x76c20000, lpProcName="lstrlenW") returned 0x76c31700 [0023.386] GetProcAddress (hModule=0x76c20000, lpProcName="SetEndOfFile") returned 0x76c4ce2e [0023.386] GetProcAddress (hModule=0x76c20000, lpProcName="QueryPerformanceCounter") returned 0x76c31725 [0023.386] GetProcAddress (hModule=0x76c20000, lpProcName="HeapFree") returned 0x76c314c9 [0023.386] GetProcAddress (hModule=0x76c20000, lpProcName="WideCharToMultiByte") returned 0x76c3170d [0023.386] GetProcAddress (hModule=0x76c20000, lpProcName="FindClose") returned 0x76c34442 [0023.386] GetProcAddress (hModule=0x76c20000, lpProcName="MultiByteToWideChar") returned 0x76c3192e [0023.386] GetProcAddress (hModule=0x76c20000, lpProcName="LoadLibraryW") returned 0x76c3492b [0023.387] GetProcAddress (hModule=0x76c20000, lpProcName="SetEvent") returned 0x76c316c5 [0023.387] GetProcAddress (hModule=0x76c20000, lpProcName="GetLocaleInfoW") returned 0x76c33c42 [0023.387] GetProcAddress (hModule=0x76c20000, lpProcName="CreateFileW") returned 0x76c33f5c [0023.387] GetProcAddress (hModule=0x76c20000, lpProcName="EnumResourceNamesW") returned 0x76ca3161 [0023.387] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteFileW") returned 0x76c389b3 [0023.387] GetProcAddress (hModule=0x76c20000, lpProcName="IsDBCSLeadByteEx") returned 0x76c5cf4e [0023.387] GetProcAddress (hModule=0x76c20000, lpProcName="GetEnvironmentVariableW") returned 0x76c31b48 [0023.387] GetProcAddress (hModule=0x76c20000, lpProcName="GetLocalTime") returned 0x76c35aa6 [0023.387] GetProcAddress (hModule=0x76c20000, lpProcName="WaitForSingleObject") returned 0x76c31136 [0023.387] GetProcAddress (hModule=0x76c20000, lpProcName="WriteFile") returned 0x76c31282 [0023.387] GetProcAddress (hModule=0x76c20000, lpProcName="CreateFileMappingW") returned 0x76c31909 [0023.387] GetProcAddress (hModule=0x76c20000, lpProcName="ExitThread") returned 0x7718d598 [0023.387] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteCriticalSection") returned 0x771645f5 [0023.387] GetProcAddress (hModule=0x76c20000, lpProcName="GetDateFormatW") returned 0x76c534d7 [0023.388] GetProcAddress (hModule=0x76c20000, lpProcName="TlsGetValue") returned 0x76c311e0 [0023.388] GetProcAddress (hModule=0x76c20000, lpProcName="SetErrorMode") returned 0x76c31b00 [0023.388] GetProcAddress (hModule=0x76c20000, lpProcName="IsValidLocale") returned 0x76c4ce46 [0023.388] GetProcAddress (hModule=0x76c20000, lpProcName="TlsSetValue") returned 0x76c314fb [0023.388] GetProcAddress (hModule=0x76c20000, lpProcName="CreateDirectoryW") returned 0x76c34259 [0023.388] GetProcAddress (hModule=0x76c20000, lpProcName="GetSystemDefaultUILanguage") returned 0x76c52b22 [0023.388] GetProcAddress (hModule=0x76c20000, lpProcName="EnumCalendarInfoW") returned 0x76cb41ff [0023.388] GetProcAddress (hModule=0x76c20000, lpProcName="LocalAlloc") returned 0x76c3168c [0023.388] GetProcAddress (hModule=0x76c20000, lpProcName="RemoveDirectoryW") returned 0x76cb44cf [0023.388] GetProcAddress (hModule=0x76c20000, lpProcName="GlobalMemoryStatus") returned 0x76c38b6d [0023.388] GetProcAddress (hModule=0x76c20000, lpProcName="CreateEventW") returned 0x76c3183e [0023.388] GetProcAddress (hModule=0x76c20000, lpProcName="WaitForMultipleObjectsEx") returned 0x76c3199e [0023.388] GetProcAddress (hModule=0x76c20000, lpProcName="GetThreadLocale") returned 0x76c335cf [0023.388] GetProcAddress (hModule=0x76c20000, lpProcName="SetThreadLocale") returned 0x76c389d9 [0023.388] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x74d40000 [0023.389] GetProcAddress (hModule=0x74d40000, lpProcName="RegSetValueExW") returned 0x74d514d6 [0023.389] GetProcAddress (hModule=0x74d40000, lpProcName="InitializeAcl") returned 0x74d545cd [0023.389] GetProcAddress (hModule=0x74d40000, lpProcName="RegConnectRegistryW") returned 0x74d48f01 [0023.389] GetProcAddress (hModule=0x74d40000, lpProcName="RegEnumKeyExW") returned 0x74d546c8 [0023.389] GetProcAddress (hModule=0x74d40000, lpProcName="RegLoadKeyW") returned 0x74d83473 [0023.389] GetProcAddress (hModule=0x74d40000, lpProcName="SetKernelObjectSecurity") returned 0x74d54645 [0023.389] GetProcAddress (hModule=0x74d40000, lpProcName="RegDeleteKeyW") returned 0x74d51272 [0023.389] GetProcAddress (hModule=0x74d40000, lpProcName="RegOpenKeyExW") returned 0x74d5468d [0023.389] GetProcAddress (hModule=0x74d40000, lpProcName="RegQueryInfoKeyW") returned 0x74d546e7 [0023.389] GetProcAddress (hModule=0x74d40000, lpProcName="RegUnLoadKeyW") returned 0x74d83493 [0023.389] GetProcAddress (hModule=0x74d40000, lpProcName="RegSaveKeyW") returned 0x74d67a9b [0023.389] GetProcAddress (hModule=0x74d40000, lpProcName="RegDeleteValueW") returned 0x74d4cf31 [0023.390] GetProcAddress (hModule=0x74d40000, lpProcName="RegReplaceKeyW") returned 0x74da0b89 [0023.390] GetProcAddress (hModule=0x74d40000, lpProcName="RegFlushKey") returned 0x74d6773f [0023.390] GetProcAddress (hModule=0x74d40000, lpProcName="RegEnumValueW") returned 0x74d548cc [0023.390] GetProcAddress (hModule=0x74d40000, lpProcName="RegQueryValueExW") returned 0x74d546ad [0023.390] GetProcAddress (hModule=0x74d40000, lpProcName="InitializeSecurityDescriptor") returned 0x74d54620 [0023.390] GetProcAddress (hModule=0x74d40000, lpProcName="RegCloseKey") returned 0x74d5469d [0023.390] GetProcAddress (hModule=0x74d40000, lpProcName="RegCreateKeyExW") returned 0x74d540fe [0023.390] GetProcAddress (hModule=0x74d40000, lpProcName="SetSecurityDescriptorDacl") returned 0x74d5415e [0023.390] GetProcAddress (hModule=0x74d40000, lpProcName="RegRestoreKeyW") returned 0x74d67cba [0023.390] LoadLibraryA (lpLibFileName="comctl32.dll") returned 0x74ae0000 [0023.390] GetProcAddress (hModule=0x74ae0000, lpProcName="ImageList_GetImageInfo") returned 0x74aed96c [0023.390] GetProcAddress (hModule=0x74ae0000, lpProcName="FlatSB_SetScrollInfo") returned 0x74b122be [0023.390] GetProcAddress (hModule=0x74ae0000, lpProcName="ImageList_DragMove") returned 0x74b45f53 [0023.390] GetProcAddress (hModule=0x74ae0000, lpProcName="ImageList_Destroy") returned 0x74ae7cf1 [0023.391] GetProcAddress (hModule=0x74ae0000, lpProcName="_TrackMouseEvent") returned 0x74b158cc [0023.391] GetProcAddress (hModule=0x74ae0000, lpProcName="ImageList_DragShowNolock") returned 0x74b45fa6 [0023.391] GetProcAddress (hModule=0x74ae0000, lpProcName="ImageList_Add") returned 0x74b46e5c [0023.391] GetProcAddress (hModule=0x74ae0000, lpProcName="FlatSB_SetScrollProp") returned 0x74b1238d [0023.391] GetProcAddress (hModule=0x74ae0000, lpProcName="ImageList_GetDragImage") returned 0x74b46c98 [0023.391] GetProcAddress (hModule=0x74ae0000, lpProcName="ImageList_Create") returned 0x74ae908c [0023.391] GetProcAddress (hModule=0x74ae0000, lpProcName="ImageList_EndDrag") returned 0x74b45ee7 [0023.391] GetProcAddress (hModule=0x74ae0000, lpProcName="ImageList_DrawEx") returned 0x74aed9b4 [0023.391] GetProcAddress (hModule=0x74ae0000, lpProcName="ImageList_SetImageCount") returned 0x74b46e17 [0023.391] GetProcAddress (hModule=0x74ae0000, lpProcName="FlatSB_GetScrollPos") returned 0x74b11ccd [0023.391] GetProcAddress (hModule=0x74ae0000, lpProcName="FlatSB_SetScrollPos") returned 0x74b1216d [0023.391] GetProcAddress (hModule=0x74ae0000, lpProcName="InitializeFlatSB") returned 0x74b1266f [0023.391] GetProcAddress (hModule=0x74ae0000, lpProcName="ImageList_Copy") returned 0x74b46f76 [0023.392] GetProcAddress (hModule=0x74ae0000, lpProcName="FlatSB_GetScrollInfo") returned 0x74b11f0f [0023.392] GetProcAddress (hModule=0x74ae0000, lpProcName="ImageList_Write") returned 0x74b46d79 [0023.392] GetProcAddress (hModule=0x74ae0000, lpProcName="ImageList_SetBkColor") returned 0x74aea197 [0023.392] GetProcAddress (hModule=0x74ae0000, lpProcName="ImageList_GetBkColor") returned 0x74af4419 [0023.392] GetProcAddress (hModule=0x74ae0000, lpProcName="ImageList_BeginDrag") returned 0x74b46ccb [0023.392] GetProcAddress (hModule=0x74ae0000, lpProcName="ImageList_GetIcon") returned 0x74b46f2f [0023.392] GetProcAddress (hModule=0x74ae0000, lpProcName="ImageList_Replace") returned 0x74aeddc8 [0023.392] GetProcAddress (hModule=0x74ae0000, lpProcName="ImageList_GetImageCount") returned 0x74aed910 [0023.392] GetProcAddress (hModule=0x74ae0000, lpProcName="ImageList_DragEnter") returned 0x74b45f25 [0023.392] GetProcAddress (hModule=0x74ae0000, lpProcName="ImageList_GetIconSize") returned 0x74aed8c8 [0023.392] GetProcAddress (hModule=0x74ae0000, lpProcName="ImageList_SetIconSize") returned 0x74b46fc8 [0023.392] GetProcAddress (hModule=0x74ae0000, lpProcName="ImageList_Read") returned 0x74aede13 [0023.392] GetProcAddress (hModule=0x74ae0000, lpProcName="ImageList_DragLeave") returned 0x74b45f7e [0023.392] GetProcAddress (hModule=0x74ae0000, lpProcName="ImageList_LoadImageW") returned 0x74af57dd [0023.393] GetProcAddress (hModule=0x74ae0000, lpProcName="ImageList_Draw") returned 0x74af5f62 [0023.393] GetProcAddress (hModule=0x74ae0000, lpProcName="ImageList_Remove") returned 0x74b46eea [0023.393] GetProcAddress (hModule=0x74ae0000, lpProcName="ImageList_ReplaceIcon") returned 0x74b46ea3 [0023.393] GetProcAddress (hModule=0x74ae0000, lpProcName="ImageList_SetOverlayImage") returned 0x74af49c2 [0023.393] LoadLibraryA (lpLibFileName="gdi32.dll") returned 0x75ad0000 [0023.393] GetProcAddress (hModule=0x75ad0000, lpProcName="Pie") returned 0x75b14554 [0023.393] GetProcAddress (hModule=0x75ad0000, lpProcName="SetBkMode") returned 0x75ae51a2 [0023.393] GetProcAddress (hModule=0x75ad0000, lpProcName="CreateCompatibleBitmap") returned 0x75ae5f49 [0023.393] GetProcAddress (hModule=0x75ad0000, lpProcName="GetEnhMetaFileHeader") returned 0x75af59f0 [0023.393] GetProcAddress (hModule=0x75ad0000, lpProcName="RectVisible") returned 0x75ae8b24 [0023.393] GetProcAddress (hModule=0x75ad0000, lpProcName="AngleArc") returned 0x75b14124 [0023.393] GetProcAddress (hModule=0x75ad0000, lpProcName="SetAbortProc") returned 0x75af6b89 [0023.393] GetProcAddress (hModule=0x75ad0000, lpProcName="SetTextColor") returned 0x75ae522d [0023.393] GetProcAddress (hModule=0x75ad0000, lpProcName="StretchBlt") returned 0x75aeb895 [0023.394] GetProcAddress (hModule=0x75ad0000, lpProcName="RoundRect") returned 0x75af6cde [0023.394] GetProcAddress (hModule=0x75ad0000, lpProcName="RestoreDC") returned 0x75ae6ead [0023.394] GetProcAddress (hModule=0x75ad0000, lpProcName="SetRectRgn") returned 0x75aea785 [0023.394] GetProcAddress (hModule=0x75ad0000, lpProcName="GetTextMetricsW") returned 0x75ae82b2 [0023.394] GetProcAddress (hModule=0x75ad0000, lpProcName="GetWindowOrgEx") returned 0x75aee310 [0023.394] GetProcAddress (hModule=0x75ad0000, lpProcName="CreatePalette") returned 0x75ae795a [0023.394] GetProcAddress (hModule=0x75ad0000, lpProcName="PolyBezierTo") returned 0x75b15cd5 [0023.394] GetProcAddress (hModule=0x75ad0000, lpProcName="CreateICW") returned 0x75aec040 [0023.394] GetProcAddress (hModule=0x75ad0000, lpProcName="CreateDCW") returned 0x75aee743 [0023.394] GetProcAddress (hModule=0x75ad0000, lpProcName="GetStockObject") returned 0x75ae4eb8 [0023.394] GetProcAddress (hModule=0x75ad0000, lpProcName="CreateSolidBrush") returned 0x75ae4f17 [0023.394] GetProcAddress (hModule=0x75ad0000, lpProcName="Polygon") returned 0x75aecafc [0023.394] GetProcAddress (hModule=0x75ad0000, lpProcName="MoveToEx") returned 0x75ae8ee6 [0023.395] GetProcAddress (hModule=0x75ad0000, lpProcName="PlayEnhMetaFile") returned 0x75afc8a2 [0023.395] GetProcAddress (hModule=0x75ad0000, lpProcName="Ellipse") returned 0x75b14492 [0023.395] GetProcAddress (hModule=0x75ad0000, lpProcName="StartPage") returned 0x75b1401a [0023.395] GetProcAddress (hModule=0x75ad0000, lpProcName="GetBitmapBits") returned 0x75aec155 [0023.395] GetProcAddress (hModule=0x75ad0000, lpProcName="StartDocW") returned 0x75b14c51 [0023.395] GetProcAddress (hModule=0x75ad0000, lpProcName="GetSystemPaletteEntries") returned 0x75aecf02 [0023.395] GetProcAddress (hModule=0x75ad0000, lpProcName="GetEnhMetaFileBits") returned 0x75afb731 [0023.395] GetProcAddress (hModule=0x75ad0000, lpProcName="AbortDoc") returned 0x75b13adc [0023.395] GetProcAddress (hModule=0x75ad0000, lpProcName="GetEnhMetaFilePaletteEntries") returned 0x75b1d2d2 [0023.395] GetProcAddress (hModule=0x75ad0000, lpProcName="CreatePenIndirect") returned 0x75af1feb [0023.395] GetProcAddress (hModule=0x75ad0000, lpProcName="CreateFontIndirectW") returned 0x75ae5c19 [0023.395] GetProcAddress (hModule=0x75ad0000, lpProcName="PolyBezier") returned 0x75b15bb3 [0023.395] GetProcAddress (hModule=0x75ad0000, lpProcName="EndDoc") returned 0x75b13f29 [0023.395] GetProcAddress (hModule=0x75ad0000, lpProcName="GetObjectW") returned 0x75ae6c3a [0023.396] GetProcAddress (hModule=0x75ad0000, lpProcName="GetWinMetaFileBits") returned 0x75b1db56 [0023.396] GetProcAddress (hModule=0x75ad0000, lpProcName="SetROP2") returned 0x75aebc54 [0023.396] GetProcAddress (hModule=0x75ad0000, lpProcName="GetEnhMetaFileDescriptionW") returned 0x75b1dff7 [0023.396] GetProcAddress (hModule=0x75ad0000, lpProcName="ArcTo") returned 0x75b142d1 [0023.396] GetProcAddress (hModule=0x75ad0000, lpProcName="Arc") returned 0x75b141df [0023.396] GetProcAddress (hModule=0x75ad0000, lpProcName="SelectPalette") returned 0x75ae5a86 [0023.396] GetProcAddress (hModule=0x75ad0000, lpProcName="ExcludeClipRect") returned 0x75aea066 [0023.396] GetProcAddress (hModule=0x75ad0000, lpProcName="MaskBlt") returned 0x75aec332 [0023.396] GetProcAddress (hModule=0x75ad0000, lpProcName="SetWindowOrgEx") returned 0x75aeaf0a [0023.396] GetProcAddress (hModule=0x75ad0000, lpProcName="EndPage") returned 0x75af6bde [0023.396] GetProcAddress (hModule=0x75ad0000, lpProcName="DeleteEnhMetaFile") returned 0x75af2c80 [0023.396] GetProcAddress (hModule=0x75ad0000, lpProcName="Chord") returned 0x75b1439f [0023.396] GetProcAddress (hModule=0x75ad0000, lpProcName="SetDIBits") returned 0x75ae7590 [0023.396] GetProcAddress (hModule=0x75ad0000, lpProcName="SetViewportOrgEx") returned 0x75ae86cc [0023.397] GetProcAddress (hModule=0x75ad0000, lpProcName="CreateRectRgn") returned 0x75ae77cf [0023.397] GetProcAddress (hModule=0x75ad0000, lpProcName="RealizePalette") returned 0x75aeb001 [0023.397] LoadLibraryA (lpLibFileName="netapi32.dll") returned 0x74ac0000 [0023.397] LoadLibraryA (lpLibFileName="ole32.dll") returned 0x755e0000 [0023.397] LoadLibraryA (lpLibFileName="oleaut32.dll") returned 0x75220000 [0023.397] LoadLibraryA (lpLibFileName="shell32.dll") returned 0x75fd0000 [0023.397] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74f40000 [0023.397] LoadLibraryA (lpLibFileName="version.dll") returned 0x74a70000 [0023.398] LoadLibraryA (lpLibFileName="wininet.dll") returned 0x753d0000 [0023.398] LoadLibraryA (lpLibFileName="winspool.drv") returned 0x74a10000 [0023.398] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x2) returned 1 [0023.504] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x2, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x4) returned 1 [0023.504] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0023.505] SetThreadLocale (Locale=0x400) returned 1 [0023.506] GetVersion () returned 0x1db10106 [0023.506] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0023.506] GetProcAddress (hModule=0x76c20000, lpProcName="GetThreadPreferredUILanguages") returned 0x76cb47a1 [0023.506] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0023.506] GetProcAddress (hModule=0x76c20000, lpProcName="SetThreadPreferredUILanguages") returned 0x76cc79e5 [0023.506] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0023.506] GetProcAddress (hModule=0x76c20000, lpProcName="GetThreadUILanguage") returned 0x76c5cf14 [0023.506] GetSystemInfo (in: lpSystemInfo=0x18fd5c | out: lpSystemInfo=0x18fd5c*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0023.506] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\egui.exe\" " [0023.506] GetStartupInfoW (in: lpStartupInfo=0x18fd38 | out: lpStartupInfo=0x18fd38*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\egui.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x4, hStdOutput=0x24a, hStdError=0x1f80)) [0023.506] GetACP () returned 0x4e4 [0023.506] GetCurrentThreadId () returned 0x970 [0023.506] GetVersion () returned 0x1db10106 [0023.506] GetVersionExW (in: lpVersionInformation=0x18fc7c*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x18fcd0, dwBuildNumber=0x26fe30, dwPlatformId=0x18fd2c, szCSDVersion="͢眖眕﫚眔疖￿￿%") | out: lpVersionInformation=0x18fc7c*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0023.507] GetVersionExW (in: lpVersionInformation=0x18fc7c*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1") | out: lpVersionInformation=0x18fc7c*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0023.507] GetModuleFileNameW (in: hModule=0x400000, lpFilename=0x18db3c, nSize=0x20a | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\egui.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\egui.exe")) returned 0x2e [0023.507] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18d926, nSize=0x105 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\egui.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\egui.exe")) returned 0x2e [0023.507] VirtualAlloc (lpAddress=0x0, dwSize=0x13fff0, flAllocationType=0x1000, flProtect=0x4) returned 0x1f00000 [0023.507] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Embarcadero\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18d8a0 | out: phkResult=0x18d8a0*=0x0) returned 0x2 [0023.507] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Embarcadero\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18d8a0 | out: phkResult=0x18d8a0*=0x0) returned 0x2 [0023.507] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\CodeGear\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18d8a0 | out: phkResult=0x18d8a0*=0x0) returned 0x2 [0023.508] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\CodeGear\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18d8a0 | out: phkResult=0x18d8a0*=0x0) returned 0x2 [0023.508] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Borland\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18d8a0 | out: phkResult=0x18d8a0*=0x0) returned 0x2 [0023.508] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Borland\\Delphi\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18d8a0 | out: phkResult=0x18d8a0*=0x0) returned 0x2 [0023.508] GetUserDefaultUILanguage () returned 0x409 [0023.508] IsValidLocale (Locale=0x409, dwFlags=0x2) returned 1 [0023.508] GetThreadUILanguage () returned 0x180409 [0023.508] GetThreadPreferredUILanguages (in: dwFlags=0x38, pulNumLanguages=0x18d87c, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x18d8a4 | out: pulNumLanguages=0x18d87c, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x18d8a4) returned 1 [0023.508] GetThreadPreferredUILanguages (in: dwFlags=0x38, pulNumLanguages=0x18d87c, pwszLanguagesBuffer=0x202a680, pcchLanguagesBuffer=0x18d8a4 | out: pulNumLanguages=0x18d87c, pwszLanguagesBuffer=0x202a680, pcchLanguagesBuffer=0x18d8a4) returned 1 [0023.508] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\egui.en-US", lpFindFileData=0x18d644 | out: lpFindFileData=0x18d644*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x28c, ftCreationTime.dwHighDateTime=0x1010004, ftLastAccessTime.dwLowDateTime=0x18d588, ftLastAccessTime.dwHighDateTime=0x3, ftLastWriteTime.dwLowDateTime=0x18d8b4, ftLastWriteTime.dwHighDateTime=0x28c, nFileSizeHigh=0x378490, nFileSizeLow=0xfffffffe, dwReserved0=0xe00000e, dwReserved1=0x20c, cFileName="", cAlternateFileName="쀬ȁ떄@+")) returned 0xffffffff [0023.509] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\egui.en", lpFindFileData=0x18d644 | out: lpFindFileData=0x18d644*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x28c, ftCreationTime.dwHighDateTime=0x1010004, ftLastAccessTime.dwLowDateTime=0x18d588, ftLastAccessTime.dwHighDateTime=0x3, ftLastWriteTime.dwLowDateTime=0x18d8b4, ftLastWriteTime.dwHighDateTime=0x28c, nFileSizeHigh=0x378490, nFileSizeLow=0xfffffffe, dwReserved0=0xe00000e, dwReserved1=0x20c, cFileName="", cAlternateFileName="跌ȃ떄@+")) returned 0xffffffff [0023.509] GetUserDefaultUILanguage () returned 0x409 [0023.509] GetLocaleInfoW (in: Locale=0x409, LCType=0x3, lpLCData=0x18d8c0, cchData=4 | out: lpLCData="ENU") returned 4 [0023.509] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\egui.ENU", lpFindFileData=0x18d64c | out: lpFindFileData=0x18d64c*(dwFileAttributes=0x1010004, ftCreationTime.dwLowDateTime=0x18d588, ftCreationTime.dwHighDateTime=0x3, ftLastAccessTime.dwLowDateTime=0x18d8b4, ftLastAccessTime.dwHighDateTime=0x28c, ftLastWriteTime.dwLowDateTime=0x378490, ftLastWriteTime.dwHighDateTime=0xfffffffe, nFileSizeHigh=0xe00000e, nFileSizeLow=0x20c, dwReserved0=0x0, dwReserved1=0x272f18, cFileName="'4쀀", cAlternateFileName="跌ȃ떄@+")) returned 0xffffffff [0023.510] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\egui.EN", lpFindFileData=0x18d64c | out: lpFindFileData=0x18d64c*(dwFileAttributes=0x1010004, ftCreationTime.dwLowDateTime=0x18d588, ftCreationTime.dwHighDateTime=0x3, ftLastAccessTime.dwLowDateTime=0x18d8b4, ftLastAccessTime.dwHighDateTime=0x28c, ftLastWriteTime.dwLowDateTime=0x378490, ftLastWriteTime.dwHighDateTime=0xfffffffe, nFileSizeHigh=0xe00000e, nFileSizeLow=0x20c, dwReserved0=0x0, dwReserved1=0x272f18, cFileName="'4쀀", cAlternateFileName="跌ȃ떄@+")) returned 0xffffffff [0023.510] LoadStringW (in: hInstance=0x400000, uID=0xffb0, lpBuffer=0x18dd6c, cchBufferMax=4096 | out: lpBuffer="Method called on disposed object") returned 0x20 [0023.510] LoadStringW (in: hInstance=0x400000, uID=0xffcf, lpBuffer=0x18dd6c, cchBufferMax=4096 | out: lpBuffer="Feature not implemented") returned 0x17 [0023.510] LoadStringW (in: hInstance=0x400000, uID=0xffce, lpBuffer=0x18dd6c, cchBufferMax=4096 | out: lpBuffer="Monitor support function not initialized") returned 0x28 [0023.510] LoadStringW (in: hInstance=0x400000, uID=0xffcd, lpBuffer=0x18dd6c, cchBufferMax=4096 | out: lpBuffer="Object lock not owned") returned 0x15 [0023.510] LoadStringW (in: hInstance=0x400000, uID=0xffcc, lpBuffer=0x18dd6c, cchBufferMax=4096 | out: lpBuffer="Exception in safecall method") returned 0x1c [0023.510] LoadStringW (in: hInstance=0x400000, uID=0xffcb, lpBuffer=0x18dd6c, cchBufferMax=4096 | out: lpBuffer="Interface not supported") returned 0x17 [0023.510] LoadStringW (in: hInstance=0x400000, uID=0xffc9, lpBuffer=0x18dd6c, cchBufferMax=4096 | out: lpBuffer="External exception %x") returned 0x15 [0023.510] LoadStringW (in: hInstance=0x400000, uID=0xffca, lpBuffer=0x18dd6c, cchBufferMax=4096 | out: lpBuffer="Assertion failed") returned 0x10 [0023.510] LoadStringW (in: hInstance=0x400000, uID=0xffd8, lpBuffer=0x18dd6c, cchBufferMax=4096 | out: lpBuffer="Variant or safe array index out of bounds") returned 0x29 [0023.510] LoadStringW (in: hInstance=0x400000, uID=0xffc5, lpBuffer=0x18dd6c, cchBufferMax=4096 | out: lpBuffer="Invalid argument") returned 0x10 [0023.510] LoadStringW (in: hInstance=0x400000, uID=0xffd7, lpBuffer=0x18dd6c, cchBufferMax=4096 | out: lpBuffer="Error creating variant or safe array") returned 0x24 [0023.510] LoadStringW (in: hInstance=0x400000, uID=0xffd1, lpBuffer=0x18dd6c, cchBufferMax=4096 | out: lpBuffer="Variant method calls not supported") returned 0x22 [0023.510] LoadStringW (in: hInstance=0x400000, uID=0xffdb, lpBuffer=0x18dd6c, cchBufferMax=4096 | out: lpBuffer="Invalid variant operation") returned 0x19 [0023.510] LoadStringW (in: hInstance=0x400000, uID=0xffda, lpBuffer=0x18dd6c, cchBufferMax=4096 | out: lpBuffer="Invalid variant type conversion") returned 0x1f [0023.511] LoadStringW (in: hInstance=0x400000, uID=0xffea, lpBuffer=0x18dd6c, cchBufferMax=4096 | out: lpBuffer="Stack overflow") returned 0xe [0023.511] LoadStringW (in: hInstance=0x400000, uID=0xffeb, lpBuffer=0x18dd6c, cchBufferMax=4096 | out: lpBuffer="Control-C hit") returned 0xd [0023.511] LoadStringW (in: hInstance=0x400000, uID=0xffec, lpBuffer=0x18dd6c, cchBufferMax=4096 | out: lpBuffer="Privileged instruction") returned 0x16 [0023.511] LoadStringW (in: hInstance=0x400000, uID=0xffe9, lpBuffer=0x18dd6c, cchBufferMax=4096 | out: lpBuffer="Access violation") returned 0x10 [0023.511] LoadStringW (in: hInstance=0x400000, uID=0xffe7, lpBuffer=0x18dd6c, cchBufferMax=4096 | out: lpBuffer="Invalid class typecast") returned 0x16 [0023.511] LoadStringW (in: hInstance=0x400000, uID=0xffe5, lpBuffer=0x18dd6c, cchBufferMax=4096 | out: lpBuffer="Floating point underflow") returned 0x18 [0023.511] LoadStringW (in: hInstance=0x400000, uID=0xffe4, lpBuffer=0x18dd6c, cchBufferMax=4096 | out: lpBuffer="Floating point overflow") returned 0x17 [0023.511] LoadStringW (in: hInstance=0x400000, uID=0xffe3, lpBuffer=0x18dd6c, cchBufferMax=4096 | out: lpBuffer="Floating point division by zero") returned 0x1f [0023.511] LoadStringW (in: hInstance=0x400000, uID=0xffe2, lpBuffer=0x18dd6c, cchBufferMax=4096 | out: lpBuffer="Invalid floating point operation") returned 0x20 [0023.511] LoadStringW (in: hInstance=0x400000, uID=0xffe1, lpBuffer=0x18dd6c, cchBufferMax=4096 | out: lpBuffer="Integer overflow") returned 0x10 [0023.511] LoadStringW (in: hInstance=0x400000, uID=0xffe0, lpBuffer=0x18dd6c, cchBufferMax=4096 | out: lpBuffer="Range check error") returned 0x11 [0023.511] LoadStringW (in: hInstance=0x400000, uID=0xffff, lpBuffer=0x18dd6c, cchBufferMax=4096 | out: lpBuffer="Division by zero") returned 0x10 [0023.511] LoadStringW (in: hInstance=0x400000, uID=0xfff6, lpBuffer=0x18dd64, cchBufferMax=4096 | out: lpBuffer="Out of memory") returned 0xd [0023.511] LoadStringW (in: hInstance=0x400000, uID=0xffe6, lpBuffer=0x18dd64, cchBufferMax=4096 | out: lpBuffer="Invalid pointer operation") returned 0x19 [0023.511] GetVersionExW (in: lpVersionInformation=0x18fc78*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x18fc78*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0023.511] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76c20000 [0023.511] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0x272f18 [0023.511] GetProcAddress (hModule=0x76c20000, lpProcName="GetNativeSystemInfo") returned 0x76c410b5 [0023.511] GetNativeSystemInfo (in: lpSystemInfo=0x18fc54 | out: lpSystemInfo=0x18fc54*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0023.511] LoadStringW (in: hInstance=0x400000, uID=0xff3e, lpBuffer=0x18dc3c, cchBufferMax=4096 | out: lpBuffer="Windows") returned 0x7 [0023.511] LoadStringW (in: hInstance=0x400000, uID=0xff21, lpBuffer=0x18dc3c, cchBufferMax=4096 | out: lpBuffer="Windows 7") returned 0x9 [0023.511] LoadStringW (in: hInstance=0x400000, uID=0xfffe, lpBuffer=0x18dd5c, cchBufferMax=4096 | out: lpBuffer="Invalid numeric input") returned 0x15 [0023.512] LoadStringW (in: hInstance=0x400000, uID=0xfffd, lpBuffer=0x18dd5c, cchBufferMax=4096 | out: lpBuffer="Disk full") returned 0x9 [0023.512] LoadStringW (in: hInstance=0x400000, uID=0xfffc, lpBuffer=0x18dd5c, cchBufferMax=4096 | out: lpBuffer="Read beyond end of file") returned 0x17 [0023.512] LoadStringW (in: hInstance=0x400000, uID=0xfffb, lpBuffer=0x18dd5c, cchBufferMax=4096 | out: lpBuffer="File access denied") returned 0x12 [0023.512] LoadStringW (in: hInstance=0x400000, uID=0xfffa, lpBuffer=0x18dd5c, cchBufferMax=4096 | out: lpBuffer="Too many open files") returned 0x13 [0023.512] LoadStringW (in: hInstance=0x400000, uID=0xfff9, lpBuffer=0x18dd5c, cchBufferMax=4096 | out: lpBuffer="Invalid filename") returned 0x10 [0023.512] LoadStringW (in: hInstance=0x400000, uID=0xfff8, lpBuffer=0x18dd5c, cchBufferMax=4096 | out: lpBuffer="File not found") returned 0xe [0023.512] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18fb42, nSize=0x105 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\egui.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\egui.exe")) returned 0x2e [0023.512] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Embarcadero\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18fd50 | out: phkResult=0x18fd50*=0x0) returned 0x2 [0023.512] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Embarcadero\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18fd50 | out: phkResult=0x18fd50*=0x0) returned 0x2 [0023.512] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\CodeGear\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18fd50 | out: phkResult=0x18fd50*=0x0) returned 0x2 [0023.512] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\CodeGear\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18fd50 | out: phkResult=0x18fd50*=0x0) returned 0x2 [0023.512] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Borland\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18fd50 | out: phkResult=0x18fd50*=0x0) returned 0x2 [0023.512] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Borland\\Delphi\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18fd50 | out: phkResult=0x18fd50*=0x0) returned 0x2 [0023.512] GetThreadLocale () returned 0x409 [0023.512] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fc88 | out: lpCPInfo=0x18fc88) returned 1 [0023.512] IsValidLocale (Locale=0x409, dwFlags=0x1) returned 1 [0023.513] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0023.513] GetProcAddress (hModule=0x76c20000, lpProcName="GetLogicalProcessorInformation") returned 0x76cb4761 [0023.513] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76c20000 [0023.513] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0x272f28 [0023.513] GetProcAddress (hModule=0x76c20000, lpProcName="GetLogicalProcessorInformation") returned 0x76cb4761 [0023.513] GetLogicalProcessorInformation (in: Buffer=0x0, ReturnedLength=0x18fbf4 | out: Buffer=0x0, ReturnedLength=0x18fbf4) returned 0 [0023.513] GetLastError () returned 0x7a [0023.513] GetLogicalProcessorInformation (in: Buffer=0x1fe99d0, ReturnedLength=0x18fbf4 | out: Buffer=0x1fe99d0, ReturnedLength=0x18fbf4) returned 1 [0023.513] GetCurrentThreadId () returned 0x970 [0023.513] GetCurrentThreadId () returned 0x970 [0023.513] GetLocaleInfoW (in: Locale=0x409, LCType=0x100b, lpLCData=0x18fa04, cchData=256 | out: lpLCData="2") returned 2 [0023.513] GetThreadLocale () returned 0x409 [0023.513] EnumCalendarInfoW (lpCalInfoEnumProc=0x42c988, Locale=0x409, Calendar=0x2, CalType=0x4) returned 1 [0023.514] GetThreadLocale () returned 0x409 [0023.514] EnumCalendarInfoW (lpCalInfoEnumProc=0x42ca20, Locale=0x409, Calendar=0x2, CalType=0x3) returned 1 [0023.514] GetCurrentThreadId () returned 0x970 [0023.514] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x18f9ec, cchData=256 | out: lpLCData="Sun") returned 4 [0023.514] GetLocaleInfoW (in: Locale=0x409, LCType=0x30, lpLCData=0x18f9ec, cchData=256 | out: lpLCData="Sunday") returned 7 [0023.514] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x18f9ec, cchData=256 | out: lpLCData="Mon") returned 4 [0023.514] GetLocaleInfoW (in: Locale=0x409, LCType=0x2a, lpLCData=0x18f9ec, cchData=256 | out: lpLCData="Monday") returned 7 [0023.514] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x18f9ec, cchData=256 | out: lpLCData="Tue") returned 4 [0023.514] GetLocaleInfoW (in: Locale=0x409, LCType=0x2b, lpLCData=0x18f9ec, cchData=256 | out: lpLCData="Tuesday") returned 8 [0023.514] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x18f9ec, cchData=256 | out: lpLCData="Wed") returned 4 [0023.514] GetLocaleInfoW (in: Locale=0x409, LCType=0x2c, lpLCData=0x18f9ec, cchData=256 | out: lpLCData="Wednesday") returned 10 [0023.514] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x18f9ec, cchData=256 | out: lpLCData="Thu") returned 4 [0023.514] GetLocaleInfoW (in: Locale=0x409, LCType=0x2d, lpLCData=0x18f9ec, cchData=256 | out: lpLCData="Thursday") returned 9 [0023.514] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x18f9ec, cchData=256 | out: lpLCData="Fri") returned 4 [0023.514] GetLocaleInfoW (in: Locale=0x409, LCType=0x2e, lpLCData=0x18f9ec, cchData=256 | out: lpLCData="Friday") returned 7 [0023.514] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x18f9ec, cchData=256 | out: lpLCData="Sat") returned 4 [0023.514] GetLocaleInfoW (in: Locale=0x409, LCType=0x2f, lpLCData=0x18f9ec, cchData=256 | out: lpLCData="Saturday") returned 9 [0023.514] GetLocaleInfoW (in: Locale=0x409, LCType=0x44, lpLCData=0x18f9f0, cchData=256 | out: lpLCData="Jan") returned 4 [0023.514] GetLocaleInfoW (in: Locale=0x409, LCType=0x38, lpLCData=0x18f9f0, cchData=256 | out: lpLCData="January") returned 8 [0023.514] GetLocaleInfoW (in: Locale=0x409, LCType=0x45, lpLCData=0x18f9f0, cchData=256 | out: lpLCData="Feb") returned 4 [0023.514] GetLocaleInfoW (in: Locale=0x409, LCType=0x39, lpLCData=0x18f9f0, cchData=256 | out: lpLCData="February") returned 9 [0023.514] GetLocaleInfoW (in: Locale=0x409, LCType=0x46, lpLCData=0x18f9f0, cchData=256 | out: lpLCData="Mar") returned 4 [0023.514] GetLocaleInfoW (in: Locale=0x409, LCType=0x3a, lpLCData=0x18f9f0, cchData=256 | out: lpLCData="March") returned 6 [0023.514] GetLocaleInfoW (in: Locale=0x409, LCType=0x47, lpLCData=0x18f9f0, cchData=256 | out: lpLCData="Apr") returned 4 [0023.514] GetLocaleInfoW (in: Locale=0x409, LCType=0x3b, lpLCData=0x18f9f0, cchData=256 | out: lpLCData="April") returned 6 [0023.514] GetLocaleInfoW (in: Locale=0x409, LCType=0x48, lpLCData=0x18f9f0, cchData=256 | out: lpLCData="May") returned 4 [0023.514] GetLocaleInfoW (in: Locale=0x409, LCType=0x3c, lpLCData=0x18f9f0, cchData=256 | out: lpLCData="May") returned 4 [0023.514] GetLocaleInfoW (in: Locale=0x409, LCType=0x49, lpLCData=0x18f9f0, cchData=256 | out: lpLCData="Jun") returned 4 [0023.514] GetLocaleInfoW (in: Locale=0x409, LCType=0x3d, lpLCData=0x18f9f0, cchData=256 | out: lpLCData="June") returned 5 [0023.515] GetLocaleInfoW (in: Locale=0x409, LCType=0x4a, lpLCData=0x18f9f0, cchData=256 | out: lpLCData="Jul") returned 4 [0023.515] GetLocaleInfoW (in: Locale=0x409, LCType=0x3e, lpLCData=0x18f9f0, cchData=256 | out: lpLCData="July") returned 5 [0023.515] GetLocaleInfoW (in: Locale=0x409, LCType=0x4b, lpLCData=0x18f9f0, cchData=256 | out: lpLCData="Aug") returned 4 [0023.515] GetLocaleInfoW (in: Locale=0x409, LCType=0x3f, lpLCData=0x18f9f0, cchData=256 | out: lpLCData="August") returned 7 [0023.515] GetLocaleInfoW (in: Locale=0x409, LCType=0x4c, lpLCData=0x18f9f0, cchData=256 | out: lpLCData="Sep") returned 4 [0023.515] GetLocaleInfoW (in: Locale=0x409, LCType=0x40, lpLCData=0x18f9f0, cchData=256 | out: lpLCData="September") returned 10 [0023.515] GetLocaleInfoW (in: Locale=0x409, LCType=0x4d, lpLCData=0x18f9f0, cchData=256 | out: lpLCData="Oct") returned 4 [0023.515] GetLocaleInfoW (in: Locale=0x409, LCType=0x41, lpLCData=0x18f9f0, cchData=256 | out: lpLCData="October") returned 8 [0023.515] GetLocaleInfoW (in: Locale=0x409, LCType=0x4e, lpLCData=0x18f9f0, cchData=256 | out: lpLCData="Nov") returned 4 [0023.515] GetLocaleInfoW (in: Locale=0x409, LCType=0x42, lpLCData=0x18f9f0, cchData=256 | out: lpLCData="November") returned 9 [0023.515] GetLocaleInfoW (in: Locale=0x409, LCType=0x4f, lpLCData=0x18f9f0, cchData=256 | out: lpLCData="Dec") returned 4 [0023.515] GetLocaleInfoW (in: Locale=0x409, LCType=0x43, lpLCData=0x18f9f0, cchData=256 | out: lpLCData="December") returned 9 [0023.515] GetLocaleInfoW (in: Locale=0x409, LCType=0x14, lpLCData=0x18fa40, cchData=256 | out: lpLCData="$") returned 2 [0023.515] GetLocaleInfoW (in: Locale=0x409, LCType=0x1b, lpLCData=0x18fa40, cchData=256 | out: lpLCData="0") returned 2 [0023.515] GetLocaleInfoW (in: Locale=0x409, LCType=0x1c, lpLCData=0x18fa40, cchData=256 | out: lpLCData="0") returned 2 [0023.515] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x18fc38, cchData=2 | out: lpLCData=",") returned 2 [0023.515] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x18fc38, cchData=2 | out: lpLCData=".") returned 2 [0023.515] GetLocaleInfoW (in: Locale=0x409, LCType=0x19, lpLCData=0x18fa40, cchData=256 | out: lpLCData="2") returned 2 [0023.515] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x18fc38, cchData=2 | out: lpLCData="/") returned 2 [0023.515] GetLocaleInfoW (in: Locale=0x409, LCType=0x1f, lpLCData=0x18f9fc, cchData=256 | out: lpLCData="M/d/yyyy") returned 9 [0023.515] GetLocaleInfoW (in: Locale=0x409, LCType=0x1009, lpLCData=0x18f9fc, cchData=256 | out: lpLCData="1") returned 2 [0023.515] GetLocaleInfoW (in: Locale=0x409, LCType=0x20, lpLCData=0x18f9fc, cchData=256 | out: lpLCData="dddd, MMMM dd, yyyy") returned 20 [0023.515] GetLocaleInfoW (in: Locale=0x409, LCType=0x1009, lpLCData=0x18f9fc, cchData=256 | out: lpLCData="1") returned 2 [0023.515] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x18fc38, cchData=2 | out: lpLCData=":") returned 2 [0023.515] GetLocaleInfoW (in: Locale=0x409, LCType=0x28, lpLCData=0x18fa40, cchData=256 | out: lpLCData="AM") returned 3 [0023.515] GetLocaleInfoW (in: Locale=0x409, LCType=0x29, lpLCData=0x18fa40, cchData=256 | out: lpLCData="PM") returned 3 [0023.515] GetLocaleInfoW (in: Locale=0x409, LCType=0x25, lpLCData=0x18fa40, cchData=256 | out: lpLCData="0") returned 2 [0023.515] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x18fa40, cchData=256 | out: lpLCData="0") returned 2 [0023.515] GetLocaleInfoW (in: Locale=0x409, LCType=0x1005, lpLCData=0x18fa40, cchData=256 | out: lpLCData="0") returned 2 [0023.515] GetLocaleInfoW (in: Locale=0x409, LCType=0xc, lpLCData=0x18fc38, cchData=2 | out: lpLCData=",") returned 2 [0023.515] GetModuleHandleW (lpModuleName="oleaut32.dll") returned 0x75220000 [0023.515] GetProcAddress (hModule=0x75220000, lpProcName="VariantChangeTypeEx") returned 0x75224c28 [0023.516] GetProcAddress (hModule=0x75220000, lpProcName="VarNeg") returned 0x7529c802 [0023.516] GetProcAddress (hModule=0x75220000, lpProcName="VarNot") returned 0x7529ec66 [0023.516] GetProcAddress (hModule=0x75220000, lpProcName="VarAdd") returned 0x75245934 [0023.516] GetProcAddress (hModule=0x75220000, lpProcName="VarSub") returned 0x7529d332 [0023.516] GetProcAddress (hModule=0x75220000, lpProcName="VarMul") returned 0x7529dbd4 [0023.516] GetProcAddress (hModule=0x75220000, lpProcName="VarDiv") returned 0x7529e405 [0023.516] GetProcAddress (hModule=0x75220000, lpProcName="VarIdiv") returned 0x7529f00a [0023.516] GetProcAddress (hModule=0x75220000, lpProcName="VarMod") returned 0x7529f15e [0023.516] GetProcAddress (hModule=0x75220000, lpProcName="VarAnd") returned 0x75245a98 [0023.516] GetProcAddress (hModule=0x75220000, lpProcName="VarOr") returned 0x7529ecfa [0023.516] GetProcAddress (hModule=0x75220000, lpProcName="VarXor") returned 0x7529ee2e [0023.516] GetProcAddress (hModule=0x75220000, lpProcName="VarCmp") returned 0x7523b0dc [0023.516] GetProcAddress (hModule=0x75220000, lpProcName="VarI4FromStr") returned 0x75236fab [0023.516] GetProcAddress (hModule=0x75220000, lpProcName="VarR4FromStr") returned 0x752401a0 [0023.517] GetProcAddress (hModule=0x75220000, lpProcName="VarR8FromStr") returned 0x7523699e [0023.517] GetProcAddress (hModule=0x75220000, lpProcName="VarDateFromStr") returned 0x75246ba7 [0023.517] GetProcAddress (hModule=0x75220000, lpProcName="VarCyFromStr") returned 0x75266c12 [0023.517] GetProcAddress (hModule=0x75220000, lpProcName="VarBoolFromStr") returned 0x7523dbd1 [0023.517] GetProcAddress (hModule=0x75220000, lpProcName="VarBstrFromCy") returned 0x75247fdc [0023.517] GetProcAddress (hModule=0x75220000, lpProcName="VarBstrFromDate") returned 0x75237a2a [0023.517] GetProcAddress (hModule=0x75220000, lpProcName="VarBstrFromBool") returned 0x75240355 [0023.517] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0xcc [0023.517] GetACP () returned 0x4e4 [0023.517] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fd38 | out: lpCPInfo=0x18fd38) returned 1 [0023.517] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0xd0 [0023.517] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xd4 [0023.517] LoadStringW (in: hInstance=0x400000, uID=0xff15, lpBuffer=0x18dd6c, cchBufferMax=4096 | out: lpBuffer="Invalid time Offset string: %s") returned 0x1e [0023.517] LoadStringW (in: hInstance=0x400000, uID=0xff14, lpBuffer=0x18dd6c, cchBufferMax=4096 | out: lpBuffer="Invalid time string: %s") returned 0x17 [0023.517] LoadStringW (in: hInstance=0x400000, uID=0xff13, lpBuffer=0x18dd6c, cchBufferMax=4096 | out: lpBuffer="Invalid date string: %s") returned 0x17 [0023.517] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd68 | out: lpPerformanceCount=0x18fd68*=14378209567) returned 1 [0023.519] GetDC (hWnd=0x0) returned 0x32010824 [0023.519] GetDeviceCaps (hdc=0x32010824, index=90) returned 96 [0023.519] ReleaseDC (hWnd=0x0, hDC=0x32010824) returned 1 [0023.519] GetDC (hWnd=0x0) returned 0x32010824 [0023.519] GetDeviceCaps (hdc=0x32010824, index=104) returned 0 [0023.519] ReleaseDC (hWnd=0x0, hDC=0x32010824) returned 1 [0023.519] CreatePalette (plpal=0x18f978) returned 0xffffffffc1080847 [0023.519] GetStockObject (i=7) returned 0x1b00017 [0023.519] GetStockObject (i=5) returned 0x1900015 [0023.519] GetStockObject (i=13) returned 0x18a002e [0023.519] LoadIconW (hInstance=0x0, lpIconName=0x7f00) returned 0x10027 [0023.519] MulDiv (nNumber=8, nNumerator=96, nDenominator=72) returned 11 [0023.519] GetCurrentThreadId () returned 0x970 [0023.519] GetCurrentThreadId () returned 0x970 [0023.519] GetVersionExW (in: lpVersionInformation=0x18fb48*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x74fc0a54, dwMinorVersion=0x3, dwBuildNumber=0x7f00, dwPlatformId=0x2c0001, szCSDVersion="") | out: lpVersionInformation=0x18fb48*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0023.519] GetCurrentThreadId () returned 0x970 [0023.520] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes", ulOptions=0x0, samDesired=0x20019, phkResult=0x18fc58 | out: phkResult=0x18fc58*=0xd8) returned 0x0 [0023.520] RegQueryValueExW (in: hKey=0xd8, lpValueName="MS Shell Dlg 2", lpReserved=0x0, lpType=0x18fc2c, lpData=0x0, lpcbData=0x18fc44*=0x0 | out: lpType=0x18fc2c*=0x1, lpData=0x0, lpcbData=0x18fc44*=0xe) returned 0x0 [0023.520] RegQueryValueExW (in: hKey=0xd8, lpValueName="MS Shell Dlg 2", lpReserved=0x0, lpType=0x18fc40, lpData=0x1fe28ec, lpcbData=0x18fc50*=0xe | out: lpType=0x18fc40*=0x1, lpData="Tahoma", lpcbData=0x18fc50*=0xe) returned 0x0 [0023.520] RegCloseKey (hKey=0xd8) returned 0x0 [0023.520] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Tahoma", cchWideChar=6, lpMultiByteStr=0x18fc85, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Tahoma", lpUsedDefaultChar=0x0) returned 6 [0023.520] GetCurrentThreadId () returned 0x970 [0023.520] GetCurrentThreadId () returned 0x970 [0023.520] GetCurrentThreadId () returned 0x970 [0023.520] GetCurrentThreadId () returned 0x970 [0023.520] GetCurrentThreadId () returned 0x970 [0023.520] GetCurrentThreadId () returned 0x970 [0023.520] GetCurrentThreadId () returned 0x970 [0023.520] GetCurrentThreadId () returned 0x970 [0023.520] GetCurrentThreadId () returned 0x970 [0023.520] GetCurrentThreadId () returned 0x970 [0023.520] GetCurrentThreadId () returned 0x970 [0023.520] GetCurrentThreadId () returned 0x970 [0023.520] GetCurrentThreadId () returned 0x970 [0023.520] GetCurrentThreadId () returned 0x970 [0023.520] GetCurrentThreadId () returned 0x970 [0023.520] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0023.521] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="InitializeConditionVariable", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0023.521] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="InitializeConditionVariable", cchWideChar=27, lpMultiByteStr=0x1fff5ac, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="InitializeConditionVariable", lpUsedDefaultChar=0x0) returned 27 [0023.521] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeConditionVariable") returned 0x77168456 [0023.521] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WakeConditionVariable", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0023.521] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WakeConditionVariable", cchWideChar=21, lpMultiByteStr=0x1ff826c, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WakeConditionVariable", lpUsedDefaultChar=0x0) returned 21 [0023.521] GetProcAddress (hModule=0x76c20000, lpProcName="WakeConditionVariable") returned 0x771d7de4 [0023.521] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WakeAllConditionVariable", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0023.521] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WakeAllConditionVariable", cchWideChar=24, lpMultiByteStr=0x1fff5ac, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WakeAllConditionVariable", lpUsedDefaultChar=0x0) returned 24 [0023.521] GetProcAddress (hModule=0x76c20000, lpProcName="WakeAllConditionVariable") returned 0x7719409d [0023.521] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SleepConditionVariableCS", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0023.521] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SleepConditionVariableCS", cchWideChar=24, lpMultiByteStr=0x1fff5ac, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SleepConditionVariableCS", lpUsedDefaultChar=0x0) returned 24 [0023.521] GetProcAddress (hModule=0x76c20000, lpProcName="SleepConditionVariableCS") returned 0x76cb4b32 [0023.521] GetCurrentThreadId () returned 0x970 [0023.521] GetCurrentThreadId () returned 0x970 [0023.521] GetCurrentThreadId () returned 0x970 [0023.521] GetCurrentThreadId () returned 0x970 [0023.521] GetCurrentThreadId () returned 0x970 [0023.521] GetCurrentThreadId () returned 0x970 [0023.521] GetCurrentThreadId () returned 0x970 [0023.521] GetCurrentThreadId () returned 0x970 [0023.521] GetCurrentThreadId () returned 0x970 [0023.521] GetCurrentThreadId () returned 0x970 [0023.521] GetCurrentThreadId () returned 0x970 [0023.521] GetCurrentThreadId () returned 0x970 [0023.521] GetModuleHandleW (lpModuleName="ole32.dll") returned 0x755e0000 [0023.522] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CoCreateInstanceEx", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0023.522] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CoCreateInstanceEx", cchWideChar=18, lpMultiByteStr=0x1ff8294, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CoCreateInstanceEx", lpUsedDefaultChar=0x0) returned 18 [0023.522] GetProcAddress (hModule=0x755e0000, lpProcName="CoCreateInstanceEx") returned 0x75629d4e [0023.522] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CoInitializeEx", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0023.522] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CoInitializeEx", cchWideChar=14, lpMultiByteStr=0x1fe294c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CoInitializeEx", lpUsedDefaultChar=0x0) returned 14 [0023.522] GetProcAddress (hModule=0x755e0000, lpProcName="CoInitializeEx") returned 0x756209ad [0023.522] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CoAddRefServerProcess", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0023.522] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CoAddRefServerProcess", cchWideChar=21, lpMultiByteStr=0x1ff8294, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CoAddRefServerProcess", lpUsedDefaultChar=0x0) returned 21 [0023.522] GetProcAddress (hModule=0x755e0000, lpProcName="CoAddRefServerProcess") returned 0x75643cf3 [0023.522] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CoReleaseServerProcess", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0023.522] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CoReleaseServerProcess", cchWideChar=22, lpMultiByteStr=0x1ff8294, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CoReleaseServerProcess", lpUsedDefaultChar=0x0) returned 22 [0023.522] GetProcAddress (hModule=0x755e0000, lpProcName="CoReleaseServerProcess") returned 0x75644314 [0023.522] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CoResumeClassObjects", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0023.522] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CoResumeClassObjects", cchWideChar=20, lpMultiByteStr=0x1ff8294, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CoResumeClassObjects", lpUsedDefaultChar=0x0) returned 20 [0023.522] GetProcAddress (hModule=0x755e0000, lpProcName="CoResumeClassObjects") returned 0x755eea02 [0023.522] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CoSuspendClassObjects", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0023.522] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CoSuspendClassObjects", cchWideChar=21, lpMultiByteStr=0x1ff8294, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CoSuspendClassObjects", lpUsedDefaultChar=0x0) returned 21 [0023.522] GetProcAddress (hModule=0x755e0000, lpProcName="CoSuspendClassObjects") returned 0x7564bb02 [0023.522] SetErrorMode (uMode=0x8000) returned 0x0 [0023.522] LoadLibraryW (lpLibFileName="Msctf.dll") returned 0x75150000 [0023.522] SetErrorMode (uMode=0x0) returned 0x8000 [0023.523] GetVersion () returned 0x1db10106 [0023.523] GetCurrentProcessId () returned 0x96c [0023.523] GlobalAddAtomW (lpString="Delphi0000096C") returned 0xc15f [0023.523] GetCurrentThreadId () returned 0x970 [0023.523] GlobalAddAtomW (lpString="ControlOfs0040000000000970") returned 0xc15e [0023.523] RegisterClipboardFormatW (lpszFormat="DelphiRM_GetObjectInstance") returned 0xc13d [0023.523] SetErrorMode (uMode=0x8000) returned 0x0 [0023.523] LoadLibraryW (lpLibFileName="imm32.dll") returned 0x75b60000 [0023.523] SetErrorMode (uMode=0x0) returned 0x8000 [0023.523] GetSystemMetrics (nIndex=19) returned 1 [0023.768] GetSystemMetrics (nIndex=75) returned 1 [0023.768] SystemParametersInfoW (in: uiAction=0x68, uiParam=0x0, pvParam=0x2031c60, fWinIni=0x0 | out: pvParam=0x2031c60) returned 1 [0023.768] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0023.768] LoadCursorW (hInstance=0x0, lpCursorName=0x7f86) returned 0x10015 [0023.768] LoadCursorW (hInstance=0x0, lpCursorName=0x7f89) returned 0x1001f [0023.768] LoadCursorW (hInstance=0x0, lpCursorName=0x7f8b) returned 0x1001b [0023.768] LoadCursorW (hInstance=0x0, lpCursorName=0x7f8a) returned 0x10019 [0023.768] LoadCursorW (hInstance=0x0, lpCursorName=0x7f88) returned 0x10017 [0023.768] LoadCursorW (hInstance=0x400000, lpCursorName=0x7ffa) returned 0xa0103 [0023.769] LoadCursorW (hInstance=0x400000, lpCursorName=0x7ffb) returned 0xd01a1 [0023.769] LoadCursorW (hInstance=0x400000, lpCursorName=0x7ffc) returned 0xe0157 [0023.769] LoadCursorW (hInstance=0x400000, lpCursorName=0x7ffd) returned 0x50113 [0023.769] LoadCursorW (hInstance=0x400000, lpCursorName=0x7fff) returned 0x1600f9 [0023.770] LoadCursorW (hInstance=0x400000, lpCursorName=0x7ffe) returned 0x800eb [0023.770] LoadCursorW (hInstance=0x0, lpCursorName=0x7f02) returned 0x10007 [0023.770] LoadCursorW (hInstance=0x0, lpCursorName=0x7f04) returned 0x1000b [0023.770] LoadCursorW (hInstance=0x0, lpCursorName=0x7f84) returned 0x10011 [0023.770] LoadCursorW (hInstance=0x0, lpCursorName=0x7f82) returned 0x1000d [0023.770] LoadCursorW (hInstance=0x0, lpCursorName=0x7f85) returned 0x10013 [0023.770] LoadCursorW (hInstance=0x0, lpCursorName=0x7f83) returned 0x1000f [0023.770] LoadCursorW (hInstance=0x0, lpCursorName=0x7f86) returned 0x10015 [0023.770] LoadCursorW (hInstance=0x0, lpCursorName=0x7f01) returned 0x10005 [0023.770] LoadCursorW (hInstance=0x0, lpCursorName=0x7f03) returned 0x10009 [0023.770] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0023.770] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0023.770] GetDC (hWnd=0x0) returned 0x32010824 [0023.770] GetDeviceCaps (hdc=0x32010824, index=90) returned 96 [0023.770] ReleaseDC (hWnd=0x0, hDC=0x32010824) returned 1 [0023.770] EnumDisplayMonitors (hdc=0x0, lprcClip=0x0, lpfnEnum=0x5d1cd8, dwData=0x1fe9dc0) returned 1 [0023.770] GetCurrentThread () returned 0xfffffffe [0023.771] GetCurrentThreadId () returned 0x970 [0023.771] GetCurrentThreadId () returned 0x970 [0023.771] GetCurrentThreadId () returned 0x970 [0023.771] GetCurrentThreadId () returned 0x970 [0023.771] SystemParametersInfoW (in: uiAction=0x1f, uiParam=0x5c, pvParam=0x18fcbc, fWinIni=0x0 | out: pvParam=0x18fcbc) returned 1 [0023.771] CreateFontIndirectW (lplf=0x18fcbc) returned 0x530a0273 [0023.771] GetObjectW (in: h=0x530a0273, c=92, pv=0x18f9b4 | out: pv=0x18f9b4) returned 92 [0023.771] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Segoe UI", cchWideChar=8, lpMultiByteStr=0x18f8b5, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Segoe UI", lpUsedDefaultChar=0x0) returned 8 [0023.771] SystemParametersInfoW (in: uiAction=0x29, uiParam=0x0, pvParam=0x18fac4, fWinIni=0x0 | out: pvParam=0x18fac4) returned 1 [0023.771] CreateFontIndirectW (lplf=0x18fc00) returned 0x220a0274 [0023.771] GetObjectW (in: h=0x220a0274, c=92, pv=0x18f9b4 | out: pv=0x18f9b4) returned 92 [0023.771] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Segoe UI", cchWideChar=8, lpMultiByteStr=0x18f8b5, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Segoe UI", lpUsedDefaultChar=0x0) returned 8 [0023.771] CreateFontIndirectW (lplf=0x18fba4) returned 0x820a07c0 [0023.771] GetObjectW (in: h=0x820a07c0, c=92, pv=0x18f9b4 | out: pv=0x18f9b4) returned 92 [0023.771] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Segoe UI", cchWideChar=8, lpMultiByteStr=0x18f8b5, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Segoe UI", lpUsedDefaultChar=0x0) returned 8 [0023.772] CreateFontIndirectW (lplf=0x18fc5c) returned 0x2b0a019e [0023.772] GetObjectW (in: h=0x2b0a019e, c=92, pv=0x18f9b4 | out: pv=0x18f9b4) returned 92 [0023.772] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Segoe UI", cchWideChar=8, lpMultiByteStr=0x18f8b5, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Segoe UI", lpUsedDefaultChar=0x0) returned 8 [0023.772] CreateFontIndirectW (lplf=0x18fadc) returned 0x430a0763 [0023.772] GetObjectW (in: h=0x430a0763, c=92, pv=0x18f9b4 | out: pv=0x18f9b4) returned 92 [0023.772] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Segoe UI", cchWideChar=8, lpMultiByteStr=0x18f8b5, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Segoe UI", lpUsedDefaultChar=0x0) returned 8 [0023.772] OleInitialize (pvReserved=0x0) returned 0x0 [0023.775] LoadIconW (hInstance=0x400000, lpIconName="MAINICON") returned 0x17009f [0023.775] GetIconInfo (in: hIcon=0x17009f, piconinfo=0x18fb08 | out: piconinfo=0x18fb08) returned 1 [0023.775] GetObjectW (in: h=0x28050255, c=24, pv=0x18faf0 | out: pv=0x18faf0) returned 24 [0023.775] DeleteObject (ho=0xc050826) returned 1 [0023.775] DeleteObject (ho=0x28050255) returned 1 [0023.775] GetModuleFileNameW (in: hModule=0x400000, lpFilename=0x18fb42, nSize=0x100 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\egui.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\egui.exe")) returned 0x2e [0023.776] GetClassInfoW (in: hInstance=0x400000, lpClassName="TPUtilWindow", lpWndClass=0x18fae0 | out: lpWndClass=0x18fae0) returned 0 [0023.776] RegisterClassW (lpWndClass=0x66b818) returned 0xc136 [0023.776] CreateWindowExW (dwExStyle=0x80, lpClassName="TPUtilWindow", lpWindowName="", dwStyle=0x80000000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x401b6 [0023.777] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x40) returned 0x1b0000 [0023.778] SetWindowLongW (hWnd=0x401b6, nIndex=-4, dwNewLong=1773551) returned 4285616 [0023.778] GetClassInfoW (in: hInstance=0x400000, lpClassName="TApplication", lpWndClass=0x18faf8 | out: lpWndClass=0x18faf8) returned 0 [0023.778] RegisterClassW (lpWndClass=0x66c87c) returned 0xc059 [0023.778] GetSystemMetrics (nIndex=0) returned 1440 [0023.778] GetSystemMetrics (nIndex=1) returned 900 [0023.778] CreateWindowExW (dwExStyle=0x80, lpClassName="TApplication", lpWindowName="egui", dwStyle=0x84ca0000, X=720, Y=450, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x301ba [0023.864] LoadLibraryA (lpLibFileName="wtsapi32.dll") returned 0x74a00000 [0023.920] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0x283cd0 [0023.920] GetProcAddress (hModule=0x74a00000, lpProcName="WTSRegisterSessionNotification") returned 0x74a01cbc [0023.920] WTSRegisterSessionNotification (hWnd=0x301ba, dwFlags=0x0) returned 1 [0024.012] LoadLibraryA (lpLibFileName="uxtheme.dll") returned 0x745e0000 [0024.012] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0x287ad8 [0024.012] GetProcAddress (hModule=0x745e0000, lpProcName="BufferedPaintInit") returned 0x745fb8d4 [0024.012] BufferedPaintInit () returned 0x0 [0024.012] SetWindowLongW (hWnd=0x301ba, nIndex=-4, dwNewLong=1773538) returned 4285616 [0024.012] SendMessageW (hWnd=0x301ba, Msg=0x80, wParam=0x1, lParam=0x17009f) returned 0x0 [0024.013] NtdllDefWindowProc_W () returned 0x0 [0024.030] SetClassLongW (hWnd=0x301ba, nIndex=-14, dwNewLong=1507487) returned 0x0 [0024.030] GetSystemMenu (hWnd=0x301ba, bRevert=0) returned 0x30175 [0024.032] DeleteMenu (hMenu=0x30175, uPosition=0xf030, uFlags=0x0) returned 1 [0024.032] DeleteMenu (hMenu=0x30175, uPosition=0xf000, uFlags=0x0) returned 1 [0024.032] DeleteMenu (hMenu=0x30175, uPosition=0xf010, uFlags=0x0) returned 1 [0024.032] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="", cchWideChar=0, lpMultiByteStr=0x18fb9d, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 0 [0024.032] GetCurrentThreadId () returned 0x970 [0024.033] GetCurrentThreadId () returned 0x970 [0024.033] GetCurrentThreadId () returned 0x970 [0024.034] GetModuleHandleW (lpModuleName="USER32") returned 0x74f40000 [0024.034] GetCurrentThreadId () returned 0x970 [0024.034] GetCurrentThreadId () returned 0x970 [0024.034] GetCurrentThreadId () returned 0x970 [0024.034] GetCurrentThreadId () returned 0x970 [0024.034] GetCurrentThreadId () returned 0x970 [0024.034] GetCurrentThreadId () returned 0x970 [0024.034] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AnimateWindow", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0024.034] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AnimateWindow", cchWideChar=13, lpMultiByteStr=0x1fe2a8c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AnimateWindow", lpUsedDefaultChar=0x0) returned 13 [0024.034] GetProcAddress (hModule=0x74f40000, lpProcName="AnimateWindow") returned 0x74f6b531 [0024.034] GetCurrentThreadId () returned 0x970 [0024.034] GetCurrentThreadId () returned 0x970 [0024.034] GetCurrentThreadId () returned 0x970 [0024.034] GetCurrentThreadId () returned 0x970 [0024.034] GetCurrentThreadId () returned 0x970 [0024.034] GetCurrentThreadId () returned 0x970 [0024.034] GetCurrentThreadId () returned 0x970 [0024.034] GetCurrentThreadId () returned 0x970 [0024.034] GetCurrentThreadId () returned 0x970 [0024.034] GetCurrentThreadId () returned 0x970 [0024.034] GetCurrentThreadId () returned 0x970 [0024.034] GetCurrentThreadId () returned 0x970 [0024.034] GetCurrentThreadId () returned 0x970 [0024.034] GetCurrentThreadId () returned 0x970 [0024.034] GetCurrentThreadId () returned 0x970 [0024.034] GetCurrentThreadId () returned 0x970 [0024.034] GetCurrentThreadId () returned 0x970 [0024.034] GetCurrentThreadId () returned 0x970 [0024.034] GetCurrentThreadId () returned 0x970 [0024.034] GetCurrentThreadId () returned 0x970 [0024.034] GetCurrentThreadId () returned 0x970 [0024.034] GetCurrentThreadId () returned 0x970 [0024.034] GetCurrentThreadId () returned 0x970 [0024.034] GetCurrentThreadId () returned 0x970 [0024.034] GetCurrentThreadId () returned 0x970 [0024.035] GetCurrentThreadId () returned 0x970 [0024.035] GetCurrentThreadId () returned 0x970 [0024.035] GetCurrentThreadId () returned 0x970 [0024.035] GetCurrentThreadId () returned 0x970 [0024.035] GetCurrentThreadId () returned 0x970 [0024.035] RegisterClipboardFormatW (lpszFormat="TaskbarCreated") returned 0xc0c1 [0024.035] LoadStringW (in: hInstance=0x400000, uID=0xfeb6, lpBuffer=0x18dd6c, cchBufferMax=4096 | out: lpBuffer="Alt+") returned 0x4 [0024.035] LoadStringW (in: hInstance=0x400000, uID=0xfeb5, lpBuffer=0x18dd6c, cchBufferMax=4096 | out: lpBuffer="Ctrl+") returned 0x5 [0024.035] LoadStringW (in: hInstance=0x400000, uID=0xfeb4, lpBuffer=0x18dd6c, cchBufferMax=4096 | out: lpBuffer="Shift+") returned 0x6 [0024.035] LoadStringW (in: hInstance=0x400000, uID=0xfeb3, lpBuffer=0x18dd6c, cchBufferMax=4096 | out: lpBuffer="Del") returned 0x3 [0024.035] LoadStringW (in: hInstance=0x400000, uID=0xfeb2, lpBuffer=0x18dd6c, cchBufferMax=4096 | out: lpBuffer="Ins") returned 0x3 [0024.035] LoadStringW (in: hInstance=0x400000, uID=0xfeb1, lpBuffer=0x18dd6c, cchBufferMax=4096 | out: lpBuffer="Down") returned 0x4 [0024.035] LoadStringW (in: hInstance=0x400000, uID=0xfeb0, lpBuffer=0x18dd6c, cchBufferMax=4096 | out: lpBuffer="Right") returned 0x5 [0024.035] LoadStringW (in: hInstance=0x400000, uID=0xfecf, lpBuffer=0x18dd6c, cchBufferMax=4096 | out: lpBuffer="Up") returned 0x2 [0024.035] LoadStringW (in: hInstance=0x400000, uID=0xfece, lpBuffer=0x18dd6c, cchBufferMax=4096 | out: lpBuffer="Left") returned 0x4 [0024.035] LoadStringW (in: hInstance=0x400000, uID=0xfecd, lpBuffer=0x18dd6c, cchBufferMax=4096 | out: lpBuffer="Home") returned 0x4 [0024.035] LoadStringW (in: hInstance=0x400000, uID=0xfecc, lpBuffer=0x18dd6c, cchBufferMax=4096 | out: lpBuffer="End") returned 0x3 [0024.035] LoadStringW (in: hInstance=0x400000, uID=0xfecb, lpBuffer=0x18dd6c, cchBufferMax=4096 | out: lpBuffer="PgDn") returned 0x4 [0024.035] LoadStringW (in: hInstance=0x400000, uID=0xfeca, lpBuffer=0x18dd6c, cchBufferMax=4096 | out: lpBuffer="PgUp") returned 0x4 [0024.035] LoadStringW (in: hInstance=0x400000, uID=0xfec9, lpBuffer=0x18dd6c, cchBufferMax=4096 | out: lpBuffer="Space") returned 0x5 [0024.035] LoadStringW (in: hInstance=0x400000, uID=0xfec8, lpBuffer=0x18dd6c, cchBufferMax=4096 | out: lpBuffer="Enter") returned 0x5 [0024.035] LoadStringW (in: hInstance=0x400000, uID=0xfec7, lpBuffer=0x18dd6c, cchBufferMax=4096 | out: lpBuffer="Esc") returned 0x3 [0024.035] LoadStringW (in: hInstance=0x400000, uID=0xfec6, lpBuffer=0x18dd6c, cchBufferMax=4096 | out: lpBuffer="Tab") returned 0x3 [0024.035] LoadStringW (in: hInstance=0x400000, uID=0xfec5, lpBuffer=0x18dd6c, cchBufferMax=4096 | out: lpBuffer="BkSp") returned 0x4 [0024.035] GetCurrentThreadId () returned 0x970 [0024.035] GetCurrentThreadId () returned 0x970 [0024.035] GetCurrentThreadId () returned 0x970 [0024.035] GetCurrentThreadId () returned 0x970 [0024.035] GetCurrentThreadId () returned 0x970 [0024.035] GetCurrentThreadId () returned 0x970 [0024.035] GetCurrentThreadId () returned 0x970 [0024.035] GetCurrentThreadId () returned 0x970 [0024.035] GetCurrentThreadId () returned 0x970 [0024.035] GetCurrentThreadId () returned 0x970 [0024.035] GetCurrentThreadId () returned 0x970 [0024.035] GetCurrentThreadId () returned 0x970 [0024.035] GetCurrentThreadId () returned 0x970 [0024.035] GetCurrentThreadId () returned 0x970 [0024.036] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x5b5cdd, cbMultiByte=9, lpWideCharStr=0x1ff844c, cchWideChar=10 | out: lpWideCharStr="TMenuItem") returned 9 [0024.036] CharLowerBuffW (in: lpsz="TMenuItem", cchLength=0x9 | out: lpsz="tmenuitem") returned 0x9 [0024.036] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x49dcb3, cbMultiByte=10, lpWideCharStr=0x1ff8474, cchWideChar=11 | out: lpWideCharStr="TComponent") returned 10 [0024.036] CharLowerBuffW (in: lpsz="TComponent", cchLength=0xa | out: lpsz="tcomponent") returned 0xa [0024.036] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x491131, cbMultiByte=11, lpWideCharStr=0x1ff849c, cchWideChar=12 | out: lpWideCharStr="TPersistent") returned 11 [0024.036] CharLowerBuffW (in: lpsz="TPersistent", cchLength=0xb | out: lpsz="tpersistent") returned 0xb [0024.036] CharLowerBuffW (in: lpsz="TPersistent", cchLength=0xb | out: lpsz="tpersistent") returned 0xb [0024.036] GetCurrentThreadId () returned 0x970 [0024.036] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x74ae0000 [0024.036] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="InitializeFlatSB", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0024.036] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="InitializeFlatSB", cchWideChar=16, lpMultiByteStr=0x1ff84c4, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="InitializeFlatSB", lpUsedDefaultChar=0x0) returned 16 [0024.036] GetProcAddress (hModule=0x74ae0000, lpProcName="InitializeFlatSB") returned 0x74b1266f [0024.036] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="UninitializeFlatSB", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0024.036] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="UninitializeFlatSB", cchWideChar=18, lpMultiByteStr=0x1ff84c4, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UninitializeFlatSB", lpUsedDefaultChar=0x0) returned 18 [0024.036] GetProcAddress (hModule=0x74ae0000, lpProcName="UninitializeFlatSB") returned 0x74b12542 [0024.036] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FlatSB_GetScrollProp", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0024.036] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FlatSB_GetScrollProp", cchWideChar=20, lpMultiByteStr=0x1ff84c4, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FlatSB_GetScrollProp", lpUsedDefaultChar=0x0) returned 20 [0024.036] GetProcAddress (hModule=0x74ae0000, lpProcName="FlatSB_GetScrollProp") returned 0x74b11d29 [0024.036] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FlatSB_SetScrollProp", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0024.036] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FlatSB_SetScrollProp", cchWideChar=20, lpMultiByteStr=0x1ff84c4, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FlatSB_SetScrollProp", lpUsedDefaultChar=0x0) returned 20 [0024.037] GetProcAddress (hModule=0x74ae0000, lpProcName="FlatSB_SetScrollProp") returned 0x74b1238d [0024.037] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FlatSB_EnableScrollBar", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0024.037] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FlatSB_EnableScrollBar", cchWideChar=22, lpMultiByteStr=0x1ff84c4, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FlatSB_EnableScrollBar", lpUsedDefaultChar=0x0) returned 22 [0024.037] GetProcAddress (hModule=0x74ae0000, lpProcName="FlatSB_EnableScrollBar") returned 0x74b120c9 [0024.037] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FlatSB_ShowScrollBar", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0024.037] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FlatSB_ShowScrollBar", cchWideChar=20, lpMultiByteStr=0x1ff84c4, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FlatSB_ShowScrollBar", lpUsedDefaultChar=0x0) returned 20 [0024.037] GetProcAddress (hModule=0x74ae0000, lpProcName="FlatSB_ShowScrollBar") returned 0x74b11fdb [0024.037] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FlatSB_GetScrollRange", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0024.037] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FlatSB_GetScrollRange", cchWideChar=21, lpMultiByteStr=0x1ff84c4, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FlatSB_GetScrollRange", lpUsedDefaultChar=0x0) returned 21 [0024.037] GetProcAddress (hModule=0x74ae0000, lpProcName="FlatSB_GetScrollRange") returned 0x74b11e8d [0024.037] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FlatSB_GetScrollInfo", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0024.037] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FlatSB_GetScrollInfo", cchWideChar=20, lpMultiByteStr=0x1ff84c4, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FlatSB_GetScrollInfo", lpUsedDefaultChar=0x0) returned 20 [0024.037] GetProcAddress (hModule=0x74ae0000, lpProcName="FlatSB_GetScrollInfo") returned 0x74b11f0f [0024.037] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FlatSB_GetScrollPos", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0024.037] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FlatSB_GetScrollPos", cchWideChar=19, lpMultiByteStr=0x1ff84c4, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FlatSB_GetScrollPos", lpUsedDefaultChar=0x0) returned 19 [0024.037] GetProcAddress (hModule=0x74ae0000, lpProcName="FlatSB_GetScrollPos") returned 0x74b11ccd [0024.037] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FlatSB_SetScrollPos", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0024.037] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FlatSB_SetScrollPos", cchWideChar=19, lpMultiByteStr=0x1ff84c4, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FlatSB_SetScrollPos", lpUsedDefaultChar=0x0) returned 19 [0024.037] GetProcAddress (hModule=0x74ae0000, lpProcName="FlatSB_SetScrollPos") returned 0x74b1216d [0024.038] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FlatSB_SetScrollInfo", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0024.038] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FlatSB_SetScrollInfo", cchWideChar=20, lpMultiByteStr=0x1ff84c4, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FlatSB_SetScrollInfo", lpUsedDefaultChar=0x0) returned 20 [0024.038] GetProcAddress (hModule=0x74ae0000, lpProcName="FlatSB_SetScrollInfo") returned 0x74b122be [0024.038] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FlatSB_SetScrollRange", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0024.038] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FlatSB_SetScrollRange", cchWideChar=21, lpMultiByteStr=0x1ff84c4, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FlatSB_SetScrollRange", lpUsedDefaultChar=0x0) returned 21 [0024.039] GetProcAddress (hModule=0x74ae0000, lpProcName="FlatSB_SetScrollRange") returned 0x74b121e2 [0024.039] RegisterClipboardFormatW (lpszFormat="Delphi Picture") returned 0xc137 [0024.039] RegisterClipboardFormatW (lpszFormat="Delphi Component") returned 0xc138 [0024.039] GetModuleHandleW (lpModuleName="user32.dll") returned 0x74f40000 [0024.039] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SetLayeredWindowAttributes", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0024.039] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SetLayeredWindowAttributes", cchWideChar=26, lpMultiByteStr=0x1fffa5c, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SetLayeredWindowAttributes", lpUsedDefaultChar=0x0) returned 26 [0024.039] GetProcAddress (hModule=0x74f40000, lpProcName="SetLayeredWindowAttributes") returned 0x74f7ec88 [0024.039] RegisterClipboardFormatW (lpszFormat="TaskbarCreated") returned 0xc0c1 [0024.039] RegisterClipboardFormatW (lpszFormat="TaskbarButtonCreated") returned 0xc091 [0024.039] RegisterClipboardFormatW (lpszFormat="commdlg_help") returned 0xc0ed [0024.039] RegisterClipboardFormatW (lpszFormat="commdlg_FindReplace") returned 0xc0fe [0024.039] GetCurrentThreadId () returned 0x970 [0024.039] GlobalAddAtomW (lpString="WndProcPtr0040000000000970") returned 0xc15d [0024.039] GetCurrentThreadId () returned 0x970 [0024.039] GetCurrentThreadId () returned 0x970 [0024.039] GetCurrentThreadId () returned 0x970 [0024.039] GetCurrentThreadId () returned 0x970 [0024.039] GetCurrentThreadId () returned 0x970 [0024.039] GetCurrentThreadId () returned 0x970 [0024.039] GetCurrentThreadId () returned 0x970 [0024.039] GetCurrentThreadId () returned 0x970 [0024.039] CharLowerBuffW (in: lpsz="TComponent", cchLength=0xa | out: lpsz="tcomponent") returned 0xa [0024.039] CharLowerBuffW (in: lpsz="TPersistent", cchLength=0xb | out: lpsz="tpersistent") returned 0xb [0024.039] GetCurrentThreadId () returned 0x970 [0024.039] GetCurrentThreadId () returned 0x970 [0024.039] GetCurrentThreadId () returned 0x970 [0024.040] CharLowerBuffW (in: lpsz="TComponent", cchLength=0xa | out: lpsz="tcomponent") returned 0xa [0024.040] CharLowerBuffW (in: lpsz="TPersistent", cchLength=0xb | out: lpsz="tpersistent") returned 0xb [0024.040] GetCurrentThreadId () returned 0x970 [0024.040] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x5fe21a, cbMultiByte=16, lpWideCharStr=0x2031de4, cchWideChar=17 | out: lpWideCharStr="TCipher_Rijndael") returned 16 [0024.040] GetUserDefaultLCID () returned 0x409 [0024.040] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="", cchCount1=1, lpString2="", cchCount2=1) returned 2 [0024.041] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="\x01", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.042] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="\x02", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.042] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="\x03", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.042] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="\x04", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.042] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="\x05", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.042] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="\x06", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.042] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="\x07", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.042] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="\x08", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.042] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="\x09", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.042] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="\n", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.042] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="\x0b", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.042] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="\x0c", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.042] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="\r", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.042] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="\x0e", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.042] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="\x0f", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.042] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="\x10", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.042] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="\x11", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.042] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="\x12", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.042] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="\x13", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.042] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="\x14", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.042] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="\x15", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.042] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="\x16", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.042] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="\x17", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.042] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="\x18", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.042] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="\x19", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.042] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="\x1a", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.042] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="\x1b", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.042] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="\x1c", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.042] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="\x1d", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.042] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="\x1e", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.042] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="\x1f", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.042] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1=" ", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.042] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="!", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.042] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="\"", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.043] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="#", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.043] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="$", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.043] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="%", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.043] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="&", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.043] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="'", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.043] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="(", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.043] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1=")", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.043] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="*", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.043] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="+", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.043] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1=",", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.043] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="-", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.043] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1=".", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.043] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="/", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.043] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="0", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.043] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="1", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.043] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="2", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.043] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="3", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.043] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="4", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.043] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="5", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.043] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="6", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.043] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="7", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.043] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="8", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.043] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="9", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.043] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1=":", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.043] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1=";", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.043] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="<", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.043] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="=", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.043] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1=">", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.043] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="?", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.043] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="@", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.043] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="A", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.043] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="B", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.043] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="C", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.043] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="D", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.044] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="E", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.044] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="F", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.044] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="G", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.044] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="H", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.044] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="I", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.044] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="J", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.044] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="K", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.044] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="L", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.044] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="M", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.044] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="N", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.044] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="O", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.044] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="P", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.044] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="Q", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.044] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="R", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.044] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="S", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.044] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="T", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.044] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="U", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.044] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="V", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.044] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="W", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.044] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="X", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.044] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="Y", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.044] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="Z", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.044] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="[", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.044] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="\\", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.044] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="]", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.044] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="^", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.044] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="_", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.044] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="`", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.044] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="a", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.044] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="b", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.044] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="c", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.044] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="d", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.044] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="e", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.044] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="f", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.045] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="g", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.045] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="h", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.045] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="i", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.045] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="j", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.045] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="k", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.045] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="l", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.045] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="m", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.045] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="n", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.045] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="o", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.045] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="p", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.045] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="q", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.045] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="r", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.045] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="s", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.045] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="t", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.045] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="u", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.045] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="v", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.045] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="w", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.045] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="x", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.045] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="y", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.045] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="z", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.045] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="{", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.045] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="|", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.045] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="}", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.045] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="~", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.045] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="\x7f", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.045] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="\x80", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.045] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="\x81", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.045] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="\x82", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.045] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="\x83", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.045] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="\x84", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.045] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="…", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.045] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="\x86", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.045] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="\x87", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.046] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="\x88", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.046] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="\x89", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.046] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="\x8a", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.046] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="\x8b", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.046] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="\x8c", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.046] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="\x8d", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.046] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="\x8e", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.046] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="\x8f", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.046] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="\x90", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.046] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="\x91", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.046] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="\x92", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.046] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="\x93", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.046] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="\x94", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.046] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="\x95", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.046] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="\x96", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.046] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="\x97", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.046] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="\x98", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.046] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="\x99", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.046] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="\x9a", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.046] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="\x9b", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.046] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="\x9c", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.046] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="\x9d", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.046] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="\x9e", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.046] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="\x9f", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.046] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1=" ", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.046] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="¡", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.046] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="¢", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.046] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="£", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.046] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="¤", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.046] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="¥", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.046] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="¦", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.046] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="§", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.046] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="¨", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.047] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="©", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.047] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="ª", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.047] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="«", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.047] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="¬", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.047] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="­", cchCount1=1, lpString2="", cchCount2=1) returned 2 [0024.047] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="®", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.047] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="¯", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.047] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="°", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.047] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="±", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.047] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="²", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.047] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="³", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.047] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="´", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.047] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="µ", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.047] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="¶", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.047] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="·", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.047] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="¸", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.047] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="¹", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.047] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="º", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.047] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="»", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.047] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="¼", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.047] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="½", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.047] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="¾", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.047] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="¿", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.047] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="À", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.047] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="Á", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.047] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="Â", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.047] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="Ã", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.047] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="Ä", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.047] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="Å", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.047] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="Æ", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.047] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="Ç", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.047] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="È", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.048] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="É", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.048] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="Ê", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.048] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="Ë", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.048] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="Ì", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.048] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="Í", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.048] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="Î", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.048] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="Ï", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.048] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="Ð", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.048] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="Ñ", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.048] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="Ò", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.048] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="Ó", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.048] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="Ô", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.048] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="Õ", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.048] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="Ö", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.048] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="×", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.048] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="Ø", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.048] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="Ù", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.048] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="Ú", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.048] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="Û", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.048] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="Ü", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.048] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="Ý", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.048] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="Þ", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.048] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="ß", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.048] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="à", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.048] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="á", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.048] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="â", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.048] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="ã", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.048] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="ä", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.048] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="å", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.048] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="æ", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.048] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="ç", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.048] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="è", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.048] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="é", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.048] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="ê", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.049] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="ë", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.049] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="ì", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.049] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="í", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.049] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="î", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.049] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="ï", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.049] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="ð", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.049] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="ñ", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.049] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="ò", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.049] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="ó", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.049] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="ô", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.049] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="õ", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.049] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="ö", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.049] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="÷", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.049] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="ø", cchCount1=1, lpString2="", cchCount2=1) returned 3 [0024.056] CharToOemBuffA (in: lpszSrc="", lpszDst=0x67d67c, cchDstLength=0x100 | out: lpszDst="") returned 1 [0024.056] OemToCharBuffA (in: lpszSrc="", lpszDst=0x67d87c, cchDstLength=0x100 | out: lpszDst="") returned 1 [0024.056] CharUpperBuffA (in: lpsz="", cchLength=0x100 | out: lpsz="") returned 0x100 [0024.056] CharLowerBuffA (in: lpsz="", cchLength=0x100 | out: lpsz="") returned 0x100 [0024.056] EnumWindows (lpEnumFunc=0x623150, lParam=0x67dab4) returned 1 [0024.056] GetWindowTextW (in: hWnd=0x3013e, lpString=0x1fa7720, nMaxCount=255 | out: lpString="Task Switching") returned 14 [0024.057] GetWindowTextW (in: hWnd=0x300b2, lpString=0x1fa7720, nMaxCount=255 | out: lpString="") returned 0 [0024.057] GetWindowTextW (in: hWnd=0x300ee, lpString=0x1fa7720, nMaxCount=255 | out: lpString="") returned 0 [0024.057] GetWindowTextW (in: hWnd=0x400c0, lpString=0x1fa7720, nMaxCount=255 | out: lpString="") returned 0 [0024.057] GetWindowTextW (in: hWnd=0x10146, lpString=0x1fa7720, nMaxCount=255 | out: lpString="Network Flyout") returned 14 [0024.057] GetWindowTextW (in: hWnd=0x20118, lpString=0x1fa7720, nMaxCount=255 | out: lpString="CiceroUIWndFrame") returned 16 [0024.057] GetWindowTextW (in: hWnd=0x2001e, lpString=0x1fa7720, nMaxCount=255 | out: lpString="CiceroUIWndFrame") returned 16 [0024.057] GetWindowTextW (in: hWnd=0x20028, lpString=0x1fa7720, nMaxCount=255 | out: lpString="TF_FloatingLangBar_WndTitle") returned 27 [0024.057] GetWindowTextW (in: hWnd=0x1007c, lpString=0x1fa7720, nMaxCount=255 | out: lpString="") returned 0 [0024.057] GetWindowTextW (in: hWnd=0x1007a, lpString=0x1fa7720, nMaxCount=255 | out: lpString="") returned 0 [0024.057] GetWindowTextW (in: hWnd=0x10066, lpString=0x1fa7720, nMaxCount=255 | out: lpString="") returned 0 [0024.057] GetWindowTextW (in: hWnd=0x10090, lpString=0x1fa7720, nMaxCount=255 | out: lpString="") returned 0 [0024.057] GetWindowTextW (in: hWnd=0x10084, lpString=0x1fa7720, nMaxCount=255 | out: lpString="") returned 0 [0024.058] GetWindowTextW (in: hWnd=0x10082, lpString=0x1fa03f0, nMaxCount=255 | out: lpString="") returned 0 [0024.058] GetWindowTextW (in: hWnd=0x1007e, lpString=0x1fa03f0, nMaxCount=255 | out: lpString="") returned 0 [0024.058] GetWindowTextW (in: hWnd=0x1005e, lpString=0x1fa03f0, nMaxCount=255 | out: lpString="Start") returned 5 [0024.058] GetWindowTextW (in: hWnd=0x10056, lpString=0x1fa03f0, nMaxCount=255 | out: lpString="") returned 0 [0024.058] GetWindowTextW (in: hWnd=0x100fa, lpString=0x1fa03f0, nMaxCount=255 | out: lpString="") returned 0 [0024.058] GetWindowTextW (in: hWnd=0x500a2, lpString=0x1fa03f0, nMaxCount=255 | out: lpString="") returned 0 [0024.058] GetWindowTextW (in: hWnd=0x10092, lpString=0x1fa03f0, nMaxCount=255 | out: lpString="") returned 0 [0024.058] GetWindowTextW (in: hWnd=0x101ae, lpString=0x1fa03f0, nMaxCount=255 | out: lpString="Dts Guilty Blanket") returned 18 [0024.058] GetWindowTextW (in: hWnd=0x301ba, lpString=0x1fa03f0, nMaxCount=255 | out: lpString="egui") returned 4 [0024.058] NtdllDefWindowProc_W () returned 0x4 [0024.058] GetWindowTextW (in: hWnd=0x401b6, lpString=0x1fa03f0, nMaxCount=255 | out: lpString="") returned 0 [0024.058] NtdllDefWindowProc_W () returned 0x0 [0024.058] GetWindowTextW (in: hWnd=0x800a8, lpString=0x1fa03f0, nMaxCount=255 | out: lpString="Start menu") returned 10 [0024.059] GetWindowTextW (in: hWnd=0x300c6, lpString=0x1fa03f0, nMaxCount=255 | out: lpString="") returned 0 [0024.059] GetWindowTextW (in: hWnd=0x400d0, lpString=0x1fa03f0, nMaxCount=255 | out: lpString="") returned 0 [0024.059] GetWindowTextW (in: hWnd=0x400f0, lpString=0x1fa03f0, nMaxCount=255 | out: lpString="") returned 0 [0024.059] GetWindowTextW (in: hWnd=0x300de, lpString=0x1fa03f0, nMaxCount=255 | out: lpString="") returned 0 [0024.059] GetWindowTextW (in: hWnd=0x300ca, lpString=0x1fa03f0, nMaxCount=255 | out: lpString="") returned 0 [0024.059] GetWindowTextW (in: hWnd=0x400c4, lpString=0x1f990c0, nMaxCount=255 | out: lpString="") returned 0 [0024.059] GetWindowTextW (in: hWnd=0x300ac, lpString=0x1f990c0, nMaxCount=255 | out: lpString="5p5NrGJn0jS HALPmcxz") returned 20 [0024.059] GetWindowTextW (in: hWnd=0x101aa, lpString=0x1f990c0, nMaxCount=255 | out: lpString="Diploma Difficulty") returned 18 [0024.059] GetWindowTextW (in: hWnd=0x101a6, lpString=0x1f990c0, nMaxCount=255 | out: lpString="Ou Lightning") returned 12 [0024.059] GetWindowTextW (in: hWnd=0x101a2, lpString=0x1f990c0, nMaxCount=255 | out: lpString="Finite") returned 6 [0024.059] GetWindowTextW (in: hWnd=0x1019e, lpString=0x1f990c0, nMaxCount=255 | out: lpString="Fire Ny") returned 7 [0024.059] GetWindowTextW (in: hWnd=0x1019a, lpString=0x1f990c0, nMaxCount=255 | out: lpString="Careers") returned 7 [0024.060] GetWindowTextW (in: hWnd=0x10196, lpString=0x1f990c0, nMaxCount=255 | out: lpString="Desk") returned 4 [0024.060] GetWindowTextW (in: hWnd=0x10192, lpString=0x1f990c0, nMaxCount=255 | out: lpString="Dee") returned 3 [0024.060] GetWindowTextW (in: hWnd=0x1018e, lpString=0x1f990c0, nMaxCount=255 | out: lpString="Twisted Ruth") returned 12 [0024.060] GetWindowTextW (in: hWnd=0x1018a, lpString=0x1f990c0, nMaxCount=255 | out: lpString="Landscapes Participate Area") returned 27 [0024.060] GetWindowTextW (in: hWnd=0x10186, lpString=0x1f990c0, nMaxCount=255 | out: lpString="Strategies Fed") returned 14 [0024.060] GetWindowTextW (in: hWnd=0x10182, lpString=0x1f990c0, nMaxCount=255 | out: lpString="Storage Spyware") returned 15 [0024.060] GetWindowTextW (in: hWnd=0x1017e, lpString=0x1f990c0, nMaxCount=255 | out: lpString="Dimension") returned 9 [0024.060] GetWindowTextW (in: hWnd=0x1017a, lpString=0x1f990c0, nMaxCount=255 | out: lpString="Over Numerous") returned 13 [0024.060] GetWindowTextW (in: hWnd=0x10176, lpString=0x1f990c0, nMaxCount=255 | out: lpString="Shower Coming Operations") returned 24 [0024.060] GetWindowTextW (in: hWnd=0x10172, lpString=0x1f990c0, nMaxCount=255 | out: lpString="Funky") returned 5 [0024.060] GetWindowTextW (in: hWnd=0x1016e, lpString=0x1f990c0, nMaxCount=255 | out: lpString="Each") returned 4 [0024.061] GetWindowTextW (in: hWnd=0x1016a, lpString=0x1f990c0, nMaxCount=255 | out: lpString="Interpreted Viewers Newport") returned 27 [0024.061] GetWindowTextW (in: hWnd=0x10166, lpString=0x1f990c0, nMaxCount=255 | out: lpString="Approximate") returned 11 [0024.061] GetWindowTextW (in: hWnd=0x10162, lpString=0x1f990c0, nMaxCount=255 | out: lpString="Terrorist Assignment Interpretation") returned 35 [0024.061] GetWindowTextW (in: hWnd=0x2015e, lpString=0x1f990c0, nMaxCount=255 | out: lpString="Dialog Tabs Region") returned 18 [0024.061] GetWindowTextW (in: hWnd=0x3015a, lpString=0x1f990c0, nMaxCount=255 | out: lpString="HiddenFaxWindow") returned 15 [0024.061] GetWindowTextW (in: hWnd=0x10150, lpString=0x1f990c0, nMaxCount=255 | out: lpString="BluetoothNotificationAreaIconWindowClass") returned 40 [0024.061] GetWindowTextW (in: hWnd=0x1014e, lpString=0x1f990c0, nMaxCount=255 | out: lpString="MS_WebcheckMonitor") returned 18 [0024.061] GetWindowTextW (in: hWnd=0x20144, lpString=0x1f990c0, nMaxCount=255 | out: lpString="") returned 0 [0024.061] GetWindowTextW (in: hWnd=0x10138, lpString=0x1f990c0, nMaxCount=255 | out: lpString="Media Center SSO") returned 16 [0024.061] GetWindowTextW (in: hWnd=0x10130, lpString=0x1f990c0, nMaxCount=255 | out: lpString="") returned 0 [0024.061] GetWindowTextW (in: hWnd=0x10126, lpString=0x1f990c0, nMaxCount=255 | out: lpString="Battery Meter") returned 13 [0024.061] GetWindowTextW (in: hWnd=0x200d6, lpString=0x1f990c0, nMaxCount=255 | out: lpString="") returned 0 [0024.061] GetWindowTextW (in: hWnd=0x1010e, lpString=0x1f990c0, nMaxCount=255 | out: lpString="TaskEng - Task Scheduler Engine Process") returned 39 [0024.062] GetWindowTextW (in: hWnd=0x1010c, lpString=0x1f990c0, nMaxCount=255 | out: lpString="") returned 0 [0024.062] GetWindowTextW (in: hWnd=0x10108, lpString=0x1f990c0, nMaxCount=255 | out: lpString="") returned 0 [0024.062] GetWindowTextW (in: hWnd=0x10102, lpString=0x1f990c0, nMaxCount=255 | out: lpString="") returned 0 [0024.062] GetWindowTextW (in: hWnd=0x50094, lpString=0x1f990c0, nMaxCount=255 | out: lpString="Jump List") returned 9 [0024.062] GetWindowTextW (in: hWnd=0x1008a, lpString=0x1f990c0, nMaxCount=255 | out: lpString="") returned 0 [0024.062] GetWindowTextW (in: hWnd=0x10088, lpString=0x1f990c0, nMaxCount=255 | out: lpString="") returned 0 [0024.062] GetWindowTextW (in: hWnd=0x10080, lpString=0x1f990c0, nMaxCount=255 | out: lpString="") returned 0 [0024.062] GetWindowTextW (in: hWnd=0x1006e, lpString=0x1f990c0, nMaxCount=255 | out: lpString="") returned 0 [0024.062] GetWindowTextW (in: hWnd=0x20020, lpString=0x1f990c0, nMaxCount=255 | out: lpString="MCI command handling window") returned 27 [0024.062] GetWindowTextW (in: hWnd=0x1006a, lpString=0x1f990c0, nMaxCount=255 | out: lpString="") returned 0 [0024.062] GetWindowTextW (in: hWnd=0x10058, lpString=0x1f990c0, nMaxCount=255 | out: lpString="Task Host Window") returned 16 [0024.062] GetWindowTextW (in: hWnd=0x10052, lpString=0x1f990c0, nMaxCount=255 | out: lpString="DDE Server Window") returned 17 [0024.062] GetWindowTextW (in: hWnd=0x1004a, lpString=0x1f990c0, nMaxCount=255 | out: lpString="") returned 0 [0024.063] GetWindowTextW (in: hWnd=0x20046, lpString=0x1f990c0, nMaxCount=255 | out: lpString="") returned 0 [0024.063] GetWindowTextW (in: hWnd=0x30044, lpString=0x1f990c0, nMaxCount=255 | out: lpString="DWM Notification Window") returned 23 [0024.063] GetWindowTextW (in: hWnd=0x20018, lpString=0x1f990c0, nMaxCount=255 | out: lpString="") returned 0 [0024.063] GetWindowTextW (in: hWnd=0x100f2, lpString=0x1f990c0, nMaxCount=255 | out: lpString="Program Manager") returned 15 [0024.063] GetWindowTextW (in: hWnd=0x30140, lpString=0x1f91b90, nMaxCount=255 | out: lpString="Default IME") returned 11 [0024.063] GetWindowTextW (in: hWnd=0x1005c, lpString=0x1f91b90, nMaxCount=255 | out: lpString="MSCTFIME UI") returned 11 [0024.063] GetWindowTextW (in: hWnd=0x10054, lpString=0x1f91b90, nMaxCount=255 | out: lpString="Default IME") returned 11 [0024.063] GetWindowTextW (in: hWnd=0x101b0, lpString=0x1f91b90, nMaxCount=255 | out: lpString="Default IME") returned 11 [0024.063] GetWindowTextW (in: hWnd=0xa01b2, lpString=0x1f91b90, nMaxCount=255 | out: lpString="Default IME") returned 11 [0024.063] GetWindowTextW (in: hWnd=0x101ac, lpString=0x1f91b90, nMaxCount=255 | out: lpString="Default IME") returned 11 [0024.063] GetWindowTextW (in: hWnd=0x101a8, lpString=0x1f91b90, nMaxCount=255 | out: lpString="Default IME") returned 11 [0024.063] GetWindowTextW (in: hWnd=0x101a4, lpString=0x1f91b90, nMaxCount=255 | out: lpString="Default IME") returned 11 [0024.063] GetWindowTextW (in: hWnd=0x101a0, lpString=0x1f91b90, nMaxCount=255 | out: lpString="Default IME") returned 11 [0024.063] GetWindowTextW (in: hWnd=0x1019c, lpString=0x1f91b90, nMaxCount=255 | out: lpString="Default IME") returned 11 [0024.064] GetWindowTextW (in: hWnd=0x10198, lpString=0x1f91b90, nMaxCount=255 | out: lpString="Default IME") returned 11 [0024.064] GetWindowTextW (in: hWnd=0x10194, lpString=0x1f91b90, nMaxCount=255 | out: lpString="Default IME") returned 11 [0024.064] GetWindowTextW (in: hWnd=0x10190, lpString=0x1f91b90, nMaxCount=255 | out: lpString="Default IME") returned 11 [0024.064] GetWindowTextW (in: hWnd=0x1018c, lpString=0x1f91b90, nMaxCount=255 | out: lpString="Default IME") returned 11 [0024.064] GetWindowTextW (in: hWnd=0x10188, lpString=0x1f91b90, nMaxCount=255 | out: lpString="Default IME") returned 11 [0024.064] GetWindowTextW (in: hWnd=0x10184, lpString=0x1f91b90, nMaxCount=255 | out: lpString="Default IME") returned 11 [0024.064] GetWindowTextW (in: hWnd=0x10180, lpString=0x1f91b90, nMaxCount=255 | out: lpString="Default IME") returned 11 [0024.064] GetWindowTextW (in: hWnd=0x1017c, lpString=0x1f91b90, nMaxCount=255 | out: lpString="Default IME") returned 11 [0024.064] GetWindowTextW (in: hWnd=0x10178, lpString=0x1f91b90, nMaxCount=255 | out: lpString="Default IME") returned 11 [0024.064] GetWindowTextW (in: hWnd=0x10174, lpString=0x1f91b90, nMaxCount=255 | out: lpString="Default IME") returned 11 [0024.064] GetWindowTextW (in: hWnd=0x10170, lpString=0x1f91b90, nMaxCount=255 | out: lpString="Default IME") returned 11 [0024.064] GetWindowTextW (in: hWnd=0x1016c, lpString=0x1f91b90, nMaxCount=255 | out: lpString="Default IME") returned 11 [0024.064] GetWindowTextW (in: hWnd=0x10168, lpString=0x1f91b90, nMaxCount=255 | out: lpString="Default IME") returned 11 [0024.065] GetWindowTextW (in: hWnd=0x10164, lpString=0x1f91b90, nMaxCount=255 | out: lpString="Default IME") returned 11 [0024.065] GetWindowTextW (in: hWnd=0x10160, lpString=0x1f91b90, nMaxCount=255 | out: lpString="Default IME") returned 11 [0024.065] GetWindowTextW (in: hWnd=0x1013a, lpString=0x1f91b90, nMaxCount=255 | out: lpString="Default IME") returned 11 [0024.065] GetWindowTextW (in: hWnd=0x10132, lpString=0x1f91b90, nMaxCount=255 | out: lpString="Default IME") returned 11 [0024.065] GetWindowTextW (in: hWnd=0x10128, lpString=0x1f91b90, nMaxCount=255 | out: lpString="Default IME") returned 11 [0024.065] GetWindowTextW (in: hWnd=0x700a4, lpString=0x1f91b90, nMaxCount=255 | out: lpString="Default IME") returned 11 [0024.065] GetWindowTextW (in: hWnd=0x20104, lpString=0x1f91b90, nMaxCount=255 | out: lpString="MSCTFIME UI") returned 11 [0024.065] GetWindowTextW (in: hWnd=0x2002a, lpString=0x1f91b90, nMaxCount=255 | out: lpString="Default IME") returned 11 [0024.065] GetWindowTextW (in: hWnd=0x1005a, lpString=0x1f91b90, nMaxCount=255 | out: lpString="Default IME") returned 11 [0024.065] GetWindowTextW (in: hWnd=0x10048, lpString=0x1f91b90, nMaxCount=255 | out: lpString="Default IME") returned 11 [0024.065] GetWindowTextW (in: hWnd=0x2001a, lpString=0x1f91b90, nMaxCount=255 | out: lpString="Default IME") returned 11 [0024.065] GetCurrentThreadId () returned 0x970 [0024.065] GetCurrentThreadId () returned 0x970 [0024.066] GetCurrentThreadId () returned 0x970 [0024.066] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Borland\\Delphi", ulOptions=0x0, samDesired=0x20009, phkResult=0x18fd14 | out: phkResult=0x18fd14*=0x0) returned 0x2 [0024.066] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Borland\\C++Builder", ulOptions=0x0, samDesired=0x20009, phkResult=0x18fd14 | out: phkResult=0x18fd14*=0x0) returned 0x2 [0024.066] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\CodeGear\\BDS", ulOptions=0x0, samDesired=0x20009, phkResult=0x18fd14 | out: phkResult=0x18fd14*=0x0) returned 0x2 [0024.066] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Embarcadero", ulOptions=0x0, samDesired=0x20009, phkResult=0x18fd14 | out: phkResult=0x18fd14*=0x0) returned 0x2 [0024.066] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Borland\\BDS", ulOptions=0x0, samDesired=0x20009, phkResult=0x18fd14 | out: phkResult=0x18fd14*=0x0) returned 0x2 [0024.066] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0024.066] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0024.066] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x202a8b8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0024.066] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=1, lpName="896967946") returned 0x154 [0024.067] GetLastError () returned 0x0 [0024.067] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0xf003f, lpSecurityAttributes=0x0, phkResult=0x18fda8, lpdwDisposition=0x18fda4 | out: phkResult=0x18fda8*=0x158, lpdwDisposition=0x18fda4*=0x2) returned 0x0 [0024.067] RegQueryValueExW (in: hKey=0x158, lpValueName="vin", lpReserved=0x0, lpType=0x18fd9c, lpData=0x0, lpcbData=0x18fdb4*=0x0 | out: lpType=0x18fd9c*=0x0, lpData=0x0, lpcbData=0x18fdb4*=0x0) returned 0x2 [0024.067] RegSetValueExW (in: hKey=0x158, lpValueName="vin", Reserved=0x0, dwType=0x1, lpData="go", cbData=0x6 | out: lpData="go") returned 0x0 [0024.067] RegCloseKey (hKey=0x158) returned 0x0 [0024.067] GetCurrentProcess () returned 0xffffffff [0024.067] InitializeSecurityDescriptor (in: pSecurityDescriptor=0x18f998, dwRevision=0x1 | out: pSecurityDescriptor=0x18f998) returned 1 [0024.067] InitializeAcl (in: pAcl=0x18f9ac, nAclLength=0x400, dwAclRevision=0x2 | out: pAcl=0x18f9ac) returned 1 [0024.067] SetSecurityDescriptorDacl (in: pSecurityDescriptor=0x18f998, bDaclPresent=1, pDacl=0x18f9ac, bDaclDefaulted=0 | out: pSecurityDescriptor=0x18f998) returned 1 [0024.067] SetKernelObjectSecurity (Handle=0xffffffff, SecurityInformation=0x4, SecurityDescriptor=0x18f998) returned 1 [0024.067] GetCurrentThread () returned 0xfffffffe [0024.067] InitializeSecurityDescriptor (in: pSecurityDescriptor=0x18f998, dwRevision=0x1 | out: pSecurityDescriptor=0x18f998) returned 1 [0024.067] InitializeAcl (in: pAcl=0x18f9ac, nAclLength=0x400, dwAclRevision=0x2 | out: pAcl=0x18f9ac) returned 1 [0024.067] SetSecurityDescriptorDacl (in: pSecurityDescriptor=0x18f998, bDaclPresent=1, pDacl=0x18f9ac, bDaclDefaulted=0 | out: pSecurityDescriptor=0x18f998) returned 1 [0024.067] SetKernelObjectSecurity (Handle=0xfffffffe, SecurityInformation=0x4, SecurityDescriptor=0x18f998) returned 1 [0024.067] SetLastError (dwErrCode=0x0) [0024.067] GetLogicalDriveStringsW (in: nBufferLength=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0x5 [0024.067] GetLogicalDriveStringsW (in: nBufferLength=0x5, lpBuffer=0x1fea064 | out: lpBuffer="C:\\") returned 0x4 [0024.067] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0024.067] SetLastError (dwErrCode=0x0) [0024.068] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x104, lpBuffer=0x18fb34, lpFilePart=0x18fb30 | out: lpBuffer="C:\\", lpFilePart=0x18fb30*=0x0) returned 0x3 [0024.068] GetLastError () returned 0x0 [0024.068] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0024.068] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x18fafc | out: lpFindFileData=0x18fafc*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x28ce40 [0024.068] FileTimeToLocalFileTime (in: lpFileTime=0x18fb10, lpLocalFileTime=0x18fa84 | out: lpLocalFileTime=0x18fa84) returned 1 [0024.068] FileTimeToDosDateTime (in: lpFileTime=0x18fa84, lpFatDate=0x18fade, lpFatTime=0x18fadc | out: lpFatDate=0x18fade, lpFatTime=0x18fadc) returned 1 [0024.068] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="$Recycle.Bin", cchCount2=8) returned 3 [0024.068] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="$Recycle.Bin", cchCount2=4) returned 3 [0024.068] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="$Recycle.Bin", cchCount2=8) returned 3 [0024.068] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="$Recycle.Bin", cchCount2=4) returned 3 [0024.068] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="$Recycle.Bin", cchCount2=8) returned 3 [0024.068] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="$Recycle.Bin", cchCount2=4) returned 3 [0024.068] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x18f848 | out: lpFindFileData=0x18f848*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790063, dwReserved1=0x6c0063, cFileName=".", cAlternateFileName="")) returned 0x28ce80 [0024.069] FileTimeToLocalFileTime (in: lpFileTime=0x18f85c, lpLocalFileTime=0x18f7d0 | out: lpLocalFileTime=0x18f7d0) returned 1 [0024.069] FileTimeToDosDateTime (in: lpFileTime=0x18f7d0, lpFatDate=0x18f82a, lpFatTime=0x18f828 | out: lpFatDate=0x18f82a, lpFatTime=0x18f828) returned 1 [0024.069] FindNextFileW (in: hFindFile=0x28ce80, lpFindFileData=0x18f848 | out: lpFindFileData=0x18f848*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790063, dwReserved1=0x6c0063, cFileName="..", cAlternateFileName="")) returned 1 [0024.069] FileTimeToLocalFileTime (in: lpFileTime=0x18f85c, lpLocalFileTime=0x18f7cc | out: lpLocalFileTime=0x18f7cc) returned 1 [0024.069] FileTimeToDosDateTime (in: lpFileTime=0x18f7cc, lpFatDate=0x18f82a, lpFatTime=0x18f828 | out: lpFatDate=0x18f82a, lpFatTime=0x18f828) returned 1 [0024.069] FindNextFileW (in: hFindFile=0x28ce80, lpFindFileData=0x18f848 | out: lpFindFileData=0x18f848*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790063, dwReserved1=0x6c0063, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0024.069] FileTimeToLocalFileTime (in: lpFileTime=0x18f85c, lpLocalFileTime=0x18f7cc | out: lpLocalFileTime=0x18f7cc) returned 1 [0024.069] FileTimeToDosDateTime (in: lpFileTime=0x18f7cc, lpFatDate=0x18f82a, lpFatTime=0x18f828 | out: lpFatDate=0x18f82a, lpFatTime=0x18f828) returned 1 [0024.069] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000", cchCount2=8) returned 1 [0024.069] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000", cchCount2=4) returned 1 [0024.069] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000", cchCount2=8) returned 1 [0024.069] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000", cchCount2=4) returned 1 [0024.069] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000", cchCount2=8) returned 1 [0024.069] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000", cchCount2=4) returned 1 [0024.069] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x28dec8 [0024.069] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f51c | out: lpLocalFileTime=0x18f51c) returned 1 [0024.069] FileTimeToDosDateTime (in: lpFileTime=0x18f51c, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.069] FindNextFileW (in: hFindFile=0x28dec8, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0024.069] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f518 | out: lpLocalFileTime=0x18f518) returned 1 [0024.069] FileTimeToDosDateTime (in: lpFileTime=0x18f518, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.069] FindNextFileW (in: hFindFile=0x28dec8, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0024.070] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f518 | out: lpLocalFileTime=0x18f518) returned 1 [0024.070] FileTimeToDosDateTime (in: lpFileTime=0x18f518, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.070] FindNextFileW (in: hFindFile=0x28dec8, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0024.070] GetLastError () returned 0x12 [0024.070] FindClose (in: hFindFile=0x28dec8 | out: hFindFile=0x28dec8) returned 1 [0024.070] FindNextFileW (in: hFindFile=0x28ce80, lpFindFileData=0x18f848 | out: lpFindFileData=0x18f848*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790063, dwReserved1=0x6c0063, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0024.070] GetLastError () returned 0x12 [0024.070] FindClose (in: hFindFile=0x28ce80 | out: hFindFile=0x28ce80) returned 1 [0024.070] FindNextFileW (in: hFindFile=0x28ce40, lpFindFileData=0x18fafc | out: lpFindFileData=0x18fafc*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0024.070] FileTimeToLocalFileTime (in: lpFileTime=0x18fb10, lpLocalFileTime=0x18fa80 | out: lpLocalFileTime=0x18fa80) returned 1 [0024.070] FileTimeToDosDateTime (in: lpFileTime=0x18fa80, lpFatDate=0x18fade, lpFatTime=0x18fadc | out: lpFatDate=0x18fade, lpFatTime=0x18fadc) returned 1 [0024.070] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="Boot", cchCount2=4) returned 1 [0024.070] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="Boot", cchCount2=4) returned 1 [0024.070] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="Boot", cchCount2=4) returned 1 [0024.070] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x18f848 | out: lpFindFileData=0x18f848*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790063, dwReserved1=0x6c0063, cFileName=".", cAlternateFileName="")) returned 0x28de88 [0024.070] FileTimeToLocalFileTime (in: lpFileTime=0x18f85c, lpLocalFileTime=0x18f7d0 | out: lpLocalFileTime=0x18f7d0) returned 1 [0024.070] FileTimeToDosDateTime (in: lpFileTime=0x18f7d0, lpFatDate=0x18f82a, lpFatTime=0x18f828 | out: lpFatDate=0x18f82a, lpFatTime=0x18f828) returned 1 [0024.070] FindNextFileW (in: hFindFile=0x28de88, lpFindFileData=0x18f848 | out: lpFindFileData=0x18f848*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790063, dwReserved1=0x6c0063, cFileName="..", cAlternateFileName="")) returned 1 [0024.070] FileTimeToLocalFileTime (in: lpFileTime=0x18f85c, lpLocalFileTime=0x18f7cc | out: lpLocalFileTime=0x18f7cc) returned 1 [0024.070] FileTimeToDosDateTime (in: lpFileTime=0x18f7cc, lpFatDate=0x18f82a, lpFatTime=0x18f828 | out: lpFatDate=0x18f82a, lpFatTime=0x18f828) returned 1 [0024.070] FindNextFileW (in: hFindFile=0x28de88, lpFindFileData=0x18f848 | out: lpFindFileData=0x18f848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x2ebf9340, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2ebf9340, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x790063, dwReserved1=0x6c0063, cFileName="BCD", cAlternateFileName="")) returned 1 [0024.071] FileTimeToLocalFileTime (in: lpFileTime=0x18f85c, lpLocalFileTime=0x18f7cc | out: lpLocalFileTime=0x18f7cc) returned 1 [0024.071] FileTimeToDosDateTime (in: lpFileTime=0x18f7cc, lpFatDate=0x18f82a, lpFatTime=0x18f828 | out: lpFatDate=0x18f82a, lpFatTime=0x18f828) returned 1 [0024.071] FindNextFileW (in: hFindFile=0x28de88, lpFindFileData=0x18f848 | out: lpFindFileData=0x18f848*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac2e8a60, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x469b3b00, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x5400, dwReserved0=0x790063, dwReserved1=0x6c0063, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0024.071] FileTimeToLocalFileTime (in: lpFileTime=0x18f85c, lpLocalFileTime=0x18f7cc | out: lpLocalFileTime=0x18f7cc) returned 1 [0024.071] FileTimeToDosDateTime (in: lpFileTime=0x18f7cc, lpFatDate=0x18f82a, lpFatTime=0x18f828 | out: lpFatDate=0x18f82a, lpFatTime=0x18f828) returned 1 [0024.071] FindNextFileW (in: hFindFile=0x28de88, lpFindFileData=0x18f848 | out: lpFindFileData=0x18f848*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790063, dwReserved1=0x6c0063, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0024.071] FileTimeToLocalFileTime (in: lpFileTime=0x18f85c, lpLocalFileTime=0x18f7cc | out: lpLocalFileTime=0x18f7cc) returned 1 [0024.071] FileTimeToDosDateTime (in: lpFileTime=0x18f7cc, lpFatDate=0x18f82a, lpFatTime=0x18f828 | out: lpFatDate=0x18f82a, lpFatTime=0x18f828) returned 1 [0024.071] FindNextFileW (in: hFindFile=0x28de88, lpFindFileData=0x18f848 | out: lpFindFileData=0x18f848*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790063, dwReserved1=0x6c0063, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0024.071] FileTimeToLocalFileTime (in: lpFileTime=0x18f85c, lpLocalFileTime=0x18f7cc | out: lpLocalFileTime=0x18f7cc) returned 1 [0024.071] FileTimeToDosDateTime (in: lpFileTime=0x18f7cc, lpFatDate=0x18f82a, lpFatTime=0x18f828 | out: lpFatDate=0x18f82a, lpFatTime=0x18f828) returned 1 [0024.071] FindNextFileW (in: hFindFile=0x28de88, lpFindFileData=0x18f848 | out: lpFindFileData=0x18f848*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x790063, dwReserved1=0x6c0063, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0024.071] FileTimeToLocalFileTime (in: lpFileTime=0x18f85c, lpLocalFileTime=0x18f7cc | out: lpLocalFileTime=0x18f7cc) returned 1 [0024.071] FileTimeToDosDateTime (in: lpFileTime=0x18f7cc, lpFatDate=0x18f82a, lpFatTime=0x18f828 | out: lpFatDate=0x18f82a, lpFatTime=0x18f828) returned 1 [0024.071] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="BOOTSTAT.DAT", cchCount2=8) returned 1 [0024.071] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="BOOTSTAT.DAT", cchCount2=4) returned 1 [0024.071] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="BOOTSTAT.DAT", cchCount2=8) returned 1 [0024.071] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="BOOTSTAT.DAT", cchCount2=4) returned 1 [0024.071] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="BOOTSTAT.DAT", cchCount2=8) returned 1 [0024.071] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="BOOTSTAT.DAT", cchCount2=4) returned 1 [0024.071] FindNextFileW (in: hFindFile=0x28de88, lpFindFileData=0x18f848 | out: lpFindFileData=0x18f848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790063, dwReserved1=0x6c0063, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0024.071] FileTimeToLocalFileTime (in: lpFileTime=0x18f85c, lpLocalFileTime=0x18f7cc | out: lpLocalFileTime=0x18f7cc) returned 1 [0024.071] FileTimeToDosDateTime (in: lpFileTime=0x18f7cc, lpFatDate=0x18f82a, lpFatTime=0x18f828 | out: lpFatDate=0x18f82a, lpFatTime=0x18f828) returned 1 [0024.071] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="cs-CZ", cchCount2=4) returned 1 [0024.071] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="cs-CZ", cchCount2=4) returned 1 [0024.071] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="cs-CZ", cchCount2=4) returned 1 [0024.071] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x28eed0 [0024.072] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f51c | out: lpLocalFileTime=0x18f51c) returned 1 [0024.072] FileTimeToDosDateTime (in: lpFileTime=0x18f51c, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.072] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="..", cAlternateFileName="")) returned 1 [0024.073] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f518 | out: lpLocalFileTime=0x18f518) returned 1 [0024.073] FileTimeToDosDateTime (in: lpFileTime=0x18f518, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.073] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0024.073] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f518 | out: lpLocalFileTime=0x18f518) returned 1 [0024.073] FileTimeToDosDateTime (in: lpFileTime=0x18f518, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.073] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0024.073] GetLastError () returned 0x12 [0024.073] FindClose (in: hFindFile=0x28eed0 | out: hFindFile=0x28eed0) returned 1 [0024.073] FindNextFileW (in: hFindFile=0x28de88, lpFindFileData=0x18f848 | out: lpFindFileData=0x18f848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790063, dwReserved1=0x6c0063, cFileName="da-DK", cAlternateFileName="")) returned 1 [0024.073] FileTimeToLocalFileTime (in: lpFileTime=0x18f85c, lpLocalFileTime=0x18f7cc | out: lpLocalFileTime=0x18f7cc) returned 1 [0024.073] FileTimeToDosDateTime (in: lpFileTime=0x18f7cc, lpFatDate=0x18f82a, lpFatTime=0x18f828 | out: lpFatDate=0x18f82a, lpFatTime=0x18f828) returned 1 [0024.073] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="da-DK", cchCount2=4) returned 1 [0024.073] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="da-DK", cchCount2=4) returned 1 [0024.073] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="da-DK", cchCount2=4) returned 1 [0024.073] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x28eed0 [0024.073] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f51c | out: lpLocalFileTime=0x18f51c) returned 1 [0024.073] FileTimeToDosDateTime (in: lpFileTime=0x18f51c, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.073] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="..", cAlternateFileName="")) returned 1 [0024.073] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f518 | out: lpLocalFileTime=0x18f518) returned 1 [0024.073] FileTimeToDosDateTime (in: lpFileTime=0x18f518, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.073] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0024.073] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f518 | out: lpLocalFileTime=0x18f518) returned 1 [0024.073] FileTimeToDosDateTime (in: lpFileTime=0x18f518, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.074] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0024.074] GetLastError () returned 0x12 [0024.074] FindClose (in: hFindFile=0x28eed0 | out: hFindFile=0x28eed0) returned 1 [0024.074] FindNextFileW (in: hFindFile=0x28de88, lpFindFileData=0x18f848 | out: lpFindFileData=0x18f848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790063, dwReserved1=0x6c0063, cFileName="de-DE", cAlternateFileName="")) returned 1 [0024.074] FileTimeToLocalFileTime (in: lpFileTime=0x18f85c, lpLocalFileTime=0x18f7cc | out: lpLocalFileTime=0x18f7cc) returned 1 [0024.074] FileTimeToDosDateTime (in: lpFileTime=0x18f7cc, lpFatDate=0x18f82a, lpFatTime=0x18f828 | out: lpFatDate=0x18f82a, lpFatTime=0x18f828) returned 1 [0024.074] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="de-DE", cchCount2=4) returned 1 [0024.074] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="de-DE", cchCount2=4) returned 1 [0024.074] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="de-DE", cchCount2=4) returned 1 [0024.074] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x28eed0 [0024.075] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f51c | out: lpLocalFileTime=0x18f51c) returned 1 [0024.075] FileTimeToDosDateTime (in: lpFileTime=0x18f51c, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.075] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="..", cAlternateFileName="")) returned 1 [0024.075] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f518 | out: lpLocalFileTime=0x18f518) returned 1 [0024.075] FileTimeToDosDateTime (in: lpFileTime=0x18f518, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.075] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0024.075] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f518 | out: lpLocalFileTime=0x18f518) returned 1 [0024.075] FileTimeToDosDateTime (in: lpFileTime=0x18f518, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.075] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0024.075] GetLastError () returned 0x12 [0024.075] FindClose (in: hFindFile=0x28eed0 | out: hFindFile=0x28eed0) returned 1 [0024.075] FindNextFileW (in: hFindFile=0x28de88, lpFindFileData=0x18f848 | out: lpFindFileData=0x18f848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790063, dwReserved1=0x6c0063, cFileName="el-GR", cAlternateFileName="")) returned 1 [0024.075] FileTimeToLocalFileTime (in: lpFileTime=0x18f85c, lpLocalFileTime=0x18f7cc | out: lpLocalFileTime=0x18f7cc) returned 1 [0024.075] FileTimeToDosDateTime (in: lpFileTime=0x18f7cc, lpFatDate=0x18f82a, lpFatTime=0x18f828 | out: lpFatDate=0x18f82a, lpFatTime=0x18f828) returned 1 [0024.075] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="el-GR", cchCount2=4) returned 1 [0024.075] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="el-GR", cchCount2=4) returned 1 [0024.075] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="el-GR", cchCount2=4) returned 1 [0024.075] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x28eed0 [0024.075] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f51c | out: lpLocalFileTime=0x18f51c) returned 1 [0024.075] FileTimeToDosDateTime (in: lpFileTime=0x18f51c, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.075] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="..", cAlternateFileName="")) returned 1 [0024.075] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f518 | out: lpLocalFileTime=0x18f518) returned 1 [0024.075] FileTimeToDosDateTime (in: lpFileTime=0x18f518, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.076] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0024.076] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f518 | out: lpLocalFileTime=0x18f518) returned 1 [0024.076] FileTimeToDosDateTime (in: lpFileTime=0x18f518, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.076] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0024.076] GetLastError () returned 0x12 [0024.076] FindClose (in: hFindFile=0x28eed0 | out: hFindFile=0x28eed0) returned 1 [0024.076] FindNextFileW (in: hFindFile=0x28de88, lpFindFileData=0x18f848 | out: lpFindFileData=0x18f848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790063, dwReserved1=0x6c0063, cFileName="en-US", cAlternateFileName="")) returned 1 [0024.076] FileTimeToLocalFileTime (in: lpFileTime=0x18f85c, lpLocalFileTime=0x18f7cc | out: lpLocalFileTime=0x18f7cc) returned 1 [0024.076] FileTimeToDosDateTime (in: lpFileTime=0x18f7cc, lpFatDate=0x18f82a, lpFatTime=0x18f828 | out: lpFatDate=0x18f82a, lpFatTime=0x18f828) returned 1 [0024.076] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="en-US", cchCount2=4) returned 1 [0024.076] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="en-US", cchCount2=4) returned 1 [0024.076] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="en-US", cchCount2=4) returned 1 [0024.076] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x28eed0 [0024.077] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f51c | out: lpLocalFileTime=0x18f51c) returned 1 [0024.077] FileTimeToDosDateTime (in: lpFileTime=0x18f51c, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.077] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="..", cAlternateFileName="")) returned 1 [0024.077] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f518 | out: lpLocalFileTime=0x18f518) returned 1 [0024.077] FileTimeToDosDateTime (in: lpFileTime=0x18f518, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.077] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0024.077] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f518 | out: lpLocalFileTime=0x18f518) returned 1 [0024.077] FileTimeToDosDateTime (in: lpFileTime=0x18f518, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.077] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0024.077] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f518 | out: lpLocalFileTime=0x18f518) returned 1 [0024.077] FileTimeToDosDateTime (in: lpFileTime=0x18f518, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.077] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0024.077] GetLastError () returned 0x12 [0024.077] FindClose (in: hFindFile=0x28eed0 | out: hFindFile=0x28eed0) returned 1 [0024.077] FindNextFileW (in: hFindFile=0x28de88, lpFindFileData=0x18f848 | out: lpFindFileData=0x18f848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790063, dwReserved1=0x6c0063, cFileName="es-ES", cAlternateFileName="")) returned 1 [0024.077] FileTimeToLocalFileTime (in: lpFileTime=0x18f85c, lpLocalFileTime=0x18f7cc | out: lpLocalFileTime=0x18f7cc) returned 1 [0024.077] FileTimeToDosDateTime (in: lpFileTime=0x18f7cc, lpFatDate=0x18f82a, lpFatTime=0x18f828 | out: lpFatDate=0x18f82a, lpFatTime=0x18f828) returned 1 [0024.077] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="es-ES", cchCount2=4) returned 1 [0024.077] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="es-ES", cchCount2=4) returned 1 [0024.077] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="es-ES", cchCount2=4) returned 1 [0024.077] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x28eed0 [0024.078] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f51c | out: lpLocalFileTime=0x18f51c) returned 1 [0024.078] FileTimeToDosDateTime (in: lpFileTime=0x18f51c, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.078] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="..", cAlternateFileName="")) returned 1 [0024.078] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f518 | out: lpLocalFileTime=0x18f518) returned 1 [0024.078] FileTimeToDosDateTime (in: lpFileTime=0x18f518, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.078] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0024.078] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f518 | out: lpLocalFileTime=0x18f518) returned 1 [0024.078] FileTimeToDosDateTime (in: lpFileTime=0x18f518, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.078] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0024.078] GetLastError () returned 0x12 [0024.078] FindClose (in: hFindFile=0x28eed0 | out: hFindFile=0x28eed0) returned 1 [0024.079] FindNextFileW (in: hFindFile=0x28de88, lpFindFileData=0x18f848 | out: lpFindFileData=0x18f848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790063, dwReserved1=0x6c0063, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0024.079] FileTimeToLocalFileTime (in: lpFileTime=0x18f85c, lpLocalFileTime=0x18f7cc | out: lpLocalFileTime=0x18f7cc) returned 1 [0024.079] FileTimeToDosDateTime (in: lpFileTime=0x18f7cc, lpFatDate=0x18f82a, lpFatTime=0x18f828 | out: lpFatDate=0x18f82a, lpFatTime=0x18f828) returned 1 [0024.079] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="fi-FI", cchCount2=4) returned 1 [0024.079] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="fi-FI", cchCount2=4) returned 1 [0024.079] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="fi-FI", cchCount2=4) returned 1 [0024.079] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x28eed0 [0024.079] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f51c | out: lpLocalFileTime=0x18f51c) returned 1 [0024.079] FileTimeToDosDateTime (in: lpFileTime=0x18f51c, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.079] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="..", cAlternateFileName="")) returned 1 [0024.079] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f518 | out: lpLocalFileTime=0x18f518) returned 1 [0024.079] FileTimeToDosDateTime (in: lpFileTime=0x18f518, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.079] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0024.079] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f518 | out: lpLocalFileTime=0x18f518) returned 1 [0024.079] FileTimeToDosDateTime (in: lpFileTime=0x18f518, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.079] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0024.079] GetLastError () returned 0x12 [0024.079] FindClose (in: hFindFile=0x28eed0 | out: hFindFile=0x28eed0) returned 1 [0024.079] FindNextFileW (in: hFindFile=0x28de88, lpFindFileData=0x18f848 | out: lpFindFileData=0x18f848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790063, dwReserved1=0x6c0063, cFileName="Fonts", cAlternateFileName="")) returned 1 [0024.079] FileTimeToLocalFileTime (in: lpFileTime=0x18f85c, lpLocalFileTime=0x18f7cc | out: lpLocalFileTime=0x18f7cc) returned 1 [0024.079] FileTimeToDosDateTime (in: lpFileTime=0x18f7cc, lpFatDate=0x18f82a, lpFatTime=0x18f828 | out: lpFatDate=0x18f82a, lpFatTime=0x18f828) returned 1 [0024.079] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="Fonts", cchCount2=4) returned 1 [0024.079] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="Fonts", cchCount2=4) returned 1 [0024.079] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="Fonts", cchCount2=4) returned 1 [0024.080] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x28eed0 [0024.080] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f51c | out: lpLocalFileTime=0x18f51c) returned 1 [0024.080] FileTimeToDosDateTime (in: lpFileTime=0x18f51c, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.080] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="..", cAlternateFileName="")) returned 1 [0024.080] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f518 | out: lpLocalFileTime=0x18f518) returned 1 [0024.080] FileTimeToDosDateTime (in: lpFileTime=0x18f518, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.080] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0024.080] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f518 | out: lpLocalFileTime=0x18f518) returned 1 [0024.080] FileTimeToDosDateTime (in: lpFileTime=0x18f518, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.081] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac191e00, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac191e00, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6505f253, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3b27a4, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1 [0024.081] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f518 | out: lpLocalFileTime=0x18f518) returned 1 [0024.081] FileTimeToDosDateTime (in: lpFileTime=0x18f518, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.081] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac204220, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac204220, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65274577, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1e46e4, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1 [0024.081] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f518 | out: lpLocalFileTime=0x18f518) returned 1 [0024.081] FileTimeToDosDateTime (in: lpFileTime=0x18f518, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.081] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac22a380, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac22a380, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6530caef, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x242f20, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1 [0024.081] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f518 | out: lpLocalFileTime=0x18f518) returned 1 [0024.081] FileTimeToDosDateTime (in: lpFileTime=0x18f518, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.081] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1 [0024.081] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f518 | out: lpLocalFileTime=0x18f518) returned 1 [0024.081] FileTimeToDosDateTime (in: lpFileTime=0x18f518, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.081] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 0 [0024.081] GetLastError () returned 0x12 [0024.081] FindClose (in: hFindFile=0x28eed0 | out: hFindFile=0x28eed0) returned 1 [0024.081] FindNextFileW (in: hFindFile=0x28de88, lpFindFileData=0x18f848 | out: lpFindFileData=0x18f848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790063, dwReserved1=0x6c0063, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0024.081] FileTimeToLocalFileTime (in: lpFileTime=0x18f85c, lpLocalFileTime=0x18f7cc | out: lpLocalFileTime=0x18f7cc) returned 1 [0024.081] FileTimeToDosDateTime (in: lpFileTime=0x18f7cc, lpFatDate=0x18f82a, lpFatTime=0x18f828 | out: lpFatDate=0x18f82a, lpFatTime=0x18f828) returned 1 [0024.081] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="fr-FR", cchCount2=4) returned 1 [0024.081] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="fr-FR", cchCount2=4) returned 1 [0024.081] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="fr-FR", cchCount2=4) returned 1 [0024.081] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x28eed0 [0024.082] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f51c | out: lpLocalFileTime=0x18f51c) returned 1 [0024.082] FileTimeToDosDateTime (in: lpFileTime=0x18f51c, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.082] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="..", cAlternateFileName="")) returned 1 [0024.082] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f518 | out: lpLocalFileTime=0x18f518) returned 1 [0024.082] FileTimeToDosDateTime (in: lpFileTime=0x18f518, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.082] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0024.082] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f518 | out: lpLocalFileTime=0x18f518) returned 1 [0024.082] FileTimeToDosDateTime (in: lpFileTime=0x18f518, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.082] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0024.082] GetLastError () returned 0x12 [0024.082] FindClose (in: hFindFile=0x28eed0 | out: hFindFile=0x28eed0) returned 1 [0024.083] FindNextFileW (in: hFindFile=0x28de88, lpFindFileData=0x18f848 | out: lpFindFileData=0x18f848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790063, dwReserved1=0x6c0063, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0024.083] FileTimeToLocalFileTime (in: lpFileTime=0x18f85c, lpLocalFileTime=0x18f7cc | out: lpLocalFileTime=0x18f7cc) returned 1 [0024.083] FileTimeToDosDateTime (in: lpFileTime=0x18f7cc, lpFatDate=0x18f82a, lpFatTime=0x18f828 | out: lpFatDate=0x18f82a, lpFatTime=0x18f828) returned 1 [0024.083] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="hu-HU", cchCount2=4) returned 1 [0024.083] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="hu-HU", cchCount2=4) returned 1 [0024.083] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="hu-HU", cchCount2=4) returned 1 [0024.083] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x28eed0 [0024.083] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f51c | out: lpLocalFileTime=0x18f51c) returned 1 [0024.083] FileTimeToDosDateTime (in: lpFileTime=0x18f51c, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.083] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="..", cAlternateFileName="")) returned 1 [0024.083] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f518 | out: lpLocalFileTime=0x18f518) returned 1 [0024.083] FileTimeToDosDateTime (in: lpFileTime=0x18f518, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.083] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0024.083] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f518 | out: lpLocalFileTime=0x18f518) returned 1 [0024.083] FileTimeToDosDateTime (in: lpFileTime=0x18f518, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.083] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0024.083] GetLastError () returned 0x12 [0024.083] FindClose (in: hFindFile=0x28eed0 | out: hFindFile=0x28eed0) returned 1 [0024.083] FindNextFileW (in: hFindFile=0x28de88, lpFindFileData=0x18f848 | out: lpFindFileData=0x18f848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790063, dwReserved1=0x6c0063, cFileName="it-IT", cAlternateFileName="")) returned 1 [0024.083] FileTimeToLocalFileTime (in: lpFileTime=0x18f85c, lpLocalFileTime=0x18f7cc | out: lpLocalFileTime=0x18f7cc) returned 1 [0024.083] FileTimeToDosDateTime (in: lpFileTime=0x18f7cc, lpFatDate=0x18f82a, lpFatTime=0x18f828 | out: lpFatDate=0x18f82a, lpFatTime=0x18f828) returned 1 [0024.083] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="it-IT", cchCount2=4) returned 1 [0024.083] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="it-IT", cchCount2=4) returned 1 [0024.083] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="it-IT", cchCount2=4) returned 1 [0024.083] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x28eed0 [0024.085] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f51c | out: lpLocalFileTime=0x18f51c) returned 1 [0024.085] FileTimeToDosDateTime (in: lpFileTime=0x18f51c, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.085] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="..", cAlternateFileName="")) returned 1 [0024.085] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f518 | out: lpLocalFileTime=0x18f518) returned 1 [0024.085] FileTimeToDosDateTime (in: lpFileTime=0x18f518, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.085] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0024.085] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f518 | out: lpLocalFileTime=0x18f518) returned 1 [0024.085] FileTimeToDosDateTime (in: lpFileTime=0x18f518, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.085] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0024.085] GetLastError () returned 0x12 [0024.085] FindClose (in: hFindFile=0x28eed0 | out: hFindFile=0x28eed0) returned 1 [0024.085] FindNextFileW (in: hFindFile=0x28de88, lpFindFileData=0x18f848 | out: lpFindFileData=0x18f848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790063, dwReserved1=0x6c0063, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0024.085] FileTimeToLocalFileTime (in: lpFileTime=0x18f85c, lpLocalFileTime=0x18f7cc | out: lpLocalFileTime=0x18f7cc) returned 1 [0024.085] FileTimeToDosDateTime (in: lpFileTime=0x18f7cc, lpFatDate=0x18f82a, lpFatTime=0x18f828 | out: lpFatDate=0x18f82a, lpFatTime=0x18f828) returned 1 [0024.085] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="ja-JP", cchCount2=4) returned 1 [0024.085] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="ja-JP", cchCount2=4) returned 1 [0024.085] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="ja-JP", cchCount2=4) returned 1 [0024.085] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x28eed0 [0024.085] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f51c | out: lpLocalFileTime=0x18f51c) returned 1 [0024.085] FileTimeToDosDateTime (in: lpFileTime=0x18f51c, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.085] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="..", cAlternateFileName="")) returned 1 [0024.086] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f518 | out: lpLocalFileTime=0x18f518) returned 1 [0024.086] FileTimeToDosDateTime (in: lpFileTime=0x18f518, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.086] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0024.086] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f518 | out: lpLocalFileTime=0x18f518) returned 1 [0024.086] FileTimeToDosDateTime (in: lpFileTime=0x18f518, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.086] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0024.086] GetLastError () returned 0x12 [0024.086] FindClose (in: hFindFile=0x28eed0 | out: hFindFile=0x28eed0) returned 1 [0024.086] FindNextFileW (in: hFindFile=0x28de88, lpFindFileData=0x18f848 | out: lpFindFileData=0x18f848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790063, dwReserved1=0x6c0063, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0024.086] FileTimeToLocalFileTime (in: lpFileTime=0x18f85c, lpLocalFileTime=0x18f7cc | out: lpLocalFileTime=0x18f7cc) returned 1 [0024.086] FileTimeToDosDateTime (in: lpFileTime=0x18f7cc, lpFatDate=0x18f82a, lpFatTime=0x18f828 | out: lpFatDate=0x18f82a, lpFatTime=0x18f828) returned 1 [0024.086] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="ko-KR", cchCount2=4) returned 1 [0024.086] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="ko-KR", cchCount2=4) returned 1 [0024.086] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="ko-KR", cchCount2=4) returned 1 [0024.086] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x28eed0 [0024.087] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f51c | out: lpLocalFileTime=0x18f51c) returned 1 [0024.087] FileTimeToDosDateTime (in: lpFileTime=0x18f51c, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.087] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="..", cAlternateFileName="")) returned 1 [0024.087] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f518 | out: lpLocalFileTime=0x18f518) returned 1 [0024.087] FileTimeToDosDateTime (in: lpFileTime=0x18f518, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.087] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0024.087] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f518 | out: lpLocalFileTime=0x18f518) returned 1 [0024.087] FileTimeToDosDateTime (in: lpFileTime=0x18f518, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.087] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0024.087] GetLastError () returned 0x12 [0024.087] FindClose (in: hFindFile=0x28eed0 | out: hFindFile=0x28eed0) returned 1 [0024.087] FindNextFileW (in: hFindFile=0x28de88, lpFindFileData=0x18f848 | out: lpFindFileData=0x18f848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x790063, dwReserved1=0x6c0063, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0024.087] FileTimeToLocalFileTime (in: lpFileTime=0x18f85c, lpLocalFileTime=0x18f7cc | out: lpLocalFileTime=0x18f7cc) returned 1 [0024.087] FileTimeToDosDateTime (in: lpFileTime=0x18f7cc, lpFatDate=0x18f82a, lpFatTime=0x18f828 | out: lpFatDate=0x18f82a, lpFatTime=0x18f828) returned 1 [0024.087] FindNextFileW (in: hFindFile=0x28de88, lpFindFileData=0x18f848 | out: lpFindFileData=0x18f848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790063, dwReserved1=0x6c0063, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0024.087] FileTimeToLocalFileTime (in: lpFileTime=0x18f85c, lpLocalFileTime=0x18f7cc | out: lpLocalFileTime=0x18f7cc) returned 1 [0024.087] FileTimeToDosDateTime (in: lpFileTime=0x18f7cc, lpFatDate=0x18f82a, lpFatTime=0x18f828 | out: lpFatDate=0x18f82a, lpFatTime=0x18f828) returned 1 [0024.087] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="nb-NO", cchCount2=4) returned 1 [0024.087] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="nb-NO", cchCount2=4) returned 1 [0024.087] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="nb-NO", cchCount2=4) returned 1 [0024.088] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x28eed0 [0024.088] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f51c | out: lpLocalFileTime=0x18f51c) returned 1 [0024.088] FileTimeToDosDateTime (in: lpFileTime=0x18f51c, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.088] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="..", cAlternateFileName="")) returned 1 [0024.088] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f518 | out: lpLocalFileTime=0x18f518) returned 1 [0024.088] FileTimeToDosDateTime (in: lpFileTime=0x18f518, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.088] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0024.088] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f518 | out: lpLocalFileTime=0x18f518) returned 1 [0024.088] FileTimeToDosDateTime (in: lpFileTime=0x18f518, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.088] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0024.088] GetLastError () returned 0x12 [0024.088] FindClose (in: hFindFile=0x28eed0 | out: hFindFile=0x28eed0) returned 1 [0024.088] FindNextFileW (in: hFindFile=0x28de88, lpFindFileData=0x18f848 | out: lpFindFileData=0x18f848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790063, dwReserved1=0x6c0063, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0024.088] FileTimeToLocalFileTime (in: lpFileTime=0x18f85c, lpLocalFileTime=0x18f7cc | out: lpLocalFileTime=0x18f7cc) returned 1 [0024.088] FileTimeToDosDateTime (in: lpFileTime=0x18f7cc, lpFatDate=0x18f82a, lpFatTime=0x18f828 | out: lpFatDate=0x18f82a, lpFatTime=0x18f828) returned 1 [0024.088] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="nl-NL", cchCount2=4) returned 1 [0024.088] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="nl-NL", cchCount2=4) returned 1 [0024.088] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="nl-NL", cchCount2=4) returned 1 [0024.088] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x28eed0 [0024.089] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f51c | out: lpLocalFileTime=0x18f51c) returned 1 [0024.089] FileTimeToDosDateTime (in: lpFileTime=0x18f51c, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.089] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="..", cAlternateFileName="")) returned 1 [0024.089] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f518 | out: lpLocalFileTime=0x18f518) returned 1 [0024.089] FileTimeToDosDateTime (in: lpFileTime=0x18f518, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.089] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0024.089] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f518 | out: lpLocalFileTime=0x18f518) returned 1 [0024.089] FileTimeToDosDateTime (in: lpFileTime=0x18f518, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.089] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0024.089] GetLastError () returned 0x12 [0024.089] FindClose (in: hFindFile=0x28eed0 | out: hFindFile=0x28eed0) returned 1 [0024.090] FindNextFileW (in: hFindFile=0x28de88, lpFindFileData=0x18f848 | out: lpFindFileData=0x18f848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790063, dwReserved1=0x6c0063, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0024.090] FileTimeToLocalFileTime (in: lpFileTime=0x18f85c, lpLocalFileTime=0x18f7cc | out: lpLocalFileTime=0x18f7cc) returned 1 [0024.090] FileTimeToDosDateTime (in: lpFileTime=0x18f7cc, lpFatDate=0x18f82a, lpFatTime=0x18f828 | out: lpFatDate=0x18f82a, lpFatTime=0x18f828) returned 1 [0024.090] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="pl-PL", cchCount2=4) returned 1 [0024.090] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="pl-PL", cchCount2=4) returned 1 [0024.090] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="pl-PL", cchCount2=4) returned 1 [0024.090] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x28eed0 [0024.090] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f51c | out: lpLocalFileTime=0x18f51c) returned 1 [0024.090] FileTimeToDosDateTime (in: lpFileTime=0x18f51c, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.090] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="..", cAlternateFileName="")) returned 1 [0024.090] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f518 | out: lpLocalFileTime=0x18f518) returned 1 [0024.090] FileTimeToDosDateTime (in: lpFileTime=0x18f518, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.090] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0024.090] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f518 | out: lpLocalFileTime=0x18f518) returned 1 [0024.090] FileTimeToDosDateTime (in: lpFileTime=0x18f518, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.090] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0024.090] GetLastError () returned 0x12 [0024.090] FindClose (in: hFindFile=0x28eed0 | out: hFindFile=0x28eed0) returned 1 [0024.090] FindNextFileW (in: hFindFile=0x28de88, lpFindFileData=0x18f848 | out: lpFindFileData=0x18f848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790063, dwReserved1=0x6c0063, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0024.090] FileTimeToLocalFileTime (in: lpFileTime=0x18f85c, lpLocalFileTime=0x18f7cc | out: lpLocalFileTime=0x18f7cc) returned 1 [0024.090] FileTimeToDosDateTime (in: lpFileTime=0x18f7cc, lpFatDate=0x18f82a, lpFatTime=0x18f828 | out: lpFatDate=0x18f82a, lpFatTime=0x18f828) returned 1 [0024.090] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="pt-BR", cchCount2=4) returned 1 [0024.090] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="pt-BR", cchCount2=4) returned 1 [0024.090] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="pt-BR", cchCount2=4) returned 1 [0024.090] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x28eed0 [0024.091] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f51c | out: lpLocalFileTime=0x18f51c) returned 1 [0024.091] FileTimeToDosDateTime (in: lpFileTime=0x18f51c, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.091] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="..", cAlternateFileName="")) returned 1 [0024.091] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f518 | out: lpLocalFileTime=0x18f518) returned 1 [0024.091] FileTimeToDosDateTime (in: lpFileTime=0x18f518, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.091] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0024.091] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f518 | out: lpLocalFileTime=0x18f518) returned 1 [0024.091] FileTimeToDosDateTime (in: lpFileTime=0x18f518, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.092] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0024.092] GetLastError () returned 0x12 [0024.092] FindClose (in: hFindFile=0x28eed0 | out: hFindFile=0x28eed0) returned 1 [0024.092] FindNextFileW (in: hFindFile=0x28de88, lpFindFileData=0x18f848 | out: lpFindFileData=0x18f848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790063, dwReserved1=0x6c0063, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0024.092] FileTimeToLocalFileTime (in: lpFileTime=0x18f85c, lpLocalFileTime=0x18f7cc | out: lpLocalFileTime=0x18f7cc) returned 1 [0024.092] FileTimeToDosDateTime (in: lpFileTime=0x18f7cc, lpFatDate=0x18f82a, lpFatTime=0x18f828 | out: lpFatDate=0x18f82a, lpFatTime=0x18f828) returned 1 [0024.092] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="pt-PT", cchCount2=4) returned 1 [0024.092] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="pt-PT", cchCount2=4) returned 1 [0024.092] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="pt-PT", cchCount2=4) returned 1 [0024.092] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x28eed0 [0024.092] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f51c | out: lpLocalFileTime=0x18f51c) returned 1 [0024.092] FileTimeToDosDateTime (in: lpFileTime=0x18f51c, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.092] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="..", cAlternateFileName="")) returned 1 [0024.092] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f518 | out: lpLocalFileTime=0x18f518) returned 1 [0024.092] FileTimeToDosDateTime (in: lpFileTime=0x18f518, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.092] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0024.092] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f518 | out: lpLocalFileTime=0x18f518) returned 1 [0024.092] FileTimeToDosDateTime (in: lpFileTime=0x18f518, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.092] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0024.092] GetLastError () returned 0x12 [0024.092] FindClose (in: hFindFile=0x28eed0 | out: hFindFile=0x28eed0) returned 1 [0024.092] FindNextFileW (in: hFindFile=0x28de88, lpFindFileData=0x18f848 | out: lpFindFileData=0x18f848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790063, dwReserved1=0x6c0063, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0024.093] FileTimeToLocalFileTime (in: lpFileTime=0x18f85c, lpLocalFileTime=0x18f7cc | out: lpLocalFileTime=0x18f7cc) returned 1 [0024.093] FileTimeToDosDateTime (in: lpFileTime=0x18f7cc, lpFatDate=0x18f82a, lpFatTime=0x18f828 | out: lpFatDate=0x18f82a, lpFatTime=0x18f828) returned 1 [0024.093] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="ru-RU", cchCount2=4) returned 1 [0024.093] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="ru-RU", cchCount2=4) returned 1 [0024.093] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="ru-RU", cchCount2=4) returned 1 [0024.093] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x28eed0 [0024.093] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f51c | out: lpLocalFileTime=0x18f51c) returned 1 [0024.093] FileTimeToDosDateTime (in: lpFileTime=0x18f51c, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.093] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="..", cAlternateFileName="")) returned 1 [0024.094] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f518 | out: lpLocalFileTime=0x18f518) returned 1 [0024.094] FileTimeToDosDateTime (in: lpFileTime=0x18f518, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.094] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0024.094] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f518 | out: lpLocalFileTime=0x18f518) returned 1 [0024.094] FileTimeToDosDateTime (in: lpFileTime=0x18f518, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.094] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0024.094] GetLastError () returned 0x12 [0024.094] FindClose (in: hFindFile=0x28eed0 | out: hFindFile=0x28eed0) returned 1 [0024.094] FindNextFileW (in: hFindFile=0x28de88, lpFindFileData=0x18f848 | out: lpFindFileData=0x18f848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790063, dwReserved1=0x6c0063, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0024.094] FileTimeToLocalFileTime (in: lpFileTime=0x18f85c, lpLocalFileTime=0x18f7cc | out: lpLocalFileTime=0x18f7cc) returned 1 [0024.094] FileTimeToDosDateTime (in: lpFileTime=0x18f7cc, lpFatDate=0x18f82a, lpFatTime=0x18f828 | out: lpFatDate=0x18f82a, lpFatTime=0x18f828) returned 1 [0024.094] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="sv-SE", cchCount2=4) returned 1 [0024.094] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="sv-SE", cchCount2=4) returned 1 [0024.094] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="sv-SE", cchCount2=4) returned 1 [0024.094] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*", lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x28eed0 [0024.094] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f51c | out: lpLocalFileTime=0x18f51c) returned 1 [0024.094] FileTimeToDosDateTime (in: lpFileTime=0x18f51c, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.094] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="..", cAlternateFileName="")) returned 1 [0024.094] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f518 | out: lpLocalFileTime=0x18f518) returned 1 [0024.094] FileTimeToDosDateTime (in: lpFileTime=0x18f518, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.094] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0024.094] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f518 | out: lpLocalFileTime=0x18f518) returned 1 [0024.094] FileTimeToDosDateTime (in: lpFileTime=0x18f518, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.095] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0024.095] GetLastError () returned 0x12 [0024.095] FindClose (in: hFindFile=0x28eed0 | out: hFindFile=0x28eed0) returned 1 [0024.095] FindNextFileW (in: hFindFile=0x28de88, lpFindFileData=0x18f848 | out: lpFindFileData=0x18f848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790063, dwReserved1=0x6c0063, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0024.095] FileTimeToLocalFileTime (in: lpFileTime=0x18f85c, lpLocalFileTime=0x18f7cc | out: lpLocalFileTime=0x18f7cc) returned 1 [0024.095] FileTimeToDosDateTime (in: lpFileTime=0x18f7cc, lpFatDate=0x18f82a, lpFatTime=0x18f828 | out: lpFatDate=0x18f82a, lpFatTime=0x18f828) returned 1 [0024.095] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="tr-TR", cchCount2=4) returned 1 [0024.095] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="tr-TR", cchCount2=4) returned 1 [0024.095] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="tr-TR", cchCount2=4) returned 1 [0024.095] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*", lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x28eed0 [0024.096] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f51c | out: lpLocalFileTime=0x18f51c) returned 1 [0024.096] FileTimeToDosDateTime (in: lpFileTime=0x18f51c, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.096] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="..", cAlternateFileName="")) returned 1 [0024.096] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f518 | out: lpLocalFileTime=0x18f518) returned 1 [0024.096] FileTimeToDosDateTime (in: lpFileTime=0x18f518, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.096] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0024.096] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f518 | out: lpLocalFileTime=0x18f518) returned 1 [0024.096] FileTimeToDosDateTime (in: lpFileTime=0x18f518, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.096] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0024.096] GetLastError () returned 0x12 [0024.096] FindClose (in: hFindFile=0x28eed0 | out: hFindFile=0x28eed0) returned 1 [0024.096] FindNextFileW (in: hFindFile=0x28de88, lpFindFileData=0x18f848 | out: lpFindFileData=0x18f848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790063, dwReserved1=0x6c0063, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0024.096] FileTimeToLocalFileTime (in: lpFileTime=0x18f85c, lpLocalFileTime=0x18f7cc | out: lpLocalFileTime=0x18f7cc) returned 1 [0024.096] FileTimeToDosDateTime (in: lpFileTime=0x18f7cc, lpFatDate=0x18f82a, lpFatTime=0x18f828 | out: lpFatDate=0x18f82a, lpFatTime=0x18f828) returned 1 [0024.096] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="zh-CN", cchCount2=4) returned 1 [0024.096] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="zh-CN", cchCount2=4) returned 1 [0024.096] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="zh-CN", cchCount2=4) returned 1 [0024.096] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*", lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x28eed0 [0024.096] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f51c | out: lpLocalFileTime=0x18f51c) returned 1 [0024.096] FileTimeToDosDateTime (in: lpFileTime=0x18f51c, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.096] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="..", cAlternateFileName="")) returned 1 [0024.097] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f518 | out: lpLocalFileTime=0x18f518) returned 1 [0024.097] FileTimeToDosDateTime (in: lpFileTime=0x18f518, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.097] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0024.097] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f518 | out: lpLocalFileTime=0x18f518) returned 1 [0024.097] FileTimeToDosDateTime (in: lpFileTime=0x18f518, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.097] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0024.097] GetLastError () returned 0x12 [0024.097] FindClose (in: hFindFile=0x28eed0 | out: hFindFile=0x28eed0) returned 1 [0024.097] FindNextFileW (in: hFindFile=0x28de88, lpFindFileData=0x18f848 | out: lpFindFileData=0x18f848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790063, dwReserved1=0x6c0063, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0024.097] FileTimeToLocalFileTime (in: lpFileTime=0x18f85c, lpLocalFileTime=0x18f7cc | out: lpLocalFileTime=0x18f7cc) returned 1 [0024.097] FileTimeToDosDateTime (in: lpFileTime=0x18f7cc, lpFatDate=0x18f82a, lpFatTime=0x18f828 | out: lpFatDate=0x18f82a, lpFatTime=0x18f828) returned 1 [0024.097] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="zh-HK", cchCount2=4) returned 1 [0024.097] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="zh-HK", cchCount2=4) returned 1 [0024.097] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="zh-HK", cchCount2=4) returned 1 [0024.097] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*", lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x28eed0 [0024.098] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f51c | out: lpLocalFileTime=0x18f51c) returned 1 [0024.098] FileTimeToDosDateTime (in: lpFileTime=0x18f51c, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.098] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="..", cAlternateFileName="")) returned 1 [0024.098] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f518 | out: lpLocalFileTime=0x18f518) returned 1 [0024.098] FileTimeToDosDateTime (in: lpFileTime=0x18f518, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.098] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0024.098] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f518 | out: lpLocalFileTime=0x18f518) returned 1 [0024.098] FileTimeToDosDateTime (in: lpFileTime=0x18f518, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.098] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0024.098] GetLastError () returned 0x12 [0024.098] FindClose (in: hFindFile=0x28eed0 | out: hFindFile=0x28eed0) returned 1 [0024.098] FindNextFileW (in: hFindFile=0x28de88, lpFindFileData=0x18f848 | out: lpFindFileData=0x18f848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790063, dwReserved1=0x6c0063, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0024.098] FileTimeToLocalFileTime (in: lpFileTime=0x18f85c, lpLocalFileTime=0x18f7cc | out: lpLocalFileTime=0x18f7cc) returned 1 [0024.098] FileTimeToDosDateTime (in: lpFileTime=0x18f7cc, lpFatDate=0x18f82a, lpFatTime=0x18f828 | out: lpFatDate=0x18f82a, lpFatTime=0x18f828) returned 1 [0024.098] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="zh-TW", cchCount2=4) returned 1 [0024.098] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="zh-TW", cchCount2=4) returned 1 [0024.098] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="zh-TW", cchCount2=4) returned 1 [0024.098] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-TW\\*", lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x28eed0 [0024.099] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f51c | out: lpLocalFileTime=0x18f51c) returned 1 [0024.099] FileTimeToDosDateTime (in: lpFileTime=0x18f51c, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.099] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="..", cAlternateFileName="")) returned 1 [0024.099] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f518 | out: lpLocalFileTime=0x18f518) returned 1 [0024.099] FileTimeToDosDateTime (in: lpFileTime=0x18f518, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.099] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0024.099] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f518 | out: lpLocalFileTime=0x18f518) returned 1 [0024.099] FileTimeToDosDateTime (in: lpFileTime=0x18f518, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.099] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0024.099] GetLastError () returned 0x12 [0024.099] FindClose (in: hFindFile=0x28eed0 | out: hFindFile=0x28eed0) returned 1 [0024.099] FindNextFileW (in: hFindFile=0x28de88, lpFindFileData=0x18f848 | out: lpFindFileData=0x18f848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790063, dwReserved1=0x6c0063, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0024.099] GetLastError () returned 0x12 [0024.099] FindClose (in: hFindFile=0x28de88 | out: hFindFile=0x28de88) returned 1 [0024.099] FindNextFileW (in: hFindFile=0x28ce40, lpFindFileData=0x18fafc | out: lpFindFileData=0x18fafc*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0024.099] FileTimeToLocalFileTime (in: lpFileTime=0x18fb10, lpLocalFileTime=0x18fa80 | out: lpLocalFileTime=0x18fa80) returned 1 [0024.099] FileTimeToDosDateTime (in: lpFileTime=0x18fa80, lpFatDate=0x18fade, lpFatTime=0x18fadc | out: lpFatDate=0x18fade, lpFatTime=0x18fadc) returned 1 [0024.099] FindNextFileW (in: hFindFile=0x28ce40, lpFindFileData=0x18fafc | out: lpFindFileData=0x18fafc*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac54a060, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac54a060, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac54a060, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0024.099] FileTimeToLocalFileTime (in: lpFileTime=0x18fb10, lpLocalFileTime=0x18fa80 | out: lpLocalFileTime=0x18fa80) returned 1 [0024.099] FileTimeToDosDateTime (in: lpFileTime=0x18fa80, lpFatDate=0x18fade, lpFatTime=0x18fadc | out: lpFatDate=0x18fade, lpFatTime=0x18fadc) returned 1 [0024.099] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="BOOTSECT.BAK", cchCount2=8) returned 1 [0024.099] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="BOOTSECT.BAK", cchCount2=4) returned 1 [0024.099] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="BOOTSECT.BAK", cchCount2=8) returned 1 [0024.099] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="BOOTSECT.BAK", cchCount2=4) returned 1 [0024.100] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="BOOTSECT.BAK", cchCount2=8) returned 1 [0024.100] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="BOOTSECT.BAK", cchCount2=4) returned 1 [0024.100] FindNextFileW (in: hFindFile=0x28ce40, lpFindFileData=0x18fafc | out: lpFindFileData=0x18fafc*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Config.Msi", cAlternateFileName="")) returned 1 [0024.100] FileTimeToLocalFileTime (in: lpFileTime=0x18fb10, lpLocalFileTime=0x18fa80 | out: lpLocalFileTime=0x18fa80) returned 1 [0024.100] FileTimeToDosDateTime (in: lpFileTime=0x18fa80, lpFatDate=0x18fade, lpFatTime=0x18fadc | out: lpFatDate=0x18fade, lpFatTime=0x18fadc) returned 1 [0024.100] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="Config.Msi", cchCount2=8) returned 1 [0024.100] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="Config.Msi", cchCount2=4) returned 1 [0024.100] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="Config.Msi", cchCount2=8) returned 1 [0024.100] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="Config.Msi", cchCount2=4) returned 1 [0024.100] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="Config.Msi", cchCount2=8) returned 1 [0024.100] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="Config.Msi", cchCount2=4) returned 1 [0024.100] FindFirstFileW (in: lpFileName="C:\\Config.Msi\\*", lpFindFileData=0x18f848 | out: lpFindFileData=0x18f848*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790063, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x28de88 [0024.101] FileTimeToLocalFileTime (in: lpFileTime=0x18f85c, lpLocalFileTime=0x18f7d0 | out: lpLocalFileTime=0x18f7d0) returned 1 [0024.101] FileTimeToDosDateTime (in: lpFileTime=0x18f7d0, lpFatDate=0x18f82a, lpFatTime=0x18f828 | out: lpFatDate=0x18f82a, lpFatTime=0x18f828) returned 1 [0024.101] FindNextFileW (in: hFindFile=0x28de88, lpFindFileData=0x18f848 | out: lpFindFileData=0x18f848*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790063, dwReserved1=0x28cb50, cFileName="..", cAlternateFileName="")) returned 1 [0024.101] FileTimeToLocalFileTime (in: lpFileTime=0x18f85c, lpLocalFileTime=0x18f7cc | out: lpLocalFileTime=0x18f7cc) returned 1 [0024.101] FileTimeToDosDateTime (in: lpFileTime=0x18f7cc, lpFatDate=0x18f82a, lpFatTime=0x18f828 | out: lpFatDate=0x18f82a, lpFatTime=0x18f828) returned 1 [0024.101] FindNextFileW (in: hFindFile=0x28de88, lpFindFileData=0x18f848 | out: lpFindFileData=0x18f848*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790063, dwReserved1=0x28cb50, cFileName="..", cAlternateFileName="")) returned 0 [0024.101] GetLastError () returned 0x12 [0024.101] FindClose (in: hFindFile=0x28de88 | out: hFindFile=0x28de88) returned 1 [0024.101] FindNextFileW (in: hFindFile=0x28ce40, lpFindFileData=0x18fafc | out: lpFindFileData=0x18fafc*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0024.101] FileTimeToLocalFileTime (in: lpFileTime=0x18fb10, lpLocalFileTime=0x18fa80 | out: lpLocalFileTime=0x18fa80) returned 1 [0024.101] FileTimeToDosDateTime (in: lpFileTime=0x18fa80, lpFatDate=0x18fade, lpFatTime=0x18fadc | out: lpFatDate=0x18fade, lpFatTime=0x18fadc) returned 1 [0024.101] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="Documents and Settings", cchCount2=8) returned 1 [0024.101] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="Documents and Settings", cchCount2=4) returned 1 [0024.101] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="Documents and Settings", cchCount2=8) returned 1 [0024.101] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="Documents and Settings", cchCount2=4) returned 1 [0024.101] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="Documents and Settings", cchCount2=8) returned 1 [0024.101] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="Documents and Settings", cchCount2=4) returned 1 [0024.101] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\*", lpFindFileData=0x18f848 | out: lpFindFileData=0x18f848*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790063, dwReserved1=0x28cb50, cFileName="..", cAlternateFileName="N弼f㔴Ǿ")) returned 0xffffffff [0024.102] GetLastError () returned 0x5 [0024.102] FindNextFileW (in: hFindFile=0x28ce40, lpFindFileData=0x18fafc | out: lpFindFileData=0x18fafc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x56257dc0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x56257dc0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x813b7be0, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0024.102] FileTimeToLocalFileTime (in: lpFileTime=0x18fb10, lpLocalFileTime=0x18fa80 | out: lpLocalFileTime=0x18fa80) returned 1 [0024.102] FileTimeToDosDateTime (in: lpFileTime=0x18fa80, lpFatDate=0x18fade, lpFatTime=0x18fadc | out: lpFatDate=0x18fade, lpFatTime=0x18fadc) returned 1 [0024.102] FindNextFileW (in: hFindFile=0x28ce40, lpFindFileData=0x18fafc | out: lpFindFileData=0x18fafc*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0024.102] FileTimeToLocalFileTime (in: lpFileTime=0x18fb10, lpLocalFileTime=0x18fa80 | out: lpLocalFileTime=0x18fa80) returned 1 [0024.102] FileTimeToDosDateTime (in: lpFileTime=0x18fa80, lpFatDate=0x18fade, lpFatTime=0x18fadc | out: lpFatDate=0x18fade, lpFatTime=0x18fadc) returned 1 [0024.102] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="MSOCache", cchCount2=8) returned 1 [0024.102] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="MSOCache", cchCount2=4) returned 1 [0024.102] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="MSOCache", cchCount2=8) returned 1 [0024.102] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="MSOCache", cchCount2=4) returned 1 [0024.102] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="MSOCache", cchCount2=8) returned 1 [0024.102] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="MSOCache", cchCount2=4) returned 1 [0024.102] FindFirstFileW (in: lpFileName="C:\\MSOCache\\*", lpFindFileData=0x18f848 | out: lpFindFileData=0x18f848*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790063, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x28de88 [0024.102] FileTimeToLocalFileTime (in: lpFileTime=0x18f85c, lpLocalFileTime=0x18f7d0 | out: lpLocalFileTime=0x18f7d0) returned 1 [0024.102] FileTimeToDosDateTime (in: lpFileTime=0x18f7d0, lpFatDate=0x18f82a, lpFatTime=0x18f828 | out: lpFatDate=0x18f82a, lpFatTime=0x18f828) returned 1 [0024.102] FindNextFileW (in: hFindFile=0x28de88, lpFindFileData=0x18f848 | out: lpFindFileData=0x18f848*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790063, dwReserved1=0x28cb50, cFileName="..", cAlternateFileName="")) returned 1 [0024.102] FileTimeToLocalFileTime (in: lpFileTime=0x18f85c, lpLocalFileTime=0x18f7cc | out: lpLocalFileTime=0x18f7cc) returned 1 [0024.102] FileTimeToDosDateTime (in: lpFileTime=0x18f7cc, lpFatDate=0x18f82a, lpFatTime=0x18f828 | out: lpFatDate=0x18f82a, lpFatTime=0x18f828) returned 1 [0024.102] FindNextFileW (in: hFindFile=0x28de88, lpFindFileData=0x18f848 | out: lpFindFileData=0x18f848*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790063, dwReserved1=0x28cb50, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0024.102] FileTimeToLocalFileTime (in: lpFileTime=0x18f85c, lpLocalFileTime=0x18f7cc | out: lpLocalFileTime=0x18f7cc) returned 1 [0024.102] FileTimeToDosDateTime (in: lpFileTime=0x18f7cc, lpFatDate=0x18f82a, lpFatTime=0x18f828 | out: lpFatDate=0x18f82a, lpFatTime=0x18f828) returned 1 [0024.102] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="All Users", cchCount2=8) returned 1 [0024.102] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="All Users", cchCount2=4) returned 1 [0024.102] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="All Users", cchCount2=8) returned 1 [0024.103] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="All Users", cchCount2=4) returned 1 [0024.103] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="All Users", cchCount2=8) returned 1 [0024.103] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="All Users", cchCount2=4) returned 1 [0024.103] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\*", lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x28eed0 [0024.105] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f51c | out: lpLocalFileTime=0x18f51c) returned 1 [0024.105] FileTimeToDosDateTime (in: lpFileTime=0x18f51c, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.105] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="..", cAlternateFileName="")) returned 1 [0024.105] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f518 | out: lpLocalFileTime=0x18f518) returned 1 [0024.105] FileTimeToDosDateTime (in: lpFileTime=0x18f518, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.105] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="{90140000-0016-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~3")) returned 1 [0024.105] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f518 | out: lpLocalFileTime=0x18f518) returned 1 [0024.105] FileTimeToDosDateTime (in: lpFileTime=0x18f518, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.105] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="{90140000-0016-0409-1000-0000000FF1CE}-C", cchCount2=8) returned 1 [0024.105] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="{90140000-0016-0409-1000-0000000FF1CE}-C", cchCount2=4) returned 1 [0024.105] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="{90140000-0016-0409-1000-0000000FF1CE}-C", cchCount2=8) returned 1 [0024.105] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="{90140000-0016-0409-1000-0000000FF1CE}-C", cchCount2=4) returned 1 [0024.106] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="{90140000-0016-0409-1000-0000000FF1CE}-C", cchCount2=8) returned 1 [0024.106] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="{90140000-0016-0409-1000-0000000FF1CE}-C", cchCount2=4) returned 1 [0024.106] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x28ff18 [0024.107] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f268 | out: lpLocalFileTime=0x18f268) returned 1 [0024.107] FileTimeToDosDateTime (in: lpFileTime=0x18f268, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.107] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0024.107] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f264 | out: lpLocalFileTime=0x18f264) returned 1 [0024.107] FileTimeToDosDateTime (in: lpFileTime=0x18f264, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.107] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x393df700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x393df700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xed035930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x102fcbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelLR.cab", cAlternateFileName="")) returned 1 [0024.107] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f264 | out: lpLocalFileTime=0x18f264) returned 1 [0024.107] FileTimeToDosDateTime (in: lpFileTime=0x18f264, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.107] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xece1ee80, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.msi", cAlternateFileName="")) returned 1 [0024.107] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f264 | out: lpLocalFileTime=0x18f264) returned 1 [0024.107] FileTimeToDosDateTime (in: lpFileTime=0x18f264, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.107] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.xml", cAlternateFileName="")) returned 1 [0024.107] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f264 | out: lpLocalFileTime=0x18f264) returned 1 [0024.107] FileTimeToDosDateTime (in: lpFileTime=0x18f264, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.107] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="ExcelMUI.xml", cchCount2=8) returned 1 [0024.107] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="ExcelMUI.xml", cchCount2=4) returned 1 [0024.107] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="ExcelMUI.xml", cchCount2=8) returned 1 [0024.107] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="ExcelMUI.xml", cchCount2=4) returned 1 [0024.107] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="ExcelMUI.xml", cchCount2=8) returned 1 [0024.107] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="ExcelMUI.xml", cchCount2=4) returned 1 [0024.107] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0024.107] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f264 | out: lpLocalFileTime=0x18f264) returned 1 [0024.107] FileTimeToDosDateTime (in: lpFileTime=0x18f264, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.107] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="Setup.xml", cchCount2=8) returned 1 [0024.107] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="Setup.xml", cchCount2=4) returned 1 [0024.107] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="Setup.xml", cchCount2=8) returned 1 [0024.107] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="Setup.xml", cchCount2=4) returned 1 [0024.107] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="Setup.xml", cchCount2=8) returned 1 [0024.107] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="Setup.xml", cchCount2=4) returned 1 [0024.107] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0024.108] GetLastError () returned 0x12 [0024.108] FindClose (in: hFindFile=0x28ff18 | out: hFindFile=0x28ff18) returned 1 [0024.108] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="{90140000-0018-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~2")) returned 1 [0024.108] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f518 | out: lpLocalFileTime=0x18f518) returned 1 [0024.108] FileTimeToDosDateTime (in: lpFileTime=0x18f518, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.108] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="{90140000-0018-0409-1000-0000000FF1CE}-C", cchCount2=8) returned 1 [0024.108] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="{90140000-0018-0409-1000-0000000FF1CE}-C", cchCount2=4) returned 1 [0024.108] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="{90140000-0018-0409-1000-0000000FF1CE}-C", cchCount2=8) returned 1 [0024.108] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="{90140000-0018-0409-1000-0000000FF1CE}-C", cchCount2=4) returned 1 [0024.108] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="{90140000-0018-0409-1000-0000000FF1CE}-C", cchCount2=8) returned 1 [0024.108] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="{90140000-0018-0409-1000-0000000FF1CE}-C", cchCount2=4) returned 1 [0024.108] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x28ff18 [0024.110] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f268 | out: lpLocalFileTime=0x18f268) returned 1 [0024.110] FileTimeToDosDateTime (in: lpFileTime=0x18f268, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.110] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0024.110] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f264 | out: lpLocalFileTime=0x18f264) returned 1 [0024.110] FileTimeToDosDateTime (in: lpFileTime=0x18f264, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.110] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe874f770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.msi", cAlternateFileName="POWERP~1.MSI")) returned 1 [0024.110] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f264 | out: lpLocalFileTime=0x18f264) returned 1 [0024.110] FileTimeToDosDateTime (in: lpFileTime=0x18f264, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.110] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.xml", cAlternateFileName="POWERP~1.XML")) returned 1 [0024.110] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f264 | out: lpLocalFileTime=0x18f264) returned 1 [0024.110] FileTimeToDosDateTime (in: lpFileTime=0x18f264, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.110] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="PowerPointMUI.xml", cchCount2=8) returned 1 [0024.110] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="PowerPointMUI.xml", cchCount2=4) returned 1 [0024.110] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="PowerPointMUI.xml", cchCount2=8) returned 1 [0024.110] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="PowerPointMUI.xml", cchCount2=4) returned 1 [0024.110] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="PowerPointMUI.xml", cchCount2=8) returned 1 [0024.110] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="PowerPointMUI.xml", cchCount2=4) returned 1 [0024.110] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2d523500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2d523500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8b079d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x431a290, dwReserved0=0x0, dwReserved1=0x0, cFileName="PptLR.cab", cAlternateFileName="")) returned 1 [0024.111] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f264 | out: lpLocalFileTime=0x18f264) returned 1 [0024.111] FileTimeToDosDateTime (in: lpFileTime=0x18f264, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.111] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0024.111] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f264 | out: lpLocalFileTime=0x18f264) returned 1 [0024.111] FileTimeToDosDateTime (in: lpFileTime=0x18f264, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.111] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="Setup.xml", cchCount2=8) returned 1 [0024.111] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="Setup.xml", cchCount2=4) returned 1 [0024.111] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="Setup.xml", cchCount2=8) returned 1 [0024.111] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="Setup.xml", cchCount2=4) returned 1 [0024.111] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="Setup.xml", cchCount2=8) returned 1 [0024.111] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="Setup.xml", cchCount2=4) returned 1 [0024.111] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0024.111] GetLastError () returned 0x12 [0024.111] FindClose (in: hFindFile=0x28ff18 | out: hFindFile=0x28ff18) returned 1 [0024.112] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="{90140000-0019-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9877A~1")) returned 1 [0024.112] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f518 | out: lpLocalFileTime=0x18f518) returned 1 [0024.112] FileTimeToDosDateTime (in: lpFileTime=0x18f518, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.112] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="{90140000-0019-0409-1000-0000000FF1CE}-C", cchCount2=8) returned 1 [0024.112] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="{90140000-0019-0409-1000-0000000FF1CE}-C", cchCount2=4) returned 1 [0024.112] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="{90140000-0019-0409-1000-0000000FF1CE}-C", cchCount2=8) returned 1 [0024.112] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="{90140000-0019-0409-1000-0000000FF1CE}-C", cchCount2=4) returned 1 [0024.112] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="{90140000-0019-0409-1000-0000000FF1CE}-C", cchCount2=8) returned 1 [0024.112] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="{90140000-0019-0409-1000-0000000FF1CE}-C", cchCount2=4) returned 1 [0024.112] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x28ff18 [0024.114] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f268 | out: lpLocalFileTime=0x18f268) returned 1 [0024.114] FileTimeToDosDateTime (in: lpFileTime=0x18f268, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.114] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0024.114] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f264 | out: lpLocalFileTime=0x18f264) returned 1 [0024.114] FileTimeToDosDateTime (in: lpFileTime=0x18f264, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.114] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc40b730, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x265c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.msi", cAlternateFileName="PUBLIS~1.MSI")) returned 1 [0024.114] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f264 | out: lpLocalFileTime=0x18f264) returned 1 [0024.114] FileTimeToDosDateTime (in: lpFileTime=0x18f264, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.114] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.xml", cAlternateFileName="PUBLIS~1.XML")) returned 1 [0024.114] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f264 | out: lpLocalFileTime=0x18f264) returned 1 [0024.114] FileTimeToDosDateTime (in: lpFileTime=0x18f264, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.114] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="PublisherMUI.xml", cchCount2=8) returned 1 [0024.114] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="PublisherMUI.xml", cchCount2=4) returned 1 [0024.114] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="PublisherMUI.xml", cchCount2=8) returned 1 [0024.114] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="PublisherMUI.xml", cchCount2=4) returned 1 [0024.114] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="PublisherMUI.xml", cchCount2=8) returned 1 [0024.114] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="PublisherMUI.xml", cchCount2=4) returned 1 [0024.114] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc47e320, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x97f3f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PubLR.cab", cAlternateFileName="")) returned 1 [0024.114] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f264 | out: lpLocalFileTime=0x18f264) returned 1 [0024.114] FileTimeToDosDateTime (in: lpFileTime=0x18f264, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.115] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0024.115] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f264 | out: lpLocalFileTime=0x18f264) returned 1 [0024.115] FileTimeToDosDateTime (in: lpFileTime=0x18f264, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.115] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="Setup.xml", cchCount2=8) returned 1 [0024.115] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="Setup.xml", cchCount2=4) returned 1 [0024.115] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="Setup.xml", cchCount2=8) returned 1 [0024.115] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="Setup.xml", cchCount2=4) returned 1 [0024.115] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="Setup.xml", cchCount2=8) returned 1 [0024.115] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="Setup.xml", cchCount2=4) returned 1 [0024.115] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0024.115] GetLastError () returned 0x12 [0024.115] FindClose (in: hFindFile=0x28ff18 | out: hFindFile=0x28ff18) returned 1 [0024.116] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="{90140000-001A-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9765F~1")) returned 1 [0024.116] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f518 | out: lpLocalFileTime=0x18f518) returned 1 [0024.116] FileTimeToDosDateTime (in: lpFileTime=0x18f518, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.116] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="{90140000-001A-0409-1000-0000000FF1CE}-C", cchCount2=8) returned 1 [0024.116] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="{90140000-001A-0409-1000-0000000FF1CE}-C", cchCount2=4) returned 1 [0024.116] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="{90140000-001A-0409-1000-0000000FF1CE}-C", cchCount2=8) returned 1 [0024.116] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="{90140000-001A-0409-1000-0000000FF1CE}-C", cchCount2=4) returned 1 [0024.116] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="{90140000-001A-0409-1000-0000000FF1CE}-C", cchCount2=8) returned 1 [0024.116] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="{90140000-001A-0409-1000-0000000FF1CE}-C", cchCount2=4) returned 1 [0024.116] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x28ff18 [0024.119] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f268 | out: lpLocalFileTime=0x18f268) returned 1 [0024.119] FileTimeToDosDateTime (in: lpFileTime=0x18f268, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.119] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0024.119] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f264 | out: lpLocalFileTime=0x18f264) returned 1 [0024.119] FileTimeToDosDateTime (in: lpFileTime=0x18f264, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.119] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a6f2400, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3a6f2400, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xeebe0180, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe21fcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlkLR.cab", cAlternateFileName="")) returned 1 [0024.119] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f264 | out: lpLocalFileTime=0x18f264) returned 1 [0024.119] FileTimeToDosDateTime (in: lpFileTime=0x18f264, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.119] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2bba00, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.msi", cAlternateFileName="OUTLOO~1.MSI")) returned 1 [0024.119] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f264 | out: lpLocalFileTime=0x18f264) returned 1 [0024.119] FileTimeToDosDateTime (in: lpFileTime=0x18f264, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.119] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xc72, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.xml", cAlternateFileName="OUTLOO~1.XML")) returned 1 [0024.119] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f264 | out: lpLocalFileTime=0x18f264) returned 1 [0024.119] FileTimeToDosDateTime (in: lpFileTime=0x18f264, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.119] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="OutlookMUI.xml", cchCount2=8) returned 1 [0024.119] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="OutlookMUI.xml", cchCount2=4) returned 1 [0024.119] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="OutlookMUI.xml", cchCount2=8) returned 1 [0024.119] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="OutlookMUI.xml", cchCount2=4) returned 1 [0024.119] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="OutlookMUI.xml", cchCount2=8) returned 1 [0024.119] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="OutlookMUI.xml", cchCount2=4) returned 1 [0024.119] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0024.119] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f264 | out: lpLocalFileTime=0x18f264) returned 1 [0024.119] FileTimeToDosDateTime (in: lpFileTime=0x18f264, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.120] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="Setup.xml", cchCount2=8) returned 1 [0024.120] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="Setup.xml", cchCount2=4) returned 1 [0024.120] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="Setup.xml", cchCount2=8) returned 1 [0024.120] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="Setup.xml", cchCount2=4) returned 1 [0024.120] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="Setup.xml", cchCount2=8) returned 1 [0024.120] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="Setup.xml", cchCount2=4) returned 1 [0024.120] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0024.120] GetLastError () returned 0x12 [0024.120] FindClose (in: hFindFile=0x28ff18 | out: hFindFile=0x28ff18) returned 1 [0024.120] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="{90140000-001B-0409-1000-0000000FF1CE}-C", cAlternateFileName="{94E50~1")) returned 1 [0024.121] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f518 | out: lpLocalFileTime=0x18f518) returned 1 [0024.121] FileTimeToDosDateTime (in: lpFileTime=0x18f518, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.121] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="{90140000-001B-0409-1000-0000000FF1CE}-C", cchCount2=8) returned 1 [0024.121] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="{90140000-001B-0409-1000-0000000FF1CE}-C", cchCount2=4) returned 1 [0024.121] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="{90140000-001B-0409-1000-0000000FF1CE}-C", cchCount2=8) returned 1 [0024.121] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="{90140000-001B-0409-1000-0000000FF1CE}-C", cchCount2=4) returned 1 [0024.121] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="{90140000-001B-0409-1000-0000000FF1CE}-C", cchCount2=8) returned 1 [0024.121] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="{90140000-001B-0409-1000-0000000FF1CE}-C", cchCount2=4) returned 1 [0024.121] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x28ff18 [0024.124] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f268 | out: lpLocalFileTime=0x18f268) returned 1 [0024.124] FileTimeToDosDateTime (in: lpFileTime=0x18f268, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.124] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0024.124] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f264 | out: lpLocalFileTime=0x18f264) returned 1 [0024.124] FileTimeToDosDateTime (in: lpFileTime=0x18f264, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.124] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x978, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0024.124] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f264 | out: lpLocalFileTime=0x18f264) returned 1 [0024.124] FileTimeToDosDateTime (in: lpFileTime=0x18f264, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.124] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="Setup.xml", cchCount2=8) returned 1 [0024.125] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="Setup.xml", cchCount2=4) returned 1 [0024.125] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="Setup.xml", cchCount2=8) returned 1 [0024.125] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="Setup.xml", cchCount2=4) returned 1 [0024.125] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="Setup.xml", cchCount2=8) returned 1 [0024.125] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="Setup.xml", cchCount2=4) returned 1 [0024.125] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2fb48f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2fb48f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc967850, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x29c6dbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordLR.cab", cAlternateFileName="")) returned 1 [0024.125] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f264 | out: lpLocalFileTime=0x18f264) returned 1 [0024.125] FileTimeToDosDateTime (in: lpFileTime=0x18f264, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.125] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x267e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.msi", cAlternateFileName="")) returned 1 [0024.125] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f264 | out: lpLocalFileTime=0x18f264) returned 1 [0024.125] FileTimeToDosDateTime (in: lpFileTime=0x18f264, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.125] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.xml", cAlternateFileName="")) returned 1 [0024.125] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f264 | out: lpLocalFileTime=0x18f264) returned 1 [0024.125] FileTimeToDosDateTime (in: lpFileTime=0x18f264, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.125] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="WordMUI.xml", cchCount2=8) returned 1 [0024.125] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="WordMUI.xml", cchCount2=4) returned 1 [0024.125] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="WordMUI.xml", cchCount2=8) returned 1 [0024.125] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="WordMUI.xml", cchCount2=4) returned 1 [0024.125] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="WordMUI.xml", cchCount2=8) returned 1 [0024.125] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="WordMUI.xml", cchCount2=4) returned 1 [0024.125] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.xml", cAlternateFileName="")) returned 0 [0024.125] GetLastError () returned 0x12 [0024.125] FindClose (in: hFindFile=0x28ff18 | out: hFindFile=0x28ff18) returned 1 [0024.125] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="{90140000-002C-0409-1000-0000000FF1CE}-C", cAlternateFileName="{92787~1")) returned 1 [0024.125] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f518 | out: lpLocalFileTime=0x18f518) returned 1 [0024.125] FileTimeToDosDateTime (in: lpFileTime=0x18f518, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.125] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="{90140000-002C-0409-1000-0000000FF1CE}-C", cchCount2=8) returned 1 [0024.125] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="{90140000-002C-0409-1000-0000000FF1CE}-C", cchCount2=4) returned 1 [0024.125] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="{90140000-002C-0409-1000-0000000FF1CE}-C", cchCount2=8) returned 1 [0024.126] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="{90140000-002C-0409-1000-0000000FF1CE}-C", cchCount2=4) returned 1 [0024.126] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="{90140000-002C-0409-1000-0000000FF1CE}-C", cchCount2=8) returned 1 [0024.126] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="{90140000-002C-0409-1000-0000000FF1CE}-C", cchCount2=4) returned 1 [0024.126] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x28ff18 [0024.135] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f268 | out: lpLocalFileTime=0x18f268) returned 1 [0024.135] FileTimeToDosDateTime (in: lpFileTime=0x18f268, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.135] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0024.135] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f264 | out: lpLocalFileTime=0x18f264) returned 1 [0024.135] FileTimeToDosDateTime (in: lpFileTime=0x18f264, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.135] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.en", cAlternateFileName="")) returned 1 [0024.135] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f264 | out: lpLocalFileTime=0x18f264) returned 1 [0024.135] FileTimeToDosDateTime (in: lpFileTime=0x18f264, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.135] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="Proof.en", cchCount2=8) returned 1 [0024.135] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="Proof.en", cchCount2=4) returned 1 [0024.135] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="Proof.en", cchCount2=8) returned 1 [0024.135] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="Proof.en", cchCount2=4) returned 1 [0024.135] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="Proof.en", cchCount2=8) returned 1 [0024.135] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="Proof.en", cchCount2=4) returned 1 [0024.135] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x290f60 [0024.136] FileTimeToLocalFileTime (in: lpFileTime=0x18f040, lpLocalFileTime=0x18efb4 | out: lpLocalFileTime=0x18efb4) returned 1 [0024.136] FileTimeToDosDateTime (in: lpFileTime=0x18efb4, lpFatDate=0x18f00e, lpFatTime=0x18f00c | out: lpFatDate=0x18f00e, lpFatTime=0x18f00c) returned 1 [0024.136] FindNextFileW (in: hFindFile=0x290f60, lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="..", cAlternateFileName="")) returned 1 [0024.136] FileTimeToLocalFileTime (in: lpFileTime=0x18f040, lpLocalFileTime=0x18efb0 | out: lpLocalFileTime=0x18efb0) returned 1 [0024.136] FileTimeToDosDateTime (in: lpFileTime=0x18efb0, lpFatDate=0x18f00e, lpFatTime=0x18f00c | out: lpFatDate=0x18f00e, lpFatTime=0x18f00c) returned 1 [0024.136] FindNextFileW (in: hFindFile=0x290f60, lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x219b4a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x219b4a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf07b1ad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xaf35ed, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0024.136] FileTimeToLocalFileTime (in: lpFileTime=0x18f040, lpLocalFileTime=0x18efb0 | out: lpLocalFileTime=0x18efb0) returned 1 [0024.136] FileTimeToDosDateTime (in: lpFileTime=0x18efb0, lpFatDate=0x18f00e, lpFatTime=0x18f00c | out: lpFatDate=0x18f00e, lpFatTime=0x18f00c) returned 1 [0024.136] FindNextFileW (in: hFindFile=0x290f60, lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4db6cb00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x4db6cb00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf020c5d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5c00, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0024.136] FileTimeToLocalFileTime (in: lpFileTime=0x18f040, lpLocalFileTime=0x18efb0 | out: lpLocalFileTime=0x18efb0) returned 1 [0024.136] FileTimeToDosDateTime (in: lpFileTime=0x18efb0, lpFatDate=0x18f00e, lpFatTime=0x18f00c | out: lpFatDate=0x18f00e, lpFatTime=0x18f00c) returned 1 [0024.136] FindNextFileW (in: hFindFile=0x290f60, lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38b7300, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0xa38b7300, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0024.136] FileTimeToLocalFileTime (in: lpFileTime=0x18f040, lpLocalFileTime=0x18efb0 | out: lpLocalFileTime=0x18efb0) returned 1 [0024.136] FileTimeToDosDateTime (in: lpFileTime=0x18efb0, lpFatDate=0x18f00e, lpFatTime=0x18f00c | out: lpFatDate=0x18f00e, lpFatTime=0x18f00c) returned 1 [0024.136] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="Proof.xml", cchCount2=8) returned 1 [0024.136] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="Proof.xml", cchCount2=4) returned 1 [0024.136] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="Proof.xml", cchCount2=8) returned 1 [0024.136] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="Proof.xml", cchCount2=4) returned 1 [0024.136] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="Proof.xml", cchCount2=8) returned 1 [0024.136] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="Proof.xml", cchCount2=4) returned 1 [0024.136] FindNextFileW (in: hFindFile=0x290f60, lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38b7300, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0xa38b7300, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0024.137] GetLastError () returned 0x12 [0024.137] FindClose (in: hFindFile=0x290f60 | out: hFindFile=0x290f60) returned 1 [0024.137] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.es", cAlternateFileName="")) returned 1 [0024.137] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f264 | out: lpLocalFileTime=0x18f264) returned 1 [0024.137] FileTimeToDosDateTime (in: lpFileTime=0x18f264, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.137] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="Proof.es", cchCount2=8) returned 1 [0024.137] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="Proof.es", cchCount2=4) returned 1 [0024.137] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="Proof.es", cchCount2=8) returned 1 [0024.137] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="Proof.es", cchCount2=4) returned 1 [0024.137] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="Proof.es", cchCount2=8) returned 1 [0024.137] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="Proof.es", cchCount2=4) returned 1 [0024.137] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x290f60 [0024.141] FileTimeToLocalFileTime (in: lpFileTime=0x18f040, lpLocalFileTime=0x18efb4 | out: lpLocalFileTime=0x18efb4) returned 1 [0024.141] FileTimeToDosDateTime (in: lpFileTime=0x18efb4, lpFatDate=0x18f00e, lpFatTime=0x18f00c | out: lpFatDate=0x18f00e, lpFatTime=0x18f00c) returned 1 [0024.141] FindNextFileW (in: hFindFile=0x290f60, lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="..", cAlternateFileName="")) returned 1 [0024.141] FileTimeToLocalFileTime (in: lpFileTime=0x18f040, lpLocalFileTime=0x18efb0 | out: lpLocalFileTime=0x18efb0) returned 1 [0024.141] FileTimeToDosDateTime (in: lpFileTime=0x18efb0, lpFatDate=0x18f00e, lpFatTime=0x18f00c | out: lpFatDate=0x18f00e, lpFatTime=0x18f00c) returned 1 [0024.141] FindNextFileW (in: hFindFile=0x290f60, lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd02aea, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0024.141] FileTimeToLocalFileTime (in: lpFileTime=0x18f040, lpLocalFileTime=0x18efb0 | out: lpLocalFileTime=0x18efb0) returned 1 [0024.141] FileTimeToDosDateTime (in: lpFileTime=0x18efb0, lpFatDate=0x18f00e, lpFatTime=0x18f00c | out: lpFatDate=0x18f00e, lpFatTime=0x18f00c) returned 1 [0024.141] FindNextFileW (in: hFindFile=0x290f60, lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e5c7f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd7200, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0024.142] FileTimeToLocalFileTime (in: lpFileTime=0x18f040, lpLocalFileTime=0x18efb0 | out: lpLocalFileTime=0x18efb0) returned 1 [0024.142] FileTimeToDosDateTime (in: lpFileTime=0x18efb0, lpFatDate=0x18f00e, lpFatTime=0x18f00c | out: lpFatDate=0x18f00e, lpFatTime=0x18f00c) returned 1 [0024.142] FindNextFileW (in: hFindFile=0x290f60, lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0024.142] FileTimeToLocalFileTime (in: lpFileTime=0x18f040, lpLocalFileTime=0x18efb0 | out: lpLocalFileTime=0x18efb0) returned 1 [0024.142] FileTimeToDosDateTime (in: lpFileTime=0x18efb0, lpFatDate=0x18f00e, lpFatTime=0x18f00c | out: lpFatDate=0x18f00e, lpFatTime=0x18f00c) returned 1 [0024.142] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="Proof.xml", cchCount2=8) returned 1 [0024.142] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="Proof.xml", cchCount2=4) returned 1 [0024.142] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="Proof.xml", cchCount2=8) returned 1 [0024.142] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="Proof.xml", cchCount2=4) returned 1 [0024.142] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="Proof.xml", cchCount2=8) returned 1 [0024.142] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="Proof.xml", cchCount2=4) returned 1 [0024.142] FindNextFileW (in: hFindFile=0x290f60, lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0024.142] GetLastError () returned 0x12 [0024.142] FindClose (in: hFindFile=0x290f60 | out: hFindFile=0x290f60) returned 1 [0024.142] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.fr", cAlternateFileName="")) returned 1 [0024.142] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f264 | out: lpLocalFileTime=0x18f264) returned 1 [0024.142] FileTimeToDosDateTime (in: lpFileTime=0x18f264, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.142] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="Proof.fr", cchCount2=8) returned 1 [0024.142] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="Proof.fr", cchCount2=4) returned 1 [0024.142] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="Proof.fr", cchCount2=8) returned 1 [0024.142] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="Proof.fr", cchCount2=4) returned 1 [0024.142] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="Proof.fr", cchCount2=8) returned 1 [0024.142] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="Proof.fr", cchCount2=4) returned 1 [0024.142] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x290f60 [0024.142] FileTimeToLocalFileTime (in: lpFileTime=0x18f040, lpLocalFileTime=0x18efb4 | out: lpLocalFileTime=0x18efb4) returned 1 [0024.143] FileTimeToDosDateTime (in: lpFileTime=0x18efb4, lpFatDate=0x18f00e, lpFatTime=0x18f00c | out: lpFatDate=0x18f00e, lpFatTime=0x18f00c) returned 1 [0024.143] FindNextFileW (in: hFindFile=0x290f60, lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="..", cAlternateFileName="")) returned 1 [0024.143] FileTimeToLocalFileTime (in: lpFileTime=0x18f040, lpLocalFileTime=0x18efb0 | out: lpLocalFileTime=0x18efb0) returned 1 [0024.143] FileTimeToDosDateTime (in: lpFileTime=0x18efb0, lpFatDate=0x18f00e, lpFatTime=0x18f00c | out: lpFatDate=0x18f00e, lpFatTime=0x18f00c) returned 1 [0024.143] FindNextFileW (in: hFindFile=0x290f60, lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x35aa7000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x35aa7000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf3076b00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1416b54, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0024.143] FileTimeToLocalFileTime (in: lpFileTime=0x18f040, lpLocalFileTime=0x18efb0 | out: lpLocalFileTime=0x18efb0) returned 1 [0024.143] FileTimeToDosDateTime (in: lpFileTime=0x18efb0, lpFatDate=0x18f00e, lpFatTime=0x18f00c | out: lpFatDate=0x18f00e, lpFatTime=0x18f00c) returned 1 [0024.143] FindNextFileW (in: hFindFile=0x290f60, lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2e3b660, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd8400, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0024.143] FileTimeToLocalFileTime (in: lpFileTime=0x18f040, lpLocalFileTime=0x18efb0 | out: lpLocalFileTime=0x18efb0) returned 1 [0024.143] FileTimeToDosDateTime (in: lpFileTime=0x18efb0, lpFatDate=0x18f00e, lpFatTime=0x18f00c | out: lpFatDate=0x18f00e, lpFatTime=0x18f00c) returned 1 [0024.143] FindNextFileW (in: hFindFile=0x290f60, lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0024.143] FileTimeToLocalFileTime (in: lpFileTime=0x18f040, lpLocalFileTime=0x18efb0 | out: lpLocalFileTime=0x18efb0) returned 1 [0024.143] FileTimeToDosDateTime (in: lpFileTime=0x18efb0, lpFatDate=0x18f00e, lpFatTime=0x18f00c | out: lpFatDate=0x18f00e, lpFatTime=0x18f00c) returned 1 [0024.143] FindNextFileW (in: hFindFile=0x290f60, lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0024.143] GetLastError () returned 0x12 [0024.143] FindClose (in: hFindFile=0x290f60 | out: hFindFile=0x290f60) returned 1 [0024.143] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x40650500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x40650500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf0126df0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.msi", cAlternateFileName="")) returned 1 [0024.143] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f264 | out: lpLocalFileTime=0x18f264) returned 1 [0024.143] FileTimeToDosDateTime (in: lpFileTime=0x18f264, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.143] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x32b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.xml", cAlternateFileName="")) returned 1 [0024.143] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f264 | out: lpLocalFileTime=0x18f264) returned 1 [0024.143] FileTimeToDosDateTime (in: lpFileTime=0x18f264, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.143] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0024.143] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f264 | out: lpLocalFileTime=0x18f264) returned 1 [0024.144] FileTimeToDosDateTime (in: lpFileTime=0x18f264, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.144] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0024.144] GetLastError () returned 0x12 [0024.144] FindClose (in: hFindFile=0x28ff18 | out: hFindFile=0x28ff18) returned 1 [0024.144] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="{90140000-0043-0409-1000-0000000FF1CE}-C", cAlternateFileName="{95310~1")) returned 1 [0024.144] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f518 | out: lpLocalFileTime=0x18f518) returned 1 [0024.144] FileTimeToDosDateTime (in: lpFileTime=0x18f518, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.150] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f268 | out: lpLocalFileTime=0x18f268) returned 1 [0024.150] FileTimeToDosDateTime (in: lpFileTime=0x18f268, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.150] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0024.150] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f264 | out: lpLocalFileTime=0x18f264) returned 1 [0024.150] FileTimeToDosDateTime (in: lpFileTime=0x18f264, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.150] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32MUI.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0024.150] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f264 | out: lpLocalFileTime=0x18f264) returned 1 [0024.150] FileTimeToDosDateTime (in: lpFileTime=0x18f264, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.150] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32MUI.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0024.150] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f264 | out: lpLocalFileTime=0x18f264) returned 1 [0024.150] FileTimeToDosDateTime (in: lpFileTime=0x18f264, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.150] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc301560, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2cb13b, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWOW32LR.cab", cAlternateFileName="")) returned 1 [0024.150] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f264 | out: lpLocalFileTime=0x18f264) returned 1 [0024.150] FileTimeToDosDateTime (in: lpFileTime=0x18f264, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.150] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0024.150] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f264 | out: lpLocalFileTime=0x18f264) returned 1 [0024.150] FileTimeToDosDateTime (in: lpFileTime=0x18f264, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.150] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0024.150] GetLastError () returned 0x12 [0024.150] FindClose (in: hFindFile=0x28ff18 | out: hFindFile=0x28ff18) returned 1 [0024.151] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="{90140000-0044-0409-1000-0000000FF1CE}-C", cAlternateFileName="{91454~1")) returned 1 [0024.151] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f518 | out: lpLocalFileTime=0x18f518) returned 1 [0024.151] FileTimeToDosDateTime (in: lpFileTime=0x18f518, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.153] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f268 | out: lpLocalFileTime=0x18f268) returned 1 [0024.153] FileTimeToDosDateTime (in: lpFileTime=0x18f268, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.153] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0024.153] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f264 | out: lpLocalFileTime=0x18f264) returned 1 [0024.153] FileTimeToDosDateTime (in: lpFileTime=0x18f264, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.153] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf79111d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1200204, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfLR.cab", cAlternateFileName="")) returned 1 [0024.153] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f264 | out: lpLocalFileTime=0x18f264) returned 1 [0024.153] FileTimeToDosDateTime (in: lpFileTime=0x18f264, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.153] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e58f90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2fac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathMUI.msi", cAlternateFileName="INFOPA~1.MSI")) returned 1 [0024.153] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f264 | out: lpLocalFileTime=0x18f264) returned 1 [0024.153] FileTimeToDosDateTime (in: lpFileTime=0x18f264, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.153] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e345a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x4cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathMUI.xml", cAlternateFileName="INFOPA~1.XML")) returned 1 [0024.153] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f264 | out: lpLocalFileTime=0x18f264) returned 1 [0024.153] FileTimeToDosDateTime (in: lpFileTime=0x18f264, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.153] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0024.153] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f264 | out: lpLocalFileTime=0x18f264) returned 1 [0024.153] FileTimeToDosDateTime (in: lpFileTime=0x18f264, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.153] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0024.153] GetLastError () returned 0x12 [0024.153] FindClose (in: hFindFile=0x28ff18 | out: hFindFile=0x28ff18) returned 1 [0024.154] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="{90140000-0054-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9EA85~1")) returned 1 [0024.154] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f518 | out: lpLocalFileTime=0x18f518) returned 1 [0024.154] FileTimeToDosDateTime (in: lpFileTime=0x18f518, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.154] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f268 | out: lpLocalFileTime=0x18f268) returned 1 [0024.154] FileTimeToDosDateTime (in: lpFileTime=0x18f268, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.154] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0024.154] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f264 | out: lpLocalFileTime=0x18f264) returned 1 [0024.154] FileTimeToDosDateTime (in: lpFileTime=0x18f264, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.154] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f356eb0, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f356eb0, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1861, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0024.154] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f264 | out: lpLocalFileTime=0x18f264) returned 1 [0024.154] FileTimeToDosDateTime (in: lpFileTime=0x18f264, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.154] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7fb9f9e0, ftCreationTime.dwHighDateTime=0x1cbe575, ftLastAccessTime.dwLowDateTime=0x7fb9f9e0, ftLastAccessTime.dwHighDateTime=0x1cbe575, ftLastWriteTime.dwLowDateTime=0x437179c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x30780dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioLR.cab", cAlternateFileName="")) returned 1 [0024.154] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f264 | out: lpLocalFileTime=0x18f264) returned 1 [0024.155] FileTimeToDosDateTime (in: lpFileTime=0x18f264, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.155] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x272b1e70, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x272b1e70, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x435c1d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2ab000, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.msi", cAlternateFileName="")) returned 1 [0024.155] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f264 | out: lpLocalFileTime=0x18f264) returned 1 [0024.155] FileTimeToDosDateTime (in: lpFileTime=0x18f264, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.155] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f0a8e20, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f0a8e20, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.xml", cAlternateFileName="")) returned 1 [0024.155] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f264 | out: lpLocalFileTime=0x18f264) returned 1 [0024.155] FileTimeToDosDateTime (in: lpFileTime=0x18f264, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.155] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f0a8e20, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f0a8e20, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.xml", cAlternateFileName="")) returned 0 [0024.155] GetLastError () returned 0x12 [0024.155] FindClose (in: hFindFile=0x28ff18 | out: hFindFile=0x28ff18) returned 1 [0024.155] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="{90140000-00A1-0409-1000-0000000FF1CE}-C", cAlternateFileName="{92572~1")) returned 1 [0024.155] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f518 | out: lpLocalFileTime=0x18f518) returned 1 [0024.155] FileTimeToDosDateTime (in: lpFileTime=0x18f518, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.157] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f268 | out: lpLocalFileTime=0x18f268) returned 1 [0024.157] FileTimeToDosDateTime (in: lpFileTime=0x18f268, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.157] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0024.157] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f264 | out: lpLocalFileTime=0x18f264) returned 1 [0024.157] FileTimeToDosDateTime (in: lpFileTime=0x18f264, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.157] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5914a30, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteMUI.msi", cAlternateFileName="ONENOT~1.MSI")) returned 1 [0024.157] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f264 | out: lpLocalFileTime=0x18f264) returned 1 [0024.157] FileTimeToDosDateTime (in: lpFileTime=0x18f264, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.157] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58ed930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x646, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteMUI.xml", cAlternateFileName="ONENOT~1.XML")) returned 1 [0024.157] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f264 | out: lpLocalFileTime=0x18f264) returned 1 [0024.157] FileTimeToDosDateTime (in: lpFileTime=0x18f264, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.157] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36db9d00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x36db9d00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5e95540, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10a5df8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OnoteLR.cab", cAlternateFileName="")) returned 1 [0024.157] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f264 | out: lpLocalFileTime=0x18f264) returned 1 [0024.157] FileTimeToDosDateTime (in: lpFileTime=0x18f264, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.158] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0024.158] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f264 | out: lpLocalFileTime=0x18f264) returned 1 [0024.158] FileTimeToDosDateTime (in: lpFileTime=0x18f264, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.158] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0024.158] GetLastError () returned 0x12 [0024.158] FindClose (in: hFindFile=0x28ff18 | out: hFindFile=0x28ff18) returned 1 [0024.158] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="{90140000-00B4-0409-1000-0000000FF1CE}-C", cAlternateFileName="{912E0~1")) returned 1 [0024.158] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f518 | out: lpLocalFileTime=0x18f518) returned 1 [0024.158] FileTimeToDosDateTime (in: lpFileTime=0x18f518, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.161] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f268 | out: lpLocalFileTime=0x18f268) returned 1 [0024.161] FileTimeToDosDateTime (in: lpFileTime=0x18f268, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.161] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0024.161] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f264 | out: lpLocalFileTime=0x18f264) returned 1 [0024.161] FileTimeToDosDateTime (in: lpFileTime=0x18f264, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.161] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x308ae9f0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x308ae9f0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b55ce0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x265400, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectMUI.msi", cAlternateFileName="PROJEC~1.MSI")) returned 1 [0024.161] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f264 | out: lpLocalFileTime=0x18f264) returned 1 [0024.161] FileTimeToDosDateTime (in: lpFileTime=0x18f264, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.161] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30a2b7b0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30a2b7b0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b2ebe0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectMUI.xml", cAlternateFileName="PROJEC~1.XML")) returned 1 [0024.161] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f264 | out: lpLocalFileTime=0x18f264) returned 1 [0024.161] FileTimeToDosDateTime (in: lpFileTime=0x18f264, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.161] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30306de0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30306de0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b7cde0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x7e1dcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjLR.cab", cAlternateFileName="")) returned 1 [0024.161] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f264 | out: lpLocalFileTime=0x18f264) returned 1 [0024.161] FileTimeToDosDateTime (in: lpFileTime=0x18f264, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.161] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x309dfcc0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x309dfcc0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0024.162] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f264 | out: lpLocalFileTime=0x18f264) returned 1 [0024.162] FileTimeToDosDateTime (in: lpFileTime=0x18f264, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.162] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x309dfcc0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x309dfcc0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0024.162] GetLastError () returned 0x12 [0024.162] FindClose (in: hFindFile=0x28ff18 | out: hFindFile=0x28ff18) returned 1 [0024.163] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="{90140000-00BA-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~4")) returned 1 [0024.163] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f518 | out: lpLocalFileTime=0x18f518) returned 1 [0024.163] FileTimeToDosDateTime (in: lpFileTime=0x18f518, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.164] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f268 | out: lpLocalFileTime=0x18f268) returned 1 [0024.164] FileTimeToDosDateTime (in: lpFileTime=0x18f268, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.165] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0024.165] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f264 | out: lpLocalFileTime=0x18f264) returned 1 [0024.165] FileTimeToDosDateTime (in: lpFileTime=0x18f264, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.165] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee4bb7b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x3e7e1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveLR.cab", cAlternateFileName="")) returned 1 [0024.165] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f264 | out: lpLocalFileTime=0x18f264) returned 1 [0024.165] FileTimeToDosDateTime (in: lpFileTime=0x18f264, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.165] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee3b15e0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x264400, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveMUI.msi", cAlternateFileName="GROOVE~1.MSI")) returned 1 [0024.165] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f264 | out: lpLocalFileTime=0x18f264) returned 1 [0024.165] FileTimeToDosDateTime (in: lpFileTime=0x18f264, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.165] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveMUI.xml", cAlternateFileName="GROOVE~1.XML")) returned 1 [0024.165] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f264 | out: lpLocalFileTime=0x18f264) returned 1 [0024.165] FileTimeToDosDateTime (in: lpFileTime=0x18f264, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.165] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0024.165] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f264 | out: lpLocalFileTime=0x18f264) returned 1 [0024.165] FileTimeToDosDateTime (in: lpFileTime=0x18f264, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.165] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0024.165] GetLastError () returned 0x12 [0024.165] FindClose (in: hFindFile=0x28ff18 | out: hFindFile=0x28ff18) returned 1 [0024.166] FindNextFileW (in: hFindFile=0x28eed0, lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="{90140000-0115-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~1")) returned 1 [0024.166] FileTimeToLocalFileTime (in: lpFileTime=0x18f5a8, lpLocalFileTime=0x18f518 | out: lpLocalFileTime=0x18f518) returned 1 [0024.166] FileTimeToDosDateTime (in: lpFileTime=0x18f518, lpFatDate=0x18f576, lpFatTime=0x18f574 | out: lpFatDate=0x18f576, lpFatTime=0x18f574) returned 1 [0024.167] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f268 | out: lpLocalFileTime=0x18f268) returned 1 [0024.167] FileTimeToDosDateTime (in: lpFileTime=0x18f268, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.167] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0024.167] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f264 | out: lpLocalFileTime=0x18f264) returned 1 [0024.167] FileTimeToDosDateTime (in: lpFileTime=0x18f264, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.167] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0024.167] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f264 | out: lpLocalFileTime=0x18f264) returned 1 [0024.167] FileTimeToDosDateTime (in: lpFileTime=0x18f264, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.168] FileTimeToLocalFileTime (in: lpFileTime=0x18f040, lpLocalFileTime=0x18efb4 | out: lpLocalFileTime=0x18efb4) returned 1 [0024.168] FileTimeToDosDateTime (in: lpFileTime=0x18efb4, lpFatDate=0x18f00e, lpFatTime=0x18f00c | out: lpFatDate=0x18f00e, lpFatTime=0x18f00c) returned 1 [0024.168] FindNextFileW (in: hFindFile=0x290f60, lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="..", cAlternateFileName="")) returned 1 [0024.168] FileTimeToLocalFileTime (in: lpFileTime=0x18f040, lpLocalFileTime=0x18efb0 | out: lpLocalFileTime=0x18efb0) returned 1 [0024.168] FileTimeToDosDateTime (in: lpFileTime=0x18efb0, lpFatDate=0x18f00e, lpFatTime=0x18f00c | out: lpFatDate=0x18f00e, lpFatTime=0x18f00c) returned 1 [0024.168] FindNextFileW (in: hFindFile=0x290f60, lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a35700, ftCreationTime.dwHighDateTime=0x1cac9d7, ftLastAccessTime.dwLowDateTime=0x6a35700, ftLastAccessTime.dwHighDateTime=0x1cac9d7, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1a588, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="dwintl20.dll", cAlternateFileName="")) returned 1 [0024.168] FileTimeToLocalFileTime (in: lpFileTime=0x18f040, lpLocalFileTime=0x18efb0 | out: lpLocalFileTime=0x18efb0) returned 1 [0024.168] FileTimeToDosDateTime (in: lpFileTime=0x18efb0, lpFatDate=0x18f00e, lpFatTime=0x18f00c | out: lpFatDate=0x18f00e, lpFatTime=0x18f00c) returned 1 [0024.168] FindNextFileW (in: hFindFile=0x290f60, lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a35700, ftCreationTime.dwHighDateTime=0x1cac9d7, ftLastAccessTime.dwLowDateTime=0x6a35700, ftLastAccessTime.dwHighDateTime=0x1cac9d7, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1a588, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName="dwintl20.dll", cAlternateFileName="")) returned 0 [0024.169] GetLastError () returned 0x12 [0024.169] FindClose (in: hFindFile=0x290f60 | out: hFindFile=0x290f60) returned 1 [0024.169] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x0, cFileName="branding.xml", cAlternateFileName="")) returned 1 [0024.169] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f264 | out: lpLocalFileTime=0x18f264) returned 1 [0024.169] FileTimeToDosDateTime (in: lpFileTime=0x18f264, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.169] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa26c9d00, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xa26c9d00, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85142d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xccb88, dwReserved0=0x0, dwReserved1=0x0, cFileName="DW20.EXE", cAlternateFileName="")) returned 1 [0024.169] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f264 | out: lpLocalFileTime=0x18f264) returned 1 [0024.169] FileTimeToDosDateTime (in: lpFileTime=0x18f264, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.169] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabf60500, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xabf60500, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85ab8b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x80760, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwdcw20.dll", cAlternateFileName="")) returned 1 [0024.169] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f264 | out: lpLocalFileTime=0x18f264) returned 1 [0024.169] FileTimeToDosDateTime (in: lpFileTime=0x18f264, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.169] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabf60500, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xabf60500, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85f73a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7eda0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwtrig20.exe", cAlternateFileName="")) returned 1 [0024.169] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f264 | out: lpLocalFileTime=0x18f264) returned 1 [0024.169] FileTimeToDosDateTime (in: lpFileTime=0x18f264, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.169] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8d646800, ftCreationTime.dwHighDateTime=0x1cacc53, ftLastAccessTime.dwLowDateTime=0x8d646800, ftLastAccessTime.dwHighDateTime=0x1cacc53, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x741, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VC90.CRT.manifest", cAlternateFileName="MICROS~1.MAN")) returned 1 [0024.169] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f264 | out: lpLocalFileTime=0x18f264) returned 1 [0024.169] FileTimeToDosDateTime (in: lpFileTime=0x18f264, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.169] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8c333b00, ftCreationTime.dwHighDateTime=0x1cacc53, ftLastAccessTime.dwLowDateTime=0x8c333b00, ftLastAccessTime.dwHighDateTime=0x1cacc53, ftLastWriteTime.dwLowDateTime=0xe86b5a80, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa0200, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcr90.dll", cAlternateFileName="")) returned 1 [0024.169] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f264 | out: lpLocalFileTime=0x18f264) returned 1 [0024.169] FileTimeToDosDateTime (in: lpFileTime=0x18f264, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.169] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7e3b3f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd79282, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeLR.cab", cAlternateFileName="")) returned 1 [0024.169] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f264 | out: lpLocalFileTime=0x18f264) returned 1 [0024.169] FileTimeToDosDateTime (in: lpFileTime=0x18f264, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.169] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7c4ba40, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x387e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUI.msi", cAlternateFileName="OFFICE~2.MSI")) returned 1 [0024.170] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f264 | out: lpLocalFileTime=0x18f264) returned 1 [0024.170] FileTimeToDosDateTime (in: lpFileTime=0x18f264, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.170] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7c27050, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x15b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUI.xml", cAlternateFileName="OFFICE~2.XML")) returned 1 [0024.170] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f264 | out: lpLocalFileTime=0x18f264) returned 1 [0024.170] FileTimeToDosDateTime (in: lpFileTime=0x18f264, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.170] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUISet.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0024.170] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f264 | out: lpLocalFileTime=0x18f264) returned 1 [0024.170] FileTimeToDosDateTime (in: lpFileTime=0x18f264, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.170] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUISet.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0024.170] FileTimeToLocalFileTime (in: lpFileTime=0x18f2f4, lpLocalFileTime=0x18f264 | out: lpLocalFileTime=0x18f264) returned 1 [0024.170] FileTimeToDosDateTime (in: lpFileTime=0x18f264, lpFatDate=0x18f2c2, lpFatTime=0x18f2c0 | out: lpFatDate=0x18f2c2, lpFatTime=0x18f2c0) returned 1 [0024.170] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc8b16200, ftCreationTime.dwHighDateTime=0x1cac190, ftLastAccessTime.dwLowDateTime=0xc8b16200, ftLastAccessTime.dwHighDateTime=0x1cac190, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2ed80, dwReserved0=0x0, dwReserved1=0x0, cFileName="osetupui.dll", cAlternateFileName="")) returned 1 [0024.170] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x77cbb000, ftCreationTime.dwHighDateTime=0x1cac57a, ftLastAccessTime.dwLowDateTime=0x77cbb000, ftLastAccessTime.dwHighDateTime=0x1cac57a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x6a3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="pss10r.chm", cAlternateFileName="")) returned 1 [0024.170] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cab9f00, ftCreationTime.dwHighDateTime=0x1cac8ad, ftLastAccessTime.dwLowDateTime=0x7cab9f00, ftLastAccessTime.dwHighDateTime=0x1cac8ad, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10676, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.chm", cAlternateFileName="")) returned 1 [0024.170] FindNextFileW (in: hFindFile=0x28ff18, lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2488, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0028.267] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Configuration\\a9307524c4566f8b1e2df7834b33de98\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x504296d0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x504296d0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x504296d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.267] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.268] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.268] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Core\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4f7f6610, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x4f7f6610, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x4f7f6610, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.269] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Core\\0b543c6391a29ab6773dc4ad0da611f2\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4f7f6610, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x4f81c770, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x4f81c770, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.269] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.269] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.269] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85ebb5f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x85ebb5f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x85ebb5f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.270] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data\\aff3d5a446ed0ca437fb79db4e3b5720\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85ebb5f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x85ee1750, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x85ee1750, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.271] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.271] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.271] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.Entity\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9513b730, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x9513b730, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x9513b730, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.272] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.Entity\\43aac8aa5cd33cb72e5e2262b6526a45\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9513b730, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x951879f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x951879f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.272] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.272] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.272] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.Linq\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96da5dd0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x96da5dd0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x96da5dd0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.273] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.Linq\\9705a1a4cb1828c1c7c74f8952d567ae\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96da5dd0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x96dcbf30, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x96dcbf30, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.274] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.274] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.274] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.Services\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97ba1f10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x97ba1f10, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x97ba1f10, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.275] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.Services\\6477489ca4d22636fa3546d0316ca591\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97ba1f10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x97ba1f10, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x97ba1f10, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.275] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.275] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.275] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542a5850, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x542a5850, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x542a5850, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.275] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\5f5d6c1b4261c849bdcd39f6bcccb13b\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542a5850, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x542a5850, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x542a5850, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.276] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.277] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.277] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa51ddb10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa51ddb10, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa51ddb10, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.277] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\43ed165e18772def7628ddb4f70c69aa\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa51ddb10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa51ddb10, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa51ddb10, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.280] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.280] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.280] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6b74790, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa6b74790, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa6b74790, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.281] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\abfd040a82d8e14cb8bf61e2e468d6f4\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6b74790, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa6b74790, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa6b74790, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.283] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.284] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.284] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data7706cdc8#\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8fc6e770, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8fc6e770, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8fc6e770, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.284] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data7706cdc8#\\e256b79dfd5e9e14688d13aa81bef5c9\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8fc6e770, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8fc6e770, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8fc6e770, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.286] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.287] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.287] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a7a17b0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8a7a17b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8a7a17b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.288] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a2fcac4178dfa632cdc28c170b2fc52e\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a7a17b0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8a7a17b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8a7a17b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.292] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.292] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.293] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Datab086ae17#\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95d22530, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x95d22530, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x95d22530, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.293] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Datab086ae17#\\fcf20e21d8c22e0b43e9b160d9ba2466\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95d22530, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x95d22530, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x95d22530, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.295] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.296] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.296] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Deployment\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70bd39b0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x70bd39b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x70bd39b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.297] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Deployment\\792bc3f63f441586023846e411cf598b\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70bd39b0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x70bd39b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x70bd39b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.297] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.297] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.298] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a0c9870, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8a0c9870, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8a0c9870, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.298] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a0c9870, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8a0ef9d0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8a0ef9d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.299] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.299] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.299] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa74f9f90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa74f9f90, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa74f9f90, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.300] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa74f9f90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa74f9f90, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa74f9f90, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.300] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.300] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.300] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire573b08f5#\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa7b137f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa7b137f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa7b137f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.301] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire573b08f5#\\c051c5430cbd1580ec57d42e22abfa13\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa7b137f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa7b137f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa7b137f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.303] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.303] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.303] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8af37dd0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8af37dd0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8af37dd0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.304] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8af37dd0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8af37dd0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8af37dd0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.306] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.307] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.307] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78c83f10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x78caa070, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x78caa070, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.308] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78caa070, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x78caa070, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x78caa070, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.310] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.310] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.310] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Draw0a54d252#\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a96a830, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8a96a830, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8a96a830, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.311] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Draw0a54d252#\\bfc69ce2b8f9cf7092acfe50a43c569f\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a96a830, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8a96a830, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8a96a830, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.313] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.314] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.314] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715591b0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x715591b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x715591b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.315] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\839ea0590195c34c0b0054db5a9c3513\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715591b0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x715591b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x715591b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.315] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.315] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.317] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a2c1090, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x5a2c1090, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x5a2c1090, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.318] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a2c1090, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x5a2c1090, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x5a2c1090, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.318] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.319] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.319] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x868d9370, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x868d9370, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x868d9370, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.319] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x868d9370, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x868ff4d0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x868ff4d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.321] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.322] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.322] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa83da910, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa83da910, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa83da910, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.323] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa83da910, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa83da910, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa83da910, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.324] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.325] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.325] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0fcf890, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa0fcf890, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa0fcf890, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.326] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0fcf890, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa0fcf890, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa0fcf890, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.327] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.328] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.329] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0d6e290, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa0d6e290, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa0d6e290, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.330] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0d6e290, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa0d6e290, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa0d6e290, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.330] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.330] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.330] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa85c9af0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa85c9af0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa85c9af0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.331] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa85c9af0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa85c9af0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa85c9af0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.333] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.333] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.333] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa86d4490, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa86d4490, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa86d4490, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.334] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa86d4490, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa86d4490, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa86d4490, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.336] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.337] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.337] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8a66590, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa8a66590, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa8a66590, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.337] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8a66590, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa8a66590, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa8a66590, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.338] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.338] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.338] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8df8690, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa8df8690, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa8df8690, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.339] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8df8690, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa8df8690, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa8df8690, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.341] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.341] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.342] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa3893150, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa38b92b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa38b92b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.342] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa38b92b0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa38b92b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa38b92b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.343] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.343] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.343] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1387af0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa1387af0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa1387af0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.344] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1387af0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa1387af0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa1387af0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.344] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.344] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.344] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa94d05d0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa94d05d0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa94d05d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.345] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa94d05d0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa94d05d0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa94d05d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.346] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.346] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.346] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.22cc68a8#\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9c40a90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa9c40a90, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa9c40a90, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.346] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.22cc68a8#\\4b177fc35673f0e089fab5a308e5b5c2\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9c40a90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa9c40a90, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa9c40a90, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.348] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.349] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.349] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.Http\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa197b1f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa197b1f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa197b1f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.350] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.Http\\5529374166119d4622275f6a97e0d7f0\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa197b1f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa19a1350, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa19a1350, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.351] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.351] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.351] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Numerics\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5497d790, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x5497d790, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x5497d790, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.352] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Numerics\\3aa74d59e41956ad20d38ea30b94e19f\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5497d790, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x5497d790, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x5497d790, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.352] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.352] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.352] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Printing\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78585e70, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x78585e70, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x78585e70, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.355] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Printing\\dc4e2d4b4c58e35bf39ea5b85557685f\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78585e70, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x78585e70, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x78585e70, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.356] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.356] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.356] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9fd2b90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa9fd2b90, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa9fd2b90, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.356] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9fd2b90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa9fd2b90, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa9fd2b90, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.360] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.361] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.361] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b0dacf0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8b0dacf0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8b0dacf0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.361] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b0dacf0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8b0dacf0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8b0dacf0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.364] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.365] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.365] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt73a1fc9d#\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e828e10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x7e828e10, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x7e828e10, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.366] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt73a1fc9d#\\1eb533a2b10b40a4cac2ea2aa5347e4f\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e828e10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x7e84ef70, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x7e84ef70, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.368] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.368] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.368] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt9064068c#\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7640c910, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x7640c910, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x7640c910, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.369] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt9064068c#\\2bcb9d5e9dfab75d491d144f711008cf\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7640c910, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x76432a70, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x76432a70, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.371] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.372] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.372] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt93d54979#\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa16353b0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa16353b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa16353b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.372] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt93d54979#\\662cd57946ab3a775b7410b88bdf465a\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa16353b0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa16353b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa16353b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.374] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.375] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.375] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runteb92aa12#\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8c6b9710, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8c6b9710, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8c6b9710, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.376] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runteb92aa12#\\10ac1ee8f5a49497e507e508ff64e21f\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8c6b9710, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8c6b9710, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8c6b9710, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.377] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.378] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.378] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Security\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54768450, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x54768450, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x54768450, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.378] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Security\\2c1e928e0fc903e00b846cd0e3d5027c\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54768450, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x54768450, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x54768450, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.379] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.379] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.379] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14259fd9#\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2a97010, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa2e29110, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa2e29110, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.380] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14259fd9#\\5802887b8b6900a064d0b61cd0ae7487\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2e29110, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa2e753d0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa2e753d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.383] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.383] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.383] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14b62006#\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1df1b30, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa1df1b30, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa1df1b30, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.384] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14b62006#\\a95f8e1301bd1eff684a8b33c50e0986\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1df1b30, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa1df1b30, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa1df1b30, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.385] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.386] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.386] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6eba5d0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa6eba5d0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa6eba5d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.387] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6eba5d0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa6ee0730, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa6ee0730, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.389] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.389] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.389] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab114b10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xab114b10, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xab114b10, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.390] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab114b10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xab114b10, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xab114b10, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.395] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.396] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.396] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv759bfb78#\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2a3d70, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8b2c9ed0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8b2c9ed0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.396] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv759bfb78#\\b2cde20051456606147962820883750f\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2c9ed0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8b2c9ed0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8b2c9ed0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.398] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.398] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.398] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servae423458#\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaac9e1d0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xaac9e1d0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xaac9e1d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.399] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servae423458#\\6ee662bee23b205a3508157c631f697f\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaac9e1d0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xaac9e1d0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xaac9e1d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.400] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.401] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.401] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servb00a6512#\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab245610, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xab245610, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xab245610, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.412] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servb00a6512#\\e70d84ed9e6a348fd66d7b67dcdfcb94\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab245610, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xab245610, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xab245610, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.414] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.414] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.414] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servd1dec626#\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8cae3d90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8cae3d90, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8cae3d90, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.415] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servd1dec626#\\845cf66dea3fcdc050258be47067f543\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8cae3d90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8cb09ef0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8cb09ef0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.417] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.417] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.418] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servf73e6522#\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa5b63310, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa5b63310, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa5b63310, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.421] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servf73e6522#\\5b410f7aa83eb57fe1ff51f926e6a72f\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa5b63310, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa5b63310, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa5b63310, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.423] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.423] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.424] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f801c90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x9f801c90, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x9f801c90, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.424] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f801c90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x9f84df50, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x9f84df50, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.425] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.425] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.425] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xabdb9ff0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xabde0150, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xabde0150, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.426] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xabde0150, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xabde0150, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xabde0150, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.426] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.426] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.427] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Transactions\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8637e1f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8637e1f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8637e1f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.428] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Transactions\\c0b6be862ff760a1f67b8b7e6548b411\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8637e1f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8637e1f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8637e1f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.428] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.428] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.428] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x830508f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x830508f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x830508f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.429] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x830508f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x83076a50, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x83076a50, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.430] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.430] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.430] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xadec1130, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xadec1130, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xadec1130, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.431] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xadec1130, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xadec1130, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xadec1130, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.432] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.433] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.433] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.188dd00b#\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac08da10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xac08da10, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xac08da10, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.434] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.188dd00b#\\520a036265c8b10ea599074a25d6aff6\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac08da10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xac08da10, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xac08da10, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.435] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.436] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.437] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.2486c0f5#\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae4da990, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xae4da990, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xae4da990, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.438] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.2486c0f5#\\f1837930831118bb63fa67c0f8a4e041\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae4da990, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xae4da990, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xae4da990, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.440] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.440] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.440] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.28b9ef5a#\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa674a110, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa674a110, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa674a110, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.441] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.28b9ef5a#\\4299b96732f17d4e5d50b2ef75728790\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa674a110, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa6770270, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa6770270, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.443] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.443] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.444] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaefb6df0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xaefb6df0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xaefb6df0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.444] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaefb6df0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xaefdcf50, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xaefdcf50, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.446] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.447] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.447] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86d29b50, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x86d29b50, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x86d29b50, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.447] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86d29b50, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x86d29b50, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x86d29b50, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.449] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.450] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.450] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xadb08ed0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xadb08ed0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xadb08ed0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.451] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xadb08ed0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xadb08ed0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xadb08ed0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.452] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.454] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.454] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8aa28f10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8aa28f10, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8aa28f10, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.455] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8aa28f10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8aa28f10, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8aa28f10, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.458] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.459] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.459] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae9e9850, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xae9e9850, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xae9e9850, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.465] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae9e9850, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xae9e9850, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xae9e9850, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.475] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.476] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.476] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf80baf0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xaf80baf0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xaf80baf0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.477] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf80baf0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xaf831c50, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xaf831c50, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.478] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.479] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.479] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Entity\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae892bf0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xae892bf0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xae892bf0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.480] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Entity\\7daf7302e1e4f4ea64ae78ffbde6ecf6\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae892bf0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xae892bf0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xae892bf0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.480] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.480] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.480] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Mobile\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb06ec470, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb06ec470, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb06ec470, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.481] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Mobile\\b1c3497a70080378a9e9cde62b3420cd\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb06ec470, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb06ec470, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb06ec470, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.482] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.482] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.482] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Routing\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb08b54f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb08b54f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb08b54f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.482] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Routing\\46411ac9eea46e3d2385e7cd2da86632\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb08b54f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb08b54f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb08b54f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.486] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.486] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.486] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Services\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8da5cc90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8da5cc90, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8da5cc90, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.487] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Services\\c2b620d7432f7b69a2a9b71187c628bb\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8da5cc90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8da5cc90, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8da5cc90, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.487] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.487] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.488] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind0de890be#\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb2e7f230, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb2e7f230, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb2e7f230, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.488] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind0de890be#\\dacce78d04c965cfa8a0bd2d769c0df9\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb2e7f230, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb2ea5390, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb2ea5390, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.490] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.491] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.491] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind412bbddf#\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb1429ed0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb1450030, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb1450030, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.491] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind412bbddf#\\8f843d16af00b139f8aebd174cf6cd87\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb1450030, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb1450030, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb1450030, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.493] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.494] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.494] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind5abb17e9#\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb3472930, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb3472930, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb3472930, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.495] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind5abb17e9#\\47eae5af9af4dada35fc99b2aebd0836\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb3472930, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb3472930, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb3472930, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.496] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.497] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.497] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind5cb9c182#\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb31c5070, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb31c5070, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb31c5070, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.498] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind5cb9c182#\\10e977c09d43d6428afc878b89e8876b\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb31c5070, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb31c5070, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb31c5070, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.499] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.500] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.500] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind74b7bf4b#\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70274310, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x70274310, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x70274310, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.501] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind74b7bf4b#\\0e9541bf3682b6d1dc58f877d00bf003\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70274310, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x70274310, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x70274310, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.503] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.503] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.503] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x760ecc30, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x760ecc30, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x760ecc30, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.504] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\6e89f5768c30e6d5cc74a6b198f437ce\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x760ecc30, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x76138ef0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x76138ef0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.505] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.505] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.505] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Work0493292f#\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb6fa8c70, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb6fa8c70, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb6fa8c70, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.506] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Work0493292f#\\9ea2b7c90b2b94db95abbcac4b9d6fa6\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb6fa8c70, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb6fa8c70, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb6fa8c70, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.507] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.508] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.508] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workca489553#\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb5fbd950, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb5fbd950, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb5fbd950, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.509] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workca489553#\\51aca1119e84ee23c5fa073a71308fa3\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb5fbd950, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb5fe3ab0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb5fe3ab0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.510] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.511] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.511] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workd8194f73#\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb7908310, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb7908310, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb7908310, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.512] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workd8194f73#\\a09a8f6704efe36ed2e7ec006a65d128\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb7908310, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb7908310, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb7908310, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.514] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.515] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.515] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workfffcbcd8#\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb458e750, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb458e750, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb458e750, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.515] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workfffcbcd8#\\8ef3d7e6809291cb84a980d3b5838e4e\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb458e750, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb45b48b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb45b48b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.517] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.517] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.518] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x55695090, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x55695090, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x55695090, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.518] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml\\fb6b4d41d7ce9edebd6203a161832f44\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x55695090, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x55695090, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x55695090, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.519] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.519] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.519] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml.Hosting\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa49aef70, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa49aef70, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa49aef70, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.519] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml.Hosting\\0e0c19b181a5f5efad4a25b054971c98\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa49aef70, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa49aef70, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa49aef70, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.520] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.520] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.520] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53248110, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x53248110, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x53248110, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.521] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53248110, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x5326e270, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x5326e270, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.521] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.521] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.521] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb7c4e150, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb7c4e150, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb7c4e150, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.521] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb7c4e150, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb7c4e150, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb7c4e150, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.523] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.524] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.524] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.Linq\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9558bf10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x9558bf10, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x9558bf10, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.525] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.Linq\\f64e54c058a7f03b91081ec68422c2e6\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9558bf10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x9558bf10, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x9558bf10, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.525] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.525] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.526] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe955f360, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x81666320, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x81666320, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.526] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\b94-0\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe955f360, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xe955f360, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xe955f360, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.527] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.527] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.527] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomatio4e153cb6#\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb8704450, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb8704450, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb8704450, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.528] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomatio4e153cb6#\\86701376d7d601b26aab6a569b1bdd69\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb8704450, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb8704450, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb8704450, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.529] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.530] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.530] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationClient\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb7fe0250, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb7fe0250, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb7fe0250, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.535] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationClient\\e4aec2199c025a5f8222ae9b7550c974\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb7fe0250, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb7fe0250, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb7fe0250, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.535] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.536] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.536] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationProvider\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7011d6b0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x7011d6b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x7011d6b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.536] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationProvider\\1af66d34b505ca36c35a3e8d91cbba7d\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7011d6b0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x7011d6b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x7011d6b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.537] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.537] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.537] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationTypes\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70038e70, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x70038e70, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x70038e70, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.538] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationTypes\\5dee7937ac1cb13daf57484f8cf36af6\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70038e70, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x70038e70, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x70038e70, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.539] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.539] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.539] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsBase\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6066e9d0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x6066e9d0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x6066e9d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.540] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsBase\\46ff3d18994cf61508e0dcc57fef8b95\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6066e9d0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x6066e9d0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x6066e9d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.540] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.540] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.540] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsForm0b574481#\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb8c85730, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb8c85730, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb8c85730, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.541] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsForm0b574481#\\da3bf1745f91cfd07f9fb1e899bde4d7\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb8c85730, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb8c85730, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb8c85730, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.543] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.544] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.544] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5909a8d0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x5909a8d0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x5909a8d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.545] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5909a8d0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x590c0a30, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x590c0a30, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.545] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.545] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.545] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb91945f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb91945f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb91945f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.546] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb91945f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb91945f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb91945f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.547] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.547] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.547] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XsdBuildTask\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb93a9930, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb93a9930, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb93a9930, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.548] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XsdBuildTask\\a225b7775368c3a993caa9d57722f9cb\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb93a9930, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb93a9930, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb93a9930, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.551] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.553] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.553] FindClose (in: hFindFile=0x295118 | out: hFindFile=0x295118) returned 1 [0028.553] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\temp\\*", lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3df4d1b0, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xe968e7e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe968e7e0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295118 [0028.554] FindClose (in: hFindFile=0x295118 | out: hFindFile=0x295118) returned 1 [0028.554] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\tmp\\*", lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x409415bd, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xe57ec500, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe968e7e0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295118 [0028.555] FindClose (in: hFindFile=0x295118 | out: hFindFile=0x295118) returned 1 [0028.555] FindClose (in: hFindFile=0x2950d8 | out: hFindFile=0x2950d8) returned 1 [0028.555] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\*", lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfde52538, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x2950d8 [0028.555] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\DVD\\*", lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295118 [0028.555] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\DVD\\EFI\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x810320ce, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x810320ce, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.556] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\DVD\\EFI\\en-US\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8fb01be9, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x8fb01be9, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.556] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.557] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.557] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\DVD\\PCAT\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e9f4a12, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9f4a12, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.557] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\*", lpFindFileData=0x18ed78 | out: lpFindFileData=0x18ed78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9f4a12, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1e9f4a12, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9f4a12, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295198 [0028.557] FindClose (in: hFindFile=0x295198 | out: hFindFile=0x295198) returned 1 [0028.557] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.557] FindClose (in: hFindFile=0x295118 | out: hFindFile=0x295118) returned 1 [0028.557] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\EFI\\*", lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfde52538, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x4e43c9e1, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x4e43c9e1, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295118 [0028.559] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\EFI\\cs-CZ\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfde52538, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfde78692, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfde78692, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.560] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.560] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\EFI\\da-DK\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfde52538, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfde78692, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfde78692, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.560] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.560] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\EFI\\de-DE\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfde78692, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfde78692, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfde78692, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.561] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.561] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\EFI\\el-GR\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfde78692, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfde78692, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfde78692, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.561] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.561] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\EFI\\en-US\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfde78692, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1e9f4a12, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9f4a12, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.562] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.562] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\EFI\\es-ES\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfde9e7ec, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfde9e7ec, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfde9e7ec, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.562] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.563] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\EFI\\fi-FI\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfde9e7ec, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdec4946, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdec4946, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.563] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.563] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\EFI\\fr-FR\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfde9e7ec, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdec4946, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdec4946, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.563] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.563] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\EFI\\hu-HU\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdec4946, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdec4946, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdec4946, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.564] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.564] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\EFI\\it-IT\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdec4946, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdeeaaa0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdeeaaa0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.565] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.565] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\EFI\\ja-JP\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf36d54, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdf36d54, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdf36d54, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.565] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.565] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\EFI\\ko-KR\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf5ceae, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdf5ceae, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdf5ceae, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.565] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.565] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\EFI\\nb-NO\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf5ceae, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdf5ceae, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdf5ceae, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.566] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.566] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\EFI\\nl-NL\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdfcf2bc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdfcf2bc, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdfcf2bc, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.567] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.567] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\EFI\\pl-PL\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdfcf2bc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdfcf2bc, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdfcf2bc, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.567] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.567] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\EFI\\pt-BR\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe0ffd8c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe0ffd8c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe0ffd8c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.567] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.568] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\EFI\\pt-PT\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe0ffd8c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe0ffd8c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe0ffd8c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.568] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.569] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\EFI\\ru-RU\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe0ffd8c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe0ffd8c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe0ffd8c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.569] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.569] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\EFI\\sv-SE\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe0ffd8c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe125ee6, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe125ee6, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.569] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.569] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\EFI\\tr-TR\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe1982f4, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe1982f4, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe1982f4, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.570] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.570] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\EFI\\zh-CN\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe1982f4, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe1982f4, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe1982f4, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.571] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.571] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\EFI\\zh-HK\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe1982f4, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe1982f4, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe1982f4, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.571] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.571] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\EFI\\zh-TW\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe1982f4, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe1982f4, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe1982f4, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.571] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.571] FindClose (in: hFindFile=0x295118 | out: hFindFile=0x295118) returned 1 [0028.571] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\Fonts\\*", lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe1982f4, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe1be44e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe1be44e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295118 [0028.572] FindClose (in: hFindFile=0x295118 | out: hFindFile=0x295118) returned 1 [0028.572] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\PCAT\\*", lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe1982f4, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x4e4fb0c2, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x4e4fb0c2, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295118 [0028.574] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\PCAT\\cs-CZ\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe1be44e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe1be44e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe1be44e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.574] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.574] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\PCAT\\da-DK\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe1be44e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe1be44e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe1be44e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.575] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.575] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\PCAT\\de-DE\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe1e45a8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe1e45a8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe1e45a8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.575] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.575] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\PCAT\\el-GR\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe1e45a8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe1e45a8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe1e45a8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.576] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.576] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\PCAT\\en-US\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe1e45a8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1e9f4a12, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9f4a12, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.576] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.576] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\PCAT\\es-ES\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe1e45a8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe1e45a8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe1e45a8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.577] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.577] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\PCAT\\fi-FI\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe2569b6, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe27cb10, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe27cb10, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.577] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.577] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\PCAT\\fr-FR\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe27cb10, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe27cb10, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe27cb10, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.578] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.578] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\PCAT\\hu-HU\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe27cb10, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe27cb10, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe27cb10, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.579] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.579] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\PCAT\\it-IT\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe27cb10, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe27cb10, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe27cb10, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.579] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.579] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\PCAT\\ja-JP\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe27cb10, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe27cb10, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe27cb10, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.579] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.579] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\PCAT\\ko-KR\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe27cb10, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe2a2c6a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe2a2c6a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.580] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.580] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\PCAT\\nb-NO\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe2a2c6a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe2a2c6a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe2a2c6a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.581] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.581] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\PCAT\\nl-NL\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe2a2c6a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe2a2c6a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe2a2c6a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.581] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.581] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\PCAT\\pl-PL\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe2a2c6a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe2a2c6a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe2a2c6a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.581] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.581] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\PCAT\\pt-BR\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe2a2c6a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe2a2c6a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe2a2c6a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.582] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.582] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\PCAT\\pt-PT\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe2a2c6a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe2a2c6a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe2a2c6a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.583] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.583] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\PCAT\\ru-RU\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe2eef1e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe2eef1e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe2eef1e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.583] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.583] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\PCAT\\sv-SE\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe2eef1e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe2eef1e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe2eef1e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.583] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.583] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\PCAT\\tr-TR\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe36132c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe36132c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe36132c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.584] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.584] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\PCAT\\zh-CN\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe36132c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe36132c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe36132c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.585] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.586] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\PCAT\\zh-HK\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe36132c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe36132c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe36132c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.586] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.586] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\PCAT\\zh-TW\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe36132c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe36132c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe36132c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295158 [0028.586] FindClose (in: hFindFile=0x295158 | out: hFindFile=0x295158) returned 1 [0028.586] FindClose (in: hFindFile=0x295118 | out: hFindFile=0x295118) returned 1 [0028.587] FindClose (in: hFindFile=0x2950d8 | out: hFindFile=0x2950d8) returned 1 [0028.587] FindFirstFileW (in: lpFileName="C:\\Windows\\Branding\\*", lpFindFileData=0x18f594 | out: lpFindFileData=0x18f594*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe36132c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x2950d8 [0028.587] FindFirstFileW (in: lpFileName="C:\\Windows\\Branding\\Basebrd\\*", lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xaa761cf6, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9d0ecf05, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295118 [0028.587] FindFirstFileW (in: lpFileName="C:\\Windows\\Branding\\Basebrd\\en-US\\*", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea1accb, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xaa466c4a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9d113174, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x295158 [0045.495] FindFirstFileW (in: lpFileName="C:\\Windows\\winsxs\\x86_microsoft-windows-mfc40u_31bf3856ad364e35_6.1.7601.17514_none_f51a7bf0b3d25294\\*", lpFindFileData=0x18f2e0 | out: lpFindFileData=0x18f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94f7ab8d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x94f7ab8d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x94f7ab8d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x28cb50, cFileName=".", cAlternateFileName="")) returned 0x295118 [0046.534] FreeResource (hResData=0x6be0f0) returned 0 [0046.534] GetEnvironmentVariableW (in: lpName="TEMP", lpBuffer=0x18f5a8, nSize=0x400 | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 0x24 [0046.535] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\Public.key" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\public.key"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0046.535] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd50*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd50*=0) returned 0x0 [0046.535] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd48*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd48*=0) returned 0x0 [0046.535] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd48*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd48*=0) returned 0x134 [0046.535] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd48*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd48*=0) returned 0x0 [0046.535] ReadFile (in: hFile=0x158, lpBuffer=0x3519ad0, nNumberOfBytesToRead=0x134, lpNumberOfBytesRead=0x18fd5c, lpOverlapped=0x0 | out: lpBuffer=0x3519ad0*, lpNumberOfBytesRead=0x18fd5c*=0x134, lpOverlapped=0x0) returned 1 [0046.535] CloseHandle (hObject=0x158) returned 1 [0046.535] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=16679895733) returned 1 [0046.536] CreateFileW (lpFileName="C:\\Файл зашифрован [].wannacash .zip" (normalized: "c:\\Файл зашифрован [].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0046.539] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0046.539] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0046.539] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0046.539] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0046.539] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0046.539] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0046.539] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0046.539] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0046.539] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0046.539] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0046.540] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0046.540] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0046.540] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0046.540] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0046.540] SetEndOfFile (hFile=0x158) returned 1 [0046.540] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0046.540] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0046.540] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0046.540] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0046.540] WriteFile (in: hFile=0x158, lpBuffer=0x361f5a8*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x361f5a8*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0046.541] WriteFile (in: hFile=0x158, lpBuffer=0x35f005c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f005c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0046.541] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="^N4N0TiX1~!I:0{+-reu9(f0w0M#W1", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0047.036] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="A*qHZc1!P)L\"q=kv(eyN=(J>f0w0M#W1", cchWideChar=32, lpMultiByteStr=0x2031f6c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="A*qHZc1!P)L\"q=kv(eyN=(J>f0w0M#W1", lpUsedDefaultChar=0x0) returned 32 [0047.036] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0047.036] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0047.036] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38b7300, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0xa38b7300, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 0x295098 [0047.036] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0047.036] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0047.036] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml")) returned 0x2020 [0047.037] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml")) returned 0x2020 [0047.037] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml")) returned 0x2020 [0047.037] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml")) returned 0x2020 [0047.037] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38b7300, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0xa38b7300, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543)) returned 1 [0047.037] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0047.037] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0047.037] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml")) returned 0x2020 [0047.037] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml")) returned 0x2020 [0047.037] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0047.037] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0047.037] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0047.038] SetEndOfFile (hFile=0x158) returned 1 [0047.038] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Proof.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.038] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Proof.xml", cchWideChar=9, lpMultiByteStr=0x1fe358c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Proof.xml", lpUsedDefaultChar=0x0) returned 9 [0047.038] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Proof.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.038] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Proof.xml", cchWideChar=9, lpMultiByteStr=0x1fe39cc, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Proof.xml", lpUsedDefaultChar=0x0) returned 9 [0047.038] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe39cc, cbMultiByte=9, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="Proof.xmlmlxmlmll@\x01") returned 9 [0047.039] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Proof.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.039] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Proof.xml", cchWideChar=9, lpMultiByteStr=0x1fe358c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Proof.xml", lpUsedDefaultChar=0x0) returned 9 [0047.039] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0047.039] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0047.039] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x543 [0047.039] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0047.039] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0047.039] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0047.039] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Proof.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.039] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Proof.xml", cchWideChar=9, lpMultiByteStr=0x1fe358c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Proof.xml", lpUsedDefaultChar=0x0) returned 9 [0047.039] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Proof.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.039] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Proof.xml", cchWideChar=9, lpMultiByteStr=0x1fe39cc, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Proof.xml", lpUsedDefaultChar=0x0) returned 9 [0047.039] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe39cc, cbMultiByte=9, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="Proof.xmlof.xmlmlxmlmll@\x01") returned 9 [0047.039] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Proof.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.039] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Proof.xml", cchWideChar=9, lpMultiByteStr=0x1fe358c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Proof.xml", lpUsedDefaultChar=0x0) returned 9 [0047.039] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0047.040] CharToOemA (in: pSrc="Proof.xml", pDst=0x1fe39cc | out: pDst="Proof.xml") returned 1 [0047.040] WriteFile (in: hFile=0x158, lpBuffer=0x1fe39cc*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe39cc*, lpNumberOfBytesWritten=0x18e048*=0x9, lpOverlapped=0x0) returned 1 [0047.040] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0047.040] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0047.040] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0047.040] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=16730536247) returned 1 [0047.042] ReadFile (in: hFile=0x15c, lpBuffer=0x3500240, nNumberOfBytesToRead=0x543, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3500240*, lpNumberOfBytesRead=0x18dd7c*=0x543, lpOverlapped=0x0) returned 1 [0047.043] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0047.043] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=16730670665) returned 1 [0047.051] WriteFile (in: hFile=0x158, lpBuffer=0x1fea228*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fea228*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0047.051] ReadFile (in: hFile=0x15c, lpBuffer=0x3500240, nNumberOfBytesToRead=0x543, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3500240*, lpNumberOfBytesRead=0x18de38*=0x543, lpOverlapped=0x0) returned 1 [0047.051] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x44 [0047.052] WriteFile (in: hFile=0x158, lpBuffer=0x35007a0*, nNumberOfBytesToWrite=0x543, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x35007a0*, lpNumberOfBytesWritten=0x18de10*=0x543, lpOverlapped=0x0) returned 1 [0047.052] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x587 [0047.052] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0047.052] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0047.052] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0047.052] SetFilePointer (in: hFile=0x158, lDistanceToMove=9, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x27 [0047.052] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x591 [0047.052] CloseHandle (hObject=0x15c) returned 1 [0047.052] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x591 [0047.052] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x591 [0047.052] SetFilePointer (in: hFile=0x158, lDistanceToMove=1425, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x591 [0047.052] SetFilePointer (in: hFile=0x158, lDistanceToMove=1425, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x591 [0047.052] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x591 [0047.052] SetFilePointer (in: hFile=0x158, lDistanceToMove=1425, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x591 [0047.052] SetEndOfFile (hFile=0x158) returned 1 [0047.053] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x591 [0047.053] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x591 [0047.053] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Proof.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.053] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Proof.xml", cchWideChar=9, lpMultiByteStr=0x1fe358c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Proof.xml", lpUsedDefaultChar=0x0) returned 9 [0047.053] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Proof.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.053] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Proof.xml", cchWideChar=9, lpMultiByteStr=0x1fe3a0c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Proof.xml", lpUsedDefaultChar=0x0) returned 9 [0047.053] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe3a0c, cbMultiByte=9, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="Proof.xml") returned 9 [0047.053] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Proof.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.053] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Proof.xml", cchWideChar=9, lpMultiByteStr=0x1fe358c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Proof.xml", lpUsedDefaultChar=0x0) returned 9 [0047.053] WriteFile (in: hFile=0x158, lpBuffer=0x34e3cf8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x34e3cf8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0047.053] CharToOemA (in: pSrc="Proof.xml", pDst=0x1fe3a0c | out: pDst="Proof.xml") returned 1 [0047.053] WriteFile (in: hFile=0x158, lpBuffer=0x1fe3a0c*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe3a0c*, lpNumberOfBytesWritten=0x18efcc*=0x9, lpOverlapped=0x0) returned 1 [0047.053] WriteFile (in: hFile=0x158, lpBuffer=0x1fea260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea260*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0047.053] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0047.053] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0047.053] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x5d3 [0047.054] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x5d3 [0047.054] WriteFile (in: hFile=0x158, lpBuffer=0x361f5a8*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x361f5a8*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0047.054] WriteFile (in: hFile=0x158, lpBuffer=0x35eff9c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35eff9c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0047.054] DeleteFileW (lpFileName="") returned 0 [0047.054] GetLastError () returned 0x3 [0047.054] GetFileAttributesW (lpFileName="") returned 0xffffffff [0047.054] SetLastError (dwErrCode=0x3) [0047.054] FlushFileBuffers (hFile=0x158) returned 1 [0047.056] GetCurrentThreadId () returned 0x970 [0047.056] GetCurrentThreadId () returned 0x970 [0047.056] GetCurrentThreadId () returned 0x970 [0047.056] GetCurrentThreadId () returned 0x970 [0047.056] GetCurrentThreadId () returned 0x970 [0047.056] GetCurrentThreadId () returned 0x970 [0047.056] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x68a [0047.056] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x68a [0047.056] SetFilePointer (in: hFile=0x158, lDistanceToMove=1674, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x68a [0047.056] CloseHandle (hObject=0x158) returned 1 [0047.057] GetCurrentThreadId () returned 0x970 [0047.057] GetCurrentThreadId () returned 0x970 [0047.057] GetCurrentThreadId () returned 0x970 [0047.057] GetCurrentThreadId () returned 0x970 [0047.057] GetCurrentThreadId () returned 0x970 [0047.057] GetCurrentThreadId () returned 0x970 [0047.057] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Файл зашифрован [Proof.xml].wannacash .zip" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\Файл зашифрован [proof.xml].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0047.057] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x68a [0047.057] SetFilePointer (in: hFile=0x158, lDistanceToMove=1546, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x60a [0047.057] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0047.057] GetFileType (hFile=0x158) returned 0x1 [0047.057] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x36, wMilliseconds=0x166)) [0047.058] GetCurrentThreadId () returned 0x970 [0047.058] GetCurrentThreadId () returned 0x970 [0047.058] GetCurrentThreadId () returned 0x970 [0047.058] GetCurrentThreadId () returned 0x970 [0047.058] GetCurrentThreadId () returned 0x970 [0047.058] GetCurrentThreadId () returned 0x970 [0047.058] GetCurrentThreadId () returned 0x970 [0047.058] GetCurrentThreadId () returned 0x970 [0047.058] GetCurrentThreadId () returned 0x970 [0047.058] GetCurrentThreadId () returned 0x970 [0047.058] GetCurrentThreadId () returned 0x970 [0047.058] GetCurrentThreadId () returned 0x970 [0047.058] GetCurrentThreadId () returned 0x970 [0047.058] GetCurrentThreadId () returned 0x970 [0047.058] GetCurrentThreadId () returned 0x970 [0047.058] GetCurrentThreadId () returned 0x970 [0047.058] GetCurrentThreadId () returned 0x970 [0047.058] GetCurrentThreadId () returned 0x970 [0047.058] GetCurrentThreadId () returned 0x970 [0047.058] GetCurrentThreadId () returned 0x970 [0047.058] GetCurrentThreadId () returned 0x970 [0047.058] GetCurrentThreadId () returned 0x970 [0047.058] GetCurrentThreadId () returned 0x970 [0047.058] GetCurrentThreadId () returned 0x970 [0047.058] GetCurrentThreadId () returned 0x970 [0047.058] GetCurrentThreadId () returned 0x970 [0047.058] GetCurrentThreadId () returned 0x970 [0047.058] GetCurrentThreadId () returned 0x970 [0047.058] GetCurrentThreadId () returned 0x970 [0047.058] GetCurrentThreadId () returned 0x970 [0047.058] GetCurrentThreadId () returned 0x970 [0047.058] GetCurrentThreadId () returned 0x970 [0047.058] GetCurrentThreadId () returned 0x970 [0047.058] GetCurrentThreadId () returned 0x970 [0047.058] GetCurrentThreadId () returned 0x970 [0047.058] GetCurrentThreadId () returned 0x970 [0047.058] GetCurrentThreadId () returned 0x970 [0047.058] GetCurrentThreadId () returned 0x970 [0047.058] GetCurrentThreadId () returned 0x970 [0047.058] GetCurrentThreadId () returned 0x970 [0047.058] GetCurrentThreadId () returned 0x970 [0047.058] GetCurrentThreadId () returned 0x970 [0047.058] GetCurrentThreadId () returned 0x970 [0047.058] GetCurrentThreadId () returned 0x970 [0047.058] GetCurrentThreadId () returned 0x970 [0047.059] GetCurrentThreadId () returned 0x970 [0047.059] GetCurrentThreadId () returned 0x970 [0047.059] GetCurrentThreadId () returned 0x970 [0047.059] GetCurrentThreadId () returned 0x970 [0047.059] GetCurrentThreadId () returned 0x970 [0047.059] GetCurrentThreadId () returned 0x970 [0047.059] GetCurrentThreadId () returned 0x970 [0047.059] GetCurrentThreadId () returned 0x970 [0047.059] GetCurrentThreadId () returned 0x970 [0047.059] GetCurrentThreadId () returned 0x970 [0047.059] GetCurrentThreadId () returned 0x970 [0047.059] GetCurrentThreadId () returned 0x970 [0047.059] GetCurrentThreadId () returned 0x970 [0047.059] GetCurrentThreadId () returned 0x970 [0047.059] GetCurrentThreadId () returned 0x970 [0047.059] GetCurrentThreadId () returned 0x970 [0047.059] GetCurrentThreadId () returned 0x970 [0047.059] GetCurrentThreadId () returned 0x970 [0047.059] GetCurrentThreadId () returned 0x970 [0047.059] GetCurrentThreadId () returned 0x970 [0047.059] GetCurrentThreadId () returned 0x970 [0047.059] GetCurrentThreadId () returned 0x970 [0047.059] GetCurrentThreadId () returned 0x970 [0047.059] GetCurrentThreadId () returned 0x970 [0047.059] GetCurrentThreadId () returned 0x970 [0047.059] GetCurrentThreadId () returned 0x970 [0047.059] GetCurrentThreadId () returned 0x970 [0047.059] GetCurrentThreadId () returned 0x970 [0047.059] GetCurrentThreadId () returned 0x970 [0047.059] GetCurrentThreadId () returned 0x970 [0047.059] GetCurrentThreadId () returned 0x970 [0047.059] GetCurrentThreadId () returned 0x970 [0047.059] GetCurrentThreadId () returned 0x970 [0047.059] GetCurrentThreadId () returned 0x970 [0047.059] GetCurrentThreadId () returned 0x970 [0047.059] GetCurrentThreadId () returned 0x970 [0047.059] GetCurrentThreadId () returned 0x970 [0047.059] GetCurrentThreadId () returned 0x970 [0047.059] GetCurrentThreadId () returned 0x970 [0047.059] GetCurrentThreadId () returned 0x970 [0047.059] GetCurrentThreadId () returned 0x970 [0047.059] GetCurrentThreadId () returned 0x970 [0047.059] GetCurrentThreadId () returned 0x970 [0047.059] GetCurrentThreadId () returned 0x970 [0047.059] GetCurrentThreadId () returned 0x970 [0047.059] GetCurrentThreadId () returned 0x970 [0047.059] GetCurrentThreadId () returned 0x970 [0047.059] GetCurrentThreadId () returned 0x970 [0047.060] GetCurrentThreadId () returned 0x970 [0047.060] GetCurrentThreadId () returned 0x970 [0047.060] GetCurrentThreadId () returned 0x970 [0047.060] GetCurrentThreadId () returned 0x970 [0047.060] GetCurrentThreadId () returned 0x970 [0047.060] GetCurrentThreadId () returned 0x970 [0047.060] GetCurrentThreadId () returned 0x970 [0047.060] GetCurrentThreadId () returned 0x970 [0047.060] GetCurrentThreadId () returned 0x970 [0047.060] GetCurrentThreadId () returned 0x970 [0047.060] GetCurrentThreadId () returned 0x970 [0047.060] GetCurrentThreadId () returned 0x970 [0047.060] GetCurrentThreadId () returned 0x970 [0047.060] GetCurrentThreadId () returned 0x970 [0047.060] GetCurrentThreadId () returned 0x970 [0047.060] GetCurrentThreadId () returned 0x970 [0047.060] GetCurrentThreadId () returned 0x970 [0047.060] GetCurrentThreadId () returned 0x970 [0047.060] GetCurrentThreadId () returned 0x970 [0047.060] GetCurrentThreadId () returned 0x970 [0047.060] GetCurrentThreadId () returned 0x970 [0047.060] GetCurrentThreadId () returned 0x970 [0047.060] GetCurrentThreadId () returned 0x970 [0047.060] GetCurrentThreadId () returned 0x970 [0047.060] GetCurrentThreadId () returned 0x970 [0047.060] GetCurrentThreadId () returned 0x970 [0047.060] GetCurrentThreadId () returned 0x970 [0047.060] GetCurrentThreadId () returned 0x970 [0047.060] GetCurrentThreadId () returned 0x970 [0047.060] GetCurrentThreadId () returned 0x970 [0047.060] GetCurrentThreadId () returned 0x970 [0047.060] GetCurrentThreadId () returned 0x970 [0047.060] GetCurrentThreadId () returned 0x970 [0047.060] GetCurrentThreadId () returned 0x970 [0047.060] GetCurrentThreadId () returned 0x970 [0047.060] GetCurrentThreadId () returned 0x970 [0047.060] GetCurrentThreadId () returned 0x970 [0047.060] GetCurrentThreadId () returned 0x970 [0047.060] GetCurrentThreadId () returned 0x970 [0047.060] GetCurrentThreadId () returned 0x970 [0047.060] GetCurrentThreadId () returned 0x970 [0047.060] GetCurrentThreadId () returned 0x970 [0047.060] GetCurrentThreadId () returned 0x970 [0047.060] GetCurrentThreadId () returned 0x970 [0047.060] GetCurrentThreadId () returned 0x970 [0047.060] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0047.060] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0047.061] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea830, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0047.061] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0047.061] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0047.061] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea830, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0047.061] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0047.061] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0047.061] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0047.061] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0047.061] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0047.061] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0047.061] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0047.061] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0047.061] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0047.061] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0047.061] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0047.061] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0047.061] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0047.061] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0047.061] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0047.061] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x36, wMilliseconds=0x166)) [0047.061] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="A*qHZc1!P)L\"q=kv(eyN=(J>f0w0M#W1", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0047.061] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="A*qHZc1!P)L\"q=kv(eyN=(J>f0w0M#W1", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0047.061] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="A*qHZc1!P)L\"q=kv(eyN=(J>f0w0M#W1", cchWideChar=32, lpMultiByteStr=0x2000208, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="A*qHZc1!P)L\"q=kv(eyN=(J>f0w0M#W1", lpUsedDefaultChar=0x0) returned 32 [0047.061] GetCurrentThreadId () returned 0x970 [0047.061] GetCurrentThreadId () returned 0x970 [0047.061] GetCurrentThreadId () returned 0x970 [0047.061] GetCurrentThreadId () returned 0x970 [0047.061] GetCurrentThreadId () returned 0x970 [0047.061] GetCurrentThreadId () returned 0x970 [0047.069] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0047.069] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0047.069] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x202bb78, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0047.069] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x35901f8, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0047.069] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x35901f8, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAADcnidSGGQ1rIWXFWPhTsjDqpfATOUkASWiBDNVvg4hiXASQLEf8c91SV0+1XSk8gi76WdNbvficRYz79cvBHRjQk6ebxRPYEo6kK6/2tcLhsxAS9DLPpqAGzkM6SOcWoSpECMGiF35XUHSOIW+mXJy5H1Iop4vZt3YCMWMH+QbpmUtlKIiUXqNeXjp9WBNZz3EM1w6+lRNmHh9FU7z4bwYY2QB4xZTxgA==") returned 232 [0047.069] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x36, wMilliseconds=0x176)) [0047.069] GetCurrentThreadId () returned 0x970 [0047.069] GetCurrentThreadId () returned 0x970 [0047.069] GetCurrentThreadId () returned 0x970 [0047.069] GetCurrentThreadId () returned 0x970 [0047.069] GetCurrentThreadId () returned 0x970 [0047.069] GetCurrentThreadId () returned 0x970 [0047.069] GetCurrentThreadId () returned 0x970 [0047.069] GetCurrentThreadId () returned 0x970 [0047.069] GetCurrentThreadId () returned 0x970 [0047.069] GetCurrentThreadId () returned 0x970 [0047.069] GetCurrentThreadId () returned 0x970 [0047.069] GetCurrentThreadId () returned 0x970 [0047.069] GetCurrentThreadId () returned 0x970 [0047.069] GetCurrentThreadId () returned 0x970 [0047.069] GetCurrentThreadId () returned 0x970 [0047.069] GetCurrentThreadId () returned 0x970 [0047.069] GetCurrentThreadId () returned 0x970 [0047.069] GetCurrentThreadId () returned 0x970 [0047.069] GetCurrentThreadId () returned 0x970 [0047.069] GetCurrentThreadId () returned 0x970 [0047.069] GetCurrentThreadId () returned 0x970 [0047.069] GetCurrentThreadId () returned 0x970 [0047.069] GetCurrentThreadId () returned 0x970 [0047.069] GetCurrentThreadId () returned 0x970 [0047.069] GetCurrentThreadId () returned 0x970 [0047.069] GetCurrentThreadId () returned 0x970 [0047.069] GetCurrentThreadId () returned 0x970 [0047.069] GetCurrentThreadId () returned 0x970 [0047.069] GetCurrentThreadId () returned 0x970 [0047.069] GetCurrentThreadId () returned 0x970 [0047.069] GetCurrentThreadId () returned 0x970 [0047.069] GetCurrentThreadId () returned 0x970 [0047.069] GetCurrentThreadId () returned 0x970 [0047.069] GetCurrentThreadId () returned 0x970 [0047.069] GetCurrentThreadId () returned 0x970 [0047.069] GetCurrentThreadId () returned 0x970 [0047.069] GetCurrentThreadId () returned 0x970 [0047.070] GetCurrentThreadId () returned 0x970 [0047.070] GetCurrentThreadId () returned 0x970 [0047.070] GetCurrentThreadId () returned 0x970 [0047.070] GetCurrentThreadId () returned 0x970 [0047.070] GetCurrentThreadId () returned 0x970 [0047.070] GetCurrentThreadId () returned 0x970 [0047.070] GetCurrentThreadId () returned 0x970 [0047.070] GetCurrentThreadId () returned 0x970 [0047.070] GetCurrentThreadId () returned 0x970 [0047.070] GetCurrentThreadId () returned 0x970 [0047.070] GetCurrentThreadId () returned 0x970 [0047.070] GetCurrentThreadId () returned 0x970 [0047.070] GetCurrentThreadId () returned 0x970 [0047.070] GetCurrentThreadId () returned 0x970 [0047.070] GetCurrentThreadId () returned 0x970 [0047.070] GetCurrentThreadId () returned 0x970 [0047.070] GetCurrentThreadId () returned 0x970 [0047.070] GetCurrentThreadId () returned 0x970 [0047.070] GetCurrentThreadId () returned 0x970 [0047.070] GetCurrentThreadId () returned 0x970 [0047.070] GetCurrentThreadId () returned 0x970 [0047.070] GetCurrentThreadId () returned 0x970 [0047.070] GetCurrentThreadId () returned 0x970 [0047.070] GetCurrentThreadId () returned 0x970 [0047.070] GetCurrentThreadId () returned 0x970 [0047.070] GetCurrentThreadId () returned 0x970 [0047.070] GetCurrentThreadId () returned 0x970 [0047.070] GetCurrentThreadId () returned 0x970 [0047.070] GetCurrentThreadId () returned 0x970 [0047.070] GetCurrentThreadId () returned 0x970 [0047.070] GetCurrentThreadId () returned 0x970 [0047.070] GetCurrentThreadId () returned 0x970 [0047.070] GetCurrentThreadId () returned 0x970 [0047.070] GetCurrentThreadId () returned 0x970 [0047.070] GetCurrentThreadId () returned 0x970 [0047.070] GetCurrentThreadId () returned 0x970 [0047.070] GetCurrentThreadId () returned 0x970 [0047.070] GetCurrentThreadId () returned 0x970 [0047.070] GetCurrentThreadId () returned 0x970 [0047.070] GetCurrentThreadId () returned 0x970 [0047.070] GetCurrentThreadId () returned 0x970 [0047.070] GetCurrentThreadId () returned 0x970 [0047.070] GetCurrentThreadId () returned 0x970 [0047.070] GetCurrentThreadId () returned 0x970 [0047.070] GetCurrentThreadId () returned 0x970 [0047.070] GetCurrentThreadId () returned 0x970 [0047.070] GetCurrentThreadId () returned 0x970 [0047.070] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAADcnidSGGQ1rIWXFWPhTsjDqpfATOUkASWiBDNVvg4hiXASQLEf8c91SV0+1XSk8gi76WdNbvficRYz79cvBHRjQk6ebxRPYEo6kK6/2tcLhsxAS9DLPpqAGzkM6SOcWoSpECMGiF35XUHSOIW+mXJy5H1Iop4vZt3YCMWMH+QbpmUtlKIiUXqNeXjp9WBNZz3EM1w6+lRNmHh9FU7z4bwYY2QB4xZTxgA==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0047.071] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAADcnidSGGQ1rIWXFWPhTsjDqpfATOUkASWiBDNVvg4hiXASQLEf8c91SV0+1XSk8gi76WdNbvficRYz79cvBHRjQk6ebxRPYEo6kK6/2tcLhsxAS9DLPpqAGzkM6SOcWoSpECMGiF35XUHSOIW+mXJy5H1Iop4vZt3YCMWMH+QbpmUtlKIiUXqNeXjp9WBNZz3EM1w6+lRNmHh9FU7z4bwYY2QB4xZTxgA==", cchWideChar=245, lpMultiByteStr=0x3538cdc, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAADcnidSGGQ1rIWXFWPhTsjDqpfATOUkASWiBDNVvg4hiXASQLEf8c91SV0+1XSk8gi76WdNbvficRYz79cvBHRjQk6ebxRPYEo6kK6/2tcLhsxAS9DLPpqAGzkM6SOcWoSpECMGiF35XUHSOIW+mXJy5H1Iop4vZt3YCMWMH+QbpmUtlKIiUXqNeXjp9WBNZz3EM1w6+lRNmHh9FU7z4bwYY2QB4xZTxgA==", lpUsedDefaultChar=0x0) returned 245 [0047.071] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0047.071] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0047.071] CloseHandle (hObject=0x158) returned 1 [0047.071] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml")) returned 1 [0047.072] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=16733554021) returned 1 [0047.072] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Файл зашифрован [Proof.xml].wannacash .zip" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\Файл зашифрован [proof.xml].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0047.081] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0047.081] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0047.081] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0047.081] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0047.081] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0047.081] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0047.081] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0047.081] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0047.081] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0047.081] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0047.081] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0047.081] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0047.081] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0047.081] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0047.081] SetEndOfFile (hFile=0x158) returned 1 [0047.082] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0047.082] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0047.082] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0047.082] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0047.082] WriteFile (in: hFile=0x158, lpBuffer=0x361f5a8*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x361f5a8*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0047.083] WriteFile (in: hFile=0x158, lpBuffer=0x35f011c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f011c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0047.083] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="+{IpWYwQ1KoTQoy+,k", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0047.157] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="4VsHbiM5UGLY\"$#M9\\i#HU0Bv$fI>+,k", cchWideChar=32, lpMultiByteStr=0x203235c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4VsHbiM5UGLY\"$#M9\\i#HU0Bv$fI>+,k", lpUsedDefaultChar=0x0) returned 32 [0047.157] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0047.157] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0047.157] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x32b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.xml", cAlternateFileName="")) returned 0x295098 [0047.157] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0047.157] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0047.157] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml")) returned 0x2020 [0047.158] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml")) returned 0x2020 [0047.158] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml")) returned 0x2020 [0047.158] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml")) returned 0x2020 [0047.158] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x32b)) returned 1 [0047.158] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0047.158] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0047.158] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml")) returned 0x2020 [0047.158] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml")) returned 0x2020 [0047.158] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0047.158] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0047.158] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0047.158] SetEndOfFile (hFile=0x158) returned 1 [0047.159] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Proofing.xml", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0047.159] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Proofing.xml", cchWideChar=12, lpMultiByteStr=0x1fe35ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Proofing.xml", lpUsedDefaultChar=0x0) returned 12 [0047.159] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Proofing.xml", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0047.159] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Proofing.xml", cchWideChar=12, lpMultiByteStr=0x1fe39ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Proofing.xml", lpUsedDefaultChar=0x0) returned 12 [0047.159] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe39ac, cbMultiByte=12, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="Proofing.xmlmlmll@\x01") returned 12 [0047.159] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Proofing.xml", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0047.159] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Proofing.xml", cchWideChar=12, lpMultiByteStr=0x1fe35ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Proofing.xml", lpUsedDefaultChar=0x0) returned 12 [0047.159] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0047.159] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0047.160] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x32b [0047.160] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0047.160] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0047.160] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0047.160] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Proofing.xml", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0047.160] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Proofing.xml", cchWideChar=12, lpMultiByteStr=0x1fe35ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Proofing.xml", lpUsedDefaultChar=0x0) returned 12 [0047.160] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Proofing.xml", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0047.160] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Proofing.xml", cchWideChar=12, lpMultiByteStr=0x1fe39ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Proofing.xml", lpUsedDefaultChar=0x0) returned 12 [0047.160] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe39ac, cbMultiByte=12, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="Proofing.xmlng.xmlmlmll@\x01") returned 12 [0047.160] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Proofing.xml", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0047.160] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Proofing.xml", cchWideChar=12, lpMultiByteStr=0x1fe35ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Proofing.xml", lpUsedDefaultChar=0x0) returned 12 [0047.160] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0047.161] CharToOemA (in: pSrc="Proofing.xml", pDst=0x1fe39ac | out: pDst="Proofing.xml") returned 1 [0047.161] WriteFile (in: hFile=0x158, lpBuffer=0x1fe39ac*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe39ac*, lpNumberOfBytesWritten=0x18e048*=0xc, lpOverlapped=0x0) returned 1 [0047.161] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0047.161] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0047.161] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0047.161] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=16742460950) returned 1 [0047.161] ReadFile (in: hFile=0x15c, lpBuffer=0x3500240, nNumberOfBytesToRead=0x32b, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3500240*, lpNumberOfBytesRead=0x18dd7c*=0x32b, lpOverlapped=0x0) returned 1 [0047.163] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0047.163] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=16742602181) returned 1 [0047.171] WriteFile (in: hFile=0x158, lpBuffer=0x1fea120*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fea120*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0047.171] ReadFile (in: hFile=0x15c, lpBuffer=0x3500240, nNumberOfBytesToRead=0x32b, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3500240*, lpNumberOfBytesRead=0x18de38*=0x32b, lpOverlapped=0x0) returned 1 [0047.171] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x47 [0047.171] WriteFile (in: hFile=0x158, lpBuffer=0x35005b0*, nNumberOfBytesToWrite=0x32b, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x35005b0*, lpNumberOfBytesWritten=0x18de10*=0x32b, lpOverlapped=0x0) returned 1 [0047.171] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x372 [0047.171] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0047.171] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0047.171] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0047.171] SetFilePointer (in: hFile=0x158, lDistanceToMove=12, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2a [0047.171] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x37c [0047.171] CloseHandle (hObject=0x15c) returned 1 [0047.172] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x37c [0047.172] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x37c [0047.172] SetFilePointer (in: hFile=0x158, lDistanceToMove=892, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x37c [0047.172] SetFilePointer (in: hFile=0x158, lDistanceToMove=892, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x37c [0047.172] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x37c [0047.172] SetFilePointer (in: hFile=0x158, lDistanceToMove=892, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x37c [0047.172] SetEndOfFile (hFile=0x158) returned 1 [0047.172] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x37c [0047.172] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x37c [0047.172] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Proofing.xml", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0047.172] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Proofing.xml", cchWideChar=12, lpMultiByteStr=0x1fe35ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Proofing.xml", lpUsedDefaultChar=0x0) returned 12 [0047.172] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Proofing.xml", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0047.173] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Proofing.xml", cchWideChar=12, lpMultiByteStr=0x1fe354c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Proofing.xml", lpUsedDefaultChar=0x0) returned 12 [0047.173] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe354c, cbMultiByte=12, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="Proofing.xmlꞗ@涤(\x18믉`믑`") returned 12 [0047.173] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Proofing.xml", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0047.173] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Proofing.xml", cchWideChar=12, lpMultiByteStr=0x1fe35ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Proofing.xml", lpUsedDefaultChar=0x0) returned 12 [0047.173] WriteFile (in: hFile=0x158, lpBuffer=0x34e3cf8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x34e3cf8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0047.173] CharToOemA (in: pSrc="Proofing.xml", pDst=0x1fe354c | out: pDst="Proofing.xml") returned 1 [0047.173] WriteFile (in: hFile=0x158, lpBuffer=0x1fe354c*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe354c*, lpNumberOfBytesWritten=0x18efcc*=0xc, lpOverlapped=0x0) returned 1 [0047.173] WriteFile (in: hFile=0x158, lpBuffer=0x1fea260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea260*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0047.173] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0047.173] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0047.173] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x3c1 [0047.173] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x3c1 [0047.173] WriteFile (in: hFile=0x158, lpBuffer=0x361f5a8*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x361f5a8*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0047.173] WriteFile (in: hFile=0x158, lpBuffer=0x35eff9c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35eff9c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0047.174] DeleteFileW (lpFileName="") returned 0 [0047.174] GetLastError () returned 0x3 [0047.174] GetFileAttributesW (lpFileName="") returned 0xffffffff [0047.174] SetLastError (dwErrCode=0x3) [0047.174] FlushFileBuffers (hFile=0x158) returned 1 [0047.176] GetCurrentThreadId () returned 0x970 [0047.176] GetCurrentThreadId () returned 0x970 [0047.176] GetCurrentThreadId () returned 0x970 [0047.176] GetCurrentThreadId () returned 0x970 [0047.176] GetCurrentThreadId () returned 0x970 [0047.176] GetCurrentThreadId () returned 0x970 [0047.176] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x478 [0047.176] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x478 [0047.176] SetFilePointer (in: hFile=0x158, lDistanceToMove=1144, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x478 [0047.176] CloseHandle (hObject=0x158) returned 1 [0047.177] GetCurrentThreadId () returned 0x970 [0047.177] GetCurrentThreadId () returned 0x970 [0047.177] GetCurrentThreadId () returned 0x970 [0047.177] GetCurrentThreadId () returned 0x970 [0047.177] GetCurrentThreadId () returned 0x970 [0047.177] GetCurrentThreadId () returned 0x970 [0047.177] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Файл зашифрован [Proofing.xml].wannacash .zip" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\Файл зашифрован [proofing.xml].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0047.177] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x478 [0047.177] SetFilePointer (in: hFile=0x158, lDistanceToMove=1016, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3f8 [0047.177] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0047.177] GetFileType (hFile=0x158) returned 0x1 [0047.177] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x36, wMilliseconds=0x1e3)) [0047.177] GetCurrentThreadId () returned 0x970 [0047.177] GetCurrentThreadId () returned 0x970 [0047.177] GetCurrentThreadId () returned 0x970 [0047.177] GetCurrentThreadId () returned 0x970 [0047.177] GetCurrentThreadId () returned 0x970 [0047.177] GetCurrentThreadId () returned 0x970 [0047.177] GetCurrentThreadId () returned 0x970 [0047.177] GetCurrentThreadId () returned 0x970 [0047.177] GetCurrentThreadId () returned 0x970 [0047.177] GetCurrentThreadId () returned 0x970 [0047.177] GetCurrentThreadId () returned 0x970 [0047.177] GetCurrentThreadId () returned 0x970 [0047.177] GetCurrentThreadId () returned 0x970 [0047.177] GetCurrentThreadId () returned 0x970 [0047.178] GetCurrentThreadId () returned 0x970 [0047.178] GetCurrentThreadId () returned 0x970 [0047.178] GetCurrentThreadId () returned 0x970 [0047.178] GetCurrentThreadId () returned 0x970 [0047.178] GetCurrentThreadId () returned 0x970 [0047.178] GetCurrentThreadId () returned 0x970 [0047.178] GetCurrentThreadId () returned 0x970 [0047.178] GetCurrentThreadId () returned 0x970 [0047.178] GetCurrentThreadId () returned 0x970 [0047.178] GetCurrentThreadId () returned 0x970 [0047.178] GetCurrentThreadId () returned 0x970 [0047.178] GetCurrentThreadId () returned 0x970 [0047.178] GetCurrentThreadId () returned 0x970 [0047.178] GetCurrentThreadId () returned 0x970 [0047.178] GetCurrentThreadId () returned 0x970 [0047.178] GetCurrentThreadId () returned 0x970 [0047.178] GetCurrentThreadId () returned 0x970 [0047.178] GetCurrentThreadId () returned 0x970 [0047.178] GetCurrentThreadId () returned 0x970 [0047.178] GetCurrentThreadId () returned 0x970 [0047.178] GetCurrentThreadId () returned 0x970 [0047.178] GetCurrentThreadId () returned 0x970 [0047.178] GetCurrentThreadId () returned 0x970 [0047.178] GetCurrentThreadId () returned 0x970 [0047.178] GetCurrentThreadId () returned 0x970 [0047.178] GetCurrentThreadId () returned 0x970 [0047.178] GetCurrentThreadId () returned 0x970 [0047.178] GetCurrentThreadId () returned 0x970 [0047.178] GetCurrentThreadId () returned 0x970 [0047.178] GetCurrentThreadId () returned 0x970 [0047.178] GetCurrentThreadId () returned 0x970 [0047.178] GetCurrentThreadId () returned 0x970 [0047.178] GetCurrentThreadId () returned 0x970 [0047.178] GetCurrentThreadId () returned 0x970 [0047.178] GetCurrentThreadId () returned 0x970 [0047.178] GetCurrentThreadId () returned 0x970 [0047.178] GetCurrentThreadId () returned 0x970 [0047.178] GetCurrentThreadId () returned 0x970 [0047.178] GetCurrentThreadId () returned 0x970 [0047.178] GetCurrentThreadId () returned 0x970 [0047.178] GetCurrentThreadId () returned 0x970 [0047.178] GetCurrentThreadId () returned 0x970 [0047.178] GetCurrentThreadId () returned 0x970 [0047.178] GetCurrentThreadId () returned 0x970 [0047.178] GetCurrentThreadId () returned 0x970 [0047.178] GetCurrentThreadId () returned 0x970 [0047.178] GetCurrentThreadId () returned 0x970 [0047.178] GetCurrentThreadId () returned 0x970 [0047.179] GetCurrentThreadId () returned 0x970 [0047.179] GetCurrentThreadId () returned 0x970 [0047.179] GetCurrentThreadId () returned 0x970 [0047.179] GetCurrentThreadId () returned 0x970 [0047.179] GetCurrentThreadId () returned 0x970 [0047.179] GetCurrentThreadId () returned 0x970 [0047.179] GetCurrentThreadId () returned 0x970 [0047.179] GetCurrentThreadId () returned 0x970 [0047.179] GetCurrentThreadId () returned 0x970 [0047.179] GetCurrentThreadId () returned 0x970 [0047.179] GetCurrentThreadId () returned 0x970 [0047.179] GetCurrentThreadId () returned 0x970 [0047.179] GetCurrentThreadId () returned 0x970 [0047.179] GetCurrentThreadId () returned 0x970 [0047.179] GetCurrentThreadId () returned 0x970 [0047.179] GetCurrentThreadId () returned 0x970 [0047.179] GetCurrentThreadId () returned 0x970 [0047.179] GetCurrentThreadId () returned 0x970 [0047.179] GetCurrentThreadId () returned 0x970 [0047.179] GetCurrentThreadId () returned 0x970 [0047.179] GetCurrentThreadId () returned 0x970 [0047.179] GetCurrentThreadId () returned 0x970 [0047.179] GetCurrentThreadId () returned 0x970 [0047.179] GetCurrentThreadId () returned 0x970 [0047.179] GetCurrentThreadId () returned 0x970 [0047.179] GetCurrentThreadId () returned 0x970 [0047.179] GetCurrentThreadId () returned 0x970 [0047.179] GetCurrentThreadId () returned 0x970 [0047.179] GetCurrentThreadId () returned 0x970 [0047.179] GetCurrentThreadId () returned 0x970 [0047.179] GetCurrentThreadId () returned 0x970 [0047.179] GetCurrentThreadId () returned 0x970 [0047.179] GetCurrentThreadId () returned 0x970 [0047.179] GetCurrentThreadId () returned 0x970 [0047.179] GetCurrentThreadId () returned 0x970 [0047.179] GetCurrentThreadId () returned 0x970 [0047.179] GetCurrentThreadId () returned 0x970 [0047.179] GetCurrentThreadId () returned 0x970 [0047.179] GetCurrentThreadId () returned 0x970 [0047.179] GetCurrentThreadId () returned 0x970 [0047.179] GetCurrentThreadId () returned 0x970 [0047.179] GetCurrentThreadId () returned 0x970 [0047.179] GetCurrentThreadId () returned 0x970 [0047.179] GetCurrentThreadId () returned 0x970 [0047.179] GetCurrentThreadId () returned 0x970 [0047.179] GetCurrentThreadId () returned 0x970 [0047.179] GetCurrentThreadId () returned 0x970 [0047.179] GetCurrentThreadId () returned 0x970 [0047.179] GetCurrentThreadId () returned 0x970 [0047.179] GetCurrentThreadId () returned 0x970 [0047.179] GetCurrentThreadId () returned 0x970 [0047.179] GetCurrentThreadId () returned 0x970 [0047.180] GetCurrentThreadId () returned 0x970 [0047.180] GetCurrentThreadId () returned 0x970 [0047.180] GetCurrentThreadId () returned 0x970 [0047.180] GetCurrentThreadId () returned 0x970 [0047.180] GetCurrentThreadId () returned 0x970 [0047.180] GetCurrentThreadId () returned 0x970 [0047.180] GetCurrentThreadId () returned 0x970 [0047.180] GetCurrentThreadId () returned 0x970 [0047.180] GetCurrentThreadId () returned 0x970 [0047.180] GetCurrentThreadId () returned 0x970 [0047.180] GetCurrentThreadId () returned 0x970 [0047.180] GetCurrentThreadId () returned 0x970 [0047.180] GetCurrentThreadId () returned 0x970 [0047.180] GetCurrentThreadId () returned 0x970 [0047.180] GetCurrentThreadId () returned 0x970 [0047.180] GetCurrentThreadId () returned 0x970 [0047.180] GetCurrentThreadId () returned 0x970 [0047.180] GetCurrentThreadId () returned 0x970 [0047.180] GetCurrentThreadId () returned 0x970 [0047.180] GetCurrentThreadId () returned 0x970 [0047.180] GetCurrentThreadId () returned 0x970 [0047.180] GetCurrentThreadId () returned 0x970 [0047.180] GetCurrentThreadId () returned 0x970 [0047.180] GetCurrentThreadId () returned 0x970 [0047.180] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0047.180] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0047.180] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea950, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0047.180] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0047.180] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0047.180] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea950, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0047.180] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0047.180] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0047.180] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0047.180] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0047.180] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0047.180] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0047.180] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0047.180] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0047.180] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea9b0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0047.180] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0047.180] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0047.180] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea9b0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0047.180] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0047.181] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0047.181] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea9b0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0047.181] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x36, wMilliseconds=0x1e3)) [0047.181] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="4VsHbiM5UGLY\"$#M9\\i#HU0Bv$fI>+,k", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0047.181] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="4VsHbiM5UGLY\"$#M9\\i#HU0Bv$fI>+,k", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0047.181] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="4VsHbiM5UGLY\"$#M9\\i#HU0Bv$fI>+,k", cchWideChar=32, lpMultiByteStr=0x20002f8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4VsHbiM5UGLY\"$#M9\\i#HU0Bv$fI>+,k", lpUsedDefaultChar=0x0) returned 32 [0047.181] GetCurrentThreadId () returned 0x970 [0047.181] GetCurrentThreadId () returned 0x970 [0047.181] GetCurrentThreadId () returned 0x970 [0047.181] GetCurrentThreadId () returned 0x970 [0047.181] GetCurrentThreadId () returned 0x970 [0047.181] GetCurrentThreadId () returned 0x970 [0047.188] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0047.188] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0047.188] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x202be48, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0047.188] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x35903f8, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0047.188] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x35903f8, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAHtvkFAJzhyePLDrQj0LJfKX5UkZrs7+YBggAv4GpQ2HDepktvhYkrpt/2QHY/fc9ViUJJpWuFTv49lhtYcAhsZzjW4pd7wKTx5Awc0NLO42PIjPr20UAHCrsPRQwS3S62slX9g8N3BgbSyMwxsnRw34V+XkEpvc9xxEar/JXVSdxqtQaoA1Wg/gIdIFJgm4qViLIj2AkeXULg9tGupAfmp3PYsc9HAebg==") returned 232 [0047.188] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x36, wMilliseconds=0x1e3)) [0047.188] GetCurrentThreadId () returned 0x970 [0047.188] GetCurrentThreadId () returned 0x970 [0047.188] GetCurrentThreadId () returned 0x970 [0047.188] GetCurrentThreadId () returned 0x970 [0047.188] GetCurrentThreadId () returned 0x970 [0047.188] GetCurrentThreadId () returned 0x970 [0047.188] GetCurrentThreadId () returned 0x970 [0047.188] GetCurrentThreadId () returned 0x970 [0047.188] GetCurrentThreadId () returned 0x970 [0047.188] GetCurrentThreadId () returned 0x970 [0047.188] GetCurrentThreadId () returned 0x970 [0047.188] GetCurrentThreadId () returned 0x970 [0047.188] GetCurrentThreadId () returned 0x970 [0047.188] GetCurrentThreadId () returned 0x970 [0047.188] GetCurrentThreadId () returned 0x970 [0047.188] GetCurrentThreadId () returned 0x970 [0047.188] GetCurrentThreadId () returned 0x970 [0047.188] GetCurrentThreadId () returned 0x970 [0047.188] GetCurrentThreadId () returned 0x970 [0047.188] GetCurrentThreadId () returned 0x970 [0047.188] GetCurrentThreadId () returned 0x970 [0047.188] GetCurrentThreadId () returned 0x970 [0047.188] GetCurrentThreadId () returned 0x970 [0047.188] GetCurrentThreadId () returned 0x970 [0047.188] GetCurrentThreadId () returned 0x970 [0047.188] GetCurrentThreadId () returned 0x970 [0047.188] GetCurrentThreadId () returned 0x970 [0047.189] GetCurrentThreadId () returned 0x970 [0047.189] GetCurrentThreadId () returned 0x970 [0047.189] GetCurrentThreadId () returned 0x970 [0047.189] GetCurrentThreadId () returned 0x970 [0047.189] GetCurrentThreadId () returned 0x970 [0047.189] GetCurrentThreadId () returned 0x970 [0047.189] GetCurrentThreadId () returned 0x970 [0047.189] GetCurrentThreadId () returned 0x970 [0047.189] GetCurrentThreadId () returned 0x970 [0047.189] GetCurrentThreadId () returned 0x970 [0047.189] GetCurrentThreadId () returned 0x970 [0047.189] GetCurrentThreadId () returned 0x970 [0047.189] GetCurrentThreadId () returned 0x970 [0047.189] GetCurrentThreadId () returned 0x970 [0047.189] GetCurrentThreadId () returned 0x970 [0047.189] GetCurrentThreadId () returned 0x970 [0047.189] GetCurrentThreadId () returned 0x970 [0047.189] GetCurrentThreadId () returned 0x970 [0047.189] GetCurrentThreadId () returned 0x970 [0047.189] GetCurrentThreadId () returned 0x970 [0047.189] GetCurrentThreadId () returned 0x970 [0047.189] GetCurrentThreadId () returned 0x970 [0047.189] GetCurrentThreadId () returned 0x970 [0047.189] GetCurrentThreadId () returned 0x970 [0047.189] GetCurrentThreadId () returned 0x970 [0047.189] GetCurrentThreadId () returned 0x970 [0047.189] GetCurrentThreadId () returned 0x970 [0047.189] GetCurrentThreadId () returned 0x970 [0047.189] GetCurrentThreadId () returned 0x970 [0047.189] GetCurrentThreadId () returned 0x970 [0047.189] GetCurrentThreadId () returned 0x970 [0047.189] GetCurrentThreadId () returned 0x970 [0047.189] GetCurrentThreadId () returned 0x970 [0047.189] GetCurrentThreadId () returned 0x970 [0047.189] GetCurrentThreadId () returned 0x970 [0047.189] GetCurrentThreadId () returned 0x970 [0047.189] GetCurrentThreadId () returned 0x970 [0047.189] GetCurrentThreadId () returned 0x970 [0047.189] GetCurrentThreadId () returned 0x970 [0047.189] GetCurrentThreadId () returned 0x970 [0047.189] GetCurrentThreadId () returned 0x970 [0047.189] GetCurrentThreadId () returned 0x970 [0047.189] GetCurrentThreadId () returned 0x970 [0047.189] GetCurrentThreadId () returned 0x970 [0047.189] GetCurrentThreadId () returned 0x970 [0047.189] GetCurrentThreadId () returned 0x970 [0047.189] GetCurrentThreadId () returned 0x970 [0047.189] GetCurrentThreadId () returned 0x970 [0047.190] GetCurrentThreadId () returned 0x970 [0047.190] GetCurrentThreadId () returned 0x970 [0047.190] GetCurrentThreadId () returned 0x970 [0047.190] GetCurrentThreadId () returned 0x970 [0047.190] GetCurrentThreadId () returned 0x970 [0047.190] GetCurrentThreadId () returned 0x970 [0047.190] GetCurrentThreadId () returned 0x970 [0047.190] GetCurrentThreadId () returned 0x970 [0047.190] GetCurrentThreadId () returned 0x970 [0047.190] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAHtvkFAJzhyePLDrQj0LJfKX5UkZrs7+YBggAv4GpQ2HDepktvhYkrpt/2QHY/fc9ViUJJpWuFTv49lhtYcAhsZzjW4pd7wKTx5Awc0NLO42PIjPr20UAHCrsPRQwS3S62slX9g8N3BgbSyMwxsnRw34V+XkEpvc9xxEar/JXVSdxqtQaoA1Wg/gIdIFJgm4qViLIj2AkeXULg9tGupAfmp3PYsc9HAebg==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0047.190] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAHtvkFAJzhyePLDrQj0LJfKX5UkZrs7+YBggAv4GpQ2HDepktvhYkrpt/2QHY/fc9ViUJJpWuFTv49lhtYcAhsZzjW4pd7wKTx5Awc0NLO42PIjPr20UAHCrsPRQwS3S62slX9g8N3BgbSyMwxsnRw34V+XkEpvc9xxEar/JXVSdxqtQaoA1Wg/gIdIFJgm4qViLIj2AkeXULg9tGupAfmp3PYsc9HAebg==", cchWideChar=245, lpMultiByteStr=0x3538cdc, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAHtvkFAJzhyePLDrQj0LJfKX5UkZrs7+YBggAv4GpQ2HDepktvhYkrpt/2QHY/fc9ViUJJpWuFTv49lhtYcAhsZzjW4pd7wKTx5Awc0NLO42PIjPr20UAHCrsPRQwS3S62slX9g8N3BgbSyMwxsnRw34V+XkEpvc9xxEar/JXVSdxqtQaoA1Wg/gIdIFJgm4qViLIj2AkeXULg9tGupAfmp3PYsc9HAebg==", lpUsedDefaultChar=0x0) returned 245 [0047.190] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0047.190] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0047.190] CloseHandle (hObject=0x158) returned 1 [0047.198] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml")) returned 1 [0047.199] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=16746243281) returned 1 [0047.199] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Файл зашифрован [Setup.xml].wannacash .zip" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\Файл зашифрован [setup.xml].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0047.199] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0047.200] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0047.200] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0047.200] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0047.200] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0047.200] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0047.200] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0047.200] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0047.200] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0047.200] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0047.200] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0047.200] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0047.200] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0047.200] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0047.200] SetEndOfFile (hFile=0x158) returned 1 [0047.200] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0047.200] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0047.200] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0047.200] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0047.200] WriteFile (in: hFile=0x158, lpBuffer=0x361f5a8*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x361f5a8*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0047.201] WriteFile (in: hFile=0x158, lpBuffer=0x35f011c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f011c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0047.202] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-V.mLztYZLs.{J%jyng*P^#Dp61#HVX:", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0047.202] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-V.mLztYZLs.{J%jyng*P^#Dp61#HVX:", cchWideChar=32, lpMultiByteStr=0x2032394, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-V.mLztYZLs.{J%jyng*P^#Dp61#HVX:", lpUsedDefaultChar=0x0) returned 32 [0047.202] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0047.202] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0047.202] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0x295098 [0047.202] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0047.202] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0047.202] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0047.202] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0047.202] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0047.202] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0047.202] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc)) returned 1 [0047.202] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0047.202] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0047.202] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0047.202] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0047.202] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0047.203] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0047.203] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0047.203] SetEndOfFile (hFile=0x158) returned 1 [0047.204] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.204] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x1fe358c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0047.204] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.204] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x1fe388c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0047.204] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe388c, cbMultiByte=9, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="Setup.xmlxmlmlmll@\x01") returned 9 [0047.204] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.204] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x1fe358c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0047.204] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0047.204] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0047.204] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x16fc [0047.204] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0047.204] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0047.204] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0047.204] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.204] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x1fe358c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0047.204] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.204] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x1fe388c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0047.205] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe388c, cbMultiByte=9, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="Setup.xmlup.xmlxmlmlmll@\x01") returned 9 [0047.205] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.205] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x1fe358c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0047.205] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0047.205] CharToOemA (in: pSrc="Setup.xml", pDst=0x1fe388c | out: pDst="Setup.xml") returned 1 [0047.205] WriteFile (in: hFile=0x158, lpBuffer=0x1fe388c*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe388c*, lpNumberOfBytesWritten=0x18e048*=0x9, lpOverlapped=0x0) returned 1 [0047.206] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0047.206] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0047.206] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0047.206] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=16746924773) returned 1 [0047.206] ReadFile (in: hFile=0x15c, lpBuffer=0x34e0010, nNumberOfBytesToRead=0x16fc, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x34e0010*, lpNumberOfBytesRead=0x18dd7c*=0x16fc, lpOverlapped=0x0) returned 1 [0047.207] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0047.207] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=16747066785) returned 1 [0047.215] WriteFile (in: hFile=0x158, lpBuffer=0x1fea180*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fea180*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0047.215] ReadFile (in: hFile=0x15c, lpBuffer=0x34e0010, nNumberOfBytesToRead=0x16fc, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x34e0010*, lpNumberOfBytesRead=0x18de38*=0x16fc, lpOverlapped=0x0) returned 1 [0047.215] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x44 [0047.216] WriteFile (in: hFile=0x158, lpBuffer=0x3501950*, nNumberOfBytesToWrite=0x16fc, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3501950*, lpNumberOfBytesWritten=0x18de10*=0x16fc, lpOverlapped=0x0) returned 1 [0047.216] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x1740 [0047.216] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0047.216] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0047.216] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0047.216] SetFilePointer (in: hFile=0x158, lDistanceToMove=9, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x27 [0047.216] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x174a [0047.216] CloseHandle (hObject=0x15c) returned 1 [0047.216] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x174a [0047.216] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x174a [0047.216] SetFilePointer (in: hFile=0x158, lDistanceToMove=5962, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x174a [0047.216] SetFilePointer (in: hFile=0x158, lDistanceToMove=5962, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x174a [0047.216] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x174a [0047.217] SetFilePointer (in: hFile=0x158, lDistanceToMove=5962, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x174a [0047.217] SetEndOfFile (hFile=0x158) returned 1 [0047.217] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x174a [0047.217] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x174a [0047.217] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.217] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x1fe358c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0047.217] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.217] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x1fe3a0c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0047.217] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe3a0c, cbMultiByte=9, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="Setup.xml") returned 9 [0047.217] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.217] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x1fe358c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0047.217] WriteFile (in: hFile=0x158, lpBuffer=0x34e3cf8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x34e3cf8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0047.217] CharToOemA (in: pSrc="Setup.xml", pDst=0x1fe3a0c | out: pDst="Setup.xml") returned 1 [0047.217] WriteFile (in: hFile=0x158, lpBuffer=0x1fe3a0c*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe3a0c*, lpNumberOfBytesWritten=0x18efcc*=0x9, lpOverlapped=0x0) returned 1 [0047.217] WriteFile (in: hFile=0x158, lpBuffer=0x1fea1e8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea1e8*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0047.217] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0047.217] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0047.218] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x178c [0047.218] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x178c [0047.218] WriteFile (in: hFile=0x158, lpBuffer=0x361f5a8*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x361f5a8*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0047.218] WriteFile (in: hFile=0x158, lpBuffer=0x35f011c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f011c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0047.218] DeleteFileW (lpFileName="") returned 0 [0047.218] GetLastError () returned 0x3 [0047.218] GetFileAttributesW (lpFileName="") returned 0xffffffff [0047.218] SetLastError (dwErrCode=0x3) [0047.218] FlushFileBuffers (hFile=0x158) returned 1 [0047.221] GetCurrentThreadId () returned 0x970 [0047.221] GetCurrentThreadId () returned 0x970 [0047.221] GetCurrentThreadId () returned 0x970 [0047.221] GetCurrentThreadId () returned 0x970 [0047.221] GetCurrentThreadId () returned 0x970 [0047.221] GetCurrentThreadId () returned 0x970 [0047.221] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x1843 [0047.221] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x1843 [0047.221] SetFilePointer (in: hFile=0x158, lDistanceToMove=6211, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x1843 [0047.221] CloseHandle (hObject=0x158) returned 1 [0047.222] GetCurrentThreadId () returned 0x970 [0047.222] GetCurrentThreadId () returned 0x970 [0047.222] GetCurrentThreadId () returned 0x970 [0047.222] GetCurrentThreadId () returned 0x970 [0047.222] GetCurrentThreadId () returned 0x970 [0047.222] GetCurrentThreadId () returned 0x970 [0047.222] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Файл зашифрован [Setup.xml].wannacash .zip" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\Файл зашифрован [setup.xml].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0047.222] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1843 [0047.222] SetFilePointer (in: hFile=0x158, lDistanceToMove=6083, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x17c3 [0047.222] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0047.222] GetFileType (hFile=0x158) returned 0x1 [0047.222] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x36, wMilliseconds=0x212)) [0047.222] GetCurrentThreadId () returned 0x970 [0047.222] GetCurrentThreadId () returned 0x970 [0047.222] GetCurrentThreadId () returned 0x970 [0047.222] GetCurrentThreadId () returned 0x970 [0047.222] GetCurrentThreadId () returned 0x970 [0047.222] GetCurrentThreadId () returned 0x970 [0047.222] GetCurrentThreadId () returned 0x970 [0047.222] GetCurrentThreadId () returned 0x970 [0047.222] GetCurrentThreadId () returned 0x970 [0047.222] GetCurrentThreadId () returned 0x970 [0047.223] GetCurrentThreadId () returned 0x970 [0047.223] GetCurrentThreadId () returned 0x970 [0047.223] GetCurrentThreadId () returned 0x970 [0047.223] GetCurrentThreadId () returned 0x970 [0047.223] GetCurrentThreadId () returned 0x970 [0047.223] GetCurrentThreadId () returned 0x970 [0047.223] GetCurrentThreadId () returned 0x970 [0047.223] GetCurrentThreadId () returned 0x970 [0047.223] GetCurrentThreadId () returned 0x970 [0047.223] GetCurrentThreadId () returned 0x970 [0047.223] GetCurrentThreadId () returned 0x970 [0047.223] GetCurrentThreadId () returned 0x970 [0047.223] GetCurrentThreadId () returned 0x970 [0047.223] GetCurrentThreadId () returned 0x970 [0047.223] GetCurrentThreadId () returned 0x970 [0047.223] GetCurrentThreadId () returned 0x970 [0047.223] GetCurrentThreadId () returned 0x970 [0047.223] GetCurrentThreadId () returned 0x970 [0047.223] GetCurrentThreadId () returned 0x970 [0047.223] GetCurrentThreadId () returned 0x970 [0047.223] GetCurrentThreadId () returned 0x970 [0047.223] GetCurrentThreadId () returned 0x970 [0047.223] GetCurrentThreadId () returned 0x970 [0047.223] GetCurrentThreadId () returned 0x970 [0047.223] GetCurrentThreadId () returned 0x970 [0047.223] GetCurrentThreadId () returned 0x970 [0047.223] GetCurrentThreadId () returned 0x970 [0047.223] GetCurrentThreadId () returned 0x970 [0047.223] GetCurrentThreadId () returned 0x970 [0047.223] GetCurrentThreadId () returned 0x970 [0047.223] GetCurrentThreadId () returned 0x970 [0047.223] GetCurrentThreadId () returned 0x970 [0047.223] GetCurrentThreadId () returned 0x970 [0047.223] GetCurrentThreadId () returned 0x970 [0047.223] GetCurrentThreadId () returned 0x970 [0047.223] GetCurrentThreadId () returned 0x970 [0047.223] GetCurrentThreadId () returned 0x970 [0047.223] GetCurrentThreadId () returned 0x970 [0047.223] GetCurrentThreadId () returned 0x970 [0047.223] GetCurrentThreadId () returned 0x970 [0047.223] GetCurrentThreadId () returned 0x970 [0047.223] GetCurrentThreadId () returned 0x970 [0047.223] GetCurrentThreadId () returned 0x970 [0047.223] GetCurrentThreadId () returned 0x970 [0047.223] GetCurrentThreadId () returned 0x970 [0047.223] GetCurrentThreadId () returned 0x970 [0047.223] GetCurrentThreadId () returned 0x970 [0047.223] GetCurrentThreadId () returned 0x970 [0047.224] GetCurrentThreadId () returned 0x970 [0047.224] GetCurrentThreadId () returned 0x970 [0047.224] GetCurrentThreadId () returned 0x970 [0047.224] GetCurrentThreadId () returned 0x970 [0047.224] GetCurrentThreadId () returned 0x970 [0047.224] GetCurrentThreadId () returned 0x970 [0047.224] GetCurrentThreadId () returned 0x970 [0047.224] GetCurrentThreadId () returned 0x970 [0047.224] GetCurrentThreadId () returned 0x970 [0047.224] GetCurrentThreadId () returned 0x970 [0047.224] GetCurrentThreadId () returned 0x970 [0047.224] GetCurrentThreadId () returned 0x970 [0047.224] GetCurrentThreadId () returned 0x970 [0047.224] GetCurrentThreadId () returned 0x970 [0047.224] GetCurrentThreadId () returned 0x970 [0047.224] GetCurrentThreadId () returned 0x970 [0047.224] GetCurrentThreadId () returned 0x970 [0047.224] GetCurrentThreadId () returned 0x970 [0047.224] GetCurrentThreadId () returned 0x970 [0047.224] GetCurrentThreadId () returned 0x970 [0047.224] GetCurrentThreadId () returned 0x970 [0047.224] GetCurrentThreadId () returned 0x970 [0047.224] GetCurrentThreadId () returned 0x970 [0047.224] GetCurrentThreadId () returned 0x970 [0047.224] GetCurrentThreadId () returned 0x970 [0047.224] GetCurrentThreadId () returned 0x970 [0047.224] GetCurrentThreadId () returned 0x970 [0047.224] GetCurrentThreadId () returned 0x970 [0047.224] GetCurrentThreadId () returned 0x970 [0047.224] GetCurrentThreadId () returned 0x970 [0047.224] GetCurrentThreadId () returned 0x970 [0047.224] GetCurrentThreadId () returned 0x970 [0047.224] GetCurrentThreadId () returned 0x970 [0047.224] GetCurrentThreadId () returned 0x970 [0047.224] GetCurrentThreadId () returned 0x970 [0047.224] GetCurrentThreadId () returned 0x970 [0047.224] GetCurrentThreadId () returned 0x970 [0047.224] GetCurrentThreadId () returned 0x970 [0047.224] GetCurrentThreadId () returned 0x970 [0047.224] GetCurrentThreadId () returned 0x970 [0047.224] GetCurrentThreadId () returned 0x970 [0047.224] GetCurrentThreadId () returned 0x970 [0047.224] GetCurrentThreadId () returned 0x970 [0047.224] GetCurrentThreadId () returned 0x970 [0047.224] GetCurrentThreadId () returned 0x970 [0047.224] GetCurrentThreadId () returned 0x970 [0047.224] GetCurrentThreadId () returned 0x970 [0047.224] GetCurrentThreadId () returned 0x970 [0047.224] GetCurrentThreadId () returned 0x970 [0047.225] GetCurrentThreadId () returned 0x970 [0047.225] GetCurrentThreadId () returned 0x970 [0047.225] GetCurrentThreadId () returned 0x970 [0047.225] GetCurrentThreadId () returned 0x970 [0047.225] GetCurrentThreadId () returned 0x970 [0047.225] GetCurrentThreadId () returned 0x970 [0047.225] GetCurrentThreadId () returned 0x970 [0047.225] GetCurrentThreadId () returned 0x970 [0047.225] GetCurrentThreadId () returned 0x970 [0047.225] GetCurrentThreadId () returned 0x970 [0047.225] GetCurrentThreadId () returned 0x970 [0047.225] GetCurrentThreadId () returned 0x970 [0047.225] GetCurrentThreadId () returned 0x970 [0047.225] GetCurrentThreadId () returned 0x970 [0047.225] GetCurrentThreadId () returned 0x970 [0047.225] GetCurrentThreadId () returned 0x970 [0047.225] GetCurrentThreadId () returned 0x970 [0047.225] GetCurrentThreadId () returned 0x970 [0047.225] GetCurrentThreadId () returned 0x970 [0047.225] GetCurrentThreadId () returned 0x970 [0047.225] GetCurrentThreadId () returned 0x970 [0047.225] GetCurrentThreadId () returned 0x970 [0047.225] GetCurrentThreadId () returned 0x970 [0047.225] GetCurrentThreadId () returned 0x970 [0047.225] GetCurrentThreadId () returned 0x970 [0047.225] GetCurrentThreadId () returned 0x970 [0047.225] GetCurrentThreadId () returned 0x970 [0047.225] GetCurrentThreadId () returned 0x970 [0047.225] GetCurrentThreadId () returned 0x970 [0047.225] GetCurrentThreadId () returned 0x970 [0047.225] GetCurrentThreadId () returned 0x970 [0047.225] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0047.225] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0047.225] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea9b0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0047.225] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0047.225] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0047.225] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea9b0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0047.225] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0047.225] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0047.225] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0047.225] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0047.225] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0047.225] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0047.226] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0047.226] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0047.226] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feaa10, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0047.226] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0047.226] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0047.226] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feaa10, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0047.226] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0047.226] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0047.226] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feaa10, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0047.226] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x36, wMilliseconds=0x212)) [0047.226] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="-V.mLztYZLs.{J%jyng*P^#Dp61#HVX:", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0047.226] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="-V.mLztYZLs.{J%jyng*P^#Dp61#HVX:", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0047.226] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="-V.mLztYZLs.{J%jyng*P^#Dp61#HVX:", cchWideChar=32, lpMultiByteStr=0x2000268, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-V.mLztYZLs.{J%jyng*P^#Dp61#HVX:", lpUsedDefaultChar=0x0) returned 32 [0047.226] GetCurrentThreadId () returned 0x970 [0047.226] GetCurrentThreadId () returned 0x970 [0047.226] GetCurrentThreadId () returned 0x970 [0047.226] GetCurrentThreadId () returned 0x970 [0047.226] GetCurrentThreadId () returned 0x970 [0047.226] GetCurrentThreadId () returned 0x970 [0047.233] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0047.233] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0047.233] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x202bf38, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0047.233] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x35903f8, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0047.233] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x35903f8, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAGvtyncBl1SEw41avUx+NM5wcw5rMBnCUBaEsDhSOdwYcCd+33DjtF2L9poCNwPMJlqCTwNCCoOaBuYaT8N5uCfPsc2sCIndWSGbX81QbPzNsVTEEqctkrL6HF0UHQBvrFd3tQlu/BCSlJb2Q8HSoAZ4lcCYUrwShhpWbrE2Vwx0E9L0hX6LrincXvOa8s3TvKhnSC5EpMe06kStK/eoG5+nhQRcrfonAQ==") returned 232 [0047.233] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x36, wMilliseconds=0x212)) [0047.233] GetCurrentThreadId () returned 0x970 [0047.233] GetCurrentThreadId () returned 0x970 [0047.233] GetCurrentThreadId () returned 0x970 [0047.233] GetCurrentThreadId () returned 0x970 [0047.233] GetCurrentThreadId () returned 0x970 [0047.233] GetCurrentThreadId () returned 0x970 [0047.233] GetCurrentThreadId () returned 0x970 [0047.233] GetCurrentThreadId () returned 0x970 [0047.233] GetCurrentThreadId () returned 0x970 [0047.233] GetCurrentThreadId () returned 0x970 [0047.233] GetCurrentThreadId () returned 0x970 [0047.233] GetCurrentThreadId () returned 0x970 [0047.234] GetCurrentThreadId () returned 0x970 [0047.234] GetCurrentThreadId () returned 0x970 [0047.234] GetCurrentThreadId () returned 0x970 [0047.234] GetCurrentThreadId () returned 0x970 [0047.234] GetCurrentThreadId () returned 0x970 [0047.234] GetCurrentThreadId () returned 0x970 [0047.234] GetCurrentThreadId () returned 0x970 [0047.234] GetCurrentThreadId () returned 0x970 [0047.234] GetCurrentThreadId () returned 0x970 [0047.234] GetCurrentThreadId () returned 0x970 [0047.234] GetCurrentThreadId () returned 0x970 [0047.234] GetCurrentThreadId () returned 0x970 [0047.234] GetCurrentThreadId () returned 0x970 [0047.234] GetCurrentThreadId () returned 0x970 [0047.234] GetCurrentThreadId () returned 0x970 [0047.234] GetCurrentThreadId () returned 0x970 [0047.234] GetCurrentThreadId () returned 0x970 [0047.234] GetCurrentThreadId () returned 0x970 [0047.234] GetCurrentThreadId () returned 0x970 [0047.234] GetCurrentThreadId () returned 0x970 [0047.234] GetCurrentThreadId () returned 0x970 [0047.234] GetCurrentThreadId () returned 0x970 [0047.234] GetCurrentThreadId () returned 0x970 [0047.234] GetCurrentThreadId () returned 0x970 [0047.234] GetCurrentThreadId () returned 0x970 [0047.234] GetCurrentThreadId () returned 0x970 [0047.234] GetCurrentThreadId () returned 0x970 [0047.234] GetCurrentThreadId () returned 0x970 [0047.234] GetCurrentThreadId () returned 0x970 [0047.234] GetCurrentThreadId () returned 0x970 [0047.234] GetCurrentThreadId () returned 0x970 [0047.234] GetCurrentThreadId () returned 0x970 [0047.234] GetCurrentThreadId () returned 0x970 [0047.234] GetCurrentThreadId () returned 0x970 [0047.234] GetCurrentThreadId () returned 0x970 [0047.234] GetCurrentThreadId () returned 0x970 [0047.234] GetCurrentThreadId () returned 0x970 [0047.234] GetCurrentThreadId () returned 0x970 [0047.234] GetCurrentThreadId () returned 0x970 [0047.234] GetCurrentThreadId () returned 0x970 [0047.234] GetCurrentThreadId () returned 0x970 [0047.234] GetCurrentThreadId () returned 0x970 [0047.234] GetCurrentThreadId () returned 0x970 [0047.234] GetCurrentThreadId () returned 0x970 [0047.234] GetCurrentThreadId () returned 0x970 [0047.234] GetCurrentThreadId () returned 0x970 [0047.234] GetCurrentThreadId () returned 0x970 [0047.235] GetCurrentThreadId () returned 0x970 [0047.235] GetCurrentThreadId () returned 0x970 [0047.235] GetCurrentThreadId () returned 0x970 [0047.235] GetCurrentThreadId () returned 0x970 [0047.235] GetCurrentThreadId () returned 0x970 [0047.235] GetCurrentThreadId () returned 0x970 [0047.235] GetCurrentThreadId () returned 0x970 [0047.235] GetCurrentThreadId () returned 0x970 [0047.235] GetCurrentThreadId () returned 0x970 [0047.235] GetCurrentThreadId () returned 0x970 [0047.235] GetCurrentThreadId () returned 0x970 [0047.235] GetCurrentThreadId () returned 0x970 [0047.235] GetCurrentThreadId () returned 0x970 [0047.235] GetCurrentThreadId () returned 0x970 [0047.235] GetCurrentThreadId () returned 0x970 [0047.235] GetCurrentThreadId () returned 0x970 [0047.235] GetCurrentThreadId () returned 0x970 [0047.235] GetCurrentThreadId () returned 0x970 [0047.235] GetCurrentThreadId () returned 0x970 [0047.235] GetCurrentThreadId () returned 0x970 [0047.235] GetCurrentThreadId () returned 0x970 [0047.235] GetCurrentThreadId () returned 0x970 [0047.235] GetCurrentThreadId () returned 0x970 [0047.235] GetCurrentThreadId () returned 0x970 [0047.235] GetCurrentThreadId () returned 0x970 [0047.235] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAGvtyncBl1SEw41avUx+NM5wcw5rMBnCUBaEsDhSOdwYcCd+33DjtF2L9poCNwPMJlqCTwNCCoOaBuYaT8N5uCfPsc2sCIndWSGbX81QbPzNsVTEEqctkrL6HF0UHQBvrFd3tQlu/BCSlJb2Q8HSoAZ4lcCYUrwShhpWbrE2Vwx0E9L0hX6LrincXvOa8s3TvKhnSC5EpMe06kStK/eoG5+nhQRcrfonAQ==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0047.235] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAGvtyncBl1SEw41avUx+NM5wcw5rMBnCUBaEsDhSOdwYcCd+33DjtF2L9poCNwPMJlqCTwNCCoOaBuYaT8N5uCfPsc2sCIndWSGbX81QbPzNsVTEEqctkrL6HF0UHQBvrFd3tQlu/BCSlJb2Q8HSoAZ4lcCYUrwShhpWbrE2Vwx0E9L0hX6LrincXvOa8s3TvKhnSC5EpMe06kStK/eoG5+nhQRcrfonAQ==", cchWideChar=245, lpMultiByteStr=0x3538cdc, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAGvtyncBl1SEw41avUx+NM5wcw5rMBnCUBaEsDhSOdwYcCd+33DjtF2L9poCNwPMJlqCTwNCCoOaBuYaT8N5uCfPsc2sCIndWSGbX81QbPzNsVTEEqctkrL6HF0UHQBvrFd3tQlu/BCSlJb2Q8HSoAZ4lcCYUrwShhpWbrE2Vwx0E9L0hX6LrincXvOa8s3TvKhnSC5EpMe06kStK/eoG5+nhQRcrfonAQ==", lpUsedDefaultChar=0x0) returned 245 [0047.235] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0047.235] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0047.235] CloseHandle (hObject=0x158) returned 1 [0047.236] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0047.237] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=16750046489) returned 1 [0047.237] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Файл зашифрован [Office32MUI.xml].wannacash .zip" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\Файл зашифрован [office32mui.xml].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0047.238] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0047.238] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0047.238] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0047.238] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0047.238] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0047.238] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0047.238] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0047.238] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0047.239] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0047.239] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0047.239] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0047.239] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0047.239] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0047.239] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0047.239] SetEndOfFile (hFile=0x158) returned 1 [0047.239] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0047.239] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0047.239] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0047.239] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0047.239] WriteFile (in: hFile=0x158, lpBuffer=0x361f5a8*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x361f5a8*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0047.240] WriteFile (in: hFile=0x158, lpBuffer=0x35f005c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f005c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0047.240] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f6e6\"Tdq~grvMR/\\~d#K1:q\\55A(?", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0048.022] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="@NREW7L@M/j&\",gu$t!Hse!/P\\3w>A(?", cchWideChar=32, lpMultiByteStr=0x2031f34, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="@NREW7L@M/j&\",gu$t!Hse!/P\\3w>A(?", lpUsedDefaultChar=0x0) returned 32 [0048.022] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0048.023] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0048.023] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xfc0c60c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x0, cFileName="branding.xml", cAlternateFileName="")) returned 0x295098 [0048.023] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0048.023] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0048.023] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml")) returned 0x2020 [0048.023] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml")) returned 0x2020 [0048.023] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml")) returned 0x2020 [0048.023] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml")) returned 0x2020 [0048.023] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xfc0c60c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975)) returned 1 [0048.023] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0048.023] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0048.023] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml")) returned 0x2020 [0048.023] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml")) returned 0x2020 [0048.023] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0048.023] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0048.023] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0048.023] SetEndOfFile (hFile=0x158) returned 1 [0048.024] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="branding.xml", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0048.024] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="branding.xml", cchWideChar=12, lpMultiByteStr=0x1fe386c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="branding.xml", lpUsedDefaultChar=0x0) returned 12 [0048.024] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="branding.xml", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0048.024] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="branding.xml", cchWideChar=12, lpMultiByteStr=0x1fe392c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="branding.xml", lpUsedDefaultChar=0x0) returned 12 [0048.024] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe392c, cbMultiByte=12, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="branding.xmllxmll@\x01") returned 12 [0048.024] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="branding.xml", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0048.024] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="branding.xml", cchWideChar=12, lpMultiByteStr=0x1fe386c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="branding.xml", lpUsedDefaultChar=0x0) returned 12 [0048.025] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0048.025] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0048.025] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x91975 [0048.025] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0048.025] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0048.025] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0048.025] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="branding.xml", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0048.025] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="branding.xml", cchWideChar=12, lpMultiByteStr=0x1fe386c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="branding.xml", lpUsedDefaultChar=0x0) returned 12 [0048.025] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="branding.xml", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0048.025] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="branding.xml", cchWideChar=12, lpMultiByteStr=0x1fe392c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="branding.xml", lpUsedDefaultChar=0x0) returned 12 [0048.025] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe392c, cbMultiByte=12, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="branding.xmlng.xmllxmll@\x01") returned 12 [0048.025] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="branding.xml", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0048.025] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="branding.xml", cchWideChar=12, lpMultiByteStr=0x1fe386c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="branding.xml", lpUsedDefaultChar=0x0) returned 12 [0048.025] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0048.026] CharToOemA (in: pSrc="branding.xml", pDst=0x1fe392c | out: pDst="branding.xml") returned 1 [0048.026] WriteFile (in: hFile=0x158, lpBuffer=0x1fe392c*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe392c*, lpNumberOfBytesWritten=0x18e048*=0xc, lpOverlapped=0x0) returned 1 [0048.026] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0048.026] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0048.026] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0048.026] VirtualAlloc (lpAddress=0x0, dwSize=0xa0000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ef00000 [0048.027] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=16829016976) returned 1 [0048.027] ReadFile (in: hFile=0x15c, lpBuffer=0x7ef00010, nNumberOfBytesToRead=0x91975, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x7ef00010*, lpNumberOfBytesRead=0x18dd7c*=0x91975, lpOverlapped=0x0) returned 1 [0048.040] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0048.040] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=16830354799) returned 1 [0048.049] WriteFile (in: hFile=0x158, lpBuffer=0x1fea210*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fea210*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0048.049] ReadFile (in: hFile=0x15c, lpBuffer=0x7ef00010, nNumberOfBytesToRead=0x91975, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x7ef00010*, lpNumberOfBytesRead=0x18de38*=0x91975, lpOverlapped=0x0) returned 1 [0048.049] VirtualAlloc (lpAddress=0x0, dwSize=0xa0000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ee60000 [0048.057] VirtualAlloc (lpAddress=0x0, dwSize=0xa0000, flAllocationType=0x101000, flProtect=0x4) returned 0x7edc0000 [0048.080] VirtualFree (lpAddress=0x7edc0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0048.082] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x47 [0048.083] WriteFile (in: hFile=0x158, lpBuffer=0x7ee60010*, nNumberOfBytesToWrite=0x91975, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x7ee60010*, lpNumberOfBytesWritten=0x18de10*=0x91975, lpOverlapped=0x0) returned 1 [0048.091] VirtualFree (lpAddress=0x7ee60000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0048.093] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x919bc [0048.093] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0048.094] VirtualFree (lpAddress=0x7ef00000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0048.096] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0048.096] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0048.096] SetFilePointer (in: hFile=0x158, lDistanceToMove=12, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2a [0048.096] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x919c6 [0048.097] CloseHandle (hObject=0x15c) returned 1 [0048.097] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x919c6 [0048.097] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x919c6 [0048.097] SetFilePointer (in: hFile=0x158, lDistanceToMove=596422, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x919c6 [0048.097] SetFilePointer (in: hFile=0x158, lDistanceToMove=596422, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x919c6 [0048.097] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x919c6 [0048.097] SetFilePointer (in: hFile=0x158, lDistanceToMove=596422, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x919c6 [0048.097] SetEndOfFile (hFile=0x158) returned 1 [0048.097] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x919c6 [0048.097] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x919c6 [0048.097] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="branding.xml", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0048.097] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="branding.xml", cchWideChar=12, lpMultiByteStr=0x1fe386c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="branding.xml", lpUsedDefaultChar=0x0) returned 12 [0048.097] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="branding.xml", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0048.097] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="branding.xml", cchWideChar=12, lpMultiByteStr=0x1fe3a0c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="branding.xml", lpUsedDefaultChar=0x0) returned 12 [0048.097] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe3a0c, cbMultiByte=12, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="branding.xmlꞗ@涤(\x18믉`믑`") returned 12 [0048.097] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="branding.xml", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0048.097] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="branding.xml", cchWideChar=12, lpMultiByteStr=0x1fe386c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="branding.xml", lpUsedDefaultChar=0x0) returned 12 [0048.098] WriteFile (in: hFile=0x158, lpBuffer=0x34e3cf8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x34e3cf8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0048.098] CharToOemA (in: pSrc="branding.xml", pDst=0x1fe3a0c | out: pDst="branding.xml") returned 1 [0048.098] WriteFile (in: hFile=0x158, lpBuffer=0x1fe3a0c*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe3a0c*, lpNumberOfBytesWritten=0x18efcc*=0xc, lpOverlapped=0x0) returned 1 [0048.098] WriteFile (in: hFile=0x158, lpBuffer=0x1fea1e8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea1e8*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0048.098] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0048.098] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0048.098] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x91a0b [0048.098] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x91a0b [0048.098] WriteFile (in: hFile=0x158, lpBuffer=0x361f5a8*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x361f5a8*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0048.098] WriteFile (in: hFile=0x158, lpBuffer=0x35f011c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f011c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0048.098] DeleteFileW (lpFileName="") returned 0 [0048.098] GetLastError () returned 0x3 [0048.098] GetFileAttributesW (lpFileName="") returned 0xffffffff [0048.098] SetLastError (dwErrCode=0x3) [0048.098] FlushFileBuffers (hFile=0x158) returned 1 [0048.113] GetCurrentThreadId () returned 0x970 [0048.113] GetCurrentThreadId () returned 0x970 [0048.113] GetCurrentThreadId () returned 0x970 [0048.113] GetCurrentThreadId () returned 0x970 [0048.113] GetCurrentThreadId () returned 0x970 [0048.113] GetCurrentThreadId () returned 0x970 [0048.113] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x91ac2 [0048.113] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x91ac2 [0048.113] SetFilePointer (in: hFile=0x158, lDistanceToMove=596674, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x91ac2 [0048.113] CloseHandle (hObject=0x158) returned 1 [0048.118] GetCurrentThreadId () returned 0x970 [0048.118] GetCurrentThreadId () returned 0x970 [0048.118] GetCurrentThreadId () returned 0x970 [0048.118] GetCurrentThreadId () returned 0x970 [0048.118] GetCurrentThreadId () returned 0x970 [0048.118] GetCurrentThreadId () returned 0x970 [0048.118] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\Файл зашифрован [branding.xml].wannacash .zip" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\Файл зашифрован [branding.xml].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0048.121] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x91ac2 [0048.121] SetFilePointer (in: hFile=0x158, lDistanceToMove=596546, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x91a42 [0048.122] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0048.122] GetFileType (hFile=0x158) returned 0x1 [0048.122] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x37, wMilliseconds=0x1a3)) [0048.122] GetCurrentThreadId () returned 0x970 [0048.122] GetCurrentThreadId () returned 0x970 [0048.122] GetCurrentThreadId () returned 0x970 [0048.122] GetCurrentThreadId () returned 0x970 [0048.122] GetCurrentThreadId () returned 0x970 [0048.122] GetCurrentThreadId () returned 0x970 [0048.122] GetCurrentThreadId () returned 0x970 [0048.122] GetCurrentThreadId () returned 0x970 [0048.122] GetCurrentThreadId () returned 0x970 [0048.122] GetCurrentThreadId () returned 0x970 [0048.122] GetCurrentThreadId () returned 0x970 [0048.122] GetCurrentThreadId () returned 0x970 [0048.122] GetCurrentThreadId () returned 0x970 [0048.122] GetCurrentThreadId () returned 0x970 [0048.122] GetCurrentThreadId () returned 0x970 [0048.122] GetCurrentThreadId () returned 0x970 [0048.122] GetCurrentThreadId () returned 0x970 [0048.122] GetCurrentThreadId () returned 0x970 [0048.122] GetCurrentThreadId () returned 0x970 [0048.122] GetCurrentThreadId () returned 0x970 [0048.122] GetCurrentThreadId () returned 0x970 [0048.122] GetCurrentThreadId () returned 0x970 [0048.122] GetCurrentThreadId () returned 0x970 [0048.122] GetCurrentThreadId () returned 0x970 [0048.122] GetCurrentThreadId () returned 0x970 [0048.122] GetCurrentThreadId () returned 0x970 [0048.122] GetCurrentThreadId () returned 0x970 [0048.122] GetCurrentThreadId () returned 0x970 [0048.122] GetCurrentThreadId () returned 0x970 [0048.122] GetCurrentThreadId () returned 0x970 [0048.122] GetCurrentThreadId () returned 0x970 [0048.122] GetCurrentThreadId () returned 0x970 [0048.122] GetCurrentThreadId () returned 0x970 [0048.122] GetCurrentThreadId () returned 0x970 [0048.122] GetCurrentThreadId () returned 0x970 [0048.122] GetCurrentThreadId () returned 0x970 [0048.122] GetCurrentThreadId () returned 0x970 [0048.122] GetCurrentThreadId () returned 0x970 [0048.122] GetCurrentThreadId () returned 0x970 [0048.122] GetCurrentThreadId () returned 0x970 [0048.122] GetCurrentThreadId () returned 0x970 [0048.123] GetCurrentThreadId () returned 0x970 [0048.123] GetCurrentThreadId () returned 0x970 [0048.123] GetCurrentThreadId () returned 0x970 [0048.123] GetCurrentThreadId () returned 0x970 [0048.123] GetCurrentThreadId () returned 0x970 [0048.123] GetCurrentThreadId () returned 0x970 [0048.123] GetCurrentThreadId () returned 0x970 [0048.123] GetCurrentThreadId () returned 0x970 [0048.123] GetCurrentThreadId () returned 0x970 [0048.123] GetCurrentThreadId () returned 0x970 [0048.123] GetCurrentThreadId () returned 0x970 [0048.123] GetCurrentThreadId () returned 0x970 [0048.123] GetCurrentThreadId () returned 0x970 [0048.123] GetCurrentThreadId () returned 0x970 [0048.123] GetCurrentThreadId () returned 0x970 [0048.123] GetCurrentThreadId () returned 0x970 [0048.123] GetCurrentThreadId () returned 0x970 [0048.123] GetCurrentThreadId () returned 0x970 [0048.123] GetCurrentThreadId () returned 0x970 [0048.123] GetCurrentThreadId () returned 0x970 [0048.123] GetCurrentThreadId () returned 0x970 [0048.123] GetCurrentThreadId () returned 0x970 [0048.123] GetCurrentThreadId () returned 0x970 [0048.123] GetCurrentThreadId () returned 0x970 [0048.123] GetCurrentThreadId () returned 0x970 [0048.123] GetCurrentThreadId () returned 0x970 [0048.123] GetCurrentThreadId () returned 0x970 [0048.123] GetCurrentThreadId () returned 0x970 [0048.123] GetCurrentThreadId () returned 0x970 [0048.123] GetCurrentThreadId () returned 0x970 [0048.123] GetCurrentThreadId () returned 0x970 [0048.123] GetCurrentThreadId () returned 0x970 [0048.123] GetCurrentThreadId () returned 0x970 [0048.123] GetCurrentThreadId () returned 0x970 [0048.123] GetCurrentThreadId () returned 0x970 [0048.123] GetCurrentThreadId () returned 0x970 [0048.123] GetCurrentThreadId () returned 0x970 [0048.123] GetCurrentThreadId () returned 0x970 [0048.123] GetCurrentThreadId () returned 0x970 [0048.123] GetCurrentThreadId () returned 0x970 [0048.123] GetCurrentThreadId () returned 0x970 [0048.123] GetCurrentThreadId () returned 0x970 [0048.123] GetCurrentThreadId () returned 0x970 [0048.123] GetCurrentThreadId () returned 0x970 [0048.123] GetCurrentThreadId () returned 0x970 [0048.123] GetCurrentThreadId () returned 0x970 [0048.123] GetCurrentThreadId () returned 0x970 [0048.124] GetCurrentThreadId () returned 0x970 [0048.124] GetCurrentThreadId () returned 0x970 [0048.124] GetCurrentThreadId () returned 0x970 [0048.124] GetCurrentThreadId () returned 0x970 [0048.124] GetCurrentThreadId () returned 0x970 [0048.124] GetCurrentThreadId () returned 0x970 [0048.124] GetCurrentThreadId () returned 0x970 [0048.124] GetCurrentThreadId () returned 0x970 [0048.124] GetCurrentThreadId () returned 0x970 [0048.124] GetCurrentThreadId () returned 0x970 [0048.124] GetCurrentThreadId () returned 0x970 [0048.124] GetCurrentThreadId () returned 0x970 [0048.124] GetCurrentThreadId () returned 0x970 [0048.124] GetCurrentThreadId () returned 0x970 [0048.124] GetCurrentThreadId () returned 0x970 [0048.124] GetCurrentThreadId () returned 0x970 [0048.124] GetCurrentThreadId () returned 0x970 [0048.124] GetCurrentThreadId () returned 0x970 [0048.124] GetCurrentThreadId () returned 0x970 [0048.124] GetCurrentThreadId () returned 0x970 [0048.124] GetCurrentThreadId () returned 0x970 [0048.124] GetCurrentThreadId () returned 0x970 [0048.124] GetCurrentThreadId () returned 0x970 [0048.124] GetCurrentThreadId () returned 0x970 [0048.124] GetCurrentThreadId () returned 0x970 [0048.124] GetCurrentThreadId () returned 0x970 [0048.124] GetCurrentThreadId () returned 0x970 [0048.124] GetCurrentThreadId () returned 0x970 [0048.124] GetCurrentThreadId () returned 0x970 [0048.124] GetCurrentThreadId () returned 0x970 [0048.124] GetCurrentThreadId () returned 0x970 [0048.124] GetCurrentThreadId () returned 0x970 [0048.124] GetCurrentThreadId () returned 0x970 [0048.124] GetCurrentThreadId () returned 0x970 [0048.124] GetCurrentThreadId () returned 0x970 [0048.124] GetCurrentThreadId () returned 0x970 [0048.124] GetCurrentThreadId () returned 0x970 [0048.124] GetCurrentThreadId () returned 0x970 [0048.124] GetCurrentThreadId () returned 0x970 [0048.124] GetCurrentThreadId () returned 0x970 [0048.124] GetCurrentThreadId () returned 0x970 [0048.124] GetCurrentThreadId () returned 0x970 [0048.124] GetCurrentThreadId () returned 0x970 [0048.124] GetCurrentThreadId () returned 0x970 [0048.124] GetCurrentThreadId () returned 0x970 [0048.124] GetCurrentThreadId () returned 0x970 [0048.125] GetCurrentThreadId () returned 0x970 [0048.125] GetCurrentThreadId () returned 0x970 [0048.125] GetCurrentThreadId () returned 0x970 [0048.125] GetCurrentThreadId () returned 0x970 [0048.125] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.125] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.125] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb070, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.125] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.125] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.125] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb070, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.125] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.125] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.125] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.125] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.125] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.125] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.125] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.125] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.125] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb0d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.125] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.125] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.125] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb0d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.125] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.125] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.125] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb0d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.125] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x37, wMilliseconds=0x1b2)) [0048.125] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="@NREW7L@M/j&\",gu$t!Hse!/P\\3w>A(?", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0048.125] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="@NREW7L@M/j&\",gu$t!Hse!/P\\3w>A(?", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0048.125] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="@NREW7L@M/j&\",gu$t!Hse!/P\\3w>A(?", cchWideChar=32, lpMultiByteStr=0x2000688, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="@NREW7L@M/j&\",gu$t!Hse!/P\\3w>A(?", lpUsedDefaultChar=0x0) returned 32 [0048.125] GetCurrentThreadId () returned 0x970 [0048.125] GetCurrentThreadId () returned 0x970 [0048.125] GetCurrentThreadId () returned 0x970 [0048.125] GetCurrentThreadId () returned 0x970 [0048.126] GetCurrentThreadId () returned 0x970 [0048.126] GetCurrentThreadId () returned 0x970 [0048.133] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0048.133] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0048.133] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x202d018, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0048.133] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x35902f8, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0048.133] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x35902f8, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAHjEdkvvX4Mzszq0Fc+DVGIXP4vlm7jtKAYhaJ7O1xk/q3nXfxxfrIDYIrpwipSDOGrSECfrG0ioZp3NDBfwV67k/Sp6nAnM3E76gMqqnLZ2lLDr2vOO4lXYVpJ5SEZwyDKURB+W5v9guUV3D79ycsUQr1aVFrddcN85EAT+jYvAMok55KPr4ahx9KUzNKSM/4xVwajQRBr1qKHf0Tn5Az4TDKQ8ncRRHA==") returned 232 [0048.133] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x37, wMilliseconds=0x1b2)) [0048.133] GetCurrentThreadId () returned 0x970 [0048.133] GetCurrentThreadId () returned 0x970 [0048.133] GetCurrentThreadId () returned 0x970 [0048.133] GetCurrentThreadId () returned 0x970 [0048.133] GetCurrentThreadId () returned 0x970 [0048.133] GetCurrentThreadId () returned 0x970 [0048.133] GetCurrentThreadId () returned 0x970 [0048.133] GetCurrentThreadId () returned 0x970 [0048.133] GetCurrentThreadId () returned 0x970 [0048.133] GetCurrentThreadId () returned 0x970 [0048.133] GetCurrentThreadId () returned 0x970 [0048.133] GetCurrentThreadId () returned 0x970 [0048.133] GetCurrentThreadId () returned 0x970 [0048.133] GetCurrentThreadId () returned 0x970 [0048.133] GetCurrentThreadId () returned 0x970 [0048.133] GetCurrentThreadId () returned 0x970 [0048.133] GetCurrentThreadId () returned 0x970 [0048.133] GetCurrentThreadId () returned 0x970 [0048.133] GetCurrentThreadId () returned 0x970 [0048.133] GetCurrentThreadId () returned 0x970 [0048.133] GetCurrentThreadId () returned 0x970 [0048.133] GetCurrentThreadId () returned 0x970 [0048.133] GetCurrentThreadId () returned 0x970 [0048.133] GetCurrentThreadId () returned 0x970 [0048.133] GetCurrentThreadId () returned 0x970 [0048.133] GetCurrentThreadId () returned 0x970 [0048.133] GetCurrentThreadId () returned 0x970 [0048.133] GetCurrentThreadId () returned 0x970 [0048.133] GetCurrentThreadId () returned 0x970 [0048.133] GetCurrentThreadId () returned 0x970 [0048.134] GetCurrentThreadId () returned 0x970 [0048.134] GetCurrentThreadId () returned 0x970 [0048.134] GetCurrentThreadId () returned 0x970 [0048.134] GetCurrentThreadId () returned 0x970 [0048.134] GetCurrentThreadId () returned 0x970 [0048.134] GetCurrentThreadId () returned 0x970 [0048.134] GetCurrentThreadId () returned 0x970 [0048.134] GetCurrentThreadId () returned 0x970 [0048.134] GetCurrentThreadId () returned 0x970 [0048.134] GetCurrentThreadId () returned 0x970 [0048.134] GetCurrentThreadId () returned 0x970 [0048.134] GetCurrentThreadId () returned 0x970 [0048.134] GetCurrentThreadId () returned 0x970 [0048.134] GetCurrentThreadId () returned 0x970 [0048.134] GetCurrentThreadId () returned 0x970 [0048.134] GetCurrentThreadId () returned 0x970 [0048.134] GetCurrentThreadId () returned 0x970 [0048.134] GetCurrentThreadId () returned 0x970 [0048.134] GetCurrentThreadId () returned 0x970 [0048.134] GetCurrentThreadId () returned 0x970 [0048.134] GetCurrentThreadId () returned 0x970 [0048.134] GetCurrentThreadId () returned 0x970 [0048.134] GetCurrentThreadId () returned 0x970 [0048.134] GetCurrentThreadId () returned 0x970 [0048.134] GetCurrentThreadId () returned 0x970 [0048.134] GetCurrentThreadId () returned 0x970 [0048.134] GetCurrentThreadId () returned 0x970 [0048.134] GetCurrentThreadId () returned 0x970 [0048.134] GetCurrentThreadId () returned 0x970 [0048.134] GetCurrentThreadId () returned 0x970 [0048.134] GetCurrentThreadId () returned 0x970 [0048.134] GetCurrentThreadId () returned 0x970 [0048.134] GetCurrentThreadId () returned 0x970 [0048.134] GetCurrentThreadId () returned 0x970 [0048.134] GetCurrentThreadId () returned 0x970 [0048.134] GetCurrentThreadId () returned 0x970 [0048.134] GetCurrentThreadId () returned 0x970 [0048.134] GetCurrentThreadId () returned 0x970 [0048.134] GetCurrentThreadId () returned 0x970 [0048.134] GetCurrentThreadId () returned 0x970 [0048.134] GetCurrentThreadId () returned 0x970 [0048.134] GetCurrentThreadId () returned 0x970 [0048.134] GetCurrentThreadId () returned 0x970 [0048.134] GetCurrentThreadId () returned 0x970 [0048.134] GetCurrentThreadId () returned 0x970 [0048.134] GetCurrentThreadId () returned 0x970 [0048.134] GetCurrentThreadId () returned 0x970 [0048.135] GetCurrentThreadId () returned 0x970 [0048.135] GetCurrentThreadId () returned 0x970 [0048.135] GetCurrentThreadId () returned 0x970 [0048.135] GetCurrentThreadId () returned 0x970 [0048.135] GetCurrentThreadId () returned 0x970 [0048.135] GetCurrentThreadId () returned 0x970 [0048.135] GetCurrentThreadId () returned 0x970 [0048.135] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAHjEdkvvX4Mzszq0Fc+DVGIXP4vlm7jtKAYhaJ7O1xk/q3nXfxxfrIDYIrpwipSDOGrSECfrG0ioZp3NDBfwV67k/Sp6nAnM3E76gMqqnLZ2lLDr2vOO4lXYVpJ5SEZwyDKURB+W5v9guUV3D79ycsUQr1aVFrddcN85EAT+jYvAMok55KPr4ahx9KUzNKSM/4xVwajQRBr1qKHf0Tn5Az4TDKQ8ncRRHA==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0048.135] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAHjEdkvvX4Mzszq0Fc+DVGIXP4vlm7jtKAYhaJ7O1xk/q3nXfxxfrIDYIrpwipSDOGrSECfrG0ioZp3NDBfwV67k/Sp6nAnM3E76gMqqnLZ2lLDr2vOO4lXYVpJ5SEZwyDKURB+W5v9guUV3D79ycsUQr1aVFrddcN85EAT+jYvAMok55KPr4ahx9KUzNKSM/4xVwajQRBr1qKHf0Tn5Az4TDKQ8ncRRHA==", cchWideChar=245, lpMultiByteStr=0x3538dec, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAHjEdkvvX4Mzszq0Fc+DVGIXP4vlm7jtKAYhaJ7O1xk/q3nXfxxfrIDYIrpwipSDOGrSECfrG0ioZp3NDBfwV67k/Sp6nAnM3E76gMqqnLZ2lLDr2vOO4lXYVpJ5SEZwyDKURB+W5v9guUV3D79ycsUQr1aVFrddcN85EAT+jYvAMok55KPr4ahx9KUzNKSM/4xVwajQRBr1qKHf0Tn5Az4TDKQ8ncRRHA==", lpUsedDefaultChar=0x0) returned 245 [0048.135] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0048.135] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0048.135] CloseHandle (hObject=0x158) returned 1 [0048.138] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml")) returned 1 [0048.144] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=16840717227) returned 1 [0048.144] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Файл зашифрован [AccessMUISet.xml].wannacash .zip" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\Файл зашифрован [accessmuiset.xml].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0048.144] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0048.144] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0048.144] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0048.144] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0048.144] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0048.144] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0048.144] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0048.145] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0048.145] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0048.145] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0048.145] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0048.145] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0048.145] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0048.145] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0048.145] SetEndOfFile (hFile=0x158) returned 1 [0048.145] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0048.145] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0048.145] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0048.145] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0048.145] WriteFile (in: hFile=0x158, lpBuffer=0x361f5a8*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x361f5a8*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0048.146] WriteFile (in: hFile=0x158, lpBuffer=0x35f005c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f005c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0048.146] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="xl3J+V.ANO\\jn8t/OyG?:QCh\"aS&Cf2d", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0048.146] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="xl3J+V.ANO\\jn8t/OyG?:QCh\"aS&Cf2d", cchWideChar=32, lpMultiByteStr=0x203227c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xl3J+V.ANO\\jn8t/OyG?:QCh\"aS&Cf2d", lpUsedDefaultChar=0x0) returned 32 [0048.146] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0048.146] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0048.146] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUISet.xml", cAlternateFileName="ACCESS~1.XML")) returned 0x295098 [0048.146] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0048.146] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0048.146] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml")) returned 0x2020 [0048.147] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml")) returned 0x2020 [0048.147] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml")) returned 0x2020 [0048.147] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml")) returned 0x2020 [0048.147] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333)) returned 1 [0048.147] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0048.147] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0048.147] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml")) returned 0x2020 [0048.147] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml")) returned 0x2020 [0048.147] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0048.147] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0048.147] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0048.147] SetEndOfFile (hFile=0x158) returned 1 [0048.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AccessMUISet.xml", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0048.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AccessMUISet.xml", cchWideChar=16, lpMultiByteStr=0x1ff88ac, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AccessMUISet.xml", lpUsedDefaultChar=0x0) returned 16 [0048.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AccessMUISet.xml", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0048.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AccessMUISet.xml", cchWideChar=16, lpMultiByteStr=0x1ff88fc, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AccessMUISet.xml", lpUsedDefaultChar=0x0) returned 16 [0048.148] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff88fc, cbMultiByte=16, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="AccessMUISet.xmll@\x01") returned 16 [0048.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AccessMUISet.xml", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0048.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AccessMUISet.xml", cchWideChar=16, lpMultiByteStr=0x1ff88ac, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AccessMUISet.xml", lpUsedDefaultChar=0x0) returned 16 [0048.148] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0048.148] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0048.148] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x333 [0048.149] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0048.149] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0048.149] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0048.149] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AccessMUISet.xml", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0048.149] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AccessMUISet.xml", cchWideChar=16, lpMultiByteStr=0x1ff88ac, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AccessMUISet.xml", lpUsedDefaultChar=0x0) returned 16 [0048.149] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AccessMUISet.xml", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0048.149] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AccessMUISet.xml", cchWideChar=16, lpMultiByteStr=0x1ff88fc, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AccessMUISet.xml", lpUsedDefaultChar=0x0) returned 16 [0048.149] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff88fc, cbMultiByte=16, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="AccessMUISet.xmlet.xmll@\x01") returned 16 [0048.149] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AccessMUISet.xml", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0048.149] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AccessMUISet.xml", cchWideChar=16, lpMultiByteStr=0x1ff88ac, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AccessMUISet.xml", lpUsedDefaultChar=0x0) returned 16 [0048.149] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0048.150] CharToOemA (in: pSrc="AccessMUISet.xml", pDst=0x1ff88fc | out: pDst="AccessMUISet.xml") returned 1 [0048.150] WriteFile (in: hFile=0x158, lpBuffer=0x1ff88fc*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1ff88fc*, lpNumberOfBytesWritten=0x18e048*=0x10, lpOverlapped=0x0) returned 1 [0048.150] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0048.150] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0048.150] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0048.150] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=16841370076) returned 1 [0048.150] ReadFile (in: hFile=0x15c, lpBuffer=0x3500240, nNumberOfBytesToRead=0x333, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3500240*, lpNumberOfBytesRead=0x18dd7c*=0x333, lpOverlapped=0x0) returned 1 [0048.152] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0048.152] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=16841514747) returned 1 [0048.160] WriteFile (in: hFile=0x158, lpBuffer=0x1fea120*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fea120*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0048.160] ReadFile (in: hFile=0x15c, lpBuffer=0x3500240, nNumberOfBytesToRead=0x333, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3500240*, lpNumberOfBytesRead=0x18de38*=0x333, lpOverlapped=0x0) returned 1 [0048.160] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x4b [0048.160] WriteFile (in: hFile=0x158, lpBuffer=0x35005b0*, nNumberOfBytesToWrite=0x333, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x35005b0*, lpNumberOfBytesWritten=0x18de10*=0x333, lpOverlapped=0x0) returned 1 [0048.160] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x37e [0048.161] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0048.161] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0048.161] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0048.161] SetFilePointer (in: hFile=0x158, lDistanceToMove=16, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2e [0048.161] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x388 [0048.161] CloseHandle (hObject=0x15c) returned 1 [0048.161] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x388 [0048.161] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x388 [0048.161] SetFilePointer (in: hFile=0x158, lDistanceToMove=904, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x388 [0048.161] SetFilePointer (in: hFile=0x158, lDistanceToMove=904, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x388 [0048.161] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x388 [0048.161] SetFilePointer (in: hFile=0x158, lDistanceToMove=904, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x388 [0048.162] SetEndOfFile (hFile=0x158) returned 1 [0048.162] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x388 [0048.162] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x388 [0048.162] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AccessMUISet.xml", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0048.162] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AccessMUISet.xml", cchWideChar=16, lpMultiByteStr=0x1ff88fc, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AccessMUISet.xml", lpUsedDefaultChar=0x0) returned 16 [0048.162] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AccessMUISet.xml", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0048.162] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AccessMUISet.xml", cchWideChar=16, lpMultiByteStr=0x1ff88ac, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AccessMUISet.xml", lpUsedDefaultChar=0x0) returned 16 [0048.162] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff88ac, cbMultiByte=16, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="AccessMUISet.xml\x18믉`믑`") returned 16 [0048.162] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AccessMUISet.xml", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0048.162] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AccessMUISet.xml", cchWideChar=16, lpMultiByteStr=0x1ff88fc, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AccessMUISet.xml", lpUsedDefaultChar=0x0) returned 16 [0048.162] WriteFile (in: hFile=0x158, lpBuffer=0x34e3cf8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x34e3cf8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0048.162] CharToOemA (in: pSrc="AccessMUISet.xml", pDst=0x1ff88ac | out: pDst="AccessMUISet.xml") returned 1 [0048.162] WriteFile (in: hFile=0x158, lpBuffer=0x1ff88ac*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1ff88ac*, lpNumberOfBytesWritten=0x18efcc*=0x10, lpOverlapped=0x0) returned 1 [0048.162] WriteFile (in: hFile=0x158, lpBuffer=0x1fea428*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea428*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0048.162] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0048.162] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0048.163] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x3d1 [0048.163] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x3d1 [0048.163] WriteFile (in: hFile=0x158, lpBuffer=0x361f5a8*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x361f5a8*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0048.163] WriteFile (in: hFile=0x158, lpBuffer=0x35f005c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f005c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0048.163] DeleteFileW (lpFileName="") returned 0 [0048.163] GetLastError () returned 0x3 [0048.163] GetFileAttributesW (lpFileName="") returned 0xffffffff [0048.163] SetLastError (dwErrCode=0x3) [0048.163] FlushFileBuffers (hFile=0x158) returned 1 [0048.166] GetCurrentThreadId () returned 0x970 [0048.166] GetCurrentThreadId () returned 0x970 [0048.166] GetCurrentThreadId () returned 0x970 [0048.166] GetCurrentThreadId () returned 0x970 [0048.166] GetCurrentThreadId () returned 0x970 [0048.166] GetCurrentThreadId () returned 0x970 [0048.166] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x488 [0048.166] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x488 [0048.166] SetFilePointer (in: hFile=0x158, lDistanceToMove=1160, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x488 [0048.166] CloseHandle (hObject=0x158) returned 1 [0048.167] GetCurrentThreadId () returned 0x970 [0048.167] GetCurrentThreadId () returned 0x970 [0048.167] GetCurrentThreadId () returned 0x970 [0048.167] GetCurrentThreadId () returned 0x970 [0048.167] GetCurrentThreadId () returned 0x970 [0048.167] GetCurrentThreadId () returned 0x970 [0048.167] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Файл зашифрован [AccessMUISet.xml].wannacash .zip" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\Файл зашифрован [accessmuiset.xml].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0048.167] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x488 [0048.167] SetFilePointer (in: hFile=0x158, lDistanceToMove=1032, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x408 [0048.167] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0048.167] GetFileType (hFile=0x158) returned 0x1 [0048.167] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x37, wMilliseconds=0x1d2)) [0048.167] GetCurrentThreadId () returned 0x970 [0048.168] GetCurrentThreadId () returned 0x970 [0048.168] GetCurrentThreadId () returned 0x970 [0048.168] GetCurrentThreadId () returned 0x970 [0048.168] GetCurrentThreadId () returned 0x970 [0048.168] GetCurrentThreadId () returned 0x970 [0048.168] GetCurrentThreadId () returned 0x970 [0048.168] GetCurrentThreadId () returned 0x970 [0048.168] GetCurrentThreadId () returned 0x970 [0048.168] GetCurrentThreadId () returned 0x970 [0048.168] GetCurrentThreadId () returned 0x970 [0048.168] GetCurrentThreadId () returned 0x970 [0048.168] GetCurrentThreadId () returned 0x970 [0048.168] GetCurrentThreadId () returned 0x970 [0048.168] GetCurrentThreadId () returned 0x970 [0048.168] GetCurrentThreadId () returned 0x970 [0048.168] GetCurrentThreadId () returned 0x970 [0048.168] GetCurrentThreadId () returned 0x970 [0048.168] GetCurrentThreadId () returned 0x970 [0048.168] GetCurrentThreadId () returned 0x970 [0048.168] GetCurrentThreadId () returned 0x970 [0048.168] GetCurrentThreadId () returned 0x970 [0048.168] GetCurrentThreadId () returned 0x970 [0048.168] GetCurrentThreadId () returned 0x970 [0048.168] GetCurrentThreadId () returned 0x970 [0048.168] GetCurrentThreadId () returned 0x970 [0048.168] GetCurrentThreadId () returned 0x970 [0048.168] GetCurrentThreadId () returned 0x970 [0048.168] GetCurrentThreadId () returned 0x970 [0048.168] GetCurrentThreadId () returned 0x970 [0048.168] GetCurrentThreadId () returned 0x970 [0048.168] GetCurrentThreadId () returned 0x970 [0048.168] GetCurrentThreadId () returned 0x970 [0048.168] GetCurrentThreadId () returned 0x970 [0048.168] GetCurrentThreadId () returned 0x970 [0048.168] GetCurrentThreadId () returned 0x970 [0048.168] GetCurrentThreadId () returned 0x970 [0048.168] GetCurrentThreadId () returned 0x970 [0048.168] GetCurrentThreadId () returned 0x970 [0048.168] GetCurrentThreadId () returned 0x970 [0048.168] GetCurrentThreadId () returned 0x970 [0048.168] GetCurrentThreadId () returned 0x970 [0048.168] GetCurrentThreadId () returned 0x970 [0048.168] GetCurrentThreadId () returned 0x970 [0048.168] GetCurrentThreadId () returned 0x970 [0048.168] GetCurrentThreadId () returned 0x970 [0048.168] GetCurrentThreadId () returned 0x970 [0048.168] GetCurrentThreadId () returned 0x970 [0048.169] GetCurrentThreadId () returned 0x970 [0048.169] GetCurrentThreadId () returned 0x970 [0048.169] GetCurrentThreadId () returned 0x970 [0048.169] GetCurrentThreadId () returned 0x970 [0048.169] GetCurrentThreadId () returned 0x970 [0048.169] GetCurrentThreadId () returned 0x970 [0048.169] GetCurrentThreadId () returned 0x970 [0048.169] GetCurrentThreadId () returned 0x970 [0048.169] GetCurrentThreadId () returned 0x970 [0048.169] GetCurrentThreadId () returned 0x970 [0048.169] GetCurrentThreadId () returned 0x970 [0048.169] GetCurrentThreadId () returned 0x970 [0048.169] GetCurrentThreadId () returned 0x970 [0048.169] GetCurrentThreadId () returned 0x970 [0048.169] GetCurrentThreadId () returned 0x970 [0048.169] GetCurrentThreadId () returned 0x970 [0048.169] GetCurrentThreadId () returned 0x970 [0048.169] GetCurrentThreadId () returned 0x970 [0048.169] GetCurrentThreadId () returned 0x970 [0048.169] GetCurrentThreadId () returned 0x970 [0048.169] GetCurrentThreadId () returned 0x970 [0048.169] GetCurrentThreadId () returned 0x970 [0048.169] GetCurrentThreadId () returned 0x970 [0048.169] GetCurrentThreadId () returned 0x970 [0048.169] GetCurrentThreadId () returned 0x970 [0048.169] GetCurrentThreadId () returned 0x970 [0048.169] GetCurrentThreadId () returned 0x970 [0048.169] GetCurrentThreadId () returned 0x970 [0048.169] GetCurrentThreadId () returned 0x970 [0048.169] GetCurrentThreadId () returned 0x970 [0048.169] GetCurrentThreadId () returned 0x970 [0048.169] GetCurrentThreadId () returned 0x970 [0048.169] GetCurrentThreadId () returned 0x970 [0048.169] GetCurrentThreadId () returned 0x970 [0048.169] GetCurrentThreadId () returned 0x970 [0048.169] GetCurrentThreadId () returned 0x970 [0048.169] GetCurrentThreadId () returned 0x970 [0048.169] GetCurrentThreadId () returned 0x970 [0048.169] GetCurrentThreadId () returned 0x970 [0048.169] GetCurrentThreadId () returned 0x970 [0048.169] GetCurrentThreadId () returned 0x970 [0048.169] GetCurrentThreadId () returned 0x970 [0048.169] GetCurrentThreadId () returned 0x970 [0048.169] GetCurrentThreadId () returned 0x970 [0048.169] GetCurrentThreadId () returned 0x970 [0048.169] GetCurrentThreadId () returned 0x970 [0048.169] GetCurrentThreadId () returned 0x970 [0048.170] GetCurrentThreadId () returned 0x970 [0048.170] GetCurrentThreadId () returned 0x970 [0048.170] GetCurrentThreadId () returned 0x970 [0048.170] GetCurrentThreadId () returned 0x970 [0048.170] GetCurrentThreadId () returned 0x970 [0048.170] GetCurrentThreadId () returned 0x970 [0048.170] GetCurrentThreadId () returned 0x970 [0048.170] GetCurrentThreadId () returned 0x970 [0048.170] GetCurrentThreadId () returned 0x970 [0048.170] GetCurrentThreadId () returned 0x970 [0048.170] GetCurrentThreadId () returned 0x970 [0048.170] GetCurrentThreadId () returned 0x970 [0048.170] GetCurrentThreadId () returned 0x970 [0048.170] GetCurrentThreadId () returned 0x970 [0048.170] GetCurrentThreadId () returned 0x970 [0048.170] GetCurrentThreadId () returned 0x970 [0048.170] GetCurrentThreadId () returned 0x970 [0048.170] GetCurrentThreadId () returned 0x970 [0048.170] GetCurrentThreadId () returned 0x970 [0048.170] GetCurrentThreadId () returned 0x970 [0048.170] GetCurrentThreadId () returned 0x970 [0048.170] GetCurrentThreadId () returned 0x970 [0048.170] GetCurrentThreadId () returned 0x970 [0048.170] GetCurrentThreadId () returned 0x970 [0048.170] GetCurrentThreadId () returned 0x970 [0048.170] GetCurrentThreadId () returned 0x970 [0048.170] GetCurrentThreadId () returned 0x970 [0048.170] GetCurrentThreadId () returned 0x970 [0048.170] GetCurrentThreadId () returned 0x970 [0048.170] GetCurrentThreadId () returned 0x970 [0048.170] GetCurrentThreadId () returned 0x970 [0048.170] GetCurrentThreadId () returned 0x970 [0048.170] GetCurrentThreadId () returned 0x970 [0048.170] GetCurrentThreadId () returned 0x970 [0048.170] GetCurrentThreadId () returned 0x970 [0048.170] GetCurrentThreadId () returned 0x970 [0048.170] GetCurrentThreadId () returned 0x970 [0048.170] GetCurrentThreadId () returned 0x970 [0048.170] GetCurrentThreadId () returned 0x970 [0048.170] GetCurrentThreadId () returned 0x970 [0048.170] GetCurrentThreadId () returned 0x970 [0048.170] GetCurrentThreadId () returned 0x970 [0048.170] GetCurrentThreadId () returned 0x970 [0048.170] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.170] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.170] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb0d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.171] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.171] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.171] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb0d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.171] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.171] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.171] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.171] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.171] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.171] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.171] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.171] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.171] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb130, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.171] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.171] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.171] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb130, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.171] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.171] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.171] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb130, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.171] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x37, wMilliseconds=0x1e1)) [0048.171] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="xl3J+V.ANO\\jn8t/OyG?:QCh\"aS&Cf2d", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0048.171] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="xl3J+V.ANO\\jn8t/OyG?:QCh\"aS&Cf2d", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0048.171] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="xl3J+V.ANO\\jn8t/OyG?:QCh\"aS&Cf2d", cchWideChar=32, lpMultiByteStr=0x20004a8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xl3J+V.ANO\\jn8t/OyG?:QCh\"aS&Cf2d", lpUsedDefaultChar=0x0) returned 32 [0048.171] GetCurrentThreadId () returned 0x970 [0048.171] GetCurrentThreadId () returned 0x970 [0048.171] GetCurrentThreadId () returned 0x970 [0048.171] GetCurrentThreadId () returned 0x970 [0048.171] GetCurrentThreadId () returned 0x970 [0048.171] GetCurrentThreadId () returned 0x970 [0048.178] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0048.179] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0048.179] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x202d108, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0048.179] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x35905f8, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0048.179] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x35905f8, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAACG0aFZkPLalXQyimmgY6EuYXvf8TDXXKBgQSnCeciTft03yLP8HB4HuGgmwPS6snZTeArJx1nQ82bIXMwEdfqPppHqtTiHvRIx59xkgs5THXg/W1yL99ZGKavRoVJE5B9+qCqo93LBBvfLbmR5r+LEZJKskUGCVZ9fI8NWc4IyTejXw/kqOPMG0gg8RdOY8jAe/mVff6+zFId3UA5151jEfTBVo7rBtvA==") returned 232 [0048.179] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x37, wMilliseconds=0x1e1)) [0048.179] GetCurrentThreadId () returned 0x970 [0048.179] GetCurrentThreadId () returned 0x970 [0048.179] GetCurrentThreadId () returned 0x970 [0048.179] GetCurrentThreadId () returned 0x970 [0048.179] GetCurrentThreadId () returned 0x970 [0048.179] GetCurrentThreadId () returned 0x970 [0048.179] GetCurrentThreadId () returned 0x970 [0048.179] GetCurrentThreadId () returned 0x970 [0048.179] GetCurrentThreadId () returned 0x970 [0048.179] GetCurrentThreadId () returned 0x970 [0048.179] GetCurrentThreadId () returned 0x970 [0048.179] GetCurrentThreadId () returned 0x970 [0048.179] GetCurrentThreadId () returned 0x970 [0048.179] GetCurrentThreadId () returned 0x970 [0048.179] GetCurrentThreadId () returned 0x970 [0048.179] GetCurrentThreadId () returned 0x970 [0048.179] GetCurrentThreadId () returned 0x970 [0048.179] GetCurrentThreadId () returned 0x970 [0048.179] GetCurrentThreadId () returned 0x970 [0048.179] GetCurrentThreadId () returned 0x970 [0048.179] GetCurrentThreadId () returned 0x970 [0048.179] GetCurrentThreadId () returned 0x970 [0048.179] GetCurrentThreadId () returned 0x970 [0048.179] GetCurrentThreadId () returned 0x970 [0048.179] GetCurrentThreadId () returned 0x970 [0048.179] GetCurrentThreadId () returned 0x970 [0048.179] GetCurrentThreadId () returned 0x970 [0048.179] GetCurrentThreadId () returned 0x970 [0048.179] GetCurrentThreadId () returned 0x970 [0048.179] GetCurrentThreadId () returned 0x970 [0048.179] GetCurrentThreadId () returned 0x970 [0048.179] GetCurrentThreadId () returned 0x970 [0048.179] GetCurrentThreadId () returned 0x970 [0048.179] GetCurrentThreadId () returned 0x970 [0048.179] GetCurrentThreadId () returned 0x970 [0048.179] GetCurrentThreadId () returned 0x970 [0048.179] GetCurrentThreadId () returned 0x970 [0048.179] GetCurrentThreadId () returned 0x970 [0048.179] GetCurrentThreadId () returned 0x970 [0048.179] GetCurrentThreadId () returned 0x970 [0048.179] GetCurrentThreadId () returned 0x970 [0048.180] GetCurrentThreadId () returned 0x970 [0048.180] GetCurrentThreadId () returned 0x970 [0048.180] GetCurrentThreadId () returned 0x970 [0048.180] GetCurrentThreadId () returned 0x970 [0048.180] GetCurrentThreadId () returned 0x970 [0048.180] GetCurrentThreadId () returned 0x970 [0048.180] GetCurrentThreadId () returned 0x970 [0048.180] GetCurrentThreadId () returned 0x970 [0048.180] GetCurrentThreadId () returned 0x970 [0048.180] GetCurrentThreadId () returned 0x970 [0048.180] GetCurrentThreadId () returned 0x970 [0048.180] GetCurrentThreadId () returned 0x970 [0048.180] GetCurrentThreadId () returned 0x970 [0048.180] GetCurrentThreadId () returned 0x970 [0048.180] GetCurrentThreadId () returned 0x970 [0048.180] GetCurrentThreadId () returned 0x970 [0048.180] GetCurrentThreadId () returned 0x970 [0048.180] GetCurrentThreadId () returned 0x970 [0048.180] GetCurrentThreadId () returned 0x970 [0048.180] GetCurrentThreadId () returned 0x970 [0048.180] GetCurrentThreadId () returned 0x970 [0048.180] GetCurrentThreadId () returned 0x970 [0048.180] GetCurrentThreadId () returned 0x970 [0048.180] GetCurrentThreadId () returned 0x970 [0048.180] GetCurrentThreadId () returned 0x970 [0048.180] GetCurrentThreadId () returned 0x970 [0048.180] GetCurrentThreadId () returned 0x970 [0048.180] GetCurrentThreadId () returned 0x970 [0048.180] GetCurrentThreadId () returned 0x970 [0048.180] GetCurrentThreadId () returned 0x970 [0048.180] GetCurrentThreadId () returned 0x970 [0048.180] GetCurrentThreadId () returned 0x970 [0048.180] GetCurrentThreadId () returned 0x970 [0048.180] GetCurrentThreadId () returned 0x970 [0048.180] GetCurrentThreadId () returned 0x970 [0048.180] GetCurrentThreadId () returned 0x970 [0048.180] GetCurrentThreadId () returned 0x970 [0048.180] GetCurrentThreadId () returned 0x970 [0048.180] GetCurrentThreadId () returned 0x970 [0048.180] GetCurrentThreadId () returned 0x970 [0048.180] GetCurrentThreadId () returned 0x970 [0048.180] GetCurrentThreadId () returned 0x970 [0048.180] GetCurrentThreadId () returned 0x970 [0048.180] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAACG0aFZkPLalXQyimmgY6EuYXvf8TDXXKBgQSnCeciTft03yLP8HB4HuGgmwPS6snZTeArJx1nQ82bIXMwEdfqPppHqtTiHvRIx59xkgs5THXg/W1yL99ZGKavRoVJE5B9+qCqo93LBBvfLbmR5r+LEZJKskUGCVZ9fI8NWc4IyTejXw/kqOPMG0gg8RdOY8jAe/mVff6+zFId3UA5151jEfTBVo7rBtvA==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0048.180] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAACG0aFZkPLalXQyimmgY6EuYXvf8TDXXKBgQSnCeciTft03yLP8HB4HuGgmwPS6snZTeArJx1nQ82bIXMwEdfqPppHqtTiHvRIx59xkgs5THXg/W1yL99ZGKavRoVJE5B9+qCqo93LBBvfLbmR5r+LEZJKskUGCVZ9fI8NWc4IyTejXw/kqOPMG0gg8RdOY8jAe/mVff6+zFId3UA5151jEfTBVo7rBtvA==", cchWideChar=245, lpMultiByteStr=0x353900c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAACG0aFZkPLalXQyimmgY6EuYXvf8TDXXKBgQSnCeciTft03yLP8HB4HuGgmwPS6snZTeArJx1nQ82bIXMwEdfqPppHqtTiHvRIx59xkgs5THXg/W1yL99ZGKavRoVJE5B9+qCqo93LBBvfLbmR5r+LEZJKskUGCVZ9fI8NWc4IyTejXw/kqOPMG0gg8RdOY8jAe/mVff6+zFId3UA5151jEfTBVo7rBtvA==", lpUsedDefaultChar=0x0) returned 245 [0048.180] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0048.181] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0048.181] CloseHandle (hObject=0x158) returned 1 [0048.181] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml")) returned 1 [0048.182] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=16844577230) returned 1 [0048.182] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Файл зашифрован [Setup.xml].wannacash .zip" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\Файл зашифрован [setup.xml].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0048.183] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0048.183] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0048.183] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0048.183] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0048.183] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0048.183] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0048.183] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0048.183] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0048.183] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0048.183] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0048.183] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0048.183] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0048.183] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0048.184] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0048.184] SetEndOfFile (hFile=0x158) returned 1 [0048.184] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0048.184] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0048.184] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0048.184] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0048.184] WriteFile (in: hFile=0x158, lpBuffer=0x361f5a8*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x361f5a8*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0048.186] WriteFile (in: hFile=0x158, lpBuffer=0x35f011c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f011c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0048.186] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VUp56>QT!#qs2$T\",*?fnX^94r}XVvcM", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0048.186] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VUp56>QT!#qs2$T\",*?fnX^94r}XVvcM", cchWideChar=32, lpMultiByteStr=0x20322b4, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VUp56>QT!#qs2$T\",*?fnX^94r}XVvcM", lpUsedDefaultChar=0x0) returned 32 [0048.186] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0048.186] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0048.186] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0x295098 [0048.186] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0048.186] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0048.186] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0048.186] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0048.186] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0048.186] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0048.186] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40)) returned 1 [0048.186] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0048.186] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0048.186] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0048.187] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0048.187] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0048.187] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0048.187] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0048.187] SetEndOfFile (hFile=0x158) returned 1 [0048.188] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0048.188] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x1fe358c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0048.188] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0048.188] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x1fe38ac, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0048.188] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe38ac, cbMultiByte=9, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="Setup.xmllet.xmll@\x01") returned 9 [0048.188] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0048.188] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x1fe358c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0048.188] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0048.188] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0048.188] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0xa40 [0048.188] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0048.188] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0048.188] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0048.188] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0048.188] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x1fe358c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0048.189] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0048.189] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x1fe38ac, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0048.189] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe38ac, cbMultiByte=9, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="Setup.xmlup.xmllet.xmll@\x01") returned 9 [0048.189] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0048.189] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x1fe358c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0048.189] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0048.189] CharToOemA (in: pSrc="Setup.xml", pDst=0x1fe38ac | out: pDst="Setup.xml") returned 1 [0048.190] WriteFile (in: hFile=0x158, lpBuffer=0x1fe38ac*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe38ac*, lpNumberOfBytesWritten=0x18e048*=0x9, lpOverlapped=0x0) returned 1 [0048.190] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0048.190] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0048.190] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0048.190] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=16845334151) returned 1 [0048.190] ReadFile (in: hFile=0x15c, lpBuffer=0x351cb30, nNumberOfBytesToRead=0xa40, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x351cb30*, lpNumberOfBytesRead=0x18dd7c*=0xa40, lpOverlapped=0x0) returned 1 [0048.191] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0048.191] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=16845469964) returned 1 [0048.200] WriteFile (in: hFile=0x158, lpBuffer=0x1fea180*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fea180*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0048.200] ReadFile (in: hFile=0x15c, lpBuffer=0x351cb30, nNumberOfBytesToRead=0xa40, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x351cb30*, lpNumberOfBytesRead=0x18de38*=0xa40, lpOverlapped=0x0) returned 1 [0048.200] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x44 [0048.200] WriteFile (in: hFile=0x158, lpBuffer=0x3500220*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3500220*, lpNumberOfBytesWritten=0x18de10*=0xa40, lpOverlapped=0x0) returned 1 [0048.200] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0xa84 [0048.200] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0048.200] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0048.200] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0048.200] SetFilePointer (in: hFile=0x158, lDistanceToMove=9, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x27 [0048.200] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0xa8e [0048.200] CloseHandle (hObject=0x15c) returned 1 [0048.201] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xa8e [0048.201] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xa8e [0048.201] SetFilePointer (in: hFile=0x158, lDistanceToMove=2702, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xa8e [0048.201] SetFilePointer (in: hFile=0x158, lDistanceToMove=2702, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0xa8e [0048.201] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xa8e [0048.201] SetFilePointer (in: hFile=0x158, lDistanceToMove=2702, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0xa8e [0048.201] SetEndOfFile (hFile=0x158) returned 1 [0048.201] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xa8e [0048.201] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xa8e [0048.201] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0048.201] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x1fe358c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0048.201] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0048.201] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x1fe3a0c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0048.201] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe3a0c, cbMultiByte=9, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="Setup.xml") returned 9 [0048.201] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0048.201] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x1fe358c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0048.201] WriteFile (in: hFile=0x158, lpBuffer=0x34e3cf8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x34e3cf8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0048.201] CharToOemA (in: pSrc="Setup.xml", pDst=0x1fe3a0c | out: pDst="Setup.xml") returned 1 [0048.202] WriteFile (in: hFile=0x158, lpBuffer=0x1fe3a0c*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe3a0c*, lpNumberOfBytesWritten=0x18efcc*=0x9, lpOverlapped=0x0) returned 1 [0048.202] WriteFile (in: hFile=0x158, lpBuffer=0x1fea260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea260*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0048.202] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0048.202] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0048.202] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xad0 [0048.202] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xad0 [0048.202] WriteFile (in: hFile=0x158, lpBuffer=0x361f5a8*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x361f5a8*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0048.202] WriteFile (in: hFile=0x158, lpBuffer=0x35f011c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f011c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0048.202] DeleteFileW (lpFileName="") returned 0 [0048.202] GetLastError () returned 0x3 [0048.203] GetFileAttributesW (lpFileName="") returned 0xffffffff [0048.203] SetLastError (dwErrCode=0x3) [0048.203] FlushFileBuffers (hFile=0x158) returned 1 [0048.206] GetCurrentThreadId () returned 0x970 [0048.206] GetCurrentThreadId () returned 0x970 [0048.206] GetCurrentThreadId () returned 0x970 [0048.206] GetCurrentThreadId () returned 0x970 [0048.206] GetCurrentThreadId () returned 0x970 [0048.206] GetCurrentThreadId () returned 0x970 [0048.206] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xb87 [0048.206] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xb87 [0048.206] SetFilePointer (in: hFile=0x158, lDistanceToMove=2951, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xb87 [0048.206] CloseHandle (hObject=0x158) returned 1 [0048.207] GetCurrentThreadId () returned 0x970 [0048.207] GetCurrentThreadId () returned 0x970 [0048.207] GetCurrentThreadId () returned 0x970 [0048.207] GetCurrentThreadId () returned 0x970 [0048.207] GetCurrentThreadId () returned 0x970 [0048.207] GetCurrentThreadId () returned 0x970 [0048.207] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Файл зашифрован [Setup.xml].wannacash .zip" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\Файл зашифрован [setup.xml].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0048.207] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb87 [0048.207] SetFilePointer (in: hFile=0x158, lDistanceToMove=2823, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb07 [0048.207] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0048.207] GetFileType (hFile=0x158) returned 0x1 [0048.207] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x37, wMilliseconds=0x200)) [0048.207] GetCurrentThreadId () returned 0x970 [0048.207] GetCurrentThreadId () returned 0x970 [0048.207] GetCurrentThreadId () returned 0x970 [0048.207] GetCurrentThreadId () returned 0x970 [0048.207] GetCurrentThreadId () returned 0x970 [0048.207] GetCurrentThreadId () returned 0x970 [0048.207] GetCurrentThreadId () returned 0x970 [0048.207] GetCurrentThreadId () returned 0x970 [0048.207] GetCurrentThreadId () returned 0x970 [0048.207] GetCurrentThreadId () returned 0x970 [0048.207] GetCurrentThreadId () returned 0x970 [0048.207] GetCurrentThreadId () returned 0x970 [0048.207] GetCurrentThreadId () returned 0x970 [0048.207] GetCurrentThreadId () returned 0x970 [0048.207] GetCurrentThreadId () returned 0x970 [0048.207] GetCurrentThreadId () returned 0x970 [0048.207] GetCurrentThreadId () returned 0x970 [0048.208] GetCurrentThreadId () returned 0x970 [0048.208] GetCurrentThreadId () returned 0x970 [0048.208] GetCurrentThreadId () returned 0x970 [0048.208] GetCurrentThreadId () returned 0x970 [0048.208] GetCurrentThreadId () returned 0x970 [0048.208] GetCurrentThreadId () returned 0x970 [0048.208] GetCurrentThreadId () returned 0x970 [0048.208] GetCurrentThreadId () returned 0x970 [0048.208] GetCurrentThreadId () returned 0x970 [0048.208] GetCurrentThreadId () returned 0x970 [0048.208] GetCurrentThreadId () returned 0x970 [0048.208] GetCurrentThreadId () returned 0x970 [0048.208] GetCurrentThreadId () returned 0x970 [0048.208] GetCurrentThreadId () returned 0x970 [0048.208] GetCurrentThreadId () returned 0x970 [0048.208] GetCurrentThreadId () returned 0x970 [0048.208] GetCurrentThreadId () returned 0x970 [0048.208] GetCurrentThreadId () returned 0x970 [0048.208] GetCurrentThreadId () returned 0x970 [0048.208] GetCurrentThreadId () returned 0x970 [0048.208] GetCurrentThreadId () returned 0x970 [0048.208] GetCurrentThreadId () returned 0x970 [0048.208] GetCurrentThreadId () returned 0x970 [0048.208] GetCurrentThreadId () returned 0x970 [0048.208] GetCurrentThreadId () returned 0x970 [0048.208] GetCurrentThreadId () returned 0x970 [0048.208] GetCurrentThreadId () returned 0x970 [0048.208] GetCurrentThreadId () returned 0x970 [0048.208] GetCurrentThreadId () returned 0x970 [0048.208] GetCurrentThreadId () returned 0x970 [0048.208] GetCurrentThreadId () returned 0x970 [0048.208] GetCurrentThreadId () returned 0x970 [0048.208] GetCurrentThreadId () returned 0x970 [0048.208] GetCurrentThreadId () returned 0x970 [0048.208] GetCurrentThreadId () returned 0x970 [0048.208] GetCurrentThreadId () returned 0x970 [0048.208] GetCurrentThreadId () returned 0x970 [0048.208] GetCurrentThreadId () returned 0x970 [0048.208] GetCurrentThreadId () returned 0x970 [0048.208] GetCurrentThreadId () returned 0x970 [0048.208] GetCurrentThreadId () returned 0x970 [0048.208] GetCurrentThreadId () returned 0x970 [0048.208] GetCurrentThreadId () returned 0x970 [0048.208] GetCurrentThreadId () returned 0x970 [0048.208] GetCurrentThreadId () returned 0x970 [0048.208] GetCurrentThreadId () returned 0x970 [0048.208] GetCurrentThreadId () returned 0x970 [0048.208] GetCurrentThreadId () returned 0x970 [0048.208] GetCurrentThreadId () returned 0x970 [0048.209] GetCurrentThreadId () returned 0x970 [0048.209] GetCurrentThreadId () returned 0x970 [0048.209] GetCurrentThreadId () returned 0x970 [0048.209] GetCurrentThreadId () returned 0x970 [0048.209] GetCurrentThreadId () returned 0x970 [0048.209] GetCurrentThreadId () returned 0x970 [0048.209] GetCurrentThreadId () returned 0x970 [0048.209] GetCurrentThreadId () returned 0x970 [0048.209] GetCurrentThreadId () returned 0x970 [0048.209] GetCurrentThreadId () returned 0x970 [0048.209] GetCurrentThreadId () returned 0x970 [0048.209] GetCurrentThreadId () returned 0x970 [0048.209] GetCurrentThreadId () returned 0x970 [0048.209] GetCurrentThreadId () returned 0x970 [0048.209] GetCurrentThreadId () returned 0x970 [0048.209] GetCurrentThreadId () returned 0x970 [0048.209] GetCurrentThreadId () returned 0x970 [0048.209] GetCurrentThreadId () returned 0x970 [0048.209] GetCurrentThreadId () returned 0x970 [0048.209] GetCurrentThreadId () returned 0x970 [0048.209] GetCurrentThreadId () returned 0x970 [0048.209] GetCurrentThreadId () returned 0x970 [0048.209] GetCurrentThreadId () returned 0x970 [0048.209] GetCurrentThreadId () returned 0x970 [0048.209] GetCurrentThreadId () returned 0x970 [0048.209] GetCurrentThreadId () returned 0x970 [0048.209] GetCurrentThreadId () returned 0x970 [0048.209] GetCurrentThreadId () returned 0x970 [0048.209] GetCurrentThreadId () returned 0x970 [0048.209] GetCurrentThreadId () returned 0x970 [0048.209] GetCurrentThreadId () returned 0x970 [0048.209] GetCurrentThreadId () returned 0x970 [0048.209] GetCurrentThreadId () returned 0x970 [0048.209] GetCurrentThreadId () returned 0x970 [0048.209] GetCurrentThreadId () returned 0x970 [0048.209] GetCurrentThreadId () returned 0x970 [0048.209] GetCurrentThreadId () returned 0x970 [0048.209] GetCurrentThreadId () returned 0x970 [0048.209] GetCurrentThreadId () returned 0x970 [0048.209] GetCurrentThreadId () returned 0x970 [0048.209] GetCurrentThreadId () returned 0x970 [0048.209] GetCurrentThreadId () returned 0x970 [0048.209] GetCurrentThreadId () returned 0x970 [0048.209] GetCurrentThreadId () returned 0x970 [0048.209] GetCurrentThreadId () returned 0x970 [0048.209] GetCurrentThreadId () returned 0x970 [0048.210] GetCurrentThreadId () returned 0x970 [0048.210] GetCurrentThreadId () returned 0x970 [0048.210] GetCurrentThreadId () returned 0x970 [0048.210] GetCurrentThreadId () returned 0x970 [0048.210] GetCurrentThreadId () returned 0x970 [0048.210] GetCurrentThreadId () returned 0x970 [0048.210] GetCurrentThreadId () returned 0x970 [0048.210] GetCurrentThreadId () returned 0x970 [0048.210] GetCurrentThreadId () returned 0x970 [0048.210] GetCurrentThreadId () returned 0x970 [0048.210] GetCurrentThreadId () returned 0x970 [0048.210] GetCurrentThreadId () returned 0x970 [0048.210] GetCurrentThreadId () returned 0x970 [0048.210] GetCurrentThreadId () returned 0x970 [0048.210] GetCurrentThreadId () returned 0x970 [0048.210] GetCurrentThreadId () returned 0x970 [0048.210] GetCurrentThreadId () returned 0x970 [0048.210] GetCurrentThreadId () returned 0x970 [0048.210] GetCurrentThreadId () returned 0x970 [0048.210] GetCurrentThreadId () returned 0x970 [0048.210] GetCurrentThreadId () returned 0x970 [0048.210] GetCurrentThreadId () returned 0x970 [0048.210] GetCurrentThreadId () returned 0x970 [0048.210] GetCurrentThreadId () returned 0x970 [0048.210] GetCurrentThreadId () returned 0x970 [0048.210] GetCurrentThreadId () returned 0x970 [0048.210] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.210] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.210] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb130, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.210] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.210] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.210] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb130, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.210] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.210] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.210] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.210] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.210] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.210] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.210] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.210] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.210] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb190, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.211] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.211] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.211] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb190, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.211] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.211] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.211] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb190, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.211] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x37, wMilliseconds=0x200)) [0048.211] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="VUp56>QT!#qs2$T\",*?fnX^94r}XVvcM", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0048.211] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="VUp56>QT!#qs2$T\",*?fnX^94r}XVvcM", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0048.211] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="VUp56>QT!#qs2$T\",*?fnX^94r}XVvcM", cchWideChar=32, lpMultiByteStr=0x2000688, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VUp56>QT!#qs2$T\",*?fnX^94r}XVvcM", lpUsedDefaultChar=0x0) returned 32 [0048.211] GetCurrentThreadId () returned 0x970 [0048.211] GetCurrentThreadId () returned 0x970 [0048.211] GetCurrentThreadId () returned 0x970 [0048.211] GetCurrentThreadId () returned 0x970 [0048.211] GetCurrentThreadId () returned 0x970 [0048.211] GetCurrentThreadId () returned 0x970 [0048.219] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0048.219] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0048.219] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x202d1f8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0048.219] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x35904f8, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0048.219] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x35904f8, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAAlXXYIkmbZ+Rbs1Q26XvAcwFrNLQe6fhIJlzMpoOo58kFA5AACwtq8w3zuvSByFK+cahB4fVsgMW1Q8NdxSX1g/Pxv7H3pgs1+YwklZ3yIN5nxz1s6HDxNCLKnrdOXhBhBBoQoZIT/frOzLv11WvnRSmqCYhQgbr5hPg7pWejiRhcwcJhB9ufodF6pahFGkhCiNNYmU6tBC99jUS2h2VJhIDeLd10oC5Q==") returned 232 [0048.219] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x37, wMilliseconds=0x210)) [0048.219] GetCurrentThreadId () returned 0x970 [0048.219] GetCurrentThreadId () returned 0x970 [0048.219] GetCurrentThreadId () returned 0x970 [0048.219] GetCurrentThreadId () returned 0x970 [0048.219] GetCurrentThreadId () returned 0x970 [0048.219] GetCurrentThreadId () returned 0x970 [0048.219] GetCurrentThreadId () returned 0x970 [0048.219] GetCurrentThreadId () returned 0x970 [0048.219] GetCurrentThreadId () returned 0x970 [0048.219] GetCurrentThreadId () returned 0x970 [0048.219] GetCurrentThreadId () returned 0x970 [0048.219] GetCurrentThreadId () returned 0x970 [0048.219] GetCurrentThreadId () returned 0x970 [0048.219] GetCurrentThreadId () returned 0x970 [0048.219] GetCurrentThreadId () returned 0x970 [0048.219] GetCurrentThreadId () returned 0x970 [0048.219] GetCurrentThreadId () returned 0x970 [0048.219] GetCurrentThreadId () returned 0x970 [0048.219] GetCurrentThreadId () returned 0x970 [0048.219] GetCurrentThreadId () returned 0x970 [0048.219] GetCurrentThreadId () returned 0x970 [0048.219] GetCurrentThreadId () returned 0x970 [0048.219] GetCurrentThreadId () returned 0x970 [0048.219] GetCurrentThreadId () returned 0x970 [0048.219] GetCurrentThreadId () returned 0x970 [0048.219] GetCurrentThreadId () returned 0x970 [0048.219] GetCurrentThreadId () returned 0x970 [0048.219] GetCurrentThreadId () returned 0x970 [0048.219] GetCurrentThreadId () returned 0x970 [0048.219] GetCurrentThreadId () returned 0x970 [0048.219] GetCurrentThreadId () returned 0x970 [0048.220] GetCurrentThreadId () returned 0x970 [0048.220] GetCurrentThreadId () returned 0x970 [0048.220] GetCurrentThreadId () returned 0x970 [0048.220] GetCurrentThreadId () returned 0x970 [0048.220] GetCurrentThreadId () returned 0x970 [0048.220] GetCurrentThreadId () returned 0x970 [0048.220] GetCurrentThreadId () returned 0x970 [0048.220] GetCurrentThreadId () returned 0x970 [0048.220] GetCurrentThreadId () returned 0x970 [0048.220] GetCurrentThreadId () returned 0x970 [0048.220] GetCurrentThreadId () returned 0x970 [0048.220] GetCurrentThreadId () returned 0x970 [0048.220] GetCurrentThreadId () returned 0x970 [0048.220] GetCurrentThreadId () returned 0x970 [0048.220] GetCurrentThreadId () returned 0x970 [0048.220] GetCurrentThreadId () returned 0x970 [0048.220] GetCurrentThreadId () returned 0x970 [0048.220] GetCurrentThreadId () returned 0x970 [0048.220] GetCurrentThreadId () returned 0x970 [0048.220] GetCurrentThreadId () returned 0x970 [0048.220] GetCurrentThreadId () returned 0x970 [0048.220] GetCurrentThreadId () returned 0x970 [0048.220] GetCurrentThreadId () returned 0x970 [0048.220] GetCurrentThreadId () returned 0x970 [0048.220] GetCurrentThreadId () returned 0x970 [0048.220] GetCurrentThreadId () returned 0x970 [0048.220] GetCurrentThreadId () returned 0x970 [0048.220] GetCurrentThreadId () returned 0x970 [0048.220] GetCurrentThreadId () returned 0x970 [0048.220] GetCurrentThreadId () returned 0x970 [0048.220] GetCurrentThreadId () returned 0x970 [0048.220] GetCurrentThreadId () returned 0x970 [0048.220] GetCurrentThreadId () returned 0x970 [0048.220] GetCurrentThreadId () returned 0x970 [0048.220] GetCurrentThreadId () returned 0x970 [0048.220] GetCurrentThreadId () returned 0x970 [0048.220] GetCurrentThreadId () returned 0x970 [0048.220] GetCurrentThreadId () returned 0x970 [0048.220] GetCurrentThreadId () returned 0x970 [0048.220] GetCurrentThreadId () returned 0x970 [0048.220] GetCurrentThreadId () returned 0x970 [0048.220] GetCurrentThreadId () returned 0x970 [0048.220] GetCurrentThreadId () returned 0x970 [0048.220] GetCurrentThreadId () returned 0x970 [0048.220] GetCurrentThreadId () returned 0x970 [0048.220] GetCurrentThreadId () returned 0x970 [0048.220] GetCurrentThreadId () returned 0x970 [0048.220] GetCurrentThreadId () returned 0x970 [0048.220] GetCurrentThreadId () returned 0x970 [0048.221] GetCurrentThreadId () returned 0x970 [0048.221] GetCurrentThreadId () returned 0x970 [0048.221] GetCurrentThreadId () returned 0x970 [0048.221] GetCurrentThreadId () returned 0x970 [0048.221] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAAlXXYIkmbZ+Rbs1Q26XvAcwFrNLQe6fhIJlzMpoOo58kFA5AACwtq8w3zuvSByFK+cahB4fVsgMW1Q8NdxSX1g/Pxv7H3pgs1+YwklZ3yIN5nxz1s6HDxNCLKnrdOXhBhBBoQoZIT/frOzLv11WvnRSmqCYhQgbr5hPg7pWejiRhcwcJhB9ufodF6pahFGkhCiNNYmU6tBC99jUS2h2VJhIDeLd10oC5Q==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0048.221] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAAlXXYIkmbZ+Rbs1Q26XvAcwFrNLQe6fhIJlzMpoOo58kFA5AACwtq8w3zuvSByFK+cahB4fVsgMW1Q8NdxSX1g/Pxv7H3pgs1+YwklZ3yIN5nxz1s6HDxNCLKnrdOXhBhBBoQoZIT/frOzLv11WvnRSmqCYhQgbr5hPg7pWejiRhcwcJhB9ufodF6pahFGkhCiNNYmU6tBC99jUS2h2VJhIDeLd10oC5Q==", cchWideChar=245, lpMultiByteStr=0x353900c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAAlXXYIkmbZ+Rbs1Q26XvAcwFrNLQe6fhIJlzMpoOo58kFA5AACwtq8w3zuvSByFK+cahB4fVsgMW1Q8NdxSX1g/Pxv7H3pgs1+YwklZ3yIN5nxz1s6HDxNCLKnrdOXhBhBBoQoZIT/frOzLv11WvnRSmqCYhQgbr5hPg7pWejiRhcwcJhB9ufodF6pahFGkhCiNNYmU6tBC99jUS2h2VJhIDeLd10oC5Q==", lpUsedDefaultChar=0x0) returned 245 [0048.221] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0048.221] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0048.221] CloseHandle (hObject=0x158) returned 1 [0048.222] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0048.223] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=16848596561) returned 1 [0048.223] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Файл зашифрован [Office32WW.xml].wannacash .zip" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\Файл зашифрован [office32ww.xml].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0048.224] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0048.224] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0048.224] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0048.224] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0048.224] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0048.224] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0048.224] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0048.224] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0048.224] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0048.224] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0048.224] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0048.224] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0048.224] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0048.224] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0048.224] SetEndOfFile (hFile=0x158) returned 1 [0048.224] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0048.225] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0048.225] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0048.225] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0048.225] WriteFile (in: hFile=0x158, lpBuffer=0x361f5a8*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x361f5a8*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0048.226] WriteFile (in: hFile=0x158, lpBuffer=0x35f005c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f005c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0048.226] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="oc#=\\x(nH*cSpI{h@0I@\\JMGPJ3!\\EDd", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0048.226] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="oc#=\\x(nH*cSpI{h@0I@\\JMGPJ3!\\EDd", cchWideChar=32, lpMultiByteStr=0x20321d4, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oc#=\\x(nH*cSpI{h@0I@\\JMGPJ3!\\EDd", lpUsedDefaultChar=0x0) returned 32 [0048.226] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0048.226] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0048.226] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x940c2a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x940c2a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.xml", cAlternateFileName="OFFICE~1.XML")) returned 0x295098 [0048.226] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0048.226] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0048.226] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0048.226] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0048.226] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0048.226] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0048.226] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x940c2a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x940c2a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10b2)) returned 1 [0048.227] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0048.227] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0048.227] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0048.227] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0048.227] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0048.227] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0048.227] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0048.227] SetEndOfFile (hFile=0x158) returned 1 [0048.228] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Office32WW.xml", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0048.228] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Office32WW.xml", cchWideChar=14, lpMultiByteStr=0x1fe366c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Office32WW.xml", lpUsedDefaultChar=0x0) returned 14 [0048.228] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Office32WW.xml", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0048.228] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Office32WW.xml", cchWideChar=14, lpMultiByteStr=0x1fe370c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Office32WW.xml", lpUsedDefaultChar=0x0) returned 14 [0048.228] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe370c, cbMultiByte=14, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="Office32WW.xmlmll@\x01") returned 14 [0048.228] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Office32WW.xml", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0048.228] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Office32WW.xml", cchWideChar=14, lpMultiByteStr=0x1fe366c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Office32WW.xml", lpUsedDefaultChar=0x0) returned 14 [0048.228] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0048.228] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0048.228] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x10b2 [0048.228] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0048.228] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0048.228] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0048.228] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Office32WW.xml", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0048.228] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Office32WW.xml", cchWideChar=14, lpMultiByteStr=0x1fe366c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Office32WW.xml", lpUsedDefaultChar=0x0) returned 14 [0048.229] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Office32WW.xml", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0048.229] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Office32WW.xml", cchWideChar=14, lpMultiByteStr=0x1fe370c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Office32WW.xml", lpUsedDefaultChar=0x0) returned 14 [0048.229] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe370c, cbMultiByte=14, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="Office32WW.xmlWW.xmlmll@\x01") returned 14 [0048.229] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Office32WW.xml", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0048.229] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Office32WW.xml", cchWideChar=14, lpMultiByteStr=0x1fe366c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Office32WW.xml", lpUsedDefaultChar=0x0) returned 14 [0048.229] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0048.230] CharToOemA (in: pSrc="Office32WW.xml", pDst=0x1fe370c | out: pDst="Office32WW.xml") returned 1 [0048.230] WriteFile (in: hFile=0x158, lpBuffer=0x1fe370c*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe370c*, lpNumberOfBytesWritten=0x18e048*=0xe, lpOverlapped=0x0) returned 1 [0048.230] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0048.230] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0048.230] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0048.230] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=16849341176) returned 1 [0048.230] ReadFile (in: hFile=0x15c, lpBuffer=0x3500220, nNumberOfBytesToRead=0x10b2, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3500220*, lpNumberOfBytesRead=0x18dd7c*=0x10b2, lpOverlapped=0x0) returned 1 [0048.254] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0048.255] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=16851816011) returned 1 [0048.263] WriteFile (in: hFile=0x158, lpBuffer=0x1fea2e8*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fea2e8*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0048.263] ReadFile (in: hFile=0x15c, lpBuffer=0x3500220, nNumberOfBytesToRead=0x10b2, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3500220*, lpNumberOfBytesRead=0x18de38*=0x10b2, lpOverlapped=0x0) returned 1 [0048.263] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x49 [0048.263] WriteFile (in: hFile=0x158, lpBuffer=0x3502a80*, nNumberOfBytesToWrite=0x10b2, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3502a80*, lpNumberOfBytesWritten=0x18de10*=0x10b2, lpOverlapped=0x0) returned 1 [0048.264] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x10fb [0048.264] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0048.264] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0048.264] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0048.264] SetFilePointer (in: hFile=0x158, lDistanceToMove=14, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2c [0048.264] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x1105 [0048.264] CloseHandle (hObject=0x15c) returned 1 [0048.264] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1105 [0048.264] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1105 [0048.264] SetFilePointer (in: hFile=0x158, lDistanceToMove=4357, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1105 [0048.265] SetFilePointer (in: hFile=0x158, lDistanceToMove=4357, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x1105 [0048.265] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1105 [0048.265] SetFilePointer (in: hFile=0x158, lDistanceToMove=4357, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x1105 [0048.265] SetEndOfFile (hFile=0x158) returned 1 [0048.265] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1105 [0048.265] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1105 [0048.265] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Office32WW.xml", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0048.265] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Office32WW.xml", cchWideChar=14, lpMultiByteStr=0x1fe366c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Office32WW.xml", lpUsedDefaultChar=0x0) returned 14 [0048.265] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Office32WW.xml", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0048.265] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Office32WW.xml", cchWideChar=14, lpMultiByteStr=0x1fe3b8c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Office32WW.xml", lpUsedDefaultChar=0x0) returned 14 [0048.265] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe3b8c, cbMultiByte=14, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="Office32WW.xml야'\x18믉`믑`") returned 14 [0048.265] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Office32WW.xml", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0048.265] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Office32WW.xml", cchWideChar=14, lpMultiByteStr=0x1fe366c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Office32WW.xml", lpUsedDefaultChar=0x0) returned 14 [0048.265] WriteFile (in: hFile=0x158, lpBuffer=0x34e3cf8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x34e3cf8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0048.265] CharToOemA (in: pSrc="Office32WW.xml", pDst=0x1fe3b8c | out: pDst="Office32WW.xml") returned 1 [0048.265] WriteFile (in: hFile=0x158, lpBuffer=0x1fe3b8c*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe3b8c*, lpNumberOfBytesWritten=0x18efcc*=0xe, lpOverlapped=0x0) returned 1 [0048.265] WriteFile (in: hFile=0x158, lpBuffer=0x1fea1e8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea1e8*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0048.266] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0048.266] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0048.266] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x114c [0048.266] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x114c [0048.266] WriteFile (in: hFile=0x158, lpBuffer=0x361f5a8*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x361f5a8*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0048.266] WriteFile (in: hFile=0x158, lpBuffer=0x35f005c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f005c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0048.266] DeleteFileW (lpFileName="") returned 0 [0048.266] GetLastError () returned 0x3 [0048.266] GetFileAttributesW (lpFileName="") returned 0xffffffff [0048.266] SetLastError (dwErrCode=0x3) [0048.266] FlushFileBuffers (hFile=0x158) returned 1 [0048.268] GetCurrentThreadId () returned 0x970 [0048.268] GetCurrentThreadId () returned 0x970 [0048.268] GetCurrentThreadId () returned 0x970 [0048.268] GetCurrentThreadId () returned 0x970 [0048.268] GetCurrentThreadId () returned 0x970 [0048.268] GetCurrentThreadId () returned 0x970 [0048.268] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x1203 [0048.268] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x1203 [0048.268] SetFilePointer (in: hFile=0x158, lDistanceToMove=4611, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x1203 [0048.269] CloseHandle (hObject=0x158) returned 1 [0048.269] GetCurrentThreadId () returned 0x970 [0048.269] GetCurrentThreadId () returned 0x970 [0048.269] GetCurrentThreadId () returned 0x970 [0048.269] GetCurrentThreadId () returned 0x970 [0048.269] GetCurrentThreadId () returned 0x970 [0048.269] GetCurrentThreadId () returned 0x970 [0048.269] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Файл зашифрован [Office32WW.xml].wannacash .zip" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\Файл зашифрован [office32ww.xml].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0048.270] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1203 [0048.270] SetFilePointer (in: hFile=0x158, lDistanceToMove=4483, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1183 [0048.270] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0048.270] GetFileType (hFile=0x158) returned 0x1 [0048.270] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x37, wMilliseconds=0x23f)) [0048.270] GetCurrentThreadId () returned 0x970 [0048.270] GetCurrentThreadId () returned 0x970 [0048.270] GetCurrentThreadId () returned 0x970 [0048.270] GetCurrentThreadId () returned 0x970 [0048.270] GetCurrentThreadId () returned 0x970 [0048.270] GetCurrentThreadId () returned 0x970 [0048.270] GetCurrentThreadId () returned 0x970 [0048.270] GetCurrentThreadId () returned 0x970 [0048.270] GetCurrentThreadId () returned 0x970 [0048.270] GetCurrentThreadId () returned 0x970 [0048.270] GetCurrentThreadId () returned 0x970 [0048.270] GetCurrentThreadId () returned 0x970 [0048.270] GetCurrentThreadId () returned 0x970 [0048.270] GetCurrentThreadId () returned 0x970 [0048.270] GetCurrentThreadId () returned 0x970 [0048.270] GetCurrentThreadId () returned 0x970 [0048.270] GetCurrentThreadId () returned 0x970 [0048.270] GetCurrentThreadId () returned 0x970 [0048.270] GetCurrentThreadId () returned 0x970 [0048.270] GetCurrentThreadId () returned 0x970 [0048.270] GetCurrentThreadId () returned 0x970 [0048.270] GetCurrentThreadId () returned 0x970 [0048.270] GetCurrentThreadId () returned 0x970 [0048.270] GetCurrentThreadId () returned 0x970 [0048.270] GetCurrentThreadId () returned 0x970 [0048.270] GetCurrentThreadId () returned 0x970 [0048.270] GetCurrentThreadId () returned 0x970 [0048.270] GetCurrentThreadId () returned 0x970 [0048.270] GetCurrentThreadId () returned 0x970 [0048.270] GetCurrentThreadId () returned 0x970 [0048.270] GetCurrentThreadId () returned 0x970 [0048.270] GetCurrentThreadId () returned 0x970 [0048.270] GetCurrentThreadId () returned 0x970 [0048.270] GetCurrentThreadId () returned 0x970 [0048.270] GetCurrentThreadId () returned 0x970 [0048.270] GetCurrentThreadId () returned 0x970 [0048.271] GetCurrentThreadId () returned 0x970 [0048.271] GetCurrentThreadId () returned 0x970 [0048.271] GetCurrentThreadId () returned 0x970 [0048.271] GetCurrentThreadId () returned 0x970 [0048.271] GetCurrentThreadId () returned 0x970 [0048.271] GetCurrentThreadId () returned 0x970 [0048.271] GetCurrentThreadId () returned 0x970 [0048.271] GetCurrentThreadId () returned 0x970 [0048.271] GetCurrentThreadId () returned 0x970 [0048.271] GetCurrentThreadId () returned 0x970 [0048.271] GetCurrentThreadId () returned 0x970 [0048.271] GetCurrentThreadId () returned 0x970 [0048.271] GetCurrentThreadId () returned 0x970 [0048.271] GetCurrentThreadId () returned 0x970 [0048.271] GetCurrentThreadId () returned 0x970 [0048.271] GetCurrentThreadId () returned 0x970 [0048.271] GetCurrentThreadId () returned 0x970 [0048.271] GetCurrentThreadId () returned 0x970 [0048.271] GetCurrentThreadId () returned 0x970 [0048.271] GetCurrentThreadId () returned 0x970 [0048.271] GetCurrentThreadId () returned 0x970 [0048.271] GetCurrentThreadId () returned 0x970 [0048.271] GetCurrentThreadId () returned 0x970 [0048.271] GetCurrentThreadId () returned 0x970 [0048.271] GetCurrentThreadId () returned 0x970 [0048.271] GetCurrentThreadId () returned 0x970 [0048.271] GetCurrentThreadId () returned 0x970 [0048.271] GetCurrentThreadId () returned 0x970 [0048.271] GetCurrentThreadId () returned 0x970 [0048.271] GetCurrentThreadId () returned 0x970 [0048.271] GetCurrentThreadId () returned 0x970 [0048.271] GetCurrentThreadId () returned 0x970 [0048.271] GetCurrentThreadId () returned 0x970 [0048.271] GetCurrentThreadId () returned 0x970 [0048.271] GetCurrentThreadId () returned 0x970 [0048.271] GetCurrentThreadId () returned 0x970 [0048.271] GetCurrentThreadId () returned 0x970 [0048.271] GetCurrentThreadId () returned 0x970 [0048.271] GetCurrentThreadId () returned 0x970 [0048.271] GetCurrentThreadId () returned 0x970 [0048.271] GetCurrentThreadId () returned 0x970 [0048.271] GetCurrentThreadId () returned 0x970 [0048.271] GetCurrentThreadId () returned 0x970 [0048.271] GetCurrentThreadId () returned 0x970 [0048.271] GetCurrentThreadId () returned 0x970 [0048.271] GetCurrentThreadId () returned 0x970 [0048.271] GetCurrentThreadId () returned 0x970 [0048.271] GetCurrentThreadId () returned 0x970 [0048.272] GetCurrentThreadId () returned 0x970 [0048.272] GetCurrentThreadId () returned 0x970 [0048.272] GetCurrentThreadId () returned 0x970 [0048.272] GetCurrentThreadId () returned 0x970 [0048.272] GetCurrentThreadId () returned 0x970 [0048.272] GetCurrentThreadId () returned 0x970 [0048.272] GetCurrentThreadId () returned 0x970 [0048.272] GetCurrentThreadId () returned 0x970 [0048.272] GetCurrentThreadId () returned 0x970 [0048.272] GetCurrentThreadId () returned 0x970 [0048.272] GetCurrentThreadId () returned 0x970 [0048.272] GetCurrentThreadId () returned 0x970 [0048.272] GetCurrentThreadId () returned 0x970 [0048.272] GetCurrentThreadId () returned 0x970 [0048.272] GetCurrentThreadId () returned 0x970 [0048.272] GetCurrentThreadId () returned 0x970 [0048.272] GetCurrentThreadId () returned 0x970 [0048.272] GetCurrentThreadId () returned 0x970 [0048.272] GetCurrentThreadId () returned 0x970 [0048.272] GetCurrentThreadId () returned 0x970 [0048.272] GetCurrentThreadId () returned 0x970 [0048.272] GetCurrentThreadId () returned 0x970 [0048.272] GetCurrentThreadId () returned 0x970 [0048.272] GetCurrentThreadId () returned 0x970 [0048.272] GetCurrentThreadId () returned 0x970 [0048.272] GetCurrentThreadId () returned 0x970 [0048.272] GetCurrentThreadId () returned 0x970 [0048.272] GetCurrentThreadId () returned 0x970 [0048.272] GetCurrentThreadId () returned 0x970 [0048.272] GetCurrentThreadId () returned 0x970 [0048.272] GetCurrentThreadId () returned 0x970 [0048.272] GetCurrentThreadId () returned 0x970 [0048.272] GetCurrentThreadId () returned 0x970 [0048.272] GetCurrentThreadId () returned 0x970 [0048.272] GetCurrentThreadId () returned 0x970 [0048.272] GetCurrentThreadId () returned 0x970 [0048.272] GetCurrentThreadId () returned 0x970 [0048.272] GetCurrentThreadId () returned 0x970 [0048.272] GetCurrentThreadId () returned 0x970 [0048.272] GetCurrentThreadId () returned 0x970 [0048.272] GetCurrentThreadId () returned 0x970 [0048.272] GetCurrentThreadId () returned 0x970 [0048.272] GetCurrentThreadId () returned 0x970 [0048.272] GetCurrentThreadId () returned 0x970 [0048.272] GetCurrentThreadId () returned 0x970 [0048.272] GetCurrentThreadId () returned 0x970 [0048.272] GetCurrentThreadId () returned 0x970 [0048.273] GetCurrentThreadId () returned 0x970 [0048.273] GetCurrentThreadId () returned 0x970 [0048.273] GetCurrentThreadId () returned 0x970 [0048.273] GetCurrentThreadId () returned 0x970 [0048.273] GetCurrentThreadId () returned 0x970 [0048.273] GetCurrentThreadId () returned 0x970 [0048.273] GetCurrentThreadId () returned 0x970 [0048.273] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.273] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.273] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb190, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.273] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.273] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.273] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb190, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.273] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.273] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.273] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.273] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.273] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.273] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.273] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.273] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.273] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb1f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.273] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.273] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.273] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb1f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.273] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.273] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.273] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb1f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.273] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x37, wMilliseconds=0x23f)) [0048.273] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="oc#=\\x(nH*cSpI{h@0I@\\JMGPJ3!\\EDd", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0048.273] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="oc#=\\x(nH*cSpI{h@0I@\\JMGPJ3!\\EDd", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0048.273] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="oc#=\\x(nH*cSpI{h@0I@\\JMGPJ3!\\EDd", cchWideChar=32, lpMultiByteStr=0x2000718, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oc#=\\x(nH*cSpI{h@0I@\\JMGPJ3!\\EDd", lpUsedDefaultChar=0x0) returned 32 [0048.273] GetCurrentThreadId () returned 0x970 [0048.273] GetCurrentThreadId () returned 0x970 [0048.274] GetCurrentThreadId () returned 0x970 [0048.274] GetCurrentThreadId () returned 0x970 [0048.274] GetCurrentThreadId () returned 0x970 [0048.274] GetCurrentThreadId () returned 0x970 [0048.281] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0048.281] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0048.281] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x202d2e8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0048.281] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x35904f8, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0048.281] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x35904f8, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAADGB1dtfFGij/wNBOTnnkF3m8IuHsggpfvbYsLsqPRLAZfeQqf2I/Sz1G2fBzbg6EPCzoH9/ATHf4tMtJwroj9bFh9KgtmFsJWOwHkSgYOxx8SgXjAAlqijLg6pNFJv2bdcG6ive784iFyHVH99f0QumtAZHbEcs8LrYOUUGf9iS1mvLff0CpqZEpnuDYM+rgpWYHKgeSvJCL4xcK+Cps7x1S5n7Hn5Pqg==") returned 232 [0048.281] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x37, wMilliseconds=0x24e)) [0048.281] GetCurrentThreadId () returned 0x970 [0048.281] GetCurrentThreadId () returned 0x970 [0048.281] GetCurrentThreadId () returned 0x970 [0048.281] GetCurrentThreadId () returned 0x970 [0048.281] GetCurrentThreadId () returned 0x970 [0048.281] GetCurrentThreadId () returned 0x970 [0048.281] GetCurrentThreadId () returned 0x970 [0048.281] GetCurrentThreadId () returned 0x970 [0048.281] GetCurrentThreadId () returned 0x970 [0048.281] GetCurrentThreadId () returned 0x970 [0048.281] GetCurrentThreadId () returned 0x970 [0048.281] GetCurrentThreadId () returned 0x970 [0048.281] GetCurrentThreadId () returned 0x970 [0048.281] GetCurrentThreadId () returned 0x970 [0048.281] GetCurrentThreadId () returned 0x970 [0048.281] GetCurrentThreadId () returned 0x970 [0048.281] GetCurrentThreadId () returned 0x970 [0048.281] GetCurrentThreadId () returned 0x970 [0048.281] GetCurrentThreadId () returned 0x970 [0048.281] GetCurrentThreadId () returned 0x970 [0048.281] GetCurrentThreadId () returned 0x970 [0048.281] GetCurrentThreadId () returned 0x970 [0048.281] GetCurrentThreadId () returned 0x970 [0048.281] GetCurrentThreadId () returned 0x970 [0048.281] GetCurrentThreadId () returned 0x970 [0048.282] GetCurrentThreadId () returned 0x970 [0048.282] GetCurrentThreadId () returned 0x970 [0048.282] GetCurrentThreadId () returned 0x970 [0048.282] GetCurrentThreadId () returned 0x970 [0048.282] GetCurrentThreadId () returned 0x970 [0048.282] GetCurrentThreadId () returned 0x970 [0048.282] GetCurrentThreadId () returned 0x970 [0048.282] GetCurrentThreadId () returned 0x970 [0048.282] GetCurrentThreadId () returned 0x970 [0048.282] GetCurrentThreadId () returned 0x970 [0048.282] GetCurrentThreadId () returned 0x970 [0048.282] GetCurrentThreadId () returned 0x970 [0048.282] GetCurrentThreadId () returned 0x970 [0048.282] GetCurrentThreadId () returned 0x970 [0048.282] GetCurrentThreadId () returned 0x970 [0048.282] GetCurrentThreadId () returned 0x970 [0048.282] GetCurrentThreadId () returned 0x970 [0048.282] GetCurrentThreadId () returned 0x970 [0048.282] GetCurrentThreadId () returned 0x970 [0048.282] GetCurrentThreadId () returned 0x970 [0048.282] GetCurrentThreadId () returned 0x970 [0048.282] GetCurrentThreadId () returned 0x970 [0048.282] GetCurrentThreadId () returned 0x970 [0048.282] GetCurrentThreadId () returned 0x970 [0048.282] GetCurrentThreadId () returned 0x970 [0048.282] GetCurrentThreadId () returned 0x970 [0048.282] GetCurrentThreadId () returned 0x970 [0048.282] GetCurrentThreadId () returned 0x970 [0048.282] GetCurrentThreadId () returned 0x970 [0048.282] GetCurrentThreadId () returned 0x970 [0048.282] GetCurrentThreadId () returned 0x970 [0048.282] GetCurrentThreadId () returned 0x970 [0048.282] GetCurrentThreadId () returned 0x970 [0048.282] GetCurrentThreadId () returned 0x970 [0048.282] GetCurrentThreadId () returned 0x970 [0048.282] GetCurrentThreadId () returned 0x970 [0048.282] GetCurrentThreadId () returned 0x970 [0048.282] GetCurrentThreadId () returned 0x970 [0048.282] GetCurrentThreadId () returned 0x970 [0048.282] GetCurrentThreadId () returned 0x970 [0048.282] GetCurrentThreadId () returned 0x970 [0048.282] GetCurrentThreadId () returned 0x970 [0048.282] GetCurrentThreadId () returned 0x970 [0048.282] GetCurrentThreadId () returned 0x970 [0048.282] GetCurrentThreadId () returned 0x970 [0048.282] GetCurrentThreadId () returned 0x970 [0048.282] GetCurrentThreadId () returned 0x970 [0048.283] GetCurrentThreadId () returned 0x970 [0048.283] GetCurrentThreadId () returned 0x970 [0048.283] GetCurrentThreadId () returned 0x970 [0048.283] GetCurrentThreadId () returned 0x970 [0048.283] GetCurrentThreadId () returned 0x970 [0048.283] GetCurrentThreadId () returned 0x970 [0048.283] GetCurrentThreadId () returned 0x970 [0048.283] GetCurrentThreadId () returned 0x970 [0048.283] GetCurrentThreadId () returned 0x970 [0048.283] GetCurrentThreadId () returned 0x970 [0048.283] GetCurrentThreadId () returned 0x970 [0048.283] GetCurrentThreadId () returned 0x970 [0048.283] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAADGB1dtfFGij/wNBOTnnkF3m8IuHsggpfvbYsLsqPRLAZfeQqf2I/Sz1G2fBzbg6EPCzoH9/ATHf4tMtJwroj9bFh9KgtmFsJWOwHkSgYOxx8SgXjAAlqijLg6pNFJv2bdcG6ive784iFyHVH99f0QumtAZHbEcs8LrYOUUGf9iS1mvLff0CpqZEpnuDYM+rgpWYHKgeSvJCL4xcK+Cps7x1S5n7Hn5Pqg==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0048.283] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAADGB1dtfFGij/wNBOTnnkF3m8IuHsggpfvbYsLsqPRLAZfeQqf2I/Sz1G2fBzbg6EPCzoH9/ATHf4tMtJwroj9bFh9KgtmFsJWOwHkSgYOxx8SgXjAAlqijLg6pNFJv2bdcG6ive784iFyHVH99f0QumtAZHbEcs8LrYOUUGf9iS1mvLff0CpqZEpnuDYM+rgpWYHKgeSvJCL4xcK+Cps7x1S5n7Hn5Pqg==", cchWideChar=245, lpMultiByteStr=0x353900c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAADGB1dtfFGij/wNBOTnnkF3m8IuHsggpfvbYsLsqPRLAZfeQqf2I/Sz1G2fBzbg6EPCzoH9/ATHf4tMtJwroj9bFh9KgtmFsJWOwHkSgYOxx8SgXjAAlqijLg6pNFJv2bdcG6ive784iFyHVH99f0QumtAZHbEcs8LrYOUUGf9iS1mvLff0CpqZEpnuDYM+rgpWYHKgeSvJCL4xcK+Cps7x1S5n7Hn5Pqg==", lpUsedDefaultChar=0x0) returned 245 [0048.283] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0048.283] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0048.283] CloseHandle (hObject=0x158) returned 1 [0048.284] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0048.285] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=16854796150) returned 1 [0048.291] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Файл зашифрован [ProPlusrWW.xml].wannacash .zip" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\Файл зашифрован [proplusrww.xml].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0048.291] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0048.292] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0048.292] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0048.292] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0048.292] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0048.292] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0048.292] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0048.292] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0048.292] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0048.292] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0048.292] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0048.292] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0048.292] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0048.292] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0048.292] SetEndOfFile (hFile=0x158) returned 1 [0048.292] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0048.292] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0048.292] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0048.292] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0048.293] WriteFile (in: hFile=0x158, lpBuffer=0x361f5a8*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x361f5a8*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0048.293] WriteFile (in: hFile=0x158, lpBuffer=0x35f011c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f011c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0048.293] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GaPV~oAo<=&nAzqRMC1}BXN74KRVr5!p", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0048.293] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GaPV~oAo<=&nAzqRMC1}BXN74KRVr5!p", cchWideChar=32, lpMultiByteStr=0x203212c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GaPV~oAo<=&nAzqRMC1}BXN74KRVr5!p", lpUsedDefaultChar=0x0) returned 32 [0048.294] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0048.294] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0048.294] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x41d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPlusrWW.xml", cAlternateFileName="PROPLU~1.XML")) returned 0x295098 [0048.294] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0048.294] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0048.294] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml")) returned 0x2020 [0048.295] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml")) returned 0x2020 [0048.295] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml")) returned 0x2020 [0048.295] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml")) returned 0x2020 [0048.295] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x41d4)) returned 1 [0048.295] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0048.295] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0048.295] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml")) returned 0x2020 [0048.295] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml")) returned 0x2020 [0048.295] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0048.295] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0048.295] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0048.295] SetEndOfFile (hFile=0x158) returned 1 [0048.296] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ProPlusrWW.xml", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0048.296] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ProPlusrWW.xml", cchWideChar=14, lpMultiByteStr=0x1fe386c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ProPlusrWW.xml", lpUsedDefaultChar=0x0) returned 14 [0048.296] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ProPlusrWW.xml", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0048.296] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ProPlusrWW.xml", cchWideChar=14, lpMultiByteStr=0x1fe3a2c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ProPlusrWW.xml", lpUsedDefaultChar=0x0) returned 14 [0048.296] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe3a2c, cbMultiByte=14, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="ProPlusrWW.xmlmll@\x01") returned 14 [0048.296] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ProPlusrWW.xml", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0048.296] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ProPlusrWW.xml", cchWideChar=14, lpMultiByteStr=0x1fe386c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ProPlusrWW.xml", lpUsedDefaultChar=0x0) returned 14 [0048.296] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0048.296] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0048.296] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x41d4 [0048.296] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0048.296] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0048.297] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0048.297] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ProPlusrWW.xml", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0048.297] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ProPlusrWW.xml", cchWideChar=14, lpMultiByteStr=0x1fe386c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ProPlusrWW.xml", lpUsedDefaultChar=0x0) returned 14 [0048.297] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ProPlusrWW.xml", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0048.297] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ProPlusrWW.xml", cchWideChar=14, lpMultiByteStr=0x1fe3a2c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ProPlusrWW.xml", lpUsedDefaultChar=0x0) returned 14 [0048.297] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe3a2c, cbMultiByte=14, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="ProPlusrWW.xmlWW.xmlmll@\x01") returned 14 [0048.297] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ProPlusrWW.xml", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0048.297] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ProPlusrWW.xml", cchWideChar=14, lpMultiByteStr=0x1fe386c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ProPlusrWW.xml", lpUsedDefaultChar=0x0) returned 14 [0048.297] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0048.298] CharToOemA (in: pSrc="ProPlusrWW.xml", pDst=0x1fe3a2c | out: pDst="ProPlusrWW.xml") returned 1 [0048.298] WriteFile (in: hFile=0x158, lpBuffer=0x1fe3a2c*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe3a2c*, lpNumberOfBytesWritten=0x18e048*=0xe, lpOverlapped=0x0) returned 1 [0048.298] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0048.298] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0048.298] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0048.298] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=16856158730) returned 1 [0048.298] ReadFile (in: hFile=0x15c, lpBuffer=0x3500220, nNumberOfBytesToRead=0x41d4, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3500220*, lpNumberOfBytesRead=0x18dd7c*=0x41d4, lpOverlapped=0x0) returned 1 [0048.300] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0048.300] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=16856311628) returned 1 [0048.308] WriteFile (in: hFile=0x158, lpBuffer=0x1fea2d0*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fea2d0*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0048.308] ReadFile (in: hFile=0x15c, lpBuffer=0x3500220, nNumberOfBytesToRead=0x41d4, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3500220*, lpNumberOfBytesRead=0x18de38*=0x41d4, lpOverlapped=0x0) returned 1 [0048.309] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x49 [0048.309] WriteFile (in: hFile=0x158, lpBuffer=0x3825e70*, nNumberOfBytesToWrite=0x41d4, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3825e70*, lpNumberOfBytesWritten=0x18de10*=0x41d4, lpOverlapped=0x0) returned 1 [0048.309] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x421d [0048.309] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0048.309] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0048.309] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0048.309] SetFilePointer (in: hFile=0x158, lDistanceToMove=14, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2c [0048.309] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x4227 [0048.309] CloseHandle (hObject=0x15c) returned 1 [0048.310] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x4227 [0048.310] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x4227 [0048.310] SetFilePointer (in: hFile=0x158, lDistanceToMove=16935, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x4227 [0048.310] SetFilePointer (in: hFile=0x158, lDistanceToMove=16935, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x4227 [0048.310] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x4227 [0048.310] SetFilePointer (in: hFile=0x158, lDistanceToMove=16935, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x4227 [0048.310] SetEndOfFile (hFile=0x158) returned 1 [0048.310] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x4227 [0048.310] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x4227 [0048.310] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ProPlusrWW.xml", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0048.310] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ProPlusrWW.xml", cchWideChar=14, lpMultiByteStr=0x1fe386c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ProPlusrWW.xml", lpUsedDefaultChar=0x0) returned 14 [0048.310] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ProPlusrWW.xml", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0048.310] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ProPlusrWW.xml", cchWideChar=14, lpMultiByteStr=0x1fe3a0c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ProPlusrWW.xml", lpUsedDefaultChar=0x0) returned 14 [0048.310] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe3a0c, cbMultiByte=14, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="ProPlusrWW.xml야'\x18믉`믑`") returned 14 [0048.310] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ProPlusrWW.xml", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0048.310] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ProPlusrWW.xml", cchWideChar=14, lpMultiByteStr=0x1fe386c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ProPlusrWW.xml", lpUsedDefaultChar=0x0) returned 14 [0048.310] WriteFile (in: hFile=0x158, lpBuffer=0x34e3cf8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x34e3cf8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0048.311] CharToOemA (in: pSrc="ProPlusrWW.xml", pDst=0x1fe3a0c | out: pDst="ProPlusrWW.xml") returned 1 [0048.311] WriteFile (in: hFile=0x158, lpBuffer=0x1fe3a0c*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe3a0c*, lpNumberOfBytesWritten=0x18efcc*=0xe, lpOverlapped=0x0) returned 1 [0048.311] WriteFile (in: hFile=0x158, lpBuffer=0x1fea428*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea428*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0048.311] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0048.311] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0048.311] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x426e [0048.311] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x426e [0048.311] WriteFile (in: hFile=0x158, lpBuffer=0x361f5a8*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x361f5a8*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0048.311] WriteFile (in: hFile=0x158, lpBuffer=0x35f011c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f011c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0048.311] DeleteFileW (lpFileName="") returned 0 [0048.311] GetLastError () returned 0x3 [0048.311] GetFileAttributesW (lpFileName="") returned 0xffffffff [0048.311] SetLastError (dwErrCode=0x3) [0048.311] FlushFileBuffers (hFile=0x158) returned 1 [0048.314] GetCurrentThreadId () returned 0x970 [0048.314] GetCurrentThreadId () returned 0x970 [0048.314] GetCurrentThreadId () returned 0x970 [0048.314] GetCurrentThreadId () returned 0x970 [0048.314] GetCurrentThreadId () returned 0x970 [0048.314] GetCurrentThreadId () returned 0x970 [0048.314] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x4325 [0048.314] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x4325 [0048.314] SetFilePointer (in: hFile=0x158, lDistanceToMove=17189, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x4325 [0048.314] CloseHandle (hObject=0x158) returned 1 [0048.315] GetCurrentThreadId () returned 0x970 [0048.315] GetCurrentThreadId () returned 0x970 [0048.315] GetCurrentThreadId () returned 0x970 [0048.315] GetCurrentThreadId () returned 0x970 [0048.315] GetCurrentThreadId () returned 0x970 [0048.315] GetCurrentThreadId () returned 0x970 [0048.315] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Файл зашифрован [ProPlusrWW.xml].wannacash .zip" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\Файл зашифрован [proplusrww.xml].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0048.316] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4325 [0048.316] SetFilePointer (in: hFile=0x158, lDistanceToMove=17061, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42a5 [0048.316] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0048.316] GetFileType (hFile=0x158) returned 0x1 [0048.316] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x37, wMilliseconds=0x26e)) [0048.316] GetCurrentThreadId () returned 0x970 [0048.316] GetCurrentThreadId () returned 0x970 [0048.316] GetCurrentThreadId () returned 0x970 [0048.316] GetCurrentThreadId () returned 0x970 [0048.316] GetCurrentThreadId () returned 0x970 [0048.316] GetCurrentThreadId () returned 0x970 [0048.316] GetCurrentThreadId () returned 0x970 [0048.316] GetCurrentThreadId () returned 0x970 [0048.316] GetCurrentThreadId () returned 0x970 [0048.316] GetCurrentThreadId () returned 0x970 [0048.316] GetCurrentThreadId () returned 0x970 [0048.316] GetCurrentThreadId () returned 0x970 [0048.316] GetCurrentThreadId () returned 0x970 [0048.316] GetCurrentThreadId () returned 0x970 [0048.316] GetCurrentThreadId () returned 0x970 [0048.316] GetCurrentThreadId () returned 0x970 [0048.316] GetCurrentThreadId () returned 0x970 [0048.316] GetCurrentThreadId () returned 0x970 [0048.316] GetCurrentThreadId () returned 0x970 [0048.316] GetCurrentThreadId () returned 0x970 [0048.316] GetCurrentThreadId () returned 0x970 [0048.316] GetCurrentThreadId () returned 0x970 [0048.316] GetCurrentThreadId () returned 0x970 [0048.316] GetCurrentThreadId () returned 0x970 [0048.316] GetCurrentThreadId () returned 0x970 [0048.316] GetCurrentThreadId () returned 0x970 [0048.316] GetCurrentThreadId () returned 0x970 [0048.316] GetCurrentThreadId () returned 0x970 [0048.316] GetCurrentThreadId () returned 0x970 [0048.316] GetCurrentThreadId () returned 0x970 [0048.316] GetCurrentThreadId () returned 0x970 [0048.316] GetCurrentThreadId () returned 0x970 [0048.316] GetCurrentThreadId () returned 0x970 [0048.316] GetCurrentThreadId () returned 0x970 [0048.316] GetCurrentThreadId () returned 0x970 [0048.316] GetCurrentThreadId () returned 0x970 [0048.317] GetCurrentThreadId () returned 0x970 [0048.317] GetCurrentThreadId () returned 0x970 [0048.317] GetCurrentThreadId () returned 0x970 [0048.317] GetCurrentThreadId () returned 0x970 [0048.317] GetCurrentThreadId () returned 0x970 [0048.317] GetCurrentThreadId () returned 0x970 [0048.317] GetCurrentThreadId () returned 0x970 [0048.317] GetCurrentThreadId () returned 0x970 [0048.317] GetCurrentThreadId () returned 0x970 [0048.317] GetCurrentThreadId () returned 0x970 [0048.317] GetCurrentThreadId () returned 0x970 [0048.317] GetCurrentThreadId () returned 0x970 [0048.317] GetCurrentThreadId () returned 0x970 [0048.317] GetCurrentThreadId () returned 0x970 [0048.317] GetCurrentThreadId () returned 0x970 [0048.317] GetCurrentThreadId () returned 0x970 [0048.317] GetCurrentThreadId () returned 0x970 [0048.317] GetCurrentThreadId () returned 0x970 [0048.317] GetCurrentThreadId () returned 0x970 [0048.317] GetCurrentThreadId () returned 0x970 [0048.317] GetCurrentThreadId () returned 0x970 [0048.317] GetCurrentThreadId () returned 0x970 [0048.317] GetCurrentThreadId () returned 0x970 [0048.317] GetCurrentThreadId () returned 0x970 [0048.317] GetCurrentThreadId () returned 0x970 [0048.317] GetCurrentThreadId () returned 0x970 [0048.317] GetCurrentThreadId () returned 0x970 [0048.317] GetCurrentThreadId () returned 0x970 [0048.317] GetCurrentThreadId () returned 0x970 [0048.317] GetCurrentThreadId () returned 0x970 [0048.317] GetCurrentThreadId () returned 0x970 [0048.317] GetCurrentThreadId () returned 0x970 [0048.317] GetCurrentThreadId () returned 0x970 [0048.317] GetCurrentThreadId () returned 0x970 [0048.317] GetCurrentThreadId () returned 0x970 [0048.317] GetCurrentThreadId () returned 0x970 [0048.317] GetCurrentThreadId () returned 0x970 [0048.317] GetCurrentThreadId () returned 0x970 [0048.317] GetCurrentThreadId () returned 0x970 [0048.317] GetCurrentThreadId () returned 0x970 [0048.317] GetCurrentThreadId () returned 0x970 [0048.317] GetCurrentThreadId () returned 0x970 [0048.317] GetCurrentThreadId () returned 0x970 [0048.317] GetCurrentThreadId () returned 0x970 [0048.317] GetCurrentThreadId () returned 0x970 [0048.317] GetCurrentThreadId () returned 0x970 [0048.317] GetCurrentThreadId () returned 0x970 [0048.318] GetCurrentThreadId () returned 0x970 [0048.318] GetCurrentThreadId () returned 0x970 [0048.318] GetCurrentThreadId () returned 0x970 [0048.318] GetCurrentThreadId () returned 0x970 [0048.318] GetCurrentThreadId () returned 0x970 [0048.318] GetCurrentThreadId () returned 0x970 [0048.318] GetCurrentThreadId () returned 0x970 [0048.318] GetCurrentThreadId () returned 0x970 [0048.318] GetCurrentThreadId () returned 0x970 [0048.318] GetCurrentThreadId () returned 0x970 [0048.318] GetCurrentThreadId () returned 0x970 [0048.318] GetCurrentThreadId () returned 0x970 [0048.318] GetCurrentThreadId () returned 0x970 [0048.318] GetCurrentThreadId () returned 0x970 [0048.318] GetCurrentThreadId () returned 0x970 [0048.318] GetCurrentThreadId () returned 0x970 [0048.318] GetCurrentThreadId () returned 0x970 [0048.318] GetCurrentThreadId () returned 0x970 [0048.318] GetCurrentThreadId () returned 0x970 [0048.318] GetCurrentThreadId () returned 0x970 [0048.318] GetCurrentThreadId () returned 0x970 [0048.318] GetCurrentThreadId () returned 0x970 [0048.318] GetCurrentThreadId () returned 0x970 [0048.318] GetCurrentThreadId () returned 0x970 [0048.318] GetCurrentThreadId () returned 0x970 [0048.318] GetCurrentThreadId () returned 0x970 [0048.318] GetCurrentThreadId () returned 0x970 [0048.318] GetCurrentThreadId () returned 0x970 [0048.318] GetCurrentThreadId () returned 0x970 [0048.318] GetCurrentThreadId () returned 0x970 [0048.318] GetCurrentThreadId () returned 0x970 [0048.318] GetCurrentThreadId () returned 0x970 [0048.318] GetCurrentThreadId () returned 0x970 [0048.318] GetCurrentThreadId () returned 0x970 [0048.318] GetCurrentThreadId () returned 0x970 [0048.318] GetCurrentThreadId () returned 0x970 [0048.318] GetCurrentThreadId () returned 0x970 [0048.318] GetCurrentThreadId () returned 0x970 [0048.318] GetCurrentThreadId () returned 0x970 [0048.318] GetCurrentThreadId () returned 0x970 [0048.318] GetCurrentThreadId () returned 0x970 [0048.318] GetCurrentThreadId () returned 0x970 [0048.318] GetCurrentThreadId () returned 0x970 [0048.318] GetCurrentThreadId () returned 0x970 [0048.318] GetCurrentThreadId () returned 0x970 [0048.318] GetCurrentThreadId () returned 0x970 [0048.318] GetCurrentThreadId () returned 0x970 [0048.319] GetCurrentThreadId () returned 0x970 [0048.319] GetCurrentThreadId () returned 0x970 [0048.319] GetCurrentThreadId () returned 0x970 [0048.319] GetCurrentThreadId () returned 0x970 [0048.319] GetCurrentThreadId () returned 0x970 [0048.319] GetCurrentThreadId () returned 0x970 [0048.319] GetCurrentThreadId () returned 0x970 [0048.319] GetCurrentThreadId () returned 0x970 [0048.319] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.319] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.319] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb1f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.319] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.319] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.319] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb1f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.319] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.319] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.319] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.319] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.319] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.319] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.319] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.319] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.319] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb250, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.319] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.319] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.319] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb250, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.319] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.319] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.319] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb250, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.319] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x37, wMilliseconds=0x26e)) [0048.319] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GaPV~oAo<=&nAzqRMC1}BXN74KRVr5!p", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0048.319] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GaPV~oAo<=&nAzqRMC1}BXN74KRVr5!p", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0048.319] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GaPV~oAo<=&nAzqRMC1}BXN74KRVr5!p", cchWideChar=32, lpMultiByteStr=0x2000748, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GaPV~oAo<=&nAzqRMC1}BXN74KRVr5!p", lpUsedDefaultChar=0x0) returned 32 [0048.319] GetCurrentThreadId () returned 0x970 [0048.320] GetCurrentThreadId () returned 0x970 [0048.320] GetCurrentThreadId () returned 0x970 [0048.320] GetCurrentThreadId () returned 0x970 [0048.320] GetCurrentThreadId () returned 0x970 [0048.320] GetCurrentThreadId () returned 0x970 [0048.327] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0048.327] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0048.327] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x202d3d8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0048.327] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x35904f8, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0048.327] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x35904f8, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAHyhow/bKNR85xTl6+0ZjJUOzYKEdUMJnX46DuAKBnKXinM8JD9lzkHHF80k8zWqZbTLpiauJ9w2FHJLQTv2e7zg/YOd4IVN582UzPVtnBy+WLjtY/+EQE/oUas4d072xtsM5EjGlH+d1aROZWH0k8FoMjqeGqWRChhDoTA7ONOcxIr5P79S7CqkE6reOIRPOP+UHrOPZVHn2mSb7PTvAwALYf8M8QVNgA==") returned 232 [0048.327] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x37, wMilliseconds=0x27d)) [0048.327] GetCurrentThreadId () returned 0x970 [0048.327] GetCurrentThreadId () returned 0x970 [0048.327] GetCurrentThreadId () returned 0x970 [0048.327] GetCurrentThreadId () returned 0x970 [0048.327] GetCurrentThreadId () returned 0x970 [0048.327] GetCurrentThreadId () returned 0x970 [0048.327] GetCurrentThreadId () returned 0x970 [0048.327] GetCurrentThreadId () returned 0x970 [0048.327] GetCurrentThreadId () returned 0x970 [0048.327] GetCurrentThreadId () returned 0x970 [0048.327] GetCurrentThreadId () returned 0x970 [0048.327] GetCurrentThreadId () returned 0x970 [0048.327] GetCurrentThreadId () returned 0x970 [0048.327] GetCurrentThreadId () returned 0x970 [0048.327] GetCurrentThreadId () returned 0x970 [0048.327] GetCurrentThreadId () returned 0x970 [0048.328] GetCurrentThreadId () returned 0x970 [0048.328] GetCurrentThreadId () returned 0x970 [0048.328] GetCurrentThreadId () returned 0x970 [0048.328] GetCurrentThreadId () returned 0x970 [0048.328] GetCurrentThreadId () returned 0x970 [0048.328] GetCurrentThreadId () returned 0x970 [0048.328] GetCurrentThreadId () returned 0x970 [0048.328] GetCurrentThreadId () returned 0x970 [0048.328] GetCurrentThreadId () returned 0x970 [0048.328] GetCurrentThreadId () returned 0x970 [0048.328] GetCurrentThreadId () returned 0x970 [0048.328] GetCurrentThreadId () returned 0x970 [0048.328] GetCurrentThreadId () returned 0x970 [0048.328] GetCurrentThreadId () returned 0x970 [0048.328] GetCurrentThreadId () returned 0x970 [0048.328] GetCurrentThreadId () returned 0x970 [0048.328] GetCurrentThreadId () returned 0x970 [0048.328] GetCurrentThreadId () returned 0x970 [0048.328] GetCurrentThreadId () returned 0x970 [0048.328] GetCurrentThreadId () returned 0x970 [0048.328] GetCurrentThreadId () returned 0x970 [0048.328] GetCurrentThreadId () returned 0x970 [0048.328] GetCurrentThreadId () returned 0x970 [0048.328] GetCurrentThreadId () returned 0x970 [0048.328] GetCurrentThreadId () returned 0x970 [0048.328] GetCurrentThreadId () returned 0x970 [0048.328] GetCurrentThreadId () returned 0x970 [0048.328] GetCurrentThreadId () returned 0x970 [0048.328] GetCurrentThreadId () returned 0x970 [0048.328] GetCurrentThreadId () returned 0x970 [0048.328] GetCurrentThreadId () returned 0x970 [0048.328] GetCurrentThreadId () returned 0x970 [0048.328] GetCurrentThreadId () returned 0x970 [0048.328] GetCurrentThreadId () returned 0x970 [0048.328] GetCurrentThreadId () returned 0x970 [0048.328] GetCurrentThreadId () returned 0x970 [0048.328] GetCurrentThreadId () returned 0x970 [0048.328] GetCurrentThreadId () returned 0x970 [0048.328] GetCurrentThreadId () returned 0x970 [0048.328] GetCurrentThreadId () returned 0x970 [0048.328] GetCurrentThreadId () returned 0x970 [0048.328] GetCurrentThreadId () returned 0x970 [0048.328] GetCurrentThreadId () returned 0x970 [0048.328] GetCurrentThreadId () returned 0x970 [0048.328] GetCurrentThreadId () returned 0x970 [0048.328] GetCurrentThreadId () returned 0x970 [0048.328] GetCurrentThreadId () returned 0x970 [0048.329] GetCurrentThreadId () returned 0x970 [0048.329] GetCurrentThreadId () returned 0x970 [0048.329] GetCurrentThreadId () returned 0x970 [0048.329] GetCurrentThreadId () returned 0x970 [0048.329] GetCurrentThreadId () returned 0x970 [0048.329] GetCurrentThreadId () returned 0x970 [0048.329] GetCurrentThreadId () returned 0x970 [0048.329] GetCurrentThreadId () returned 0x970 [0048.329] GetCurrentThreadId () returned 0x970 [0048.329] GetCurrentThreadId () returned 0x970 [0048.329] GetCurrentThreadId () returned 0x970 [0048.329] GetCurrentThreadId () returned 0x970 [0048.329] GetCurrentThreadId () returned 0x970 [0048.329] GetCurrentThreadId () returned 0x970 [0048.329] GetCurrentThreadId () returned 0x970 [0048.329] GetCurrentThreadId () returned 0x970 [0048.329] GetCurrentThreadId () returned 0x970 [0048.329] GetCurrentThreadId () returned 0x970 [0048.329] GetCurrentThreadId () returned 0x970 [0048.329] GetCurrentThreadId () returned 0x970 [0048.329] GetCurrentThreadId () returned 0x970 [0048.329] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAHyhow/bKNR85xTl6+0ZjJUOzYKEdUMJnX46DuAKBnKXinM8JD9lzkHHF80k8zWqZbTLpiauJ9w2FHJLQTv2e7zg/YOd4IVN582UzPVtnBy+WLjtY/+EQE/oUas4d072xtsM5EjGlH+d1aROZWH0k8FoMjqeGqWRChhDoTA7ONOcxIr5P79S7CqkE6reOIRPOP+UHrOPZVHn2mSb7PTvAwALYf8M8QVNgA==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0048.329] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAHyhow/bKNR85xTl6+0ZjJUOzYKEdUMJnX46DuAKBnKXinM8JD9lzkHHF80k8zWqZbTLpiauJ9w2FHJLQTv2e7zg/YOd4IVN582UzPVtnBy+WLjtY/+EQE/oUas4d072xtsM5EjGlH+d1aROZWH0k8FoMjqeGqWRChhDoTA7ONOcxIr5P79S7CqkE6reOIRPOP+UHrOPZVHn2mSb7PTvAwALYf8M8QVNgA==", cchWideChar=245, lpMultiByteStr=0x353900c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAHyhow/bKNR85xTl6+0ZjJUOzYKEdUMJnX46DuAKBnKXinM8JD9lzkHHF80k8zWqZbTLpiauJ9w2FHJLQTv2e7zg/YOd4IVN582UzPVtnBy+WLjtY/+EQE/oUas4d072xtsM5EjGlH+d1aROZWH0k8FoMjqeGqWRChhDoTA7ONOcxIr5P79S7CqkE6reOIRPOP+UHrOPZVHn2mSb7PTvAwALYf8M8QVNgA==", lpUsedDefaultChar=0x0) returned 245 [0048.329] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0048.329] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0048.329] CloseHandle (hObject=0x158) returned 1 [0048.330] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml")) returned 1 [0048.331] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=16859425067) returned 1 [0048.331] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Файл зашифрован [Setup.xml].wannacash .zip" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\Файл зашифрован [setup.xml].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0048.331] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0048.331] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0048.331] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0048.331] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0048.331] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0048.331] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0048.331] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0048.332] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0048.332] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0048.332] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0048.332] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0048.332] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0048.332] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0048.332] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0048.332] SetEndOfFile (hFile=0x158) returned 1 [0048.332] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0048.332] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0048.332] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0048.332] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0048.332] WriteFile (in: hFile=0x158, lpBuffer=0x361f5a8*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x361f5a8*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0048.333] WriteFile (in: hFile=0x158, lpBuffer=0x35f005c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f005c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0048.333] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="hS,gE,P2HAt-Q5,S6b#f3vBJiX?b}&c^", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0048.333] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="hS,gE,P2HAt-Q5,S6b#f3vBJiX?b}&c^", cchWideChar=32, lpMultiByteStr=0x203220c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hS,gE,P2HAt-Q5,S6b#f3vBJiX?b}&c^", lpUsedDefaultChar=0x0) returned 32 [0048.333] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0048.333] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0048.333] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0x295098 [0048.333] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0048.333] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0048.333] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0048.334] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0048.334] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0048.334] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0048.334] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976)) returned 1 [0048.334] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0048.334] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0048.334] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0048.334] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0048.334] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0048.334] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0048.334] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0048.334] SetEndOfFile (hFile=0x158) returned 1 [0048.335] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0048.335] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x1fe36ec, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0048.335] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0048.335] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x1fe3a4c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0048.335] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe3a4c, cbMultiByte=9, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="Setup.xmlW.xmlmll@\x01") returned 9 [0048.335] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0048.335] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x1fe36ec, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0048.335] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0048.335] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0048.335] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x7976 [0048.336] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0048.336] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0048.336] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0048.336] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0048.336] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x1fe36ec, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0048.336] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0048.336] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x1fe3a4c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0048.336] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe3a4c, cbMultiByte=9, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="Setup.xmlup.xmlW.xmlmll@\x01") returned 9 [0048.336] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0048.336] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x1fe36ec, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0048.336] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0048.337] CharToOemA (in: pSrc="Setup.xml", pDst=0x1fe3a4c | out: pDst="Setup.xml") returned 1 [0048.337] WriteFile (in: hFile=0x158, lpBuffer=0x1fe3a4c*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe3a4c*, lpNumberOfBytesWritten=0x18e048*=0x9, lpOverlapped=0x0) returned 1 [0048.337] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0048.337] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0048.337] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0048.337] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=16860060752) returned 1 [0048.337] ReadFile (in: hFile=0x15c, lpBuffer=0x37e5db0, nNumberOfBytesToRead=0x7976, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37e5db0*, lpNumberOfBytesRead=0x18dd7c*=0x7976, lpOverlapped=0x0) returned 1 [0048.339] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0048.339] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=16860225651) returned 1 [0048.347] WriteFile (in: hFile=0x158, lpBuffer=0x1fea210*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fea210*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0048.347] ReadFile (in: hFile=0x15c, lpBuffer=0x37e5db0, nNumberOfBytesToRead=0x7976, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x37e5db0*, lpNumberOfBytesRead=0x18de38*=0x7976, lpOverlapped=0x0) returned 1 [0048.348] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x44 [0048.348] WriteFile (in: hFile=0x158, lpBuffer=0x382d8a0*, nNumberOfBytesToWrite=0x7976, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x382d8a0*, lpNumberOfBytesWritten=0x18de10*=0x7976, lpOverlapped=0x0) returned 1 [0048.349] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x79ba [0048.349] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0048.349] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0048.349] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0048.349] SetFilePointer (in: hFile=0x158, lDistanceToMove=9, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x27 [0048.349] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x79c4 [0048.349] CloseHandle (hObject=0x15c) returned 1 [0048.349] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x79c4 [0048.349] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x79c4 [0048.350] SetFilePointer (in: hFile=0x158, lDistanceToMove=31172, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x79c4 [0048.350] SetFilePointer (in: hFile=0x158, lDistanceToMove=31172, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x79c4 [0048.350] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x79c4 [0048.350] SetFilePointer (in: hFile=0x158, lDistanceToMove=31172, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x79c4 [0048.350] SetEndOfFile (hFile=0x158) returned 1 [0048.350] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x79c4 [0048.350] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x79c4 [0048.350] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0048.350] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x1fe36ec, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0048.350] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0048.350] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x1fe3b8c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0048.350] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe3b8c, cbMultiByte=9, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="Setup.xml") returned 9 [0048.350] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0048.350] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x1fe36ec, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0048.350] WriteFile (in: hFile=0x158, lpBuffer=0x34e3cf8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x34e3cf8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0048.350] CharToOemA (in: pSrc="Setup.xml", pDst=0x1fe3b8c | out: pDst="Setup.xml") returned 1 [0048.350] WriteFile (in: hFile=0x158, lpBuffer=0x1fe3b8c*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe3b8c*, lpNumberOfBytesWritten=0x18efcc*=0x9, lpOverlapped=0x0) returned 1 [0048.351] WriteFile (in: hFile=0x158, lpBuffer=0x1fea260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea260*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0048.351] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0048.351] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0048.351] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x7a06 [0048.351] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x7a06 [0048.351] WriteFile (in: hFile=0x158, lpBuffer=0x361f5a8*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x361f5a8*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0048.351] WriteFile (in: hFile=0x158, lpBuffer=0x35f005c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f005c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0048.351] DeleteFileW (lpFileName="") returned 0 [0048.351] GetLastError () returned 0x3 [0048.351] GetFileAttributesW (lpFileName="") returned 0xffffffff [0048.351] SetLastError (dwErrCode=0x3) [0048.351] FlushFileBuffers (hFile=0x158) returned 1 [0048.354] GetCurrentThreadId () returned 0x970 [0048.354] GetCurrentThreadId () returned 0x970 [0048.354] GetCurrentThreadId () returned 0x970 [0048.354] GetCurrentThreadId () returned 0x970 [0048.354] GetCurrentThreadId () returned 0x970 [0048.354] GetCurrentThreadId () returned 0x970 [0048.354] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x7abd [0048.354] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x7abd [0048.354] SetFilePointer (in: hFile=0x158, lDistanceToMove=31421, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x7abd [0048.354] CloseHandle (hObject=0x158) returned 1 [0048.355] GetCurrentThreadId () returned 0x970 [0048.355] GetCurrentThreadId () returned 0x970 [0048.355] GetCurrentThreadId () returned 0x970 [0048.355] GetCurrentThreadId () returned 0x970 [0048.355] GetCurrentThreadId () returned 0x970 [0048.355] GetCurrentThreadId () returned 0x970 [0048.355] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Файл зашифрован [Setup.xml].wannacash .zip" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\Файл зашифрован [setup.xml].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0048.355] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7abd [0048.355] SetFilePointer (in: hFile=0x158, lDistanceToMove=31293, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7a3d [0048.355] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0048.355] GetFileType (hFile=0x158) returned 0x1 [0048.355] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x37, wMilliseconds=0x28d)) [0048.355] GetCurrentThreadId () returned 0x970 [0048.355] GetCurrentThreadId () returned 0x970 [0048.355] GetCurrentThreadId () returned 0x970 [0048.355] GetCurrentThreadId () returned 0x970 [0048.355] GetCurrentThreadId () returned 0x970 [0048.355] GetCurrentThreadId () returned 0x970 [0048.355] GetCurrentThreadId () returned 0x970 [0048.355] GetCurrentThreadId () returned 0x970 [0048.355] GetCurrentThreadId () returned 0x970 [0048.355] GetCurrentThreadId () returned 0x970 [0048.355] GetCurrentThreadId () returned 0x970 [0048.356] GetCurrentThreadId () returned 0x970 [0048.356] GetCurrentThreadId () returned 0x970 [0048.356] GetCurrentThreadId () returned 0x970 [0048.356] GetCurrentThreadId () returned 0x970 [0048.356] GetCurrentThreadId () returned 0x970 [0048.356] GetCurrentThreadId () returned 0x970 [0048.356] GetCurrentThreadId () returned 0x970 [0048.356] GetCurrentThreadId () returned 0x970 [0048.356] GetCurrentThreadId () returned 0x970 [0048.356] GetCurrentThreadId () returned 0x970 [0048.356] GetCurrentThreadId () returned 0x970 [0048.356] GetCurrentThreadId () returned 0x970 [0048.356] GetCurrentThreadId () returned 0x970 [0048.356] GetCurrentThreadId () returned 0x970 [0048.356] GetCurrentThreadId () returned 0x970 [0048.356] GetCurrentThreadId () returned 0x970 [0048.356] GetCurrentThreadId () returned 0x970 [0048.356] GetCurrentThreadId () returned 0x970 [0048.356] GetCurrentThreadId () returned 0x970 [0048.356] GetCurrentThreadId () returned 0x970 [0048.356] GetCurrentThreadId () returned 0x970 [0048.356] GetCurrentThreadId () returned 0x970 [0048.356] GetCurrentThreadId () returned 0x970 [0048.356] GetCurrentThreadId () returned 0x970 [0048.356] GetCurrentThreadId () returned 0x970 [0048.356] GetCurrentThreadId () returned 0x970 [0048.356] GetCurrentThreadId () returned 0x970 [0048.356] GetCurrentThreadId () returned 0x970 [0048.356] GetCurrentThreadId () returned 0x970 [0048.356] GetCurrentThreadId () returned 0x970 [0048.356] GetCurrentThreadId () returned 0x970 [0048.356] GetCurrentThreadId () returned 0x970 [0048.356] GetCurrentThreadId () returned 0x970 [0048.356] GetCurrentThreadId () returned 0x970 [0048.356] GetCurrentThreadId () returned 0x970 [0048.356] GetCurrentThreadId () returned 0x970 [0048.356] GetCurrentThreadId () returned 0x970 [0048.356] GetCurrentThreadId () returned 0x970 [0048.356] GetCurrentThreadId () returned 0x970 [0048.356] GetCurrentThreadId () returned 0x970 [0048.356] GetCurrentThreadId () returned 0x970 [0048.356] GetCurrentThreadId () returned 0x970 [0048.356] GetCurrentThreadId () returned 0x970 [0048.356] GetCurrentThreadId () returned 0x970 [0048.356] GetCurrentThreadId () returned 0x970 [0048.356] GetCurrentThreadId () returned 0x970 [0048.356] GetCurrentThreadId () returned 0x970 [0048.356] GetCurrentThreadId () returned 0x970 [0048.357] GetCurrentThreadId () returned 0x970 [0048.357] GetCurrentThreadId () returned 0x970 [0048.357] GetCurrentThreadId () returned 0x970 [0048.357] GetCurrentThreadId () returned 0x970 [0048.357] GetCurrentThreadId () returned 0x970 [0048.357] GetCurrentThreadId () returned 0x970 [0048.357] GetCurrentThreadId () returned 0x970 [0048.357] GetCurrentThreadId () returned 0x970 [0048.357] GetCurrentThreadId () returned 0x970 [0048.357] GetCurrentThreadId () returned 0x970 [0048.357] GetCurrentThreadId () returned 0x970 [0048.357] GetCurrentThreadId () returned 0x970 [0048.357] GetCurrentThreadId () returned 0x970 [0048.357] GetCurrentThreadId () returned 0x970 [0048.357] GetCurrentThreadId () returned 0x970 [0048.357] GetCurrentThreadId () returned 0x970 [0048.357] GetCurrentThreadId () returned 0x970 [0048.357] GetCurrentThreadId () returned 0x970 [0048.357] GetCurrentThreadId () returned 0x970 [0048.357] GetCurrentThreadId () returned 0x970 [0048.357] GetCurrentThreadId () returned 0x970 [0048.357] GetCurrentThreadId () returned 0x970 [0048.357] GetCurrentThreadId () returned 0x970 [0048.357] GetCurrentThreadId () returned 0x970 [0048.357] GetCurrentThreadId () returned 0x970 [0048.357] GetCurrentThreadId () returned 0x970 [0048.357] GetCurrentThreadId () returned 0x970 [0048.357] GetCurrentThreadId () returned 0x970 [0048.357] GetCurrentThreadId () returned 0x970 [0048.357] GetCurrentThreadId () returned 0x970 [0048.357] GetCurrentThreadId () returned 0x970 [0048.357] GetCurrentThreadId () returned 0x970 [0048.357] GetCurrentThreadId () returned 0x970 [0048.357] GetCurrentThreadId () returned 0x970 [0048.357] GetCurrentThreadId () returned 0x970 [0048.357] GetCurrentThreadId () returned 0x970 [0048.357] GetCurrentThreadId () returned 0x970 [0048.357] GetCurrentThreadId () returned 0x970 [0048.357] GetCurrentThreadId () returned 0x970 [0048.357] GetCurrentThreadId () returned 0x970 [0048.357] GetCurrentThreadId () returned 0x970 [0048.357] GetCurrentThreadId () returned 0x970 [0048.357] GetCurrentThreadId () returned 0x970 [0048.357] GetCurrentThreadId () returned 0x970 [0048.357] GetCurrentThreadId () returned 0x970 [0048.357] GetCurrentThreadId () returned 0x970 [0048.357] GetCurrentThreadId () returned 0x970 [0048.358] GetCurrentThreadId () returned 0x970 [0048.358] GetCurrentThreadId () returned 0x970 [0048.358] GetCurrentThreadId () returned 0x970 [0048.358] GetCurrentThreadId () returned 0x970 [0048.358] GetCurrentThreadId () returned 0x970 [0048.358] GetCurrentThreadId () returned 0x970 [0048.358] GetCurrentThreadId () returned 0x970 [0048.358] GetCurrentThreadId () returned 0x970 [0048.358] GetCurrentThreadId () returned 0x970 [0048.358] GetCurrentThreadId () returned 0x970 [0048.358] GetCurrentThreadId () returned 0x970 [0048.358] GetCurrentThreadId () returned 0x970 [0048.358] GetCurrentThreadId () returned 0x970 [0048.358] GetCurrentThreadId () returned 0x970 [0048.358] GetCurrentThreadId () returned 0x970 [0048.358] GetCurrentThreadId () returned 0x970 [0048.358] GetCurrentThreadId () returned 0x970 [0048.358] GetCurrentThreadId () returned 0x970 [0048.358] GetCurrentThreadId () returned 0x970 [0048.358] GetCurrentThreadId () returned 0x970 [0048.358] GetCurrentThreadId () returned 0x970 [0048.358] GetCurrentThreadId () returned 0x970 [0048.358] GetCurrentThreadId () returned 0x970 [0048.358] GetCurrentThreadId () returned 0x970 [0048.358] GetCurrentThreadId () returned 0x970 [0048.358] GetCurrentThreadId () returned 0x970 [0048.358] GetCurrentThreadId () returned 0x970 [0048.358] GetCurrentThreadId () returned 0x970 [0048.358] GetCurrentThreadId () returned 0x970 [0048.358] GetCurrentThreadId () returned 0x970 [0048.358] GetCurrentThreadId () returned 0x970 [0048.358] GetCurrentThreadId () returned 0x970 [0048.358] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.358] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.358] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb250, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.358] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.358] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.358] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb250, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.358] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.358] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.358] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.359] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.359] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.359] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.359] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.359] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.359] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb2b0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.359] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.359] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.359] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb2b0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.359] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.359] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.359] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb2b0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.359] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x37, wMilliseconds=0x29c)) [0048.359] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hS,gE,P2HAt-Q5,S6b#f3vBJiX?b}&c^", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0048.359] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hS,gE,P2HAt-Q5,S6b#f3vBJiX?b}&c^", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0048.359] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hS,gE,P2HAt-Q5,S6b#f3vBJiX?b}&c^", cchWideChar=32, lpMultiByteStr=0x2000508, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hS,gE,P2HAt-Q5,S6b#f3vBJiX?b}&c^", lpUsedDefaultChar=0x0) returned 32 [0048.359] GetCurrentThreadId () returned 0x970 [0048.359] GetCurrentThreadId () returned 0x970 [0048.359] GetCurrentThreadId () returned 0x970 [0048.359] GetCurrentThreadId () returned 0x970 [0048.359] GetCurrentThreadId () returned 0x970 [0048.359] GetCurrentThreadId () returned 0x970 [0048.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0048.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0048.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x202d4c8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0048.366] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x35904f8, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0048.366] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x35904f8, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAABQ6fhWPj9rYzOgXlOs512YU6xxAwOAIGSjxtliRBGsTiyztIfdwX0KW5hUG6mmKO3j8HhcMK1DWC6zmIbA9RFqogPCZe1oPrElDGLovbjRV3Eq5wyovYxjQb4sAUpu/GJ5NNJettRxHuLJRZEtw0LHpp4v8MxoKCmtk95XglZCDwfmBKhyMbquF1rUN1OMy49YgtM86LpVv1C/a4K+f5X764BsTl1NWHQ==") returned 232 [0048.366] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x37, wMilliseconds=0x29c)) [0048.366] GetCurrentThreadId () returned 0x970 [0048.367] GetCurrentThreadId () returned 0x970 [0048.367] GetCurrentThreadId () returned 0x970 [0048.367] GetCurrentThreadId () returned 0x970 [0048.367] GetCurrentThreadId () returned 0x970 [0048.367] GetCurrentThreadId () returned 0x970 [0048.367] GetCurrentThreadId () returned 0x970 [0048.367] GetCurrentThreadId () returned 0x970 [0048.367] GetCurrentThreadId () returned 0x970 [0048.367] GetCurrentThreadId () returned 0x970 [0048.367] GetCurrentThreadId () returned 0x970 [0048.367] GetCurrentThreadId () returned 0x970 [0048.367] GetCurrentThreadId () returned 0x970 [0048.367] GetCurrentThreadId () returned 0x970 [0048.367] GetCurrentThreadId () returned 0x970 [0048.367] GetCurrentThreadId () returned 0x970 [0048.367] GetCurrentThreadId () returned 0x970 [0048.367] GetCurrentThreadId () returned 0x970 [0048.367] GetCurrentThreadId () returned 0x970 [0048.367] GetCurrentThreadId () returned 0x970 [0048.367] GetCurrentThreadId () returned 0x970 [0048.367] GetCurrentThreadId () returned 0x970 [0048.367] GetCurrentThreadId () returned 0x970 [0048.367] GetCurrentThreadId () returned 0x970 [0048.367] GetCurrentThreadId () returned 0x970 [0048.367] GetCurrentThreadId () returned 0x970 [0048.367] GetCurrentThreadId () returned 0x970 [0048.367] GetCurrentThreadId () returned 0x970 [0048.367] GetCurrentThreadId () returned 0x970 [0048.367] GetCurrentThreadId () returned 0x970 [0048.367] GetCurrentThreadId () returned 0x970 [0048.367] GetCurrentThreadId () returned 0x970 [0048.367] GetCurrentThreadId () returned 0x970 [0048.367] GetCurrentThreadId () returned 0x970 [0048.367] GetCurrentThreadId () returned 0x970 [0048.367] GetCurrentThreadId () returned 0x970 [0048.367] GetCurrentThreadId () returned 0x970 [0048.367] GetCurrentThreadId () returned 0x970 [0048.367] GetCurrentThreadId () returned 0x970 [0048.367] GetCurrentThreadId () returned 0x970 [0048.367] GetCurrentThreadId () returned 0x970 [0048.367] GetCurrentThreadId () returned 0x970 [0048.367] GetCurrentThreadId () returned 0x970 [0048.367] GetCurrentThreadId () returned 0x970 [0048.367] GetCurrentThreadId () returned 0x970 [0048.367] GetCurrentThreadId () returned 0x970 [0048.367] GetCurrentThreadId () returned 0x970 [0048.367] GetCurrentThreadId () returned 0x970 [0048.367] GetCurrentThreadId () returned 0x970 [0048.367] GetCurrentThreadId () returned 0x970 [0048.368] GetCurrentThreadId () returned 0x970 [0048.368] GetCurrentThreadId () returned 0x970 [0048.368] GetCurrentThreadId () returned 0x970 [0048.368] GetCurrentThreadId () returned 0x970 [0048.368] GetCurrentThreadId () returned 0x970 [0048.368] GetCurrentThreadId () returned 0x970 [0048.368] GetCurrentThreadId () returned 0x970 [0048.368] GetCurrentThreadId () returned 0x970 [0048.368] GetCurrentThreadId () returned 0x970 [0048.368] GetCurrentThreadId () returned 0x970 [0048.368] GetCurrentThreadId () returned 0x970 [0048.368] GetCurrentThreadId () returned 0x970 [0048.368] GetCurrentThreadId () returned 0x970 [0048.368] GetCurrentThreadId () returned 0x970 [0048.368] GetCurrentThreadId () returned 0x970 [0048.368] GetCurrentThreadId () returned 0x970 [0048.368] GetCurrentThreadId () returned 0x970 [0048.368] GetCurrentThreadId () returned 0x970 [0048.368] GetCurrentThreadId () returned 0x970 [0048.368] GetCurrentThreadId () returned 0x970 [0048.368] GetCurrentThreadId () returned 0x970 [0048.368] GetCurrentThreadId () returned 0x970 [0048.368] GetCurrentThreadId () returned 0x970 [0048.368] GetCurrentThreadId () returned 0x970 [0048.368] GetCurrentThreadId () returned 0x970 [0048.368] GetCurrentThreadId () returned 0x970 [0048.368] GetCurrentThreadId () returned 0x970 [0048.368] GetCurrentThreadId () returned 0x970 [0048.368] GetCurrentThreadId () returned 0x970 [0048.368] GetCurrentThreadId () returned 0x970 [0048.368] GetCurrentThreadId () returned 0x970 [0048.368] GetCurrentThreadId () returned 0x970 [0048.368] GetCurrentThreadId () returned 0x970 [0048.368] GetCurrentThreadId () returned 0x970 [0048.368] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAABQ6fhWPj9rYzOgXlOs512YU6xxAwOAIGSjxtliRBGsTiyztIfdwX0KW5hUG6mmKO3j8HhcMK1DWC6zmIbA9RFqogPCZe1oPrElDGLovbjRV3Eq5wyovYxjQb4sAUpu/GJ5NNJettRxHuLJRZEtw0LHpp4v8MxoKCmtk95XglZCDwfmBKhyMbquF1rUN1OMy49YgtM86LpVv1C/a4K+f5X764BsTl1NWHQ==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0048.368] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAABQ6fhWPj9rYzOgXlOs512YU6xxAwOAIGSjxtliRBGsTiyztIfdwX0KW5hUG6mmKO3j8HhcMK1DWC6zmIbA9RFqogPCZe1oPrElDGLovbjRV3Eq5wyovYxjQb4sAUpu/GJ5NNJettRxHuLJRZEtw0LHpp4v8MxoKCmtk95XglZCDwfmBKhyMbquF1rUN1OMy49YgtM86LpVv1C/a4K+f5X764BsTl1NWHQ==", cchWideChar=245, lpMultiByteStr=0x353900c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAABQ6fhWPj9rYzOgXlOs512YU6xxAwOAIGSjxtliRBGsTiyztIfdwX0KW5hUG6mmKO3j8HhcMK1DWC6zmIbA9RFqogPCZe1oPrElDGLovbjRV3Eq5wyovYxjQb4sAUpu/GJ5NNJettRxHuLJRZEtw0LHpp4v8MxoKCmtk95XglZCDwfmBKhyMbquF1rUN1OMy49YgtM86LpVv1C/a4K+f5X764BsTl1NWHQ==", lpUsedDefaultChar=0x0) returned 245 [0048.368] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0048.369] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0048.369] CloseHandle (hObject=0x158) returned 1 [0048.369] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0048.370] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=16863385565) returned 1 [0048.371] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Файл зашифрован [Office32WW.xml].wannacash .zip" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\Файл зашифрован [office32ww.xml].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0048.371] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0048.372] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0048.372] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0048.372] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0048.372] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0048.372] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0048.372] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0048.372] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0048.372] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0048.372] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0048.372] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0048.372] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0048.372] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0048.372] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0048.372] SetEndOfFile (hFile=0x158) returned 1 [0048.372] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0048.372] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0048.372] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0048.373] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0048.373] WriteFile (in: hFile=0x158, lpBuffer=0x361f5a8*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x361f5a8*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0048.373] WriteFile (in: hFile=0x158, lpBuffer=0x35f011c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f011c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0048.374] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FY\"rguL7q/>.E-fMr~ksZYC9}$6#vg/Q", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0048.374] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FY\"rguL7q/>.E-fMr~ksZYC9}$6#vg/Q", cchWideChar=32, lpMultiByteStr=0x2032944, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FY\"rguL7q/>.E-fMr~ksZYC9}$6#vg/Q", lpUsedDefaultChar=0x0) returned 32 [0048.374] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0048.374] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0048.374] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87abdaa0, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x87abdaa0, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5cd2aa0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.xml", cAlternateFileName="OFFICE~1.XML")) returned 0x295098 [0048.374] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0048.374] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0048.374] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0048.374] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0048.374] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0048.374] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0048.374] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87abdaa0, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x87abdaa0, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5cd2aa0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x10b2)) returned 1 [0048.374] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0048.374] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0048.374] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0048.374] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0048.374] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0048.374] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0048.375] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0048.375] SetEndOfFile (hFile=0x158) returned 1 [0048.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Office32WW.xml", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0048.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Office32WW.xml", cchWideChar=14, lpMultiByteStr=0x1fe358c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Office32WW.xml", lpUsedDefaultChar=0x0) returned 14 [0048.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Office32WW.xml", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0048.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Office32WW.xml", cchWideChar=14, lpMultiByteStr=0x1fe396c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Office32WW.xml", lpUsedDefaultChar=0x0) returned 14 [0048.375] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe396c, cbMultiByte=14, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="Office32WW.xmlmll@\x01") returned 14 [0048.376] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Office32WW.xml", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0048.376] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Office32WW.xml", cchWideChar=14, lpMultiByteStr=0x1fe358c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Office32WW.xml", lpUsedDefaultChar=0x0) returned 14 [0048.376] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0048.376] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0048.376] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x10b2 [0048.376] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0048.376] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0048.376] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0048.376] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Office32WW.xml", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0048.376] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Office32WW.xml", cchWideChar=14, lpMultiByteStr=0x1fe358c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Office32WW.xml", lpUsedDefaultChar=0x0) returned 14 [0048.376] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Office32WW.xml", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0048.376] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Office32WW.xml", cchWideChar=14, lpMultiByteStr=0x1fe396c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Office32WW.xml", lpUsedDefaultChar=0x0) returned 14 [0048.376] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe396c, cbMultiByte=14, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="Office32WW.xmlWW.xmlmll@\x01") returned 14 [0048.376] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Office32WW.xml", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0048.376] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Office32WW.xml", cchWideChar=14, lpMultiByteStr=0x1fe358c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Office32WW.xml", lpUsedDefaultChar=0x0) returned 14 [0048.376] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0048.377] CharToOemA (in: pSrc="Office32WW.xml", pDst=0x1fe396c | out: pDst="Office32WW.xml") returned 1 [0048.377] WriteFile (in: hFile=0x158, lpBuffer=0x1fe396c*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe396c*, lpNumberOfBytesWritten=0x18e048*=0xe, lpOverlapped=0x0) returned 1 [0048.377] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0048.377] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0048.377] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0048.377] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=16864093888) returned 1 [0048.378] ReadFile (in: hFile=0x15c, lpBuffer=0x3500220, nNumberOfBytesToRead=0x10b2, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3500220*, lpNumberOfBytesRead=0x18dd7c*=0x10b2, lpOverlapped=0x0) returned 1 [0048.379] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0048.379] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=16864234921) returned 1 [0048.387] WriteFile (in: hFile=0x158, lpBuffer=0x1fea120*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fea120*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0048.387] ReadFile (in: hFile=0x15c, lpBuffer=0x3500220, nNumberOfBytesToRead=0x10b2, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3500220*, lpNumberOfBytesRead=0x18de38*=0x10b2, lpOverlapped=0x0) returned 1 [0048.387] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x49 [0048.388] WriteFile (in: hFile=0x158, lpBuffer=0x3502a80*, nNumberOfBytesToWrite=0x10b2, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3502a80*, lpNumberOfBytesWritten=0x18de10*=0x10b2, lpOverlapped=0x0) returned 1 [0048.388] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x10fb [0048.388] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0048.388] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0048.388] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0048.388] SetFilePointer (in: hFile=0x158, lDistanceToMove=14, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2c [0048.388] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x1105 [0048.388] CloseHandle (hObject=0x15c) returned 1 [0048.388] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1105 [0048.388] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1105 [0048.388] SetFilePointer (in: hFile=0x158, lDistanceToMove=4357, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1105 [0048.388] SetFilePointer (in: hFile=0x158, lDistanceToMove=4357, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x1105 [0048.389] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1105 [0048.389] SetFilePointer (in: hFile=0x158, lDistanceToMove=4357, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x1105 [0048.389] SetEndOfFile (hFile=0x158) returned 1 [0048.389] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1105 [0048.389] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1105 [0048.389] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Office32WW.xml", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0048.389] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Office32WW.xml", cchWideChar=14, lpMultiByteStr=0x1fe358c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Office32WW.xml", lpUsedDefaultChar=0x0) returned 14 [0048.389] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Office32WW.xml", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0048.389] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Office32WW.xml", cchWideChar=14, lpMultiByteStr=0x1fe3a0c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Office32WW.xml", lpUsedDefaultChar=0x0) returned 14 [0048.389] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe3a0c, cbMultiByte=14, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="Office32WW.xml야'\x18믉`믑`") returned 14 [0048.389] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Office32WW.xml", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0048.389] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Office32WW.xml", cchWideChar=14, lpMultiByteStr=0x1fe358c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Office32WW.xml", lpUsedDefaultChar=0x0) returned 14 [0048.389] WriteFile (in: hFile=0x158, lpBuffer=0x34e3cf8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x34e3cf8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0048.389] CharToOemA (in: pSrc="Office32WW.xml", pDst=0x1fe3a0c | out: pDst="Office32WW.xml") returned 1 [0048.389] WriteFile (in: hFile=0x158, lpBuffer=0x1fe3a0c*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe3a0c*, lpNumberOfBytesWritten=0x18efcc*=0xe, lpOverlapped=0x0) returned 1 [0048.390] WriteFile (in: hFile=0x158, lpBuffer=0x1fea1e8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea1e8*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0048.390] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0048.390] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0048.390] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x114c [0048.390] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x114c [0048.390] WriteFile (in: hFile=0x158, lpBuffer=0x361f5a8*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x361f5a8*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0048.390] WriteFile (in: hFile=0x158, lpBuffer=0x35f011c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f011c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0048.390] DeleteFileW (lpFileName="") returned 0 [0048.390] GetLastError () returned 0x3 [0048.390] GetFileAttributesW (lpFileName="") returned 0xffffffff [0048.390] SetLastError (dwErrCode=0x3) [0048.390] FlushFileBuffers (hFile=0x158) returned 1 [0048.393] GetCurrentThreadId () returned 0x970 [0048.393] GetCurrentThreadId () returned 0x970 [0048.393] GetCurrentThreadId () returned 0x970 [0048.393] GetCurrentThreadId () returned 0x970 [0048.393] GetCurrentThreadId () returned 0x970 [0048.393] GetCurrentThreadId () returned 0x970 [0048.393] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x1203 [0048.393] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x1203 [0048.394] SetFilePointer (in: hFile=0x158, lDistanceToMove=4611, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x1203 [0048.394] CloseHandle (hObject=0x158) returned 1 [0048.394] GetCurrentThreadId () returned 0x970 [0048.394] GetCurrentThreadId () returned 0x970 [0048.394] GetCurrentThreadId () returned 0x970 [0048.394] GetCurrentThreadId () returned 0x970 [0048.394] GetCurrentThreadId () returned 0x970 [0048.394] GetCurrentThreadId () returned 0x970 [0048.394] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Файл зашифрован [Office32WW.xml].wannacash .zip" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\Файл зашифрован [office32ww.xml].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0048.395] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1203 [0048.395] SetFilePointer (in: hFile=0x158, lDistanceToMove=4483, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1183 [0048.395] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0048.395] GetFileType (hFile=0x158) returned 0x1 [0048.395] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x37, wMilliseconds=0x2bc)) [0048.395] GetCurrentThreadId () returned 0x970 [0048.395] GetCurrentThreadId () returned 0x970 [0048.395] GetCurrentThreadId () returned 0x970 [0048.395] GetCurrentThreadId () returned 0x970 [0048.395] GetCurrentThreadId () returned 0x970 [0048.395] GetCurrentThreadId () returned 0x970 [0048.395] GetCurrentThreadId () returned 0x970 [0048.395] GetCurrentThreadId () returned 0x970 [0048.395] GetCurrentThreadId () returned 0x970 [0048.395] GetCurrentThreadId () returned 0x970 [0048.395] GetCurrentThreadId () returned 0x970 [0048.395] GetCurrentThreadId () returned 0x970 [0048.395] GetCurrentThreadId () returned 0x970 [0048.395] GetCurrentThreadId () returned 0x970 [0048.395] GetCurrentThreadId () returned 0x970 [0048.395] GetCurrentThreadId () returned 0x970 [0048.395] GetCurrentThreadId () returned 0x970 [0048.395] GetCurrentThreadId () returned 0x970 [0048.395] GetCurrentThreadId () returned 0x970 [0048.395] GetCurrentThreadId () returned 0x970 [0048.395] GetCurrentThreadId () returned 0x970 [0048.395] GetCurrentThreadId () returned 0x970 [0048.395] GetCurrentThreadId () returned 0x970 [0048.395] GetCurrentThreadId () returned 0x970 [0048.395] GetCurrentThreadId () returned 0x970 [0048.395] GetCurrentThreadId () returned 0x970 [0048.395] GetCurrentThreadId () returned 0x970 [0048.395] GetCurrentThreadId () returned 0x970 [0048.395] GetCurrentThreadId () returned 0x970 [0048.395] GetCurrentThreadId () returned 0x970 [0048.395] GetCurrentThreadId () returned 0x970 [0048.395] GetCurrentThreadId () returned 0x970 [0048.395] GetCurrentThreadId () returned 0x970 [0048.396] GetCurrentThreadId () returned 0x970 [0048.396] GetCurrentThreadId () returned 0x970 [0048.396] GetCurrentThreadId () returned 0x970 [0048.396] GetCurrentThreadId () returned 0x970 [0048.396] GetCurrentThreadId () returned 0x970 [0048.396] GetCurrentThreadId () returned 0x970 [0048.396] GetCurrentThreadId () returned 0x970 [0048.396] GetCurrentThreadId () returned 0x970 [0048.396] GetCurrentThreadId () returned 0x970 [0048.396] GetCurrentThreadId () returned 0x970 [0048.396] GetCurrentThreadId () returned 0x970 [0048.396] GetCurrentThreadId () returned 0x970 [0048.396] GetCurrentThreadId () returned 0x970 [0048.396] GetCurrentThreadId () returned 0x970 [0048.396] GetCurrentThreadId () returned 0x970 [0048.396] GetCurrentThreadId () returned 0x970 [0048.396] GetCurrentThreadId () returned 0x970 [0048.396] GetCurrentThreadId () returned 0x970 [0048.396] GetCurrentThreadId () returned 0x970 [0048.396] GetCurrentThreadId () returned 0x970 [0048.396] GetCurrentThreadId () returned 0x970 [0048.396] GetCurrentThreadId () returned 0x970 [0048.396] GetCurrentThreadId () returned 0x970 [0048.396] GetCurrentThreadId () returned 0x970 [0048.396] GetCurrentThreadId () returned 0x970 [0048.396] GetCurrentThreadId () returned 0x970 [0048.396] GetCurrentThreadId () returned 0x970 [0048.396] GetCurrentThreadId () returned 0x970 [0048.396] GetCurrentThreadId () returned 0x970 [0048.396] GetCurrentThreadId () returned 0x970 [0048.396] GetCurrentThreadId () returned 0x970 [0048.396] GetCurrentThreadId () returned 0x970 [0048.396] GetCurrentThreadId () returned 0x970 [0048.396] GetCurrentThreadId () returned 0x970 [0048.396] GetCurrentThreadId () returned 0x970 [0048.396] GetCurrentThreadId () returned 0x970 [0048.396] GetCurrentThreadId () returned 0x970 [0048.396] GetCurrentThreadId () returned 0x970 [0048.396] GetCurrentThreadId () returned 0x970 [0048.396] GetCurrentThreadId () returned 0x970 [0048.396] GetCurrentThreadId () returned 0x970 [0048.396] GetCurrentThreadId () returned 0x970 [0048.396] GetCurrentThreadId () returned 0x970 [0048.396] GetCurrentThreadId () returned 0x970 [0048.396] GetCurrentThreadId () returned 0x970 [0048.396] GetCurrentThreadId () returned 0x970 [0048.396] GetCurrentThreadId () returned 0x970 [0048.396] GetCurrentThreadId () returned 0x970 [0048.396] GetCurrentThreadId () returned 0x970 [0048.397] GetCurrentThreadId () returned 0x970 [0048.397] GetCurrentThreadId () returned 0x970 [0048.397] GetCurrentThreadId () returned 0x970 [0048.397] GetCurrentThreadId () returned 0x970 [0048.397] GetCurrentThreadId () returned 0x970 [0048.397] GetCurrentThreadId () returned 0x970 [0048.397] GetCurrentThreadId () returned 0x970 [0048.397] GetCurrentThreadId () returned 0x970 [0048.397] GetCurrentThreadId () returned 0x970 [0048.397] GetCurrentThreadId () returned 0x970 [0048.397] GetCurrentThreadId () returned 0x970 [0048.397] GetCurrentThreadId () returned 0x970 [0048.397] GetCurrentThreadId () returned 0x970 [0048.397] GetCurrentThreadId () returned 0x970 [0048.397] GetCurrentThreadId () returned 0x970 [0048.397] GetCurrentThreadId () returned 0x970 [0048.397] GetCurrentThreadId () returned 0x970 [0048.397] GetCurrentThreadId () returned 0x970 [0048.397] GetCurrentThreadId () returned 0x970 [0048.397] GetCurrentThreadId () returned 0x970 [0048.397] GetCurrentThreadId () returned 0x970 [0048.397] GetCurrentThreadId () returned 0x970 [0048.397] GetCurrentThreadId () returned 0x970 [0048.397] GetCurrentThreadId () returned 0x970 [0048.397] GetCurrentThreadId () returned 0x970 [0048.397] GetCurrentThreadId () returned 0x970 [0048.397] GetCurrentThreadId () returned 0x970 [0048.397] GetCurrentThreadId () returned 0x970 [0048.397] GetCurrentThreadId () returned 0x970 [0048.397] GetCurrentThreadId () returned 0x970 [0048.397] GetCurrentThreadId () returned 0x970 [0048.397] GetCurrentThreadId () returned 0x970 [0048.397] GetCurrentThreadId () returned 0x970 [0048.397] GetCurrentThreadId () returned 0x970 [0048.397] GetCurrentThreadId () returned 0x970 [0048.397] GetCurrentThreadId () returned 0x970 [0048.397] GetCurrentThreadId () returned 0x970 [0048.397] GetCurrentThreadId () returned 0x970 [0048.397] GetCurrentThreadId () returned 0x970 [0048.397] GetCurrentThreadId () returned 0x970 [0048.397] GetCurrentThreadId () returned 0x970 [0048.397] GetCurrentThreadId () returned 0x970 [0048.397] GetCurrentThreadId () returned 0x970 [0048.397] GetCurrentThreadId () returned 0x970 [0048.397] GetCurrentThreadId () returned 0x970 [0048.397] GetCurrentThreadId () returned 0x970 [0048.398] GetCurrentThreadId () returned 0x970 [0048.398] GetCurrentThreadId () returned 0x970 [0048.398] GetCurrentThreadId () returned 0x970 [0048.398] GetCurrentThreadId () returned 0x970 [0048.398] GetCurrentThreadId () returned 0x970 [0048.398] GetCurrentThreadId () returned 0x970 [0048.398] GetCurrentThreadId () returned 0x970 [0048.398] GetCurrentThreadId () returned 0x970 [0048.398] GetCurrentThreadId () returned 0x970 [0048.398] GetCurrentThreadId () returned 0x970 [0048.398] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.398] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.398] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb2b0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.398] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.398] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.398] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb2b0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.398] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.398] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.398] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.398] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.398] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.398] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.398] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.398] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.398] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb310, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3ro", lpUsedDefaultChar=0x0) returned 10 [0048.398] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.398] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.398] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb310, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3ro", lpUsedDefaultChar=0x0) returned 10 [0048.398] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.398] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.398] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb310, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3ro", lpUsedDefaultChar=0x0) returned 10 [0048.398] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x37, wMilliseconds=0x2bc)) [0048.398] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="FY\"rguL7q/>.E-fMr~ksZYC9}$6#vg/Q", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0048.398] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="FY\"rguL7q/>.E-fMr~ksZYC9}$6#vg/Q", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0048.398] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="FY\"rguL7q/>.E-fMr~ksZYC9}$6#vg/Q", cchWideChar=32, lpMultiByteStr=0x20007a8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FY\"rguL7q/>.E-fMr~ksZYC9}$6#vg/Q", lpUsedDefaultChar=0x0) returned 32 [0048.399] GetCurrentThreadId () returned 0x970 [0048.399] GetCurrentThreadId () returned 0x970 [0048.399] GetCurrentThreadId () returned 0x970 [0048.399] GetCurrentThreadId () returned 0x970 [0048.399] GetCurrentThreadId () returned 0x970 [0048.399] GetCurrentThreadId () returned 0x970 [0048.406] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0048.406] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0048.406] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x202d5b8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0048.406] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x35904f8, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0048.406] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x35904f8, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAACB2GLVqo9+DlYcuHYpaoE2/NEnIBm5xtPWN8et1YCesPWB1ooE7w7lTfLoSXzKocWldFJAjE0iB5Uyk9IVMxNQVvHImeyiJ8pRZDmEz2WoN4p77ZWMq8wRi/1oE5yVC1LWD9nXZTPpu5FjHbXqxpDcsddS2120k62Ia7eY+bUPoH7L+U21o99ftbHq/YnFwprsvVIfLG0WlL0icnpWQxL3TyG32iq0soQ==") returned 232 [0048.406] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x37, wMilliseconds=0x2cb)) [0048.406] GetCurrentThreadId () returned 0x970 [0048.406] GetCurrentThreadId () returned 0x970 [0048.406] GetCurrentThreadId () returned 0x970 [0048.406] GetCurrentThreadId () returned 0x970 [0048.406] GetCurrentThreadId () returned 0x970 [0048.406] GetCurrentThreadId () returned 0x970 [0048.406] GetCurrentThreadId () returned 0x970 [0048.406] GetCurrentThreadId () returned 0x970 [0048.406] GetCurrentThreadId () returned 0x970 [0048.406] GetCurrentThreadId () returned 0x970 [0048.406] GetCurrentThreadId () returned 0x970 [0048.406] GetCurrentThreadId () returned 0x970 [0048.406] GetCurrentThreadId () returned 0x970 [0048.406] GetCurrentThreadId () returned 0x970 [0048.406] GetCurrentThreadId () returned 0x970 [0048.406] GetCurrentThreadId () returned 0x970 [0048.406] GetCurrentThreadId () returned 0x970 [0048.406] GetCurrentThreadId () returned 0x970 [0048.406] GetCurrentThreadId () returned 0x970 [0048.406] GetCurrentThreadId () returned 0x970 [0048.406] GetCurrentThreadId () returned 0x970 [0048.406] GetCurrentThreadId () returned 0x970 [0048.406] GetCurrentThreadId () returned 0x970 [0048.406] GetCurrentThreadId () returned 0x970 [0048.406] GetCurrentThreadId () returned 0x970 [0048.406] GetCurrentThreadId () returned 0x970 [0048.407] GetCurrentThreadId () returned 0x970 [0048.407] GetCurrentThreadId () returned 0x970 [0048.407] GetCurrentThreadId () returned 0x970 [0048.407] GetCurrentThreadId () returned 0x970 [0048.407] GetCurrentThreadId () returned 0x970 [0048.407] GetCurrentThreadId () returned 0x970 [0048.407] GetCurrentThreadId () returned 0x970 [0048.407] GetCurrentThreadId () returned 0x970 [0048.407] GetCurrentThreadId () returned 0x970 [0048.407] GetCurrentThreadId () returned 0x970 [0048.407] GetCurrentThreadId () returned 0x970 [0048.407] GetCurrentThreadId () returned 0x970 [0048.407] GetCurrentThreadId () returned 0x970 [0048.407] GetCurrentThreadId () returned 0x970 [0048.407] GetCurrentThreadId () returned 0x970 [0048.407] GetCurrentThreadId () returned 0x970 [0048.407] GetCurrentThreadId () returned 0x970 [0048.407] GetCurrentThreadId () returned 0x970 [0048.407] GetCurrentThreadId () returned 0x970 [0048.407] GetCurrentThreadId () returned 0x970 [0048.407] GetCurrentThreadId () returned 0x970 [0048.407] GetCurrentThreadId () returned 0x970 [0048.407] GetCurrentThreadId () returned 0x970 [0048.407] GetCurrentThreadId () returned 0x970 [0048.407] GetCurrentThreadId () returned 0x970 [0048.407] GetCurrentThreadId () returned 0x970 [0048.407] GetCurrentThreadId () returned 0x970 [0048.407] GetCurrentThreadId () returned 0x970 [0048.407] GetCurrentThreadId () returned 0x970 [0048.407] GetCurrentThreadId () returned 0x970 [0048.407] GetCurrentThreadId () returned 0x970 [0048.407] GetCurrentThreadId () returned 0x970 [0048.407] GetCurrentThreadId () returned 0x970 [0048.407] GetCurrentThreadId () returned 0x970 [0048.407] GetCurrentThreadId () returned 0x970 [0048.407] GetCurrentThreadId () returned 0x970 [0048.407] GetCurrentThreadId () returned 0x970 [0048.407] GetCurrentThreadId () returned 0x970 [0048.407] GetCurrentThreadId () returned 0x970 [0048.407] GetCurrentThreadId () returned 0x970 [0048.407] GetCurrentThreadId () returned 0x970 [0048.407] GetCurrentThreadId () returned 0x970 [0048.407] GetCurrentThreadId () returned 0x970 [0048.407] GetCurrentThreadId () returned 0x970 [0048.407] GetCurrentThreadId () returned 0x970 [0048.407] GetCurrentThreadId () returned 0x970 [0048.407] GetCurrentThreadId () returned 0x970 [0048.407] GetCurrentThreadId () returned 0x970 [0048.408] GetCurrentThreadId () returned 0x970 [0048.408] GetCurrentThreadId () returned 0x970 [0048.408] GetCurrentThreadId () returned 0x970 [0048.408] GetCurrentThreadId () returned 0x970 [0048.408] GetCurrentThreadId () returned 0x970 [0048.408] GetCurrentThreadId () returned 0x970 [0048.408] GetCurrentThreadId () returned 0x970 [0048.408] GetCurrentThreadId () returned 0x970 [0048.408] GetCurrentThreadId () returned 0x970 [0048.408] GetCurrentThreadId () returned 0x970 [0048.408] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAACB2GLVqo9+DlYcuHYpaoE2/NEnIBm5xtPWN8et1YCesPWB1ooE7w7lTfLoSXzKocWldFJAjE0iB5Uyk9IVMxNQVvHImeyiJ8pRZDmEz2WoN4p77ZWMq8wRi/1oE5yVC1LWD9nXZTPpu5FjHbXqxpDcsddS2120k62Ia7eY+bUPoH7L+U21o99ftbHq/YnFwprsvVIfLG0WlL0icnpWQxL3TyG32iq0soQ==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0048.408] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAACB2GLVqo9+DlYcuHYpaoE2/NEnIBm5xtPWN8et1YCesPWB1ooE7w7lTfLoSXzKocWldFJAjE0iB5Uyk9IVMxNQVvHImeyiJ8pRZDmEz2WoN4p77ZWMq8wRi/1oE5yVC1LWD9nXZTPpu5FjHbXqxpDcsddS2120k62Ia7eY+bUPoH7L+U21o99ftbHq/YnFwprsvVIfLG0WlL0icnpWQxL3TyG32iq0soQ==", cchWideChar=245, lpMultiByteStr=0x353900c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAACB2GLVqo9+DlYcuHYpaoE2/NEnIBm5xtPWN8et1YCesPWB1ooE7w7lTfLoSXzKocWldFJAjE0iB5Uyk9IVMxNQVvHImeyiJ8pRZDmEz2WoN4p77ZWMq8wRi/1oE5yVC1LWD9nXZTPpu5FjHbXqxpDcsddS2120k62Ia7eY+bUPoH7L+U21o99ftbHq/YnFwprsvVIfLG0WlL0icnpWQxL3TyG32iq0soQ==", lpUsedDefaultChar=0x0) returned 245 [0048.408] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0048.408] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0048.408] CloseHandle (hObject=0x158) returned 1 [0048.410] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0048.411] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=16867437097) returned 1 [0048.411] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Файл зашифрован [PrjProrWW.xml].wannacash .zip" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\Файл зашифрован [prjprorww.xml].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0048.411] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0048.411] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0048.411] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0048.411] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0048.411] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0048.412] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0048.412] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0048.412] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0048.412] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0048.412] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0048.412] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0048.412] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0048.412] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0048.412] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0048.412] SetEndOfFile (hFile=0x158) returned 1 [0048.412] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0048.412] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0048.412] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0048.412] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0048.412] WriteFile (in: hFile=0x158, lpBuffer=0x361f5a8*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x361f5a8*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0048.413] WriteFile (in: hFile=0x158, lpBuffer=0x35f005c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f005c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0048.413] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="q&4/!EM*{FrXL-nM%7Yjc^A<}%jk~S),", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0048.413] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="q&4/!EM*{FrXL-nM%7Yjc^A<}%jk~S),", cchWideChar=32, lpMultiByteStr=0x203219c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="q&4/!EM*{FrXL-nM%7Yjc^A<}%jk~S),", lpUsedDefaultChar=0x0) returned 32 [0048.413] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0048.413] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0048.413] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cabec50, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7cabec50, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1915, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrjProrWW.xml", cAlternateFileName="PRJPRO~1.XML")) returned 0x295098 [0048.413] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0048.413] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0048.414] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml")) returned 0x2020 [0048.414] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml")) returned 0x2020 [0048.414] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml")) returned 0x2020 [0048.414] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml")) returned 0x2020 [0048.414] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cabec50, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7cabec50, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1915)) returned 1 [0048.414] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0048.415] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0048.415] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml")) returned 0x2020 [0048.415] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml")) returned 0x2020 [0048.415] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0048.415] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0048.415] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0048.415] SetEndOfFile (hFile=0x158) returned 1 [0048.416] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PrjProrWW.xml", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0048.416] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PrjProrWW.xml", cchWideChar=13, lpMultiByteStr=0x1fe366c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PrjProrWW.xml", lpUsedDefaultChar=0x0) returned 13 [0048.416] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PrjProrWW.xml", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0048.416] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PrjProrWW.xml", cchWideChar=13, lpMultiByteStr=0x1fe376c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PrjProrWW.xml", lpUsedDefaultChar=0x0) returned 13 [0048.416] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe376c, cbMultiByte=13, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="PrjProrWW.xmllmll@\x01") returned 13 [0048.416] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PrjProrWW.xml", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0048.416] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PrjProrWW.xml", cchWideChar=13, lpMultiByteStr=0x1fe366c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PrjProrWW.xml", lpUsedDefaultChar=0x0) returned 13 [0048.416] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0048.416] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0048.416] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x1915 [0048.416] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0048.416] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0048.416] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0048.416] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PrjProrWW.xml", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0048.416] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PrjProrWW.xml", cchWideChar=13, lpMultiByteStr=0x1fe366c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PrjProrWW.xml", lpUsedDefaultChar=0x0) returned 13 [0048.416] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PrjProrWW.xml", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0048.416] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PrjProrWW.xml", cchWideChar=13, lpMultiByteStr=0x1fe376c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PrjProrWW.xml", lpUsedDefaultChar=0x0) returned 13 [0048.416] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe376c, cbMultiByte=13, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="PrjProrWW.xmlWW.xmllmll@\x01") returned 13 [0048.417] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PrjProrWW.xml", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0048.417] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PrjProrWW.xml", cchWideChar=13, lpMultiByteStr=0x1fe366c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PrjProrWW.xml", lpUsedDefaultChar=0x0) returned 13 [0048.417] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0048.417] CharToOemA (in: pSrc="PrjProrWW.xml", pDst=0x1fe376c | out: pDst="PrjProrWW.xml") returned 1 [0048.417] WriteFile (in: hFile=0x158, lpBuffer=0x1fe376c*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe376c*, lpNumberOfBytesWritten=0x18e048*=0xd, lpOverlapped=0x0) returned 1 [0048.418] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0048.418] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0048.418] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0048.418] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=16868122301) returned 1 [0048.418] ReadFile (in: hFile=0x15c, lpBuffer=0x3500220, nNumberOfBytesToRead=0x1915, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3500220*, lpNumberOfBytesRead=0x18dd7c*=0x1915, lpOverlapped=0x0) returned 1 [0048.419] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0048.419] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=16868266963) returned 1 [0048.428] WriteFile (in: hFile=0x158, lpBuffer=0x1fea180*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fea180*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0048.428] ReadFile (in: hFile=0x15c, lpBuffer=0x3500220, nNumberOfBytesToRead=0x1915, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3500220*, lpNumberOfBytesRead=0x18de38*=0x1915, lpOverlapped=0x0) returned 1 [0048.428] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x48 [0048.428] WriteFile (in: hFile=0x158, lpBuffer=0x3503280*, nNumberOfBytesToWrite=0x1915, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3503280*, lpNumberOfBytesWritten=0x18de10*=0x1915, lpOverlapped=0x0) returned 1 [0048.428] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x195d [0048.428] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0048.428] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0048.428] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0048.429] SetFilePointer (in: hFile=0x158, lDistanceToMove=13, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2b [0048.429] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x1967 [0048.429] CloseHandle (hObject=0x15c) returned 1 [0048.429] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1967 [0048.429] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1967 [0048.429] SetFilePointer (in: hFile=0x158, lDistanceToMove=6503, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1967 [0048.429] SetFilePointer (in: hFile=0x158, lDistanceToMove=6503, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x1967 [0048.429] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1967 [0048.429] SetFilePointer (in: hFile=0x158, lDistanceToMove=6503, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x1967 [0048.429] SetEndOfFile (hFile=0x158) returned 1 [0048.429] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1967 [0048.429] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1967 [0048.429] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PrjProrWW.xml", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0048.429] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PrjProrWW.xml", cchWideChar=13, lpMultiByteStr=0x1fe366c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PrjProrWW.xml", lpUsedDefaultChar=0x0) returned 13 [0048.429] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PrjProrWW.xml", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0048.429] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PrjProrWW.xml", cchWideChar=13, lpMultiByteStr=0x1fe3b8c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PrjProrWW.xml", lpUsedDefaultChar=0x0) returned 13 [0048.429] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe3b8c, cbMultiByte=13, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="PrjProrWW.xml@涤(\x18믉`믑`") returned 13 [0048.430] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PrjProrWW.xml", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0048.430] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PrjProrWW.xml", cchWideChar=13, lpMultiByteStr=0x1fe366c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PrjProrWW.xml", lpUsedDefaultChar=0x0) returned 13 [0048.430] WriteFile (in: hFile=0x158, lpBuffer=0x34e3cf8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x34e3cf8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0048.430] CharToOemA (in: pSrc="PrjProrWW.xml", pDst=0x1fe3b8c | out: pDst="PrjProrWW.xml") returned 1 [0048.430] WriteFile (in: hFile=0x158, lpBuffer=0x1fe3b8c*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe3b8c*, lpNumberOfBytesWritten=0x18efcc*=0xd, lpOverlapped=0x0) returned 1 [0048.430] WriteFile (in: hFile=0x158, lpBuffer=0x1fea428*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea428*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0048.430] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0048.430] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0048.430] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x19ad [0048.430] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x19ad [0048.430] WriteFile (in: hFile=0x158, lpBuffer=0x361f5a8*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x361f5a8*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0048.430] WriteFile (in: hFile=0x158, lpBuffer=0x35f005c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f005c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0048.430] DeleteFileW (lpFileName="") returned 0 [0048.430] GetLastError () returned 0x3 [0048.430] GetFileAttributesW (lpFileName="") returned 0xffffffff [0048.430] SetLastError (dwErrCode=0x3) [0048.430] FlushFileBuffers (hFile=0x158) returned 1 [0048.434] GetCurrentThreadId () returned 0x970 [0048.434] GetCurrentThreadId () returned 0x970 [0048.434] GetCurrentThreadId () returned 0x970 [0048.434] GetCurrentThreadId () returned 0x970 [0048.434] GetCurrentThreadId () returned 0x970 [0048.434] GetCurrentThreadId () returned 0x970 [0048.434] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x1a64 [0048.434] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x1a64 [0048.434] SetFilePointer (in: hFile=0x158, lDistanceToMove=6756, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x1a64 [0048.434] CloseHandle (hObject=0x158) returned 1 [0048.435] GetCurrentThreadId () returned 0x970 [0048.435] GetCurrentThreadId () returned 0x970 [0048.435] GetCurrentThreadId () returned 0x970 [0048.435] GetCurrentThreadId () returned 0x970 [0048.435] GetCurrentThreadId () returned 0x970 [0048.435] GetCurrentThreadId () returned 0x970 [0048.435] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Файл зашифрован [PrjProrWW.xml].wannacash .zip" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\Файл зашифрован [prjprorww.xml].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0048.435] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1a64 [0048.435] SetFilePointer (in: hFile=0x158, lDistanceToMove=6628, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x19e4 [0048.435] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0048.435] GetFileType (hFile=0x158) returned 0x1 [0048.435] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x37, wMilliseconds=0x2db)) [0048.435] GetCurrentThreadId () returned 0x970 [0048.435] GetCurrentThreadId () returned 0x970 [0048.435] GetCurrentThreadId () returned 0x970 [0048.435] GetCurrentThreadId () returned 0x970 [0048.435] GetCurrentThreadId () returned 0x970 [0048.435] GetCurrentThreadId () returned 0x970 [0048.435] GetCurrentThreadId () returned 0x970 [0048.435] GetCurrentThreadId () returned 0x970 [0048.435] GetCurrentThreadId () returned 0x970 [0048.435] GetCurrentThreadId () returned 0x970 [0048.435] GetCurrentThreadId () returned 0x970 [0048.435] GetCurrentThreadId () returned 0x970 [0048.435] GetCurrentThreadId () returned 0x970 [0048.435] GetCurrentThreadId () returned 0x970 [0048.435] GetCurrentThreadId () returned 0x970 [0048.435] GetCurrentThreadId () returned 0x970 [0048.435] GetCurrentThreadId () returned 0x970 [0048.435] GetCurrentThreadId () returned 0x970 [0048.435] GetCurrentThreadId () returned 0x970 [0048.435] GetCurrentThreadId () returned 0x970 [0048.435] GetCurrentThreadId () returned 0x970 [0048.435] GetCurrentThreadId () returned 0x970 [0048.435] GetCurrentThreadId () returned 0x970 [0048.436] GetCurrentThreadId () returned 0x970 [0048.436] GetCurrentThreadId () returned 0x970 [0048.436] GetCurrentThreadId () returned 0x970 [0048.436] GetCurrentThreadId () returned 0x970 [0048.436] GetCurrentThreadId () returned 0x970 [0048.436] GetCurrentThreadId () returned 0x970 [0048.436] GetCurrentThreadId () returned 0x970 [0048.436] GetCurrentThreadId () returned 0x970 [0048.436] GetCurrentThreadId () returned 0x970 [0048.436] GetCurrentThreadId () returned 0x970 [0048.436] GetCurrentThreadId () returned 0x970 [0048.436] GetCurrentThreadId () returned 0x970 [0048.436] GetCurrentThreadId () returned 0x970 [0048.436] GetCurrentThreadId () returned 0x970 [0048.436] GetCurrentThreadId () returned 0x970 [0048.436] GetCurrentThreadId () returned 0x970 [0048.436] GetCurrentThreadId () returned 0x970 [0048.436] GetCurrentThreadId () returned 0x970 [0048.436] GetCurrentThreadId () returned 0x970 [0048.436] GetCurrentThreadId () returned 0x970 [0048.436] GetCurrentThreadId () returned 0x970 [0048.436] GetCurrentThreadId () returned 0x970 [0048.436] GetCurrentThreadId () returned 0x970 [0048.436] GetCurrentThreadId () returned 0x970 [0048.436] GetCurrentThreadId () returned 0x970 [0048.436] GetCurrentThreadId () returned 0x970 [0048.436] GetCurrentThreadId () returned 0x970 [0048.436] GetCurrentThreadId () returned 0x970 [0048.436] GetCurrentThreadId () returned 0x970 [0048.436] GetCurrentThreadId () returned 0x970 [0048.436] GetCurrentThreadId () returned 0x970 [0048.436] GetCurrentThreadId () returned 0x970 [0048.436] GetCurrentThreadId () returned 0x970 [0048.436] GetCurrentThreadId () returned 0x970 [0048.436] GetCurrentThreadId () returned 0x970 [0048.436] GetCurrentThreadId () returned 0x970 [0048.436] GetCurrentThreadId () returned 0x970 [0048.436] GetCurrentThreadId () returned 0x970 [0048.436] GetCurrentThreadId () returned 0x970 [0048.436] GetCurrentThreadId () returned 0x970 [0048.436] GetCurrentThreadId () returned 0x970 [0048.436] GetCurrentThreadId () returned 0x970 [0048.436] GetCurrentThreadId () returned 0x970 [0048.436] GetCurrentThreadId () returned 0x970 [0048.436] GetCurrentThreadId () returned 0x970 [0048.436] GetCurrentThreadId () returned 0x970 [0048.437] GetCurrentThreadId () returned 0x970 [0048.437] GetCurrentThreadId () returned 0x970 [0048.437] GetCurrentThreadId () returned 0x970 [0048.437] GetCurrentThreadId () returned 0x970 [0048.437] GetCurrentThreadId () returned 0x970 [0048.437] GetCurrentThreadId () returned 0x970 [0048.437] GetCurrentThreadId () returned 0x970 [0048.437] GetCurrentThreadId () returned 0x970 [0048.437] GetCurrentThreadId () returned 0x970 [0048.437] GetCurrentThreadId () returned 0x970 [0048.437] GetCurrentThreadId () returned 0x970 [0048.437] GetCurrentThreadId () returned 0x970 [0048.437] GetCurrentThreadId () returned 0x970 [0048.437] GetCurrentThreadId () returned 0x970 [0048.437] GetCurrentThreadId () returned 0x970 [0048.437] GetCurrentThreadId () returned 0x970 [0048.437] GetCurrentThreadId () returned 0x970 [0048.437] GetCurrentThreadId () returned 0x970 [0048.437] GetCurrentThreadId () returned 0x970 [0048.437] GetCurrentThreadId () returned 0x970 [0048.437] GetCurrentThreadId () returned 0x970 [0048.437] GetCurrentThreadId () returned 0x970 [0048.437] GetCurrentThreadId () returned 0x970 [0048.437] GetCurrentThreadId () returned 0x970 [0048.437] GetCurrentThreadId () returned 0x970 [0048.437] GetCurrentThreadId () returned 0x970 [0048.437] GetCurrentThreadId () returned 0x970 [0048.437] GetCurrentThreadId () returned 0x970 [0048.437] GetCurrentThreadId () returned 0x970 [0048.437] GetCurrentThreadId () returned 0x970 [0048.437] GetCurrentThreadId () returned 0x970 [0048.437] GetCurrentThreadId () returned 0x970 [0048.437] GetCurrentThreadId () returned 0x970 [0048.437] GetCurrentThreadId () returned 0x970 [0048.437] GetCurrentThreadId () returned 0x970 [0048.437] GetCurrentThreadId () returned 0x970 [0048.437] GetCurrentThreadId () returned 0x970 [0048.437] GetCurrentThreadId () returned 0x970 [0048.437] GetCurrentThreadId () returned 0x970 [0048.437] GetCurrentThreadId () returned 0x970 [0048.437] GetCurrentThreadId () returned 0x970 [0048.437] GetCurrentThreadId () returned 0x970 [0048.437] GetCurrentThreadId () returned 0x970 [0048.437] GetCurrentThreadId () returned 0x970 [0048.437] GetCurrentThreadId () returned 0x970 [0048.437] GetCurrentThreadId () returned 0x970 [0048.437] GetCurrentThreadId () returned 0x970 [0048.438] GetCurrentThreadId () returned 0x970 [0048.438] GetCurrentThreadId () returned 0x970 [0048.438] GetCurrentThreadId () returned 0x970 [0048.438] GetCurrentThreadId () returned 0x970 [0048.438] GetCurrentThreadId () returned 0x970 [0048.438] GetCurrentThreadId () returned 0x970 [0048.438] GetCurrentThreadId () returned 0x970 [0048.438] GetCurrentThreadId () returned 0x970 [0048.438] GetCurrentThreadId () returned 0x970 [0048.438] GetCurrentThreadId () returned 0x970 [0048.438] GetCurrentThreadId () returned 0x970 [0048.438] GetCurrentThreadId () returned 0x970 [0048.438] GetCurrentThreadId () returned 0x970 [0048.438] GetCurrentThreadId () returned 0x970 [0048.438] GetCurrentThreadId () returned 0x970 [0048.438] GetCurrentThreadId () returned 0x970 [0048.438] GetCurrentThreadId () returned 0x970 [0048.438] GetCurrentThreadId () returned 0x970 [0048.438] GetCurrentThreadId () returned 0x970 [0048.438] GetCurrentThreadId () returned 0x970 [0048.438] GetCurrentThreadId () returned 0x970 [0048.438] GetCurrentThreadId () returned 0x970 [0048.438] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.438] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.438] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb310, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.438] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.438] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.438] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb310, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.438] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.438] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.438] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.438] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.438] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.438] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.438] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.438] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.438] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb370, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.438] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.438] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.439] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb370, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.439] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.439] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.439] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb370, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.439] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x37, wMilliseconds=0x2ea)) [0048.439] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="q&4/!EM*{FrXL-nM%7Yjc^A<}%jk~S),", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0048.439] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="q&4/!EM*{FrXL-nM%7Yjc^A<}%jk~S),", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0048.439] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="q&4/!EM*{FrXL-nM%7Yjc^A<}%jk~S),", cchWideChar=32, lpMultiByteStr=0x20007d8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="q&4/!EM*{FrXL-nM%7Yjc^A<}%jk~S),", lpUsedDefaultChar=0x0) returned 32 [0048.439] GetCurrentThreadId () returned 0x970 [0048.439] GetCurrentThreadId () returned 0x970 [0048.439] GetCurrentThreadId () returned 0x970 [0048.439] GetCurrentThreadId () returned 0x970 [0048.439] GetCurrentThreadId () returned 0x970 [0048.439] GetCurrentThreadId () returned 0x970 [0048.446] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0048.446] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0048.446] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x202d6a8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0048.446] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x35904f8, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0048.446] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x35904f8, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAADnEggT886ci+d9LSMpeD036CULAh7MTgaxj1DxErqxHi/Pb7cxslQsfXEY5ev5bnTreV4yeP5XR/ue3X/yiUh0g8TjyN1WqHyRgQQDSH6/2KoYbEc0VbLpg4NHIN3lVI74pr9GaN8Z2MoWiOm5Ckc3P0cc0D6ah0dQUbH7N8hje3sFo09dNlGBS2Ka+VDrDdf1EJD1gMGuNOgJ/i/W8tQjSZcMiqjBr2g==") returned 232 [0048.446] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x37, wMilliseconds=0x2ea)) [0048.446] GetCurrentThreadId () returned 0x970 [0048.446] GetCurrentThreadId () returned 0x970 [0048.446] GetCurrentThreadId () returned 0x970 [0048.446] GetCurrentThreadId () returned 0x970 [0048.446] GetCurrentThreadId () returned 0x970 [0048.446] GetCurrentThreadId () returned 0x970 [0048.446] GetCurrentThreadId () returned 0x970 [0048.446] GetCurrentThreadId () returned 0x970 [0048.446] GetCurrentThreadId () returned 0x970 [0048.446] GetCurrentThreadId () returned 0x970 [0048.446] GetCurrentThreadId () returned 0x970 [0048.446] GetCurrentThreadId () returned 0x970 [0048.447] GetCurrentThreadId () returned 0x970 [0048.447] GetCurrentThreadId () returned 0x970 [0048.447] GetCurrentThreadId () returned 0x970 [0048.447] GetCurrentThreadId () returned 0x970 [0048.447] GetCurrentThreadId () returned 0x970 [0048.447] GetCurrentThreadId () returned 0x970 [0048.447] GetCurrentThreadId () returned 0x970 [0048.447] GetCurrentThreadId () returned 0x970 [0048.447] GetCurrentThreadId () returned 0x970 [0048.447] GetCurrentThreadId () returned 0x970 [0048.447] GetCurrentThreadId () returned 0x970 [0048.447] GetCurrentThreadId () returned 0x970 [0048.447] GetCurrentThreadId () returned 0x970 [0048.447] GetCurrentThreadId () returned 0x970 [0048.447] GetCurrentThreadId () returned 0x970 [0048.447] GetCurrentThreadId () returned 0x970 [0048.447] GetCurrentThreadId () returned 0x970 [0048.447] GetCurrentThreadId () returned 0x970 [0048.447] GetCurrentThreadId () returned 0x970 [0048.447] GetCurrentThreadId () returned 0x970 [0048.447] GetCurrentThreadId () returned 0x970 [0048.447] GetCurrentThreadId () returned 0x970 [0048.447] GetCurrentThreadId () returned 0x970 [0048.447] GetCurrentThreadId () returned 0x970 [0048.447] GetCurrentThreadId () returned 0x970 [0048.447] GetCurrentThreadId () returned 0x970 [0048.447] GetCurrentThreadId () returned 0x970 [0048.447] GetCurrentThreadId () returned 0x970 [0048.447] GetCurrentThreadId () returned 0x970 [0048.447] GetCurrentThreadId () returned 0x970 [0048.447] GetCurrentThreadId () returned 0x970 [0048.447] GetCurrentThreadId () returned 0x970 [0048.447] GetCurrentThreadId () returned 0x970 [0048.447] GetCurrentThreadId () returned 0x970 [0048.447] GetCurrentThreadId () returned 0x970 [0048.447] GetCurrentThreadId () returned 0x970 [0048.447] GetCurrentThreadId () returned 0x970 [0048.447] GetCurrentThreadId () returned 0x970 [0048.447] GetCurrentThreadId () returned 0x970 [0048.447] GetCurrentThreadId () returned 0x970 [0048.447] GetCurrentThreadId () returned 0x970 [0048.447] GetCurrentThreadId () returned 0x970 [0048.447] GetCurrentThreadId () returned 0x970 [0048.447] GetCurrentThreadId () returned 0x970 [0048.447] GetCurrentThreadId () returned 0x970 [0048.447] GetCurrentThreadId () returned 0x970 [0048.447] GetCurrentThreadId () returned 0x970 [0048.447] GetCurrentThreadId () returned 0x970 [0048.447] GetCurrentThreadId () returned 0x970 [0048.448] GetCurrentThreadId () returned 0x970 [0048.448] GetCurrentThreadId () returned 0x970 [0048.448] GetCurrentThreadId () returned 0x970 [0048.448] GetCurrentThreadId () returned 0x970 [0048.448] GetCurrentThreadId () returned 0x970 [0048.448] GetCurrentThreadId () returned 0x970 [0048.448] GetCurrentThreadId () returned 0x970 [0048.448] GetCurrentThreadId () returned 0x970 [0048.448] GetCurrentThreadId () returned 0x970 [0048.448] GetCurrentThreadId () returned 0x970 [0048.448] GetCurrentThreadId () returned 0x970 [0048.448] GetCurrentThreadId () returned 0x970 [0048.448] GetCurrentThreadId () returned 0x970 [0048.448] GetCurrentThreadId () returned 0x970 [0048.448] GetCurrentThreadId () returned 0x970 [0048.448] GetCurrentThreadId () returned 0x970 [0048.448] GetCurrentThreadId () returned 0x970 [0048.448] GetCurrentThreadId () returned 0x970 [0048.448] GetCurrentThreadId () returned 0x970 [0048.448] GetCurrentThreadId () returned 0x970 [0048.448] GetCurrentThreadId () returned 0x970 [0048.448] GetCurrentThreadId () returned 0x970 [0048.448] GetCurrentThreadId () returned 0x970 [0048.448] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAADnEggT886ci+d9LSMpeD036CULAh7MTgaxj1DxErqxHi/Pb7cxslQsfXEY5ev5bnTreV4yeP5XR/ue3X/yiUh0g8TjyN1WqHyRgQQDSH6/2KoYbEc0VbLpg4NHIN3lVI74pr9GaN8Z2MoWiOm5Ckc3P0cc0D6ah0dQUbH7N8hje3sFo09dNlGBS2Ka+VDrDdf1EJD1gMGuNOgJ/i/W8tQjSZcMiqjBr2g==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0048.448] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAADnEggT886ci+d9LSMpeD036CULAh7MTgaxj1DxErqxHi/Pb7cxslQsfXEY5ev5bnTreV4yeP5XR/ue3X/yiUh0g8TjyN1WqHyRgQQDSH6/2KoYbEc0VbLpg4NHIN3lVI74pr9GaN8Z2MoWiOm5Ckc3P0cc0D6ah0dQUbH7N8hje3sFo09dNlGBS2Ka+VDrDdf1EJD1gMGuNOgJ/i/W8tQjSZcMiqjBr2g==", cchWideChar=245, lpMultiByteStr=0x353900c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAADnEggT886ci+d9LSMpeD036CULAh7MTgaxj1DxErqxHi/Pb7cxslQsfXEY5ev5bnTreV4yeP5XR/ue3X/yiUh0g8TjyN1WqHyRgQQDSH6/2KoYbEc0VbLpg4NHIN3lVI74pr9GaN8Z2MoWiOm5Ckc3P0cc0D6ah0dQUbH7N8hje3sFo09dNlGBS2Ka+VDrDdf1EJD1gMGuNOgJ/i/W8tQjSZcMiqjBr2g==", lpUsedDefaultChar=0x0) returned 245 [0048.448] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0048.448] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0048.448] CloseHandle (hObject=0x158) returned 1 [0048.449] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml")) returned 1 [0048.450] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=16871333936) returned 1 [0048.450] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Файл зашифрован [Setup.xml].wannacash .zip" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\Файл зашифрован [setup.xml].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0048.450] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0048.450] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0048.450] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0048.450] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0048.450] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0048.451] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0048.451] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0048.451] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0048.451] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0048.451] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0048.451] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0048.451] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0048.451] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0048.451] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0048.451] SetEndOfFile (hFile=0x158) returned 1 [0048.451] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0048.451] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0048.451] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0048.451] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0048.451] WriteFile (in: hFile=0x158, lpBuffer=0x361f5a8*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x361f5a8*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0048.452] WriteFile (in: hFile=0x158, lpBuffer=0x35f011c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f011c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0048.452] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FLIFsc{J<,tffKR=+6^pOGvk^E=e?=Lt", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0048.452] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FLIFsc{J<,tffKR=+6^pOGvk^E=e?=Lt", cchWideChar=32, lpMultiByteStr=0x203297c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FLIFsc{J<,tffKR=+6^pOGvk^E=e?=Lt", lpUsedDefaultChar=0x0) returned 32 [0048.453] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0048.453] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0048.453] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7ca00570, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7ca00570, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0x295098 [0048.453] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0048.453] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0048.453] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0048.453] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0048.453] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0048.453] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0048.453] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7ca00570, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7ca00570, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b)) returned 1 [0048.453] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0048.453] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0048.453] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0048.453] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0048.454] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0048.454] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0048.454] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0048.454] SetEndOfFile (hFile=0x158) returned 1 [0048.454] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0048.454] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x1fe386c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0048.455] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0048.455] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x1fe382c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0048.455] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe382c, cbMultiByte=9, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="Setup.xml.xmllmll@\x01") returned 9 [0048.455] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0048.455] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x1fe386c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0048.455] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0048.455] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0048.455] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x412b [0048.455] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0048.455] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0048.455] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0048.455] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0048.455] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x1fe386c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0048.455] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0048.455] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x1fe382c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0048.455] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe382c, cbMultiByte=9, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="Setup.xmlup.xml.xmllmll@\x01") returned 9 [0048.455] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0048.455] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x1fe386c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0048.456] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0048.456] CharToOemA (in: pSrc="Setup.xml", pDst=0x1fe382c | out: pDst="Setup.xml") returned 1 [0048.456] WriteFile (in: hFile=0x158, lpBuffer=0x1fe382c*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe382c*, lpNumberOfBytesWritten=0x18e048*=0x9, lpOverlapped=0x0) returned 1 [0048.456] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0048.456] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0048.457] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0048.457] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=16872009431) returned 1 [0048.457] ReadFile (in: hFile=0x15c, lpBuffer=0x3500220, nNumberOfBytesToRead=0x412b, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3500220*, lpNumberOfBytesRead=0x18dd7c*=0x412b, lpOverlapped=0x0) returned 1 [0048.458] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0048.458] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=16872164681) returned 1 [0048.466] WriteFile (in: hFile=0x158, lpBuffer=0x1fea2e8*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fea2e8*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0048.467] ReadFile (in: hFile=0x15c, lpBuffer=0x3500220, nNumberOfBytesToRead=0x412b, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3500220*, lpNumberOfBytesRead=0x18de38*=0x412b, lpOverlapped=0x0) returned 1 [0048.467] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x44 [0048.467] WriteFile (in: hFile=0x158, lpBuffer=0x3825e70*, nNumberOfBytesToWrite=0x412b, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3825e70*, lpNumberOfBytesWritten=0x18de10*=0x412b, lpOverlapped=0x0) returned 1 [0048.468] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x416f [0048.468] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0048.468] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0048.468] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0048.468] SetFilePointer (in: hFile=0x158, lDistanceToMove=9, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x27 [0048.468] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x4179 [0048.468] CloseHandle (hObject=0x15c) returned 1 [0048.468] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x4179 [0048.468] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x4179 [0048.468] SetFilePointer (in: hFile=0x158, lDistanceToMove=16761, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x4179 [0048.468] SetFilePointer (in: hFile=0x158, lDistanceToMove=16761, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x4179 [0048.468] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x4179 [0048.468] SetFilePointer (in: hFile=0x158, lDistanceToMove=16761, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x4179 [0048.469] SetEndOfFile (hFile=0x158) returned 1 [0048.469] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x4179 [0048.469] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x4179 [0048.469] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0048.469] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x1fe386c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0048.469] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0048.469] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x1fe3a0c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0048.469] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe3a0c, cbMultiByte=9, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="Setup.xml") returned 9 [0048.469] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0048.469] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x1fe386c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0048.469] WriteFile (in: hFile=0x158, lpBuffer=0x34e3cf8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x34e3cf8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0048.469] CharToOemA (in: pSrc="Setup.xml", pDst=0x1fe3a0c | out: pDst="Setup.xml") returned 1 [0048.469] WriteFile (in: hFile=0x158, lpBuffer=0x1fe3a0c*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe3a0c*, lpNumberOfBytesWritten=0x18efcc*=0x9, lpOverlapped=0x0) returned 1 [0048.469] WriteFile (in: hFile=0x158, lpBuffer=0x1fea260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea260*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0048.469] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0048.469] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0048.470] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x41bb [0048.470] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x41bb [0048.470] WriteFile (in: hFile=0x158, lpBuffer=0x361f5a8*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x361f5a8*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0048.470] WriteFile (in: hFile=0x158, lpBuffer=0x35f011c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f011c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0048.470] DeleteFileW (lpFileName="") returned 0 [0048.470] GetLastError () returned 0x3 [0048.470] GetFileAttributesW (lpFileName="") returned 0xffffffff [0048.470] SetLastError (dwErrCode=0x3) [0048.470] FlushFileBuffers (hFile=0x158) returned 1 [0048.473] GetCurrentThreadId () returned 0x970 [0048.473] GetCurrentThreadId () returned 0x970 [0048.473] GetCurrentThreadId () returned 0x970 [0048.473] GetCurrentThreadId () returned 0x970 [0048.473] GetCurrentThreadId () returned 0x970 [0048.473] GetCurrentThreadId () returned 0x970 [0048.473] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x4272 [0048.473] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x4272 [0048.473] SetFilePointer (in: hFile=0x158, lDistanceToMove=17010, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x4272 [0048.473] CloseHandle (hObject=0x158) returned 1 [0048.474] GetCurrentThreadId () returned 0x970 [0048.474] GetCurrentThreadId () returned 0x970 [0048.474] GetCurrentThreadId () returned 0x970 [0048.474] GetCurrentThreadId () returned 0x970 [0048.474] GetCurrentThreadId () returned 0x970 [0048.474] GetCurrentThreadId () returned 0x970 [0048.474] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Файл зашифрован [Setup.xml].wannacash .zip" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\Файл зашифрован [setup.xml].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0048.474] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4272 [0048.474] SetFilePointer (in: hFile=0x158, lDistanceToMove=16882, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x41f2 [0048.474] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0048.474] GetFileType (hFile=0x158) returned 0x1 [0048.474] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x37, wMilliseconds=0x30a)) [0048.474] GetCurrentThreadId () returned 0x970 [0048.474] GetCurrentThreadId () returned 0x970 [0048.474] GetCurrentThreadId () returned 0x970 [0048.474] GetCurrentThreadId () returned 0x970 [0048.474] GetCurrentThreadId () returned 0x970 [0048.475] GetCurrentThreadId () returned 0x970 [0048.475] GetCurrentThreadId () returned 0x970 [0048.475] GetCurrentThreadId () returned 0x970 [0048.475] GetCurrentThreadId () returned 0x970 [0048.475] GetCurrentThreadId () returned 0x970 [0048.475] GetCurrentThreadId () returned 0x970 [0048.475] GetCurrentThreadId () returned 0x970 [0048.475] GetCurrentThreadId () returned 0x970 [0048.475] GetCurrentThreadId () returned 0x970 [0048.475] GetCurrentThreadId () returned 0x970 [0048.475] GetCurrentThreadId () returned 0x970 [0048.475] GetCurrentThreadId () returned 0x970 [0048.475] GetCurrentThreadId () returned 0x970 [0048.475] GetCurrentThreadId () returned 0x970 [0048.475] GetCurrentThreadId () returned 0x970 [0048.475] GetCurrentThreadId () returned 0x970 [0048.475] GetCurrentThreadId () returned 0x970 [0048.475] GetCurrentThreadId () returned 0x970 [0048.475] GetCurrentThreadId () returned 0x970 [0048.475] GetCurrentThreadId () returned 0x970 [0048.475] GetCurrentThreadId () returned 0x970 [0048.475] GetCurrentThreadId () returned 0x970 [0048.475] GetCurrentThreadId () returned 0x970 [0048.475] GetCurrentThreadId () returned 0x970 [0048.475] GetCurrentThreadId () returned 0x970 [0048.475] GetCurrentThreadId () returned 0x970 [0048.475] GetCurrentThreadId () returned 0x970 [0048.475] GetCurrentThreadId () returned 0x970 [0048.475] GetCurrentThreadId () returned 0x970 [0048.475] GetCurrentThreadId () returned 0x970 [0048.475] GetCurrentThreadId () returned 0x970 [0048.475] GetCurrentThreadId () returned 0x970 [0048.475] GetCurrentThreadId () returned 0x970 [0048.475] GetCurrentThreadId () returned 0x970 [0048.475] GetCurrentThreadId () returned 0x970 [0048.475] GetCurrentThreadId () returned 0x970 [0048.475] GetCurrentThreadId () returned 0x970 [0048.475] GetCurrentThreadId () returned 0x970 [0048.475] GetCurrentThreadId () returned 0x970 [0048.475] GetCurrentThreadId () returned 0x970 [0048.475] GetCurrentThreadId () returned 0x970 [0048.475] GetCurrentThreadId () returned 0x970 [0048.475] GetCurrentThreadId () returned 0x970 [0048.475] GetCurrentThreadId () returned 0x970 [0048.475] GetCurrentThreadId () returned 0x970 [0048.475] GetCurrentThreadId () returned 0x970 [0048.475] GetCurrentThreadId () returned 0x970 [0048.475] GetCurrentThreadId () returned 0x970 [0048.475] GetCurrentThreadId () returned 0x970 [0048.476] GetCurrentThreadId () returned 0x970 [0048.476] GetCurrentThreadId () returned 0x970 [0048.476] GetCurrentThreadId () returned 0x970 [0048.476] GetCurrentThreadId () returned 0x970 [0048.476] GetCurrentThreadId () returned 0x970 [0048.476] GetCurrentThreadId () returned 0x970 [0048.476] GetCurrentThreadId () returned 0x970 [0048.476] GetCurrentThreadId () returned 0x970 [0048.476] GetCurrentThreadId () returned 0x970 [0048.476] GetCurrentThreadId () returned 0x970 [0048.476] GetCurrentThreadId () returned 0x970 [0048.476] GetCurrentThreadId () returned 0x970 [0048.476] GetCurrentThreadId () returned 0x970 [0048.476] GetCurrentThreadId () returned 0x970 [0048.476] GetCurrentThreadId () returned 0x970 [0048.476] GetCurrentThreadId () returned 0x970 [0048.476] GetCurrentThreadId () returned 0x970 [0048.476] GetCurrentThreadId () returned 0x970 [0048.476] GetCurrentThreadId () returned 0x970 [0048.476] GetCurrentThreadId () returned 0x970 [0048.476] GetCurrentThreadId () returned 0x970 [0048.476] GetCurrentThreadId () returned 0x970 [0048.476] GetCurrentThreadId () returned 0x970 [0048.476] GetCurrentThreadId () returned 0x970 [0048.476] GetCurrentThreadId () returned 0x970 [0048.476] GetCurrentThreadId () returned 0x970 [0048.476] GetCurrentThreadId () returned 0x970 [0048.476] GetCurrentThreadId () returned 0x970 [0048.476] GetCurrentThreadId () returned 0x970 [0048.476] GetCurrentThreadId () returned 0x970 [0048.476] GetCurrentThreadId () returned 0x970 [0048.476] GetCurrentThreadId () returned 0x970 [0048.476] GetCurrentThreadId () returned 0x970 [0048.476] GetCurrentThreadId () returned 0x970 [0048.476] GetCurrentThreadId () returned 0x970 [0048.476] GetCurrentThreadId () returned 0x970 [0048.476] GetCurrentThreadId () returned 0x970 [0048.476] GetCurrentThreadId () returned 0x970 [0048.476] GetCurrentThreadId () returned 0x970 [0048.476] GetCurrentThreadId () returned 0x970 [0048.476] GetCurrentThreadId () returned 0x970 [0048.476] GetCurrentThreadId () returned 0x970 [0048.476] GetCurrentThreadId () returned 0x970 [0048.476] GetCurrentThreadId () returned 0x970 [0048.476] GetCurrentThreadId () returned 0x970 [0048.476] GetCurrentThreadId () returned 0x970 [0048.476] GetCurrentThreadId () returned 0x970 [0048.476] GetCurrentThreadId () returned 0x970 [0048.476] GetCurrentThreadId () returned 0x970 [0048.477] GetCurrentThreadId () returned 0x970 [0048.477] GetCurrentThreadId () returned 0x970 [0048.477] GetCurrentThreadId () returned 0x970 [0048.477] GetCurrentThreadId () returned 0x970 [0048.477] GetCurrentThreadId () returned 0x970 [0048.477] GetCurrentThreadId () returned 0x970 [0048.477] GetCurrentThreadId () returned 0x970 [0048.477] GetCurrentThreadId () returned 0x970 [0048.477] GetCurrentThreadId () returned 0x970 [0048.477] GetCurrentThreadId () returned 0x970 [0048.477] GetCurrentThreadId () returned 0x970 [0048.477] GetCurrentThreadId () returned 0x970 [0048.477] GetCurrentThreadId () returned 0x970 [0048.477] GetCurrentThreadId () returned 0x970 [0048.477] GetCurrentThreadId () returned 0x970 [0048.477] GetCurrentThreadId () returned 0x970 [0048.477] GetCurrentThreadId () returned 0x970 [0048.477] GetCurrentThreadId () returned 0x970 [0048.477] GetCurrentThreadId () returned 0x970 [0048.477] GetCurrentThreadId () returned 0x970 [0048.477] GetCurrentThreadId () returned 0x970 [0048.477] GetCurrentThreadId () returned 0x970 [0048.477] GetCurrentThreadId () returned 0x970 [0048.477] GetCurrentThreadId () returned 0x970 [0048.477] GetCurrentThreadId () returned 0x970 [0048.477] GetCurrentThreadId () returned 0x970 [0048.477] GetCurrentThreadId () returned 0x970 [0048.477] GetCurrentThreadId () returned 0x970 [0048.477] GetCurrentThreadId () returned 0x970 [0048.477] GetCurrentThreadId () returned 0x970 [0048.477] GetCurrentThreadId () returned 0x970 [0048.477] GetCurrentThreadId () returned 0x970 [0048.477] GetCurrentThreadId () returned 0x970 [0048.477] GetCurrentThreadId () returned 0x970 [0048.477] GetCurrentThreadId () returned 0x970 [0048.477] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.477] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.477] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb370, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.477] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.477] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.477] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb370, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.477] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.477] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.477] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.478] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.478] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.478] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.478] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.478] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.478] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb3d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.478] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.478] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.478] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb3d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.478] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.478] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.478] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb3d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.478] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x37, wMilliseconds=0x30a)) [0048.478] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="FLIFsc{J<,tffKR=+6^pOGvk^E=e?=Lt", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0048.478] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="FLIFsc{J<,tffKR=+6^pOGvk^E=e?=Lt", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0048.478] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="FLIFsc{J<,tffKR=+6^pOGvk^E=e?=Lt", cchWideChar=32, lpMultiByteStr=0x2000718, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FLIFsc{J<,tffKR=+6^pOGvk^E=e?=Lt", lpUsedDefaultChar=0x0) returned 32 [0048.478] GetCurrentThreadId () returned 0x970 [0048.478] GetCurrentThreadId () returned 0x970 [0048.478] GetCurrentThreadId () returned 0x970 [0048.478] GetCurrentThreadId () returned 0x970 [0048.478] GetCurrentThreadId () returned 0x970 [0048.478] GetCurrentThreadId () returned 0x970 [0048.485] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0048.485] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0048.486] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x202d798, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0048.486] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x35904f8, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0048.486] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x35904f8, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAADv8sHQjBLMZx+UwY0JADMdjSD6B1E0WH24OQ9D6FT4caHglabBo6OI1izHeASopgF+PMmjU6RkqwWr49tA7en9u5HaMKwCXC+zC5yylRoW1DUNuU0FDMDhIQq46H9MEkEYmNphFnxHXvasvzKs6fXbG1EXieI/4sM7yIm0JSCkdhqMOKb+dfpIXRZlVwoRfcicCF4njOV8kavlIa6JTWIrvx25qsrKl/g==") returned 232 [0048.486] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x37, wMilliseconds=0x319)) [0048.486] GetCurrentThreadId () returned 0x970 [0048.486] GetCurrentThreadId () returned 0x970 [0048.486] GetCurrentThreadId () returned 0x970 [0048.486] GetCurrentThreadId () returned 0x970 [0048.486] GetCurrentThreadId () returned 0x970 [0048.486] GetCurrentThreadId () returned 0x970 [0048.486] GetCurrentThreadId () returned 0x970 [0048.486] GetCurrentThreadId () returned 0x970 [0048.486] GetCurrentThreadId () returned 0x970 [0048.486] GetCurrentThreadId () returned 0x970 [0048.486] GetCurrentThreadId () returned 0x970 [0048.486] GetCurrentThreadId () returned 0x970 [0048.486] GetCurrentThreadId () returned 0x970 [0048.486] GetCurrentThreadId () returned 0x970 [0048.486] GetCurrentThreadId () returned 0x970 [0048.486] GetCurrentThreadId () returned 0x970 [0048.486] GetCurrentThreadId () returned 0x970 [0048.486] GetCurrentThreadId () returned 0x970 [0048.486] GetCurrentThreadId () returned 0x970 [0048.486] GetCurrentThreadId () returned 0x970 [0048.486] GetCurrentThreadId () returned 0x970 [0048.486] GetCurrentThreadId () returned 0x970 [0048.486] GetCurrentThreadId () returned 0x970 [0048.486] GetCurrentThreadId () returned 0x970 [0048.486] GetCurrentThreadId () returned 0x970 [0048.486] GetCurrentThreadId () returned 0x970 [0048.486] GetCurrentThreadId () returned 0x970 [0048.486] GetCurrentThreadId () returned 0x970 [0048.486] GetCurrentThreadId () returned 0x970 [0048.486] GetCurrentThreadId () returned 0x970 [0048.486] GetCurrentThreadId () returned 0x970 [0048.486] GetCurrentThreadId () returned 0x970 [0048.486] GetCurrentThreadId () returned 0x970 [0048.486] GetCurrentThreadId () returned 0x970 [0048.486] GetCurrentThreadId () returned 0x970 [0048.486] GetCurrentThreadId () returned 0x970 [0048.486] GetCurrentThreadId () returned 0x970 [0048.486] GetCurrentThreadId () returned 0x970 [0048.486] GetCurrentThreadId () returned 0x970 [0048.486] GetCurrentThreadId () returned 0x970 [0048.486] GetCurrentThreadId () returned 0x970 [0048.487] GetCurrentThreadId () returned 0x970 [0048.487] GetCurrentThreadId () returned 0x970 [0048.487] GetCurrentThreadId () returned 0x970 [0048.487] GetCurrentThreadId () returned 0x970 [0048.487] GetCurrentThreadId () returned 0x970 [0048.487] GetCurrentThreadId () returned 0x970 [0048.487] GetCurrentThreadId () returned 0x970 [0048.487] GetCurrentThreadId () returned 0x970 [0048.487] GetCurrentThreadId () returned 0x970 [0048.487] GetCurrentThreadId () returned 0x970 [0048.487] GetCurrentThreadId () returned 0x970 [0048.487] GetCurrentThreadId () returned 0x970 [0048.487] GetCurrentThreadId () returned 0x970 [0048.487] GetCurrentThreadId () returned 0x970 [0048.487] GetCurrentThreadId () returned 0x970 [0048.487] GetCurrentThreadId () returned 0x970 [0048.487] GetCurrentThreadId () returned 0x970 [0048.487] GetCurrentThreadId () returned 0x970 [0048.487] GetCurrentThreadId () returned 0x970 [0048.487] GetCurrentThreadId () returned 0x970 [0048.487] GetCurrentThreadId () returned 0x970 [0048.487] GetCurrentThreadId () returned 0x970 [0048.487] GetCurrentThreadId () returned 0x970 [0048.487] GetCurrentThreadId () returned 0x970 [0048.487] GetCurrentThreadId () returned 0x970 [0048.487] GetCurrentThreadId () returned 0x970 [0048.487] GetCurrentThreadId () returned 0x970 [0048.487] GetCurrentThreadId () returned 0x970 [0048.487] GetCurrentThreadId () returned 0x970 [0048.487] GetCurrentThreadId () returned 0x970 [0048.487] GetCurrentThreadId () returned 0x970 [0048.487] GetCurrentThreadId () returned 0x970 [0048.487] GetCurrentThreadId () returned 0x970 [0048.487] GetCurrentThreadId () returned 0x970 [0048.487] GetCurrentThreadId () returned 0x970 [0048.487] GetCurrentThreadId () returned 0x970 [0048.487] GetCurrentThreadId () returned 0x970 [0048.487] GetCurrentThreadId () returned 0x970 [0048.487] GetCurrentThreadId () returned 0x970 [0048.487] GetCurrentThreadId () returned 0x970 [0048.487] GetCurrentThreadId () returned 0x970 [0048.487] GetCurrentThreadId () returned 0x970 [0048.487] GetCurrentThreadId () returned 0x970 [0048.487] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAADv8sHQjBLMZx+UwY0JADMdjSD6B1E0WH24OQ9D6FT4caHglabBo6OI1izHeASopgF+PMmjU6RkqwWr49tA7en9u5HaMKwCXC+zC5yylRoW1DUNuU0FDMDhIQq46H9MEkEYmNphFnxHXvasvzKs6fXbG1EXieI/4sM7yIm0JSCkdhqMOKb+dfpIXRZlVwoRfcicCF4njOV8kavlIa6JTWIrvx25qsrKl/g==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0048.487] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAADv8sHQjBLMZx+UwY0JADMdjSD6B1E0WH24OQ9D6FT4caHglabBo6OI1izHeASopgF+PMmjU6RkqwWr49tA7en9u5HaMKwCXC+zC5yylRoW1DUNuU0FDMDhIQq46H9MEkEYmNphFnxHXvasvzKs6fXbG1EXieI/4sM7yIm0JSCkdhqMOKb+dfpIXRZlVwoRfcicCF4njOV8kavlIa6JTWIrvx25qsrKl/g==", cchWideChar=245, lpMultiByteStr=0x353900c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAADv8sHQjBLMZx+UwY0JADMdjSD6B1E0WH24OQ9D6FT4caHglabBo6OI1izHeASopgF+PMmjU6RkqwWr49tA7en9u5HaMKwCXC+zC5yylRoW1DUNuU0FDMDhIQq46H9MEkEYmNphFnxHXvasvzKs6fXbG1EXieI/4sM7yIm0JSCkdhqMOKb+dfpIXRZlVwoRfcicCF4njOV8kavlIa6JTWIrvx25qsrKl/g==", lpUsedDefaultChar=0x0) returned 245 [0048.487] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0048.488] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0048.488] CloseHandle (hObject=0x158) returned 1 [0048.489] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0048.489] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=16875292076) returned 1 [0048.490] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Файл зашифрован [Office32WW.xml].wannacash .zip" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\Файл зашифрован [office32ww.xml].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0048.491] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0048.491] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0048.491] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0048.491] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0048.491] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0048.491] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0048.491] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0048.491] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0048.491] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0048.491] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0048.491] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0048.491] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0048.491] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0048.491] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0048.491] SetEndOfFile (hFile=0x158) returned 1 [0048.491] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0048.491] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0048.491] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0048.492] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0048.492] WriteFile (in: hFile=0x158, lpBuffer=0x361f5a8*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x361f5a8*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0048.493] WriteFile (in: hFile=0x158, lpBuffer=0x35f005c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f005c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0048.493] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="wXk10b{f}{Oy&(,OjFLS+JrWqY#\"&PKE", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0048.493] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="wXk10b{f}{Oy&(,OjFLS+JrWqY#\"&PKE", cchWideChar=32, lpMultiByteStr=0x203290c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wXk10b{f}{Oy&(,OjFLS+JrWqY#\"&PKE", lpUsedDefaultChar=0x0) returned 32 [0048.493] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0048.493] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0048.493] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x16771fb0, ftCreationTime.dwHighDateTime=0x1cb12b4, ftLastAccessTime.dwLowDateTime=0x16771fb0, ftLastAccessTime.dwHighDateTime=0x1cb12b4, ftLastWriteTime.dwLowDateTime=0x46536400, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.xml", cAlternateFileName="OFFICE~1.XML")) returned 0x295098 [0048.493] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0048.493] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0048.493] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0048.493] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0048.493] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0048.493] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0048.493] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x16771fb0, ftCreationTime.dwHighDateTime=0x1cb12b4, ftLastAccessTime.dwLowDateTime=0x16771fb0, ftLastAccessTime.dwHighDateTime=0x1cb12b4, ftLastWriteTime.dwLowDateTime=0x46536400, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x10b2)) returned 1 [0048.493] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0048.493] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0048.493] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0048.494] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0048.494] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0048.494] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0048.494] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0048.494] SetEndOfFile (hFile=0x158) returned 1 [0048.494] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Office32WW.xml", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0048.495] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Office32WW.xml", cchWideChar=14, lpMultiByteStr=0x1fe36ec, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Office32WW.xml", lpUsedDefaultChar=0x0) returned 14 [0048.495] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Office32WW.xml", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0048.495] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Office32WW.xml", cchWideChar=14, lpMultiByteStr=0x1fe378c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Office32WW.xml", lpUsedDefaultChar=0x0) returned 14 [0048.495] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe378c, cbMultiByte=14, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="Office32WW.xmlmll@\x01") returned 14 [0048.495] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Office32WW.xml", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0048.495] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Office32WW.xml", cchWideChar=14, lpMultiByteStr=0x1fe36ec, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Office32WW.xml", lpUsedDefaultChar=0x0) returned 14 [0048.495] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0048.495] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0048.495] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x10b2 [0048.495] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0048.495] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0048.495] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0048.495] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Office32WW.xml", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0048.495] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Office32WW.xml", cchWideChar=14, lpMultiByteStr=0x1fe36ec, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Office32WW.xml", lpUsedDefaultChar=0x0) returned 14 [0048.495] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Office32WW.xml", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0048.495] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Office32WW.xml", cchWideChar=14, lpMultiByteStr=0x1fe378c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Office32WW.xml", lpUsedDefaultChar=0x0) returned 14 [0048.495] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe378c, cbMultiByte=14, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="Office32WW.xmlWW.xmlmll@\x01") returned 14 [0048.495] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Office32WW.xml", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0048.496] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Office32WW.xml", cchWideChar=14, lpMultiByteStr=0x1fe36ec, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Office32WW.xml", lpUsedDefaultChar=0x0) returned 14 [0048.496] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0048.496] CharToOemA (in: pSrc="Office32WW.xml", pDst=0x1fe378c | out: pDst="Office32WW.xml") returned 1 [0048.496] WriteFile (in: hFile=0x158, lpBuffer=0x1fe378c*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe378c*, lpNumberOfBytesWritten=0x18e048*=0xe, lpOverlapped=0x0) returned 1 [0048.496] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0048.497] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0048.497] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0048.497] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=16876016642) returned 1 [0048.497] ReadFile (in: hFile=0x15c, lpBuffer=0x3500220, nNumberOfBytesToRead=0x10b2, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3500220*, lpNumberOfBytesRead=0x18dd7c*=0x10b2, lpOverlapped=0x0) returned 1 [0048.498] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0048.498] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=16876166327) returned 1 [0048.506] WriteFile (in: hFile=0x158, lpBuffer=0x1fea2d0*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fea2d0*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0048.507] ReadFile (in: hFile=0x15c, lpBuffer=0x3500220, nNumberOfBytesToRead=0x10b2, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3500220*, lpNumberOfBytesRead=0x18de38*=0x10b2, lpOverlapped=0x0) returned 1 [0048.507] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x49 [0048.507] WriteFile (in: hFile=0x158, lpBuffer=0x3502a80*, nNumberOfBytesToWrite=0x10b2, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3502a80*, lpNumberOfBytesWritten=0x18de10*=0x10b2, lpOverlapped=0x0) returned 1 [0048.507] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x10fb [0048.507] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0048.507] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0048.507] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0048.507] SetFilePointer (in: hFile=0x158, lDistanceToMove=14, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2c [0048.507] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x1105 [0048.507] CloseHandle (hObject=0x15c) returned 1 [0048.508] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1105 [0048.508] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1105 [0048.508] SetFilePointer (in: hFile=0x158, lDistanceToMove=4357, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1105 [0048.508] SetFilePointer (in: hFile=0x158, lDistanceToMove=4357, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x1105 [0048.508] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1105 [0048.508] SetFilePointer (in: hFile=0x158, lDistanceToMove=4357, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x1105 [0048.508] SetEndOfFile (hFile=0x158) returned 1 [0048.508] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1105 [0048.508] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1105 [0048.508] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Office32WW.xml", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0048.508] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Office32WW.xml", cchWideChar=14, lpMultiByteStr=0x1fe36ec, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Office32WW.xml", lpUsedDefaultChar=0x0) returned 14 [0048.508] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Office32WW.xml", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0048.508] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Office32WW.xml", cchWideChar=14, lpMultiByteStr=0x1fe3b8c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Office32WW.xml", lpUsedDefaultChar=0x0) returned 14 [0048.508] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe3b8c, cbMultiByte=14, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="Office32WW.xml야'\x18믉`믑`") returned 14 [0048.508] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Office32WW.xml", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0048.508] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Office32WW.xml", cchWideChar=14, lpMultiByteStr=0x1fe36ec, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Office32WW.xml", lpUsedDefaultChar=0x0) returned 14 [0048.508] WriteFile (in: hFile=0x158, lpBuffer=0x34e3cf8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x34e3cf8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0048.509] CharToOemA (in: pSrc="Office32WW.xml", pDst=0x1fe3b8c | out: pDst="Office32WW.xml") returned 1 [0048.509] WriteFile (in: hFile=0x158, lpBuffer=0x1fe3b8c*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe3b8c*, lpNumberOfBytesWritten=0x18efcc*=0xe, lpOverlapped=0x0) returned 1 [0048.509] WriteFile (in: hFile=0x158, lpBuffer=0x1fea1e8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea1e8*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0048.509] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0048.509] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0048.509] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x114c [0048.509] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x114c [0048.509] WriteFile (in: hFile=0x158, lpBuffer=0x361f5a8*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x361f5a8*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0048.509] WriteFile (in: hFile=0x158, lpBuffer=0x35f005c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f005c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0048.509] DeleteFileW (lpFileName="") returned 0 [0048.509] GetLastError () returned 0x3 [0048.509] GetFileAttributesW (lpFileName="") returned 0xffffffff [0048.509] SetLastError (dwErrCode=0x3) [0048.509] FlushFileBuffers (hFile=0x158) returned 1 [0048.512] GetCurrentThreadId () returned 0x970 [0048.512] GetCurrentThreadId () returned 0x970 [0048.512] GetCurrentThreadId () returned 0x970 [0048.512] GetCurrentThreadId () returned 0x970 [0048.512] GetCurrentThreadId () returned 0x970 [0048.512] GetCurrentThreadId () returned 0x970 [0048.512] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x1203 [0048.512] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x1203 [0048.512] SetFilePointer (in: hFile=0x158, lDistanceToMove=4611, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x1203 [0048.512] CloseHandle (hObject=0x158) returned 1 [0048.513] GetCurrentThreadId () returned 0x970 [0048.513] GetCurrentThreadId () returned 0x970 [0048.513] GetCurrentThreadId () returned 0x970 [0048.513] GetCurrentThreadId () returned 0x970 [0048.513] GetCurrentThreadId () returned 0x970 [0048.513] GetCurrentThreadId () returned 0x970 [0048.513] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Файл зашифрован [Office32WW.xml].wannacash .zip" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\Файл зашифрован [office32ww.xml].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0048.513] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1203 [0048.513] SetFilePointer (in: hFile=0x158, lDistanceToMove=4483, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1183 [0048.514] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0048.514] GetFileType (hFile=0x158) returned 0x1 [0048.514] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x37, wMilliseconds=0x329)) [0048.514] GetCurrentThreadId () returned 0x970 [0048.514] GetCurrentThreadId () returned 0x970 [0048.514] GetCurrentThreadId () returned 0x970 [0048.514] GetCurrentThreadId () returned 0x970 [0048.514] GetCurrentThreadId () returned 0x970 [0048.514] GetCurrentThreadId () returned 0x970 [0048.514] GetCurrentThreadId () returned 0x970 [0048.514] GetCurrentThreadId () returned 0x970 [0048.514] GetCurrentThreadId () returned 0x970 [0048.514] GetCurrentThreadId () returned 0x970 [0048.514] GetCurrentThreadId () returned 0x970 [0048.514] GetCurrentThreadId () returned 0x970 [0048.514] GetCurrentThreadId () returned 0x970 [0048.514] GetCurrentThreadId () returned 0x970 [0048.514] GetCurrentThreadId () returned 0x970 [0048.514] GetCurrentThreadId () returned 0x970 [0048.514] GetCurrentThreadId () returned 0x970 [0048.514] GetCurrentThreadId () returned 0x970 [0048.514] GetCurrentThreadId () returned 0x970 [0048.514] GetCurrentThreadId () returned 0x970 [0048.514] GetCurrentThreadId () returned 0x970 [0048.514] GetCurrentThreadId () returned 0x970 [0048.514] GetCurrentThreadId () returned 0x970 [0048.514] GetCurrentThreadId () returned 0x970 [0048.514] GetCurrentThreadId () returned 0x970 [0048.514] GetCurrentThreadId () returned 0x970 [0048.514] GetCurrentThreadId () returned 0x970 [0048.514] GetCurrentThreadId () returned 0x970 [0048.514] GetCurrentThreadId () returned 0x970 [0048.514] GetCurrentThreadId () returned 0x970 [0048.514] GetCurrentThreadId () returned 0x970 [0048.514] GetCurrentThreadId () returned 0x970 [0048.514] GetCurrentThreadId () returned 0x970 [0048.514] GetCurrentThreadId () returned 0x970 [0048.515] GetCurrentThreadId () returned 0x970 [0048.515] GetCurrentThreadId () returned 0x970 [0048.515] GetCurrentThreadId () returned 0x970 [0048.515] GetCurrentThreadId () returned 0x970 [0048.515] GetCurrentThreadId () returned 0x970 [0048.515] GetCurrentThreadId () returned 0x970 [0048.515] GetCurrentThreadId () returned 0x970 [0048.515] GetCurrentThreadId () returned 0x970 [0048.515] GetCurrentThreadId () returned 0x970 [0048.515] GetCurrentThreadId () returned 0x970 [0048.515] GetCurrentThreadId () returned 0x970 [0048.515] GetCurrentThreadId () returned 0x970 [0048.515] GetCurrentThreadId () returned 0x970 [0048.515] GetCurrentThreadId () returned 0x970 [0048.515] GetCurrentThreadId () returned 0x970 [0048.515] GetCurrentThreadId () returned 0x970 [0048.515] GetCurrentThreadId () returned 0x970 [0048.515] GetCurrentThreadId () returned 0x970 [0048.515] GetCurrentThreadId () returned 0x970 [0048.515] GetCurrentThreadId () returned 0x970 [0048.515] GetCurrentThreadId () returned 0x970 [0048.515] GetCurrentThreadId () returned 0x970 [0048.515] GetCurrentThreadId () returned 0x970 [0048.515] GetCurrentThreadId () returned 0x970 [0048.515] GetCurrentThreadId () returned 0x970 [0048.515] GetCurrentThreadId () returned 0x970 [0048.515] GetCurrentThreadId () returned 0x970 [0048.515] GetCurrentThreadId () returned 0x970 [0048.515] GetCurrentThreadId () returned 0x970 [0048.515] GetCurrentThreadId () returned 0x970 [0048.515] GetCurrentThreadId () returned 0x970 [0048.515] GetCurrentThreadId () returned 0x970 [0048.515] GetCurrentThreadId () returned 0x970 [0048.515] GetCurrentThreadId () returned 0x970 [0048.515] GetCurrentThreadId () returned 0x970 [0048.515] GetCurrentThreadId () returned 0x970 [0048.515] GetCurrentThreadId () returned 0x970 [0048.515] GetCurrentThreadId () returned 0x970 [0048.515] GetCurrentThreadId () returned 0x970 [0048.515] GetCurrentThreadId () returned 0x970 [0048.515] GetCurrentThreadId () returned 0x970 [0048.515] GetCurrentThreadId () returned 0x970 [0048.515] GetCurrentThreadId () returned 0x970 [0048.515] GetCurrentThreadId () returned 0x970 [0048.515] GetCurrentThreadId () returned 0x970 [0048.515] GetCurrentThreadId () returned 0x970 [0048.515] GetCurrentThreadId () returned 0x970 [0048.515] GetCurrentThreadId () returned 0x970 [0048.515] GetCurrentThreadId () returned 0x970 [0048.516] GetCurrentThreadId () returned 0x970 [0048.516] GetCurrentThreadId () returned 0x970 [0048.516] GetCurrentThreadId () returned 0x970 [0048.516] GetCurrentThreadId () returned 0x970 [0048.516] GetCurrentThreadId () returned 0x970 [0048.516] GetCurrentThreadId () returned 0x970 [0048.516] GetCurrentThreadId () returned 0x970 [0048.516] GetCurrentThreadId () returned 0x970 [0048.516] GetCurrentThreadId () returned 0x970 [0048.516] GetCurrentThreadId () returned 0x970 [0048.516] GetCurrentThreadId () returned 0x970 [0048.516] GetCurrentThreadId () returned 0x970 [0048.516] GetCurrentThreadId () returned 0x970 [0048.516] GetCurrentThreadId () returned 0x970 [0048.516] GetCurrentThreadId () returned 0x970 [0048.516] GetCurrentThreadId () returned 0x970 [0048.516] GetCurrentThreadId () returned 0x970 [0048.516] GetCurrentThreadId () returned 0x970 [0048.516] GetCurrentThreadId () returned 0x970 [0048.516] GetCurrentThreadId () returned 0x970 [0048.516] GetCurrentThreadId () returned 0x970 [0048.516] GetCurrentThreadId () returned 0x970 [0048.516] GetCurrentThreadId () returned 0x970 [0048.516] GetCurrentThreadId () returned 0x970 [0048.516] GetCurrentThreadId () returned 0x970 [0048.516] GetCurrentThreadId () returned 0x970 [0048.516] GetCurrentThreadId () returned 0x970 [0048.516] GetCurrentThreadId () returned 0x970 [0048.516] GetCurrentThreadId () returned 0x970 [0048.516] GetCurrentThreadId () returned 0x970 [0048.516] GetCurrentThreadId () returned 0x970 [0048.516] GetCurrentThreadId () returned 0x970 [0048.516] GetCurrentThreadId () returned 0x970 [0048.516] GetCurrentThreadId () returned 0x970 [0048.516] GetCurrentThreadId () returned 0x970 [0048.516] GetCurrentThreadId () returned 0x970 [0048.516] GetCurrentThreadId () returned 0x970 [0048.516] GetCurrentThreadId () returned 0x970 [0048.516] GetCurrentThreadId () returned 0x970 [0048.516] GetCurrentThreadId () returned 0x970 [0048.516] GetCurrentThreadId () returned 0x970 [0048.516] GetCurrentThreadId () returned 0x970 [0048.516] GetCurrentThreadId () returned 0x970 [0048.516] GetCurrentThreadId () returned 0x970 [0048.516] GetCurrentThreadId () returned 0x970 [0048.516] GetCurrentThreadId () returned 0x970 [0048.516] GetCurrentThreadId () returned 0x970 [0048.516] GetCurrentThreadId () returned 0x970 [0048.517] GetCurrentThreadId () returned 0x970 [0048.517] GetCurrentThreadId () returned 0x970 [0048.517] GetCurrentThreadId () returned 0x970 [0048.517] GetCurrentThreadId () returned 0x970 [0048.517] GetCurrentThreadId () returned 0x970 [0048.517] GetCurrentThreadId () returned 0x970 [0048.517] GetCurrentThreadId () returned 0x970 [0048.517] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.517] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.517] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb3d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.517] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.517] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.517] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb3d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.517] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.517] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.517] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.517] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.517] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.517] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.517] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.517] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.517] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb430, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.517] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.517] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.517] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb430, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.517] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.517] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.517] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb430, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.517] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x37, wMilliseconds=0x338)) [0048.517] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wXk10b{f}{Oy&(,OjFLS+JrWqY#\"&PKE", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0048.517] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wXk10b{f}{Oy&(,OjFLS+JrWqY#\"&PKE", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0048.517] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wXk10b{f}{Oy&(,OjFLS+JrWqY#\"&PKE", cchWideChar=32, lpMultiByteStr=0x2000838, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wXk10b{f}{Oy&(,OjFLS+JrWqY#\"&PKE", lpUsedDefaultChar=0x0) returned 32 [0048.517] GetCurrentThreadId () returned 0x970 [0048.518] GetCurrentThreadId () returned 0x970 [0048.518] GetCurrentThreadId () returned 0x970 [0048.518] GetCurrentThreadId () returned 0x970 [0048.518] GetCurrentThreadId () returned 0x970 [0048.518] GetCurrentThreadId () returned 0x970 [0048.525] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0048.525] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0048.525] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x202d888, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0048.525] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x35904f8, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0048.525] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x35904f8, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAABqGxXSdId1K4bxEzcQ4IMnSmUjL9K6dqZSE8F7NNy9f6FPeu8FGGeSDcCZbiNvemz3oawaVo9EOIfPAeNhRuROOl/CzVxSXF5wzrlVMTkl/FHj7aOj8RiSXAW0jPTnc09OmbusMV5TexXbLJ72WD1fKvdXGsyVnu/1RTvJrBbnTSBgsIx73TneDqhVzmA1FCoBtfzSDgYPuGpyChdrR7g4XRU59vK6AQQ==") returned 232 [0048.525] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x37, wMilliseconds=0x338)) [0048.525] GetCurrentThreadId () returned 0x970 [0048.525] GetCurrentThreadId () returned 0x970 [0048.525] GetCurrentThreadId () returned 0x970 [0048.525] GetCurrentThreadId () returned 0x970 [0048.525] GetCurrentThreadId () returned 0x970 [0048.525] GetCurrentThreadId () returned 0x970 [0048.525] GetCurrentThreadId () returned 0x970 [0048.525] GetCurrentThreadId () returned 0x970 [0048.525] GetCurrentThreadId () returned 0x970 [0048.525] GetCurrentThreadId () returned 0x970 [0048.525] GetCurrentThreadId () returned 0x970 [0048.525] GetCurrentThreadId () returned 0x970 [0048.525] GetCurrentThreadId () returned 0x970 [0048.525] GetCurrentThreadId () returned 0x970 [0048.525] GetCurrentThreadId () returned 0x970 [0048.525] GetCurrentThreadId () returned 0x970 [0048.525] GetCurrentThreadId () returned 0x970 [0048.525] GetCurrentThreadId () returned 0x970 [0048.525] GetCurrentThreadId () returned 0x970 [0048.525] GetCurrentThreadId () returned 0x970 [0048.525] GetCurrentThreadId () returned 0x970 [0048.525] GetCurrentThreadId () returned 0x970 [0048.525] GetCurrentThreadId () returned 0x970 [0048.525] GetCurrentThreadId () returned 0x970 [0048.525] GetCurrentThreadId () returned 0x970 [0048.525] GetCurrentThreadId () returned 0x970 [0048.525] GetCurrentThreadId () returned 0x970 [0048.525] GetCurrentThreadId () returned 0x970 [0048.525] GetCurrentThreadId () returned 0x970 [0048.525] GetCurrentThreadId () returned 0x970 [0048.526] GetCurrentThreadId () returned 0x970 [0048.526] GetCurrentThreadId () returned 0x970 [0048.526] GetCurrentThreadId () returned 0x970 [0048.526] GetCurrentThreadId () returned 0x970 [0048.526] GetCurrentThreadId () returned 0x970 [0048.526] GetCurrentThreadId () returned 0x970 [0048.526] GetCurrentThreadId () returned 0x970 [0048.526] GetCurrentThreadId () returned 0x970 [0048.526] GetCurrentThreadId () returned 0x970 [0048.526] GetCurrentThreadId () returned 0x970 [0048.526] GetCurrentThreadId () returned 0x970 [0048.526] GetCurrentThreadId () returned 0x970 [0048.526] GetCurrentThreadId () returned 0x970 [0048.526] GetCurrentThreadId () returned 0x970 [0048.526] GetCurrentThreadId () returned 0x970 [0048.526] GetCurrentThreadId () returned 0x970 [0048.526] GetCurrentThreadId () returned 0x970 [0048.526] GetCurrentThreadId () returned 0x970 [0048.526] GetCurrentThreadId () returned 0x970 [0048.526] GetCurrentThreadId () returned 0x970 [0048.526] GetCurrentThreadId () returned 0x970 [0048.526] GetCurrentThreadId () returned 0x970 [0048.526] GetCurrentThreadId () returned 0x970 [0048.526] GetCurrentThreadId () returned 0x970 [0048.526] GetCurrentThreadId () returned 0x970 [0048.526] GetCurrentThreadId () returned 0x970 [0048.526] GetCurrentThreadId () returned 0x970 [0048.526] GetCurrentThreadId () returned 0x970 [0048.526] GetCurrentThreadId () returned 0x970 [0048.526] GetCurrentThreadId () returned 0x970 [0048.526] GetCurrentThreadId () returned 0x970 [0048.526] GetCurrentThreadId () returned 0x970 [0048.526] GetCurrentThreadId () returned 0x970 [0048.526] GetCurrentThreadId () returned 0x970 [0048.526] GetCurrentThreadId () returned 0x970 [0048.526] GetCurrentThreadId () returned 0x970 [0048.526] GetCurrentThreadId () returned 0x970 [0048.526] GetCurrentThreadId () returned 0x970 [0048.526] GetCurrentThreadId () returned 0x970 [0048.526] GetCurrentThreadId () returned 0x970 [0048.526] GetCurrentThreadId () returned 0x970 [0048.526] GetCurrentThreadId () returned 0x970 [0048.526] GetCurrentThreadId () returned 0x970 [0048.526] GetCurrentThreadId () returned 0x970 [0048.526] GetCurrentThreadId () returned 0x970 [0048.526] GetCurrentThreadId () returned 0x970 [0048.527] GetCurrentThreadId () returned 0x970 [0048.527] GetCurrentThreadId () returned 0x970 [0048.527] GetCurrentThreadId () returned 0x970 [0048.527] GetCurrentThreadId () returned 0x970 [0048.527] GetCurrentThreadId () returned 0x970 [0048.527] GetCurrentThreadId () returned 0x970 [0048.527] GetCurrentThreadId () returned 0x970 [0048.527] GetCurrentThreadId () returned 0x970 [0048.527] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAABqGxXSdId1K4bxEzcQ4IMnSmUjL9K6dqZSE8F7NNy9f6FPeu8FGGeSDcCZbiNvemz3oawaVo9EOIfPAeNhRuROOl/CzVxSXF5wzrlVMTkl/FHj7aOj8RiSXAW0jPTnc09OmbusMV5TexXbLJ72WD1fKvdXGsyVnu/1RTvJrBbnTSBgsIx73TneDqhVzmA1FCoBtfzSDgYPuGpyChdrR7g4XRU59vK6AQQ==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0048.527] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAABqGxXSdId1K4bxEzcQ4IMnSmUjL9K6dqZSE8F7NNy9f6FPeu8FGGeSDcCZbiNvemz3oawaVo9EOIfPAeNhRuROOl/CzVxSXF5wzrlVMTkl/FHj7aOj8RiSXAW0jPTnc09OmbusMV5TexXbLJ72WD1fKvdXGsyVnu/1RTvJrBbnTSBgsIx73TneDqhVzmA1FCoBtfzSDgYPuGpyChdrR7g4XRU59vK6AQQ==", cchWideChar=245, lpMultiByteStr=0x353900c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAABqGxXSdId1K4bxEzcQ4IMnSmUjL9K6dqZSE8F7NNy9f6FPeu8FGGeSDcCZbiNvemz3oawaVo9EOIfPAeNhRuROOl/CzVxSXF5wzrlVMTkl/FHj7aOj8RiSXAW0jPTnc09OmbusMV5TexXbLJ72WD1fKvdXGsyVnu/1RTvJrBbnTSBgsIx73TneDqhVzmA1FCoBtfzSDgYPuGpyChdrR7g4XRU59vK6AQQ==", lpUsedDefaultChar=0x0) returned 245 [0048.527] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0048.527] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0048.527] CloseHandle (hObject=0x158) returned 1 [0048.528] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0048.529] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=16879199672) returned 1 [0048.529] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Файл зашифрован [Setup.xml].wannacash .zip" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\Файл зашифрован [setup.xml].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0048.529] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0048.529] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0048.529] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0048.529] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0048.529] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0048.529] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0048.529] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0048.529] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0048.529] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0048.529] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0048.530] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0048.530] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0048.530] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0048.530] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0048.530] SetEndOfFile (hFile=0x158) returned 1 [0048.530] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0048.530] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0048.530] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0048.530] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0048.530] WriteFile (in: hFile=0x158, lpBuffer=0x361f5a8*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x361f5a8*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0048.531] WriteFile (in: hFile=0x158, lpBuffer=0x35f011c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f011c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0048.531] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3QGq?wXeoD:unn}Gn00gb%Jn613K>", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0048.531] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3QGq?wXeoD:unn}Gn00gb%Jn613K>", cchWideChar=32, lpMultiByteStr=0x20329b4, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3QGq?wXeoD:unn}Gn00gb%Jn613K>", lpUsedDefaultChar=0x0) returned 32 [0048.531] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0048.531] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0048.531] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80aa51d0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80aa51d0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x4a6d3200, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x5061, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0x295098 [0048.531] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0048.531] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0048.531] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0048.532] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0048.532] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0048.532] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0048.532] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80aa51d0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80aa51d0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x4a6d3200, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x5061)) returned 1 [0048.532] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0048.532] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0048.532] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0048.532] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0048.532] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0048.532] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0048.532] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0048.532] SetEndOfFile (hFile=0x158) returned 1 [0048.533] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0048.533] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x1fe358c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0048.533] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0048.533] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x1fe380c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0048.533] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe380c, cbMultiByte=9, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="Setup.xmlW.xmlmll@\x01") returned 9 [0048.533] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0048.533] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x1fe358c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0048.533] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0048.533] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0048.533] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x5061 [0048.533] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0048.533] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0048.534] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0048.534] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0048.534] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x1fe358c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0048.534] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0048.534] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x1fe380c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0048.534] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe380c, cbMultiByte=9, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="Setup.xmlup.xmlW.xmlmll@\x01") returned 9 [0048.534] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0048.534] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x1fe358c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0048.534] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0048.535] CharToOemA (in: pSrc="Setup.xml", pDst=0x1fe380c | out: pDst="Setup.xml") returned 1 [0048.535] WriteFile (in: hFile=0x158, lpBuffer=0x1fe380c*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe380c*, lpNumberOfBytesWritten=0x18e048*=0x9, lpOverlapped=0x0) returned 1 [0048.535] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0048.535] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0048.535] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0048.535] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=16879858401) returned 1 [0048.535] ReadFile (in: hFile=0x15c, lpBuffer=0x3500220, nNumberOfBytesToRead=0x5061, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3500220*, lpNumberOfBytesRead=0x18dd7c*=0x5061, lpOverlapped=0x0) returned 1 [0048.537] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0048.537] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=16880006349) returned 1 [0048.545] WriteFile (in: hFile=0x158, lpBuffer=0x1fea210*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fea210*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0048.545] ReadFile (in: hFile=0x15c, lpBuffer=0x3500220, nNumberOfBytesToRead=0x5061, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3500220*, lpNumberOfBytesRead=0x18de38*=0x5061, lpOverlapped=0x0) returned 1 [0048.546] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x44 [0048.546] WriteFile (in: hFile=0x158, lpBuffer=0x38275a0*, nNumberOfBytesToWrite=0x5061, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x38275a0*, lpNumberOfBytesWritten=0x18de10*=0x5061, lpOverlapped=0x0) returned 1 [0048.546] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x50a5 [0048.546] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0048.546] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0048.546] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0048.546] SetFilePointer (in: hFile=0x158, lDistanceToMove=9, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x27 [0048.547] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x50af [0048.547] CloseHandle (hObject=0x15c) returned 1 [0048.547] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x50af [0048.547] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x50af [0048.547] SetFilePointer (in: hFile=0x158, lDistanceToMove=20655, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x50af [0048.547] SetFilePointer (in: hFile=0x158, lDistanceToMove=20655, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x50af [0048.547] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x50af [0048.547] SetFilePointer (in: hFile=0x158, lDistanceToMove=20655, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x50af [0048.547] SetEndOfFile (hFile=0x158) returned 1 [0048.547] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x50af [0048.547] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x50af [0048.547] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0048.547] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x1fe358c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0048.547] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0048.547] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x1fe3a0c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0048.547] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe3a0c, cbMultiByte=9, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="Setup.xml") returned 9 [0048.548] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0048.548] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x1fe358c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x0) returned 9 [0048.548] WriteFile (in: hFile=0x158, lpBuffer=0x34e3cf8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x34e3cf8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0048.548] CharToOemA (in: pSrc="Setup.xml", pDst=0x1fe3a0c | out: pDst="Setup.xml") returned 1 [0048.548] WriteFile (in: hFile=0x158, lpBuffer=0x1fe3a0c*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe3a0c*, lpNumberOfBytesWritten=0x18efcc*=0x9, lpOverlapped=0x0) returned 1 [0048.548] WriteFile (in: hFile=0x158, lpBuffer=0x1fea428*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea428*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0048.548] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0048.548] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0048.548] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x50f1 [0048.548] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x50f1 [0048.548] WriteFile (in: hFile=0x158, lpBuffer=0x361f5a8*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x361f5a8*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0048.548] WriteFile (in: hFile=0x158, lpBuffer=0x35f011c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f011c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0048.548] DeleteFileW (lpFileName="") returned 0 [0048.548] GetLastError () returned 0x3 [0048.548] GetFileAttributesW (lpFileName="") returned 0xffffffff [0048.548] SetLastError (dwErrCode=0x3) [0048.548] FlushFileBuffers (hFile=0x158) returned 1 [0048.551] GetCurrentThreadId () returned 0x970 [0048.551] GetCurrentThreadId () returned 0x970 [0048.551] GetCurrentThreadId () returned 0x970 [0048.551] GetCurrentThreadId () returned 0x970 [0048.551] GetCurrentThreadId () returned 0x970 [0048.551] GetCurrentThreadId () returned 0x970 [0048.551] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x51a8 [0048.551] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x51a8 [0048.551] SetFilePointer (in: hFile=0x158, lDistanceToMove=20904, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x51a8 [0048.551] CloseHandle (hObject=0x158) returned 1 [0048.552] GetCurrentThreadId () returned 0x970 [0048.552] GetCurrentThreadId () returned 0x970 [0048.552] GetCurrentThreadId () returned 0x970 [0048.553] GetCurrentThreadId () returned 0x970 [0048.553] GetCurrentThreadId () returned 0x970 [0048.553] GetCurrentThreadId () returned 0x970 [0048.553] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Файл зашифрован [Setup.xml].wannacash .zip" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\Файл зашифрован [setup.xml].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0048.553] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x51a8 [0048.553] SetFilePointer (in: hFile=0x158, lDistanceToMove=20776, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5128 [0048.553] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0048.553] GetFileType (hFile=0x158) returned 0x1 [0048.553] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x37, wMilliseconds=0x358)) [0048.553] GetCurrentThreadId () returned 0x970 [0048.553] GetCurrentThreadId () returned 0x970 [0048.553] GetCurrentThreadId () returned 0x970 [0048.553] GetCurrentThreadId () returned 0x970 [0048.553] GetCurrentThreadId () returned 0x970 [0048.553] GetCurrentThreadId () returned 0x970 [0048.553] GetCurrentThreadId () returned 0x970 [0048.553] GetCurrentThreadId () returned 0x970 [0048.553] GetCurrentThreadId () returned 0x970 [0048.553] GetCurrentThreadId () returned 0x970 [0048.553] GetCurrentThreadId () returned 0x970 [0048.553] GetCurrentThreadId () returned 0x970 [0048.553] GetCurrentThreadId () returned 0x970 [0048.553] GetCurrentThreadId () returned 0x970 [0048.553] GetCurrentThreadId () returned 0x970 [0048.553] GetCurrentThreadId () returned 0x970 [0048.553] GetCurrentThreadId () returned 0x970 [0048.553] GetCurrentThreadId () returned 0x970 [0048.553] GetCurrentThreadId () returned 0x970 [0048.553] GetCurrentThreadId () returned 0x970 [0048.553] GetCurrentThreadId () returned 0x970 [0048.553] GetCurrentThreadId () returned 0x970 [0048.553] GetCurrentThreadId () returned 0x970 [0048.553] GetCurrentThreadId () returned 0x970 [0048.553] GetCurrentThreadId () returned 0x970 [0048.553] GetCurrentThreadId () returned 0x970 [0048.553] GetCurrentThreadId () returned 0x970 [0048.553] GetCurrentThreadId () returned 0x970 [0048.554] GetCurrentThreadId () returned 0x970 [0048.554] GetCurrentThreadId () returned 0x970 [0048.554] GetCurrentThreadId () returned 0x970 [0048.554] GetCurrentThreadId () returned 0x970 [0048.554] GetCurrentThreadId () returned 0x970 [0048.554] GetCurrentThreadId () returned 0x970 [0048.554] GetCurrentThreadId () returned 0x970 [0048.554] GetCurrentThreadId () returned 0x970 [0048.554] GetCurrentThreadId () returned 0x970 [0048.554] GetCurrentThreadId () returned 0x970 [0048.554] GetCurrentThreadId () returned 0x970 [0048.554] GetCurrentThreadId () returned 0x970 [0048.554] GetCurrentThreadId () returned 0x970 [0048.554] GetCurrentThreadId () returned 0x970 [0048.554] GetCurrentThreadId () returned 0x970 [0048.554] GetCurrentThreadId () returned 0x970 [0048.554] GetCurrentThreadId () returned 0x970 [0048.554] GetCurrentThreadId () returned 0x970 [0048.554] GetCurrentThreadId () returned 0x970 [0048.554] GetCurrentThreadId () returned 0x970 [0048.554] GetCurrentThreadId () returned 0x970 [0048.554] GetCurrentThreadId () returned 0x970 [0048.554] GetCurrentThreadId () returned 0x970 [0048.554] GetCurrentThreadId () returned 0x970 [0048.554] GetCurrentThreadId () returned 0x970 [0048.554] GetCurrentThreadId () returned 0x970 [0048.554] GetCurrentThreadId () returned 0x970 [0048.554] GetCurrentThreadId () returned 0x970 [0048.554] GetCurrentThreadId () returned 0x970 [0048.554] GetCurrentThreadId () returned 0x970 [0048.554] GetCurrentThreadId () returned 0x970 [0048.554] GetCurrentThreadId () returned 0x970 [0048.554] GetCurrentThreadId () returned 0x970 [0048.554] GetCurrentThreadId () returned 0x970 [0048.554] GetCurrentThreadId () returned 0x970 [0048.554] GetCurrentThreadId () returned 0x970 [0048.554] GetCurrentThreadId () returned 0x970 [0048.554] GetCurrentThreadId () returned 0x970 [0048.554] GetCurrentThreadId () returned 0x970 [0048.554] GetCurrentThreadId () returned 0x970 [0048.554] GetCurrentThreadId () returned 0x970 [0048.554] GetCurrentThreadId () returned 0x970 [0048.554] GetCurrentThreadId () returned 0x970 [0048.554] GetCurrentThreadId () returned 0x970 [0048.554] GetCurrentThreadId () returned 0x970 [0048.554] GetCurrentThreadId () returned 0x970 [0048.554] GetCurrentThreadId () returned 0x970 [0048.555] GetCurrentThreadId () returned 0x970 [0048.555] GetCurrentThreadId () returned 0x970 [0048.555] GetCurrentThreadId () returned 0x970 [0048.555] GetCurrentThreadId () returned 0x970 [0048.555] GetCurrentThreadId () returned 0x970 [0048.555] GetCurrentThreadId () returned 0x970 [0048.555] GetCurrentThreadId () returned 0x970 [0048.555] GetCurrentThreadId () returned 0x970 [0048.555] GetCurrentThreadId () returned 0x970 [0048.555] GetCurrentThreadId () returned 0x970 [0048.555] GetCurrentThreadId () returned 0x970 [0048.555] GetCurrentThreadId () returned 0x970 [0048.555] GetCurrentThreadId () returned 0x970 [0048.555] GetCurrentThreadId () returned 0x970 [0048.555] GetCurrentThreadId () returned 0x970 [0048.555] GetCurrentThreadId () returned 0x970 [0048.555] GetCurrentThreadId () returned 0x970 [0048.555] GetCurrentThreadId () returned 0x970 [0048.555] GetCurrentThreadId () returned 0x970 [0048.555] GetCurrentThreadId () returned 0x970 [0048.555] GetCurrentThreadId () returned 0x970 [0048.555] GetCurrentThreadId () returned 0x970 [0048.555] GetCurrentThreadId () returned 0x970 [0048.555] GetCurrentThreadId () returned 0x970 [0048.555] GetCurrentThreadId () returned 0x970 [0048.555] GetCurrentThreadId () returned 0x970 [0048.555] GetCurrentThreadId () returned 0x970 [0048.555] GetCurrentThreadId () returned 0x970 [0048.555] GetCurrentThreadId () returned 0x970 [0048.555] GetCurrentThreadId () returned 0x970 [0048.555] GetCurrentThreadId () returned 0x970 [0048.555] GetCurrentThreadId () returned 0x970 [0048.555] GetCurrentThreadId () returned 0x970 [0048.555] GetCurrentThreadId () returned 0x970 [0048.555] GetCurrentThreadId () returned 0x970 [0048.555] GetCurrentThreadId () returned 0x970 [0048.555] GetCurrentThreadId () returned 0x970 [0048.555] GetCurrentThreadId () returned 0x970 [0048.555] GetCurrentThreadId () returned 0x970 [0048.555] GetCurrentThreadId () returned 0x970 [0048.555] GetCurrentThreadId () returned 0x970 [0048.555] GetCurrentThreadId () returned 0x970 [0048.555] GetCurrentThreadId () returned 0x970 [0048.555] GetCurrentThreadId () returned 0x970 [0048.555] GetCurrentThreadId () returned 0x970 [0048.555] GetCurrentThreadId () returned 0x970 [0048.555] GetCurrentThreadId () returned 0x970 [0048.555] GetCurrentThreadId () returned 0x970 [0048.556] GetCurrentThreadId () returned 0x970 [0048.556] GetCurrentThreadId () returned 0x970 [0048.556] GetCurrentThreadId () returned 0x970 [0048.556] GetCurrentThreadId () returned 0x970 [0048.556] GetCurrentThreadId () returned 0x970 [0048.556] GetCurrentThreadId () returned 0x970 [0048.556] GetCurrentThreadId () returned 0x970 [0048.556] GetCurrentThreadId () returned 0x970 [0048.556] GetCurrentThreadId () returned 0x970 [0048.556] GetCurrentThreadId () returned 0x970 [0048.556] GetCurrentThreadId () returned 0x970 [0048.556] GetCurrentThreadId () returned 0x970 [0048.556] GetCurrentThreadId () returned 0x970 [0048.556] GetCurrentThreadId () returned 0x970 [0048.556] GetCurrentThreadId () returned 0x970 [0048.556] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.556] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.556] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb430, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.556] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.556] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.556] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb430, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.556] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.556] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.556] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.556] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.556] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.556] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.556] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.556] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.556] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb490, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.556] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.556] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.556] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb490, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.556] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.556] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.556] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb490, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.556] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x37, wMilliseconds=0x358)) [0048.556] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="3QGq?wXeoD:unn}Gn00gb%Jn613K>", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0048.556] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="3QGq?wXeoD:unn}Gn00gb%Jn613K>", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0048.557] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="3QGq?wXeoD:unn}Gn00gb%Jn613K>", cchWideChar=32, lpMultiByteStr=0x2000718, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3QGq?wXeoD:unn}Gn00gb%Jn613K>", lpUsedDefaultChar=0x0) returned 32 [0048.557] GetCurrentThreadId () returned 0x970 [0048.557] GetCurrentThreadId () returned 0x970 [0048.557] GetCurrentThreadId () returned 0x970 [0048.557] GetCurrentThreadId () returned 0x970 [0048.557] GetCurrentThreadId () returned 0x970 [0048.557] GetCurrentThreadId () returned 0x970 [0048.564] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0048.564] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0048.564] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x202d978, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0048.564] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x35904f8, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0048.564] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x35904f8, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAE0KGZ3mI+cxlM450zK1nMRvKxD0sfSr13oqayN9exN6sQDSznXvpS0OQ2RXC1y0RuL2PV1hLpZ260ChPu9uycqpQYGiU7qRrgHZnzgcSxjaLIbkYdnTItjRSADHEFXyZ+x8B9KoMK3osARNhm21akYyyw0MEiZp3Uj8osKc/yI8qaXEPzKq6NLHGsaUJKfsf/6oI68Sm6xaK0AX9WH3s1ePdiNZLU6lIw==") returned 232 [0048.564] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x37, wMilliseconds=0x367)) [0048.564] GetCurrentThreadId () returned 0x970 [0048.564] GetCurrentThreadId () returned 0x970 [0048.564] GetCurrentThreadId () returned 0x970 [0048.564] GetCurrentThreadId () returned 0x970 [0048.564] GetCurrentThreadId () returned 0x970 [0048.564] GetCurrentThreadId () returned 0x970 [0048.564] GetCurrentThreadId () returned 0x970 [0048.564] GetCurrentThreadId () returned 0x970 [0048.564] GetCurrentThreadId () returned 0x970 [0048.564] GetCurrentThreadId () returned 0x970 [0048.564] GetCurrentThreadId () returned 0x970 [0048.564] GetCurrentThreadId () returned 0x970 [0048.564] GetCurrentThreadId () returned 0x970 [0048.564] GetCurrentThreadId () returned 0x970 [0048.564] GetCurrentThreadId () returned 0x970 [0048.565] GetCurrentThreadId () returned 0x970 [0048.565] GetCurrentThreadId () returned 0x970 [0048.565] GetCurrentThreadId () returned 0x970 [0048.565] GetCurrentThreadId () returned 0x970 [0048.565] GetCurrentThreadId () returned 0x970 [0048.565] GetCurrentThreadId () returned 0x970 [0048.565] GetCurrentThreadId () returned 0x970 [0048.565] GetCurrentThreadId () returned 0x970 [0048.565] GetCurrentThreadId () returned 0x970 [0048.565] GetCurrentThreadId () returned 0x970 [0048.565] GetCurrentThreadId () returned 0x970 [0048.565] GetCurrentThreadId () returned 0x970 [0048.565] GetCurrentThreadId () returned 0x970 [0048.565] GetCurrentThreadId () returned 0x970 [0048.565] GetCurrentThreadId () returned 0x970 [0048.565] GetCurrentThreadId () returned 0x970 [0048.565] GetCurrentThreadId () returned 0x970 [0048.565] GetCurrentThreadId () returned 0x970 [0048.565] GetCurrentThreadId () returned 0x970 [0048.565] GetCurrentThreadId () returned 0x970 [0048.565] GetCurrentThreadId () returned 0x970 [0048.565] GetCurrentThreadId () returned 0x970 [0048.565] GetCurrentThreadId () returned 0x970 [0048.565] GetCurrentThreadId () returned 0x970 [0048.565] GetCurrentThreadId () returned 0x970 [0048.565] GetCurrentThreadId () returned 0x970 [0048.565] GetCurrentThreadId () returned 0x970 [0048.565] GetCurrentThreadId () returned 0x970 [0048.565] GetCurrentThreadId () returned 0x970 [0048.565] GetCurrentThreadId () returned 0x970 [0048.565] GetCurrentThreadId () returned 0x970 [0048.565] GetCurrentThreadId () returned 0x970 [0048.565] GetCurrentThreadId () returned 0x970 [0048.565] GetCurrentThreadId () returned 0x970 [0048.565] GetCurrentThreadId () returned 0x970 [0048.565] GetCurrentThreadId () returned 0x970 [0048.565] GetCurrentThreadId () returned 0x970 [0048.565] GetCurrentThreadId () returned 0x970 [0048.565] GetCurrentThreadId () returned 0x970 [0048.565] GetCurrentThreadId () returned 0x970 [0048.565] GetCurrentThreadId () returned 0x970 [0048.565] GetCurrentThreadId () returned 0x970 [0048.565] GetCurrentThreadId () returned 0x970 [0048.565] GetCurrentThreadId () returned 0x970 [0048.565] GetCurrentThreadId () returned 0x970 [0048.565] GetCurrentThreadId () returned 0x970 [0048.565] GetCurrentThreadId () returned 0x970 [0048.566] GetCurrentThreadId () returned 0x970 [0048.566] GetCurrentThreadId () returned 0x970 [0048.566] GetCurrentThreadId () returned 0x970 [0048.566] GetCurrentThreadId () returned 0x970 [0048.566] GetCurrentThreadId () returned 0x970 [0048.566] GetCurrentThreadId () returned 0x970 [0048.566] GetCurrentThreadId () returned 0x970 [0048.566] GetCurrentThreadId () returned 0x970 [0048.566] GetCurrentThreadId () returned 0x970 [0048.566] GetCurrentThreadId () returned 0x970 [0048.566] GetCurrentThreadId () returned 0x970 [0048.566] GetCurrentThreadId () returned 0x970 [0048.566] GetCurrentThreadId () returned 0x970 [0048.566] GetCurrentThreadId () returned 0x970 [0048.566] GetCurrentThreadId () returned 0x970 [0048.566] GetCurrentThreadId () returned 0x970 [0048.566] GetCurrentThreadId () returned 0x970 [0048.566] GetCurrentThreadId () returned 0x970 [0048.566] GetCurrentThreadId () returned 0x970 [0048.566] GetCurrentThreadId () returned 0x970 [0048.566] GetCurrentThreadId () returned 0x970 [0048.566] GetCurrentThreadId () returned 0x970 [0048.566] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAE0KGZ3mI+cxlM450zK1nMRvKxD0sfSr13oqayN9exN6sQDSznXvpS0OQ2RXC1y0RuL2PV1hLpZ260ChPu9uycqpQYGiU7qRrgHZnzgcSxjaLIbkYdnTItjRSADHEFXyZ+x8B9KoMK3osARNhm21akYyyw0MEiZp3Uj8osKc/yI8qaXEPzKq6NLHGsaUJKfsf/6oI68Sm6xaK0AX9WH3s1ePdiNZLU6lIw==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0048.566] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAE0KGZ3mI+cxlM450zK1nMRvKxD0sfSr13oqayN9exN6sQDSznXvpS0OQ2RXC1y0RuL2PV1hLpZ260ChPu9uycqpQYGiU7qRrgHZnzgcSxjaLIbkYdnTItjRSADHEFXyZ+x8B9KoMK3osARNhm21akYyyw0MEiZp3Uj8osKc/yI8qaXEPzKq6NLHGsaUJKfsf/6oI68Sm6xaK0AX9WH3s1ePdiNZLU6lIw==", cchWideChar=245, lpMultiByteStr=0x353900c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAE0KGZ3mI+cxlM450zK1nMRvKxD0sfSr13oqayN9exN6sQDSznXvpS0OQ2RXC1y0RuL2PV1hLpZ260ChPu9uycqpQYGiU7qRrgHZnzgcSxjaLIbkYdnTItjRSADHEFXyZ+x8B9KoMK3osARNhm21akYyyw0MEiZp3Uj8osKc/yI8qaXEPzKq6NLHGsaUJKfsf/6oI68Sm6xaK0AX9WH3s1ePdiNZLU6lIw==", lpUsedDefaultChar=0x0) returned 245 [0048.566] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0048.566] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0048.566] CloseHandle (hObject=0x158) returned 1 [0048.567] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0048.568] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=16883152434) returned 1 [0048.568] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Файл зашифрован [VisiorWW.xml].wannacash .zip" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\Файл зашифрован [visiorww.xml].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0048.568] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0048.569] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0048.569] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0048.569] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0048.569] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0048.569] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0048.569] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0048.569] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0048.569] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0048.569] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0048.569] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0048.569] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0048.569] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0048.569] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0048.569] SetEndOfFile (hFile=0x158) returned 1 [0048.569] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0048.569] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0048.569] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0048.569] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0048.570] WriteFile (in: hFile=0x158, lpBuffer=0x361f5a8*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x361f5a8*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0048.570] WriteFile (in: hFile=0x158, lpBuffer=0x35f005c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f005c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0048.570] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s48vu1K~K8?}pgC^-h@V$h?Y:}bh4HcZ", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0048.571] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s48vu1K~K8?}pgC^-h@V$h?Y:}bh4HcZ", cchWideChar=32, lpMultiByteStr=0x20329ec, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="s48vu1K~K8?}pgC^-h@V$h?Y:}bh4HcZ", lpUsedDefaultChar=0x0) returned 32 [0048.571] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0048.571] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0048.571] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80b17dc0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80b17dc0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisiorWW.xml", cAlternateFileName="")) returned 0x295098 [0048.571] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0048.571] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0048.571] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml")) returned 0x2020 [0048.571] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml")) returned 0x2020 [0048.571] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml")) returned 0x2020 [0048.571] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml")) returned 0x2020 [0048.571] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80b17dc0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80b17dc0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213)) returned 1 [0048.571] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0048.571] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0048.571] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml")) returned 0x2020 [0048.571] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml")) returned 0x2020 [0048.571] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0048.571] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0048.572] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0048.572] SetEndOfFile (hFile=0x158) returned 1 [0048.572] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VisiorWW.xml", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0048.572] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VisiorWW.xml", cchWideChar=12, lpMultiByteStr=0x1fe366c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VisiorWW.xml", lpUsedDefaultChar=0x0) returned 12 [0048.572] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VisiorWW.xml", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0048.572] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VisiorWW.xml", cchWideChar=12, lpMultiByteStr=0x1fe368c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VisiorWW.xml", lpUsedDefaultChar=0x0) returned 12 [0048.572] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe368c, cbMultiByte=12, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="VisiorWW.xmlmlmll@\x01") returned 12 [0048.573] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VisiorWW.xml", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0048.573] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VisiorWW.xml", cchWideChar=12, lpMultiByteStr=0x1fe366c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VisiorWW.xml", lpUsedDefaultChar=0x0) returned 12 [0048.573] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0048.573] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0048.573] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2213 [0048.573] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0048.573] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0048.573] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0048.573] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VisiorWW.xml", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0048.573] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VisiorWW.xml", cchWideChar=12, lpMultiByteStr=0x1fe366c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VisiorWW.xml", lpUsedDefaultChar=0x0) returned 12 [0048.573] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VisiorWW.xml", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0048.573] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VisiorWW.xml", cchWideChar=12, lpMultiByteStr=0x1fe368c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VisiorWW.xml", lpUsedDefaultChar=0x0) returned 12 [0048.573] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe368c, cbMultiByte=12, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="VisiorWW.xmlWW.xmlmlmll@\x01") returned 12 [0048.573] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VisiorWW.xml", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0048.573] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VisiorWW.xml", cchWideChar=12, lpMultiByteStr=0x1fe366c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VisiorWW.xml", lpUsedDefaultChar=0x0) returned 12 [0048.573] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0048.574] CharToOemA (in: pSrc="VisiorWW.xml", pDst=0x1fe368c | out: pDst="VisiorWW.xml") returned 1 [0048.574] WriteFile (in: hFile=0x158, lpBuffer=0x1fe368c*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe368c*, lpNumberOfBytesWritten=0x18e048*=0xc, lpOverlapped=0x0) returned 1 [0048.574] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0048.574] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0048.574] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0048.575] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=16883799080) returned 1 [0048.575] ReadFile (in: hFile=0x15c, lpBuffer=0x3500220, nNumberOfBytesToRead=0x2213, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3500220*, lpNumberOfBytesRead=0x18dd7c*=0x2213, lpOverlapped=0x0) returned 1 [0048.576] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0048.576] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=16884003937) returned 1 [0048.585] WriteFile (in: hFile=0x158, lpBuffer=0x1fea120*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fea120*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0048.585] ReadFile (in: hFile=0x15c, lpBuffer=0x3500220, nNumberOfBytesToRead=0x2213, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3500220*, lpNumberOfBytesRead=0x18de38*=0x2213, lpOverlapped=0x0) returned 1 [0048.585] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x47 [0048.585] WriteFile (in: hFile=0x158, lpBuffer=0x3503b80*, nNumberOfBytesToWrite=0x2213, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3503b80*, lpNumberOfBytesWritten=0x18de10*=0x2213, lpOverlapped=0x0) returned 1 [0048.586] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x225a [0048.586] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0048.586] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0048.586] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0048.586] SetFilePointer (in: hFile=0x158, lDistanceToMove=12, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2a [0048.586] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x2264 [0048.586] CloseHandle (hObject=0x15c) returned 1 [0048.586] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x2264 [0048.586] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x2264 [0048.586] SetFilePointer (in: hFile=0x158, lDistanceToMove=8804, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x2264 [0048.586] SetFilePointer (in: hFile=0x158, lDistanceToMove=8804, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x2264 [0048.586] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x2264 [0048.586] SetFilePointer (in: hFile=0x158, lDistanceToMove=8804, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x2264 [0048.586] SetEndOfFile (hFile=0x158) returned 1 [0048.587] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x2264 [0048.587] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x2264 [0048.587] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VisiorWW.xml", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0048.587] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VisiorWW.xml", cchWideChar=12, lpMultiByteStr=0x1fe366c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VisiorWW.xml", lpUsedDefaultChar=0x0) returned 12 [0048.587] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VisiorWW.xml", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0048.587] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VisiorWW.xml", cchWideChar=12, lpMultiByteStr=0x1fe3b8c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VisiorWW.xml", lpUsedDefaultChar=0x0) returned 12 [0048.587] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe3b8c, cbMultiByte=12, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="VisiorWW.xmlꞗ@涤(\x18믉`믑`") returned 12 [0048.587] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VisiorWW.xml", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0048.587] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VisiorWW.xml", cchWideChar=12, lpMultiByteStr=0x1fe366c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VisiorWW.xml", lpUsedDefaultChar=0x0) returned 12 [0048.587] WriteFile (in: hFile=0x158, lpBuffer=0x34e3cf8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x34e3cf8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0048.587] CharToOemA (in: pSrc="VisiorWW.xml", pDst=0x1fe3b8c | out: pDst="VisiorWW.xml") returned 1 [0048.587] WriteFile (in: hFile=0x158, lpBuffer=0x1fe3b8c*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe3b8c*, lpNumberOfBytesWritten=0x18efcc*=0xc, lpOverlapped=0x0) returned 1 [0048.587] WriteFile (in: hFile=0x158, lpBuffer=0x1fea260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea260*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0048.587] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0048.587] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0048.587] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x22a9 [0048.587] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x22a9 [0048.588] WriteFile (in: hFile=0x158, lpBuffer=0x361f5a8*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x361f5a8*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0048.588] WriteFile (in: hFile=0x158, lpBuffer=0x35f005c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f005c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0048.588] DeleteFileW (lpFileName="") returned 0 [0048.588] GetLastError () returned 0x3 [0048.588] GetFileAttributesW (lpFileName="") returned 0xffffffff [0048.588] SetLastError (dwErrCode=0x3) [0048.588] FlushFileBuffers (hFile=0x158) returned 1 [0048.591] GetCurrentThreadId () returned 0x970 [0048.591] GetCurrentThreadId () returned 0x970 [0048.591] GetCurrentThreadId () returned 0x970 [0048.591] GetCurrentThreadId () returned 0x970 [0048.591] GetCurrentThreadId () returned 0x970 [0048.591] GetCurrentThreadId () returned 0x970 [0048.591] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x2360 [0048.591] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x2360 [0048.591] SetFilePointer (in: hFile=0x158, lDistanceToMove=9056, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x2360 [0048.591] CloseHandle (hObject=0x158) returned 1 [0048.592] GetCurrentThreadId () returned 0x970 [0048.592] GetCurrentThreadId () returned 0x970 [0048.592] GetCurrentThreadId () returned 0x970 [0048.592] GetCurrentThreadId () returned 0x970 [0048.592] GetCurrentThreadId () returned 0x970 [0048.592] GetCurrentThreadId () returned 0x970 [0048.592] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Файл зашифрован [VisiorWW.xml].wannacash .zip" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\Файл зашифрован [visiorww.xml].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0048.592] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2360 [0048.592] SetFilePointer (in: hFile=0x158, lDistanceToMove=8928, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x22e0 [0048.592] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0048.592] GetFileType (hFile=0x158) returned 0x1 [0048.592] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x37, wMilliseconds=0x386)) [0048.592] GetCurrentThreadId () returned 0x970 [0048.592] GetCurrentThreadId () returned 0x970 [0048.592] GetCurrentThreadId () returned 0x970 [0048.592] GetCurrentThreadId () returned 0x970 [0048.592] GetCurrentThreadId () returned 0x970 [0048.592] GetCurrentThreadId () returned 0x970 [0048.592] GetCurrentThreadId () returned 0x970 [0048.592] GetCurrentThreadId () returned 0x970 [0048.592] GetCurrentThreadId () returned 0x970 [0048.592] GetCurrentThreadId () returned 0x970 [0048.592] GetCurrentThreadId () returned 0x970 [0048.592] GetCurrentThreadId () returned 0x970 [0048.593] GetCurrentThreadId () returned 0x970 [0048.593] GetCurrentThreadId () returned 0x970 [0048.593] GetCurrentThreadId () returned 0x970 [0048.593] GetCurrentThreadId () returned 0x970 [0048.593] GetCurrentThreadId () returned 0x970 [0048.593] GetCurrentThreadId () returned 0x970 [0048.593] GetCurrentThreadId () returned 0x970 [0048.593] GetCurrentThreadId () returned 0x970 [0048.593] GetCurrentThreadId () returned 0x970 [0048.593] GetCurrentThreadId () returned 0x970 [0048.593] GetCurrentThreadId () returned 0x970 [0048.593] GetCurrentThreadId () returned 0x970 [0048.593] GetCurrentThreadId () returned 0x970 [0048.593] GetCurrentThreadId () returned 0x970 [0048.593] GetCurrentThreadId () returned 0x970 [0048.593] GetCurrentThreadId () returned 0x970 [0048.593] GetCurrentThreadId () returned 0x970 [0048.593] GetCurrentThreadId () returned 0x970 [0048.593] GetCurrentThreadId () returned 0x970 [0048.593] GetCurrentThreadId () returned 0x970 [0048.593] GetCurrentThreadId () returned 0x970 [0048.593] GetCurrentThreadId () returned 0x970 [0048.593] GetCurrentThreadId () returned 0x970 [0048.593] GetCurrentThreadId () returned 0x970 [0048.593] GetCurrentThreadId () returned 0x970 [0048.593] GetCurrentThreadId () returned 0x970 [0048.593] GetCurrentThreadId () returned 0x970 [0048.593] GetCurrentThreadId () returned 0x970 [0048.593] GetCurrentThreadId () returned 0x970 [0048.593] GetCurrentThreadId () returned 0x970 [0048.593] GetCurrentThreadId () returned 0x970 [0048.593] GetCurrentThreadId () returned 0x970 [0048.593] GetCurrentThreadId () returned 0x970 [0048.593] GetCurrentThreadId () returned 0x970 [0048.593] GetCurrentThreadId () returned 0x970 [0048.593] GetCurrentThreadId () returned 0x970 [0048.593] GetCurrentThreadId () returned 0x970 [0048.593] GetCurrentThreadId () returned 0x970 [0048.593] GetCurrentThreadId () returned 0x970 [0048.593] GetCurrentThreadId () returned 0x970 [0048.593] GetCurrentThreadId () returned 0x970 [0048.593] GetCurrentThreadId () returned 0x970 [0048.593] GetCurrentThreadId () returned 0x970 [0048.593] GetCurrentThreadId () returned 0x970 [0048.593] GetCurrentThreadId () returned 0x970 [0048.593] GetCurrentThreadId () returned 0x970 [0048.593] GetCurrentThreadId () returned 0x970 [0048.594] GetCurrentThreadId () returned 0x970 [0048.594] GetCurrentThreadId () returned 0x970 [0048.594] GetCurrentThreadId () returned 0x970 [0048.594] GetCurrentThreadId () returned 0x970 [0048.594] GetCurrentThreadId () returned 0x970 [0048.594] GetCurrentThreadId () returned 0x970 [0048.594] GetCurrentThreadId () returned 0x970 [0048.594] GetCurrentThreadId () returned 0x970 [0048.594] GetCurrentThreadId () returned 0x970 [0048.594] GetCurrentThreadId () returned 0x970 [0048.594] GetCurrentThreadId () returned 0x970 [0048.594] GetCurrentThreadId () returned 0x970 [0048.594] GetCurrentThreadId () returned 0x970 [0048.594] GetCurrentThreadId () returned 0x970 [0048.594] GetCurrentThreadId () returned 0x970 [0048.594] GetCurrentThreadId () returned 0x970 [0048.594] GetCurrentThreadId () returned 0x970 [0048.594] GetCurrentThreadId () returned 0x970 [0048.594] GetCurrentThreadId () returned 0x970 [0048.594] GetCurrentThreadId () returned 0x970 [0048.594] GetCurrentThreadId () returned 0x970 [0048.594] GetCurrentThreadId () returned 0x970 [0048.594] GetCurrentThreadId () returned 0x970 [0048.594] GetCurrentThreadId () returned 0x970 [0048.594] GetCurrentThreadId () returned 0x970 [0048.594] GetCurrentThreadId () returned 0x970 [0048.594] GetCurrentThreadId () returned 0x970 [0048.594] GetCurrentThreadId () returned 0x970 [0048.594] GetCurrentThreadId () returned 0x970 [0048.594] GetCurrentThreadId () returned 0x970 [0048.594] GetCurrentThreadId () returned 0x970 [0048.594] GetCurrentThreadId () returned 0x970 [0048.594] GetCurrentThreadId () returned 0x970 [0048.594] GetCurrentThreadId () returned 0x970 [0048.594] GetCurrentThreadId () returned 0x970 [0048.594] GetCurrentThreadId () returned 0x970 [0048.594] GetCurrentThreadId () returned 0x970 [0048.594] GetCurrentThreadId () returned 0x970 [0048.594] GetCurrentThreadId () returned 0x970 [0048.594] GetCurrentThreadId () returned 0x970 [0048.594] GetCurrentThreadId () returned 0x970 [0048.594] GetCurrentThreadId () returned 0x970 [0048.594] GetCurrentThreadId () returned 0x970 [0048.594] GetCurrentThreadId () returned 0x970 [0048.594] GetCurrentThreadId () returned 0x970 [0048.594] GetCurrentThreadId () returned 0x970 [0048.594] GetCurrentThreadId () returned 0x970 [0048.595] GetCurrentThreadId () returned 0x970 [0048.595] GetCurrentThreadId () returned 0x970 [0048.595] GetCurrentThreadId () returned 0x970 [0048.595] GetCurrentThreadId () returned 0x970 [0048.595] GetCurrentThreadId () returned 0x970 [0048.595] GetCurrentThreadId () returned 0x970 [0048.595] GetCurrentThreadId () returned 0x970 [0048.595] GetCurrentThreadId () returned 0x970 [0048.595] GetCurrentThreadId () returned 0x970 [0048.595] GetCurrentThreadId () returned 0x970 [0048.595] GetCurrentThreadId () returned 0x970 [0048.595] GetCurrentThreadId () returned 0x970 [0048.595] GetCurrentThreadId () returned 0x970 [0048.595] GetCurrentThreadId () returned 0x970 [0048.595] GetCurrentThreadId () returned 0x970 [0048.595] GetCurrentThreadId () returned 0x970 [0048.595] GetCurrentThreadId () returned 0x970 [0048.595] GetCurrentThreadId () returned 0x970 [0048.595] GetCurrentThreadId () returned 0x970 [0048.595] GetCurrentThreadId () returned 0x970 [0048.595] GetCurrentThreadId () returned 0x970 [0048.595] GetCurrentThreadId () returned 0x970 [0048.595] GetCurrentThreadId () returned 0x970 [0048.595] GetCurrentThreadId () returned 0x970 [0048.595] GetCurrentThreadId () returned 0x970 [0048.595] GetCurrentThreadId () returned 0x970 [0048.595] GetCurrentThreadId () returned 0x970 [0048.595] GetCurrentThreadId () returned 0x970 [0048.595] GetCurrentThreadId () returned 0x970 [0048.595] GetCurrentThreadId () returned 0x970 [0048.595] GetCurrentThreadId () returned 0x970 [0048.595] GetCurrentThreadId () returned 0x970 [0048.595] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.595] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.595] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb490, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.595] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.595] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.595] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb490, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.595] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.595] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.595] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.595] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.595] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.596] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.596] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.596] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.596] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb4f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.596] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.596] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.596] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb4f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.596] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.596] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.596] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb4f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.596] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x37, wMilliseconds=0x386)) [0048.596] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="s48vu1K~K8?}pgC^-h@V$h?Y:}bh4HcZ", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0048.596] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="s48vu1K~K8?}pgC^-h@V$h?Y:}bh4HcZ", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0048.596] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="s48vu1K~K8?}pgC^-h@V$h?Y:}bh4HcZ", cchWideChar=32, lpMultiByteStr=0x2000898, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="s48vu1K~K8?}pgC^-h@V$h?Y:}bh4HcZ", lpUsedDefaultChar=0x0) returned 32 [0048.596] GetCurrentThreadId () returned 0x970 [0048.596] GetCurrentThreadId () returned 0x970 [0048.596] GetCurrentThreadId () returned 0x970 [0048.596] GetCurrentThreadId () returned 0x970 [0048.596] GetCurrentThreadId () returned 0x970 [0048.596] GetCurrentThreadId () returned 0x970 [0048.603] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0048.603] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0048.603] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x202da68, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0048.603] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x35904f8, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0048.603] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x35904f8, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAABkmCylyGKWJw/fo/pQWMb4sC7bF0VO3v1a3WSk89ZUx62D5Rpyx4otTFu5mrXSxPbLNuqVG07ZREcO72a4FYBMpU4U/AflNSmygal1PEboNTPgJ2jTTLoREQJwyyoHKNLcVz1o1D2XLNHNJMY9lV6V2NexiTZ/MIiYYMaGYuUJComTZZKGUKvZ1Z5IDiZzuLqoT7vaMCcbIA97cK4P5rrAUppQDaj51tw==") returned 232 [0048.603] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x37, wMilliseconds=0x386)) [0048.603] GetCurrentThreadId () returned 0x970 [0048.603] GetCurrentThreadId () returned 0x970 [0048.603] GetCurrentThreadId () returned 0x970 [0048.603] GetCurrentThreadId () returned 0x970 [0048.604] GetCurrentThreadId () returned 0x970 [0048.604] GetCurrentThreadId () returned 0x970 [0048.604] GetCurrentThreadId () returned 0x970 [0048.604] GetCurrentThreadId () returned 0x970 [0048.604] GetCurrentThreadId () returned 0x970 [0048.604] GetCurrentThreadId () returned 0x970 [0048.604] GetCurrentThreadId () returned 0x970 [0048.604] GetCurrentThreadId () returned 0x970 [0048.604] GetCurrentThreadId () returned 0x970 [0048.604] GetCurrentThreadId () returned 0x970 [0048.604] GetCurrentThreadId () returned 0x970 [0048.604] GetCurrentThreadId () returned 0x970 [0048.604] GetCurrentThreadId () returned 0x970 [0048.604] GetCurrentThreadId () returned 0x970 [0048.604] GetCurrentThreadId () returned 0x970 [0048.604] GetCurrentThreadId () returned 0x970 [0048.604] GetCurrentThreadId () returned 0x970 [0048.604] GetCurrentThreadId () returned 0x970 [0048.604] GetCurrentThreadId () returned 0x970 [0048.604] GetCurrentThreadId () returned 0x970 [0048.604] GetCurrentThreadId () returned 0x970 [0048.604] GetCurrentThreadId () returned 0x970 [0048.604] GetCurrentThreadId () returned 0x970 [0048.604] GetCurrentThreadId () returned 0x970 [0048.604] GetCurrentThreadId () returned 0x970 [0048.604] GetCurrentThreadId () returned 0x970 [0048.604] GetCurrentThreadId () returned 0x970 [0048.604] GetCurrentThreadId () returned 0x970 [0048.604] GetCurrentThreadId () returned 0x970 [0048.604] GetCurrentThreadId () returned 0x970 [0048.604] GetCurrentThreadId () returned 0x970 [0048.604] GetCurrentThreadId () returned 0x970 [0048.604] GetCurrentThreadId () returned 0x970 [0048.604] GetCurrentThreadId () returned 0x970 [0048.604] GetCurrentThreadId () returned 0x970 [0048.604] GetCurrentThreadId () returned 0x970 [0048.604] GetCurrentThreadId () returned 0x970 [0048.604] GetCurrentThreadId () returned 0x970 [0048.604] GetCurrentThreadId () returned 0x970 [0048.604] GetCurrentThreadId () returned 0x970 [0048.604] GetCurrentThreadId () returned 0x970 [0048.604] GetCurrentThreadId () returned 0x970 [0048.604] GetCurrentThreadId () returned 0x970 [0048.604] GetCurrentThreadId () returned 0x970 [0048.604] GetCurrentThreadId () returned 0x970 [0048.604] GetCurrentThreadId () returned 0x970 [0048.604] GetCurrentThreadId () returned 0x970 [0048.604] GetCurrentThreadId () returned 0x970 [0048.604] GetCurrentThreadId () returned 0x970 [0048.605] GetCurrentThreadId () returned 0x970 [0048.605] GetCurrentThreadId () returned 0x970 [0048.605] GetCurrentThreadId () returned 0x970 [0048.605] GetCurrentThreadId () returned 0x970 [0048.605] GetCurrentThreadId () returned 0x970 [0048.605] GetCurrentThreadId () returned 0x970 [0048.605] GetCurrentThreadId () returned 0x970 [0048.605] GetCurrentThreadId () returned 0x970 [0048.605] GetCurrentThreadId () returned 0x970 [0048.605] GetCurrentThreadId () returned 0x970 [0048.605] GetCurrentThreadId () returned 0x970 [0048.605] GetCurrentThreadId () returned 0x970 [0048.605] GetCurrentThreadId () returned 0x970 [0048.605] GetCurrentThreadId () returned 0x970 [0048.605] GetCurrentThreadId () returned 0x970 [0048.605] GetCurrentThreadId () returned 0x970 [0048.605] GetCurrentThreadId () returned 0x970 [0048.605] GetCurrentThreadId () returned 0x970 [0048.605] GetCurrentThreadId () returned 0x970 [0048.605] GetCurrentThreadId () returned 0x970 [0048.605] GetCurrentThreadId () returned 0x970 [0048.605] GetCurrentThreadId () returned 0x970 [0048.605] GetCurrentThreadId () returned 0x970 [0048.605] GetCurrentThreadId () returned 0x970 [0048.605] GetCurrentThreadId () returned 0x970 [0048.605] GetCurrentThreadId () returned 0x970 [0048.605] GetCurrentThreadId () returned 0x970 [0048.605] GetCurrentThreadId () returned 0x970 [0048.605] GetCurrentThreadId () returned 0x970 [0048.605] GetCurrentThreadId () returned 0x970 [0048.605] GetCurrentThreadId () returned 0x970 [0048.605] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAABkmCylyGKWJw/fo/pQWMb4sC7bF0VO3v1a3WSk89ZUx62D5Rpyx4otTFu5mrXSxPbLNuqVG07ZREcO72a4FYBMpU4U/AflNSmygal1PEboNTPgJ2jTTLoREQJwyyoHKNLcVz1o1D2XLNHNJMY9lV6V2NexiTZ/MIiYYMaGYuUJComTZZKGUKvZ1Z5IDiZzuLqoT7vaMCcbIA97cK4P5rrAUppQDaj51tw==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0048.605] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAABkmCylyGKWJw/fo/pQWMb4sC7bF0VO3v1a3WSk89ZUx62D5Rpyx4otTFu5mrXSxPbLNuqVG07ZREcO72a4FYBMpU4U/AflNSmygal1PEboNTPgJ2jTTLoREQJwyyoHKNLcVz1o1D2XLNHNJMY9lV6V2NexiTZ/MIiYYMaGYuUJComTZZKGUKvZ1Z5IDiZzuLqoT7vaMCcbIA97cK4P5rrAUppQDaj51tw==", cchWideChar=245, lpMultiByteStr=0x353900c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAABkmCylyGKWJw/fo/pQWMb4sC7bF0VO3v1a3WSk89ZUx62D5Rpyx4otTFu5mrXSxPbLNuqVG07ZREcO72a4FYBMpU4U/AflNSmygal1PEboNTPgJ2jTTLoREQJwyyoHKNLcVz1o1D2XLNHNJMY9lV6V2NexiTZ/MIiYYMaGYuUJComTZZKGUKvZ1Z5IDiZzuLqoT7vaMCcbIA97cK4P5rrAUppQDaj51tw==", lpUsedDefaultChar=0x0) returned 245 [0048.605] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0048.605] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0048.605] CloseHandle (hObject=0x158) returned 1 [0048.606] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml")) returned 1 [0048.607] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=16887077474) returned 1 [0048.607] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\Файл зашифрован [MS.GIF].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\Файл зашифрован [ms.gif].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0048.608] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0048.609] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0048.609] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0048.609] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0048.609] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0048.609] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0048.609] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0048.609] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0048.609] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0048.609] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0048.609] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0048.609] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0048.609] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0048.609] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0048.609] SetEndOfFile (hFile=0x158) returned 1 [0048.609] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0048.609] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0048.609] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0048.610] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0048.610] WriteFile (in: hFile=0x158, lpBuffer=0x361f5a8*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x361f5a8*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0048.610] WriteFile (in: hFile=0x158, lpBuffer=0x35f011c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f011c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0048.610] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="7bUUQe3,9402i}0s@QR&^MV^MqaL^zLk", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0048.610] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="7bUUQe3,9402i}0s@QR&^MV^MqaL^zLk", cchWideChar=32, lpMultiByteStr=0x2032a24, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7bUUQe3,9402i}0s@QR&^MV^MqaL^zLk", lpUsedDefaultChar=0x0) returned 32 [0048.611] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0048.611] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0048.611] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x42d, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.GIF", cAlternateFileName="")) returned 0x295098 [0048.611] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0048.611] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0048.611] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif")) returned 0x20 [0048.612] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif")) returned 0x20 [0048.612] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif")) returned 0x20 [0048.612] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif")) returned 0x20 [0048.612] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x42d)) returned 1 [0048.612] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0048.612] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0048.612] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif")) returned 0x20 [0048.612] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif")) returned 0x20 [0048.612] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0048.612] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0048.612] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0048.612] SetEndOfFile (hFile=0x158) returned 1 [0048.613] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MS.GIF", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0048.613] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MS.GIF", cchWideChar=6, lpMultiByteStr=0x1fea15c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MS.GIF", lpUsedDefaultChar=0x0) returned 6 [0048.613] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MS.GIF", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0048.613] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MS.GIF", cchWideChar=6, lpMultiByteStr=0x1fea12c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MS.GIF", lpUsedDefaultChar=0x0) returned 6 [0048.613] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fea12c, cbMultiByte=6, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="MS.GIFWW.xmlmlmll@\x01") returned 6 [0048.613] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MS.GIF", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0048.613] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MS.GIF", cchWideChar=6, lpMultiByteStr=0x1fea15c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MS.GIF", lpUsedDefaultChar=0x0) returned 6 [0048.613] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0048.613] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0048.613] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x42d [0048.614] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0048.614] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0048.614] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0048.614] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MS.GIF", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0048.614] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MS.GIF", cchWideChar=6, lpMultiByteStr=0x1fea15c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MS.GIF", lpUsedDefaultChar=0x0) returned 6 [0048.614] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MS.GIF", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0048.614] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MS.GIF", cchWideChar=6, lpMultiByteStr=0x1fea1ec, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MS.GIF", lpUsedDefaultChar=0x0) returned 6 [0048.614] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fea1ec, cbMultiByte=6, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="MS.GIFMS.GIFWW.xmlmlmll@\x01") returned 6 [0048.614] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MS.GIF", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0048.614] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MS.GIF", cchWideChar=6, lpMultiByteStr=0x1fea15c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MS.GIF", lpUsedDefaultChar=0x0) returned 6 [0048.614] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0048.615] CharToOemA (in: pSrc="MS.GIF", pDst=0x1fea1ec | out: pDst="MS.GIF") returned 1 [0048.615] WriteFile (in: hFile=0x158, lpBuffer=0x1fea1ec*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fea1ec*, lpNumberOfBytesWritten=0x18e048*=0x6, lpOverlapped=0x0) returned 1 [0048.615] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0048.615] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0048.615] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0048.615] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=16887863627) returned 1 [0048.615] ReadFile (in: hFile=0x15c, lpBuffer=0x3500240, nNumberOfBytesToRead=0x42d, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3500240*, lpNumberOfBytesRead=0x18dd7c*=0x42d, lpOverlapped=0x0) returned 1 [0048.616] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0048.617] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=16887997188) returned 1 [0048.625] WriteFile (in: hFile=0x158, lpBuffer=0x1fea1f8*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fea1f8*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0048.625] ReadFile (in: hFile=0x15c, lpBuffer=0x3500240, nNumberOfBytesToRead=0x42d, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3500240*, lpNumberOfBytesRead=0x18de38*=0x42d, lpOverlapped=0x0) returned 1 [0048.625] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x41 [0048.625] WriteFile (in: hFile=0x158, lpBuffer=0x35006c0*, nNumberOfBytesToWrite=0x42d, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x35006c0*, lpNumberOfBytesWritten=0x18de10*=0x42d, lpOverlapped=0x0) returned 1 [0048.625] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x46e [0048.625] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0048.625] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0048.625] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0048.626] SetFilePointer (in: hFile=0x158, lDistanceToMove=6, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x24 [0048.626] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x478 [0048.626] CloseHandle (hObject=0x15c) returned 1 [0048.626] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x478 [0048.626] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x478 [0048.626] SetFilePointer (in: hFile=0x158, lDistanceToMove=1144, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x478 [0048.626] SetFilePointer (in: hFile=0x158, lDistanceToMove=1144, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x478 [0048.626] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x478 [0048.626] SetFilePointer (in: hFile=0x158, lDistanceToMove=1144, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x478 [0048.626] SetEndOfFile (hFile=0x158) returned 1 [0048.626] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x478 [0048.626] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x478 [0048.626] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MS.GIF", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0048.626] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MS.GIF", cchWideChar=6, lpMultiByteStr=0x1fea1ec, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MS.GIF", lpUsedDefaultChar=0x0) returned 6 [0048.626] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MS.GIF", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0048.626] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MS.GIF", cchWideChar=6, lpMultiByteStr=0x1fea15c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MS.GIF", lpUsedDefaultChar=0x0) returned 6 [0048.626] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fea15c, cbMultiByte=6, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="MS.GIF") returned 6 [0048.627] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MS.GIF", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0048.627] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MS.GIF", cchWideChar=6, lpMultiByteStr=0x1fea1ec, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MS.GIF", lpUsedDefaultChar=0x0) returned 6 [0048.627] WriteFile (in: hFile=0x158, lpBuffer=0x34e3cf8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x34e3cf8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0048.627] CharToOemA (in: pSrc="MS.GIF", pDst=0x1fea15c | out: pDst="MS.GIF") returned 1 [0048.627] WriteFile (in: hFile=0x158, lpBuffer=0x1fea15c*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fea15c*, lpNumberOfBytesWritten=0x18efcc*=0x6, lpOverlapped=0x0) returned 1 [0048.627] WriteFile (in: hFile=0x158, lpBuffer=0x1fea218*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea218*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0048.627] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0048.627] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0048.627] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x4b7 [0048.627] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x4b7 [0048.627] WriteFile (in: hFile=0x158, lpBuffer=0x361f5a8*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x361f5a8*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0048.627] WriteFile (in: hFile=0x158, lpBuffer=0x35f011c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f011c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0048.627] DeleteFileW (lpFileName="") returned 0 [0048.627] GetLastError () returned 0x3 [0048.627] GetFileAttributesW (lpFileName="") returned 0xffffffff [0048.627] SetLastError (dwErrCode=0x3) [0048.627] FlushFileBuffers (hFile=0x158) returned 1 [0048.629] GetCurrentThreadId () returned 0x970 [0048.629] GetCurrentThreadId () returned 0x970 [0048.629] GetCurrentThreadId () returned 0x970 [0048.629] GetCurrentThreadId () returned 0x970 [0048.629] GetCurrentThreadId () returned 0x970 [0048.630] GetCurrentThreadId () returned 0x970 [0048.630] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x56e [0048.630] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x56e [0048.630] SetFilePointer (in: hFile=0x158, lDistanceToMove=1390, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x56e [0048.630] CloseHandle (hObject=0x158) returned 1 [0048.630] GetCurrentThreadId () returned 0x970 [0048.630] GetCurrentThreadId () returned 0x970 [0048.630] GetCurrentThreadId () returned 0x970 [0048.630] GetCurrentThreadId () returned 0x970 [0048.630] GetCurrentThreadId () returned 0x970 [0048.630] GetCurrentThreadId () returned 0x970 [0048.630] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\Файл зашифрован [MS.GIF].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\Файл зашифрован [ms.gif].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0048.631] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x56e [0048.631] SetFilePointer (in: hFile=0x158, lDistanceToMove=1262, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4ee [0048.631] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0048.631] GetFileType (hFile=0x158) returned 0x1 [0048.631] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x37, wMilliseconds=0x3a6)) [0048.631] GetCurrentThreadId () returned 0x970 [0048.631] GetCurrentThreadId () returned 0x970 [0048.631] GetCurrentThreadId () returned 0x970 [0048.631] GetCurrentThreadId () returned 0x970 [0048.631] GetCurrentThreadId () returned 0x970 [0048.631] GetCurrentThreadId () returned 0x970 [0048.631] GetCurrentThreadId () returned 0x970 [0048.631] GetCurrentThreadId () returned 0x970 [0048.631] GetCurrentThreadId () returned 0x970 [0048.631] GetCurrentThreadId () returned 0x970 [0048.631] GetCurrentThreadId () returned 0x970 [0048.631] GetCurrentThreadId () returned 0x970 [0048.631] GetCurrentThreadId () returned 0x970 [0048.631] GetCurrentThreadId () returned 0x970 [0048.631] GetCurrentThreadId () returned 0x970 [0048.631] GetCurrentThreadId () returned 0x970 [0048.631] GetCurrentThreadId () returned 0x970 [0048.631] GetCurrentThreadId () returned 0x970 [0048.631] GetCurrentThreadId () returned 0x970 [0048.631] GetCurrentThreadId () returned 0x970 [0048.631] GetCurrentThreadId () returned 0x970 [0048.631] GetCurrentThreadId () returned 0x970 [0048.631] GetCurrentThreadId () returned 0x970 [0048.631] GetCurrentThreadId () returned 0x970 [0048.631] GetCurrentThreadId () returned 0x970 [0048.631] GetCurrentThreadId () returned 0x970 [0048.631] GetCurrentThreadId () returned 0x970 [0048.631] GetCurrentThreadId () returned 0x970 [0048.631] GetCurrentThreadId () returned 0x970 [0048.631] GetCurrentThreadId () returned 0x970 [0048.631] GetCurrentThreadId () returned 0x970 [0048.631] GetCurrentThreadId () returned 0x970 [0048.631] GetCurrentThreadId () returned 0x970 [0048.631] GetCurrentThreadId () returned 0x970 [0048.632] GetCurrentThreadId () returned 0x970 [0048.632] GetCurrentThreadId () returned 0x970 [0048.632] GetCurrentThreadId () returned 0x970 [0048.632] GetCurrentThreadId () returned 0x970 [0048.632] GetCurrentThreadId () returned 0x970 [0048.632] GetCurrentThreadId () returned 0x970 [0048.632] GetCurrentThreadId () returned 0x970 [0048.632] GetCurrentThreadId () returned 0x970 [0048.632] GetCurrentThreadId () returned 0x970 [0048.632] GetCurrentThreadId () returned 0x970 [0048.632] GetCurrentThreadId () returned 0x970 [0048.632] GetCurrentThreadId () returned 0x970 [0048.632] GetCurrentThreadId () returned 0x970 [0048.632] GetCurrentThreadId () returned 0x970 [0048.632] GetCurrentThreadId () returned 0x970 [0048.632] GetCurrentThreadId () returned 0x970 [0048.632] GetCurrentThreadId () returned 0x970 [0048.632] GetCurrentThreadId () returned 0x970 [0048.632] GetCurrentThreadId () returned 0x970 [0048.632] GetCurrentThreadId () returned 0x970 [0048.632] GetCurrentThreadId () returned 0x970 [0048.632] GetCurrentThreadId () returned 0x970 [0048.632] GetCurrentThreadId () returned 0x970 [0048.632] GetCurrentThreadId () returned 0x970 [0048.632] GetCurrentThreadId () returned 0x970 [0048.632] GetCurrentThreadId () returned 0x970 [0048.632] GetCurrentThreadId () returned 0x970 [0048.632] GetCurrentThreadId () returned 0x970 [0048.632] GetCurrentThreadId () returned 0x970 [0048.632] GetCurrentThreadId () returned 0x970 [0048.632] GetCurrentThreadId () returned 0x970 [0048.632] GetCurrentThreadId () returned 0x970 [0048.632] GetCurrentThreadId () returned 0x970 [0048.632] GetCurrentThreadId () returned 0x970 [0048.632] GetCurrentThreadId () returned 0x970 [0048.632] GetCurrentThreadId () returned 0x970 [0048.632] GetCurrentThreadId () returned 0x970 [0048.632] GetCurrentThreadId () returned 0x970 [0048.632] GetCurrentThreadId () returned 0x970 [0048.632] GetCurrentThreadId () returned 0x970 [0048.632] GetCurrentThreadId () returned 0x970 [0048.632] GetCurrentThreadId () returned 0x970 [0048.632] GetCurrentThreadId () returned 0x970 [0048.632] GetCurrentThreadId () returned 0x970 [0048.632] GetCurrentThreadId () returned 0x970 [0048.632] GetCurrentThreadId () returned 0x970 [0048.632] GetCurrentThreadId () returned 0x970 [0048.632] GetCurrentThreadId () returned 0x970 [0048.632] GetCurrentThreadId () returned 0x970 [0048.633] GetCurrentThreadId () returned 0x970 [0048.633] GetCurrentThreadId () returned 0x970 [0048.633] GetCurrentThreadId () returned 0x970 [0048.633] GetCurrentThreadId () returned 0x970 [0048.633] GetCurrentThreadId () returned 0x970 [0048.633] GetCurrentThreadId () returned 0x970 [0048.633] GetCurrentThreadId () returned 0x970 [0048.633] GetCurrentThreadId () returned 0x970 [0048.633] GetCurrentThreadId () returned 0x970 [0048.633] GetCurrentThreadId () returned 0x970 [0048.633] GetCurrentThreadId () returned 0x970 [0048.633] GetCurrentThreadId () returned 0x970 [0048.633] GetCurrentThreadId () returned 0x970 [0048.633] GetCurrentThreadId () returned 0x970 [0048.633] GetCurrentThreadId () returned 0x970 [0048.633] GetCurrentThreadId () returned 0x970 [0048.633] GetCurrentThreadId () returned 0x970 [0048.633] GetCurrentThreadId () returned 0x970 [0048.633] GetCurrentThreadId () returned 0x970 [0048.633] GetCurrentThreadId () returned 0x970 [0048.633] GetCurrentThreadId () returned 0x970 [0048.633] GetCurrentThreadId () returned 0x970 [0048.633] GetCurrentThreadId () returned 0x970 [0048.633] GetCurrentThreadId () returned 0x970 [0048.633] GetCurrentThreadId () returned 0x970 [0048.633] GetCurrentThreadId () returned 0x970 [0048.633] GetCurrentThreadId () returned 0x970 [0048.633] GetCurrentThreadId () returned 0x970 [0048.633] GetCurrentThreadId () returned 0x970 [0048.633] GetCurrentThreadId () returned 0x970 [0048.633] GetCurrentThreadId () returned 0x970 [0048.633] GetCurrentThreadId () returned 0x970 [0048.633] GetCurrentThreadId () returned 0x970 [0048.633] GetCurrentThreadId () returned 0x970 [0048.633] GetCurrentThreadId () returned 0x970 [0048.633] GetCurrentThreadId () returned 0x970 [0048.633] GetCurrentThreadId () returned 0x970 [0048.633] GetCurrentThreadId () returned 0x970 [0048.633] GetCurrentThreadId () returned 0x970 [0048.633] GetCurrentThreadId () returned 0x970 [0048.633] GetCurrentThreadId () returned 0x970 [0048.633] GetCurrentThreadId () returned 0x970 [0048.633] GetCurrentThreadId () returned 0x970 [0048.633] GetCurrentThreadId () returned 0x970 [0048.633] GetCurrentThreadId () returned 0x970 [0048.633] GetCurrentThreadId () returned 0x970 [0048.633] GetCurrentThreadId () returned 0x970 [0048.634] GetCurrentThreadId () returned 0x970 [0048.634] GetCurrentThreadId () returned 0x970 [0048.634] GetCurrentThreadId () returned 0x970 [0048.634] GetCurrentThreadId () returned 0x970 [0048.634] GetCurrentThreadId () returned 0x970 [0048.634] GetCurrentThreadId () returned 0x970 [0048.634] GetCurrentThreadId () returned 0x970 [0048.634] GetCurrentThreadId () returned 0x970 [0048.634] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.634] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.634] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb4f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.634] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.634] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.634] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb4f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.634] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.634] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.634] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.634] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.634] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.634] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.634] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.634] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.634] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb550, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.634] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.634] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.634] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb550, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.634] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.634] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.634] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb550, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.634] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x37, wMilliseconds=0x3a6)) [0048.634] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="7bUUQe3,9402i}0s@QR&^MV^MqaL^zLk", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0048.634] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="7bUUQe3,9402i}0s@QR&^MV^MqaL^zLk", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0048.634] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="7bUUQe3,9402i}0s@QR&^MV^MqaL^zLk", cchWideChar=32, lpMultiByteStr=0x2000718, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7bUUQe3,9402i}0s@QR&^MV^MqaL^zLk", lpUsedDefaultChar=0x0) returned 32 [0048.634] GetCurrentThreadId () returned 0x970 [0048.635] GetCurrentThreadId () returned 0x970 [0048.635] GetCurrentThreadId () returned 0x970 [0048.635] GetCurrentThreadId () returned 0x970 [0048.635] GetCurrentThreadId () returned 0x970 [0048.635] GetCurrentThreadId () returned 0x970 [0048.642] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0048.642] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0048.642] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x202db58, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0048.642] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x35904f8, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0048.642] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x35904f8, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAD2IBRPenevSjdcrUNEiU5+FlusSZK1V1mdorZF44OSOBpHP1cCtftHcsoyugxBVzCSriwxdEl3TH/ZEduAbXk4BdqfbBJdKDrv4g5A7TYZg6YhCsX/mejUGmV0fg4hkn5kCAyBcqZs637EhuDkA1BXvUF/dgl0z8/3oLBRtFLzZ+MO5mMlHe5VoGb23Sy7wEd1mqvKcKe0mzRybbmavmr8R31qk3BSoEw==") returned 232 [0048.642] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x37, wMilliseconds=0x3b5)) [0048.642] GetCurrentThreadId () returned 0x970 [0048.642] GetCurrentThreadId () returned 0x970 [0048.642] GetCurrentThreadId () returned 0x970 [0048.642] GetCurrentThreadId () returned 0x970 [0048.642] GetCurrentThreadId () returned 0x970 [0048.642] GetCurrentThreadId () returned 0x970 [0048.642] GetCurrentThreadId () returned 0x970 [0048.642] GetCurrentThreadId () returned 0x970 [0048.642] GetCurrentThreadId () returned 0x970 [0048.642] GetCurrentThreadId () returned 0x970 [0048.642] GetCurrentThreadId () returned 0x970 [0048.642] GetCurrentThreadId () returned 0x970 [0048.642] GetCurrentThreadId () returned 0x970 [0048.642] GetCurrentThreadId () returned 0x970 [0048.642] GetCurrentThreadId () returned 0x970 [0048.642] GetCurrentThreadId () returned 0x970 [0048.642] GetCurrentThreadId () returned 0x970 [0048.642] GetCurrentThreadId () returned 0x970 [0048.642] GetCurrentThreadId () returned 0x970 [0048.642] GetCurrentThreadId () returned 0x970 [0048.642] GetCurrentThreadId () returned 0x970 [0048.643] GetCurrentThreadId () returned 0x970 [0048.643] GetCurrentThreadId () returned 0x970 [0048.643] GetCurrentThreadId () returned 0x970 [0048.643] GetCurrentThreadId () returned 0x970 [0048.643] GetCurrentThreadId () returned 0x970 [0048.643] GetCurrentThreadId () returned 0x970 [0048.643] GetCurrentThreadId () returned 0x970 [0048.643] GetCurrentThreadId () returned 0x970 [0048.643] GetCurrentThreadId () returned 0x970 [0048.643] GetCurrentThreadId () returned 0x970 [0048.643] GetCurrentThreadId () returned 0x970 [0048.643] GetCurrentThreadId () returned 0x970 [0048.643] GetCurrentThreadId () returned 0x970 [0048.643] GetCurrentThreadId () returned 0x970 [0048.643] GetCurrentThreadId () returned 0x970 [0048.643] GetCurrentThreadId () returned 0x970 [0048.643] GetCurrentThreadId () returned 0x970 [0048.643] GetCurrentThreadId () returned 0x970 [0048.643] GetCurrentThreadId () returned 0x970 [0048.643] GetCurrentThreadId () returned 0x970 [0048.643] GetCurrentThreadId () returned 0x970 [0048.643] GetCurrentThreadId () returned 0x970 [0048.643] GetCurrentThreadId () returned 0x970 [0048.643] GetCurrentThreadId () returned 0x970 [0048.643] GetCurrentThreadId () returned 0x970 [0048.643] GetCurrentThreadId () returned 0x970 [0048.643] GetCurrentThreadId () returned 0x970 [0048.643] GetCurrentThreadId () returned 0x970 [0048.643] GetCurrentThreadId () returned 0x970 [0048.643] GetCurrentThreadId () returned 0x970 [0048.643] GetCurrentThreadId () returned 0x970 [0048.643] GetCurrentThreadId () returned 0x970 [0048.643] GetCurrentThreadId () returned 0x970 [0048.643] GetCurrentThreadId () returned 0x970 [0048.643] GetCurrentThreadId () returned 0x970 [0048.643] GetCurrentThreadId () returned 0x970 [0048.643] GetCurrentThreadId () returned 0x970 [0048.643] GetCurrentThreadId () returned 0x970 [0048.643] GetCurrentThreadId () returned 0x970 [0048.643] GetCurrentThreadId () returned 0x970 [0048.643] GetCurrentThreadId () returned 0x970 [0048.643] GetCurrentThreadId () returned 0x970 [0048.643] GetCurrentThreadId () returned 0x970 [0048.643] GetCurrentThreadId () returned 0x970 [0048.643] GetCurrentThreadId () returned 0x970 [0048.643] GetCurrentThreadId () returned 0x970 [0048.643] GetCurrentThreadId () returned 0x970 [0048.643] GetCurrentThreadId () returned 0x970 [0048.643] GetCurrentThreadId () returned 0x970 [0048.644] GetCurrentThreadId () returned 0x970 [0048.644] GetCurrentThreadId () returned 0x970 [0048.644] GetCurrentThreadId () returned 0x970 [0048.644] GetCurrentThreadId () returned 0x970 [0048.644] GetCurrentThreadId () returned 0x970 [0048.644] GetCurrentThreadId () returned 0x970 [0048.644] GetCurrentThreadId () returned 0x970 [0048.644] GetCurrentThreadId () returned 0x970 [0048.644] GetCurrentThreadId () returned 0x970 [0048.644] GetCurrentThreadId () returned 0x970 [0048.644] GetCurrentThreadId () returned 0x970 [0048.644] GetCurrentThreadId () returned 0x970 [0048.644] GetCurrentThreadId () returned 0x970 [0048.644] GetCurrentThreadId () returned 0x970 [0048.644] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAD2IBRPenevSjdcrUNEiU5+FlusSZK1V1mdorZF44OSOBpHP1cCtftHcsoyugxBVzCSriwxdEl3TH/ZEduAbXk4BdqfbBJdKDrv4g5A7TYZg6YhCsX/mejUGmV0fg4hkn5kCAyBcqZs637EhuDkA1BXvUF/dgl0z8/3oLBRtFLzZ+MO5mMlHe5VoGb23Sy7wEd1mqvKcKe0mzRybbmavmr8R31qk3BSoEw==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0048.644] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAD2IBRPenevSjdcrUNEiU5+FlusSZK1V1mdorZF44OSOBpHP1cCtftHcsoyugxBVzCSriwxdEl3TH/ZEduAbXk4BdqfbBJdKDrv4g5A7TYZg6YhCsX/mejUGmV0fg4hkn5kCAyBcqZs637EhuDkA1BXvUF/dgl0z8/3oLBRtFLzZ+MO5mMlHe5VoGb23Sy7wEd1mqvKcKe0mzRybbmavmr8R31qk3BSoEw==", cchWideChar=245, lpMultiByteStr=0x353900c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAD2IBRPenevSjdcrUNEiU5+FlusSZK1V1mdorZF44OSOBpHP1cCtftHcsoyugxBVzCSriwxdEl3TH/ZEduAbXk4BdqfbBJdKDrv4g5A7TYZg6YhCsX/mejUGmV0fg4hkn5kCAyBcqZs637EhuDkA1BXvUF/dgl0z8/3oLBRtFLzZ+MO5mMlHe5VoGb23Sy7wEd1mqvKcKe0mzRybbmavmr8R31qk3BSoEw==", lpUsedDefaultChar=0x0) returned 245 [0048.644] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0048.644] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0048.644] CloseHandle (hObject=0x158) returned 1 [0048.645] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif")) returned 1 [0048.646] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=16890911678) returned 1 [0048.646] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\Файл зашифрован [MS.JPG].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\Файл зашифрован [ms.jpg].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0048.646] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0048.646] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0048.646] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0048.646] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0048.646] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0048.646] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0048.646] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0048.646] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0048.646] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0048.647] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0048.647] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0048.647] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0048.647] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0048.647] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0048.647] SetEndOfFile (hFile=0x158) returned 1 [0048.647] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0048.647] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0048.647] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0048.647] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0048.647] WriteFile (in: hFile=0x158, lpBuffer=0x361f5a8*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x361f5a8*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0048.648] WriteFile (in: hFile=0x158, lpBuffer=0x35f005c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f005c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0048.648] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="zGa9#yvd,3F9R\")!HbK\\t*C@TY.@~uNx", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0048.648] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="zGa9#yvd,3F9R\")!HbK\\t*C@TY.@~uNx", cchWideChar=32, lpMultiByteStr=0x2032a5c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="zGa9#yvd,3F9R\")!HbK\\t*C@TY.@~uNx", lpUsedDefaultChar=0x0) returned 32 [0048.648] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0048.648] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0048.648] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x425, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.JPG", cAlternateFileName="")) returned 0x295098 [0048.648] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0048.648] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0048.648] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg")) returned 0x20 [0048.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg")) returned 0x20 [0048.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg")) returned 0x20 [0048.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg")) returned 0x20 [0048.649] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x425)) returned 1 [0048.649] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0048.649] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0048.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg")) returned 0x20 [0048.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg")) returned 0x20 [0048.649] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0048.649] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0048.650] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0048.650] SetEndOfFile (hFile=0x158) returned 1 [0048.650] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MS.JPG", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0048.650] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MS.JPG", cchWideChar=6, lpMultiByteStr=0x1fea204, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MS.JPG", lpUsedDefaultChar=0x0) returned 6 [0048.650] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MS.JPG", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0048.650] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MS.JPG", cchWideChar=6, lpMultiByteStr=0x1fea1d4, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MS.JPG", lpUsedDefaultChar=0x0) returned 6 [0048.651] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fea1d4, cbMultiByte=6, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="MS.JPGWW.xmlmlmll@\x01") returned 6 [0048.651] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MS.JPG", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0048.651] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MS.JPG", cchWideChar=6, lpMultiByteStr=0x1fea204, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MS.JPG", lpUsedDefaultChar=0x0) returned 6 [0048.651] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0048.651] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0048.651] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x425 [0048.651] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0048.651] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0048.651] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0048.651] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MS.JPG", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0048.651] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MS.JPG", cchWideChar=6, lpMultiByteStr=0x1fea204, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MS.JPG", lpUsedDefaultChar=0x0) returned 6 [0048.651] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MS.JPG", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0048.651] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MS.JPG", cchWideChar=6, lpMultiByteStr=0x1fea234, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MS.JPG", lpUsedDefaultChar=0x0) returned 6 [0048.651] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fea234, cbMultiByte=6, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="MS.JPGMS.JPGWW.xmlmlmll@\x01") returned 6 [0048.651] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MS.JPG", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0048.651] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MS.JPG", cchWideChar=6, lpMultiByteStr=0x1fea204, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MS.JPG", lpUsedDefaultChar=0x0) returned 6 [0048.651] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0048.652] CharToOemA (in: pSrc="MS.JPG", pDst=0x1fea234 | out: pDst="MS.JPG") returned 1 [0048.652] WriteFile (in: hFile=0x158, lpBuffer=0x1fea234*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fea234*, lpNumberOfBytesWritten=0x18e048*=0x6, lpOverlapped=0x0) returned 1 [0048.652] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0048.652] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0048.652] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0048.652] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=16891595468) returned 1 [0048.653] ReadFile (in: hFile=0x15c, lpBuffer=0x3500240, nNumberOfBytesToRead=0x425, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3500240*, lpNumberOfBytesRead=0x18dd7c*=0x425, lpOverlapped=0x0) returned 1 [0048.654] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0048.654] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=16891732649) returned 1 [0048.662] WriteFile (in: hFile=0x158, lpBuffer=0x1fea150*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fea150*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0048.662] ReadFile (in: hFile=0x15c, lpBuffer=0x3500240, nNumberOfBytesToRead=0x425, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3500240*, lpNumberOfBytesRead=0x18de38*=0x425, lpOverlapped=0x0) returned 1 [0048.662] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x41 [0048.662] WriteFile (in: hFile=0x158, lpBuffer=0x35006c0*, nNumberOfBytesToWrite=0x425, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x35006c0*, lpNumberOfBytesWritten=0x18de10*=0x425, lpOverlapped=0x0) returned 1 [0048.663] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x466 [0048.663] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0048.663] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0048.663] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0048.663] SetFilePointer (in: hFile=0x158, lDistanceToMove=6, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x24 [0048.663] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x470 [0048.663] CloseHandle (hObject=0x15c) returned 1 [0048.663] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x470 [0048.663] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x470 [0048.663] SetFilePointer (in: hFile=0x158, lDistanceToMove=1136, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x470 [0048.663] SetFilePointer (in: hFile=0x158, lDistanceToMove=1136, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x470 [0048.663] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x470 [0048.663] SetFilePointer (in: hFile=0x158, lDistanceToMove=1136, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x470 [0048.663] SetEndOfFile (hFile=0x158) returned 1 [0048.664] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x470 [0048.664] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x470 [0048.664] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MS.JPG", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0048.664] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MS.JPG", cchWideChar=6, lpMultiByteStr=0x1fea234, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MS.JPG", lpUsedDefaultChar=0x0) returned 6 [0048.664] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MS.JPG", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0048.664] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MS.JPG", cchWideChar=6, lpMultiByteStr=0x1fea204, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MS.JPG", lpUsedDefaultChar=0x0) returned 6 [0048.664] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fea204, cbMultiByte=6, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="MS.JPG") returned 6 [0048.664] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MS.JPG", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0048.664] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MS.JPG", cchWideChar=6, lpMultiByteStr=0x1fea234, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MS.JPG", lpUsedDefaultChar=0x0) returned 6 [0048.664] WriteFile (in: hFile=0x158, lpBuffer=0x34e3cf8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x34e3cf8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0048.664] CharToOemA (in: pSrc="MS.JPG", pDst=0x1fea204 | out: pDst="MS.JPG") returned 1 [0048.664] WriteFile (in: hFile=0x158, lpBuffer=0x1fea204*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fea204*, lpNumberOfBytesWritten=0x18efcc*=0x6, lpOverlapped=0x0) returned 1 [0048.664] WriteFile (in: hFile=0x158, lpBuffer=0x1fea2d8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea2d8*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0048.664] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0048.664] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0048.664] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x4af [0048.664] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x4af [0048.664] WriteFile (in: hFile=0x158, lpBuffer=0x361f5a8*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x361f5a8*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0048.665] WriteFile (in: hFile=0x158, lpBuffer=0x35f005c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f005c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0048.665] DeleteFileW (lpFileName="") returned 0 [0048.665] GetLastError () returned 0x3 [0048.665] GetFileAttributesW (lpFileName="") returned 0xffffffff [0048.665] SetLastError (dwErrCode=0x3) [0048.665] FlushFileBuffers (hFile=0x158) returned 1 [0048.667] GetCurrentThreadId () returned 0x970 [0048.667] GetCurrentThreadId () returned 0x970 [0048.667] GetCurrentThreadId () returned 0x970 [0048.667] GetCurrentThreadId () returned 0x970 [0048.667] GetCurrentThreadId () returned 0x970 [0048.667] GetCurrentThreadId () returned 0x970 [0048.667] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x566 [0048.667] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x566 [0048.667] SetFilePointer (in: hFile=0x158, lDistanceToMove=1382, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x566 [0048.667] CloseHandle (hObject=0x158) returned 1 [0048.668] GetCurrentThreadId () returned 0x970 [0048.668] GetCurrentThreadId () returned 0x970 [0048.668] GetCurrentThreadId () returned 0x970 [0048.668] GetCurrentThreadId () returned 0x970 [0048.668] GetCurrentThreadId () returned 0x970 [0048.668] GetCurrentThreadId () returned 0x970 [0048.668] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\Файл зашифрован [MS.JPG].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\Файл зашифрован [ms.jpg].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0048.668] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x566 [0048.668] SetFilePointer (in: hFile=0x158, lDistanceToMove=1254, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4e6 [0048.668] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0048.668] GetFileType (hFile=0x158) returned 0x1 [0048.668] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x37, wMilliseconds=0x3c5)) [0048.668] GetCurrentThreadId () returned 0x970 [0048.668] GetCurrentThreadId () returned 0x970 [0048.668] GetCurrentThreadId () returned 0x970 [0048.668] GetCurrentThreadId () returned 0x970 [0048.668] GetCurrentThreadId () returned 0x970 [0048.668] GetCurrentThreadId () returned 0x970 [0048.668] GetCurrentThreadId () returned 0x970 [0048.668] GetCurrentThreadId () returned 0x970 [0048.668] GetCurrentThreadId () returned 0x970 [0048.668] GetCurrentThreadId () returned 0x970 [0048.668] GetCurrentThreadId () returned 0x970 [0048.669] GetCurrentThreadId () returned 0x970 [0048.669] GetCurrentThreadId () returned 0x970 [0048.669] GetCurrentThreadId () returned 0x970 [0048.669] GetCurrentThreadId () returned 0x970 [0048.669] GetCurrentThreadId () returned 0x970 [0048.669] GetCurrentThreadId () returned 0x970 [0048.669] GetCurrentThreadId () returned 0x970 [0048.669] GetCurrentThreadId () returned 0x970 [0048.669] GetCurrentThreadId () returned 0x970 [0048.669] GetCurrentThreadId () returned 0x970 [0048.669] GetCurrentThreadId () returned 0x970 [0048.669] GetCurrentThreadId () returned 0x970 [0048.669] GetCurrentThreadId () returned 0x970 [0048.669] GetCurrentThreadId () returned 0x970 [0048.669] GetCurrentThreadId () returned 0x970 [0048.669] GetCurrentThreadId () returned 0x970 [0048.669] GetCurrentThreadId () returned 0x970 [0048.669] GetCurrentThreadId () returned 0x970 [0048.669] GetCurrentThreadId () returned 0x970 [0048.669] GetCurrentThreadId () returned 0x970 [0048.669] GetCurrentThreadId () returned 0x970 [0048.669] GetCurrentThreadId () returned 0x970 [0048.669] GetCurrentThreadId () returned 0x970 [0048.669] GetCurrentThreadId () returned 0x970 [0048.669] GetCurrentThreadId () returned 0x970 [0048.669] GetCurrentThreadId () returned 0x970 [0048.669] GetCurrentThreadId () returned 0x970 [0048.669] GetCurrentThreadId () returned 0x970 [0048.669] GetCurrentThreadId () returned 0x970 [0048.669] GetCurrentThreadId () returned 0x970 [0048.669] GetCurrentThreadId () returned 0x970 [0048.669] GetCurrentThreadId () returned 0x970 [0048.669] GetCurrentThreadId () returned 0x970 [0048.669] GetCurrentThreadId () returned 0x970 [0048.669] GetCurrentThreadId () returned 0x970 [0048.669] GetCurrentThreadId () returned 0x970 [0048.669] GetCurrentThreadId () returned 0x970 [0048.669] GetCurrentThreadId () returned 0x970 [0048.669] GetCurrentThreadId () returned 0x970 [0048.669] GetCurrentThreadId () returned 0x970 [0048.669] GetCurrentThreadId () returned 0x970 [0048.669] GetCurrentThreadId () returned 0x970 [0048.669] GetCurrentThreadId () returned 0x970 [0048.669] GetCurrentThreadId () returned 0x970 [0048.669] GetCurrentThreadId () returned 0x970 [0048.669] GetCurrentThreadId () returned 0x970 [0048.669] GetCurrentThreadId () returned 0x970 [0048.670] GetCurrentThreadId () returned 0x970 [0048.670] GetCurrentThreadId () returned 0x970 [0048.670] GetCurrentThreadId () returned 0x970 [0048.670] GetCurrentThreadId () returned 0x970 [0048.670] GetCurrentThreadId () returned 0x970 [0048.670] GetCurrentThreadId () returned 0x970 [0048.670] GetCurrentThreadId () returned 0x970 [0048.670] GetCurrentThreadId () returned 0x970 [0048.670] GetCurrentThreadId () returned 0x970 [0048.670] GetCurrentThreadId () returned 0x970 [0048.670] GetCurrentThreadId () returned 0x970 [0048.670] GetCurrentThreadId () returned 0x970 [0048.670] GetCurrentThreadId () returned 0x970 [0048.670] GetCurrentThreadId () returned 0x970 [0048.670] GetCurrentThreadId () returned 0x970 [0048.670] GetCurrentThreadId () returned 0x970 [0048.670] GetCurrentThreadId () returned 0x970 [0048.670] GetCurrentThreadId () returned 0x970 [0048.670] GetCurrentThreadId () returned 0x970 [0048.670] GetCurrentThreadId () returned 0x970 [0048.670] GetCurrentThreadId () returned 0x970 [0048.670] GetCurrentThreadId () returned 0x970 [0048.670] GetCurrentThreadId () returned 0x970 [0048.670] GetCurrentThreadId () returned 0x970 [0048.670] GetCurrentThreadId () returned 0x970 [0048.670] GetCurrentThreadId () returned 0x970 [0048.670] GetCurrentThreadId () returned 0x970 [0048.670] GetCurrentThreadId () returned 0x970 [0048.670] GetCurrentThreadId () returned 0x970 [0048.670] GetCurrentThreadId () returned 0x970 [0048.670] GetCurrentThreadId () returned 0x970 [0048.670] GetCurrentThreadId () returned 0x970 [0048.670] GetCurrentThreadId () returned 0x970 [0048.670] GetCurrentThreadId () returned 0x970 [0048.670] GetCurrentThreadId () returned 0x970 [0048.670] GetCurrentThreadId () returned 0x970 [0048.670] GetCurrentThreadId () returned 0x970 [0048.670] GetCurrentThreadId () returned 0x970 [0048.670] GetCurrentThreadId () returned 0x970 [0048.670] GetCurrentThreadId () returned 0x970 [0048.670] GetCurrentThreadId () returned 0x970 [0048.670] GetCurrentThreadId () returned 0x970 [0048.670] GetCurrentThreadId () returned 0x970 [0048.670] GetCurrentThreadId () returned 0x970 [0048.670] GetCurrentThreadId () returned 0x970 [0048.670] GetCurrentThreadId () returned 0x970 [0048.671] GetCurrentThreadId () returned 0x970 [0048.671] GetCurrentThreadId () returned 0x970 [0048.671] GetCurrentThreadId () returned 0x970 [0048.671] GetCurrentThreadId () returned 0x970 [0048.671] GetCurrentThreadId () returned 0x970 [0048.671] GetCurrentThreadId () returned 0x970 [0048.671] GetCurrentThreadId () returned 0x970 [0048.671] GetCurrentThreadId () returned 0x970 [0048.671] GetCurrentThreadId () returned 0x970 [0048.671] GetCurrentThreadId () returned 0x970 [0048.671] GetCurrentThreadId () returned 0x970 [0048.671] GetCurrentThreadId () returned 0x970 [0048.671] GetCurrentThreadId () returned 0x970 [0048.671] GetCurrentThreadId () returned 0x970 [0048.671] GetCurrentThreadId () returned 0x970 [0048.671] GetCurrentThreadId () returned 0x970 [0048.671] GetCurrentThreadId () returned 0x970 [0048.671] GetCurrentThreadId () returned 0x970 [0048.671] GetCurrentThreadId () returned 0x970 [0048.671] GetCurrentThreadId () returned 0x970 [0048.671] GetCurrentThreadId () returned 0x970 [0048.671] GetCurrentThreadId () returned 0x970 [0048.671] GetCurrentThreadId () returned 0x970 [0048.671] GetCurrentThreadId () returned 0x970 [0048.671] GetCurrentThreadId () returned 0x970 [0048.671] GetCurrentThreadId () returned 0x970 [0048.671] GetCurrentThreadId () returned 0x970 [0048.671] GetCurrentThreadId () returned 0x970 [0048.671] GetCurrentThreadId () returned 0x970 [0048.671] GetCurrentThreadId () returned 0x970 [0048.671] GetCurrentThreadId () returned 0x970 [0048.671] GetCurrentThreadId () returned 0x970 [0048.671] GetCurrentThreadId () returned 0x970 [0048.671] GetCurrentThreadId () returned 0x970 [0048.671] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.671] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.671] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb550, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.671] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.671] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.671] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb550, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.671] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.671] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.672] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.672] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.672] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.672] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.672] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.672] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.672] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb5b0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.672] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.672] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.672] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb5b0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.672] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.672] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.672] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb5b0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.672] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x37, wMilliseconds=0x3d4)) [0048.672] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="zGa9#yvd,3F9R\")!HbK\\t*C@TY.@~uNx", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0048.672] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="zGa9#yvd,3F9R\")!HbK\\t*C@TY.@~uNx", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0048.672] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="zGa9#yvd,3F9R\")!HbK\\t*C@TY.@~uNx", cchWideChar=32, lpMultiByteStr=0x2000898, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="zGa9#yvd,3F9R\")!HbK\\t*C@TY.@~uNx", lpUsedDefaultChar=0x0) returned 32 [0048.672] GetCurrentThreadId () returned 0x970 [0048.672] GetCurrentThreadId () returned 0x970 [0048.672] GetCurrentThreadId () returned 0x970 [0048.672] GetCurrentThreadId () returned 0x970 [0048.672] GetCurrentThreadId () returned 0x970 [0048.672] GetCurrentThreadId () returned 0x970 [0048.679] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0048.679] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0048.679] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x202dc48, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0048.679] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x35904f8, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0048.679] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x35904f8, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAEo879cylisYo4zztoDnBvE00CyE4DobTgYQUZihb29x7tx8jS25PVFNC/+A4XUO+/YqKQiE69mekxZily3MKgtTkKYDa+RZqoLPGKvBw1OgUKliTabDedk/YtP+dmhkvpjJOOlcDQ/xCwftj0QGkqgTEpabAIlXPRFIWzOIvVaHlEd0EtBPC9C/aHtIDKh0kXoWVT7hydq/TE/1oGI+Oo9lNw1SpaiMqQ==") returned 232 [0048.679] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x37, wMilliseconds=0x3d4)) [0048.679] GetCurrentThreadId () returned 0x970 [0048.679] GetCurrentThreadId () returned 0x970 [0048.679] GetCurrentThreadId () returned 0x970 [0048.679] GetCurrentThreadId () returned 0x970 [0048.679] GetCurrentThreadId () returned 0x970 [0048.680] GetCurrentThreadId () returned 0x970 [0048.680] GetCurrentThreadId () returned 0x970 [0048.680] GetCurrentThreadId () returned 0x970 [0048.680] GetCurrentThreadId () returned 0x970 [0048.680] GetCurrentThreadId () returned 0x970 [0048.680] GetCurrentThreadId () returned 0x970 [0048.680] GetCurrentThreadId () returned 0x970 [0048.680] GetCurrentThreadId () returned 0x970 [0048.680] GetCurrentThreadId () returned 0x970 [0048.680] GetCurrentThreadId () returned 0x970 [0048.680] GetCurrentThreadId () returned 0x970 [0048.680] GetCurrentThreadId () returned 0x970 [0048.680] GetCurrentThreadId () returned 0x970 [0048.680] GetCurrentThreadId () returned 0x970 [0048.680] GetCurrentThreadId () returned 0x970 [0048.680] GetCurrentThreadId () returned 0x970 [0048.680] GetCurrentThreadId () returned 0x970 [0048.680] GetCurrentThreadId () returned 0x970 [0048.680] GetCurrentThreadId () returned 0x970 [0048.680] GetCurrentThreadId () returned 0x970 [0048.680] GetCurrentThreadId () returned 0x970 [0048.680] GetCurrentThreadId () returned 0x970 [0048.680] GetCurrentThreadId () returned 0x970 [0048.680] GetCurrentThreadId () returned 0x970 [0048.680] GetCurrentThreadId () returned 0x970 [0048.680] GetCurrentThreadId () returned 0x970 [0048.680] GetCurrentThreadId () returned 0x970 [0048.680] GetCurrentThreadId () returned 0x970 [0048.680] GetCurrentThreadId () returned 0x970 [0048.680] GetCurrentThreadId () returned 0x970 [0048.680] GetCurrentThreadId () returned 0x970 [0048.680] GetCurrentThreadId () returned 0x970 [0048.680] GetCurrentThreadId () returned 0x970 [0048.680] GetCurrentThreadId () returned 0x970 [0048.680] GetCurrentThreadId () returned 0x970 [0048.680] GetCurrentThreadId () returned 0x970 [0048.680] GetCurrentThreadId () returned 0x970 [0048.680] GetCurrentThreadId () returned 0x970 [0048.680] GetCurrentThreadId () returned 0x970 [0048.680] GetCurrentThreadId () returned 0x970 [0048.680] GetCurrentThreadId () returned 0x970 [0048.680] GetCurrentThreadId () returned 0x970 [0048.680] GetCurrentThreadId () returned 0x970 [0048.680] GetCurrentThreadId () returned 0x970 [0048.680] GetCurrentThreadId () returned 0x970 [0048.680] GetCurrentThreadId () returned 0x970 [0048.680] GetCurrentThreadId () returned 0x970 [0048.680] GetCurrentThreadId () returned 0x970 [0048.680] GetCurrentThreadId () returned 0x970 [0048.681] GetCurrentThreadId () returned 0x970 [0048.681] GetCurrentThreadId () returned 0x970 [0048.681] GetCurrentThreadId () returned 0x970 [0048.681] GetCurrentThreadId () returned 0x970 [0048.681] GetCurrentThreadId () returned 0x970 [0048.681] GetCurrentThreadId () returned 0x970 [0048.681] GetCurrentThreadId () returned 0x970 [0048.681] GetCurrentThreadId () returned 0x970 [0048.681] GetCurrentThreadId () returned 0x970 [0048.681] GetCurrentThreadId () returned 0x970 [0048.681] GetCurrentThreadId () returned 0x970 [0048.681] GetCurrentThreadId () returned 0x970 [0048.681] GetCurrentThreadId () returned 0x970 [0048.681] GetCurrentThreadId () returned 0x970 [0048.681] GetCurrentThreadId () returned 0x970 [0048.681] GetCurrentThreadId () returned 0x970 [0048.681] GetCurrentThreadId () returned 0x970 [0048.681] GetCurrentThreadId () returned 0x970 [0048.681] GetCurrentThreadId () returned 0x970 [0048.681] GetCurrentThreadId () returned 0x970 [0048.681] GetCurrentThreadId () returned 0x970 [0048.681] GetCurrentThreadId () returned 0x970 [0048.681] GetCurrentThreadId () returned 0x970 [0048.681] GetCurrentThreadId () returned 0x970 [0048.681] GetCurrentThreadId () returned 0x970 [0048.681] GetCurrentThreadId () returned 0x970 [0048.681] GetCurrentThreadId () returned 0x970 [0048.681] GetCurrentThreadId () returned 0x970 [0048.681] GetCurrentThreadId () returned 0x970 [0048.681] GetCurrentThreadId () returned 0x970 [0048.681] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAEo879cylisYo4zztoDnBvE00CyE4DobTgYQUZihb29x7tx8jS25PVFNC/+A4XUO+/YqKQiE69mekxZily3MKgtTkKYDa+RZqoLPGKvBw1OgUKliTabDedk/YtP+dmhkvpjJOOlcDQ/xCwftj0QGkqgTEpabAIlXPRFIWzOIvVaHlEd0EtBPC9C/aHtIDKh0kXoWVT7hydq/TE/1oGI+Oo9lNw1SpaiMqQ==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0048.681] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAEo879cylisYo4zztoDnBvE00CyE4DobTgYQUZihb29x7tx8jS25PVFNC/+A4XUO+/YqKQiE69mekxZily3MKgtTkKYDa+RZqoLPGKvBw1OgUKliTabDedk/YtP+dmhkvpjJOOlcDQ/xCwftj0QGkqgTEpabAIlXPRFIWzOIvVaHlEd0EtBPC9C/aHtIDKh0kXoWVT7hydq/TE/1oGI+Oo9lNw1SpaiMqQ==", cchWideChar=245, lpMultiByteStr=0x353900c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAEo879cylisYo4zztoDnBvE00CyE4DobTgYQUZihb29x7tx8jS25PVFNC/+A4XUO+/YqKQiE69mekxZily3MKgtTkKYDa+RZqoLPGKvBw1OgUKliTabDedk/YtP+dmhkvpjJOOlcDQ/xCwftj0QGkqgTEpabAIlXPRFIWzOIvVaHlEd0EtBPC9C/aHtIDKh0kXoWVT7hydq/TE/1oGI+Oo9lNw1SpaiMqQ==", lpUsedDefaultChar=0x0) returned 245 [0048.681] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0048.681] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0048.681] CloseHandle (hObject=0x158) returned 1 [0048.682] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg")) returned 1 [0048.683] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=16894622420) returned 1 [0048.683] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\Файл зашифрован [MS.PNG].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\Файл зашифрован [ms.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0048.683] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0048.683] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0048.683] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0048.683] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0048.683] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0048.683] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0048.683] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0048.684] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0048.684] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0048.684] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0048.684] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0048.684] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0048.684] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0048.684] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0048.684] SetEndOfFile (hFile=0x158) returned 1 [0048.684] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0048.684] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0048.684] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0048.684] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0048.684] WriteFile (in: hFile=0x158, lpBuffer=0x361f5a8*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x361f5a8*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0048.685] WriteFile (in: hFile=0x158, lpBuffer=0x35f011c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f011c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0048.685] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="mEH2}7pg5dD0xi{?g^CRu27(q\"^S\"@x5", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0048.685] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="mEH2}7pg5dD0xi{?g^CRu27(q\"^S\"@x5", cchWideChar=32, lpMultiByteStr=0x2032a94, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mEH2}7pg5dD0xi{?g^CRu27(q\"^S\"@x5", lpUsedDefaultChar=0x0) returned 32 [0048.685] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0048.685] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0048.685] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x692, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.PNG", cAlternateFileName="")) returned 0x295098 [0048.685] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0048.685] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0048.685] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png")) returned 0x20 [0048.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png")) returned 0x20 [0048.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png")) returned 0x20 [0048.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png")) returned 0x20 [0048.686] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x692)) returned 1 [0048.686] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0048.686] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0048.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png")) returned 0x20 [0048.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png")) returned 0x20 [0048.686] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0048.686] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0048.686] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0048.686] SetEndOfFile (hFile=0x158) returned 1 [0048.687] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MS.PNG", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0048.687] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MS.PNG", cchWideChar=6, lpMultiByteStr=0x1fea15c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MS.PNG", lpUsedDefaultChar=0x0) returned 6 [0048.687] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MS.PNG", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0048.687] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MS.PNG", cchWideChar=6, lpMultiByteStr=0x1fea174, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MS.PNG", lpUsedDefaultChar=0x0) returned 6 [0048.687] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fea174, cbMultiByte=6, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="MS.PNGWW.xmlmlmll@\x01") returned 6 [0048.687] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MS.PNG", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0048.687] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MS.PNG", cchWideChar=6, lpMultiByteStr=0x1fea15c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MS.PNG", lpUsedDefaultChar=0x0) returned 6 [0048.687] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0048.687] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0048.687] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x692 [0048.687] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0048.687] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0048.688] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0048.688] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MS.PNG", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0048.688] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MS.PNG", cchWideChar=6, lpMultiByteStr=0x1fea15c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MS.PNG", lpUsedDefaultChar=0x0) returned 6 [0048.688] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MS.PNG", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0048.688] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MS.PNG", cchWideChar=6, lpMultiByteStr=0x1fea2f4, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MS.PNG", lpUsedDefaultChar=0x0) returned 6 [0048.688] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fea2f4, cbMultiByte=6, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="MS.PNGMS.PNGWW.xmlmlmll@\x01") returned 6 [0048.688] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MS.PNG", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0048.688] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MS.PNG", cchWideChar=6, lpMultiByteStr=0x1fea15c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MS.PNG", lpUsedDefaultChar=0x0) returned 6 [0048.688] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0048.689] CharToOemA (in: pSrc="MS.PNG", pDst=0x1fea2f4 | out: pDst="MS.PNG") returned 1 [0048.689] WriteFile (in: hFile=0x158, lpBuffer=0x1fea2f4*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fea2f4*, lpNumberOfBytesWritten=0x18e048*=0x6, lpOverlapped=0x0) returned 1 [0048.689] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0048.689] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0048.689] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0048.689] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=16895251965) returned 1 [0048.689] ReadFile (in: hFile=0x15c, lpBuffer=0x3500240, nNumberOfBytesToRead=0x692, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3500240*, lpNumberOfBytesRead=0x18dd7c*=0x692, lpOverlapped=0x0) returned 1 [0048.691] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0048.691] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=16895408561) returned 1 [0048.699] WriteFile (in: hFile=0x158, lpBuffer=0x1fea1f8*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fea1f8*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0048.699] ReadFile (in: hFile=0x15c, lpBuffer=0x3500240, nNumberOfBytesToRead=0x692, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3500240*, lpNumberOfBytesRead=0x18de38*=0x692, lpOverlapped=0x0) returned 1 [0048.699] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x41 [0048.699] WriteFile (in: hFile=0x158, lpBuffer=0x3500950*, nNumberOfBytesToWrite=0x692, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3500950*, lpNumberOfBytesWritten=0x18de10*=0x692, lpOverlapped=0x0) returned 1 [0048.699] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x6d3 [0048.699] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0048.699] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0048.699] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0048.700] SetFilePointer (in: hFile=0x158, lDistanceToMove=6, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x24 [0048.700] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x6dd [0048.700] CloseHandle (hObject=0x15c) returned 1 [0048.700] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x6dd [0048.700] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x6dd [0048.700] SetFilePointer (in: hFile=0x158, lDistanceToMove=1757, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x6dd [0048.700] SetFilePointer (in: hFile=0x158, lDistanceToMove=1757, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x6dd [0048.700] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x6dd [0048.700] SetFilePointer (in: hFile=0x158, lDistanceToMove=1757, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x6dd [0048.700] SetEndOfFile (hFile=0x158) returned 1 [0048.700] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x6dd [0048.700] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x6dd [0048.700] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MS.PNG", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0048.700] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MS.PNG", cchWideChar=6, lpMultiByteStr=0x1fea2f4, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MS.PNG", lpUsedDefaultChar=0x0) returned 6 [0048.700] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MS.PNG", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0048.700] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MS.PNG", cchWideChar=6, lpMultiByteStr=0x1fea15c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MS.PNG", lpUsedDefaultChar=0x0) returned 6 [0048.701] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fea15c, cbMultiByte=6, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="MS.PNG") returned 6 [0048.701] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MS.PNG", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0048.701] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MS.PNG", cchWideChar=6, lpMultiByteStr=0x1fea2f4, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MS.PNG", lpUsedDefaultChar=0x0) returned 6 [0048.701] WriteFile (in: hFile=0x158, lpBuffer=0x34e3cf8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x34e3cf8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0048.701] CharToOemA (in: pSrc="MS.PNG", pDst=0x1fea15c | out: pDst="MS.PNG") returned 1 [0048.701] WriteFile (in: hFile=0x158, lpBuffer=0x1fea15c*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fea15c*, lpNumberOfBytesWritten=0x18efcc*=0x6, lpOverlapped=0x0) returned 1 [0048.701] WriteFile (in: hFile=0x158, lpBuffer=0x1fea428*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea428*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0048.701] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0048.701] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0048.701] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x71c [0048.701] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x71c [0048.701] WriteFile (in: hFile=0x158, lpBuffer=0x361f5a8*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x361f5a8*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0048.701] WriteFile (in: hFile=0x158, lpBuffer=0x35f011c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f011c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0048.702] DeleteFileW (lpFileName="") returned 0 [0048.702] GetLastError () returned 0x3 [0048.702] GetFileAttributesW (lpFileName="") returned 0xffffffff [0048.702] SetLastError (dwErrCode=0x3) [0048.702] FlushFileBuffers (hFile=0x158) returned 1 [0048.704] GetCurrentThreadId () returned 0x970 [0048.704] GetCurrentThreadId () returned 0x970 [0048.704] GetCurrentThreadId () returned 0x970 [0048.704] GetCurrentThreadId () returned 0x970 [0048.704] GetCurrentThreadId () returned 0x970 [0048.704] GetCurrentThreadId () returned 0x970 [0048.704] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x7d3 [0048.704] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x7d3 [0048.704] SetFilePointer (in: hFile=0x158, lDistanceToMove=2003, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x7d3 [0048.704] CloseHandle (hObject=0x158) returned 1 [0048.707] GetCurrentThreadId () returned 0x970 [0048.707] GetCurrentThreadId () returned 0x970 [0048.707] GetCurrentThreadId () returned 0x970 [0048.707] GetCurrentThreadId () returned 0x970 [0048.707] GetCurrentThreadId () returned 0x970 [0048.707] GetCurrentThreadId () returned 0x970 [0048.708] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\Файл зашифрован [MS.PNG].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\Файл зашифрован [ms.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0048.708] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7d3 [0048.708] SetFilePointer (in: hFile=0x158, lDistanceToMove=1875, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x753 [0048.708] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0048.708] GetFileType (hFile=0x158) returned 0x1 [0048.708] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x38, wMilliseconds=0xc)) [0048.708] GetCurrentThreadId () returned 0x970 [0048.708] GetCurrentThreadId () returned 0x970 [0048.708] GetCurrentThreadId () returned 0x970 [0048.708] GetCurrentThreadId () returned 0x970 [0048.708] GetCurrentThreadId () returned 0x970 [0048.708] GetCurrentThreadId () returned 0x970 [0048.708] GetCurrentThreadId () returned 0x970 [0048.708] GetCurrentThreadId () returned 0x970 [0048.708] GetCurrentThreadId () returned 0x970 [0048.708] GetCurrentThreadId () returned 0x970 [0048.708] GetCurrentThreadId () returned 0x970 [0048.708] GetCurrentThreadId () returned 0x970 [0048.708] GetCurrentThreadId () returned 0x970 [0048.708] GetCurrentThreadId () returned 0x970 [0048.708] GetCurrentThreadId () returned 0x970 [0048.708] GetCurrentThreadId () returned 0x970 [0048.708] GetCurrentThreadId () returned 0x970 [0048.708] GetCurrentThreadId () returned 0x970 [0048.708] GetCurrentThreadId () returned 0x970 [0048.708] GetCurrentThreadId () returned 0x970 [0048.708] GetCurrentThreadId () returned 0x970 [0048.708] GetCurrentThreadId () returned 0x970 [0048.708] GetCurrentThreadId () returned 0x970 [0048.708] GetCurrentThreadId () returned 0x970 [0048.708] GetCurrentThreadId () returned 0x970 [0048.708] GetCurrentThreadId () returned 0x970 [0048.708] GetCurrentThreadId () returned 0x970 [0048.708] GetCurrentThreadId () returned 0x970 [0048.708] GetCurrentThreadId () returned 0x970 [0048.708] GetCurrentThreadId () returned 0x970 [0048.708] GetCurrentThreadId () returned 0x970 [0048.708] GetCurrentThreadId () returned 0x970 [0048.708] GetCurrentThreadId () returned 0x970 [0048.709] GetCurrentThreadId () returned 0x970 [0048.709] GetCurrentThreadId () returned 0x970 [0048.709] GetCurrentThreadId () returned 0x970 [0048.709] GetCurrentThreadId () returned 0x970 [0048.709] GetCurrentThreadId () returned 0x970 [0048.709] GetCurrentThreadId () returned 0x970 [0048.709] GetCurrentThreadId () returned 0x970 [0048.709] GetCurrentThreadId () returned 0x970 [0048.709] GetCurrentThreadId () returned 0x970 [0048.709] GetCurrentThreadId () returned 0x970 [0048.709] GetCurrentThreadId () returned 0x970 [0048.709] GetCurrentThreadId () returned 0x970 [0048.709] GetCurrentThreadId () returned 0x970 [0048.709] GetCurrentThreadId () returned 0x970 [0048.709] GetCurrentThreadId () returned 0x970 [0048.709] GetCurrentThreadId () returned 0x970 [0048.709] GetCurrentThreadId () returned 0x970 [0048.709] GetCurrentThreadId () returned 0x970 [0048.709] GetCurrentThreadId () returned 0x970 [0048.709] GetCurrentThreadId () returned 0x970 [0048.709] GetCurrentThreadId () returned 0x970 [0048.709] GetCurrentThreadId () returned 0x970 [0048.709] GetCurrentThreadId () returned 0x970 [0048.709] GetCurrentThreadId () returned 0x970 [0048.709] GetCurrentThreadId () returned 0x970 [0048.709] GetCurrentThreadId () returned 0x970 [0048.709] GetCurrentThreadId () returned 0x970 [0048.709] GetCurrentThreadId () returned 0x970 [0048.709] GetCurrentThreadId () returned 0x970 [0048.709] GetCurrentThreadId () returned 0x970 [0048.709] GetCurrentThreadId () returned 0x970 [0048.709] GetCurrentThreadId () returned 0x970 [0048.709] GetCurrentThreadId () returned 0x970 [0048.709] GetCurrentThreadId () returned 0x970 [0048.709] GetCurrentThreadId () returned 0x970 [0048.709] GetCurrentThreadId () returned 0x970 [0048.709] GetCurrentThreadId () returned 0x970 [0048.709] GetCurrentThreadId () returned 0x970 [0048.709] GetCurrentThreadId () returned 0x970 [0048.709] GetCurrentThreadId () returned 0x970 [0048.709] GetCurrentThreadId () returned 0x970 [0048.709] GetCurrentThreadId () returned 0x970 [0048.709] GetCurrentThreadId () returned 0x970 [0048.709] GetCurrentThreadId () returned 0x970 [0048.709] GetCurrentThreadId () returned 0x970 [0048.709] GetCurrentThreadId () returned 0x970 [0048.709] GetCurrentThreadId () returned 0x970 [0048.709] GetCurrentThreadId () returned 0x970 [0048.710] GetCurrentThreadId () returned 0x970 [0048.710] GetCurrentThreadId () returned 0x970 [0048.710] GetCurrentThreadId () returned 0x970 [0048.710] GetCurrentThreadId () returned 0x970 [0048.710] GetCurrentThreadId () returned 0x970 [0048.710] GetCurrentThreadId () returned 0x970 [0048.710] GetCurrentThreadId () returned 0x970 [0048.710] GetCurrentThreadId () returned 0x970 [0048.710] GetCurrentThreadId () returned 0x970 [0048.710] GetCurrentThreadId () returned 0x970 [0048.710] GetCurrentThreadId () returned 0x970 [0048.710] GetCurrentThreadId () returned 0x970 [0048.710] GetCurrentThreadId () returned 0x970 [0048.710] GetCurrentThreadId () returned 0x970 [0048.710] GetCurrentThreadId () returned 0x970 [0048.710] GetCurrentThreadId () returned 0x970 [0048.710] GetCurrentThreadId () returned 0x970 [0048.710] GetCurrentThreadId () returned 0x970 [0048.710] GetCurrentThreadId () returned 0x970 [0048.710] GetCurrentThreadId () returned 0x970 [0048.710] GetCurrentThreadId () returned 0x970 [0048.710] GetCurrentThreadId () returned 0x970 [0048.710] GetCurrentThreadId () returned 0x970 [0048.710] GetCurrentThreadId () returned 0x970 [0048.710] GetCurrentThreadId () returned 0x970 [0048.710] GetCurrentThreadId () returned 0x970 [0048.710] GetCurrentThreadId () returned 0x970 [0048.710] GetCurrentThreadId () returned 0x970 [0048.710] GetCurrentThreadId () returned 0x970 [0048.710] GetCurrentThreadId () returned 0x970 [0048.710] GetCurrentThreadId () returned 0x970 [0048.710] GetCurrentThreadId () returned 0x970 [0048.710] GetCurrentThreadId () returned 0x970 [0048.710] GetCurrentThreadId () returned 0x970 [0048.710] GetCurrentThreadId () returned 0x970 [0048.710] GetCurrentThreadId () returned 0x970 [0048.710] GetCurrentThreadId () returned 0x970 [0048.710] GetCurrentThreadId () returned 0x970 [0048.710] GetCurrentThreadId () returned 0x970 [0048.710] GetCurrentThreadId () returned 0x970 [0048.710] GetCurrentThreadId () returned 0x970 [0048.710] GetCurrentThreadId () returned 0x970 [0048.710] GetCurrentThreadId () returned 0x970 [0048.710] GetCurrentThreadId () returned 0x970 [0048.710] GetCurrentThreadId () returned 0x970 [0048.710] GetCurrentThreadId () returned 0x970 [0048.710] GetCurrentThreadId () returned 0x970 [0048.711] GetCurrentThreadId () returned 0x970 [0048.711] GetCurrentThreadId () returned 0x970 [0048.711] GetCurrentThreadId () returned 0x970 [0048.711] GetCurrentThreadId () returned 0x970 [0048.711] GetCurrentThreadId () returned 0x970 [0048.711] GetCurrentThreadId () returned 0x970 [0048.711] GetCurrentThreadId () returned 0x970 [0048.711] GetCurrentThreadId () returned 0x970 [0048.711] GetCurrentThreadId () returned 0x970 [0048.711] GetCurrentThreadId () returned 0x970 [0048.711] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.711] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.711] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb5b0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.711] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.711] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.711] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb5b0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.711] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.711] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.711] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.711] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.711] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.711] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.711] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.711] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.711] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb610, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.711] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.711] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.711] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb610, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.711] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.711] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.711] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb610, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.711] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x38, wMilliseconds=0xc)) [0048.711] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="mEH2}7pg5dD0xi{?g^CRu27(q\"^S\"@x5", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0048.711] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="mEH2}7pg5dD0xi{?g^CRu27(q\"^S\"@x5", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0048.711] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="mEH2}7pg5dD0xi{?g^CRu27(q\"^S\"@x5", cchWideChar=32, lpMultiByteStr=0x20008c8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mEH2}7pg5dD0xi{?g^CRu27(q\"^S\"@x5", lpUsedDefaultChar=0x0) returned 32 [0048.712] GetCurrentThreadId () returned 0x970 [0048.712] GetCurrentThreadId () returned 0x970 [0048.712] GetCurrentThreadId () returned 0x970 [0048.712] GetCurrentThreadId () returned 0x970 [0048.712] GetCurrentThreadId () returned 0x970 [0048.712] GetCurrentThreadId () returned 0x970 [0048.719] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0048.719] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0048.719] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x202dd38, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0048.719] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x35904f8, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0048.719] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x35904f8, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAABFDARLIkslpPIWb3AFtGWgN6BDkrcx1LbCj+4OTKFt+P4BVh50tYiGYNsHppgVhrvhg3LjwWrWJFjqSiTDtpgF35szwHrlhSVwWfFO+UDGXI4kTS6yztEIL1WsTK24XZJM/x5jJNBMmQ29iKw47XkHU2nFTUrxQ7fuaOI6OOfIBo0l5xSAVZMXIkm2ZPZl8JpKhNM8nLQE4Bb+8s1V6WkjAYnqf/FswCQ==") returned 232 [0048.719] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x38, wMilliseconds=0x1b)) [0048.719] GetCurrentThreadId () returned 0x970 [0048.719] GetCurrentThreadId () returned 0x970 [0048.719] GetCurrentThreadId () returned 0x970 [0048.719] GetCurrentThreadId () returned 0x970 [0048.719] GetCurrentThreadId () returned 0x970 [0048.719] GetCurrentThreadId () returned 0x970 [0048.719] GetCurrentThreadId () returned 0x970 [0048.719] GetCurrentThreadId () returned 0x970 [0048.719] GetCurrentThreadId () returned 0x970 [0048.719] GetCurrentThreadId () returned 0x970 [0048.719] GetCurrentThreadId () returned 0x970 [0048.719] GetCurrentThreadId () returned 0x970 [0048.719] GetCurrentThreadId () returned 0x970 [0048.719] GetCurrentThreadId () returned 0x970 [0048.719] GetCurrentThreadId () returned 0x970 [0048.719] GetCurrentThreadId () returned 0x970 [0048.719] GetCurrentThreadId () returned 0x970 [0048.719] GetCurrentThreadId () returned 0x970 [0048.719] GetCurrentThreadId () returned 0x970 [0048.719] GetCurrentThreadId () returned 0x970 [0048.719] GetCurrentThreadId () returned 0x970 [0048.719] GetCurrentThreadId () returned 0x970 [0048.719] GetCurrentThreadId () returned 0x970 [0048.719] GetCurrentThreadId () returned 0x970 [0048.719] GetCurrentThreadId () returned 0x970 [0048.719] GetCurrentThreadId () returned 0x970 [0048.719] GetCurrentThreadId () returned 0x970 [0048.720] GetCurrentThreadId () returned 0x970 [0048.720] GetCurrentThreadId () returned 0x970 [0048.720] GetCurrentThreadId () returned 0x970 [0048.720] GetCurrentThreadId () returned 0x970 [0048.720] GetCurrentThreadId () returned 0x970 [0048.720] GetCurrentThreadId () returned 0x970 [0048.720] GetCurrentThreadId () returned 0x970 [0048.720] GetCurrentThreadId () returned 0x970 [0048.720] GetCurrentThreadId () returned 0x970 [0048.720] GetCurrentThreadId () returned 0x970 [0048.720] GetCurrentThreadId () returned 0x970 [0048.720] GetCurrentThreadId () returned 0x970 [0048.720] GetCurrentThreadId () returned 0x970 [0048.720] GetCurrentThreadId () returned 0x970 [0048.720] GetCurrentThreadId () returned 0x970 [0048.720] GetCurrentThreadId () returned 0x970 [0048.720] GetCurrentThreadId () returned 0x970 [0048.720] GetCurrentThreadId () returned 0x970 [0048.720] GetCurrentThreadId () returned 0x970 [0048.720] GetCurrentThreadId () returned 0x970 [0048.720] GetCurrentThreadId () returned 0x970 [0048.720] GetCurrentThreadId () returned 0x970 [0048.720] GetCurrentThreadId () returned 0x970 [0048.720] GetCurrentThreadId () returned 0x970 [0048.720] GetCurrentThreadId () returned 0x970 [0048.720] GetCurrentThreadId () returned 0x970 [0048.720] GetCurrentThreadId () returned 0x970 [0048.720] GetCurrentThreadId () returned 0x970 [0048.720] GetCurrentThreadId () returned 0x970 [0048.720] GetCurrentThreadId () returned 0x970 [0048.720] GetCurrentThreadId () returned 0x970 [0048.720] GetCurrentThreadId () returned 0x970 [0048.720] GetCurrentThreadId () returned 0x970 [0048.720] GetCurrentThreadId () returned 0x970 [0048.720] GetCurrentThreadId () returned 0x970 [0048.720] GetCurrentThreadId () returned 0x970 [0048.720] GetCurrentThreadId () returned 0x970 [0048.720] GetCurrentThreadId () returned 0x970 [0048.720] GetCurrentThreadId () returned 0x970 [0048.720] GetCurrentThreadId () returned 0x970 [0048.720] GetCurrentThreadId () returned 0x970 [0048.720] GetCurrentThreadId () returned 0x970 [0048.720] GetCurrentThreadId () returned 0x970 [0048.720] GetCurrentThreadId () returned 0x970 [0048.720] GetCurrentThreadId () returned 0x970 [0048.720] GetCurrentThreadId () returned 0x970 [0048.720] GetCurrentThreadId () returned 0x970 [0048.720] GetCurrentThreadId () returned 0x970 [0048.720] GetCurrentThreadId () returned 0x970 [0048.721] GetCurrentThreadId () returned 0x970 [0048.721] GetCurrentThreadId () returned 0x970 [0048.721] GetCurrentThreadId () returned 0x970 [0048.721] GetCurrentThreadId () returned 0x970 [0048.721] GetCurrentThreadId () returned 0x970 [0048.721] GetCurrentThreadId () returned 0x970 [0048.721] GetCurrentThreadId () returned 0x970 [0048.721] GetCurrentThreadId () returned 0x970 [0048.721] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAABFDARLIkslpPIWb3AFtGWgN6BDkrcx1LbCj+4OTKFt+P4BVh50tYiGYNsHppgVhrvhg3LjwWrWJFjqSiTDtpgF35szwHrlhSVwWfFO+UDGXI4kTS6yztEIL1WsTK24XZJM/x5jJNBMmQ29iKw47XkHU2nFTUrxQ7fuaOI6OOfIBo0l5xSAVZMXIkm2ZPZl8JpKhNM8nLQE4Bb+8s1V6WkjAYnqf/FswCQ==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0048.721] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAABFDARLIkslpPIWb3AFtGWgN6BDkrcx1LbCj+4OTKFt+P4BVh50tYiGYNsHppgVhrvhg3LjwWrWJFjqSiTDtpgF35szwHrlhSVwWfFO+UDGXI4kTS6yztEIL1WsTK24XZJM/x5jJNBMmQ29iKw47XkHU2nFTUrxQ7fuaOI6OOfIBo0l5xSAVZMXIkm2ZPZl8JpKhNM8nLQE4Bb+8s1V6WkjAYnqf/FswCQ==", cchWideChar=245, lpMultiByteStr=0x353900c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAABFDARLIkslpPIWb3AFtGWgN6BDkrcx1LbCj+4OTKFt+P4BVh50tYiGYNsHppgVhrvhg3LjwWrWJFjqSiTDtpgF35szwHrlhSVwWfFO+UDGXI4kTS6yztEIL1WsTK24XZJM/x5jJNBMmQ29iKw47XkHU2nFTUrxQ7fuaOI6OOfIBo0l5xSAVZMXIkm2ZPZl8JpKhNM8nLQE4Bb+8s1V6WkjAYnqf/FswCQ==", lpUsedDefaultChar=0x0) returned 245 [0048.721] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0048.721] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0048.721] CloseHandle (hObject=0x158) returned 1 [0048.722] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png")) returned 1 [0048.722] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=16898582387) returned 1 [0048.722] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Файл зашифрован [Alphabet.xml].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\Файл зашифрован [alphabet.xml].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0048.724] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0048.724] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0048.724] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0048.724] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0048.724] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0048.724] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0048.724] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0048.724] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0048.724] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0048.724] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0048.724] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0048.724] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0048.724] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0048.724] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0048.724] SetEndOfFile (hFile=0x158) returned 1 [0048.725] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0048.725] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0048.725] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0048.725] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0048.725] WriteFile (in: hFile=0x158, lpBuffer=0x361f5a8*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x361f5a8*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0048.726] WriteFile (in: hFile=0x158, lpBuffer=0x35f005c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f005c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0048.726] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e*w<+4et%Wh5P#+@t{ZuOB.{u1M.a>qG", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0048.726] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e*w<+4et%Wh5P#+@t{ZuOB.{u1M.a>qG", cchWideChar=32, lpMultiByteStr=0x2032acc, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="e*w<+4et%Wh5P#+@t{ZuOB.{u1M.a>qG", lpUsedDefaultChar=0x0) returned 32 [0048.726] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0048.726] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0048.726] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2bbccc, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c2bbccc, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x90daefa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc1486, dwReserved0=0x0, dwReserved1=0x0, cFileName="Alphabet.xml", cAlternateFileName="")) returned 0x295098 [0048.726] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0048.726] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0048.726] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0048.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0048.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0048.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0048.728] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2bbccc, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c2bbccc, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x90daefa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc1486)) returned 1 [0048.728] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0048.728] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0048.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0048.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0048.728] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0048.728] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0048.728] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0048.728] SetEndOfFile (hFile=0x158) returned 1 [0048.729] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Alphabet.xml", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0048.729] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Alphabet.xml", cchWideChar=12, lpMultiByteStr=0x1fe378c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Alphabet.xml", lpUsedDefaultChar=0x0) returned 12 [0048.729] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Alphabet.xml", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0048.729] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Alphabet.xml", cchWideChar=12, lpMultiByteStr=0x1fe37ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Alphabet.xml", lpUsedDefaultChar=0x0) returned 12 [0048.729] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe37ac, cbMultiByte=12, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="Alphabet.xmlmlmll@\x01") returned 12 [0048.729] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Alphabet.xml", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0048.729] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Alphabet.xml", cchWideChar=12, lpMultiByteStr=0x1fe378c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Alphabet.xml", lpUsedDefaultChar=0x0) returned 12 [0048.729] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0048.729] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0048.729] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0xc1486 [0048.729] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0048.730] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0048.730] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0048.730] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Alphabet.xml", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0048.730] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Alphabet.xml", cchWideChar=12, lpMultiByteStr=0x1fe378c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Alphabet.xml", lpUsedDefaultChar=0x0) returned 12 [0048.730] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Alphabet.xml", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0048.730] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Alphabet.xml", cchWideChar=12, lpMultiByteStr=0x1fe37ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Alphabet.xml", lpUsedDefaultChar=0x0) returned 12 [0048.730] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe37ac, cbMultiByte=12, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="Alphabet.xmlet.xmlmlmll@\x01") returned 12 [0048.730] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Alphabet.xml", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0048.730] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Alphabet.xml", cchWideChar=12, lpMultiByteStr=0x1fe378c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Alphabet.xml", lpUsedDefaultChar=0x0) returned 12 [0048.730] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0048.732] CharToOemA (in: pSrc="Alphabet.xml", pDst=0x1fe37ac | out: pDst="Alphabet.xml") returned 1 [0048.732] WriteFile (in: hFile=0x158, lpBuffer=0x1fe37ac*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe37ac*, lpNumberOfBytesWritten=0x18e048*=0xc, lpOverlapped=0x0) returned 1 [0048.732] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0048.732] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0048.732] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0048.732] VirtualAlloc (lpAddress=0x0, dwSize=0xd0000, flAllocationType=0x101000, flProtect=0x4) returned 0x7eed0000 [0048.732] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=16899586207) returned 1 [0048.732] ReadFile (in: hFile=0x15c, lpBuffer=0x7eed0010, nNumberOfBytesToRead=0xc1486, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x7eed0010*, lpNumberOfBytesRead=0x18dd7c*=0xc1486, lpOverlapped=0x0) returned 1 [0048.750] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0048.750] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=16901382177) returned 1 [0048.759] WriteFile (in: hFile=0x158, lpBuffer=0x1fea2e8*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fea2e8*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0048.759] ReadFile (in: hFile=0x15c, lpBuffer=0x7eed0010, nNumberOfBytesToRead=0xc1486, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x7eed0010*, lpNumberOfBytesRead=0x18de38*=0xc1486, lpOverlapped=0x0) returned 1 [0048.759] VirtualAlloc (lpAddress=0x0, dwSize=0xd0000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ee00000 [0048.769] VirtualAlloc (lpAddress=0x0, dwSize=0xd0000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ed30000 [0048.800] VirtualFree (lpAddress=0x7ed30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0048.803] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x47 [0048.803] WriteFile (in: hFile=0x158, lpBuffer=0x7ee00010*, nNumberOfBytesToWrite=0xc1486, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x7ee00010*, lpNumberOfBytesWritten=0x18de10*=0xc1486, lpOverlapped=0x0) returned 1 [0048.814] VirtualFree (lpAddress=0x7ee00000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0048.818] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0xc14cd [0048.818] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0048.818] VirtualFree (lpAddress=0x7eed0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0048.821] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0048.821] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0048.821] SetFilePointer (in: hFile=0x158, lDistanceToMove=12, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2a [0048.821] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0xc14d7 [0048.821] CloseHandle (hObject=0x15c) returned 1 [0048.821] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xc14d7 [0048.822] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xc14d7 [0048.822] SetFilePointer (in: hFile=0x158, lDistanceToMove=791767, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xc14d7 [0048.822] SetFilePointer (in: hFile=0x158, lDistanceToMove=791767, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0xc14d7 [0048.822] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xc14d7 [0048.822] SetFilePointer (in: hFile=0x158, lDistanceToMove=791767, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0xc14d7 [0048.822] SetEndOfFile (hFile=0x158) returned 1 [0048.822] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xc14d7 [0048.822] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xc14d7 [0048.822] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Alphabet.xml", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0048.822] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Alphabet.xml", cchWideChar=12, lpMultiByteStr=0x1fe378c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Alphabet.xml", lpUsedDefaultChar=0x0) returned 12 [0048.822] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Alphabet.xml", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0048.822] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Alphabet.xml", cchWideChar=12, lpMultiByteStr=0x1fe410c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Alphabet.xml", lpUsedDefaultChar=0x0) returned 12 [0048.822] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe410c, cbMultiByte=12, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="Alphabet.xmlꞗ@涤(\x18믉`믑`") returned 12 [0048.822] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Alphabet.xml", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0048.822] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Alphabet.xml", cchWideChar=12, lpMultiByteStr=0x1fe378c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Alphabet.xml", lpUsedDefaultChar=0x0) returned 12 [0048.822] WriteFile (in: hFile=0x158, lpBuffer=0x34e3cf8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x34e3cf8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0048.822] CharToOemA (in: pSrc="Alphabet.xml", pDst=0x1fe410c | out: pDst="Alphabet.xml") returned 1 [0048.822] WriteFile (in: hFile=0x158, lpBuffer=0x1fe410c*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe410c*, lpNumberOfBytesWritten=0x18efcc*=0xc, lpOverlapped=0x0) returned 1 [0048.823] WriteFile (in: hFile=0x158, lpBuffer=0x1fea128*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea128*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0048.823] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0048.823] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0048.823] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xc151c [0048.823] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xc151c [0048.823] WriteFile (in: hFile=0x158, lpBuffer=0x361f5a8*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x361f5a8*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0048.823] WriteFile (in: hFile=0x158, lpBuffer=0x35f005c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f005c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0048.823] DeleteFileW (lpFileName="") returned 0 [0048.823] GetLastError () returned 0x3 [0048.823] GetFileAttributesW (lpFileName="") returned 0xffffffff [0048.823] SetLastError (dwErrCode=0x3) [0048.823] FlushFileBuffers (hFile=0x158) returned 1 [0048.860] GetCurrentThreadId () returned 0x970 [0048.860] GetCurrentThreadId () returned 0x970 [0048.860] GetCurrentThreadId () returned 0x970 [0048.860] GetCurrentThreadId () returned 0x970 [0048.860] GetCurrentThreadId () returned 0x970 [0048.860] GetCurrentThreadId () returned 0x970 [0048.860] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xc15d3 [0048.860] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xc15d3 [0048.860] SetFilePointer (in: hFile=0x158, lDistanceToMove=792019, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xc15d3 [0048.860] CloseHandle (hObject=0x158) returned 1 [0048.867] GetCurrentThreadId () returned 0x970 [0048.867] GetCurrentThreadId () returned 0x970 [0048.867] GetCurrentThreadId () returned 0x970 [0048.867] GetCurrentThreadId () returned 0x970 [0048.867] GetCurrentThreadId () returned 0x970 [0048.867] GetCurrentThreadId () returned 0x970 [0048.867] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Файл зашифрован [Alphabet.xml].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\Файл зашифрован [alphabet.xml].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0048.867] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc15d3 [0048.867] SetFilePointer (in: hFile=0x158, lDistanceToMove=791891, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc1553 [0048.867] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0048.867] GetFileType (hFile=0x158) returned 0x1 [0048.867] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x38, wMilliseconds=0xa8)) [0048.867] GetCurrentThreadId () returned 0x970 [0048.867] GetCurrentThreadId () returned 0x970 [0048.867] GetCurrentThreadId () returned 0x970 [0048.867] GetCurrentThreadId () returned 0x970 [0048.867] GetCurrentThreadId () returned 0x970 [0048.867] GetCurrentThreadId () returned 0x970 [0048.867] GetCurrentThreadId () returned 0x970 [0048.867] GetCurrentThreadId () returned 0x970 [0048.867] GetCurrentThreadId () returned 0x970 [0048.867] GetCurrentThreadId () returned 0x970 [0048.867] GetCurrentThreadId () returned 0x970 [0048.868] GetCurrentThreadId () returned 0x970 [0048.868] GetCurrentThreadId () returned 0x970 [0048.868] GetCurrentThreadId () returned 0x970 [0048.868] GetCurrentThreadId () returned 0x970 [0048.868] GetCurrentThreadId () returned 0x970 [0048.868] GetCurrentThreadId () returned 0x970 [0048.868] GetCurrentThreadId () returned 0x970 [0048.868] GetCurrentThreadId () returned 0x970 [0048.868] GetCurrentThreadId () returned 0x970 [0048.868] GetCurrentThreadId () returned 0x970 [0048.868] GetCurrentThreadId () returned 0x970 [0048.868] GetCurrentThreadId () returned 0x970 [0048.868] GetCurrentThreadId () returned 0x970 [0048.868] GetCurrentThreadId () returned 0x970 [0048.868] GetCurrentThreadId () returned 0x970 [0048.868] GetCurrentThreadId () returned 0x970 [0048.868] GetCurrentThreadId () returned 0x970 [0048.868] GetCurrentThreadId () returned 0x970 [0048.868] GetCurrentThreadId () returned 0x970 [0048.868] GetCurrentThreadId () returned 0x970 [0048.868] GetCurrentThreadId () returned 0x970 [0048.868] GetCurrentThreadId () returned 0x970 [0048.868] GetCurrentThreadId () returned 0x970 [0048.868] GetCurrentThreadId () returned 0x970 [0048.868] GetCurrentThreadId () returned 0x970 [0048.868] GetCurrentThreadId () returned 0x970 [0048.868] GetCurrentThreadId () returned 0x970 [0048.868] GetCurrentThreadId () returned 0x970 [0048.868] GetCurrentThreadId () returned 0x970 [0048.868] GetCurrentThreadId () returned 0x970 [0048.868] GetCurrentThreadId () returned 0x970 [0048.868] GetCurrentThreadId () returned 0x970 [0048.868] GetCurrentThreadId () returned 0x970 [0048.868] GetCurrentThreadId () returned 0x970 [0048.868] GetCurrentThreadId () returned 0x970 [0048.868] GetCurrentThreadId () returned 0x970 [0048.868] GetCurrentThreadId () returned 0x970 [0048.868] GetCurrentThreadId () returned 0x970 [0048.868] GetCurrentThreadId () returned 0x970 [0048.868] GetCurrentThreadId () returned 0x970 [0048.868] GetCurrentThreadId () returned 0x970 [0048.868] GetCurrentThreadId () returned 0x970 [0048.868] GetCurrentThreadId () returned 0x970 [0048.868] GetCurrentThreadId () returned 0x970 [0048.868] GetCurrentThreadId () returned 0x970 [0048.868] GetCurrentThreadId () returned 0x970 [0048.868] GetCurrentThreadId () returned 0x970 [0048.868] GetCurrentThreadId () returned 0x970 [0048.868] GetCurrentThreadId () returned 0x970 [0048.868] GetCurrentThreadId () returned 0x970 [0048.869] GetCurrentThreadId () returned 0x970 [0048.869] GetCurrentThreadId () returned 0x970 [0048.869] GetCurrentThreadId () returned 0x970 [0048.869] GetCurrentThreadId () returned 0x970 [0048.869] GetCurrentThreadId () returned 0x970 [0048.869] GetCurrentThreadId () returned 0x970 [0048.869] GetCurrentThreadId () returned 0x970 [0048.869] GetCurrentThreadId () returned 0x970 [0048.869] GetCurrentThreadId () returned 0x970 [0048.869] GetCurrentThreadId () returned 0x970 [0048.869] GetCurrentThreadId () returned 0x970 [0048.869] GetCurrentThreadId () returned 0x970 [0048.869] GetCurrentThreadId () returned 0x970 [0048.869] GetCurrentThreadId () returned 0x970 [0048.869] GetCurrentThreadId () returned 0x970 [0048.869] GetCurrentThreadId () returned 0x970 [0048.869] GetCurrentThreadId () returned 0x970 [0048.869] GetCurrentThreadId () returned 0x970 [0048.869] GetCurrentThreadId () returned 0x970 [0048.869] GetCurrentThreadId () returned 0x970 [0048.869] GetCurrentThreadId () returned 0x970 [0048.869] GetCurrentThreadId () returned 0x970 [0048.869] GetCurrentThreadId () returned 0x970 [0048.869] GetCurrentThreadId () returned 0x970 [0048.869] GetCurrentThreadId () returned 0x970 [0048.869] GetCurrentThreadId () returned 0x970 [0048.869] GetCurrentThreadId () returned 0x970 [0048.869] GetCurrentThreadId () returned 0x970 [0048.869] GetCurrentThreadId () returned 0x970 [0048.869] GetCurrentThreadId () returned 0x970 [0048.869] GetCurrentThreadId () returned 0x970 [0048.869] GetCurrentThreadId () returned 0x970 [0048.869] GetCurrentThreadId () returned 0x970 [0048.869] GetCurrentThreadId () returned 0x970 [0048.869] GetCurrentThreadId () returned 0x970 [0048.869] GetCurrentThreadId () returned 0x970 [0048.869] GetCurrentThreadId () returned 0x970 [0048.869] GetCurrentThreadId () returned 0x970 [0048.869] GetCurrentThreadId () returned 0x970 [0048.869] GetCurrentThreadId () returned 0x970 [0048.869] GetCurrentThreadId () returned 0x970 [0048.869] GetCurrentThreadId () returned 0x970 [0048.869] GetCurrentThreadId () returned 0x970 [0048.869] GetCurrentThreadId () returned 0x970 [0048.869] GetCurrentThreadId () returned 0x970 [0048.869] GetCurrentThreadId () returned 0x970 [0048.870] GetCurrentThreadId () returned 0x970 [0048.870] GetCurrentThreadId () returned 0x970 [0048.870] GetCurrentThreadId () returned 0x970 [0048.870] GetCurrentThreadId () returned 0x970 [0048.870] GetCurrentThreadId () returned 0x970 [0048.870] GetCurrentThreadId () returned 0x970 [0048.870] GetCurrentThreadId () returned 0x970 [0048.870] GetCurrentThreadId () returned 0x970 [0048.870] GetCurrentThreadId () returned 0x970 [0048.870] GetCurrentThreadId () returned 0x970 [0048.870] GetCurrentThreadId () returned 0x970 [0048.870] GetCurrentThreadId () returned 0x970 [0048.870] GetCurrentThreadId () returned 0x970 [0048.870] GetCurrentThreadId () returned 0x970 [0048.870] GetCurrentThreadId () returned 0x970 [0048.870] GetCurrentThreadId () returned 0x970 [0048.870] GetCurrentThreadId () returned 0x970 [0048.870] GetCurrentThreadId () returned 0x970 [0048.870] GetCurrentThreadId () returned 0x970 [0048.870] GetCurrentThreadId () returned 0x970 [0048.870] GetCurrentThreadId () returned 0x970 [0048.870] GetCurrentThreadId () returned 0x970 [0048.870] GetCurrentThreadId () returned 0x970 [0048.870] GetCurrentThreadId () returned 0x970 [0048.870] GetCurrentThreadId () returned 0x970 [0048.870] GetCurrentThreadId () returned 0x970 [0048.870] GetCurrentThreadId () returned 0x970 [0048.870] GetCurrentThreadId () returned 0x970 [0048.870] GetCurrentThreadId () returned 0x970 [0048.870] GetCurrentThreadId () returned 0x970 [0048.870] GetCurrentThreadId () returned 0x970 [0048.870] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.870] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.870] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb610, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.870] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.870] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.870] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb610, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.870] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.870] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.870] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.870] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.870] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.871] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.871] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.871] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.871] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb670, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.871] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.871] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.871] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb670, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.871] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.871] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.871] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb670, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.871] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x38, wMilliseconds=0xa8)) [0048.871] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="e*w<+4et%Wh5P#+@t{ZuOB.{u1M.a>qG", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0048.871] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="e*w<+4et%Wh5P#+@t{ZuOB.{u1M.a>qG", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0048.871] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="e*w<+4et%Wh5P#+@t{ZuOB.{u1M.a>qG", cchWideChar=32, lpMultiByteStr=0x2000958, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="e*w<+4et%Wh5P#+@t{ZuOB.{u1M.a>qG", lpUsedDefaultChar=0x0) returned 32 [0048.871] GetCurrentThreadId () returned 0x970 [0048.871] GetCurrentThreadId () returned 0x970 [0048.871] GetCurrentThreadId () returned 0x970 [0048.871] GetCurrentThreadId () returned 0x970 [0048.871] GetCurrentThreadId () returned 0x970 [0048.871] GetCurrentThreadId () returned 0x970 [0048.878] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0048.878] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0048.878] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x202de28, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0048.878] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x35904f8, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0048.878] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x35904f8, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAABvPPhFqp2z1zBepusM+2FTZENHz1ldnyTDw1XCvcrvOS0+u6wCs8eMS0uj/QctO89B/11k0yYFnNGzQLKodVWggmPFHDrKD+dBkFP28Y+B9pQiUrzf5D9WdRzJgr+wHcc+3CmPgIIqjtk3y+0oVoDK0eyXQKM3sNRxdDfuWNezXoX24TNtJAJCGpwB43DOoinjJI7qdUJNDZx8hbzx5QNEIjtnVQlZgVQ==") returned 232 [0048.878] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x38, wMilliseconds=0xb7)) [0048.878] GetCurrentThreadId () returned 0x970 [0048.878] GetCurrentThreadId () returned 0x970 [0048.878] GetCurrentThreadId () returned 0x970 [0048.879] GetCurrentThreadId () returned 0x970 [0048.879] GetCurrentThreadId () returned 0x970 [0048.879] GetCurrentThreadId () returned 0x970 [0048.879] GetCurrentThreadId () returned 0x970 [0048.879] GetCurrentThreadId () returned 0x970 [0048.879] GetCurrentThreadId () returned 0x970 [0048.879] GetCurrentThreadId () returned 0x970 [0048.879] GetCurrentThreadId () returned 0x970 [0048.879] GetCurrentThreadId () returned 0x970 [0048.879] GetCurrentThreadId () returned 0x970 [0048.879] GetCurrentThreadId () returned 0x970 [0048.879] GetCurrentThreadId () returned 0x970 [0048.879] GetCurrentThreadId () returned 0x970 [0048.879] GetCurrentThreadId () returned 0x970 [0048.879] GetCurrentThreadId () returned 0x970 [0048.879] GetCurrentThreadId () returned 0x970 [0048.879] GetCurrentThreadId () returned 0x970 [0048.879] GetCurrentThreadId () returned 0x970 [0048.879] GetCurrentThreadId () returned 0x970 [0048.879] GetCurrentThreadId () returned 0x970 [0048.879] GetCurrentThreadId () returned 0x970 [0048.879] GetCurrentThreadId () returned 0x970 [0048.879] GetCurrentThreadId () returned 0x970 [0048.879] GetCurrentThreadId () returned 0x970 [0048.879] GetCurrentThreadId () returned 0x970 [0048.879] GetCurrentThreadId () returned 0x970 [0048.879] GetCurrentThreadId () returned 0x970 [0048.879] GetCurrentThreadId () returned 0x970 [0048.879] GetCurrentThreadId () returned 0x970 [0048.879] GetCurrentThreadId () returned 0x970 [0048.879] GetCurrentThreadId () returned 0x970 [0048.879] GetCurrentThreadId () returned 0x970 [0048.879] GetCurrentThreadId () returned 0x970 [0048.879] GetCurrentThreadId () returned 0x970 [0048.879] GetCurrentThreadId () returned 0x970 [0048.879] GetCurrentThreadId () returned 0x970 [0048.879] GetCurrentThreadId () returned 0x970 [0048.879] GetCurrentThreadId () returned 0x970 [0048.879] GetCurrentThreadId () returned 0x970 [0048.879] GetCurrentThreadId () returned 0x970 [0048.879] GetCurrentThreadId () returned 0x970 [0048.879] GetCurrentThreadId () returned 0x970 [0048.879] GetCurrentThreadId () returned 0x970 [0048.879] GetCurrentThreadId () returned 0x970 [0048.879] GetCurrentThreadId () returned 0x970 [0048.879] GetCurrentThreadId () returned 0x970 [0048.879] GetCurrentThreadId () returned 0x970 [0048.879] GetCurrentThreadId () returned 0x970 [0048.879] GetCurrentThreadId () returned 0x970 [0048.879] GetCurrentThreadId () returned 0x970 [0048.880] GetCurrentThreadId () returned 0x970 [0048.880] GetCurrentThreadId () returned 0x970 [0048.880] GetCurrentThreadId () returned 0x970 [0048.880] GetCurrentThreadId () returned 0x970 [0048.880] GetCurrentThreadId () returned 0x970 [0048.880] GetCurrentThreadId () returned 0x970 [0048.880] GetCurrentThreadId () returned 0x970 [0048.880] GetCurrentThreadId () returned 0x970 [0048.880] GetCurrentThreadId () returned 0x970 [0048.880] GetCurrentThreadId () returned 0x970 [0048.880] GetCurrentThreadId () returned 0x970 [0048.880] GetCurrentThreadId () returned 0x970 [0048.880] GetCurrentThreadId () returned 0x970 [0048.880] GetCurrentThreadId () returned 0x970 [0048.880] GetCurrentThreadId () returned 0x970 [0048.880] GetCurrentThreadId () returned 0x970 [0048.880] GetCurrentThreadId () returned 0x970 [0048.880] GetCurrentThreadId () returned 0x970 [0048.880] GetCurrentThreadId () returned 0x970 [0048.880] GetCurrentThreadId () returned 0x970 [0048.880] GetCurrentThreadId () returned 0x970 [0048.880] GetCurrentThreadId () returned 0x970 [0048.880] GetCurrentThreadId () returned 0x970 [0048.880] GetCurrentThreadId () returned 0x970 [0048.880] GetCurrentThreadId () returned 0x970 [0048.880] GetCurrentThreadId () returned 0x970 [0048.880] GetCurrentThreadId () returned 0x970 [0048.880] GetCurrentThreadId () returned 0x970 [0048.880] GetCurrentThreadId () returned 0x970 [0048.880] GetCurrentThreadId () returned 0x970 [0048.880] GetCurrentThreadId () returned 0x970 [0048.880] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAABvPPhFqp2z1zBepusM+2FTZENHz1ldnyTDw1XCvcrvOS0+u6wCs8eMS0uj/QctO89B/11k0yYFnNGzQLKodVWggmPFHDrKD+dBkFP28Y+B9pQiUrzf5D9WdRzJgr+wHcc+3CmPgIIqjtk3y+0oVoDK0eyXQKM3sNRxdDfuWNezXoX24TNtJAJCGpwB43DOoinjJI7qdUJNDZx8hbzx5QNEIjtnVQlZgVQ==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0048.880] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAABvPPhFqp2z1zBepusM+2FTZENHz1ldnyTDw1XCvcrvOS0+u6wCs8eMS0uj/QctO89B/11k0yYFnNGzQLKodVWggmPFHDrKD+dBkFP28Y+B9pQiUrzf5D9WdRzJgr+wHcc+3CmPgIIqjtk3y+0oVoDK0eyXQKM3sNRxdDfuWNezXoX24TNtJAJCGpwB43DOoinjJI7qdUJNDZx8hbzx5QNEIjtnVQlZgVQ==", cchWideChar=245, lpMultiByteStr=0x353900c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAABvPPhFqp2z1zBepusM+2FTZENHz1ldnyTDw1XCvcrvOS0+u6wCs8eMS0uj/QctO89B/11k0yYFnNGzQLKodVWggmPFHDrKD+dBkFP28Y+B9pQiUrzf5D9WdRzJgr+wHcc+3CmPgIIqjtk3y+0oVoDK0eyXQKM3sNRxdDfuWNezXoX24TNtJAJCGpwB43DOoinjJI7qdUJNDZx8hbzx5QNEIjtnVQlZgVQ==", lpUsedDefaultChar=0x0) returned 245 [0048.880] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0048.880] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0048.880] CloseHandle (hObject=0x158) returned 1 [0048.885] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0 [0048.885] GetLastError () returned 0x5 [0048.885] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0048.885] SetLastError (dwErrCode=0x5) [0048.885] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=16914836966) returned 1 [0048.885] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Файл зашифрован [Content.xml].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\Файл зашифрован [content.xml].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0048.885] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0048.886] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0048.886] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0048.886] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0048.886] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0048.886] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0048.886] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0048.886] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0048.886] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0048.886] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0048.886] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0048.886] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0048.886] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0048.886] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0048.886] SetEndOfFile (hFile=0x158) returned 1 [0048.886] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0048.886] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0048.886] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0048.887] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0048.887] WriteFile (in: hFile=0x158, lpBuffer=0x361f5a8*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x361f5a8*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0048.887] WriteFile (in: hFile=0x158, lpBuffer=0x35f011c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f011c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0048.887] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="!?kqg$93qERJ&=!>x0enGJYLuoP$IQtI", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0048.887] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="!?kqg$93qERJ&=!>x0enGJYLuoP$IQtI", cchWideChar=32, lpMultiByteStr=0x2032b04, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="!?kqg$93qERJ&=!>x0enGJYLuoP$IQtI", lpUsedDefaultChar=0x0) returned 32 [0048.888] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0048.888] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0048.888] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90daefa5, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x90daefa5, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x90daefa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x69a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.xml", cAlternateFileName="")) returned 0x295098 [0048.888] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0048.888] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0048.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0048.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0048.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0048.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0048.888] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90daefa5, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x90daefa5, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x90daefa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x69a5)) returned 1 [0048.888] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0048.888] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0048.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0048.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0048.889] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0048.889] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0048.889] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0048.889] SetEndOfFile (hFile=0x158) returned 1 [0048.889] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Content.xml", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0048.889] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Content.xml", cchWideChar=11, lpMultiByteStr=0x1fe3aac, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Content.xml", lpUsedDefaultChar=0x0) returned 11 [0048.890] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Content.xml", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0048.890] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Content.xml", cchWideChar=11, lpMultiByteStr=0x1fe3a8c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Content.xml", lpUsedDefaultChar=0x0) returned 11 [0048.890] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe3a8c, cbMultiByte=11, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="Content.xmllmlmll@\x01") returned 11 [0048.890] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Content.xml", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0048.890] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Content.xml", cchWideChar=11, lpMultiByteStr=0x1fe3aac, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Content.xml", lpUsedDefaultChar=0x0) returned 11 [0048.890] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0048.890] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0048.890] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x69a5 [0048.890] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0048.890] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0048.890] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0048.890] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Content.xml", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0048.890] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Content.xml", cchWideChar=11, lpMultiByteStr=0x1fe3aac, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Content.xml", lpUsedDefaultChar=0x0) returned 11 [0048.890] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Content.xml", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0048.890] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Content.xml", cchWideChar=11, lpMultiByteStr=0x1fe3a8c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Content.xml", lpUsedDefaultChar=0x0) returned 11 [0048.890] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe3a8c, cbMultiByte=11, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="Content.xmlnt.xmllmlmll@\x01") returned 11 [0048.890] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Content.xml", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0048.890] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Content.xml", cchWideChar=11, lpMultiByteStr=0x1fe3aac, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Content.xml", lpUsedDefaultChar=0x0) returned 11 [0048.891] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0048.891] CharToOemA (in: pSrc="Content.xml", pDst=0x1fe3a8c | out: pDst="Content.xml") returned 1 [0048.891] WriteFile (in: hFile=0x158, lpBuffer=0x1fe3a8c*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe3a8c*, lpNumberOfBytesWritten=0x18e048*=0xb, lpOverlapped=0x0) returned 1 [0048.891] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0048.891] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0048.892] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0048.892] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=16915509333) returned 1 [0048.892] ReadFile (in: hFile=0x15c, lpBuffer=0x37e5db0, nNumberOfBytesToRead=0x69a5, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37e5db0*, lpNumberOfBytesRead=0x18dd7c*=0x69a5, lpOverlapped=0x0) returned 1 [0048.893] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0048.893] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=16915664260) returned 1 [0048.901] WriteFile (in: hFile=0x158, lpBuffer=0x1fea168*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fea168*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0048.902] ReadFile (in: hFile=0x15c, lpBuffer=0x37e5db0, nNumberOfBytesToRead=0x69a5, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x37e5db0*, lpNumberOfBytesRead=0x18de38*=0x69a5, lpOverlapped=0x0) returned 1 [0048.902] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x46 [0048.902] WriteFile (in: hFile=0x158, lpBuffer=0x382c8a0*, nNumberOfBytesToWrite=0x69a5, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x382c8a0*, lpNumberOfBytesWritten=0x18de10*=0x69a5, lpOverlapped=0x0) returned 1 [0048.903] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x69eb [0048.903] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0048.903] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0048.903] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0048.903] SetFilePointer (in: hFile=0x158, lDistanceToMove=11, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x29 [0048.903] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x69f5 [0048.903] CloseHandle (hObject=0x15c) returned 1 [0048.904] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x69f5 [0048.904] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x69f5 [0048.904] SetFilePointer (in: hFile=0x158, lDistanceToMove=27125, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x69f5 [0048.904] SetFilePointer (in: hFile=0x158, lDistanceToMove=27125, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x69f5 [0048.904] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x69f5 [0048.904] SetFilePointer (in: hFile=0x158, lDistanceToMove=27125, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x69f5 [0048.904] SetEndOfFile (hFile=0x158) returned 1 [0048.904] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x69f5 [0048.904] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x69f5 [0048.904] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Content.xml", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0048.904] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Content.xml", cchWideChar=11, lpMultiByteStr=0x1fe3aac, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Content.xml", lpUsedDefaultChar=0x0) returned 11 [0048.904] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Content.xml", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0048.904] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Content.xml", cchWideChar=11, lpMultiByteStr=0x1fe412c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Content.xml", lpUsedDefaultChar=0x0) returned 11 [0048.904] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe412c, cbMultiByte=11, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="Content.xml\x18ꞗ@涤(\x18믉`믑`") returned 11 [0048.904] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Content.xml", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0048.904] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Content.xml", cchWideChar=11, lpMultiByteStr=0x1fe3aac, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Content.xml", lpUsedDefaultChar=0x0) returned 11 [0048.904] WriteFile (in: hFile=0x158, lpBuffer=0x34e3cf8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x34e3cf8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0048.905] CharToOemA (in: pSrc="Content.xml", pDst=0x1fe412c | out: pDst="Content.xml") returned 1 [0048.905] WriteFile (in: hFile=0x158, lpBuffer=0x1fe412c*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe412c*, lpNumberOfBytesWritten=0x18efcc*=0xb, lpOverlapped=0x0) returned 1 [0048.905] WriteFile (in: hFile=0x158, lpBuffer=0x1fea2d8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea2d8*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0048.905] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0048.905] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0048.905] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x6a39 [0048.905] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x6a39 [0048.905] WriteFile (in: hFile=0x158, lpBuffer=0x361f5a8*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x361f5a8*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0048.905] WriteFile (in: hFile=0x158, lpBuffer=0x35f011c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f011c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0048.905] DeleteFileW (lpFileName="") returned 0 [0048.905] GetLastError () returned 0x3 [0048.905] GetFileAttributesW (lpFileName="") returned 0xffffffff [0048.905] SetLastError (dwErrCode=0x3) [0048.905] FlushFileBuffers (hFile=0x158) returned 1 [0048.908] GetCurrentThreadId () returned 0x970 [0048.908] GetCurrentThreadId () returned 0x970 [0048.908] GetCurrentThreadId () returned 0x970 [0048.908] GetCurrentThreadId () returned 0x970 [0048.908] GetCurrentThreadId () returned 0x970 [0048.908] GetCurrentThreadId () returned 0x970 [0048.908] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x6af0 [0048.908] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x6af0 [0048.908] SetFilePointer (in: hFile=0x158, lDistanceToMove=27376, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x6af0 [0048.908] CloseHandle (hObject=0x158) returned 1 [0048.909] GetCurrentThreadId () returned 0x970 [0048.909] GetCurrentThreadId () returned 0x970 [0048.909] GetCurrentThreadId () returned 0x970 [0048.909] GetCurrentThreadId () returned 0x970 [0048.909] GetCurrentThreadId () returned 0x970 [0048.909] GetCurrentThreadId () returned 0x970 [0048.909] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Файл зашифрован [Content.xml].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\Файл зашифрован [content.xml].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0048.909] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6af0 [0048.909] SetFilePointer (in: hFile=0x158, lDistanceToMove=27248, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6a70 [0048.910] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0048.910] GetFileType (hFile=0x158) returned 0x1 [0048.910] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x38, wMilliseconds=0xd6)) [0048.910] GetCurrentThreadId () returned 0x970 [0048.910] GetCurrentThreadId () returned 0x970 [0048.910] GetCurrentThreadId () returned 0x970 [0048.910] GetCurrentThreadId () returned 0x970 [0048.910] GetCurrentThreadId () returned 0x970 [0048.910] GetCurrentThreadId () returned 0x970 [0048.910] GetCurrentThreadId () returned 0x970 [0048.910] GetCurrentThreadId () returned 0x970 [0048.910] GetCurrentThreadId () returned 0x970 [0048.910] GetCurrentThreadId () returned 0x970 [0048.910] GetCurrentThreadId () returned 0x970 [0048.910] GetCurrentThreadId () returned 0x970 [0048.910] GetCurrentThreadId () returned 0x970 [0048.910] GetCurrentThreadId () returned 0x970 [0048.910] GetCurrentThreadId () returned 0x970 [0048.910] GetCurrentThreadId () returned 0x970 [0048.910] GetCurrentThreadId () returned 0x970 [0048.910] GetCurrentThreadId () returned 0x970 [0048.910] GetCurrentThreadId () returned 0x970 [0048.910] GetCurrentThreadId () returned 0x970 [0048.910] GetCurrentThreadId () returned 0x970 [0048.910] GetCurrentThreadId () returned 0x970 [0048.910] GetCurrentThreadId () returned 0x970 [0048.910] GetCurrentThreadId () returned 0x970 [0048.910] GetCurrentThreadId () returned 0x970 [0048.910] GetCurrentThreadId () returned 0x970 [0048.910] GetCurrentThreadId () returned 0x970 [0048.910] GetCurrentThreadId () returned 0x970 [0048.910] GetCurrentThreadId () returned 0x970 [0048.910] GetCurrentThreadId () returned 0x970 [0048.910] GetCurrentThreadId () returned 0x970 [0048.910] GetCurrentThreadId () returned 0x970 [0048.910] GetCurrentThreadId () returned 0x970 [0048.910] GetCurrentThreadId () returned 0x970 [0048.910] GetCurrentThreadId () returned 0x970 [0048.910] GetCurrentThreadId () returned 0x970 [0048.910] GetCurrentThreadId () returned 0x970 [0048.910] GetCurrentThreadId () returned 0x970 [0048.910] GetCurrentThreadId () returned 0x970 [0048.910] GetCurrentThreadId () returned 0x970 [0048.910] GetCurrentThreadId () returned 0x970 [0048.911] GetCurrentThreadId () returned 0x970 [0048.911] GetCurrentThreadId () returned 0x970 [0048.911] GetCurrentThreadId () returned 0x970 [0048.911] GetCurrentThreadId () returned 0x970 [0048.911] GetCurrentThreadId () returned 0x970 [0048.911] GetCurrentThreadId () returned 0x970 [0048.911] GetCurrentThreadId () returned 0x970 [0048.911] GetCurrentThreadId () returned 0x970 [0048.911] GetCurrentThreadId () returned 0x970 [0048.911] GetCurrentThreadId () returned 0x970 [0048.911] GetCurrentThreadId () returned 0x970 [0048.911] GetCurrentThreadId () returned 0x970 [0048.911] GetCurrentThreadId () returned 0x970 [0048.911] GetCurrentThreadId () returned 0x970 [0048.911] GetCurrentThreadId () returned 0x970 [0048.911] GetCurrentThreadId () returned 0x970 [0048.911] GetCurrentThreadId () returned 0x970 [0048.911] GetCurrentThreadId () returned 0x970 [0048.911] GetCurrentThreadId () returned 0x970 [0048.911] GetCurrentThreadId () returned 0x970 [0048.911] GetCurrentThreadId () returned 0x970 [0048.911] GetCurrentThreadId () returned 0x970 [0048.911] GetCurrentThreadId () returned 0x970 [0048.911] GetCurrentThreadId () returned 0x970 [0048.911] GetCurrentThreadId () returned 0x970 [0048.911] GetCurrentThreadId () returned 0x970 [0048.911] GetCurrentThreadId () returned 0x970 [0048.911] GetCurrentThreadId () returned 0x970 [0048.911] GetCurrentThreadId () returned 0x970 [0048.911] GetCurrentThreadId () returned 0x970 [0048.911] GetCurrentThreadId () returned 0x970 [0048.911] GetCurrentThreadId () returned 0x970 [0048.911] GetCurrentThreadId () returned 0x970 [0048.911] GetCurrentThreadId () returned 0x970 [0048.911] GetCurrentThreadId () returned 0x970 [0048.911] GetCurrentThreadId () returned 0x970 [0048.911] GetCurrentThreadId () returned 0x970 [0048.911] GetCurrentThreadId () returned 0x970 [0048.911] GetCurrentThreadId () returned 0x970 [0048.911] GetCurrentThreadId () returned 0x970 [0048.911] GetCurrentThreadId () returned 0x970 [0048.911] GetCurrentThreadId () returned 0x970 [0048.911] GetCurrentThreadId () returned 0x970 [0048.911] GetCurrentThreadId () returned 0x970 [0048.911] GetCurrentThreadId () returned 0x970 [0048.911] GetCurrentThreadId () returned 0x970 [0048.911] GetCurrentThreadId () returned 0x970 [0048.911] GetCurrentThreadId () returned 0x970 [0048.912] GetCurrentThreadId () returned 0x970 [0048.912] GetCurrentThreadId () returned 0x970 [0048.912] GetCurrentThreadId () returned 0x970 [0048.912] GetCurrentThreadId () returned 0x970 [0048.912] GetCurrentThreadId () returned 0x970 [0048.912] GetCurrentThreadId () returned 0x970 [0048.912] GetCurrentThreadId () returned 0x970 [0048.912] GetCurrentThreadId () returned 0x970 [0048.912] GetCurrentThreadId () returned 0x970 [0048.912] GetCurrentThreadId () returned 0x970 [0048.912] GetCurrentThreadId () returned 0x970 [0048.912] GetCurrentThreadId () returned 0x970 [0048.912] GetCurrentThreadId () returned 0x970 [0048.912] GetCurrentThreadId () returned 0x970 [0048.912] GetCurrentThreadId () returned 0x970 [0048.912] GetCurrentThreadId () returned 0x970 [0048.912] GetCurrentThreadId () returned 0x970 [0048.912] GetCurrentThreadId () returned 0x970 [0048.912] GetCurrentThreadId () returned 0x970 [0048.912] GetCurrentThreadId () returned 0x970 [0048.912] GetCurrentThreadId () returned 0x970 [0048.912] GetCurrentThreadId () returned 0x970 [0048.912] GetCurrentThreadId () returned 0x970 [0048.912] GetCurrentThreadId () returned 0x970 [0048.912] GetCurrentThreadId () returned 0x970 [0048.912] GetCurrentThreadId () returned 0x970 [0048.912] GetCurrentThreadId () returned 0x970 [0048.912] GetCurrentThreadId () returned 0x970 [0048.912] GetCurrentThreadId () returned 0x970 [0048.912] GetCurrentThreadId () returned 0x970 [0048.912] GetCurrentThreadId () returned 0x970 [0048.912] GetCurrentThreadId () returned 0x970 [0048.912] GetCurrentThreadId () returned 0x970 [0048.912] GetCurrentThreadId () returned 0x970 [0048.912] GetCurrentThreadId () returned 0x970 [0048.912] GetCurrentThreadId () returned 0x970 [0048.912] GetCurrentThreadId () returned 0x970 [0048.912] GetCurrentThreadId () returned 0x970 [0048.912] GetCurrentThreadId () returned 0x970 [0048.912] GetCurrentThreadId () returned 0x970 [0048.912] GetCurrentThreadId () returned 0x970 [0048.912] GetCurrentThreadId () returned 0x970 [0048.912] GetCurrentThreadId () returned 0x970 [0048.912] GetCurrentThreadId () returned 0x970 [0048.912] GetCurrentThreadId () returned 0x970 [0048.912] GetCurrentThreadId () returned 0x970 [0048.912] GetCurrentThreadId () returned 0x970 [0048.912] GetCurrentThreadId () returned 0x970 [0048.912] GetCurrentThreadId () returned 0x970 [0048.913] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.913] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.913] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb670, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.913] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.913] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.913] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb670, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.913] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.913] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.913] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.913] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.913] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.913] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.913] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.913] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.913] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb6d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.913] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.913] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.913] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb6d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.913] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.913] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.913] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb6d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.913] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x38, wMilliseconds=0xd6)) [0048.913] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="!?kqg$93qERJ&=!>x0enGJYLuoP$IQtI", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0048.913] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="!?kqg$93qERJ&=!>x0enGJYLuoP$IQtI", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0048.913] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="!?kqg$93qERJ&=!>x0enGJYLuoP$IQtI", cchWideChar=32, lpMultiByteStr=0x20008c8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="!?kqg$93qERJ&=!>x0enGJYLuoP$IQtI", lpUsedDefaultChar=0x0) returned 32 [0048.913] GetCurrentThreadId () returned 0x970 [0048.913] GetCurrentThreadId () returned 0x970 [0048.913] GetCurrentThreadId () returned 0x970 [0048.913] GetCurrentThreadId () returned 0x970 [0048.913] GetCurrentThreadId () returned 0x970 [0048.913] GetCurrentThreadId () returned 0x970 [0048.921] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0048.921] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0048.921] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x202df18, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0048.921] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x35904f8, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0048.921] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x35904f8, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAASy6I+Odncy/r5qgSs4tiuZMPw5SN1JwNvg1jlv6pMYx5sad4Q177/VpB3NSK0tBLBizogWs8iFcQ78H0vpa9Aqm4liCRYgTS3YY10Qb376dbQb4Gj9N5dKi+I8iFjrYINb1im4U3WQvTslmDxI08cmZWT299fR4se7bzHlT46OmsjPekH9AFrXXHkKFV8ykRw99GQst5QmFC8t5PLFcP2vPSA/tra5tw==") returned 232 [0048.921] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x38, wMilliseconds=0xe6)) [0048.921] GetCurrentThreadId () returned 0x970 [0048.921] GetCurrentThreadId () returned 0x970 [0048.921] GetCurrentThreadId () returned 0x970 [0048.921] GetCurrentThreadId () returned 0x970 [0048.921] GetCurrentThreadId () returned 0x970 [0048.921] GetCurrentThreadId () returned 0x970 [0048.921] GetCurrentThreadId () returned 0x970 [0048.921] GetCurrentThreadId () returned 0x970 [0048.921] GetCurrentThreadId () returned 0x970 [0048.921] GetCurrentThreadId () returned 0x970 [0048.921] GetCurrentThreadId () returned 0x970 [0048.921] GetCurrentThreadId () returned 0x970 [0048.921] GetCurrentThreadId () returned 0x970 [0048.921] GetCurrentThreadId () returned 0x970 [0048.921] GetCurrentThreadId () returned 0x970 [0048.921] GetCurrentThreadId () returned 0x970 [0048.921] GetCurrentThreadId () returned 0x970 [0048.921] GetCurrentThreadId () returned 0x970 [0048.921] GetCurrentThreadId () returned 0x970 [0048.921] GetCurrentThreadId () returned 0x970 [0048.921] GetCurrentThreadId () returned 0x970 [0048.921] GetCurrentThreadId () returned 0x970 [0048.921] GetCurrentThreadId () returned 0x970 [0048.921] GetCurrentThreadId () returned 0x970 [0048.921] GetCurrentThreadId () returned 0x970 [0048.921] GetCurrentThreadId () returned 0x970 [0048.921] GetCurrentThreadId () returned 0x970 [0048.921] GetCurrentThreadId () returned 0x970 [0048.921] GetCurrentThreadId () returned 0x970 [0048.922] GetCurrentThreadId () returned 0x970 [0048.922] GetCurrentThreadId () returned 0x970 [0048.922] GetCurrentThreadId () returned 0x970 [0048.922] GetCurrentThreadId () returned 0x970 [0048.922] GetCurrentThreadId () returned 0x970 [0048.922] GetCurrentThreadId () returned 0x970 [0048.922] GetCurrentThreadId () returned 0x970 [0048.922] GetCurrentThreadId () returned 0x970 [0048.922] GetCurrentThreadId () returned 0x970 [0048.922] GetCurrentThreadId () returned 0x970 [0048.922] GetCurrentThreadId () returned 0x970 [0048.922] GetCurrentThreadId () returned 0x970 [0048.922] GetCurrentThreadId () returned 0x970 [0048.922] GetCurrentThreadId () returned 0x970 [0048.922] GetCurrentThreadId () returned 0x970 [0048.922] GetCurrentThreadId () returned 0x970 [0048.922] GetCurrentThreadId () returned 0x970 [0048.922] GetCurrentThreadId () returned 0x970 [0048.922] GetCurrentThreadId () returned 0x970 [0048.922] GetCurrentThreadId () returned 0x970 [0048.922] GetCurrentThreadId () returned 0x970 [0048.922] GetCurrentThreadId () returned 0x970 [0048.922] GetCurrentThreadId () returned 0x970 [0048.922] GetCurrentThreadId () returned 0x970 [0048.922] GetCurrentThreadId () returned 0x970 [0048.922] GetCurrentThreadId () returned 0x970 [0048.922] GetCurrentThreadId () returned 0x970 [0048.922] GetCurrentThreadId () returned 0x970 [0048.922] GetCurrentThreadId () returned 0x970 [0048.922] GetCurrentThreadId () returned 0x970 [0048.922] GetCurrentThreadId () returned 0x970 [0048.922] GetCurrentThreadId () returned 0x970 [0048.922] GetCurrentThreadId () returned 0x970 [0048.922] GetCurrentThreadId () returned 0x970 [0048.922] GetCurrentThreadId () returned 0x970 [0048.922] GetCurrentThreadId () returned 0x970 [0048.922] GetCurrentThreadId () returned 0x970 [0048.922] GetCurrentThreadId () returned 0x970 [0048.922] GetCurrentThreadId () returned 0x970 [0048.922] GetCurrentThreadId () returned 0x970 [0048.922] GetCurrentThreadId () returned 0x970 [0048.922] GetCurrentThreadId () returned 0x970 [0048.922] GetCurrentThreadId () returned 0x970 [0048.922] GetCurrentThreadId () returned 0x970 [0048.922] GetCurrentThreadId () returned 0x970 [0048.922] GetCurrentThreadId () returned 0x970 [0048.922] GetCurrentThreadId () returned 0x970 [0048.922] GetCurrentThreadId () returned 0x970 [0048.923] GetCurrentThreadId () returned 0x970 [0048.923] GetCurrentThreadId () returned 0x970 [0048.923] GetCurrentThreadId () returned 0x970 [0048.923] GetCurrentThreadId () returned 0x970 [0048.923] GetCurrentThreadId () returned 0x970 [0048.923] GetCurrentThreadId () returned 0x970 [0048.923] GetCurrentThreadId () returned 0x970 [0048.923] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAASy6I+Odncy/r5qgSs4tiuZMPw5SN1JwNvg1jlv6pMYx5sad4Q177/VpB3NSK0tBLBizogWs8iFcQ78H0vpa9Aqm4liCRYgTS3YY10Qb376dbQb4Gj9N5dKi+I8iFjrYINb1im4U3WQvTslmDxI08cmZWT299fR4se7bzHlT46OmsjPekH9AFrXXHkKFV8ykRw99GQst5QmFC8t5PLFcP2vPSA/tra5tw==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0048.923] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAASy6I+Odncy/r5qgSs4tiuZMPw5SN1JwNvg1jlv6pMYx5sad4Q177/VpB3NSK0tBLBizogWs8iFcQ78H0vpa9Aqm4liCRYgTS3YY10Qb376dbQb4Gj9N5dKi+I8iFjrYINb1im4U3WQvTslmDxI08cmZWT299fR4se7bzHlT46OmsjPekH9AFrXXHkKFV8ykRw99GQst5QmFC8t5PLFcP2vPSA/tra5tw==", cchWideChar=245, lpMultiByteStr=0x353900c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAASy6I+Odncy/r5qgSs4tiuZMPw5SN1JwNvg1jlv6pMYx5sad4Q177/VpB3NSK0tBLBizogWs8iFcQ78H0vpa9Aqm4liCRYgTS3YY10Qb376dbQb4Gj9N5dKi+I8iFjrYINb1im4U3WQvTslmDxI08cmZWT299fR4se7bzHlT46OmsjPekH9AFrXXHkKFV8ykRw99GQst5QmFC8t5PLFcP2vPSA/tra5tw==", lpUsedDefaultChar=0x0) returned 245 [0048.923] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0048.923] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0048.923] CloseHandle (hObject=0x158) returned 1 [0048.924] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0 [0048.924] GetLastError () returned 0x5 [0048.924] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0048.924] SetLastError (dwErrCode=0x5) [0048.924] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=16918737476) returned 1 [0048.924] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\Файл зашифрован [boxed-correct.avi].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\Файл зашифрован [boxed-correct.avi].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0048.925] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0048.925] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0048.925] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0048.925] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0048.925] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0048.925] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0048.925] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0048.925] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0048.925] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0048.925] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0048.926] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0048.926] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0048.926] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0048.926] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0048.926] SetEndOfFile (hFile=0x158) returned 1 [0048.926] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0048.926] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0048.926] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0048.926] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0048.926] WriteFile (in: hFile=0x158, lpBuffer=0x361f5a8*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x361f5a8*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0048.927] WriteFile (in: hFile=0x158, lpBuffer=0x35f005c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f005c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0048.927] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="JHF+wfo0}U^:@.)khx9wq4~6A/A3,o/G", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0048.927] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="JHF+wfo0}U^:@.)khx9wq4~6A/A3,o/G", cchWideChar=32, lpMultiByteStr=0x2032bac, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="JHF+wfo0}U^:@.)khx9wq4~6A/A3,o/G", lpUsedDefaultChar=0x0) returned 32 [0048.927] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0048.927] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0048.927] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a407849, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9a407849, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x9a407849, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x15e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-correct.avi", cAlternateFileName="")) returned 0x295098 [0048.927] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0048.927] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0048.927] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0048.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0048.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0048.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0048.929] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a407849, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9a407849, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x9a407849, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x15e00)) returned 1 [0048.929] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0048.929] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0048.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0048.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0048.929] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0048.929] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0048.929] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0048.929] SetEndOfFile (hFile=0x158) returned 1 [0048.930] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="boxed-correct.avi", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0048.930] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="boxed-correct.avi", cchWideChar=17, lpMultiByteStr=0x1ff8974, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="boxed-correct.avi", lpUsedDefaultChar=0x0) returned 17 [0048.930] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="boxed-correct.avi", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0048.930] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="boxed-correct.avi", cchWideChar=17, lpMultiByteStr=0x1ff88ac, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="boxed-correct.avi", lpUsedDefaultChar=0x0) returned 17 [0048.930] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff88ac, cbMultiByte=17, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="boxed-correct.avi@\x01") returned 17 [0048.930] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="boxed-correct.avi", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0048.930] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="boxed-correct.avi", cchWideChar=17, lpMultiByteStr=0x1ff8974, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="boxed-correct.avi", lpUsedDefaultChar=0x0) returned 17 [0048.930] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0048.931] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0048.931] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x15e00 [0048.931] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0048.931] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0048.931] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0048.931] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="boxed-correct.avi", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0048.931] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="boxed-correct.avi", cchWideChar=17, lpMultiByteStr=0x1ff8974, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="boxed-correct.avi", lpUsedDefaultChar=0x0) returned 17 [0048.931] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="boxed-correct.avi", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0048.931] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="boxed-correct.avi", cchWideChar=17, lpMultiByteStr=0x1ff88ac, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="boxed-correct.avi", lpUsedDefaultChar=0x0) returned 17 [0048.931] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff88ac, cbMultiByte=17, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="boxed-correct.avict.avi@\x01") returned 17 [0048.931] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="boxed-correct.avi", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0048.931] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="boxed-correct.avi", cchWideChar=17, lpMultiByteStr=0x1ff8974, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="boxed-correct.avi", lpUsedDefaultChar=0x0) returned 17 [0048.931] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0048.932] CharToOemA (in: pSrc="boxed-correct.avi", pDst=0x1ff88ac | out: pDst="boxed-correct.avi") returned 1 [0048.932] WriteFile (in: hFile=0x158, lpBuffer=0x1ff88ac*, nNumberOfBytesToWrite=0x11, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1ff88ac*, lpNumberOfBytesWritten=0x18e048*=0x11, lpOverlapped=0x0) returned 1 [0048.932] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0048.932] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0048.932] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0048.932] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=16919579361) returned 1 [0048.932] ReadFile (in: hFile=0x15c, lpBuffer=0x37e5db0, nNumberOfBytesToRead=0x15e00, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37e5db0*, lpNumberOfBytesRead=0x18dd7c*=0x15e00, lpOverlapped=0x0) returned 1 [0048.934] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0048.934] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=16919776747) returned 1 [0048.943] WriteFile (in: hFile=0x158, lpBuffer=0x1fea210*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fea210*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0048.943] ReadFile (in: hFile=0x15c, lpBuffer=0x37e5db0, nNumberOfBytesToRead=0x15e00, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x37e5db0*, lpNumberOfBytesRead=0x18de38*=0x15e00, lpOverlapped=0x0) returned 1 [0048.946] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x4c [0048.946] WriteFile (in: hFile=0x158, lpBuffer=0x383bca0*, nNumberOfBytesToWrite=0x15e00, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x383bca0*, lpNumberOfBytesWritten=0x18de10*=0x15e00, lpOverlapped=0x0) returned 1 [0048.948] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x15e4c [0048.948] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0048.948] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0048.948] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0048.948] SetFilePointer (in: hFile=0x158, lDistanceToMove=17, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2f [0048.948] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x15e56 [0048.948] CloseHandle (hObject=0x15c) returned 1 [0048.948] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x15e56 [0048.948] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x15e56 [0048.948] SetFilePointer (in: hFile=0x158, lDistanceToMove=89686, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x15e56 [0048.948] SetFilePointer (in: hFile=0x158, lDistanceToMove=89686, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x15e56 [0048.948] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x15e56 [0048.948] SetFilePointer (in: hFile=0x158, lDistanceToMove=89686, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x15e56 [0048.948] SetEndOfFile (hFile=0x158) returned 1 [0048.949] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x15e56 [0048.949] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x15e56 [0048.949] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="boxed-correct.avi", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0048.949] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="boxed-correct.avi", cchWideChar=17, lpMultiByteStr=0x1ff88ac, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="boxed-correct.avi", lpUsedDefaultChar=0x0) returned 17 [0048.949] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="boxed-correct.avi", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0048.949] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="boxed-correct.avi", cchWideChar=17, lpMultiByteStr=0x1ff8974, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="boxed-correct.avi", lpUsedDefaultChar=0x0) returned 17 [0048.949] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff8974, cbMultiByte=17, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="boxed-correct.avi\x18믉`믑`") returned 17 [0048.949] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="boxed-correct.avi", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0048.949] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="boxed-correct.avi", cchWideChar=17, lpMultiByteStr=0x1ff88ac, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="boxed-correct.avi", lpUsedDefaultChar=0x0) returned 17 [0048.949] WriteFile (in: hFile=0x158, lpBuffer=0x34e3cf8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x34e3cf8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0048.949] CharToOemA (in: pSrc="boxed-correct.avi", pDst=0x1ff8974 | out: pDst="boxed-correct.avi") returned 1 [0048.949] WriteFile (in: hFile=0x158, lpBuffer=0x1ff8974*, nNumberOfBytesToWrite=0x11, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1ff8974*, lpNumberOfBytesWritten=0x18efcc*=0x11, lpOverlapped=0x0) returned 1 [0048.949] WriteFile (in: hFile=0x158, lpBuffer=0x1fea428*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea428*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0048.949] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0048.949] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0048.949] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x15ea0 [0048.950] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x15ea0 [0048.950] WriteFile (in: hFile=0x158, lpBuffer=0x361f5a8*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x361f5a8*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0048.950] WriteFile (in: hFile=0x158, lpBuffer=0x35f005c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f005c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0048.950] DeleteFileW (lpFileName="") returned 0 [0048.950] GetLastError () returned 0x3 [0048.950] GetFileAttributesW (lpFileName="") returned 0xffffffff [0048.950] SetLastError (dwErrCode=0x3) [0048.950] FlushFileBuffers (hFile=0x158) returned 1 [0048.952] GetCurrentThreadId () returned 0x970 [0048.952] GetCurrentThreadId () returned 0x970 [0048.952] GetCurrentThreadId () returned 0x970 [0048.952] GetCurrentThreadId () returned 0x970 [0048.952] GetCurrentThreadId () returned 0x970 [0048.952] GetCurrentThreadId () returned 0x970 [0048.952] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x15f57 [0048.952] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x15f57 [0048.952] SetFilePointer (in: hFile=0x158, lDistanceToMove=89943, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x15f57 [0048.952] CloseHandle (hObject=0x158) returned 1 [0048.954] GetCurrentThreadId () returned 0x970 [0048.954] GetCurrentThreadId () returned 0x970 [0048.954] GetCurrentThreadId () returned 0x970 [0048.954] GetCurrentThreadId () returned 0x970 [0048.954] GetCurrentThreadId () returned 0x970 [0048.954] GetCurrentThreadId () returned 0x970 [0048.954] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\Файл зашифрован [boxed-correct.avi].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\Файл зашифрован [boxed-correct.avi].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0048.954] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x15f57 [0048.954] SetFilePointer (in: hFile=0x158, lDistanceToMove=89815, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x15ed7 [0048.954] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0048.954] GetFileType (hFile=0x158) returned 0x1 [0048.954] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x38, wMilliseconds=0x105)) [0048.954] GetCurrentThreadId () returned 0x970 [0048.954] GetCurrentThreadId () returned 0x970 [0048.954] GetCurrentThreadId () returned 0x970 [0048.954] GetCurrentThreadId () returned 0x970 [0048.954] GetCurrentThreadId () returned 0x970 [0048.954] GetCurrentThreadId () returned 0x970 [0048.954] GetCurrentThreadId () returned 0x970 [0048.954] GetCurrentThreadId () returned 0x970 [0048.955] GetCurrentThreadId () returned 0x970 [0048.955] GetCurrentThreadId () returned 0x970 [0048.955] GetCurrentThreadId () returned 0x970 [0048.955] GetCurrentThreadId () returned 0x970 [0048.955] GetCurrentThreadId () returned 0x970 [0048.955] GetCurrentThreadId () returned 0x970 [0048.955] GetCurrentThreadId () returned 0x970 [0048.955] GetCurrentThreadId () returned 0x970 [0048.955] GetCurrentThreadId () returned 0x970 [0048.955] GetCurrentThreadId () returned 0x970 [0048.955] GetCurrentThreadId () returned 0x970 [0048.955] GetCurrentThreadId () returned 0x970 [0048.955] GetCurrentThreadId () returned 0x970 [0048.955] GetCurrentThreadId () returned 0x970 [0048.955] GetCurrentThreadId () returned 0x970 [0048.955] GetCurrentThreadId () returned 0x970 [0048.955] GetCurrentThreadId () returned 0x970 [0048.955] GetCurrentThreadId () returned 0x970 [0048.955] GetCurrentThreadId () returned 0x970 [0048.955] GetCurrentThreadId () returned 0x970 [0048.955] GetCurrentThreadId () returned 0x970 [0048.955] GetCurrentThreadId () returned 0x970 [0048.955] GetCurrentThreadId () returned 0x970 [0048.955] GetCurrentThreadId () returned 0x970 [0048.955] GetCurrentThreadId () returned 0x970 [0048.955] GetCurrentThreadId () returned 0x970 [0048.955] GetCurrentThreadId () returned 0x970 [0048.955] GetCurrentThreadId () returned 0x970 [0048.955] GetCurrentThreadId () returned 0x970 [0048.955] GetCurrentThreadId () returned 0x970 [0048.955] GetCurrentThreadId () returned 0x970 [0048.955] GetCurrentThreadId () returned 0x970 [0048.955] GetCurrentThreadId () returned 0x970 [0048.955] GetCurrentThreadId () returned 0x970 [0048.955] GetCurrentThreadId () returned 0x970 [0048.955] GetCurrentThreadId () returned 0x970 [0048.955] GetCurrentThreadId () returned 0x970 [0048.955] GetCurrentThreadId () returned 0x970 [0048.955] GetCurrentThreadId () returned 0x970 [0048.955] GetCurrentThreadId () returned 0x970 [0048.955] GetCurrentThreadId () returned 0x970 [0048.955] GetCurrentThreadId () returned 0x970 [0048.955] GetCurrentThreadId () returned 0x970 [0048.955] GetCurrentThreadId () returned 0x970 [0048.955] GetCurrentThreadId () returned 0x970 [0048.955] GetCurrentThreadId () returned 0x970 [0048.955] GetCurrentThreadId () returned 0x970 [0048.955] GetCurrentThreadId () returned 0x970 [0048.955] GetCurrentThreadId () returned 0x970 [0048.956] GetCurrentThreadId () returned 0x970 [0048.956] GetCurrentThreadId () returned 0x970 [0048.956] GetCurrentThreadId () returned 0x970 [0048.956] GetCurrentThreadId () returned 0x970 [0048.956] GetCurrentThreadId () returned 0x970 [0048.956] GetCurrentThreadId () returned 0x970 [0048.956] GetCurrentThreadId () returned 0x970 [0048.956] GetCurrentThreadId () returned 0x970 [0048.956] GetCurrentThreadId () returned 0x970 [0048.956] GetCurrentThreadId () returned 0x970 [0048.956] GetCurrentThreadId () returned 0x970 [0048.956] GetCurrentThreadId () returned 0x970 [0048.956] GetCurrentThreadId () returned 0x970 [0048.956] GetCurrentThreadId () returned 0x970 [0048.956] GetCurrentThreadId () returned 0x970 [0048.956] GetCurrentThreadId () returned 0x970 [0048.956] GetCurrentThreadId () returned 0x970 [0048.956] GetCurrentThreadId () returned 0x970 [0048.956] GetCurrentThreadId () returned 0x970 [0048.956] GetCurrentThreadId () returned 0x970 [0048.956] GetCurrentThreadId () returned 0x970 [0048.956] GetCurrentThreadId () returned 0x970 [0048.956] GetCurrentThreadId () returned 0x970 [0048.956] GetCurrentThreadId () returned 0x970 [0048.956] GetCurrentThreadId () returned 0x970 [0048.956] GetCurrentThreadId () returned 0x970 [0048.956] GetCurrentThreadId () returned 0x970 [0048.956] GetCurrentThreadId () returned 0x970 [0048.956] GetCurrentThreadId () returned 0x970 [0048.956] GetCurrentThreadId () returned 0x970 [0048.956] GetCurrentThreadId () returned 0x970 [0048.956] GetCurrentThreadId () returned 0x970 [0048.956] GetCurrentThreadId () returned 0x970 [0048.956] GetCurrentThreadId () returned 0x970 [0048.956] GetCurrentThreadId () returned 0x970 [0048.956] GetCurrentThreadId () returned 0x970 [0048.956] GetCurrentThreadId () returned 0x970 [0048.956] GetCurrentThreadId () returned 0x970 [0048.956] GetCurrentThreadId () returned 0x970 [0048.956] GetCurrentThreadId () returned 0x970 [0048.956] GetCurrentThreadId () returned 0x970 [0048.956] GetCurrentThreadId () returned 0x970 [0048.956] GetCurrentThreadId () returned 0x970 [0048.956] GetCurrentThreadId () returned 0x970 [0048.956] GetCurrentThreadId () returned 0x970 [0048.956] GetCurrentThreadId () returned 0x970 [0048.956] GetCurrentThreadId () returned 0x970 [0048.956] GetCurrentThreadId () returned 0x970 [0048.957] GetCurrentThreadId () returned 0x970 [0048.957] GetCurrentThreadId () returned 0x970 [0048.957] GetCurrentThreadId () returned 0x970 [0048.957] GetCurrentThreadId () returned 0x970 [0048.957] GetCurrentThreadId () returned 0x970 [0048.957] GetCurrentThreadId () returned 0x970 [0048.957] GetCurrentThreadId () returned 0x970 [0048.957] GetCurrentThreadId () returned 0x970 [0048.957] GetCurrentThreadId () returned 0x970 [0048.957] GetCurrentThreadId () returned 0x970 [0048.957] GetCurrentThreadId () returned 0x970 [0048.957] GetCurrentThreadId () returned 0x970 [0048.957] GetCurrentThreadId () returned 0x970 [0048.957] GetCurrentThreadId () returned 0x970 [0048.957] GetCurrentThreadId () returned 0x970 [0048.957] GetCurrentThreadId () returned 0x970 [0048.957] GetCurrentThreadId () returned 0x970 [0048.957] GetCurrentThreadId () returned 0x970 [0048.957] GetCurrentThreadId () returned 0x970 [0048.957] GetCurrentThreadId () returned 0x970 [0048.957] GetCurrentThreadId () returned 0x970 [0048.957] GetCurrentThreadId () returned 0x970 [0048.957] GetCurrentThreadId () returned 0x970 [0048.957] GetCurrentThreadId () returned 0x970 [0048.957] GetCurrentThreadId () returned 0x970 [0048.957] GetCurrentThreadId () returned 0x970 [0048.957] GetCurrentThreadId () returned 0x970 [0048.957] GetCurrentThreadId () returned 0x970 [0048.957] GetCurrentThreadId () returned 0x970 [0048.957] GetCurrentThreadId () returned 0x970 [0048.957] GetCurrentThreadId () returned 0x970 [0048.957] GetCurrentThreadId () returned 0x970 [0048.957] GetCurrentThreadId () returned 0x970 [0048.957] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.957] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.957] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb6d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.957] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.957] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.957] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb6d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.957] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.957] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.957] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.957] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.958] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.958] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.958] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.958] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.958] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb730, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3tV", lpUsedDefaultChar=0x0) returned 10 [0048.958] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.958] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.958] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb730, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3tV", lpUsedDefaultChar=0x0) returned 10 [0048.958] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.958] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.958] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb730, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3tV", lpUsedDefaultChar=0x0) returned 10 [0048.958] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x38, wMilliseconds=0x105)) [0048.958] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JHF+wfo0}U^:@.)khx9wq4~6A/A3,o/G", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0048.958] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JHF+wfo0}U^:@.)khx9wq4~6A/A3,o/G", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0048.958] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JHF+wfo0}U^:@.)khx9wq4~6A/A3,o/G", cchWideChar=32, lpMultiByteStr=0x2000958, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="JHF+wfo0}U^:@.)khx9wq4~6A/A3,o/G", lpUsedDefaultChar=0x0) returned 32 [0048.958] GetCurrentThreadId () returned 0x970 [0048.958] GetCurrentThreadId () returned 0x970 [0048.958] GetCurrentThreadId () returned 0x970 [0048.958] GetCurrentThreadId () returned 0x970 [0048.958] GetCurrentThreadId () returned 0x970 [0048.958] GetCurrentThreadId () returned 0x970 [0048.965] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0048.965] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0048.965] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x202e008, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0048.965] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x35904f8, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0048.965] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x35904f8, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAHPLjV+KkGJxV7Ev89IkiFX+/fOIUzXyrDO3ktQyeOiypuZA/2pFO3hWWrk5zSgJqwKQPS5dOCQZ1kggeYB1FYiXR2i4tMyiP2rs87+QXL0IaqgN9L6wfn4ivknG4zkmtscx1+ljf7+smZj9DCbTIkZbbDKPzCaRJ6x0vrEU/eCZc+6N1LKCHtFvFFTp66duK4OMkSHUCJ1cJsybMjyylTyFRwZagQUE1g==") returned 232 [0048.965] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x38, wMilliseconds=0x105)) [0048.965] GetCurrentThreadId () returned 0x970 [0048.965] GetCurrentThreadId () returned 0x970 [0048.965] GetCurrentThreadId () returned 0x970 [0048.965] GetCurrentThreadId () returned 0x970 [0048.965] GetCurrentThreadId () returned 0x970 [0048.965] GetCurrentThreadId () returned 0x970 [0048.965] GetCurrentThreadId () returned 0x970 [0048.965] GetCurrentThreadId () returned 0x970 [0048.966] GetCurrentThreadId () returned 0x970 [0048.966] GetCurrentThreadId () returned 0x970 [0048.966] GetCurrentThreadId () returned 0x970 [0048.966] GetCurrentThreadId () returned 0x970 [0048.966] GetCurrentThreadId () returned 0x970 [0048.966] GetCurrentThreadId () returned 0x970 [0048.966] GetCurrentThreadId () returned 0x970 [0048.966] GetCurrentThreadId () returned 0x970 [0048.966] GetCurrentThreadId () returned 0x970 [0048.966] GetCurrentThreadId () returned 0x970 [0048.966] GetCurrentThreadId () returned 0x970 [0048.966] GetCurrentThreadId () returned 0x970 [0048.966] GetCurrentThreadId () returned 0x970 [0048.966] GetCurrentThreadId () returned 0x970 [0048.966] GetCurrentThreadId () returned 0x970 [0048.966] GetCurrentThreadId () returned 0x970 [0048.966] GetCurrentThreadId () returned 0x970 [0048.966] GetCurrentThreadId () returned 0x970 [0048.966] GetCurrentThreadId () returned 0x970 [0048.966] GetCurrentThreadId () returned 0x970 [0048.966] GetCurrentThreadId () returned 0x970 [0048.966] GetCurrentThreadId () returned 0x970 [0048.966] GetCurrentThreadId () returned 0x970 [0048.966] GetCurrentThreadId () returned 0x970 [0048.966] GetCurrentThreadId () returned 0x970 [0048.966] GetCurrentThreadId () returned 0x970 [0048.966] GetCurrentThreadId () returned 0x970 [0048.966] GetCurrentThreadId () returned 0x970 [0048.966] GetCurrentThreadId () returned 0x970 [0048.966] GetCurrentThreadId () returned 0x970 [0048.966] GetCurrentThreadId () returned 0x970 [0048.966] GetCurrentThreadId () returned 0x970 [0048.966] GetCurrentThreadId () returned 0x970 [0048.966] GetCurrentThreadId () returned 0x970 [0048.966] GetCurrentThreadId () returned 0x970 [0048.966] GetCurrentThreadId () returned 0x970 [0048.966] GetCurrentThreadId () returned 0x970 [0048.966] GetCurrentThreadId () returned 0x970 [0048.966] GetCurrentThreadId () returned 0x970 [0048.966] GetCurrentThreadId () returned 0x970 [0048.966] GetCurrentThreadId () returned 0x970 [0048.966] GetCurrentThreadId () returned 0x970 [0048.966] GetCurrentThreadId () returned 0x970 [0048.966] GetCurrentThreadId () returned 0x970 [0048.966] GetCurrentThreadId () returned 0x970 [0048.966] GetCurrentThreadId () returned 0x970 [0048.967] GetCurrentThreadId () returned 0x970 [0048.967] GetCurrentThreadId () returned 0x970 [0048.967] GetCurrentThreadId () returned 0x970 [0048.967] GetCurrentThreadId () returned 0x970 [0048.967] GetCurrentThreadId () returned 0x970 [0048.967] GetCurrentThreadId () returned 0x970 [0048.967] GetCurrentThreadId () returned 0x970 [0048.967] GetCurrentThreadId () returned 0x970 [0048.967] GetCurrentThreadId () returned 0x970 [0048.967] GetCurrentThreadId () returned 0x970 [0048.967] GetCurrentThreadId () returned 0x970 [0048.967] GetCurrentThreadId () returned 0x970 [0048.967] GetCurrentThreadId () returned 0x970 [0048.967] GetCurrentThreadId () returned 0x970 [0048.967] GetCurrentThreadId () returned 0x970 [0048.967] GetCurrentThreadId () returned 0x970 [0048.967] GetCurrentThreadId () returned 0x970 [0048.967] GetCurrentThreadId () returned 0x970 [0048.967] GetCurrentThreadId () returned 0x970 [0048.967] GetCurrentThreadId () returned 0x970 [0048.967] GetCurrentThreadId () returned 0x970 [0048.967] GetCurrentThreadId () returned 0x970 [0048.967] GetCurrentThreadId () returned 0x970 [0048.967] GetCurrentThreadId () returned 0x970 [0048.967] GetCurrentThreadId () returned 0x970 [0048.967] GetCurrentThreadId () returned 0x970 [0048.967] GetCurrentThreadId () returned 0x970 [0048.967] GetCurrentThreadId () returned 0x970 [0048.967] GetCurrentThreadId () returned 0x970 [0048.967] GetCurrentThreadId () returned 0x970 [0048.967] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAHPLjV+KkGJxV7Ev89IkiFX+/fOIUzXyrDO3ktQyeOiypuZA/2pFO3hWWrk5zSgJqwKQPS5dOCQZ1kggeYB1FYiXR2i4tMyiP2rs87+QXL0IaqgN9L6wfn4ivknG4zkmtscx1+ljf7+smZj9DCbTIkZbbDKPzCaRJ6x0vrEU/eCZc+6N1LKCHtFvFFTp66duK4OMkSHUCJ1cJsybMjyylTyFRwZagQUE1g==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0048.967] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAHPLjV+KkGJxV7Ev89IkiFX+/fOIUzXyrDO3ktQyeOiypuZA/2pFO3hWWrk5zSgJqwKQPS5dOCQZ1kggeYB1FYiXR2i4tMyiP2rs87+QXL0IaqgN9L6wfn4ivknG4zkmtscx1+ljf7+smZj9DCbTIkZbbDKPzCaRJ6x0vrEU/eCZc+6N1LKCHtFvFFTp66duK4OMkSHUCJ1cJsybMjyylTyFRwZagQUE1g==", cchWideChar=245, lpMultiByteStr=0x353900c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAHPLjV+KkGJxV7Ev89IkiFX+/fOIUzXyrDO3ktQyeOiypuZA/2pFO3hWWrk5zSgJqwKQPS5dOCQZ1kggeYB1FYiXR2i4tMyiP2rs87+QXL0IaqgN9L6wfn4ivknG4zkmtscx1+ljf7+smZj9DCbTIkZbbDKPzCaRJ6x0vrEU/eCZc+6N1LKCHtFvFFTp66duK4OMkSHUCJ1cJsybMjyylTyFRwZagQUE1g==", lpUsedDefaultChar=0x0) returned 245 [0048.967] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0048.967] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0048.967] CloseHandle (hObject=0x158) returned 1 [0048.969] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0 [0048.969] GetLastError () returned 0x5 [0048.969] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0048.969] SetLastError (dwErrCode=0x5) [0048.969] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=16923225911) returned 1 [0048.969] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\Файл зашифрован [boxed-delete.avi].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\Файл зашифрован [boxed-delete.avi].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0048.969] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0048.969] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0048.969] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0048.969] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0048.969] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0048.969] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0048.969] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0048.970] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0048.970] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0048.970] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0048.970] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0048.970] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0048.970] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0048.970] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0048.970] SetEndOfFile (hFile=0x158) returned 1 [0048.970] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0048.970] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0048.970] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0048.970] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0048.970] WriteFile (in: hFile=0x158, lpBuffer=0x361f5a8*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x361f5a8*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0048.971] WriteFile (in: hFile=0x158, lpBuffer=0x35f011c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f011c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0048.971] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="xcEw.cRi?yA", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0048.971] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="xcEw.cRi?yA", cchWideChar=32, lpMultiByteStr=0x2032b3c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xcEw.cRi?yA", lpUsedDefaultChar=0x0) returned 32 [0048.971] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0048.971] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0048.971] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23b3de0, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x23b3de0, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a49fdc1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-delete.avi", cAlternateFileName="")) returned 0x295098 [0048.971] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0048.971] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0048.971] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0048.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0048.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0048.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0048.972] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23b3de0, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x23b3de0, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a49fdc1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7c00)) returned 1 [0048.972] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0048.972] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0048.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0048.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0048.972] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0048.973] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0048.973] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0048.973] SetEndOfFile (hFile=0x158) returned 1 [0048.973] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="boxed-delete.avi", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0048.973] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="boxed-delete.avi", cchWideChar=16, lpMultiByteStr=0x1ff88ac, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="boxed-delete.avi", lpUsedDefaultChar=0x0) returned 16 [0048.974] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="boxed-delete.avi", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0048.974] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="boxed-delete.avi", cchWideChar=16, lpMultiByteStr=0x1ff88fc, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="boxed-delete.avi", lpUsedDefaultChar=0x0) returned 16 [0048.974] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff88fc, cbMultiByte=16, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="boxed-delete.avii@\x01") returned 16 [0048.974] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="boxed-delete.avi", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0048.974] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="boxed-delete.avi", cchWideChar=16, lpMultiByteStr=0x1ff88ac, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="boxed-delete.avi", lpUsedDefaultChar=0x0) returned 16 [0048.974] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0048.974] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0048.974] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x7c00 [0048.974] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0048.974] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0048.974] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0048.974] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="boxed-delete.avi", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0048.974] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="boxed-delete.avi", cchWideChar=16, lpMultiByteStr=0x1ff88ac, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="boxed-delete.avi", lpUsedDefaultChar=0x0) returned 16 [0048.974] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="boxed-delete.avi", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0048.974] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="boxed-delete.avi", cchWideChar=16, lpMultiByteStr=0x1ff88fc, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="boxed-delete.avi", lpUsedDefaultChar=0x0) returned 16 [0048.974] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff88fc, cbMultiByte=16, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="boxed-delete.avite.avii@\x01") returned 16 [0048.974] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="boxed-delete.avi", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0048.974] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="boxed-delete.avi", cchWideChar=16, lpMultiByteStr=0x1ff88ac, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="boxed-delete.avi", lpUsedDefaultChar=0x0) returned 16 [0048.975] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0048.975] CharToOemA (in: pSrc="boxed-delete.avi", pDst=0x1ff88fc | out: pDst="boxed-delete.avi") returned 1 [0048.975] WriteFile (in: hFile=0x158, lpBuffer=0x1ff88fc*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1ff88fc*, lpNumberOfBytesWritten=0x18e048*=0x10, lpOverlapped=0x0) returned 1 [0048.975] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0048.975] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0048.976] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0048.976] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=16923909300) returned 1 [0048.976] ReadFile (in: hFile=0x15c, lpBuffer=0x37cff80, nNumberOfBytesToRead=0x7c00, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37cff80*, lpNumberOfBytesRead=0x18dd7c*=0x7c00, lpOverlapped=0x0) returned 1 [0048.977] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0048.977] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=16924068308) returned 1 [0048.986] WriteFile (in: hFile=0x158, lpBuffer=0x1fea258*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fea258*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0048.986] ReadFile (in: hFile=0x15c, lpBuffer=0x37cff80, nNumberOfBytesToRead=0x7c00, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x37cff80*, lpNumberOfBytesRead=0x18de38*=0x7c00, lpOverlapped=0x0) returned 1 [0048.987] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x4b [0048.987] WriteFile (in: hFile=0x158, lpBuffer=0x3817c70*, nNumberOfBytesToWrite=0x7c00, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3817c70*, lpNumberOfBytesWritten=0x18de10*=0x7c00, lpOverlapped=0x0) returned 1 [0048.987] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x7c4b [0048.987] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0048.987] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0048.987] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0048.988] SetFilePointer (in: hFile=0x158, lDistanceToMove=16, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2e [0048.988] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x7c55 [0048.988] CloseHandle (hObject=0x15c) returned 1 [0048.988] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x7c55 [0048.988] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x7c55 [0048.988] SetFilePointer (in: hFile=0x158, lDistanceToMove=31829, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x7c55 [0048.988] SetFilePointer (in: hFile=0x158, lDistanceToMove=31829, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x7c55 [0048.988] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x7c55 [0048.988] SetFilePointer (in: hFile=0x158, lDistanceToMove=31829, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x7c55 [0048.988] SetEndOfFile (hFile=0x158) returned 1 [0048.988] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x7c55 [0048.988] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x7c55 [0048.988] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="boxed-delete.avi", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0048.988] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="boxed-delete.avi", cchWideChar=16, lpMultiByteStr=0x1ff88fc, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="boxed-delete.avi", lpUsedDefaultChar=0x0) returned 16 [0048.988] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="boxed-delete.avi", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0048.988] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="boxed-delete.avi", cchWideChar=16, lpMultiByteStr=0x1ff88ac, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="boxed-delete.avi", lpUsedDefaultChar=0x0) returned 16 [0048.988] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff88ac, cbMultiByte=16, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="boxed-delete.avi\x18믉`믑`") returned 16 [0048.989] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="boxed-delete.avi", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0048.989] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="boxed-delete.avi", cchWideChar=16, lpMultiByteStr=0x1ff88fc, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="boxed-delete.avi", lpUsedDefaultChar=0x0) returned 16 [0048.989] WriteFile (in: hFile=0x158, lpBuffer=0x34e3cf8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x34e3cf8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0048.989] CharToOemA (in: pSrc="boxed-delete.avi", pDst=0x1ff88ac | out: pDst="boxed-delete.avi") returned 1 [0048.989] WriteFile (in: hFile=0x158, lpBuffer=0x1ff88ac*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1ff88ac*, lpNumberOfBytesWritten=0x18efcc*=0x10, lpOverlapped=0x0) returned 1 [0048.989] WriteFile (in: hFile=0x158, lpBuffer=0x1fea128*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea128*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0048.989] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0048.989] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0048.989] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x7c9e [0048.989] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x7c9e [0048.989] WriteFile (in: hFile=0x158, lpBuffer=0x361f5a8*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x361f5a8*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0048.989] WriteFile (in: hFile=0x158, lpBuffer=0x35f011c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f011c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0048.989] DeleteFileW (lpFileName="") returned 0 [0048.989] GetLastError () returned 0x3 [0048.989] GetFileAttributesW (lpFileName="") returned 0xffffffff [0048.989] SetLastError (dwErrCode=0x3) [0048.989] FlushFileBuffers (hFile=0x158) returned 1 [0048.992] GetCurrentThreadId () returned 0x970 [0048.992] GetCurrentThreadId () returned 0x970 [0048.992] GetCurrentThreadId () returned 0x970 [0048.992] GetCurrentThreadId () returned 0x970 [0048.992] GetCurrentThreadId () returned 0x970 [0048.992] GetCurrentThreadId () returned 0x970 [0048.992] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x7d55 [0048.992] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x7d55 [0048.992] SetFilePointer (in: hFile=0x158, lDistanceToMove=32085, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x7d55 [0048.992] CloseHandle (hObject=0x158) returned 1 [0048.993] GetCurrentThreadId () returned 0x970 [0048.993] GetCurrentThreadId () returned 0x970 [0048.993] GetCurrentThreadId () returned 0x970 [0048.993] GetCurrentThreadId () returned 0x970 [0048.993] GetCurrentThreadId () returned 0x970 [0048.993] GetCurrentThreadId () returned 0x970 [0048.993] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\Файл зашифрован [boxed-delete.avi].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\Файл зашифрован [boxed-delete.avi].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0048.994] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7d55 [0048.994] SetFilePointer (in: hFile=0x158, lDistanceToMove=31957, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7cd5 [0048.994] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0048.994] GetFileType (hFile=0x158) returned 0x1 [0048.994] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x38, wMilliseconds=0x124)) [0048.994] GetCurrentThreadId () returned 0x970 [0048.994] GetCurrentThreadId () returned 0x970 [0048.994] GetCurrentThreadId () returned 0x970 [0048.994] GetCurrentThreadId () returned 0x970 [0048.994] GetCurrentThreadId () returned 0x970 [0048.994] GetCurrentThreadId () returned 0x970 [0048.994] GetCurrentThreadId () returned 0x970 [0048.994] GetCurrentThreadId () returned 0x970 [0048.994] GetCurrentThreadId () returned 0x970 [0048.994] GetCurrentThreadId () returned 0x970 [0048.994] GetCurrentThreadId () returned 0x970 [0048.994] GetCurrentThreadId () returned 0x970 [0048.994] GetCurrentThreadId () returned 0x970 [0048.994] GetCurrentThreadId () returned 0x970 [0048.994] GetCurrentThreadId () returned 0x970 [0048.994] GetCurrentThreadId () returned 0x970 [0048.994] GetCurrentThreadId () returned 0x970 [0048.994] GetCurrentThreadId () returned 0x970 [0048.994] GetCurrentThreadId () returned 0x970 [0048.994] GetCurrentThreadId () returned 0x970 [0048.994] GetCurrentThreadId () returned 0x970 [0048.994] GetCurrentThreadId () returned 0x970 [0048.994] GetCurrentThreadId () returned 0x970 [0048.994] GetCurrentThreadId () returned 0x970 [0048.994] GetCurrentThreadId () returned 0x970 [0048.994] GetCurrentThreadId () returned 0x970 [0048.994] GetCurrentThreadId () returned 0x970 [0048.994] GetCurrentThreadId () returned 0x970 [0048.994] GetCurrentThreadId () returned 0x970 [0048.994] GetCurrentThreadId () returned 0x970 [0048.994] GetCurrentThreadId () returned 0x970 [0048.994] GetCurrentThreadId () returned 0x970 [0048.994] GetCurrentThreadId () returned 0x970 [0048.994] GetCurrentThreadId () returned 0x970 [0048.994] GetCurrentThreadId () returned 0x970 [0048.994] GetCurrentThreadId () returned 0x970 [0048.995] GetCurrentThreadId () returned 0x970 [0048.995] GetCurrentThreadId () returned 0x970 [0048.995] GetCurrentThreadId () returned 0x970 [0048.995] GetCurrentThreadId () returned 0x970 [0048.995] GetCurrentThreadId () returned 0x970 [0048.995] GetCurrentThreadId () returned 0x970 [0048.995] GetCurrentThreadId () returned 0x970 [0048.995] GetCurrentThreadId () returned 0x970 [0048.995] GetCurrentThreadId () returned 0x970 [0048.995] GetCurrentThreadId () returned 0x970 [0048.995] GetCurrentThreadId () returned 0x970 [0048.995] GetCurrentThreadId () returned 0x970 [0048.995] GetCurrentThreadId () returned 0x970 [0048.995] GetCurrentThreadId () returned 0x970 [0048.995] GetCurrentThreadId () returned 0x970 [0048.995] GetCurrentThreadId () returned 0x970 [0048.995] GetCurrentThreadId () returned 0x970 [0048.995] GetCurrentThreadId () returned 0x970 [0048.995] GetCurrentThreadId () returned 0x970 [0048.995] GetCurrentThreadId () returned 0x970 [0048.995] GetCurrentThreadId () returned 0x970 [0048.995] GetCurrentThreadId () returned 0x970 [0048.995] GetCurrentThreadId () returned 0x970 [0048.995] GetCurrentThreadId () returned 0x970 [0048.995] GetCurrentThreadId () returned 0x970 [0048.995] GetCurrentThreadId () returned 0x970 [0048.995] GetCurrentThreadId () returned 0x970 [0048.995] GetCurrentThreadId () returned 0x970 [0048.995] GetCurrentThreadId () returned 0x970 [0048.995] GetCurrentThreadId () returned 0x970 [0048.995] GetCurrentThreadId () returned 0x970 [0048.995] GetCurrentThreadId () returned 0x970 [0048.995] GetCurrentThreadId () returned 0x970 [0048.995] GetCurrentThreadId () returned 0x970 [0048.995] GetCurrentThreadId () returned 0x970 [0048.995] GetCurrentThreadId () returned 0x970 [0048.995] GetCurrentThreadId () returned 0x970 [0048.995] GetCurrentThreadId () returned 0x970 [0048.995] GetCurrentThreadId () returned 0x970 [0048.995] GetCurrentThreadId () returned 0x970 [0048.995] GetCurrentThreadId () returned 0x970 [0048.995] GetCurrentThreadId () returned 0x970 [0048.995] GetCurrentThreadId () returned 0x970 [0048.995] GetCurrentThreadId () returned 0x970 [0048.995] GetCurrentThreadId () returned 0x970 [0048.995] GetCurrentThreadId () returned 0x970 [0048.995] GetCurrentThreadId () returned 0x970 [0048.995] GetCurrentThreadId () returned 0x970 [0048.995] GetCurrentThreadId () returned 0x970 [0048.996] GetCurrentThreadId () returned 0x970 [0048.996] GetCurrentThreadId () returned 0x970 [0048.996] GetCurrentThreadId () returned 0x970 [0048.996] GetCurrentThreadId () returned 0x970 [0048.996] GetCurrentThreadId () returned 0x970 [0048.996] GetCurrentThreadId () returned 0x970 [0048.996] GetCurrentThreadId () returned 0x970 [0048.996] GetCurrentThreadId () returned 0x970 [0048.996] GetCurrentThreadId () returned 0x970 [0048.996] GetCurrentThreadId () returned 0x970 [0048.996] GetCurrentThreadId () returned 0x970 [0048.996] GetCurrentThreadId () returned 0x970 [0048.996] GetCurrentThreadId () returned 0x970 [0048.996] GetCurrentThreadId () returned 0x970 [0048.996] GetCurrentThreadId () returned 0x970 [0048.996] GetCurrentThreadId () returned 0x970 [0048.996] GetCurrentThreadId () returned 0x970 [0048.996] GetCurrentThreadId () returned 0x970 [0048.996] GetCurrentThreadId () returned 0x970 [0048.996] GetCurrentThreadId () returned 0x970 [0048.996] GetCurrentThreadId () returned 0x970 [0048.996] GetCurrentThreadId () returned 0x970 [0048.996] GetCurrentThreadId () returned 0x970 [0048.996] GetCurrentThreadId () returned 0x970 [0048.996] GetCurrentThreadId () returned 0x970 [0048.996] GetCurrentThreadId () returned 0x970 [0048.996] GetCurrentThreadId () returned 0x970 [0048.996] GetCurrentThreadId () returned 0x970 [0048.996] GetCurrentThreadId () returned 0x970 [0048.996] GetCurrentThreadId () returned 0x970 [0048.996] GetCurrentThreadId () returned 0x970 [0048.996] GetCurrentThreadId () returned 0x970 [0048.996] GetCurrentThreadId () returned 0x970 [0048.996] GetCurrentThreadId () returned 0x970 [0048.996] GetCurrentThreadId () returned 0x970 [0048.996] GetCurrentThreadId () returned 0x970 [0048.996] GetCurrentThreadId () returned 0x970 [0048.996] GetCurrentThreadId () returned 0x970 [0048.996] GetCurrentThreadId () returned 0x970 [0048.996] GetCurrentThreadId () returned 0x970 [0048.996] GetCurrentThreadId () returned 0x970 [0048.996] GetCurrentThreadId () returned 0x970 [0048.996] GetCurrentThreadId () returned 0x970 [0048.996] GetCurrentThreadId () returned 0x970 [0048.996] GetCurrentThreadId () returned 0x970 [0048.996] GetCurrentThreadId () returned 0x970 [0048.996] GetCurrentThreadId () returned 0x970 [0048.996] GetCurrentThreadId () returned 0x970 [0048.996] GetCurrentThreadId () returned 0x970 [0048.997] GetCurrentThreadId () returned 0x970 [0048.997] GetCurrentThreadId () returned 0x970 [0048.997] GetCurrentThreadId () returned 0x970 [0048.997] GetCurrentThreadId () returned 0x970 [0048.997] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.997] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.997] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb730, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.997] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.997] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.997] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb730, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.997] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.997] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.997] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.997] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.997] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.997] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0048.997] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.997] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.997] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb790, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3Ô­", lpUsedDefaultChar=0x0) returned 10 [0048.997] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.997] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.997] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb790, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3Ô­", lpUsedDefaultChar=0x0) returned 10 [0048.997] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.997] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.997] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb790, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3Ô­", lpUsedDefaultChar=0x0) returned 10 [0048.997] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x38, wMilliseconds=0x124)) [0048.997] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="xcEw.cRi?yA", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0048.997] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="xcEw.cRi?yA", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0048.997] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="xcEw.cRi?yA", cchWideChar=32, lpMultiByteStr=0x2000988, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xcEw.cRi?yA", lpUsedDefaultChar=0x0) returned 32 [0048.997] GetCurrentThreadId () returned 0x970 [0048.997] GetCurrentThreadId () returned 0x970 [0048.997] GetCurrentThreadId () returned 0x970 [0048.997] GetCurrentThreadId () returned 0x970 [0048.998] GetCurrentThreadId () returned 0x970 [0048.998] GetCurrentThreadId () returned 0x970 [0049.005] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0049.005] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0049.005] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x202e0f8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0049.005] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x35904f8, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0049.005] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x35904f8, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAG6Wapz6sOJDBG3K9WW8TMRzH+rFxekUWjQpCENS1eO/vnPfWBc4wQEHVNrGFfZ3VTePp0d4Dz2gFKqDk6MKLbRy/47HpZZThZTO+YKpRLu4LC053w719b5tRr1f5CuIWPGgFVyKZed9rdFv6GkN8RF3/A0tHzS/zL4Sdr1iUoFyjVztKx6QHTOC4bGqByHvvGWcjvTPCAmtUtYQwbXlMMej9kHXfPnJNQ==") returned 232 [0049.005] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x38, wMilliseconds=0x134)) [0049.005] GetCurrentThreadId () returned 0x970 [0049.005] GetCurrentThreadId () returned 0x970 [0049.005] GetCurrentThreadId () returned 0x970 [0049.005] GetCurrentThreadId () returned 0x970 [0049.005] GetCurrentThreadId () returned 0x970 [0049.005] GetCurrentThreadId () returned 0x970 [0049.005] GetCurrentThreadId () returned 0x970 [0049.005] GetCurrentThreadId () returned 0x970 [0049.005] GetCurrentThreadId () returned 0x970 [0049.005] GetCurrentThreadId () returned 0x970 [0049.005] GetCurrentThreadId () returned 0x970 [0049.005] GetCurrentThreadId () returned 0x970 [0049.005] GetCurrentThreadId () returned 0x970 [0049.005] GetCurrentThreadId () returned 0x970 [0049.005] GetCurrentThreadId () returned 0x970 [0049.005] GetCurrentThreadId () returned 0x970 [0049.005] GetCurrentThreadId () returned 0x970 [0049.005] GetCurrentThreadId () returned 0x970 [0049.005] GetCurrentThreadId () returned 0x970 [0049.005] GetCurrentThreadId () returned 0x970 [0049.005] GetCurrentThreadId () returned 0x970 [0049.005] GetCurrentThreadId () returned 0x970 [0049.005] GetCurrentThreadId () returned 0x970 [0049.005] GetCurrentThreadId () returned 0x970 [0049.005] GetCurrentThreadId () returned 0x970 [0049.005] GetCurrentThreadId () returned 0x970 [0049.005] GetCurrentThreadId () returned 0x970 [0049.005] GetCurrentThreadId () returned 0x970 [0049.005] GetCurrentThreadId () returned 0x970 [0049.005] GetCurrentThreadId () returned 0x970 [0049.005] GetCurrentThreadId () returned 0x970 [0049.005] GetCurrentThreadId () returned 0x970 [0049.005] GetCurrentThreadId () returned 0x970 [0049.005] GetCurrentThreadId () returned 0x970 [0049.006] GetCurrentThreadId () returned 0x970 [0049.006] GetCurrentThreadId () returned 0x970 [0049.006] GetCurrentThreadId () returned 0x970 [0049.006] GetCurrentThreadId () returned 0x970 [0049.006] GetCurrentThreadId () returned 0x970 [0049.006] GetCurrentThreadId () returned 0x970 [0049.006] GetCurrentThreadId () returned 0x970 [0049.006] GetCurrentThreadId () returned 0x970 [0049.006] GetCurrentThreadId () returned 0x970 [0049.006] GetCurrentThreadId () returned 0x970 [0049.006] GetCurrentThreadId () returned 0x970 [0049.006] GetCurrentThreadId () returned 0x970 [0049.006] GetCurrentThreadId () returned 0x970 [0049.006] GetCurrentThreadId () returned 0x970 [0049.006] GetCurrentThreadId () returned 0x970 [0049.006] GetCurrentThreadId () returned 0x970 [0049.006] GetCurrentThreadId () returned 0x970 [0049.006] GetCurrentThreadId () returned 0x970 [0049.006] GetCurrentThreadId () returned 0x970 [0049.006] GetCurrentThreadId () returned 0x970 [0049.006] GetCurrentThreadId () returned 0x970 [0049.006] GetCurrentThreadId () returned 0x970 [0049.006] GetCurrentThreadId () returned 0x970 [0049.006] GetCurrentThreadId () returned 0x970 [0049.006] GetCurrentThreadId () returned 0x970 [0049.006] GetCurrentThreadId () returned 0x970 [0049.006] GetCurrentThreadId () returned 0x970 [0049.006] GetCurrentThreadId () returned 0x970 [0049.006] GetCurrentThreadId () returned 0x970 [0049.006] GetCurrentThreadId () returned 0x970 [0049.006] GetCurrentThreadId () returned 0x970 [0049.006] GetCurrentThreadId () returned 0x970 [0049.006] GetCurrentThreadId () returned 0x970 [0049.006] GetCurrentThreadId () returned 0x970 [0049.006] GetCurrentThreadId () returned 0x970 [0049.006] GetCurrentThreadId () returned 0x970 [0049.006] GetCurrentThreadId () returned 0x970 [0049.006] GetCurrentThreadId () returned 0x970 [0049.006] GetCurrentThreadId () returned 0x970 [0049.006] GetCurrentThreadId () returned 0x970 [0049.006] GetCurrentThreadId () returned 0x970 [0049.006] GetCurrentThreadId () returned 0x970 [0049.006] GetCurrentThreadId () returned 0x970 [0049.006] GetCurrentThreadId () returned 0x970 [0049.006] GetCurrentThreadId () returned 0x970 [0049.006] GetCurrentThreadId () returned 0x970 [0049.006] GetCurrentThreadId () returned 0x970 [0049.007] GetCurrentThreadId () returned 0x970 [0049.007] GetCurrentThreadId () returned 0x970 [0049.007] GetCurrentThreadId () returned 0x970 [0049.007] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAG6Wapz6sOJDBG3K9WW8TMRzH+rFxekUWjQpCENS1eO/vnPfWBc4wQEHVNrGFfZ3VTePp0d4Dz2gFKqDk6MKLbRy/47HpZZThZTO+YKpRLu4LC053w719b5tRr1f5CuIWPGgFVyKZed9rdFv6GkN8RF3/A0tHzS/zL4Sdr1iUoFyjVztKx6QHTOC4bGqByHvvGWcjvTPCAmtUtYQwbXlMMej9kHXfPnJNQ==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0049.007] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAG6Wapz6sOJDBG3K9WW8TMRzH+rFxekUWjQpCENS1eO/vnPfWBc4wQEHVNrGFfZ3VTePp0d4Dz2gFKqDk6MKLbRy/47HpZZThZTO+YKpRLu4LC053w719b5tRr1f5CuIWPGgFVyKZed9rdFv6GkN8RF3/A0tHzS/zL4Sdr1iUoFyjVztKx6QHTOC4bGqByHvvGWcjvTPCAmtUtYQwbXlMMej9kHXfPnJNQ==", cchWideChar=245, lpMultiByteStr=0x353900c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAG6Wapz6sOJDBG3K9WW8TMRzH+rFxekUWjQpCENS1eO/vnPfWBc4wQEHVNrGFfZ3VTePp0d4Dz2gFKqDk6MKLbRy/47HpZZThZTO+YKpRLu4LC053w719b5tRr1f5CuIWPGgFVyKZed9rdFv6GkN8RF3/A0tHzS/zL4Sdr1iUoFyjVztKx6QHTOC4bGqByHvvGWcjvTPCAmtUtYQwbXlMMej9kHXfPnJNQ==", lpUsedDefaultChar=0x0) returned 245 [0049.007] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0049.007] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0049.007] CloseHandle (hObject=0x158) returned 1 [0049.008] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0 [0049.008] GetLastError () returned 0x5 [0049.008] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0049.008] SetLastError (dwErrCode=0x5) [0049.008] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=16927129159) returned 1 [0049.008] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\Файл зашифрован [boxed-join.avi].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\Файл зашифрован [boxed-join.avi].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0049.008] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0049.008] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0049.008] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0049.008] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0049.008] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0049.008] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0049.009] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0049.009] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0049.009] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0049.009] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0049.009] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0049.009] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0049.009] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0049.009] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0049.009] SetEndOfFile (hFile=0x158) returned 1 [0049.009] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0049.009] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0049.009] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0049.009] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0049.009] WriteFile (in: hFile=0x158, lpBuffer=0x361f5a8*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x361f5a8*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0049.010] WriteFile (in: hFile=0x158, lpBuffer=0x35f005c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f005c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0049.010] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o42n+l?*d5H0=Y5Z^fiDhcqROS*29Td<", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0049.010] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o42n+l?*d5H0=Y5Z^fiDhcqROS*29Td<", cchWideChar=32, lpMultiByteStr=0x2032c54, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="o42n+l?*d5H0=Y5Z^fiDhcqROS*29Td<", lpUsedDefaultChar=0x0) returned 32 [0049.010] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0049.010] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0049.010] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23d9f3d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x23d9f3d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a4c5f1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x8200, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-join.avi", cAlternateFileName="")) returned 0x295098 [0049.011] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0049.011] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0049.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0049.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0049.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0049.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0049.011] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23d9f3d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x23d9f3d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a4c5f1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x8200)) returned 1 [0049.011] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0049.011] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0049.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0049.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0049.011] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0049.011] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0049.011] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0049.011] SetEndOfFile (hFile=0x158) returned 1 [0049.012] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="boxed-join.avi", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0049.012] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="boxed-join.avi", cchWideChar=14, lpMultiByteStr=0x1fe410c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="boxed-join.avi", lpUsedDefaultChar=0x0) returned 14 [0049.012] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="boxed-join.avi", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0049.012] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="boxed-join.avi", cchWideChar=14, lpMultiByteStr=0x1fe384c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="boxed-join.avi", lpUsedDefaultChar=0x0) returned 14 [0049.012] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe384c, cbMultiByte=14, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="boxed-join.avivii@\x01") returned 14 [0049.012] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="boxed-join.avi", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0049.012] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="boxed-join.avi", cchWideChar=14, lpMultiByteStr=0x1fe410c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="boxed-join.avi", lpUsedDefaultChar=0x0) returned 14 [0049.012] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0049.012] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0049.013] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x8200 [0049.013] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0049.013] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0049.013] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0049.013] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="boxed-join.avi", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0049.013] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="boxed-join.avi", cchWideChar=14, lpMultiByteStr=0x1fe410c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="boxed-join.avi", lpUsedDefaultChar=0x0) returned 14 [0049.013] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="boxed-join.avi", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0049.013] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="boxed-join.avi", cchWideChar=14, lpMultiByteStr=0x1fe384c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="boxed-join.avi", lpUsedDefaultChar=0x0) returned 14 [0049.013] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe384c, cbMultiByte=14, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="boxed-join.aviin.avivii@\x01") returned 14 [0049.013] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="boxed-join.avi", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0049.013] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="boxed-join.avi", cchWideChar=14, lpMultiByteStr=0x1fe410c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="boxed-join.avi", lpUsedDefaultChar=0x0) returned 14 [0049.013] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0049.014] CharToOemA (in: pSrc="boxed-join.avi", pDst=0x1fe384c | out: pDst="boxed-join.avi") returned 1 [0049.014] WriteFile (in: hFile=0x158, lpBuffer=0x1fe384c*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe384c*, lpNumberOfBytesWritten=0x18e048*=0xe, lpOverlapped=0x0) returned 1 [0049.014] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0049.014] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0049.014] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0049.014] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=16927783926) returned 1 [0049.014] ReadFile (in: hFile=0x15c, lpBuffer=0x37cff80, nNumberOfBytesToRead=0x8200, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37cff80*, lpNumberOfBytesRead=0x18dd7c*=0x8200, lpOverlapped=0x0) returned 1 [0049.016] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0049.016] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=16927951616) returned 1 [0049.024] WriteFile (in: hFile=0x158, lpBuffer=0x1fea378*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fea378*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0049.024] ReadFile (in: hFile=0x15c, lpBuffer=0x37cff80, nNumberOfBytesToRead=0x8200, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x37cff80*, lpNumberOfBytesRead=0x18de38*=0x8200, lpOverlapped=0x0) returned 1 [0049.025] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x49 [0049.025] WriteFile (in: hFile=0x158, lpBuffer=0x3818270*, nNumberOfBytesToWrite=0x8200, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3818270*, lpNumberOfBytesWritten=0x18de10*=0x8200, lpOverlapped=0x0) returned 1 [0049.026] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x8249 [0049.026] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0049.026] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0049.026] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0049.026] SetFilePointer (in: hFile=0x158, lDistanceToMove=14, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2c [0049.026] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x8253 [0049.026] CloseHandle (hObject=0x15c) returned 1 [0049.027] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x8253 [0049.027] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x8253 [0049.027] SetFilePointer (in: hFile=0x158, lDistanceToMove=33363, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x8253 [0049.027] SetFilePointer (in: hFile=0x158, lDistanceToMove=33363, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x8253 [0049.027] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x8253 [0049.027] SetFilePointer (in: hFile=0x158, lDistanceToMove=33363, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x8253 [0049.027] SetEndOfFile (hFile=0x158) returned 1 [0049.027] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x8253 [0049.027] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x8253 [0049.027] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="boxed-join.avi", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0049.027] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="boxed-join.avi", cchWideChar=14, lpMultiByteStr=0x1fe410c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="boxed-join.avi", lpUsedDefaultChar=0x0) returned 14 [0049.027] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="boxed-join.avi", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0049.027] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="boxed-join.avi", cchWideChar=14, lpMultiByteStr=0x1fe36cc, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="boxed-join.avi", lpUsedDefaultChar=0x0) returned 14 [0049.027] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe36cc, cbMultiByte=14, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="boxed-join.avi야'\x18믉`믑`") returned 14 [0049.027] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="boxed-join.avi", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0049.027] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="boxed-join.avi", cchWideChar=14, lpMultiByteStr=0x1fe410c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="boxed-join.avi", lpUsedDefaultChar=0x0) returned 14 [0049.027] WriteFile (in: hFile=0x158, lpBuffer=0x34e3cf8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x34e3cf8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0049.028] CharToOemA (in: pSrc="boxed-join.avi", pDst=0x1fe36cc | out: pDst="boxed-join.avi") returned 1 [0049.028] WriteFile (in: hFile=0x158, lpBuffer=0x1fe36cc*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe36cc*, lpNumberOfBytesWritten=0x18efcc*=0xe, lpOverlapped=0x0) returned 1 [0049.028] WriteFile (in: hFile=0x158, lpBuffer=0x1fea2d8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea2d8*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0049.028] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0049.028] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0049.028] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x829a [0049.028] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x829a [0049.028] WriteFile (in: hFile=0x158, lpBuffer=0x361f5a8*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x361f5a8*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0049.028] WriteFile (in: hFile=0x158, lpBuffer=0x35f005c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f005c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0049.028] DeleteFileW (lpFileName="") returned 0 [0049.028] GetLastError () returned 0x3 [0049.028] GetFileAttributesW (lpFileName="") returned 0xffffffff [0049.028] SetLastError (dwErrCode=0x3) [0049.028] FlushFileBuffers (hFile=0x158) returned 1 [0049.032] GetCurrentThreadId () returned 0x970 [0049.032] GetCurrentThreadId () returned 0x970 [0049.032] GetCurrentThreadId () returned 0x970 [0049.032] GetCurrentThreadId () returned 0x970 [0049.032] GetCurrentThreadId () returned 0x970 [0049.032] GetCurrentThreadId () returned 0x970 [0049.032] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x8351 [0049.032] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x8351 [0049.032] SetFilePointer (in: hFile=0x158, lDistanceToMove=33617, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x8351 [0049.032] CloseHandle (hObject=0x158) returned 1 [0049.033] GetCurrentThreadId () returned 0x970 [0049.033] GetCurrentThreadId () returned 0x970 [0049.033] GetCurrentThreadId () returned 0x970 [0049.033] GetCurrentThreadId () returned 0x970 [0049.033] GetCurrentThreadId () returned 0x970 [0049.033] GetCurrentThreadId () returned 0x970 [0049.033] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\Файл зашифрован [boxed-join.avi].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\Файл зашифрован [boxed-join.avi].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0049.033] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8351 [0049.033] SetFilePointer (in: hFile=0x158, lDistanceToMove=33489, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x82d1 [0049.033] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0049.033] GetFileType (hFile=0x158) returned 0x1 [0049.033] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x38, wMilliseconds=0x153)) [0049.034] GetCurrentThreadId () returned 0x970 [0049.034] GetCurrentThreadId () returned 0x970 [0049.034] GetCurrentThreadId () returned 0x970 [0049.034] GetCurrentThreadId () returned 0x970 [0049.034] GetCurrentThreadId () returned 0x970 [0049.034] GetCurrentThreadId () returned 0x970 [0049.034] GetCurrentThreadId () returned 0x970 [0049.034] GetCurrentThreadId () returned 0x970 [0049.034] GetCurrentThreadId () returned 0x970 [0049.034] GetCurrentThreadId () returned 0x970 [0049.034] GetCurrentThreadId () returned 0x970 [0049.034] GetCurrentThreadId () returned 0x970 [0049.034] GetCurrentThreadId () returned 0x970 [0049.034] GetCurrentThreadId () returned 0x970 [0049.034] GetCurrentThreadId () returned 0x970 [0049.034] GetCurrentThreadId () returned 0x970 [0049.034] GetCurrentThreadId () returned 0x970 [0049.034] GetCurrentThreadId () returned 0x970 [0049.034] GetCurrentThreadId () returned 0x970 [0049.034] GetCurrentThreadId () returned 0x970 [0049.034] GetCurrentThreadId () returned 0x970 [0049.034] GetCurrentThreadId () returned 0x970 [0049.034] GetCurrentThreadId () returned 0x970 [0049.034] GetCurrentThreadId () returned 0x970 [0049.034] GetCurrentThreadId () returned 0x970 [0049.034] GetCurrentThreadId () returned 0x970 [0049.034] GetCurrentThreadId () returned 0x970 [0049.034] GetCurrentThreadId () returned 0x970 [0049.034] GetCurrentThreadId () returned 0x970 [0049.034] GetCurrentThreadId () returned 0x970 [0049.034] GetCurrentThreadId () returned 0x970 [0049.034] GetCurrentThreadId () returned 0x970 [0049.034] GetCurrentThreadId () returned 0x970 [0049.034] GetCurrentThreadId () returned 0x970 [0049.034] GetCurrentThreadId () returned 0x970 [0049.034] GetCurrentThreadId () returned 0x970 [0049.034] GetCurrentThreadId () returned 0x970 [0049.034] GetCurrentThreadId () returned 0x970 [0049.034] GetCurrentThreadId () returned 0x970 [0049.034] GetCurrentThreadId () returned 0x970 [0049.034] GetCurrentThreadId () returned 0x970 [0049.034] GetCurrentThreadId () returned 0x970 [0049.034] GetCurrentThreadId () returned 0x970 [0049.034] GetCurrentThreadId () returned 0x970 [0049.034] GetCurrentThreadId () returned 0x970 [0049.034] GetCurrentThreadId () returned 0x970 [0049.034] GetCurrentThreadId () returned 0x970 [0049.035] GetCurrentThreadId () returned 0x970 [0049.035] GetCurrentThreadId () returned 0x970 [0049.035] GetCurrentThreadId () returned 0x970 [0049.035] GetCurrentThreadId () returned 0x970 [0049.035] GetCurrentThreadId () returned 0x970 [0049.035] GetCurrentThreadId () returned 0x970 [0049.035] GetCurrentThreadId () returned 0x970 [0049.035] GetCurrentThreadId () returned 0x970 [0049.035] GetCurrentThreadId () returned 0x970 [0049.035] GetCurrentThreadId () returned 0x970 [0049.035] GetCurrentThreadId () returned 0x970 [0049.035] GetCurrentThreadId () returned 0x970 [0049.035] GetCurrentThreadId () returned 0x970 [0049.035] GetCurrentThreadId () returned 0x970 [0049.035] GetCurrentThreadId () returned 0x970 [0049.035] GetCurrentThreadId () returned 0x970 [0049.035] GetCurrentThreadId () returned 0x970 [0049.035] GetCurrentThreadId () returned 0x970 [0049.035] GetCurrentThreadId () returned 0x970 [0049.035] GetCurrentThreadId () returned 0x970 [0049.035] GetCurrentThreadId () returned 0x970 [0049.035] GetCurrentThreadId () returned 0x970 [0049.035] GetCurrentThreadId () returned 0x970 [0049.035] GetCurrentThreadId () returned 0x970 [0049.035] GetCurrentThreadId () returned 0x970 [0049.035] GetCurrentThreadId () returned 0x970 [0049.035] GetCurrentThreadId () returned 0x970 [0049.035] GetCurrentThreadId () returned 0x970 [0049.035] GetCurrentThreadId () returned 0x970 [0049.035] GetCurrentThreadId () returned 0x970 [0049.035] GetCurrentThreadId () returned 0x970 [0049.035] GetCurrentThreadId () returned 0x970 [0049.035] GetCurrentThreadId () returned 0x970 [0049.035] GetCurrentThreadId () returned 0x970 [0049.035] GetCurrentThreadId () returned 0x970 [0049.035] GetCurrentThreadId () returned 0x970 [0049.035] GetCurrentThreadId () returned 0x970 [0049.035] GetCurrentThreadId () returned 0x970 [0049.035] GetCurrentThreadId () returned 0x970 [0049.035] GetCurrentThreadId () returned 0x970 [0049.035] GetCurrentThreadId () returned 0x970 [0049.035] GetCurrentThreadId () returned 0x970 [0049.035] GetCurrentThreadId () returned 0x970 [0049.035] GetCurrentThreadId () returned 0x970 [0049.035] GetCurrentThreadId () returned 0x970 [0049.035] GetCurrentThreadId () returned 0x970 [0049.035] GetCurrentThreadId () returned 0x970 [0049.035] GetCurrentThreadId () returned 0x970 [0049.035] GetCurrentThreadId () returned 0x970 [0049.036] GetCurrentThreadId () returned 0x970 [0049.036] GetCurrentThreadId () returned 0x970 [0049.036] GetCurrentThreadId () returned 0x970 [0049.036] GetCurrentThreadId () returned 0x970 [0049.036] GetCurrentThreadId () returned 0x970 [0049.036] GetCurrentThreadId () returned 0x970 [0049.036] GetCurrentThreadId () returned 0x970 [0049.036] GetCurrentThreadId () returned 0x970 [0049.036] GetCurrentThreadId () returned 0x970 [0049.036] GetCurrentThreadId () returned 0x970 [0049.036] GetCurrentThreadId () returned 0x970 [0049.036] GetCurrentThreadId () returned 0x970 [0049.036] GetCurrentThreadId () returned 0x970 [0049.036] GetCurrentThreadId () returned 0x970 [0049.036] GetCurrentThreadId () returned 0x970 [0049.036] GetCurrentThreadId () returned 0x970 [0049.036] GetCurrentThreadId () returned 0x970 [0049.036] GetCurrentThreadId () returned 0x970 [0049.036] GetCurrentThreadId () returned 0x970 [0049.036] GetCurrentThreadId () returned 0x970 [0049.036] GetCurrentThreadId () returned 0x970 [0049.036] GetCurrentThreadId () returned 0x970 [0049.036] GetCurrentThreadId () returned 0x970 [0049.036] GetCurrentThreadId () returned 0x970 [0049.036] GetCurrentThreadId () returned 0x970 [0049.036] GetCurrentThreadId () returned 0x970 [0049.036] GetCurrentThreadId () returned 0x970 [0049.036] GetCurrentThreadId () returned 0x970 [0049.036] GetCurrentThreadId () returned 0x970 [0049.036] GetCurrentThreadId () returned 0x970 [0049.036] GetCurrentThreadId () returned 0x970 [0049.036] GetCurrentThreadId () returned 0x970 [0049.036] GetCurrentThreadId () returned 0x970 [0049.036] GetCurrentThreadId () returned 0x970 [0049.036] GetCurrentThreadId () returned 0x970 [0049.036] GetCurrentThreadId () returned 0x970 [0049.036] GetCurrentThreadId () returned 0x970 [0049.036] GetCurrentThreadId () returned 0x970 [0049.036] GetCurrentThreadId () returned 0x970 [0049.036] GetCurrentThreadId () returned 0x970 [0049.036] GetCurrentThreadId () returned 0x970 [0049.036] GetCurrentThreadId () returned 0x970 [0049.036] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.036] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.036] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb790, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.036] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.036] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.036] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb790, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.037] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.037] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.037] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.037] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.037] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.037] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.037] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.037] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.037] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb7f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.037] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.037] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.037] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb7f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.037] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.037] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.037] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb7f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.037] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x38, wMilliseconds=0x153)) [0049.037] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="o42n+l?*d5H0=Y5Z^fiDhcqROS*29Td<", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0049.037] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="o42n+l?*d5H0=Y5Z^fiDhcqROS*29Td<", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0049.037] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="o42n+l?*d5H0=Y5Z^fiDhcqROS*29Td<", cchWideChar=32, lpMultiByteStr=0x2000a18, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="o42n+l?*d5H0=Y5Z^fiDhcqROS*29Td<", lpUsedDefaultChar=0x0) returned 32 [0049.037] GetCurrentThreadId () returned 0x970 [0049.037] GetCurrentThreadId () returned 0x970 [0049.037] GetCurrentThreadId () returned 0x970 [0049.037] GetCurrentThreadId () returned 0x970 [0049.037] GetCurrentThreadId () returned 0x970 [0049.037] GetCurrentThreadId () returned 0x970 [0049.045] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0049.045] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0049.045] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x202e1e8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0049.045] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x35904f8, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0049.045] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x35904f8, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAHE0ah9Z9Jj3Qbz2i9pMRDKLjWp6OYKHqiZ0doAOa4x9lDsUx3x+T5G6rD/3x6pX4U8nWtLwMMuPE10CwUMsWbj+EuBMK8wLPFXj+kFTaOdUuUlpNIRC+o5NgCOBM/+lanB+kwnHrzbZq1BSuR8nVsFKk352zvoSPMZWIjWQet3+p8kpTgV84mo2meQEz4sPDQjWmyAHMaMJ8H+dlPG6Md3u7D2PXOPglw==") returned 232 [0049.045] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x38, wMilliseconds=0x163)) [0049.045] GetCurrentThreadId () returned 0x970 [0049.045] GetCurrentThreadId () returned 0x970 [0049.045] GetCurrentThreadId () returned 0x970 [0049.045] GetCurrentThreadId () returned 0x970 [0049.045] GetCurrentThreadId () returned 0x970 [0049.045] GetCurrentThreadId () returned 0x970 [0049.045] GetCurrentThreadId () returned 0x970 [0049.045] GetCurrentThreadId () returned 0x970 [0049.045] GetCurrentThreadId () returned 0x970 [0049.045] GetCurrentThreadId () returned 0x970 [0049.045] GetCurrentThreadId () returned 0x970 [0049.045] GetCurrentThreadId () returned 0x970 [0049.045] GetCurrentThreadId () returned 0x970 [0049.045] GetCurrentThreadId () returned 0x970 [0049.045] GetCurrentThreadId () returned 0x970 [0049.045] GetCurrentThreadId () returned 0x970 [0049.046] GetCurrentThreadId () returned 0x970 [0049.046] GetCurrentThreadId () returned 0x970 [0049.046] GetCurrentThreadId () returned 0x970 [0049.046] GetCurrentThreadId () returned 0x970 [0049.046] GetCurrentThreadId () returned 0x970 [0049.046] GetCurrentThreadId () returned 0x970 [0049.046] GetCurrentThreadId () returned 0x970 [0049.046] GetCurrentThreadId () returned 0x970 [0049.046] GetCurrentThreadId () returned 0x970 [0049.046] GetCurrentThreadId () returned 0x970 [0049.046] GetCurrentThreadId () returned 0x970 [0049.046] GetCurrentThreadId () returned 0x970 [0049.046] GetCurrentThreadId () returned 0x970 [0049.046] GetCurrentThreadId () returned 0x970 [0049.046] GetCurrentThreadId () returned 0x970 [0049.046] GetCurrentThreadId () returned 0x970 [0049.046] GetCurrentThreadId () returned 0x970 [0049.046] GetCurrentThreadId () returned 0x970 [0049.046] GetCurrentThreadId () returned 0x970 [0049.046] GetCurrentThreadId () returned 0x970 [0049.046] GetCurrentThreadId () returned 0x970 [0049.046] GetCurrentThreadId () returned 0x970 [0049.046] GetCurrentThreadId () returned 0x970 [0049.046] GetCurrentThreadId () returned 0x970 [0049.046] GetCurrentThreadId () returned 0x970 [0049.046] GetCurrentThreadId () returned 0x970 [0049.046] GetCurrentThreadId () returned 0x970 [0049.046] GetCurrentThreadId () returned 0x970 [0049.046] GetCurrentThreadId () returned 0x970 [0049.046] GetCurrentThreadId () returned 0x970 [0049.046] GetCurrentThreadId () returned 0x970 [0049.046] GetCurrentThreadId () returned 0x970 [0049.046] GetCurrentThreadId () returned 0x970 [0049.046] GetCurrentThreadId () returned 0x970 [0049.046] GetCurrentThreadId () returned 0x970 [0049.046] GetCurrentThreadId () returned 0x970 [0049.046] GetCurrentThreadId () returned 0x970 [0049.046] GetCurrentThreadId () returned 0x970 [0049.046] GetCurrentThreadId () returned 0x970 [0049.046] GetCurrentThreadId () returned 0x970 [0049.046] GetCurrentThreadId () returned 0x970 [0049.046] GetCurrentThreadId () returned 0x970 [0049.046] GetCurrentThreadId () returned 0x970 [0049.046] GetCurrentThreadId () returned 0x970 [0049.046] GetCurrentThreadId () returned 0x970 [0049.046] GetCurrentThreadId () returned 0x970 [0049.046] GetCurrentThreadId () returned 0x970 [0049.047] GetCurrentThreadId () returned 0x970 [0049.047] GetCurrentThreadId () returned 0x970 [0049.047] GetCurrentThreadId () returned 0x970 [0049.047] GetCurrentThreadId () returned 0x970 [0049.047] GetCurrentThreadId () returned 0x970 [0049.047] GetCurrentThreadId () returned 0x970 [0049.047] GetCurrentThreadId () returned 0x970 [0049.047] GetCurrentThreadId () returned 0x970 [0049.047] GetCurrentThreadId () returned 0x970 [0049.047] GetCurrentThreadId () returned 0x970 [0049.047] GetCurrentThreadId () returned 0x970 [0049.047] GetCurrentThreadId () returned 0x970 [0049.047] GetCurrentThreadId () returned 0x970 [0049.047] GetCurrentThreadId () returned 0x970 [0049.047] GetCurrentThreadId () returned 0x970 [0049.047] GetCurrentThreadId () returned 0x970 [0049.047] GetCurrentThreadId () returned 0x970 [0049.047] GetCurrentThreadId () returned 0x970 [0049.047] GetCurrentThreadId () returned 0x970 [0049.047] GetCurrentThreadId () returned 0x970 [0049.047] GetCurrentThreadId () returned 0x970 [0049.047] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAHE0ah9Z9Jj3Qbz2i9pMRDKLjWp6OYKHqiZ0doAOa4x9lDsUx3x+T5G6rD/3x6pX4U8nWtLwMMuPE10CwUMsWbj+EuBMK8wLPFXj+kFTaOdUuUlpNIRC+o5NgCOBM/+lanB+kwnHrzbZq1BSuR8nVsFKk352zvoSPMZWIjWQet3+p8kpTgV84mo2meQEz4sPDQjWmyAHMaMJ8H+dlPG6Md3u7D2PXOPglw==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0049.047] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAHE0ah9Z9Jj3Qbz2i9pMRDKLjWp6OYKHqiZ0doAOa4x9lDsUx3x+T5G6rD/3x6pX4U8nWtLwMMuPE10CwUMsWbj+EuBMK8wLPFXj+kFTaOdUuUlpNIRC+o5NgCOBM/+lanB+kwnHrzbZq1BSuR8nVsFKk352zvoSPMZWIjWQet3+p8kpTgV84mo2meQEz4sPDQjWmyAHMaMJ8H+dlPG6Md3u7D2PXOPglw==", cchWideChar=245, lpMultiByteStr=0x353900c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAHE0ah9Z9Jj3Qbz2i9pMRDKLjWp6OYKHqiZ0doAOa4x9lDsUx3x+T5G6rD/3x6pX4U8nWtLwMMuPE10CwUMsWbj+EuBMK8wLPFXj+kFTaOdUuUlpNIRC+o5NgCOBM/+lanB+kwnHrzbZq1BSuR8nVsFKk352zvoSPMZWIjWQet3+p8kpTgV84mo2meQEz4sPDQjWmyAHMaMJ8H+dlPG6Md3u7D2PXOPglw==", lpUsedDefaultChar=0x0) returned 245 [0049.047] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0049.047] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0049.047] CloseHandle (hObject=0x158) returned 1 [0049.048] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0 [0049.048] GetLastError () returned 0x5 [0049.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0049.048] SetLastError (dwErrCode=0x5) [0049.048] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=16931164317) returned 1 [0049.048] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\Файл зашифрован [boxed-split.avi].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\Файл зашифрован [boxed-split.avi].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0049.049] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0049.049] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0049.049] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0049.049] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0049.049] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0049.049] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0049.049] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0049.049] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0049.049] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0049.049] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0049.049] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0049.049] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0049.049] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0049.049] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0049.049] SetEndOfFile (hFile=0x158) returned 1 [0049.050] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0049.050] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0049.050] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0049.050] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0049.050] WriteFile (in: hFile=0x158, lpBuffer=0x361f6e8*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x361f6e8*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0049.051] WriteFile (in: hFile=0x158, lpBuffer=0x35f011c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f011c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0049.051] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="gH6kH?sp+w9qrdLU:,Mnh~i^WwH\\ERQ{", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0049.051] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="gH6kH?sp+w9qrdLU:,Mnh~i^WwH\\ERQ{", cchWideChar=32, lpMultiByteStr=0x2032c1c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gH6kH?sp+w9qrdLU:,Mnh~i^WwH\\ERQ{", lpUsedDefaultChar=0x0) returned 32 [0049.051] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0049.051] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0049.051] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24261f7, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x24261f7, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a538339, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf600, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-split.avi", cAlternateFileName="")) returned 0x295098 [0049.051] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0049.051] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0049.051] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0049.051] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0049.051] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0049.051] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0049.051] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24261f7, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x24261f7, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a538339, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf600)) returned 1 [0049.051] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0049.051] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0049.051] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0049.051] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0049.052] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0049.052] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0049.052] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0049.052] SetEndOfFile (hFile=0x158) returned 1 [0049.052] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="boxed-split.avi", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0049.052] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="boxed-split.avi", cchWideChar=15, lpMultiByteStr=0x1fe3aac, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="boxed-split.avi", lpUsedDefaultChar=0x0) returned 15 [0049.053] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="boxed-split.avi", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0049.053] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="boxed-split.avi", cchWideChar=15, lpMultiByteStr=0x1fe358c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="boxed-split.avi", lpUsedDefaultChar=0x0) returned 15 [0049.053] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe358c, cbMultiByte=15, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="boxed-split.aviii@\x01") returned 15 [0049.053] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="boxed-split.avi", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0049.053] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="boxed-split.avi", cchWideChar=15, lpMultiByteStr=0x1fe3aac, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="boxed-split.avi", lpUsedDefaultChar=0x0) returned 15 [0049.053] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0049.053] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0049.053] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0xf600 [0049.053] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0049.053] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0049.053] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0049.053] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="boxed-split.avi", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0049.053] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="boxed-split.avi", cchWideChar=15, lpMultiByteStr=0x1fe3aac, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="boxed-split.avi", lpUsedDefaultChar=0x0) returned 15 [0049.053] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="boxed-split.avi", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0049.053] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="boxed-split.avi", cchWideChar=15, lpMultiByteStr=0x1fe358c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="boxed-split.avi", lpUsedDefaultChar=0x0) returned 15 [0049.053] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe358c, cbMultiByte=15, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="boxed-split.aviit.aviii@\x01") returned 15 [0049.053] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="boxed-split.avi", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0049.053] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="boxed-split.avi", cchWideChar=15, lpMultiByteStr=0x1fe3aac, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="boxed-split.avi", lpUsedDefaultChar=0x0) returned 15 [0049.053] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0049.054] CharToOemA (in: pSrc="boxed-split.avi", pDst=0x1fe358c | out: pDst="boxed-split.avi") returned 1 [0049.054] WriteFile (in: hFile=0x158, lpBuffer=0x1fe358c*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe358c*, lpNumberOfBytesWritten=0x18e048*=0xf, lpOverlapped=0x0) returned 1 [0049.054] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0049.054] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0049.055] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0049.055] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=16931810855) returned 1 [0049.055] ReadFile (in: hFile=0x15c, lpBuffer=0x37cff80, nNumberOfBytesToRead=0xf600, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37cff80*, lpNumberOfBytesRead=0x18dd7c*=0xf600, lpOverlapped=0x0) returned 1 [0049.056] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0049.057] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=16932000322) returned 1 [0049.065] WriteFile (in: hFile=0x158, lpBuffer=0x1fea2e8*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fea2e8*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0049.065] ReadFile (in: hFile=0x15c, lpBuffer=0x37cff80, nNumberOfBytesToRead=0xf600, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x37cff80*, lpNumberOfBytesRead=0x18de38*=0xf600, lpOverlapped=0x0) returned 1 [0049.067] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x4a [0049.067] WriteFile (in: hFile=0x158, lpBuffer=0x381f670*, nNumberOfBytesToWrite=0xf600, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x381f670*, lpNumberOfBytesWritten=0x18de10*=0xf600, lpOverlapped=0x0) returned 1 [0049.068] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0xf64a [0049.068] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0049.068] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0049.068] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0049.068] SetFilePointer (in: hFile=0x158, lDistanceToMove=15, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2d [0049.068] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0xf654 [0049.068] CloseHandle (hObject=0x15c) returned 1 [0049.068] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xf654 [0049.068] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xf654 [0049.068] SetFilePointer (in: hFile=0x158, lDistanceToMove=63060, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xf654 [0049.068] SetFilePointer (in: hFile=0x158, lDistanceToMove=63060, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0xf654 [0049.068] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xf654 [0049.069] SetFilePointer (in: hFile=0x158, lDistanceToMove=63060, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0xf654 [0049.069] SetEndOfFile (hFile=0x158) returned 1 [0049.069] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xf654 [0049.069] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xf654 [0049.069] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="boxed-split.avi", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0049.069] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="boxed-split.avi", cchWideChar=15, lpMultiByteStr=0x1fe3aac, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="boxed-split.avi", lpUsedDefaultChar=0x0) returned 15 [0049.069] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="boxed-split.avi", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0049.069] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="boxed-split.avi", cchWideChar=15, lpMultiByteStr=0x1fe368c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="boxed-split.avi", lpUsedDefaultChar=0x0) returned 15 [0049.069] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe368c, cbMultiByte=15, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="boxed-split.avi'\x18믉`믑`") returned 15 [0049.069] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="boxed-split.avi", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0049.069] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="boxed-split.avi", cchWideChar=15, lpMultiByteStr=0x1fe3aac, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="boxed-split.avi", lpUsedDefaultChar=0x0) returned 15 [0049.069] WriteFile (in: hFile=0x158, lpBuffer=0x34e3cf8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x34e3cf8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0049.069] CharToOemA (in: pSrc="boxed-split.avi", pDst=0x1fe368c | out: pDst="boxed-split.avi") returned 1 [0049.069] WriteFile (in: hFile=0x158, lpBuffer=0x1fe368c*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe368c*, lpNumberOfBytesWritten=0x18efcc*=0xf, lpOverlapped=0x0) returned 1 [0049.069] WriteFile (in: hFile=0x158, lpBuffer=0x1fea428*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea428*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0049.069] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0049.070] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0049.070] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xf69c [0049.070] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xf69c [0049.070] WriteFile (in: hFile=0x158, lpBuffer=0x361f6e8*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x361f6e8*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0049.070] WriteFile (in: hFile=0x158, lpBuffer=0x35f011c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f011c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0049.070] DeleteFileW (lpFileName="") returned 0 [0049.070] GetLastError () returned 0x3 [0049.070] GetFileAttributesW (lpFileName="") returned 0xffffffff [0049.070] SetLastError (dwErrCode=0x3) [0049.070] FlushFileBuffers (hFile=0x158) returned 1 [0049.072] GetCurrentThreadId () returned 0x970 [0049.072] GetCurrentThreadId () returned 0x970 [0049.072] GetCurrentThreadId () returned 0x970 [0049.072] GetCurrentThreadId () returned 0x970 [0049.072] GetCurrentThreadId () returned 0x970 [0049.072] GetCurrentThreadId () returned 0x970 [0049.072] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xf753 [0049.072] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xf753 [0049.072] SetFilePointer (in: hFile=0x158, lDistanceToMove=63315, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xf753 [0049.072] CloseHandle (hObject=0x158) returned 1 [0049.074] GetCurrentThreadId () returned 0x970 [0049.074] GetCurrentThreadId () returned 0x970 [0049.074] GetCurrentThreadId () returned 0x970 [0049.074] GetCurrentThreadId () returned 0x970 [0049.074] GetCurrentThreadId () returned 0x970 [0049.074] GetCurrentThreadId () returned 0x970 [0049.074] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\Файл зашифрован [boxed-split.avi].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\Файл зашифрован [boxed-split.avi].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0049.074] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf753 [0049.074] SetFilePointer (in: hFile=0x158, lDistanceToMove=63187, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf6d3 [0049.074] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0049.074] GetFileType (hFile=0x158) returned 0x1 [0049.074] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x38, wMilliseconds=0x172)) [0049.074] GetCurrentThreadId () returned 0x970 [0049.074] GetCurrentThreadId () returned 0x970 [0049.074] GetCurrentThreadId () returned 0x970 [0049.074] GetCurrentThreadId () returned 0x970 [0049.074] GetCurrentThreadId () returned 0x970 [0049.074] GetCurrentThreadId () returned 0x970 [0049.074] GetCurrentThreadId () returned 0x970 [0049.074] GetCurrentThreadId () returned 0x970 [0049.074] GetCurrentThreadId () returned 0x970 [0049.074] GetCurrentThreadId () returned 0x970 [0049.074] GetCurrentThreadId () returned 0x970 [0049.074] GetCurrentThreadId () returned 0x970 [0049.074] GetCurrentThreadId () returned 0x970 [0049.074] GetCurrentThreadId () returned 0x970 [0049.074] GetCurrentThreadId () returned 0x970 [0049.074] GetCurrentThreadId () returned 0x970 [0049.074] GetCurrentThreadId () returned 0x970 [0049.074] GetCurrentThreadId () returned 0x970 [0049.074] GetCurrentThreadId () returned 0x970 [0049.074] GetCurrentThreadId () returned 0x970 [0049.074] GetCurrentThreadId () returned 0x970 [0049.074] GetCurrentThreadId () returned 0x970 [0049.074] GetCurrentThreadId () returned 0x970 [0049.074] GetCurrentThreadId () returned 0x970 [0049.075] GetCurrentThreadId () returned 0x970 [0049.075] GetCurrentThreadId () returned 0x970 [0049.075] GetCurrentThreadId () returned 0x970 [0049.075] GetCurrentThreadId () returned 0x970 [0049.075] GetCurrentThreadId () returned 0x970 [0049.075] GetCurrentThreadId () returned 0x970 [0049.075] GetCurrentThreadId () returned 0x970 [0049.075] GetCurrentThreadId () returned 0x970 [0049.075] GetCurrentThreadId () returned 0x970 [0049.075] GetCurrentThreadId () returned 0x970 [0049.075] GetCurrentThreadId () returned 0x970 [0049.075] GetCurrentThreadId () returned 0x970 [0049.075] GetCurrentThreadId () returned 0x970 [0049.075] GetCurrentThreadId () returned 0x970 [0049.075] GetCurrentThreadId () returned 0x970 [0049.075] GetCurrentThreadId () returned 0x970 [0049.075] GetCurrentThreadId () returned 0x970 [0049.075] GetCurrentThreadId () returned 0x970 [0049.075] GetCurrentThreadId () returned 0x970 [0049.075] GetCurrentThreadId () returned 0x970 [0049.075] GetCurrentThreadId () returned 0x970 [0049.075] GetCurrentThreadId () returned 0x970 [0049.075] GetCurrentThreadId () returned 0x970 [0049.075] GetCurrentThreadId () returned 0x970 [0049.075] GetCurrentThreadId () returned 0x970 [0049.075] GetCurrentThreadId () returned 0x970 [0049.075] GetCurrentThreadId () returned 0x970 [0049.075] GetCurrentThreadId () returned 0x970 [0049.075] GetCurrentThreadId () returned 0x970 [0049.075] GetCurrentThreadId () returned 0x970 [0049.075] GetCurrentThreadId () returned 0x970 [0049.075] GetCurrentThreadId () returned 0x970 [0049.075] GetCurrentThreadId () returned 0x970 [0049.075] GetCurrentThreadId () returned 0x970 [0049.075] GetCurrentThreadId () returned 0x970 [0049.075] GetCurrentThreadId () returned 0x970 [0049.075] GetCurrentThreadId () returned 0x970 [0049.075] GetCurrentThreadId () returned 0x970 [0049.075] GetCurrentThreadId () returned 0x970 [0049.075] GetCurrentThreadId () returned 0x970 [0049.075] GetCurrentThreadId () returned 0x970 [0049.075] GetCurrentThreadId () returned 0x970 [0049.075] GetCurrentThreadId () returned 0x970 [0049.075] GetCurrentThreadId () returned 0x970 [0049.075] GetCurrentThreadId () returned 0x970 [0049.075] GetCurrentThreadId () returned 0x970 [0049.075] GetCurrentThreadId () returned 0x970 [0049.075] GetCurrentThreadId () returned 0x970 [0049.076] GetCurrentThreadId () returned 0x970 [0049.076] GetCurrentThreadId () returned 0x970 [0049.076] GetCurrentThreadId () returned 0x970 [0049.076] GetCurrentThreadId () returned 0x970 [0049.076] GetCurrentThreadId () returned 0x970 [0049.076] GetCurrentThreadId () returned 0x970 [0049.076] GetCurrentThreadId () returned 0x970 [0049.076] GetCurrentThreadId () returned 0x970 [0049.076] GetCurrentThreadId () returned 0x970 [0049.076] GetCurrentThreadId () returned 0x970 [0049.076] GetCurrentThreadId () returned 0x970 [0049.076] GetCurrentThreadId () returned 0x970 [0049.076] GetCurrentThreadId () returned 0x970 [0049.076] GetCurrentThreadId () returned 0x970 [0049.076] GetCurrentThreadId () returned 0x970 [0049.076] GetCurrentThreadId () returned 0x970 [0049.076] GetCurrentThreadId () returned 0x970 [0049.076] GetCurrentThreadId () returned 0x970 [0049.076] GetCurrentThreadId () returned 0x970 [0049.076] GetCurrentThreadId () returned 0x970 [0049.076] GetCurrentThreadId () returned 0x970 [0049.076] GetCurrentThreadId () returned 0x970 [0049.076] GetCurrentThreadId () returned 0x970 [0049.076] GetCurrentThreadId () returned 0x970 [0049.076] GetCurrentThreadId () returned 0x970 [0049.076] GetCurrentThreadId () returned 0x970 [0049.076] GetCurrentThreadId () returned 0x970 [0049.076] GetCurrentThreadId () returned 0x970 [0049.076] GetCurrentThreadId () returned 0x970 [0049.076] GetCurrentThreadId () returned 0x970 [0049.076] GetCurrentThreadId () returned 0x970 [0049.076] GetCurrentThreadId () returned 0x970 [0049.076] GetCurrentThreadId () returned 0x970 [0049.076] GetCurrentThreadId () returned 0x970 [0049.076] GetCurrentThreadId () returned 0x970 [0049.076] GetCurrentThreadId () returned 0x970 [0049.076] GetCurrentThreadId () returned 0x970 [0049.076] GetCurrentThreadId () returned 0x970 [0049.076] GetCurrentThreadId () returned 0x970 [0049.076] GetCurrentThreadId () returned 0x970 [0049.076] GetCurrentThreadId () returned 0x970 [0049.076] GetCurrentThreadId () returned 0x970 [0049.076] GetCurrentThreadId () returned 0x970 [0049.076] GetCurrentThreadId () returned 0x970 [0049.076] GetCurrentThreadId () returned 0x970 [0049.076] GetCurrentThreadId () returned 0x970 [0049.076] GetCurrentThreadId () returned 0x970 [0049.076] GetCurrentThreadId () returned 0x970 [0049.076] GetCurrentThreadId () returned 0x970 [0049.077] GetCurrentThreadId () returned 0x970 [0049.077] GetCurrentThreadId () returned 0x970 [0049.077] GetCurrentThreadId () returned 0x970 [0049.077] GetCurrentThreadId () returned 0x970 [0049.077] GetCurrentThreadId () returned 0x970 [0049.077] GetCurrentThreadId () returned 0x970 [0049.077] GetCurrentThreadId () returned 0x970 [0049.077] GetCurrentThreadId () returned 0x970 [0049.077] GetCurrentThreadId () returned 0x970 [0049.077] GetCurrentThreadId () returned 0x970 [0049.077] GetCurrentThreadId () returned 0x970 [0049.077] GetCurrentThreadId () returned 0x970 [0049.077] GetCurrentThreadId () returned 0x970 [0049.077] GetCurrentThreadId () returned 0x970 [0049.077] GetCurrentThreadId () returned 0x970 [0049.077] GetCurrentThreadId () returned 0x970 [0049.077] GetCurrentThreadId () returned 0x970 [0049.077] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.077] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.077] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb7f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.077] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.077] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.077] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb7f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.077] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.077] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.077] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.077] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.077] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.077] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.077] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.077] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.077] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb850, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.077] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.077] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.077] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb850, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.077] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.077] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.077] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb850, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.077] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x38, wMilliseconds=0x182)) [0049.078] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gH6kH?sp+w9qrdLU:,Mnh~i^WwH\\ERQ{", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0049.078] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gH6kH?sp+w9qrdLU:,Mnh~i^WwH\\ERQ{", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0049.078] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gH6kH?sp+w9qrdLU:,Mnh~i^WwH\\ERQ{", cchWideChar=32, lpMultiByteStr=0x2000a48, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gH6kH?sp+w9qrdLU:,Mnh~i^WwH\\ERQ{", lpUsedDefaultChar=0x0) returned 32 [0049.078] GetCurrentThreadId () returned 0x970 [0049.078] GetCurrentThreadId () returned 0x970 [0049.078] GetCurrentThreadId () returned 0x970 [0049.078] GetCurrentThreadId () returned 0x970 [0049.078] GetCurrentThreadId () returned 0x970 [0049.078] GetCurrentThreadId () returned 0x970 [0049.085] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0049.085] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0049.085] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x202e2d8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0049.085] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x35904f8, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0049.085] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x35904f8, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAHU6skD+nzR+42XU6PsMvGeE+8vnqHGe9QmGsOUUCj3ow6hzipfP/dS8371arim112Qi35iQy3XXOArOAMHdlrMhBdd7/QSPmjjaLUpRg3oZRQV7LDlvt7i9zIUGiSDh041ZquuWZopVSq7cDkENKb7XCXwCFpo56AR911tMfggr7Jkgbk18gPfkyXrmLNR4fVp+Mw553K8uc1Gzz34QnEiURAWPb0z0WA==") returned 232 [0049.085] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x38, wMilliseconds=0x182)) [0049.085] GetCurrentThreadId () returned 0x970 [0049.085] GetCurrentThreadId () returned 0x970 [0049.085] GetCurrentThreadId () returned 0x970 [0049.085] GetCurrentThreadId () returned 0x970 [0049.085] GetCurrentThreadId () returned 0x970 [0049.085] GetCurrentThreadId () returned 0x970 [0049.085] GetCurrentThreadId () returned 0x970 [0049.085] GetCurrentThreadId () returned 0x970 [0049.085] GetCurrentThreadId () returned 0x970 [0049.085] GetCurrentThreadId () returned 0x970 [0049.085] GetCurrentThreadId () returned 0x970 [0049.085] GetCurrentThreadId () returned 0x970 [0049.085] GetCurrentThreadId () returned 0x970 [0049.085] GetCurrentThreadId () returned 0x970 [0049.085] GetCurrentThreadId () returned 0x970 [0049.085] GetCurrentThreadId () returned 0x970 [0049.085] GetCurrentThreadId () returned 0x970 [0049.085] GetCurrentThreadId () returned 0x970 [0049.085] GetCurrentThreadId () returned 0x970 [0049.085] GetCurrentThreadId () returned 0x970 [0049.085] GetCurrentThreadId () returned 0x970 [0049.085] GetCurrentThreadId () returned 0x970 [0049.085] GetCurrentThreadId () returned 0x970 [0049.086] GetCurrentThreadId () returned 0x970 [0049.086] GetCurrentThreadId () returned 0x970 [0049.086] GetCurrentThreadId () returned 0x970 [0049.086] GetCurrentThreadId () returned 0x970 [0049.086] GetCurrentThreadId () returned 0x970 [0049.086] GetCurrentThreadId () returned 0x970 [0049.086] GetCurrentThreadId () returned 0x970 [0049.086] GetCurrentThreadId () returned 0x970 [0049.086] GetCurrentThreadId () returned 0x970 [0049.086] GetCurrentThreadId () returned 0x970 [0049.086] GetCurrentThreadId () returned 0x970 [0049.086] GetCurrentThreadId () returned 0x970 [0049.086] GetCurrentThreadId () returned 0x970 [0049.086] GetCurrentThreadId () returned 0x970 [0049.086] GetCurrentThreadId () returned 0x970 [0049.086] GetCurrentThreadId () returned 0x970 [0049.086] GetCurrentThreadId () returned 0x970 [0049.086] GetCurrentThreadId () returned 0x970 [0049.086] GetCurrentThreadId () returned 0x970 [0049.086] GetCurrentThreadId () returned 0x970 [0049.086] GetCurrentThreadId () returned 0x970 [0049.086] GetCurrentThreadId () returned 0x970 [0049.086] GetCurrentThreadId () returned 0x970 [0049.086] GetCurrentThreadId () returned 0x970 [0049.086] GetCurrentThreadId () returned 0x970 [0049.086] GetCurrentThreadId () returned 0x970 [0049.086] GetCurrentThreadId () returned 0x970 [0049.086] GetCurrentThreadId () returned 0x970 [0049.086] GetCurrentThreadId () returned 0x970 [0049.086] GetCurrentThreadId () returned 0x970 [0049.086] GetCurrentThreadId () returned 0x970 [0049.086] GetCurrentThreadId () returned 0x970 [0049.086] GetCurrentThreadId () returned 0x970 [0049.086] GetCurrentThreadId () returned 0x970 [0049.086] GetCurrentThreadId () returned 0x970 [0049.086] GetCurrentThreadId () returned 0x970 [0049.086] GetCurrentThreadId () returned 0x970 [0049.086] GetCurrentThreadId () returned 0x970 [0049.086] GetCurrentThreadId () returned 0x970 [0049.086] GetCurrentThreadId () returned 0x970 [0049.086] GetCurrentThreadId () returned 0x970 [0049.086] GetCurrentThreadId () returned 0x970 [0049.086] GetCurrentThreadId () returned 0x970 [0049.086] GetCurrentThreadId () returned 0x970 [0049.086] GetCurrentThreadId () returned 0x970 [0049.086] GetCurrentThreadId () returned 0x970 [0049.086] GetCurrentThreadId () returned 0x970 [0049.087] GetCurrentThreadId () returned 0x970 [0049.087] GetCurrentThreadId () returned 0x970 [0049.087] GetCurrentThreadId () returned 0x970 [0049.087] GetCurrentThreadId () returned 0x970 [0049.087] GetCurrentThreadId () returned 0x970 [0049.087] GetCurrentThreadId () returned 0x970 [0049.087] GetCurrentThreadId () returned 0x970 [0049.087] GetCurrentThreadId () returned 0x970 [0049.087] GetCurrentThreadId () returned 0x970 [0049.087] GetCurrentThreadId () returned 0x970 [0049.087] GetCurrentThreadId () returned 0x970 [0049.087] GetCurrentThreadId () returned 0x970 [0049.087] GetCurrentThreadId () returned 0x970 [0049.087] GetCurrentThreadId () returned 0x970 [0049.087] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAHU6skD+nzR+42XU6PsMvGeE+8vnqHGe9QmGsOUUCj3ow6hzipfP/dS8371arim112Qi35iQy3XXOArOAMHdlrMhBdd7/QSPmjjaLUpRg3oZRQV7LDlvt7i9zIUGiSDh041ZquuWZopVSq7cDkENKb7XCXwCFpo56AR911tMfggr7Jkgbk18gPfkyXrmLNR4fVp+Mw553K8uc1Gzz34QnEiURAWPb0z0WA==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0049.087] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAHU6skD+nzR+42XU6PsMvGeE+8vnqHGe9QmGsOUUCj3ow6hzipfP/dS8371arim112Qi35iQy3XXOArOAMHdlrMhBdd7/QSPmjjaLUpRg3oZRQV7LDlvt7i9zIUGiSDh041ZquuWZopVSq7cDkENKb7XCXwCFpo56AR911tMfggr7Jkgbk18gPfkyXrmLNR4fVp+Mw553K8uc1Gzz34QnEiURAWPb0z0WA==", cchWideChar=245, lpMultiByteStr=0x353900c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAHU6skD+nzR+42XU6PsMvGeE+8vnqHGe9QmGsOUUCj3ow6hzipfP/dS8371arim112Qi35iQy3XXOArOAMHdlrMhBdd7/QSPmjjaLUpRg3oZRQV7LDlvt7i9zIUGiSDh041ZquuWZopVSq7cDkENKb7XCXwCFpo56AR911tMfggr7Jkgbk18gPfkyXrmLNR4fVp+Mw553K8uc1Gzz34QnEiURAWPb0z0WA==", lpUsedDefaultChar=0x0) returned 245 [0049.087] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0049.087] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0049.087] CloseHandle (hObject=0x158) returned 1 [0049.088] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0 [0049.088] GetLastError () returned 0x5 [0049.088] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0049.088] SetLastError (dwErrCode=0x5) [0049.088] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=16935165447) returned 1 [0049.088] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\Файл зашифрован [correct.avi].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\Файл зашифрован [correct.avi].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0049.089] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0049.089] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0049.089] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0049.089] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0049.089] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0049.089] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0049.089] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0049.090] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0049.090] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0049.090] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0049.090] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0049.090] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0049.090] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0049.090] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0049.090] SetEndOfFile (hFile=0x158) returned 1 [0049.090] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0049.090] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0049.090] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0049.090] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0049.090] WriteFile (in: hFile=0x158, lpBuffer=0x361f5a8*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x361f5a8*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0049.091] WriteFile (in: hFile=0x158, lpBuffer=0x35f005c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f005c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0049.091] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=",eCpc1e=+g:di:gz.?}0vU(>Hr3sQNjx", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0049.091] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=",eCpc1e=+g:di:gz.?}0vU(>Hr3sQNjx", cchWideChar=32, lpMultiByteStr=0x20328d4, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=",eCpc1e=+g:di:gz.?}0vU(>Hr3sQNjx", lpUsedDefaultChar=0x0) returned 32 [0049.091] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0049.091] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0049.091] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x244c354, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x244c354, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a55e497, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x30200, dwReserved0=0x0, dwReserved1=0x0, cFileName="correct.avi", cAlternateFileName="")) returned 0x295098 [0049.091] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0049.092] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0049.092] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20 [0049.092] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20 [0049.092] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20 [0049.092] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20 [0049.092] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x244c354, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x244c354, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a55e497, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x30200)) returned 1 [0049.092] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0049.092] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0049.092] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20 [0049.092] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20 [0049.092] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0049.092] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0049.092] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0049.092] SetEndOfFile (hFile=0x158) returned 1 [0049.093] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="correct.avi", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0049.093] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="correct.avi", cchWideChar=11, lpMultiByteStr=0x1fe420c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="correct.avi", lpUsedDefaultChar=0x0) returned 11 [0049.093] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="correct.avi", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0049.093] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="correct.avi", cchWideChar=11, lpMultiByteStr=0x1fe38ac, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="correct.avi", lpUsedDefaultChar=0x0) returned 11 [0049.093] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe38ac, cbMultiByte=11, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="correct.avi.aviii@\x01") returned 11 [0049.093] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="correct.avi", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0049.093] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="correct.avi", cchWideChar=11, lpMultiByteStr=0x1fe420c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="correct.avi", lpUsedDefaultChar=0x0) returned 11 [0049.093] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0049.093] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0049.094] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x30200 [0049.094] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0049.094] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0049.094] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0049.094] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="correct.avi", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0049.094] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="correct.avi", cchWideChar=11, lpMultiByteStr=0x1fe420c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="correct.avi", lpUsedDefaultChar=0x0) returned 11 [0049.094] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="correct.avi", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0049.094] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="correct.avi", cchWideChar=11, lpMultiByteStr=0x1fe38ac, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="correct.avi", lpUsedDefaultChar=0x0) returned 11 [0049.094] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe38ac, cbMultiByte=11, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="correct.avict.avi.aviii@\x01") returned 11 [0049.094] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="correct.avi", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0049.094] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="correct.avi", cchWideChar=11, lpMultiByteStr=0x1fe420c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="correct.avi", lpUsedDefaultChar=0x0) returned 11 [0049.094] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0049.095] CharToOemA (in: pSrc="correct.avi", pDst=0x1fe38ac | out: pDst="correct.avi") returned 1 [0049.095] WriteFile (in: hFile=0x158, lpBuffer=0x1fe38ac*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe38ac*, lpNumberOfBytesWritten=0x18e048*=0xb, lpOverlapped=0x0) returned 1 [0049.095] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0049.095] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0049.095] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0049.095] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=16935870048) returned 1 [0049.095] ReadFile (in: hFile=0x15c, lpBuffer=0x37cff80, nNumberOfBytesToRead=0x30200, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37cff80*, lpNumberOfBytesRead=0x18dd7c*=0x30200, lpOverlapped=0x0) returned 1 [0049.098] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0049.098] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=16936163555) returned 1 [0049.106] WriteFile (in: hFile=0x158, lpBuffer=0x1fea168*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fea168*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0049.107] ReadFile (in: hFile=0x15c, lpBuffer=0x37cff80, nNumberOfBytesToRead=0x30200, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x37cff80*, lpNumberOfBytesRead=0x18de38*=0x30200, lpOverlapped=0x0) returned 1 [0049.117] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x46 [0049.117] WriteFile (in: hFile=0x158, lpBuffer=0x379fd50*, nNumberOfBytesToWrite=0x30200, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x379fd50*, lpNumberOfBytesWritten=0x18de10*=0x30200, lpOverlapped=0x0) returned 1 [0049.119] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x30246 [0049.120] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0049.120] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0049.120] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0049.120] SetFilePointer (in: hFile=0x158, lDistanceToMove=11, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x29 [0049.120] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x30250 [0049.120] CloseHandle (hObject=0x15c) returned 1 [0049.120] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x30250 [0049.120] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x30250 [0049.120] SetFilePointer (in: hFile=0x158, lDistanceToMove=197200, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x30250 [0049.120] SetFilePointer (in: hFile=0x158, lDistanceToMove=197200, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x30250 [0049.120] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x30250 [0049.120] SetFilePointer (in: hFile=0x158, lDistanceToMove=197200, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x30250 [0049.120] SetEndOfFile (hFile=0x158) returned 1 [0049.120] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x30250 [0049.120] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x30250 [0049.121] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="correct.avi", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0049.121] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="correct.avi", cchWideChar=11, lpMultiByteStr=0x1fe420c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="correct.avi", lpUsedDefaultChar=0x0) returned 11 [0049.121] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="correct.avi", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0049.121] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="correct.avi", cchWideChar=11, lpMultiByteStr=0x1fe36cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="correct.avi", lpUsedDefaultChar=0x0) returned 11 [0049.121] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe36cc, cbMultiByte=11, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="correct.avi\x18ꞗ@涤(\x18믉`믑`") returned 11 [0049.121] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="correct.avi", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0049.121] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="correct.avi", cchWideChar=11, lpMultiByteStr=0x1fe420c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="correct.avi", lpUsedDefaultChar=0x0) returned 11 [0049.121] WriteFile (in: hFile=0x158, lpBuffer=0x34e3cf8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x34e3cf8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0049.121] CharToOemA (in: pSrc="correct.avi", pDst=0x1fe36cc | out: pDst="correct.avi") returned 1 [0049.121] WriteFile (in: hFile=0x158, lpBuffer=0x1fe36cc*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe36cc*, lpNumberOfBytesWritten=0x18efcc*=0xb, lpOverlapped=0x0) returned 1 [0049.121] WriteFile (in: hFile=0x158, lpBuffer=0x1fea128*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea128*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0049.121] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0049.121] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0049.121] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x30294 [0049.121] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x30294 [0049.121] WriteFile (in: hFile=0x158, lpBuffer=0x361f5a8*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x361f5a8*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0049.121] WriteFile (in: hFile=0x158, lpBuffer=0x35f005c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f005c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0049.122] DeleteFileW (lpFileName="") returned 0 [0049.122] GetLastError () returned 0x3 [0049.122] GetFileAttributesW (lpFileName="") returned 0xffffffff [0049.122] SetLastError (dwErrCode=0x3) [0049.122] FlushFileBuffers (hFile=0x158) returned 1 [0049.128] GetCurrentThreadId () returned 0x970 [0049.128] GetCurrentThreadId () returned 0x970 [0049.128] GetCurrentThreadId () returned 0x970 [0049.128] GetCurrentThreadId () returned 0x970 [0049.128] GetCurrentThreadId () returned 0x970 [0049.128] GetCurrentThreadId () returned 0x970 [0049.128] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x3034b [0049.128] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x3034b [0049.128] SetFilePointer (in: hFile=0x158, lDistanceToMove=197451, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x3034b [0049.128] CloseHandle (hObject=0x158) returned 1 [0049.130] GetCurrentThreadId () returned 0x970 [0049.130] GetCurrentThreadId () returned 0x970 [0049.130] GetCurrentThreadId () returned 0x970 [0049.131] GetCurrentThreadId () returned 0x970 [0049.131] GetCurrentThreadId () returned 0x970 [0049.131] GetCurrentThreadId () returned 0x970 [0049.131] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\Файл зашифрован [correct.avi].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\Файл зашифрован [correct.avi].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0049.131] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3034b [0049.131] SetFilePointer (in: hFile=0x158, lDistanceToMove=197323, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x302cb [0049.131] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0049.131] GetFileType (hFile=0x158) returned 0x1 [0049.131] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x38, wMilliseconds=0x1b1)) [0049.131] GetCurrentThreadId () returned 0x970 [0049.131] GetCurrentThreadId () returned 0x970 [0049.131] GetCurrentThreadId () returned 0x970 [0049.131] GetCurrentThreadId () returned 0x970 [0049.131] GetCurrentThreadId () returned 0x970 [0049.131] GetCurrentThreadId () returned 0x970 [0049.131] GetCurrentThreadId () returned 0x970 [0049.131] GetCurrentThreadId () returned 0x970 [0049.131] GetCurrentThreadId () returned 0x970 [0049.131] GetCurrentThreadId () returned 0x970 [0049.131] GetCurrentThreadId () returned 0x970 [0049.131] GetCurrentThreadId () returned 0x970 [0049.131] GetCurrentThreadId () returned 0x970 [0049.131] GetCurrentThreadId () returned 0x970 [0049.131] GetCurrentThreadId () returned 0x970 [0049.131] GetCurrentThreadId () returned 0x970 [0049.131] GetCurrentThreadId () returned 0x970 [0049.131] GetCurrentThreadId () returned 0x970 [0049.131] GetCurrentThreadId () returned 0x970 [0049.131] GetCurrentThreadId () returned 0x970 [0049.131] GetCurrentThreadId () returned 0x970 [0049.131] GetCurrentThreadId () returned 0x970 [0049.131] GetCurrentThreadId () returned 0x970 [0049.131] GetCurrentThreadId () returned 0x970 [0049.131] GetCurrentThreadId () returned 0x970 [0049.131] GetCurrentThreadId () returned 0x970 [0049.131] GetCurrentThreadId () returned 0x970 [0049.131] GetCurrentThreadId () returned 0x970 [0049.132] GetCurrentThreadId () returned 0x970 [0049.132] GetCurrentThreadId () returned 0x970 [0049.132] GetCurrentThreadId () returned 0x970 [0049.132] GetCurrentThreadId () returned 0x970 [0049.132] GetCurrentThreadId () returned 0x970 [0049.132] GetCurrentThreadId () returned 0x970 [0049.132] GetCurrentThreadId () returned 0x970 [0049.132] GetCurrentThreadId () returned 0x970 [0049.132] GetCurrentThreadId () returned 0x970 [0049.132] GetCurrentThreadId () returned 0x970 [0049.132] GetCurrentThreadId () returned 0x970 [0049.132] GetCurrentThreadId () returned 0x970 [0049.132] GetCurrentThreadId () returned 0x970 [0049.132] GetCurrentThreadId () returned 0x970 [0049.132] GetCurrentThreadId () returned 0x970 [0049.132] GetCurrentThreadId () returned 0x970 [0049.132] GetCurrentThreadId () returned 0x970 [0049.132] GetCurrentThreadId () returned 0x970 [0049.132] GetCurrentThreadId () returned 0x970 [0049.132] GetCurrentThreadId () returned 0x970 [0049.132] GetCurrentThreadId () returned 0x970 [0049.132] GetCurrentThreadId () returned 0x970 [0049.132] GetCurrentThreadId () returned 0x970 [0049.132] GetCurrentThreadId () returned 0x970 [0049.132] GetCurrentThreadId () returned 0x970 [0049.132] GetCurrentThreadId () returned 0x970 [0049.132] GetCurrentThreadId () returned 0x970 [0049.132] GetCurrentThreadId () returned 0x970 [0049.132] GetCurrentThreadId () returned 0x970 [0049.132] GetCurrentThreadId () returned 0x970 [0049.132] GetCurrentThreadId () returned 0x970 [0049.132] GetCurrentThreadId () returned 0x970 [0049.132] GetCurrentThreadId () returned 0x970 [0049.132] GetCurrentThreadId () returned 0x970 [0049.132] GetCurrentThreadId () returned 0x970 [0049.132] GetCurrentThreadId () returned 0x970 [0049.132] GetCurrentThreadId () returned 0x970 [0049.132] GetCurrentThreadId () returned 0x970 [0049.132] GetCurrentThreadId () returned 0x970 [0049.132] GetCurrentThreadId () returned 0x970 [0049.132] GetCurrentThreadId () returned 0x970 [0049.132] GetCurrentThreadId () returned 0x970 [0049.132] GetCurrentThreadId () returned 0x970 [0049.132] GetCurrentThreadId () returned 0x970 [0049.132] GetCurrentThreadId () returned 0x970 [0049.132] GetCurrentThreadId () returned 0x970 [0049.132] GetCurrentThreadId () returned 0x970 [0049.132] GetCurrentThreadId () returned 0x970 [0049.132] GetCurrentThreadId () returned 0x970 [0049.132] GetCurrentThreadId () returned 0x970 [0049.133] GetCurrentThreadId () returned 0x970 [0049.133] GetCurrentThreadId () returned 0x970 [0049.133] GetCurrentThreadId () returned 0x970 [0049.133] GetCurrentThreadId () returned 0x970 [0049.133] GetCurrentThreadId () returned 0x970 [0049.133] GetCurrentThreadId () returned 0x970 [0049.133] GetCurrentThreadId () returned 0x970 [0049.133] GetCurrentThreadId () returned 0x970 [0049.133] GetCurrentThreadId () returned 0x970 [0049.133] GetCurrentThreadId () returned 0x970 [0049.133] GetCurrentThreadId () returned 0x970 [0049.133] GetCurrentThreadId () returned 0x970 [0049.133] GetCurrentThreadId () returned 0x970 [0049.133] GetCurrentThreadId () returned 0x970 [0049.133] GetCurrentThreadId () returned 0x970 [0049.133] GetCurrentThreadId () returned 0x970 [0049.133] GetCurrentThreadId () returned 0x970 [0049.133] GetCurrentThreadId () returned 0x970 [0049.133] GetCurrentThreadId () returned 0x970 [0049.133] GetCurrentThreadId () returned 0x970 [0049.133] GetCurrentThreadId () returned 0x970 [0049.133] GetCurrentThreadId () returned 0x970 [0049.133] GetCurrentThreadId () returned 0x970 [0049.133] GetCurrentThreadId () returned 0x970 [0049.133] GetCurrentThreadId () returned 0x970 [0049.133] GetCurrentThreadId () returned 0x970 [0049.133] GetCurrentThreadId () returned 0x970 [0049.133] GetCurrentThreadId () returned 0x970 [0049.133] GetCurrentThreadId () returned 0x970 [0049.133] GetCurrentThreadId () returned 0x970 [0049.133] GetCurrentThreadId () returned 0x970 [0049.133] GetCurrentThreadId () returned 0x970 [0049.133] GetCurrentThreadId () returned 0x970 [0049.133] GetCurrentThreadId () returned 0x970 [0049.133] GetCurrentThreadId () returned 0x970 [0049.133] GetCurrentThreadId () returned 0x970 [0049.133] GetCurrentThreadId () returned 0x970 [0049.133] GetCurrentThreadId () returned 0x970 [0049.133] GetCurrentThreadId () returned 0x970 [0049.133] GetCurrentThreadId () returned 0x970 [0049.133] GetCurrentThreadId () returned 0x970 [0049.133] GetCurrentThreadId () returned 0x970 [0049.133] GetCurrentThreadId () returned 0x970 [0049.133] GetCurrentThreadId () returned 0x970 [0049.133] GetCurrentThreadId () returned 0x970 [0049.133] GetCurrentThreadId () returned 0x970 [0049.133] GetCurrentThreadId () returned 0x970 [0049.133] GetCurrentThreadId () returned 0x970 [0049.134] GetCurrentThreadId () returned 0x970 [0049.134] GetCurrentThreadId () returned 0x970 [0049.134] GetCurrentThreadId () returned 0x970 [0049.134] GetCurrentThreadId () returned 0x970 [0049.134] GetCurrentThreadId () returned 0x970 [0049.134] GetCurrentThreadId () returned 0x970 [0049.134] GetCurrentThreadId () returned 0x970 [0049.134] GetCurrentThreadId () returned 0x970 [0049.134] GetCurrentThreadId () returned 0x970 [0049.134] GetCurrentThreadId () returned 0x970 [0049.134] GetCurrentThreadId () returned 0x970 [0049.134] GetCurrentThreadId () returned 0x970 [0049.134] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.134] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.134] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb850, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.134] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.134] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.134] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb850, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.134] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.134] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.134] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.134] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.134] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.134] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.134] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.134] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.134] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb8b0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.134] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.134] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.134] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb8b0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.134] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.134] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.134] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb8b0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.134] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x38, wMilliseconds=0x1b1)) [0049.134] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr=",eCpc1e=+g:di:gz.?}0vU(>Hr3sQNjx", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0049.134] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr=",eCpc1e=+g:di:gz.?}0vU(>Hr3sQNjx", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0049.134] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr=",eCpc1e=+g:di:gz.?}0vU(>Hr3sQNjx", cchWideChar=32, lpMultiByteStr=0x20008f8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=",eCpc1e=+g:di:gz.?}0vU(>Hr3sQNjx", lpUsedDefaultChar=0x0) returned 32 [0049.135] GetCurrentThreadId () returned 0x970 [0049.135] GetCurrentThreadId () returned 0x970 [0049.135] GetCurrentThreadId () returned 0x970 [0049.135] GetCurrentThreadId () returned 0x970 [0049.135] GetCurrentThreadId () returned 0x970 [0049.135] GetCurrentThreadId () returned 0x970 [0049.142] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0049.142] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0049.142] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x202e3c8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0049.142] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x35904f8, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0049.142] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x35904f8, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAHb7uqnPL98UORuf7PnrrHJfLTOFYIuyHnuZ82QzTpW/aR1un/KDdwAH+l/VjdIh5QqkVt9JqbejWWXzb0e4hnZTVU7RoXU7bI89kTi6quz5XFG61rtFRbHrB4FoynUo4vWVaDst90PaekrRe/8zjmyxE1n1cCV2XfD85pHaRXNAZ5dik0QIPIaoYkFNuMGPZdZ2uWZQIqzSjSCaznBG9flFHANHn7eUmQ==") returned 232 [0049.142] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x38, wMilliseconds=0x1c0)) [0049.142] GetCurrentThreadId () returned 0x970 [0049.142] GetCurrentThreadId () returned 0x970 [0049.142] GetCurrentThreadId () returned 0x970 [0049.142] GetCurrentThreadId () returned 0x970 [0049.142] GetCurrentThreadId () returned 0x970 [0049.142] GetCurrentThreadId () returned 0x970 [0049.142] GetCurrentThreadId () returned 0x970 [0049.142] GetCurrentThreadId () returned 0x970 [0049.142] GetCurrentThreadId () returned 0x970 [0049.142] GetCurrentThreadId () returned 0x970 [0049.142] GetCurrentThreadId () returned 0x970 [0049.142] GetCurrentThreadId () returned 0x970 [0049.142] GetCurrentThreadId () returned 0x970 [0049.142] GetCurrentThreadId () returned 0x970 [0049.142] GetCurrentThreadId () returned 0x970 [0049.142] GetCurrentThreadId () returned 0x970 [0049.142] GetCurrentThreadId () returned 0x970 [0049.142] GetCurrentThreadId () returned 0x970 [0049.142] GetCurrentThreadId () returned 0x970 [0049.142] GetCurrentThreadId () returned 0x970 [0049.142] GetCurrentThreadId () returned 0x970 [0049.142] GetCurrentThreadId () returned 0x970 [0049.142] GetCurrentThreadId () returned 0x970 [0049.142] GetCurrentThreadId () returned 0x970 [0049.143] GetCurrentThreadId () returned 0x970 [0049.143] GetCurrentThreadId () returned 0x970 [0049.143] GetCurrentThreadId () returned 0x970 [0049.143] GetCurrentThreadId () returned 0x970 [0049.143] GetCurrentThreadId () returned 0x970 [0049.143] GetCurrentThreadId () returned 0x970 [0049.143] GetCurrentThreadId () returned 0x970 [0049.143] GetCurrentThreadId () returned 0x970 [0049.143] GetCurrentThreadId () returned 0x970 [0049.143] GetCurrentThreadId () returned 0x970 [0049.143] GetCurrentThreadId () returned 0x970 [0049.143] GetCurrentThreadId () returned 0x970 [0049.143] GetCurrentThreadId () returned 0x970 [0049.143] GetCurrentThreadId () returned 0x970 [0049.143] GetCurrentThreadId () returned 0x970 [0049.143] GetCurrentThreadId () returned 0x970 [0049.143] GetCurrentThreadId () returned 0x970 [0049.143] GetCurrentThreadId () returned 0x970 [0049.143] GetCurrentThreadId () returned 0x970 [0049.143] GetCurrentThreadId () returned 0x970 [0049.143] GetCurrentThreadId () returned 0x970 [0049.143] GetCurrentThreadId () returned 0x970 [0049.143] GetCurrentThreadId () returned 0x970 [0049.143] GetCurrentThreadId () returned 0x970 [0049.143] GetCurrentThreadId () returned 0x970 [0049.143] GetCurrentThreadId () returned 0x970 [0049.143] GetCurrentThreadId () returned 0x970 [0049.143] GetCurrentThreadId () returned 0x970 [0049.143] GetCurrentThreadId () returned 0x970 [0049.143] GetCurrentThreadId () returned 0x970 [0049.143] GetCurrentThreadId () returned 0x970 [0049.143] GetCurrentThreadId () returned 0x970 [0049.143] GetCurrentThreadId () returned 0x970 [0049.143] GetCurrentThreadId () returned 0x970 [0049.143] GetCurrentThreadId () returned 0x970 [0049.143] GetCurrentThreadId () returned 0x970 [0049.143] GetCurrentThreadId () returned 0x970 [0049.143] GetCurrentThreadId () returned 0x970 [0049.143] GetCurrentThreadId () returned 0x970 [0049.143] GetCurrentThreadId () returned 0x970 [0049.143] GetCurrentThreadId () returned 0x970 [0049.143] GetCurrentThreadId () returned 0x970 [0049.143] GetCurrentThreadId () returned 0x970 [0049.143] GetCurrentThreadId () returned 0x970 [0049.143] GetCurrentThreadId () returned 0x970 [0049.143] GetCurrentThreadId () returned 0x970 [0049.143] GetCurrentThreadId () returned 0x970 [0049.143] GetCurrentThreadId () returned 0x970 [0049.143] GetCurrentThreadId () returned 0x970 [0049.143] GetCurrentThreadId () returned 0x970 [0049.144] GetCurrentThreadId () returned 0x970 [0049.144] GetCurrentThreadId () returned 0x970 [0049.144] GetCurrentThreadId () returned 0x970 [0049.144] GetCurrentThreadId () returned 0x970 [0049.144] GetCurrentThreadId () returned 0x970 [0049.144] GetCurrentThreadId () returned 0x970 [0049.144] GetCurrentThreadId () returned 0x970 [0049.144] GetCurrentThreadId () returned 0x970 [0049.144] GetCurrentThreadId () returned 0x970 [0049.144] GetCurrentThreadId () returned 0x970 [0049.144] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAHb7uqnPL98UORuf7PnrrHJfLTOFYIuyHnuZ82QzTpW/aR1un/KDdwAH+l/VjdIh5QqkVt9JqbejWWXzb0e4hnZTVU7RoXU7bI89kTi6quz5XFG61rtFRbHrB4FoynUo4vWVaDst90PaekrRe/8zjmyxE1n1cCV2XfD85pHaRXNAZ5dik0QIPIaoYkFNuMGPZdZ2uWZQIqzSjSCaznBG9flFHANHn7eUmQ==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0049.144] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAHb7uqnPL98UORuf7PnrrHJfLTOFYIuyHnuZ82QzTpW/aR1un/KDdwAH+l/VjdIh5QqkVt9JqbejWWXzb0e4hnZTVU7RoXU7bI89kTi6quz5XFG61rtFRbHrB4FoynUo4vWVaDst90PaekrRe/8zjmyxE1n1cCV2XfD85pHaRXNAZ5dik0QIPIaoYkFNuMGPZdZ2uWZQIqzSjSCaznBG9flFHANHn7eUmQ==", cchWideChar=245, lpMultiByteStr=0x353900c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAHb7uqnPL98UORuf7PnrrHJfLTOFYIuyHnuZ82QzTpW/aR1un/KDdwAH+l/VjdIh5QqkVt9JqbejWWXzb0e4hnZTVU7RoXU7bI89kTi6quz5XFG61rtFRbHrB4FoynUo4vWVaDst90PaekrRe/8zjmyxE1n1cCV2XfD85pHaRXNAZ5dik0QIPIaoYkFNuMGPZdZ2uWZQIqzSjSCaznBG9flFHANHn7eUmQ==", lpUsedDefaultChar=0x0) returned 245 [0049.144] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0049.144] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0049.144] CloseHandle (hObject=0x158) returned 1 [0049.146] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0 [0049.146] GetLastError () returned 0x5 [0049.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20 [0049.146] SetLastError (dwErrCode=0x5) [0049.146] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=16940919912) returned 1 [0049.146] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\Файл зашифрован [delete.avi].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\Файл зашифрован [delete.avi].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0049.146] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0049.146] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0049.146] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0049.146] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0049.146] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0049.146] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0049.146] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0049.147] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0049.147] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0049.147] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0049.147] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0049.147] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0049.147] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0049.147] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0049.147] SetEndOfFile (hFile=0x158) returned 1 [0049.147] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0049.147] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0049.147] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0049.147] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0049.147] WriteFile (in: hFile=0x158, lpBuffer=0x361f6e8*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x361f6e8*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0049.148] WriteFile (in: hFile=0x158, lpBuffer=0x35f011c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f011c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0049.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="q30seQ4CKHm4{7zO\"W0@QqzSBN{^3$.E", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0049.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="q30seQ4CKHm4{7zO\"W0@QqzSBN{^3$.E", cchWideChar=32, lpMultiByteStr=0x2032b74, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="q30seQ4CKHm4{7zO\"W0@QqzSBN{^3$.E", lpUsedDefaultChar=0x0) returned 32 [0049.148] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0049.148] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0049.148] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24be76b, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x24be76b, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5845f5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="delete.avi", cAlternateFileName="")) returned 0x295098 [0049.148] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0049.148] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0049.148] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi")) returned 0x20 [0049.149] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi")) returned 0x20 [0049.149] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi")) returned 0x20 [0049.149] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi")) returned 0x20 [0049.149] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24be76b, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x24be76b, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5845f5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36c00)) returned 1 [0049.150] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0049.150] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0049.150] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi")) returned 0x20 [0049.150] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi")) returned 0x20 [0049.150] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0049.150] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0049.150] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0049.150] SetEndOfFile (hFile=0x158) returned 1 [0049.151] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="delete.avi", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.151] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="delete.avi", cchWideChar=10, lpMultiByteStr=0x1fe37cc, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="delete.avi", lpUsedDefaultChar=0x0) returned 10 [0049.151] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="delete.avi", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.151] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="delete.avi", cchWideChar=10, lpMultiByteStr=0x1fe374c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="delete.avi", lpUsedDefaultChar=0x0) returned 10 [0049.151] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe374c, cbMultiByte=10, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="delete.avii.aviii@\x01") returned 10 [0049.151] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="delete.avi", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.151] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="delete.avi", cchWideChar=10, lpMultiByteStr=0x1fe37cc, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="delete.avi", lpUsedDefaultChar=0x0) returned 10 [0049.151] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0049.151] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0049.151] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x36c00 [0049.151] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0049.151] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0049.151] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0049.151] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="delete.avi", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.151] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="delete.avi", cchWideChar=10, lpMultiByteStr=0x1fe37cc, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="delete.avi", lpUsedDefaultChar=0x0) returned 10 [0049.151] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="delete.avi", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.151] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="delete.avi", cchWideChar=10, lpMultiByteStr=0x1fe374c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="delete.avi", lpUsedDefaultChar=0x0) returned 10 [0049.152] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe374c, cbMultiByte=10, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="delete.avite.avii.aviii@\x01") returned 10 [0049.152] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="delete.avi", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.152] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="delete.avi", cchWideChar=10, lpMultiByteStr=0x1fe37cc, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="delete.avi", lpUsedDefaultChar=0x0) returned 10 [0049.152] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0049.152] CharToOemA (in: pSrc="delete.avi", pDst=0x1fe374c | out: pDst="delete.avi") returned 1 [0049.152] WriteFile (in: hFile=0x158, lpBuffer=0x1fe374c*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe374c*, lpNumberOfBytesWritten=0x18e048*=0xa, lpOverlapped=0x0) returned 1 [0049.153] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0049.153] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0049.153] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0049.153] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=16941625534) returned 1 [0049.153] ReadFile (in: hFile=0x15c, lpBuffer=0x376fb20, nNumberOfBytesToRead=0x36c00, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x376fb20*, lpNumberOfBytesRead=0x18dd7c*=0x36c00, lpOverlapped=0x0) returned 1 [0049.156] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0049.156] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=16941911786) returned 1 [0049.164] WriteFile (in: hFile=0x158, lpBuffer=0x1fea210*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fea210*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0049.164] ReadFile (in: hFile=0x15c, lpBuffer=0x376fb20, nNumberOfBytesToRead=0x36c00, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x376fb20*, lpNumberOfBytesRead=0x18de38*=0x36c00, lpOverlapped=0x0) returned 1 [0049.170] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x45 [0049.170] WriteFile (in: hFile=0x158, lpBuffer=0x37e6810*, nNumberOfBytesToWrite=0x36c00, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x37e6810*, lpNumberOfBytesWritten=0x18de10*=0x36c00, lpOverlapped=0x0) returned 1 [0049.173] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x36c45 [0049.173] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0049.173] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0049.173] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0049.174] SetFilePointer (in: hFile=0x158, lDistanceToMove=10, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x28 [0049.174] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x36c4f [0049.174] CloseHandle (hObject=0x15c) returned 1 [0049.174] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x36c4f [0049.174] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x36c4f [0049.174] SetFilePointer (in: hFile=0x158, lDistanceToMove=224335, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x36c4f [0049.174] SetFilePointer (in: hFile=0x158, lDistanceToMove=224335, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x36c4f [0049.174] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x36c4f [0049.174] SetFilePointer (in: hFile=0x158, lDistanceToMove=224335, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x36c4f [0049.174] SetEndOfFile (hFile=0x158) returned 1 [0049.174] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x36c4f [0049.174] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x36c4f [0049.174] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="delete.avi", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.174] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="delete.avi", cchWideChar=10, lpMultiByteStr=0x1fe37cc, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="delete.avi", lpUsedDefaultChar=0x0) returned 10 [0049.174] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="delete.avi", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.175] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="delete.avi", cchWideChar=10, lpMultiByteStr=0x1fe368c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="delete.avi", lpUsedDefaultChar=0x0) returned 10 [0049.175] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe368c, cbMultiByte=10, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="delete.avi\x18ꞗ@涤(\x18믉`믑`") returned 10 [0049.175] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="delete.avi", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.175] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="delete.avi", cchWideChar=10, lpMultiByteStr=0x1fe37cc, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="delete.avi", lpUsedDefaultChar=0x0) returned 10 [0049.175] WriteFile (in: hFile=0x158, lpBuffer=0x34e3cf8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x34e3cf8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0049.175] CharToOemA (in: pSrc="delete.avi", pDst=0x1fe368c | out: pDst="delete.avi") returned 1 [0049.175] WriteFile (in: hFile=0x158, lpBuffer=0x1fe368c*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe368c*, lpNumberOfBytesWritten=0x18efcc*=0xa, lpOverlapped=0x0) returned 1 [0049.175] WriteFile (in: hFile=0x158, lpBuffer=0x1fea2d8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea2d8*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0049.175] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0049.175] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0049.175] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x36c92 [0049.175] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x36c92 [0049.175] WriteFile (in: hFile=0x158, lpBuffer=0x361f6e8*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x361f6e8*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0049.175] WriteFile (in: hFile=0x158, lpBuffer=0x35f011c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f011c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0049.175] DeleteFileW (lpFileName="") returned 0 [0049.175] GetLastError () returned 0x3 [0049.175] GetFileAttributesW (lpFileName="") returned 0xffffffff [0049.175] SetLastError (dwErrCode=0x3) [0049.175] FlushFileBuffers (hFile=0x158) returned 1 [0049.178] GetCurrentThreadId () returned 0x970 [0049.178] GetCurrentThreadId () returned 0x970 [0049.178] GetCurrentThreadId () returned 0x970 [0049.178] GetCurrentThreadId () returned 0x970 [0049.178] GetCurrentThreadId () returned 0x970 [0049.178] GetCurrentThreadId () returned 0x970 [0049.178] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x36d49 [0049.178] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x36d49 [0049.179] SetFilePointer (in: hFile=0x158, lDistanceToMove=224585, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x36d49 [0049.179] CloseHandle (hObject=0x158) returned 1 [0049.181] GetCurrentThreadId () returned 0x970 [0049.181] GetCurrentThreadId () returned 0x970 [0049.181] GetCurrentThreadId () returned 0x970 [0049.181] GetCurrentThreadId () returned 0x970 [0049.181] GetCurrentThreadId () returned 0x970 [0049.181] GetCurrentThreadId () returned 0x970 [0049.181] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\Файл зашифрован [delete.avi].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\Файл зашифрован [delete.avi].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0049.181] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x36d49 [0049.181] SetFilePointer (in: hFile=0x158, lDistanceToMove=224457, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x36cc9 [0049.181] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0049.181] GetFileType (hFile=0x158) returned 0x1 [0049.181] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x38, wMilliseconds=0x1e0)) [0049.181] GetCurrentThreadId () returned 0x970 [0049.181] GetCurrentThreadId () returned 0x970 [0049.181] GetCurrentThreadId () returned 0x970 [0049.181] GetCurrentThreadId () returned 0x970 [0049.181] GetCurrentThreadId () returned 0x970 [0049.181] GetCurrentThreadId () returned 0x970 [0049.181] GetCurrentThreadId () returned 0x970 [0049.181] GetCurrentThreadId () returned 0x970 [0049.181] GetCurrentThreadId () returned 0x970 [0049.181] GetCurrentThreadId () returned 0x970 [0049.181] GetCurrentThreadId () returned 0x970 [0049.181] GetCurrentThreadId () returned 0x970 [0049.182] GetCurrentThreadId () returned 0x970 [0049.182] GetCurrentThreadId () returned 0x970 [0049.182] GetCurrentThreadId () returned 0x970 [0049.182] GetCurrentThreadId () returned 0x970 [0049.182] GetCurrentThreadId () returned 0x970 [0049.182] GetCurrentThreadId () returned 0x970 [0049.182] GetCurrentThreadId () returned 0x970 [0049.182] GetCurrentThreadId () returned 0x970 [0049.182] GetCurrentThreadId () returned 0x970 [0049.182] GetCurrentThreadId () returned 0x970 [0049.182] GetCurrentThreadId () returned 0x970 [0049.182] GetCurrentThreadId () returned 0x970 [0049.182] GetCurrentThreadId () returned 0x970 [0049.182] GetCurrentThreadId () returned 0x970 [0049.182] GetCurrentThreadId () returned 0x970 [0049.182] GetCurrentThreadId () returned 0x970 [0049.182] GetCurrentThreadId () returned 0x970 [0049.182] GetCurrentThreadId () returned 0x970 [0049.182] GetCurrentThreadId () returned 0x970 [0049.182] GetCurrentThreadId () returned 0x970 [0049.182] GetCurrentThreadId () returned 0x970 [0049.182] GetCurrentThreadId () returned 0x970 [0049.182] GetCurrentThreadId () returned 0x970 [0049.182] GetCurrentThreadId () returned 0x970 [0049.182] GetCurrentThreadId () returned 0x970 [0049.182] GetCurrentThreadId () returned 0x970 [0049.182] GetCurrentThreadId () returned 0x970 [0049.182] GetCurrentThreadId () returned 0x970 [0049.182] GetCurrentThreadId () returned 0x970 [0049.182] GetCurrentThreadId () returned 0x970 [0049.182] GetCurrentThreadId () returned 0x970 [0049.182] GetCurrentThreadId () returned 0x970 [0049.182] GetCurrentThreadId () returned 0x970 [0049.182] GetCurrentThreadId () returned 0x970 [0049.182] GetCurrentThreadId () returned 0x970 [0049.182] GetCurrentThreadId () returned 0x970 [0049.182] GetCurrentThreadId () returned 0x970 [0049.182] GetCurrentThreadId () returned 0x970 [0049.182] GetCurrentThreadId () returned 0x970 [0049.182] GetCurrentThreadId () returned 0x970 [0049.182] GetCurrentThreadId () returned 0x970 [0049.182] GetCurrentThreadId () returned 0x970 [0049.182] GetCurrentThreadId () returned 0x970 [0049.182] GetCurrentThreadId () returned 0x970 [0049.182] GetCurrentThreadId () returned 0x970 [0049.182] GetCurrentThreadId () returned 0x970 [0049.182] GetCurrentThreadId () returned 0x970 [0049.182] GetCurrentThreadId () returned 0x970 [0049.182] GetCurrentThreadId () returned 0x970 [0049.183] GetCurrentThreadId () returned 0x970 [0049.183] GetCurrentThreadId () returned 0x970 [0049.183] GetCurrentThreadId () returned 0x970 [0049.183] GetCurrentThreadId () returned 0x970 [0049.183] GetCurrentThreadId () returned 0x970 [0049.183] GetCurrentThreadId () returned 0x970 [0049.183] GetCurrentThreadId () returned 0x970 [0049.183] GetCurrentThreadId () returned 0x970 [0049.183] GetCurrentThreadId () returned 0x970 [0049.183] GetCurrentThreadId () returned 0x970 [0049.183] GetCurrentThreadId () returned 0x970 [0049.183] GetCurrentThreadId () returned 0x970 [0049.183] GetCurrentThreadId () returned 0x970 [0049.183] GetCurrentThreadId () returned 0x970 [0049.183] GetCurrentThreadId () returned 0x970 [0049.183] GetCurrentThreadId () returned 0x970 [0049.183] GetCurrentThreadId () returned 0x970 [0049.183] GetCurrentThreadId () returned 0x970 [0049.183] GetCurrentThreadId () returned 0x970 [0049.183] GetCurrentThreadId () returned 0x970 [0049.183] GetCurrentThreadId () returned 0x970 [0049.183] GetCurrentThreadId () returned 0x970 [0049.183] GetCurrentThreadId () returned 0x970 [0049.183] GetCurrentThreadId () returned 0x970 [0049.183] GetCurrentThreadId () returned 0x970 [0049.183] GetCurrentThreadId () returned 0x970 [0049.183] GetCurrentThreadId () returned 0x970 [0049.183] GetCurrentThreadId () returned 0x970 [0049.183] GetCurrentThreadId () returned 0x970 [0049.183] GetCurrentThreadId () returned 0x970 [0049.183] GetCurrentThreadId () returned 0x970 [0049.183] GetCurrentThreadId () returned 0x970 [0049.183] GetCurrentThreadId () returned 0x970 [0049.183] GetCurrentThreadId () returned 0x970 [0049.183] GetCurrentThreadId () returned 0x970 [0049.183] GetCurrentThreadId () returned 0x970 [0049.183] GetCurrentThreadId () returned 0x970 [0049.183] GetCurrentThreadId () returned 0x970 [0049.183] GetCurrentThreadId () returned 0x970 [0049.183] GetCurrentThreadId () returned 0x970 [0049.183] GetCurrentThreadId () returned 0x970 [0049.183] GetCurrentThreadId () returned 0x970 [0049.183] GetCurrentThreadId () returned 0x970 [0049.183] GetCurrentThreadId () returned 0x970 [0049.183] GetCurrentThreadId () returned 0x970 [0049.183] GetCurrentThreadId () returned 0x970 [0049.183] GetCurrentThreadId () returned 0x970 [0049.183] GetCurrentThreadId () returned 0x970 [0049.183] GetCurrentThreadId () returned 0x970 [0049.184] GetCurrentThreadId () returned 0x970 [0049.184] GetCurrentThreadId () returned 0x970 [0049.184] GetCurrentThreadId () returned 0x970 [0049.184] GetCurrentThreadId () returned 0x970 [0049.184] GetCurrentThreadId () returned 0x970 [0049.184] GetCurrentThreadId () returned 0x970 [0049.184] GetCurrentThreadId () returned 0x970 [0049.184] GetCurrentThreadId () returned 0x970 [0049.184] GetCurrentThreadId () returned 0x970 [0049.184] GetCurrentThreadId () returned 0x970 [0049.184] GetCurrentThreadId () returned 0x970 [0049.184] GetCurrentThreadId () returned 0x970 [0049.184] GetCurrentThreadId () returned 0x970 [0049.184] GetCurrentThreadId () returned 0x970 [0049.184] GetCurrentThreadId () returned 0x970 [0049.184] GetCurrentThreadId () returned 0x970 [0049.184] GetCurrentThreadId () returned 0x970 [0049.184] GetCurrentThreadId () returned 0x970 [0049.184] GetCurrentThreadId () returned 0x970 [0049.184] GetCurrentThreadId () returned 0x970 [0049.184] GetCurrentThreadId () returned 0x970 [0049.184] GetCurrentThreadId () returned 0x970 [0049.184] GetCurrentThreadId () returned 0x970 [0049.184] GetCurrentThreadId () returned 0x970 [0049.184] GetCurrentThreadId () returned 0x970 [0049.184] GetCurrentThreadId () returned 0x970 [0049.184] GetCurrentThreadId () returned 0x970 [0049.184] GetCurrentThreadId () returned 0x970 [0049.184] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.184] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.184] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb8b0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.184] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.184] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.184] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb8b0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.184] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.184] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.184] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.184] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.184] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.184] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.184] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.184] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.184] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb910, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3\x13\x86", lpUsedDefaultChar=0x0) returned 10 [0049.185] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.185] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.185] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb910, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3\x13\x86", lpUsedDefaultChar=0x0) returned 10 [0049.185] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.185] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.185] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb910, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3\x13\x86", lpUsedDefaultChar=0x0) returned 10 [0049.185] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x38, wMilliseconds=0x1ef)) [0049.185] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="q30seQ4CKHm4{7zO\"W0@QqzSBN{^3$.E", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0049.185] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="q30seQ4CKHm4{7zO\"W0@QqzSBN{^3$.E", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0049.185] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="q30seQ4CKHm4{7zO\"W0@QqzSBN{^3$.E", cchWideChar=32, lpMultiByteStr=0x2000a48, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="q30seQ4CKHm4{7zO\"W0@QqzSBN{^3$.E", lpUsedDefaultChar=0x0) returned 32 [0049.185] GetCurrentThreadId () returned 0x970 [0049.185] GetCurrentThreadId () returned 0x970 [0049.185] GetCurrentThreadId () returned 0x970 [0049.185] GetCurrentThreadId () returned 0x970 [0049.185] GetCurrentThreadId () returned 0x970 [0049.185] GetCurrentThreadId () returned 0x970 [0049.192] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0049.192] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0049.192] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x202e4b8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0049.192] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x35904f8, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0049.192] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x35904f8, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAHNCwLda0X6NXj9l5/4A9av5Gpe8gM4ZlRsGz3TegO7fn8JJd9LSyW8FIz/jvWMhu2Sbc8zWBgWdRMsx6FNisMDjmx0oNHF8txBT2oW6by5OgLYI0W8F66L0b0l3Ay2kFMCrVK+aOmAuBYh3Fovqhc+lAXWb/PjTeCBKxVo9uofm51jX6oMv2+aqP4qAWzj+2MdGWd+0Pnw/Yltyxg2/cE3jTpf031+vsQ==") returned 232 [0049.192] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x38, wMilliseconds=0x1ef)) [0049.192] GetCurrentThreadId () returned 0x970 [0049.192] GetCurrentThreadId () returned 0x970 [0049.192] GetCurrentThreadId () returned 0x970 [0049.192] GetCurrentThreadId () returned 0x970 [0049.192] GetCurrentThreadId () returned 0x970 [0049.192] GetCurrentThreadId () returned 0x970 [0049.192] GetCurrentThreadId () returned 0x970 [0049.192] GetCurrentThreadId () returned 0x970 [0049.192] GetCurrentThreadId () returned 0x970 [0049.192] GetCurrentThreadId () returned 0x970 [0049.192] GetCurrentThreadId () returned 0x970 [0049.192] GetCurrentThreadId () returned 0x970 [0049.192] GetCurrentThreadId () returned 0x970 [0049.193] GetCurrentThreadId () returned 0x970 [0049.193] GetCurrentThreadId () returned 0x970 [0049.193] GetCurrentThreadId () returned 0x970 [0049.193] GetCurrentThreadId () returned 0x970 [0049.193] GetCurrentThreadId () returned 0x970 [0049.193] GetCurrentThreadId () returned 0x970 [0049.193] GetCurrentThreadId () returned 0x970 [0049.193] GetCurrentThreadId () returned 0x970 [0049.193] GetCurrentThreadId () returned 0x970 [0049.193] GetCurrentThreadId () returned 0x970 [0049.193] GetCurrentThreadId () returned 0x970 [0049.193] GetCurrentThreadId () returned 0x970 [0049.193] GetCurrentThreadId () returned 0x970 [0049.193] GetCurrentThreadId () returned 0x970 [0049.193] GetCurrentThreadId () returned 0x970 [0049.193] GetCurrentThreadId () returned 0x970 [0049.193] GetCurrentThreadId () returned 0x970 [0049.193] GetCurrentThreadId () returned 0x970 [0049.193] GetCurrentThreadId () returned 0x970 [0049.193] GetCurrentThreadId () returned 0x970 [0049.193] GetCurrentThreadId () returned 0x970 [0049.193] GetCurrentThreadId () returned 0x970 [0049.193] GetCurrentThreadId () returned 0x970 [0049.193] GetCurrentThreadId () returned 0x970 [0049.193] GetCurrentThreadId () returned 0x970 [0049.193] GetCurrentThreadId () returned 0x970 [0049.193] GetCurrentThreadId () returned 0x970 [0049.193] GetCurrentThreadId () returned 0x970 [0049.193] GetCurrentThreadId () returned 0x970 [0049.193] GetCurrentThreadId () returned 0x970 [0049.193] GetCurrentThreadId () returned 0x970 [0049.193] GetCurrentThreadId () returned 0x970 [0049.193] GetCurrentThreadId () returned 0x970 [0049.193] GetCurrentThreadId () returned 0x970 [0049.193] GetCurrentThreadId () returned 0x970 [0049.193] GetCurrentThreadId () returned 0x970 [0049.193] GetCurrentThreadId () returned 0x970 [0049.193] GetCurrentThreadId () returned 0x970 [0049.193] GetCurrentThreadId () returned 0x970 [0049.193] GetCurrentThreadId () returned 0x970 [0049.193] GetCurrentThreadId () returned 0x970 [0049.193] GetCurrentThreadId () returned 0x970 [0049.193] GetCurrentThreadId () returned 0x970 [0049.193] GetCurrentThreadId () returned 0x970 [0049.193] GetCurrentThreadId () returned 0x970 [0049.193] GetCurrentThreadId () returned 0x970 [0049.193] GetCurrentThreadId () returned 0x970 [0049.193] GetCurrentThreadId () returned 0x970 [0049.194] GetCurrentThreadId () returned 0x970 [0049.194] GetCurrentThreadId () returned 0x970 [0049.194] GetCurrentThreadId () returned 0x970 [0049.194] GetCurrentThreadId () returned 0x970 [0049.194] GetCurrentThreadId () returned 0x970 [0049.194] GetCurrentThreadId () returned 0x970 [0049.194] GetCurrentThreadId () returned 0x970 [0049.194] GetCurrentThreadId () returned 0x970 [0049.194] GetCurrentThreadId () returned 0x970 [0049.194] GetCurrentThreadId () returned 0x970 [0049.194] GetCurrentThreadId () returned 0x970 [0049.194] GetCurrentThreadId () returned 0x970 [0049.194] GetCurrentThreadId () returned 0x970 [0049.194] GetCurrentThreadId () returned 0x970 [0049.194] GetCurrentThreadId () returned 0x970 [0049.194] GetCurrentThreadId () returned 0x970 [0049.194] GetCurrentThreadId () returned 0x970 [0049.194] GetCurrentThreadId () returned 0x970 [0049.194] GetCurrentThreadId () returned 0x970 [0049.194] GetCurrentThreadId () returned 0x970 [0049.194] GetCurrentThreadId () returned 0x970 [0049.194] GetCurrentThreadId () returned 0x970 [0049.194] GetCurrentThreadId () returned 0x970 [0049.194] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAHNCwLda0X6NXj9l5/4A9av5Gpe8gM4ZlRsGz3TegO7fn8JJd9LSyW8FIz/jvWMhu2Sbc8zWBgWdRMsx6FNisMDjmx0oNHF8txBT2oW6by5OgLYI0W8F66L0b0l3Ay2kFMCrVK+aOmAuBYh3Fovqhc+lAXWb/PjTeCBKxVo9uofm51jX6oMv2+aqP4qAWzj+2MdGWd+0Pnw/Yltyxg2/cE3jTpf031+vsQ==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0049.194] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAHNCwLda0X6NXj9l5/4A9av5Gpe8gM4ZlRsGz3TegO7fn8JJd9LSyW8FIz/jvWMhu2Sbc8zWBgWdRMsx6FNisMDjmx0oNHF8txBT2oW6by5OgLYI0W8F66L0b0l3Ay2kFMCrVK+aOmAuBYh3Fovqhc+lAXWb/PjTeCBKxVo9uofm51jX6oMv2+aqP4qAWzj+2MdGWd+0Pnw/Yltyxg2/cE3jTpf031+vsQ==", cchWideChar=245, lpMultiByteStr=0x353900c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAHNCwLda0X6NXj9l5/4A9av5Gpe8gM4ZlRsGz3TegO7fn8JJd9LSyW8FIz/jvWMhu2Sbc8zWBgWdRMsx6FNisMDjmx0oNHF8txBT2oW6by5OgLYI0W8F66L0b0l3Ay2kFMCrVK+aOmAuBYh3Fovqhc+lAXWb/PjTeCBKxVo9uofm51jX6oMv2+aqP4qAWzj+2MdGWd+0Pnw/Yltyxg2/cE3jTpf031+vsQ==", lpUsedDefaultChar=0x0) returned 245 [0049.194] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0049.194] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0049.194] CloseHandle (hObject=0x158) returned 1 [0049.196] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi")) returned 0 [0049.196] GetLastError () returned 0x5 [0049.196] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi")) returned 0x20 [0049.196] SetLastError (dwErrCode=0x5) [0049.196] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=16946362792) returned 1 [0049.201] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\Файл зашифрован [join.avi].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\Файл зашифрован [join.avi].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0049.205] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0049.205] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0049.205] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0049.205] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0049.205] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0049.205] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0049.205] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0049.205] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0049.205] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0049.205] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0049.205] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0049.205] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0049.205] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0049.206] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0049.206] SetEndOfFile (hFile=0x158) returned 1 [0049.206] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0049.206] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0049.206] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0049.206] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0049.206] WriteFile (in: hFile=0x158, lpBuffer=0x361f5a8*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x361f5a8*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0049.207] WriteFile (in: hFile=0x158, lpBuffer=0x35f005c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f005c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0049.207] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l2Lr)~*,LqE*8ptcf9gX!,flB+:FSGt7", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0049.207] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l2Lr)~*,LqE*8ptcf9gX!,flB+:FSGt7", cchWideChar=32, lpMultiByteStr=0x2032c8c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="l2Lr)~*,LqE*8ptcf9gX!,flB+:FSGt7", lpUsedDefaultChar=0x0) returned 32 [0049.207] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0049.207] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0049.207] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x250aa25, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x250aa25, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5aa753, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36400, dwReserved0=0x0, dwReserved1=0x0, cFileName="join.avi", cAlternateFileName="")) returned 0x295098 [0049.208] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0049.208] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0049.208] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi")) returned 0x20 [0049.208] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi")) returned 0x20 [0049.208] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi")) returned 0x20 [0049.208] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi")) returned 0x20 [0049.208] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x250aa25, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x250aa25, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5aa753, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36400)) returned 1 [0049.208] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0049.208] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0049.208] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi")) returned 0x20 [0049.208] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi")) returned 0x20 [0049.209] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0049.209] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0049.209] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0049.209] SetEndOfFile (hFile=0x158) returned 1 [0049.210] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="join.avi", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0049.210] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="join.avi", cchWideChar=8, lpMultiByteStr=0x1fe410c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="join.avi", lpUsedDefaultChar=0x0) returned 8 [0049.210] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="join.avi", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0049.210] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="join.avi", cchWideChar=8, lpMultiByteStr=0x1fe3c4c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="join.avi", lpUsedDefaultChar=0x0) returned 8 [0049.210] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe3c4c, cbMultiByte=8, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="join.avivii.aviii@\x01") returned 8 [0049.210] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="join.avi", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0049.210] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="join.avi", cchWideChar=8, lpMultiByteStr=0x1fe410c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="join.avi", lpUsedDefaultChar=0x0) returned 8 [0049.210] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0049.210] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0049.210] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x36400 [0049.210] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0049.210] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0049.210] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0049.210] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="join.avi", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0049.210] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="join.avi", cchWideChar=8, lpMultiByteStr=0x1fe410c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="join.avi", lpUsedDefaultChar=0x0) returned 8 [0049.210] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="join.avi", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0049.210] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="join.avi", cchWideChar=8, lpMultiByteStr=0x1fe3c4c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="join.avi", lpUsedDefaultChar=0x0) returned 8 [0049.211] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe3c4c, cbMultiByte=8, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="join.aviin.avivii.aviii@\x01") returned 8 [0049.211] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="join.avi", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0049.211] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="join.avi", cchWideChar=8, lpMultiByteStr=0x1fe410c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="join.avi", lpUsedDefaultChar=0x0) returned 8 [0049.211] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0049.211] CharToOemA (in: pSrc="join.avi", pDst=0x1fe3c4c | out: pDst="join.avi") returned 1 [0049.211] WriteFile (in: hFile=0x158, lpBuffer=0x1fe3c4c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe3c4c*, lpNumberOfBytesWritten=0x18e048*=0x8, lpOverlapped=0x0) returned 1 [0049.212] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0049.212] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0049.212] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0049.212] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=16947530014) returned 1 [0049.212] ReadFile (in: hFile=0x15c, lpBuffer=0x376fb20, nNumberOfBytesToRead=0x36400, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x376fb20*, lpNumberOfBytesRead=0x18dd7c*=0x36400, lpOverlapped=0x0) returned 1 [0049.216] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0049.216] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=16947995522) returned 1 [0049.225] WriteFile (in: hFile=0x158, lpBuffer=0x1fea258*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fea258*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0049.225] ReadFile (in: hFile=0x15c, lpBuffer=0x376fb20, nNumberOfBytesToRead=0x36400, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x376fb20*, lpNumberOfBytesRead=0x18de38*=0x36400, lpOverlapped=0x0) returned 1 [0049.231] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x43 [0049.231] WriteFile (in: hFile=0x158, lpBuffer=0x37e6010*, nNumberOfBytesToWrite=0x36400, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x37e6010*, lpNumberOfBytesWritten=0x18de10*=0x36400, lpOverlapped=0x0) returned 1 [0049.235] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x36443 [0049.235] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0049.235] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0049.235] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0049.235] SetFilePointer (in: hFile=0x158, lDistanceToMove=8, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x26 [0049.235] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x3644d [0049.235] CloseHandle (hObject=0x15c) returned 1 [0049.235] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x3644d [0049.235] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x3644d [0049.236] SetFilePointer (in: hFile=0x158, lDistanceToMove=222285, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x3644d [0049.236] SetFilePointer (in: hFile=0x158, lDistanceToMove=222285, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x3644d [0049.236] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x3644d [0049.236] SetFilePointer (in: hFile=0x158, lDistanceToMove=222285, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x3644d [0049.236] SetEndOfFile (hFile=0x158) returned 1 [0049.236] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x3644d [0049.236] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x3644d [0049.236] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="join.avi", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0049.236] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="join.avi", cchWideChar=8, lpMultiByteStr=0x1fe410c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="join.avi", lpUsedDefaultChar=0x0) returned 8 [0049.236] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="join.avi", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0049.236] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="join.avi", cchWideChar=8, lpMultiByteStr=0x1fe36cc, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="join.avi", lpUsedDefaultChar=0x0) returned 8 [0049.236] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe36cc, cbMultiByte=8, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="join.avi ") returned 8 [0049.236] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="join.avi", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0049.236] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="join.avi", cchWideChar=8, lpMultiByteStr=0x1fe410c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="join.avi", lpUsedDefaultChar=0x0) returned 8 [0049.236] WriteFile (in: hFile=0x158, lpBuffer=0x34e4d28*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x34e4d28*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0049.236] CharToOemA (in: pSrc="join.avi", pDst=0x1fe36cc | out: pDst="join.avi") returned 1 [0049.236] WriteFile (in: hFile=0x158, lpBuffer=0x1fe36cc*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe36cc*, lpNumberOfBytesWritten=0x18efcc*=0x8, lpOverlapped=0x0) returned 1 [0049.236] WriteFile (in: hFile=0x158, lpBuffer=0x1fea428*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea428*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0049.237] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0049.237] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0049.237] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x3648e [0049.237] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x3648e [0049.237] WriteFile (in: hFile=0x158, lpBuffer=0x361f5a8*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x361f5a8*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0049.237] WriteFile (in: hFile=0x158, lpBuffer=0x35f005c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f005c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0049.237] DeleteFileW (lpFileName="") returned 0 [0049.237] GetLastError () returned 0x3 [0049.237] GetFileAttributesW (lpFileName="") returned 0xffffffff [0049.237] SetLastError (dwErrCode=0x3) [0049.237] FlushFileBuffers (hFile=0x158) returned 1 [0049.242] GetCurrentThreadId () returned 0x970 [0049.242] GetCurrentThreadId () returned 0x970 [0049.242] GetCurrentThreadId () returned 0x970 [0049.242] GetCurrentThreadId () returned 0x970 [0049.242] GetCurrentThreadId () returned 0x970 [0049.242] GetCurrentThreadId () returned 0x970 [0049.242] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x36545 [0049.242] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x36545 [0049.243] SetFilePointer (in: hFile=0x158, lDistanceToMove=222533, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x36545 [0049.243] CloseHandle (hObject=0x158) returned 1 [0049.245] GetCurrentThreadId () returned 0x970 [0049.245] GetCurrentThreadId () returned 0x970 [0049.245] GetCurrentThreadId () returned 0x970 [0049.245] GetCurrentThreadId () returned 0x970 [0049.245] GetCurrentThreadId () returned 0x970 [0049.245] GetCurrentThreadId () returned 0x970 [0049.245] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\Файл зашифрован [join.avi].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\Файл зашифрован [join.avi].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0049.245] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x36545 [0049.246] SetFilePointer (in: hFile=0x158, lDistanceToMove=222405, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x364c5 [0049.246] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0049.246] GetFileType (hFile=0x158) returned 0x1 [0049.246] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x38, wMilliseconds=0x21e)) [0049.246] GetCurrentThreadId () returned 0x970 [0049.246] GetCurrentThreadId () returned 0x970 [0049.246] GetCurrentThreadId () returned 0x970 [0049.246] GetCurrentThreadId () returned 0x970 [0049.246] GetCurrentThreadId () returned 0x970 [0049.246] GetCurrentThreadId () returned 0x970 [0049.246] GetCurrentThreadId () returned 0x970 [0049.246] GetCurrentThreadId () returned 0x970 [0049.246] GetCurrentThreadId () returned 0x970 [0049.246] GetCurrentThreadId () returned 0x970 [0049.246] GetCurrentThreadId () returned 0x970 [0049.246] GetCurrentThreadId () returned 0x970 [0049.246] GetCurrentThreadId () returned 0x970 [0049.246] GetCurrentThreadId () returned 0x970 [0049.246] GetCurrentThreadId () returned 0x970 [0049.246] GetCurrentThreadId () returned 0x970 [0049.246] GetCurrentThreadId () returned 0x970 [0049.246] GetCurrentThreadId () returned 0x970 [0049.246] GetCurrentThreadId () returned 0x970 [0049.246] GetCurrentThreadId () returned 0x970 [0049.246] GetCurrentThreadId () returned 0x970 [0049.246] GetCurrentThreadId () returned 0x970 [0049.246] GetCurrentThreadId () returned 0x970 [0049.246] GetCurrentThreadId () returned 0x970 [0049.246] GetCurrentThreadId () returned 0x970 [0049.246] GetCurrentThreadId () returned 0x970 [0049.246] GetCurrentThreadId () returned 0x970 [0049.246] GetCurrentThreadId () returned 0x970 [0049.246] GetCurrentThreadId () returned 0x970 [0049.246] GetCurrentThreadId () returned 0x970 [0049.246] GetCurrentThreadId () returned 0x970 [0049.246] GetCurrentThreadId () returned 0x970 [0049.246] GetCurrentThreadId () returned 0x970 [0049.246] GetCurrentThreadId () returned 0x970 [0049.246] GetCurrentThreadId () returned 0x970 [0049.246] GetCurrentThreadId () returned 0x970 [0049.246] GetCurrentThreadId () returned 0x970 [0049.247] GetCurrentThreadId () returned 0x970 [0049.247] GetCurrentThreadId () returned 0x970 [0049.247] GetCurrentThreadId () returned 0x970 [0049.247] GetCurrentThreadId () returned 0x970 [0049.247] GetCurrentThreadId () returned 0x970 [0049.247] GetCurrentThreadId () returned 0x970 [0049.247] GetCurrentThreadId () returned 0x970 [0049.247] GetCurrentThreadId () returned 0x970 [0049.247] GetCurrentThreadId () returned 0x970 [0049.247] GetCurrentThreadId () returned 0x970 [0049.247] GetCurrentThreadId () returned 0x970 [0049.247] GetCurrentThreadId () returned 0x970 [0049.247] GetCurrentThreadId () returned 0x970 [0049.247] GetCurrentThreadId () returned 0x970 [0049.247] GetCurrentThreadId () returned 0x970 [0049.247] GetCurrentThreadId () returned 0x970 [0049.247] GetCurrentThreadId () returned 0x970 [0049.247] GetCurrentThreadId () returned 0x970 [0049.247] GetCurrentThreadId () returned 0x970 [0049.247] GetCurrentThreadId () returned 0x970 [0049.247] GetCurrentThreadId () returned 0x970 [0049.247] GetCurrentThreadId () returned 0x970 [0049.247] GetCurrentThreadId () returned 0x970 [0049.247] GetCurrentThreadId () returned 0x970 [0049.247] GetCurrentThreadId () returned 0x970 [0049.247] GetCurrentThreadId () returned 0x970 [0049.247] GetCurrentThreadId () returned 0x970 [0049.247] GetCurrentThreadId () returned 0x970 [0049.247] GetCurrentThreadId () returned 0x970 [0049.247] GetCurrentThreadId () returned 0x970 [0049.247] GetCurrentThreadId () returned 0x970 [0049.247] GetCurrentThreadId () returned 0x970 [0049.247] GetCurrentThreadId () returned 0x970 [0049.247] GetCurrentThreadId () returned 0x970 [0049.247] GetCurrentThreadId () returned 0x970 [0049.247] GetCurrentThreadId () returned 0x970 [0049.247] GetCurrentThreadId () returned 0x970 [0049.247] GetCurrentThreadId () returned 0x970 [0049.247] GetCurrentThreadId () returned 0x970 [0049.247] GetCurrentThreadId () returned 0x970 [0049.247] GetCurrentThreadId () returned 0x970 [0049.247] GetCurrentThreadId () returned 0x970 [0049.247] GetCurrentThreadId () returned 0x970 [0049.247] GetCurrentThreadId () returned 0x970 [0049.247] GetCurrentThreadId () returned 0x970 [0049.247] GetCurrentThreadId () returned 0x970 [0049.248] GetCurrentThreadId () returned 0x970 [0049.248] GetCurrentThreadId () returned 0x970 [0049.248] GetCurrentThreadId () returned 0x970 [0049.248] GetCurrentThreadId () returned 0x970 [0049.248] GetCurrentThreadId () returned 0x970 [0049.248] GetCurrentThreadId () returned 0x970 [0049.248] GetCurrentThreadId () returned 0x970 [0049.248] GetCurrentThreadId () returned 0x970 [0049.248] GetCurrentThreadId () returned 0x970 [0049.248] GetCurrentThreadId () returned 0x970 [0049.248] GetCurrentThreadId () returned 0x970 [0049.248] GetCurrentThreadId () returned 0x970 [0049.248] GetCurrentThreadId () returned 0x970 [0049.248] GetCurrentThreadId () returned 0x970 [0049.248] GetCurrentThreadId () returned 0x970 [0049.248] GetCurrentThreadId () returned 0x970 [0049.248] GetCurrentThreadId () returned 0x970 [0049.248] GetCurrentThreadId () returned 0x970 [0049.248] GetCurrentThreadId () returned 0x970 [0049.248] GetCurrentThreadId () returned 0x970 [0049.248] GetCurrentThreadId () returned 0x970 [0049.248] GetCurrentThreadId () returned 0x970 [0049.248] GetCurrentThreadId () returned 0x970 [0049.248] GetCurrentThreadId () returned 0x970 [0049.248] GetCurrentThreadId () returned 0x970 [0049.248] GetCurrentThreadId () returned 0x970 [0049.248] GetCurrentThreadId () returned 0x970 [0049.248] GetCurrentThreadId () returned 0x970 [0049.248] GetCurrentThreadId () returned 0x970 [0049.248] GetCurrentThreadId () returned 0x970 [0049.248] GetCurrentThreadId () returned 0x970 [0049.248] GetCurrentThreadId () returned 0x970 [0049.248] GetCurrentThreadId () returned 0x970 [0049.248] GetCurrentThreadId () returned 0x970 [0049.248] GetCurrentThreadId () returned 0x970 [0049.248] GetCurrentThreadId () returned 0x970 [0049.248] GetCurrentThreadId () returned 0x970 [0049.248] GetCurrentThreadId () returned 0x970 [0049.248] GetCurrentThreadId () returned 0x970 [0049.248] GetCurrentThreadId () returned 0x970 [0049.248] GetCurrentThreadId () returned 0x970 [0049.248] GetCurrentThreadId () returned 0x970 [0049.248] GetCurrentThreadId () returned 0x970 [0049.248] GetCurrentThreadId () returned 0x970 [0049.248] GetCurrentThreadId () returned 0x970 [0049.248] GetCurrentThreadId () returned 0x970 [0049.248] GetCurrentThreadId () returned 0x970 [0049.248] GetCurrentThreadId () returned 0x970 [0049.249] GetCurrentThreadId () returned 0x970 [0049.249] GetCurrentThreadId () returned 0x970 [0049.249] GetCurrentThreadId () returned 0x970 [0049.249] GetCurrentThreadId () returned 0x970 [0049.249] GetCurrentThreadId () returned 0x970 [0049.249] GetCurrentThreadId () returned 0x970 [0049.249] GetCurrentThreadId () returned 0x970 [0049.249] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.249] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.249] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb910, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.249] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.249] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.249] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb910, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.249] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.249] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.249] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.249] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.249] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.249] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.249] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.249] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.249] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb970, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3\x08æ", lpUsedDefaultChar=0x0) returned 10 [0049.249] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.249] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.249] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb970, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3\x08æ", lpUsedDefaultChar=0x0) returned 10 [0049.249] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.249] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.249] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb970, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3\x08æ", lpUsedDefaultChar=0x0) returned 10 [0049.249] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x38, wMilliseconds=0x22e)) [0049.249] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="l2Lr)~*,LqE*8ptcf9gX!,flB+:FSGt7", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0049.249] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="l2Lr)~*,LqE*8ptcf9gX!,flB+:FSGt7", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0049.249] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="l2Lr)~*,LqE*8ptcf9gX!,flB+:FSGt7", cchWideChar=32, lpMultiByteStr=0x2000a78, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="l2Lr)~*,LqE*8ptcf9gX!,flB+:FSGt7", lpUsedDefaultChar=0x0) returned 32 [0049.249] GetCurrentThreadId () returned 0x970 [0049.250] GetCurrentThreadId () returned 0x970 [0049.250] GetCurrentThreadId () returned 0x970 [0049.250] GetCurrentThreadId () returned 0x970 [0049.250] GetCurrentThreadId () returned 0x970 [0049.250] GetCurrentThreadId () returned 0x970 [0049.257] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0049.257] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0049.257] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x202e5a8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0049.257] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x35904f8, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0049.257] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x35904f8, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAADcKWXz7J+Qp1mo1N+FCatviQYaGyUNZVLUQZ3IMEr7PHzd6cCXaE57Qh6sgNqdaOz/5VtbJukXmTHjljZZudDS0PYVVyeW1UQtHhuhqMaSCgw4yLqKjxPjVWKsxpOEJrT/5HHo2IuN0DBD6lG2IbQci6bfLuXlL4OmNyRHWGnMYYIYHxJ91B4saqoCktpelwwEGRwVT87i+WApdSyn7jG2RuyQTF18xug==") returned 232 [0049.257] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x38, wMilliseconds=0x22e)) [0049.257] GetCurrentThreadId () returned 0x970 [0049.257] GetCurrentThreadId () returned 0x970 [0049.257] GetCurrentThreadId () returned 0x970 [0049.257] GetCurrentThreadId () returned 0x970 [0049.257] GetCurrentThreadId () returned 0x970 [0049.258] GetCurrentThreadId () returned 0x970 [0049.258] GetCurrentThreadId () returned 0x970 [0049.258] GetCurrentThreadId () returned 0x970 [0049.258] GetCurrentThreadId () returned 0x970 [0049.258] GetCurrentThreadId () returned 0x970 [0049.258] GetCurrentThreadId () returned 0x970 [0049.258] GetCurrentThreadId () returned 0x970 [0049.258] GetCurrentThreadId () returned 0x970 [0049.258] GetCurrentThreadId () returned 0x970 [0049.258] GetCurrentThreadId () returned 0x970 [0049.258] GetCurrentThreadId () returned 0x970 [0049.258] GetCurrentThreadId () returned 0x970 [0049.258] GetCurrentThreadId () returned 0x970 [0049.258] GetCurrentThreadId () returned 0x970 [0049.258] GetCurrentThreadId () returned 0x970 [0049.258] GetCurrentThreadId () returned 0x970 [0049.258] GetCurrentThreadId () returned 0x970 [0049.258] GetCurrentThreadId () returned 0x970 [0049.258] GetCurrentThreadId () returned 0x970 [0049.258] GetCurrentThreadId () returned 0x970 [0049.258] GetCurrentThreadId () returned 0x970 [0049.258] GetCurrentThreadId () returned 0x970 [0049.258] GetCurrentThreadId () returned 0x970 [0049.258] GetCurrentThreadId () returned 0x970 [0049.258] GetCurrentThreadId () returned 0x970 [0049.258] GetCurrentThreadId () returned 0x970 [0049.258] GetCurrentThreadId () returned 0x970 [0049.258] GetCurrentThreadId () returned 0x970 [0049.258] GetCurrentThreadId () returned 0x970 [0049.258] GetCurrentThreadId () returned 0x970 [0049.258] GetCurrentThreadId () returned 0x970 [0049.258] GetCurrentThreadId () returned 0x970 [0049.258] GetCurrentThreadId () returned 0x970 [0049.258] GetCurrentThreadId () returned 0x970 [0049.258] GetCurrentThreadId () returned 0x970 [0049.258] GetCurrentThreadId () returned 0x970 [0049.258] GetCurrentThreadId () returned 0x970 [0049.258] GetCurrentThreadId () returned 0x970 [0049.258] GetCurrentThreadId () returned 0x970 [0049.258] GetCurrentThreadId () returned 0x970 [0049.258] GetCurrentThreadId () returned 0x970 [0049.258] GetCurrentThreadId () returned 0x970 [0049.258] GetCurrentThreadId () returned 0x970 [0049.258] GetCurrentThreadId () returned 0x970 [0049.258] GetCurrentThreadId () returned 0x970 [0049.258] GetCurrentThreadId () returned 0x970 [0049.258] GetCurrentThreadId () returned 0x970 [0049.259] GetCurrentThreadId () returned 0x970 [0049.259] GetCurrentThreadId () returned 0x970 [0049.259] GetCurrentThreadId () returned 0x970 [0049.259] GetCurrentThreadId () returned 0x970 [0049.259] GetCurrentThreadId () returned 0x970 [0049.259] GetCurrentThreadId () returned 0x970 [0049.259] GetCurrentThreadId () returned 0x970 [0049.259] GetCurrentThreadId () returned 0x970 [0049.259] GetCurrentThreadId () returned 0x970 [0049.259] GetCurrentThreadId () returned 0x970 [0049.259] GetCurrentThreadId () returned 0x970 [0049.259] GetCurrentThreadId () returned 0x970 [0049.259] GetCurrentThreadId () returned 0x970 [0049.259] GetCurrentThreadId () returned 0x970 [0049.259] GetCurrentThreadId () returned 0x970 [0049.259] GetCurrentThreadId () returned 0x970 [0049.259] GetCurrentThreadId () returned 0x970 [0049.259] GetCurrentThreadId () returned 0x970 [0049.259] GetCurrentThreadId () returned 0x970 [0049.259] GetCurrentThreadId () returned 0x970 [0049.259] GetCurrentThreadId () returned 0x970 [0049.259] GetCurrentThreadId () returned 0x970 [0049.259] GetCurrentThreadId () returned 0x970 [0049.259] GetCurrentThreadId () returned 0x970 [0049.259] GetCurrentThreadId () returned 0x970 [0049.259] GetCurrentThreadId () returned 0x970 [0049.259] GetCurrentThreadId () returned 0x970 [0049.259] GetCurrentThreadId () returned 0x970 [0049.259] GetCurrentThreadId () returned 0x970 [0049.259] GetCurrentThreadId () returned 0x970 [0049.259] GetCurrentThreadId () returned 0x970 [0049.259] GetCurrentThreadId () returned 0x970 [0049.259] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAADcKWXz7J+Qp1mo1N+FCatviQYaGyUNZVLUQZ3IMEr7PHzd6cCXaE57Qh6sgNqdaOz/5VtbJukXmTHjljZZudDS0PYVVyeW1UQtHhuhqMaSCgw4yLqKjxPjVWKsxpOEJrT/5HHo2IuN0DBD6lG2IbQci6bfLuXlL4OmNyRHWGnMYYIYHxJ91B4saqoCktpelwwEGRwVT87i+WApdSyn7jG2RuyQTF18xug==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0049.259] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAADcKWXz7J+Qp1mo1N+FCatviQYaGyUNZVLUQZ3IMEr7PHzd6cCXaE57Qh6sgNqdaOz/5VtbJukXmTHjljZZudDS0PYVVyeW1UQtHhuhqMaSCgw4yLqKjxPjVWKsxpOEJrT/5HHo2IuN0DBD6lG2IbQci6bfLuXlL4OmNyRHWGnMYYIYHxJ91B4saqoCktpelwwEGRwVT87i+WApdSyn7jG2RuyQTF18xug==", cchWideChar=245, lpMultiByteStr=0x353900c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAADcKWXz7J+Qp1mo1N+FCatviQYaGyUNZVLUQZ3IMEr7PHzd6cCXaE57Qh6sgNqdaOz/5VtbJukXmTHjljZZudDS0PYVVyeW1UQtHhuhqMaSCgw4yLqKjxPjVWKsxpOEJrT/5HHo2IuN0DBD6lG2IbQci6bfLuXlL4OmNyRHWGnMYYIYHxJ91B4saqoCktpelwwEGRwVT87i+WApdSyn7jG2RuyQTF18xug==", lpUsedDefaultChar=0x0) returned 245 [0049.259] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0049.260] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0049.260] CloseHandle (hObject=0x158) returned 1 [0049.261] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi")) returned 0 [0049.262] GetLastError () returned 0x5 [0049.262] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi")) returned 0x20 [0049.262] SetLastError (dwErrCode=0x5) [0049.262] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=16952508660) returned 1 [0049.262] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\Файл зашифрован [split.avi].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\Файл зашифрован [split.avi].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0049.262] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0049.262] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0049.262] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0049.262] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0049.262] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0049.262] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0049.262] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0049.262] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0049.262] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0049.262] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0049.263] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0049.263] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0049.263] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0049.263] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0049.263] SetEndOfFile (hFile=0x158) returned 1 [0049.263] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0049.263] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0049.263] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0049.263] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0049.263] WriteFile (in: hFile=0x158, lpBuffer=0x361f5a8*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x361f5a8*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0049.264] WriteFile (in: hFile=0x158, lpBuffer=0x35f011c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f011c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0049.264] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="En4r>D\\U}vDFSZLA1FR(RWCRWrxti)6r", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0049.264] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="En4r>D\\U}vDFSZLA1FR(RWCRWrxti)6r", cchWideChar=32, lpMultiByteStr=0x20327f4, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="En4r>D\\U}vDFSZLA1FR(RWCRWrxti)6r", lpUsedDefaultChar=0x0) returned 32 [0049.264] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0049.264] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0049.264] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25c90f6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x25c90f6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5d08b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2f600, dwReserved0=0x0, dwReserved1=0x0, cFileName="split.avi", cAlternateFileName="")) returned 0x295098 [0049.264] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0049.264] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0049.264] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi")) returned 0x20 [0049.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi")) returned 0x20 [0049.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi")) returned 0x20 [0049.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi")) returned 0x20 [0049.265] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25c90f6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x25c90f6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5d08b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2f600)) returned 1 [0049.265] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0049.265] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0049.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi")) returned 0x20 [0049.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi")) returned 0x20 [0049.265] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0049.265] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0049.265] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0049.265] SetEndOfFile (hFile=0x158) returned 1 [0049.266] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="split.avi", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0049.266] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="split.avi", cchWideChar=9, lpMultiByteStr=0x1fe3aac, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="split.avi", lpUsedDefaultChar=0x0) returned 9 [0049.266] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="split.avi", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0049.266] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="split.avi", cchWideChar=9, lpMultiByteStr=0x1fe388c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="split.avi", lpUsedDefaultChar=0x0) returned 9 [0049.266] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe388c, cbMultiByte=9, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="split.aviii.aviii@\x01") returned 9 [0049.266] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="split.avi", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0049.266] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="split.avi", cchWideChar=9, lpMultiByteStr=0x1fe3aac, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="split.avi", lpUsedDefaultChar=0x0) returned 9 [0049.266] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0049.266] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0049.266] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2f600 [0049.266] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0049.267] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0049.267] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0049.267] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="split.avi", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0049.267] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="split.avi", cchWideChar=9, lpMultiByteStr=0x1fe3aac, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="split.avi", lpUsedDefaultChar=0x0) returned 9 [0049.267] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="split.avi", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0049.267] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="split.avi", cchWideChar=9, lpMultiByteStr=0x1fe388c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="split.avi", lpUsedDefaultChar=0x0) returned 9 [0049.267] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe388c, cbMultiByte=9, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="split.aviit.aviii.aviii@\x01") returned 9 [0049.267] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="split.avi", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0049.267] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="split.avi", cchWideChar=9, lpMultiByteStr=0x1fe3aac, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="split.avi", lpUsedDefaultChar=0x0) returned 9 [0049.267] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0049.268] CharToOemA (in: pSrc="split.avi", pDst=0x1fe388c | out: pDst="split.avi") returned 1 [0049.268] WriteFile (in: hFile=0x158, lpBuffer=0x1fe388c*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe388c*, lpNumberOfBytesWritten=0x18e048*=0x9, lpOverlapped=0x0) returned 1 [0049.268] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0049.268] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0049.268] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0049.268] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=16953157396) returned 1 [0049.268] ReadFile (in: hFile=0x15c, lpBuffer=0x376fb20, nNumberOfBytesToRead=0x2f600, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x376fb20*, lpNumberOfBytesRead=0x18dd7c*=0x2f600, lpOverlapped=0x0) returned 1 [0049.271] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0049.271] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=16953475430) returned 1 [0049.280] WriteFile (in: hFile=0x158, lpBuffer=0x1fea378*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fea378*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0049.280] ReadFile (in: hFile=0x15c, lpBuffer=0x376fb20, nNumberOfBytesToRead=0x2f600, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x376fb20*, lpNumberOfBytesRead=0x18de38*=0x2f600, lpOverlapped=0x0) returned 1 [0049.285] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x44 [0049.285] WriteFile (in: hFile=0x158, lpBuffer=0x37df210*, nNumberOfBytesToWrite=0x2f600, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x37df210*, lpNumberOfBytesWritten=0x18de10*=0x2f600, lpOverlapped=0x0) returned 1 [0049.288] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x2f644 [0049.288] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0049.288] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0049.288] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0049.288] SetFilePointer (in: hFile=0x158, lDistanceToMove=9, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x27 [0049.288] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x2f64e [0049.288] CloseHandle (hObject=0x15c) returned 1 [0049.288] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x2f64e [0049.288] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x2f64e [0049.288] SetFilePointer (in: hFile=0x158, lDistanceToMove=194126, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x2f64e [0049.288] SetFilePointer (in: hFile=0x158, lDistanceToMove=194126, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x2f64e [0049.288] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x2f64e [0049.289] SetFilePointer (in: hFile=0x158, lDistanceToMove=194126, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x2f64e [0049.289] SetEndOfFile (hFile=0x158) returned 1 [0049.289] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x2f64e [0049.289] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x2f64e [0049.289] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="split.avi", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0049.289] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="split.avi", cchWideChar=9, lpMultiByteStr=0x1fe3aac, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="split.avi", lpUsedDefaultChar=0x0) returned 9 [0049.289] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="split.avi", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0049.289] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="split.avi", cchWideChar=9, lpMultiByteStr=0x1fe368c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="split.avi", lpUsedDefaultChar=0x0) returned 9 [0049.289] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe368c, cbMultiByte=9, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="split.avi") returned 9 [0049.289] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="split.avi", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0049.289] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="split.avi", cchWideChar=9, lpMultiByteStr=0x1fe3aac, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="split.avi", lpUsedDefaultChar=0x0) returned 9 [0049.289] WriteFile (in: hFile=0x158, lpBuffer=0x34e4d28*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x34e4d28*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0049.289] CharToOemA (in: pSrc="split.avi", pDst=0x1fe368c | out: pDst="split.avi") returned 1 [0049.289] WriteFile (in: hFile=0x158, lpBuffer=0x1fe368c*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe368c*, lpNumberOfBytesWritten=0x18efcc*=0x9, lpOverlapped=0x0) returned 1 [0049.289] WriteFile (in: hFile=0x158, lpBuffer=0x1fea128*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea128*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0049.289] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0049.290] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0049.290] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x2f690 [0049.290] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x2f690 [0049.290] WriteFile (in: hFile=0x158, lpBuffer=0x361f5a8*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x361f5a8*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0049.290] WriteFile (in: hFile=0x158, lpBuffer=0x35f011c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f011c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0049.290] DeleteFileW (lpFileName="") returned 0 [0049.290] GetLastError () returned 0x3 [0049.290] GetFileAttributesW (lpFileName="") returned 0xffffffff [0049.290] SetLastError (dwErrCode=0x3) [0049.290] FlushFileBuffers (hFile=0x158) returned 1 [0049.299] GetCurrentThreadId () returned 0x970 [0049.299] GetCurrentThreadId () returned 0x970 [0049.299] GetCurrentThreadId () returned 0x970 [0049.299] GetCurrentThreadId () returned 0x970 [0049.299] GetCurrentThreadId () returned 0x970 [0049.299] GetCurrentThreadId () returned 0x970 [0049.299] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x2f747 [0049.299] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x2f747 [0049.299] SetFilePointer (in: hFile=0x158, lDistanceToMove=194375, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x2f747 [0049.300] CloseHandle (hObject=0x158) returned 1 [0049.302] GetCurrentThreadId () returned 0x970 [0049.302] GetCurrentThreadId () returned 0x970 [0049.302] GetCurrentThreadId () returned 0x970 [0049.302] GetCurrentThreadId () returned 0x970 [0049.302] GetCurrentThreadId () returned 0x970 [0049.302] GetCurrentThreadId () returned 0x970 [0049.302] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\Файл зашифрован [split.avi].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\Файл зашифрован [split.avi].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0049.302] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2f747 [0049.302] SetFilePointer (in: hFile=0x158, lDistanceToMove=194247, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2f6c7 [0049.302] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0049.302] GetFileType (hFile=0x158) returned 0x1 [0049.302] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x38, wMilliseconds=0x25c)) [0049.302] GetCurrentThreadId () returned 0x970 [0049.302] GetCurrentThreadId () returned 0x970 [0049.302] GetCurrentThreadId () returned 0x970 [0049.302] GetCurrentThreadId () returned 0x970 [0049.302] GetCurrentThreadId () returned 0x970 [0049.302] GetCurrentThreadId () returned 0x970 [0049.302] GetCurrentThreadId () returned 0x970 [0049.302] GetCurrentThreadId () returned 0x970 [0049.302] GetCurrentThreadId () returned 0x970 [0049.302] GetCurrentThreadId () returned 0x970 [0049.302] GetCurrentThreadId () returned 0x970 [0049.302] GetCurrentThreadId () returned 0x970 [0049.303] GetCurrentThreadId () returned 0x970 [0049.303] GetCurrentThreadId () returned 0x970 [0049.303] GetCurrentThreadId () returned 0x970 [0049.303] GetCurrentThreadId () returned 0x970 [0049.303] GetCurrentThreadId () returned 0x970 [0049.303] GetCurrentThreadId () returned 0x970 [0049.303] GetCurrentThreadId () returned 0x970 [0049.303] GetCurrentThreadId () returned 0x970 [0049.303] GetCurrentThreadId () returned 0x970 [0049.303] GetCurrentThreadId () returned 0x970 [0049.303] GetCurrentThreadId () returned 0x970 [0049.303] GetCurrentThreadId () returned 0x970 [0049.303] GetCurrentThreadId () returned 0x970 [0049.303] GetCurrentThreadId () returned 0x970 [0049.303] GetCurrentThreadId () returned 0x970 [0049.303] GetCurrentThreadId () returned 0x970 [0049.303] GetCurrentThreadId () returned 0x970 [0049.303] GetCurrentThreadId () returned 0x970 [0049.303] GetCurrentThreadId () returned 0x970 [0049.303] GetCurrentThreadId () returned 0x970 [0049.303] GetCurrentThreadId () returned 0x970 [0049.303] GetCurrentThreadId () returned 0x970 [0049.303] GetCurrentThreadId () returned 0x970 [0049.303] GetCurrentThreadId () returned 0x970 [0049.303] GetCurrentThreadId () returned 0x970 [0049.303] GetCurrentThreadId () returned 0x970 [0049.303] GetCurrentThreadId () returned 0x970 [0049.303] GetCurrentThreadId () returned 0x970 [0049.303] GetCurrentThreadId () returned 0x970 [0049.303] GetCurrentThreadId () returned 0x970 [0049.303] GetCurrentThreadId () returned 0x970 [0049.303] GetCurrentThreadId () returned 0x970 [0049.303] GetCurrentThreadId () returned 0x970 [0049.303] GetCurrentThreadId () returned 0x970 [0049.303] GetCurrentThreadId () returned 0x970 [0049.303] GetCurrentThreadId () returned 0x970 [0049.303] GetCurrentThreadId () returned 0x970 [0049.303] GetCurrentThreadId () returned 0x970 [0049.303] GetCurrentThreadId () returned 0x970 [0049.303] GetCurrentThreadId () returned 0x970 [0049.303] GetCurrentThreadId () returned 0x970 [0049.303] GetCurrentThreadId () returned 0x970 [0049.303] GetCurrentThreadId () returned 0x970 [0049.303] GetCurrentThreadId () returned 0x970 [0049.303] GetCurrentThreadId () returned 0x970 [0049.303] GetCurrentThreadId () returned 0x970 [0049.303] GetCurrentThreadId () returned 0x970 [0049.303] GetCurrentThreadId () returned 0x970 [0049.304] GetCurrentThreadId () returned 0x970 [0049.304] GetCurrentThreadId () returned 0x970 [0049.304] GetCurrentThreadId () returned 0x970 [0049.304] GetCurrentThreadId () returned 0x970 [0049.304] GetCurrentThreadId () returned 0x970 [0049.304] GetCurrentThreadId () returned 0x970 [0049.304] GetCurrentThreadId () returned 0x970 [0049.304] GetCurrentThreadId () returned 0x970 [0049.304] GetCurrentThreadId () returned 0x970 [0049.304] GetCurrentThreadId () returned 0x970 [0049.304] GetCurrentThreadId () returned 0x970 [0049.304] GetCurrentThreadId () returned 0x970 [0049.304] GetCurrentThreadId () returned 0x970 [0049.304] GetCurrentThreadId () returned 0x970 [0049.304] GetCurrentThreadId () returned 0x970 [0049.304] GetCurrentThreadId () returned 0x970 [0049.304] GetCurrentThreadId () returned 0x970 [0049.304] GetCurrentThreadId () returned 0x970 [0049.304] GetCurrentThreadId () returned 0x970 [0049.304] GetCurrentThreadId () returned 0x970 [0049.304] GetCurrentThreadId () returned 0x970 [0049.304] GetCurrentThreadId () returned 0x970 [0049.304] GetCurrentThreadId () returned 0x970 [0049.304] GetCurrentThreadId () returned 0x970 [0049.304] GetCurrentThreadId () returned 0x970 [0049.304] GetCurrentThreadId () returned 0x970 [0049.304] GetCurrentThreadId () returned 0x970 [0049.304] GetCurrentThreadId () returned 0x970 [0049.304] GetCurrentThreadId () returned 0x970 [0049.304] GetCurrentThreadId () returned 0x970 [0049.304] GetCurrentThreadId () returned 0x970 [0049.304] GetCurrentThreadId () returned 0x970 [0049.304] GetCurrentThreadId () returned 0x970 [0049.304] GetCurrentThreadId () returned 0x970 [0049.304] GetCurrentThreadId () returned 0x970 [0049.304] GetCurrentThreadId () returned 0x970 [0049.304] GetCurrentThreadId () returned 0x970 [0049.304] GetCurrentThreadId () returned 0x970 [0049.304] GetCurrentThreadId () returned 0x970 [0049.304] GetCurrentThreadId () returned 0x970 [0049.304] GetCurrentThreadId () returned 0x970 [0049.304] GetCurrentThreadId () returned 0x970 [0049.304] GetCurrentThreadId () returned 0x970 [0049.304] GetCurrentThreadId () returned 0x970 [0049.304] GetCurrentThreadId () returned 0x970 [0049.304] GetCurrentThreadId () returned 0x970 [0049.304] GetCurrentThreadId () returned 0x970 [0049.304] GetCurrentThreadId () returned 0x970 [0049.304] GetCurrentThreadId () returned 0x970 [0049.305] GetCurrentThreadId () returned 0x970 [0049.305] GetCurrentThreadId () returned 0x970 [0049.305] GetCurrentThreadId () returned 0x970 [0049.305] GetCurrentThreadId () returned 0x970 [0049.305] GetCurrentThreadId () returned 0x970 [0049.305] GetCurrentThreadId () returned 0x970 [0049.305] GetCurrentThreadId () returned 0x970 [0049.305] GetCurrentThreadId () returned 0x970 [0049.305] GetCurrentThreadId () returned 0x970 [0049.305] GetCurrentThreadId () returned 0x970 [0049.305] GetCurrentThreadId () returned 0x970 [0049.305] GetCurrentThreadId () returned 0x970 [0049.305] GetCurrentThreadId () returned 0x970 [0049.305] GetCurrentThreadId () returned 0x970 [0049.305] GetCurrentThreadId () returned 0x970 [0049.305] GetCurrentThreadId () returned 0x970 [0049.305] GetCurrentThreadId () returned 0x970 [0049.305] GetCurrentThreadId () returned 0x970 [0049.305] GetCurrentThreadId () returned 0x970 [0049.305] GetCurrentThreadId () returned 0x970 [0049.305] GetCurrentThreadId () returned 0x970 [0049.305] GetCurrentThreadId () returned 0x970 [0049.305] GetCurrentThreadId () returned 0x970 [0049.305] GetCurrentThreadId () returned 0x970 [0049.305] GetCurrentThreadId () returned 0x970 [0049.305] GetCurrentThreadId () returned 0x970 [0049.305] GetCurrentThreadId () returned 0x970 [0049.305] GetCurrentThreadId () returned 0x970 [0049.305] GetCurrentThreadId () returned 0x970 [0049.305] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.305] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.305] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb970, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.305] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.305] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.305] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb970, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.305] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.305] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.305] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.305] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.305] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.305] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.305] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.306] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.306] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb9d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.306] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.306] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.306] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb9d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.306] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.306] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.306] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb9d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.306] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x38, wMilliseconds=0x25c)) [0049.306] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="En4r>D\\U}vDFSZLA1FR(RWCRWrxti)6r", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0049.306] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="En4r>D\\U}vDFSZLA1FR(RWCRWrxti)6r", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0049.306] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="En4r>D\\U}vDFSZLA1FR(RWCRWrxti)6r", cchWideChar=32, lpMultiByteStr=0x2000aa8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="En4r>D\\U}vDFSZLA1FR(RWCRWrxti)6r", lpUsedDefaultChar=0x0) returned 32 [0049.306] GetCurrentThreadId () returned 0x970 [0049.306] GetCurrentThreadId () returned 0x970 [0049.306] GetCurrentThreadId () returned 0x970 [0049.306] GetCurrentThreadId () returned 0x970 [0049.306] GetCurrentThreadId () returned 0x970 [0049.306] GetCurrentThreadId () returned 0x970 [0049.313] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0049.313] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0049.313] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x202e698, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0049.313] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x35904f8, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0049.313] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x35904f8, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAFwyUSGoWZ0cYtrV6DbtachYKlYjsw4f9DCgZ8B3MQQw7N0L4rbKa8m/rnlqEtAfGORZVYCP4LLybbUnaZNgtvNzLIX9D2E/5+fZD5Rrx0SCnwMxEVfrmp8qryzy/SnGD+a/sdWOPD31IjAEl3s3nGgxMBPZmajRx5QAF1RYETUnbkwhFFz3cjAnhumizC7S25kISVI/4E/J69xDAoJp553MGsSxvPxAfA==") returned 232 [0049.313] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x38, wMilliseconds=0x26c)) [0049.313] GetCurrentThreadId () returned 0x970 [0049.313] GetCurrentThreadId () returned 0x970 [0049.313] GetCurrentThreadId () returned 0x970 [0049.313] GetCurrentThreadId () returned 0x970 [0049.313] GetCurrentThreadId () returned 0x970 [0049.314] GetCurrentThreadId () returned 0x970 [0049.314] GetCurrentThreadId () returned 0x970 [0049.314] GetCurrentThreadId () returned 0x970 [0049.314] GetCurrentThreadId () returned 0x970 [0049.314] GetCurrentThreadId () returned 0x970 [0049.314] GetCurrentThreadId () returned 0x970 [0049.314] GetCurrentThreadId () returned 0x970 [0049.314] GetCurrentThreadId () returned 0x970 [0049.314] GetCurrentThreadId () returned 0x970 [0049.314] GetCurrentThreadId () returned 0x970 [0049.314] GetCurrentThreadId () returned 0x970 [0049.314] GetCurrentThreadId () returned 0x970 [0049.314] GetCurrentThreadId () returned 0x970 [0049.314] GetCurrentThreadId () returned 0x970 [0049.314] GetCurrentThreadId () returned 0x970 [0049.314] GetCurrentThreadId () returned 0x970 [0049.314] GetCurrentThreadId () returned 0x970 [0049.314] GetCurrentThreadId () returned 0x970 [0049.314] GetCurrentThreadId () returned 0x970 [0049.314] GetCurrentThreadId () returned 0x970 [0049.314] GetCurrentThreadId () returned 0x970 [0049.314] GetCurrentThreadId () returned 0x970 [0049.314] GetCurrentThreadId () returned 0x970 [0049.314] GetCurrentThreadId () returned 0x970 [0049.314] GetCurrentThreadId () returned 0x970 [0049.314] GetCurrentThreadId () returned 0x970 [0049.314] GetCurrentThreadId () returned 0x970 [0049.314] GetCurrentThreadId () returned 0x970 [0049.314] GetCurrentThreadId () returned 0x970 [0049.314] GetCurrentThreadId () returned 0x970 [0049.314] GetCurrentThreadId () returned 0x970 [0049.314] GetCurrentThreadId () returned 0x970 [0049.314] GetCurrentThreadId () returned 0x970 [0049.314] GetCurrentThreadId () returned 0x970 [0049.314] GetCurrentThreadId () returned 0x970 [0049.314] GetCurrentThreadId () returned 0x970 [0049.314] GetCurrentThreadId () returned 0x970 [0049.314] GetCurrentThreadId () returned 0x970 [0049.314] GetCurrentThreadId () returned 0x970 [0049.314] GetCurrentThreadId () returned 0x970 [0049.314] GetCurrentThreadId () returned 0x970 [0049.314] GetCurrentThreadId () returned 0x970 [0049.314] GetCurrentThreadId () returned 0x970 [0049.314] GetCurrentThreadId () returned 0x970 [0049.314] GetCurrentThreadId () returned 0x970 [0049.314] GetCurrentThreadId () returned 0x970 [0049.314] GetCurrentThreadId () returned 0x970 [0049.315] GetCurrentThreadId () returned 0x970 [0049.315] GetCurrentThreadId () returned 0x970 [0049.315] GetCurrentThreadId () returned 0x970 [0049.315] GetCurrentThreadId () returned 0x970 [0049.315] GetCurrentThreadId () returned 0x970 [0049.315] GetCurrentThreadId () returned 0x970 [0049.315] GetCurrentThreadId () returned 0x970 [0049.315] GetCurrentThreadId () returned 0x970 [0049.315] GetCurrentThreadId () returned 0x970 [0049.315] GetCurrentThreadId () returned 0x970 [0049.315] GetCurrentThreadId () returned 0x970 [0049.315] GetCurrentThreadId () returned 0x970 [0049.315] GetCurrentThreadId () returned 0x970 [0049.315] GetCurrentThreadId () returned 0x970 [0049.315] GetCurrentThreadId () returned 0x970 [0049.315] GetCurrentThreadId () returned 0x970 [0049.315] GetCurrentThreadId () returned 0x970 [0049.315] GetCurrentThreadId () returned 0x970 [0049.315] GetCurrentThreadId () returned 0x970 [0049.315] GetCurrentThreadId () returned 0x970 [0049.315] GetCurrentThreadId () returned 0x970 [0049.315] GetCurrentThreadId () returned 0x970 [0049.315] GetCurrentThreadId () returned 0x970 [0049.315] GetCurrentThreadId () returned 0x970 [0049.315] GetCurrentThreadId () returned 0x970 [0049.315] GetCurrentThreadId () returned 0x970 [0049.315] GetCurrentThreadId () returned 0x970 [0049.315] GetCurrentThreadId () returned 0x970 [0049.315] GetCurrentThreadId () returned 0x970 [0049.315] GetCurrentThreadId () returned 0x970 [0049.315] GetCurrentThreadId () returned 0x970 [0049.315] GetCurrentThreadId () returned 0x970 [0049.315] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAFwyUSGoWZ0cYtrV6DbtachYKlYjsw4f9DCgZ8B3MQQw7N0L4rbKa8m/rnlqEtAfGORZVYCP4LLybbUnaZNgtvNzLIX9D2E/5+fZD5Rrx0SCnwMxEVfrmp8qryzy/SnGD+a/sdWOPD31IjAEl3s3nGgxMBPZmajRx5QAF1RYETUnbkwhFFz3cjAnhumizC7S25kISVI/4E/J69xDAoJp553MGsSxvPxAfA==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0049.315] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAFwyUSGoWZ0cYtrV6DbtachYKlYjsw4f9DCgZ8B3MQQw7N0L4rbKa8m/rnlqEtAfGORZVYCP4LLybbUnaZNgtvNzLIX9D2E/5+fZD5Rrx0SCnwMxEVfrmp8qryzy/SnGD+a/sdWOPD31IjAEl3s3nGgxMBPZmajRx5QAF1RYETUnbkwhFFz3cjAnhumizC7S25kISVI/4E/J69xDAoJp553MGsSxvPxAfA==", cchWideChar=245, lpMultiByteStr=0x353900c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAFwyUSGoWZ0cYtrV6DbtachYKlYjsw4f9DCgZ8B3MQQw7N0L4rbKa8m/rnlqEtAfGORZVYCP4LLybbUnaZNgtvNzLIX9D2E/5+fZD5Rrx0SCnwMxEVfrmp8qryzy/SnGD+a/sdWOPD31IjAEl3s3nGgxMBPZmajRx5QAF1RYETUnbkwhFFz3cjAnhumizC7S25kISVI/4E/J69xDAoJp553MGsSxvPxAfA==", lpUsedDefaultChar=0x0) returned 245 [0049.315] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0049.315] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0049.315] CloseHandle (hObject=0x158) returned 1 [0049.317] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi")) returned 0 [0049.317] GetLastError () returned 0x5 [0049.317] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi")) returned 0x20 [0049.317] SetLastError (dwErrCode=0x5) [0049.317] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=16958070021) returned 1 [0049.317] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Файл зашифрован [FlickAnimation.avi].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\Файл зашифрован [flickanimation.avi].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0049.318] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0049.318] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0049.318] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0049.318] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0049.318] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0049.318] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0049.318] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0049.318] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0049.318] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0049.318] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0049.318] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0049.318] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0049.318] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0049.319] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0049.319] SetEndOfFile (hFile=0x158) returned 1 [0049.319] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0049.319] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0049.319] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0049.319] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0049.319] WriteFile (in: hFile=0x158, lpBuffer=0x361f5a8*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x361f5a8*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0049.320] WriteFile (in: hFile=0x158, lpBuffer=0x35f005c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f005c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0049.320] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="pwl?gjC-~dmZ/\"(*UID@4>xtsJ\"FhAOz", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0049.320] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="pwl?gjC-~dmZ/\"(*UID@4>xtsJ\"FhAOz", cchWideChar=32, lpMultiByteStr=0x2032d6c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pwl?gjC-~dmZ/\"(*UID@4>xtsJ\"FhAOz", lpUsedDefaultChar=0x0) returned 32 [0049.320] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0049.320] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0049.320] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f4e4a1, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x92f4e4a1, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x92f9a75d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x186b84, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickAnimation.avi", cAlternateFileName="")) returned 0x295098 [0049.320] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0049.320] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0049.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi")) returned 0x20 [0049.321] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi")) returned 0x20 [0049.321] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi")) returned 0x20 [0049.321] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi")) returned 0x20 [0049.321] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f4e4a1, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x92f4e4a1, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x92f9a75d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x186b84)) returned 1 [0049.321] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0049.321] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0049.321] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi")) returned 0x20 [0049.321] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi")) returned 0x20 [0049.321] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0049.321] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0049.321] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0049.321] SetEndOfFile (hFile=0x158) returned 1 [0049.322] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FlickAnimation.avi", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0049.322] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FlickAnimation.avi", cchWideChar=18, lpMultiByteStr=0x1ff89ec, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FlickAnimation.avi", lpUsedDefaultChar=0x0) returned 18 [0049.322] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FlickAnimation.avi", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0049.322] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FlickAnimation.avi", cchWideChar=18, lpMultiByteStr=0x1ff885c, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FlickAnimation.avi", lpUsedDefaultChar=0x0) returned 18 [0049.322] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff885c, cbMultiByte=18, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="FlickAnimation.avi\x01") returned 18 [0049.322] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FlickAnimation.avi", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0049.322] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FlickAnimation.avi", cchWideChar=18, lpMultiByteStr=0x1ff89ec, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FlickAnimation.avi", lpUsedDefaultChar=0x0) returned 18 [0049.322] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0049.323] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0049.323] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x186b84 [0049.323] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0049.323] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0049.323] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0049.323] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FlickAnimation.avi", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0049.323] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FlickAnimation.avi", cchWideChar=18, lpMultiByteStr=0x1ff89ec, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FlickAnimation.avi", lpUsedDefaultChar=0x0) returned 18 [0049.323] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FlickAnimation.avi", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0049.323] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FlickAnimation.avi", cchWideChar=18, lpMultiByteStr=0x1ff885c, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FlickAnimation.avi", lpUsedDefaultChar=0x0) returned 18 [0049.323] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff885c, cbMultiByte=18, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="FlickAnimation.avion.avi\x01") returned 18 [0049.323] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FlickAnimation.avi", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0049.323] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FlickAnimation.avi", cchWideChar=18, lpMultiByteStr=0x1ff89ec, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FlickAnimation.avi", lpUsedDefaultChar=0x0) returned 18 [0049.323] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0049.324] CharToOemA (in: pSrc="FlickAnimation.avi", pDst=0x1ff885c | out: pDst="FlickAnimation.avi") returned 1 [0049.324] WriteFile (in: hFile=0x158, lpBuffer=0x1ff885c*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1ff885c*, lpNumberOfBytesWritten=0x18e048*=0x12, lpOverlapped=0x0) returned 1 [0049.324] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0049.324] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0049.324] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0049.324] VirtualAlloc (lpAddress=0x0, dwSize=0x110000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ee90000 [0049.325] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=16958820281) returned 1 [0049.325] ReadFile (in: hFile=0x15c, lpBuffer=0x7ee90010, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x7ee90010*, lpNumberOfBytesRead=0x18dd7c*=0x100000, lpOverlapped=0x0) returned 1 [0049.354] ReadFile (in: hFile=0x15c, lpBuffer=0x7ee90010, nNumberOfBytesToRead=0x86b84, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x7ee90010*, lpNumberOfBytesRead=0x18dd7c*=0x86b84, lpOverlapped=0x0) returned 1 [0049.364] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0049.364] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=16962764519) returned 1 [0049.372] WriteFile (in: hFile=0x158, lpBuffer=0x1fea2e8*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fea2e8*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0049.372] ReadFile (in: hFile=0x15c, lpBuffer=0x7ee90010, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x7ee90010*, lpNumberOfBytesRead=0x18de38*=0x100000, lpOverlapped=0x0) returned 1 [0049.377] VirtualAlloc (lpAddress=0x0, dwSize=0x110000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ed80000 [0049.391] VirtualAlloc (lpAddress=0x0, dwSize=0x110000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ec70000 [0049.431] VirtualFree (lpAddress=0x7ec70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0049.436] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x4d [0049.436] WriteFile (in: hFile=0x158, lpBuffer=0x7ed80010*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x7ed80010*, lpNumberOfBytesWritten=0x18de10*=0x100000, lpOverlapped=0x0) returned 1 [0049.456] VirtualFree (lpAddress=0x7ed80000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0049.461] ReadFile (in: hFile=0x15c, lpBuffer=0x7ee90010, nNumberOfBytesToRead=0x86b84, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x7ee90010*, lpNumberOfBytesRead=0x18de38*=0x86b84, lpOverlapped=0x0) returned 1 [0049.461] VirtualAlloc (lpAddress=0x0, dwSize=0x90000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ee00000 [0049.468] VirtualAlloc (lpAddress=0x0, dwSize=0x90000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ed70000 [0049.490] VirtualFree (lpAddress=0x7ed70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0049.492] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x10004d [0049.492] WriteFile (in: hFile=0x158, lpBuffer=0x7ee00010*, nNumberOfBytesToWrite=0x86b84, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x7ee00010*, lpNumberOfBytesWritten=0x18de10*=0x86b84, lpOverlapped=0x0) returned 1 [0049.500] VirtualFree (lpAddress=0x7ee00000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0049.502] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x186bd1 [0049.502] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0049.503] VirtualFree (lpAddress=0x7ee90000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0049.507] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0049.507] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0049.508] SetFilePointer (in: hFile=0x158, lDistanceToMove=18, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x30 [0049.508] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x186bdb [0049.508] CloseHandle (hObject=0x15c) returned 1 [0049.508] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x186bdb [0049.508] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x186bdb [0049.508] SetFilePointer (in: hFile=0x158, lDistanceToMove=1600475, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x186bdb [0049.508] SetFilePointer (in: hFile=0x158, lDistanceToMove=1600475, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x186bdb [0049.508] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x186bdb [0049.508] SetFilePointer (in: hFile=0x158, lDistanceToMove=1600475, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x186bdb [0049.508] SetEndOfFile (hFile=0x158) returned 1 [0049.508] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x186bdb [0049.508] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x186bdb [0049.509] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FlickAnimation.avi", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0049.509] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FlickAnimation.avi", cchWideChar=18, lpMultiByteStr=0x1ff885c, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FlickAnimation.avi", lpUsedDefaultChar=0x0) returned 18 [0049.509] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FlickAnimation.avi", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0049.509] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FlickAnimation.avi", cchWideChar=18, lpMultiByteStr=0x1ff89ec, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FlickAnimation.avi", lpUsedDefaultChar=0x0) returned 18 [0049.509] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff89ec, cbMultiByte=18, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="FlickAnimation.avi믉`믑`") returned 18 [0049.509] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FlickAnimation.avi", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0049.509] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FlickAnimation.avi", cchWideChar=18, lpMultiByteStr=0x1ff885c, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FlickAnimation.avi", lpUsedDefaultChar=0x0) returned 18 [0049.509] WriteFile (in: hFile=0x158, lpBuffer=0x34e4d28*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x34e4d28*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0049.509] CharToOemA (in: pSrc="FlickAnimation.avi", pDst=0x1ff89ec | out: pDst="FlickAnimation.avi") returned 1 [0049.509] WriteFile (in: hFile=0x158, lpBuffer=0x1ff89ec*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1ff89ec*, lpNumberOfBytesWritten=0x18efcc*=0x12, lpOverlapped=0x0) returned 1 [0049.509] WriteFile (in: hFile=0x158, lpBuffer=0x1fea2d8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea2d8*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0049.509] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0049.509] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0049.509] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x186c26 [0049.509] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x186c26 [0049.509] WriteFile (in: hFile=0x158, lpBuffer=0x361f5a8*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x361f5a8*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0049.509] WriteFile (in: hFile=0x158, lpBuffer=0x35f005c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f005c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0049.510] DeleteFileW (lpFileName="") returned 0 [0049.510] GetLastError () returned 0x3 [0049.510] GetFileAttributesW (lpFileName="") returned 0xffffffff [0049.510] SetLastError (dwErrCode=0x3) [0049.510] FlushFileBuffers (hFile=0x158) returned 1 [0049.519] GetCurrentThreadId () returned 0x970 [0049.519] GetCurrentThreadId () returned 0x970 [0049.519] GetCurrentThreadId () returned 0x970 [0049.519] GetCurrentThreadId () returned 0x970 [0049.519] GetCurrentThreadId () returned 0x970 [0049.519] GetCurrentThreadId () returned 0x970 [0049.519] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x186cdd [0049.519] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x186cdd [0049.519] SetFilePointer (in: hFile=0x158, lDistanceToMove=1600733, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x186cdd [0049.519] CloseHandle (hObject=0x158) returned 1 [0049.534] GetCurrentThreadId () returned 0x970 [0049.534] GetCurrentThreadId () returned 0x970 [0049.534] GetCurrentThreadId () returned 0x970 [0049.534] GetCurrentThreadId () returned 0x970 [0049.534] GetCurrentThreadId () returned 0x970 [0049.534] GetCurrentThreadId () returned 0x970 [0049.534] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Файл зашифрован [FlickAnimation.avi].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\Файл зашифрован [flickanimation.avi].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0049.534] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x186cdd [0049.534] SetFilePointer (in: hFile=0x158, lDistanceToMove=1600605, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x186c5d [0049.534] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0049.534] GetFileType (hFile=0x158) returned 0x1 [0049.534] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x38, wMilliseconds=0x346)) [0049.534] GetCurrentThreadId () returned 0x970 [0049.534] GetCurrentThreadId () returned 0x970 [0049.534] GetCurrentThreadId () returned 0x970 [0049.534] GetCurrentThreadId () returned 0x970 [0049.534] GetCurrentThreadId () returned 0x970 [0049.534] GetCurrentThreadId () returned 0x970 [0049.534] GetCurrentThreadId () returned 0x970 [0049.534] GetCurrentThreadId () returned 0x970 [0049.534] GetCurrentThreadId () returned 0x970 [0049.534] GetCurrentThreadId () returned 0x970 [0049.534] GetCurrentThreadId () returned 0x970 [0049.534] GetCurrentThreadId () returned 0x970 [0049.535] GetCurrentThreadId () returned 0x970 [0049.535] GetCurrentThreadId () returned 0x970 [0049.535] GetCurrentThreadId () returned 0x970 [0049.535] GetCurrentThreadId () returned 0x970 [0049.535] GetCurrentThreadId () returned 0x970 [0049.535] GetCurrentThreadId () returned 0x970 [0049.535] GetCurrentThreadId () returned 0x970 [0049.535] GetCurrentThreadId () returned 0x970 [0049.535] GetCurrentThreadId () returned 0x970 [0049.535] GetCurrentThreadId () returned 0x970 [0049.535] GetCurrentThreadId () returned 0x970 [0049.535] GetCurrentThreadId () returned 0x970 [0049.535] GetCurrentThreadId () returned 0x970 [0049.535] GetCurrentThreadId () returned 0x970 [0049.535] GetCurrentThreadId () returned 0x970 [0049.535] GetCurrentThreadId () returned 0x970 [0049.535] GetCurrentThreadId () returned 0x970 [0049.535] GetCurrentThreadId () returned 0x970 [0049.535] GetCurrentThreadId () returned 0x970 [0049.535] GetCurrentThreadId () returned 0x970 [0049.535] GetCurrentThreadId () returned 0x970 [0049.535] GetCurrentThreadId () returned 0x970 [0049.535] GetCurrentThreadId () returned 0x970 [0049.535] GetCurrentThreadId () returned 0x970 [0049.535] GetCurrentThreadId () returned 0x970 [0049.535] GetCurrentThreadId () returned 0x970 [0049.535] GetCurrentThreadId () returned 0x970 [0049.535] GetCurrentThreadId () returned 0x970 [0049.535] GetCurrentThreadId () returned 0x970 [0049.535] GetCurrentThreadId () returned 0x970 [0049.535] GetCurrentThreadId () returned 0x970 [0049.535] GetCurrentThreadId () returned 0x970 [0049.535] GetCurrentThreadId () returned 0x970 [0049.535] GetCurrentThreadId () returned 0x970 [0049.535] GetCurrentThreadId () returned 0x970 [0049.535] GetCurrentThreadId () returned 0x970 [0049.535] GetCurrentThreadId () returned 0x970 [0049.535] GetCurrentThreadId () returned 0x970 [0049.535] GetCurrentThreadId () returned 0x970 [0049.535] GetCurrentThreadId () returned 0x970 [0049.535] GetCurrentThreadId () returned 0x970 [0049.535] GetCurrentThreadId () returned 0x970 [0049.535] GetCurrentThreadId () returned 0x970 [0049.535] GetCurrentThreadId () returned 0x970 [0049.535] GetCurrentThreadId () returned 0x970 [0049.535] GetCurrentThreadId () returned 0x970 [0049.535] GetCurrentThreadId () returned 0x970 [0049.535] GetCurrentThreadId () returned 0x970 [0049.536] GetCurrentThreadId () returned 0x970 [0049.536] GetCurrentThreadId () returned 0x970 [0049.536] GetCurrentThreadId () returned 0x970 [0049.536] GetCurrentThreadId () returned 0x970 [0049.536] GetCurrentThreadId () returned 0x970 [0049.536] GetCurrentThreadId () returned 0x970 [0049.536] GetCurrentThreadId () returned 0x970 [0049.536] GetCurrentThreadId () returned 0x970 [0049.536] GetCurrentThreadId () returned 0x970 [0049.536] GetCurrentThreadId () returned 0x970 [0049.536] GetCurrentThreadId () returned 0x970 [0049.536] GetCurrentThreadId () returned 0x970 [0049.536] GetCurrentThreadId () returned 0x970 [0049.536] GetCurrentThreadId () returned 0x970 [0049.536] GetCurrentThreadId () returned 0x970 [0049.536] GetCurrentThreadId () returned 0x970 [0049.536] GetCurrentThreadId () returned 0x970 [0049.536] GetCurrentThreadId () returned 0x970 [0049.536] GetCurrentThreadId () returned 0x970 [0049.536] GetCurrentThreadId () returned 0x970 [0049.536] GetCurrentThreadId () returned 0x970 [0049.536] GetCurrentThreadId () returned 0x970 [0049.536] GetCurrentThreadId () returned 0x970 [0049.536] GetCurrentThreadId () returned 0x970 [0049.536] GetCurrentThreadId () returned 0x970 [0049.536] GetCurrentThreadId () returned 0x970 [0049.536] GetCurrentThreadId () returned 0x970 [0049.536] GetCurrentThreadId () returned 0x970 [0049.536] GetCurrentThreadId () returned 0x970 [0049.536] GetCurrentThreadId () returned 0x970 [0049.536] GetCurrentThreadId () returned 0x970 [0049.536] GetCurrentThreadId () returned 0x970 [0049.536] GetCurrentThreadId () returned 0x970 [0049.536] GetCurrentThreadId () returned 0x970 [0049.536] GetCurrentThreadId () returned 0x970 [0049.536] GetCurrentThreadId () returned 0x970 [0049.536] GetCurrentThreadId () returned 0x970 [0049.536] GetCurrentThreadId () returned 0x970 [0049.536] GetCurrentThreadId () returned 0x970 [0049.536] GetCurrentThreadId () returned 0x970 [0049.536] GetCurrentThreadId () returned 0x970 [0049.536] GetCurrentThreadId () returned 0x970 [0049.536] GetCurrentThreadId () returned 0x970 [0049.536] GetCurrentThreadId () returned 0x970 [0049.536] GetCurrentThreadId () returned 0x970 [0049.536] GetCurrentThreadId () returned 0x970 [0049.536] GetCurrentThreadId () returned 0x970 [0049.536] GetCurrentThreadId () returned 0x970 [0049.537] GetCurrentThreadId () returned 0x970 [0049.537] GetCurrentThreadId () returned 0x970 [0049.537] GetCurrentThreadId () returned 0x970 [0049.537] GetCurrentThreadId () returned 0x970 [0049.537] GetCurrentThreadId () returned 0x970 [0049.537] GetCurrentThreadId () returned 0x970 [0049.537] GetCurrentThreadId () returned 0x970 [0049.537] GetCurrentThreadId () returned 0x970 [0049.537] GetCurrentThreadId () returned 0x970 [0049.537] GetCurrentThreadId () returned 0x970 [0049.537] GetCurrentThreadId () returned 0x970 [0049.537] GetCurrentThreadId () returned 0x970 [0049.537] GetCurrentThreadId () returned 0x970 [0049.537] GetCurrentThreadId () returned 0x970 [0049.537] GetCurrentThreadId () returned 0x970 [0049.537] GetCurrentThreadId () returned 0x970 [0049.537] GetCurrentThreadId () returned 0x970 [0049.537] GetCurrentThreadId () returned 0x970 [0049.537] GetCurrentThreadId () returned 0x970 [0049.537] GetCurrentThreadId () returned 0x970 [0049.537] GetCurrentThreadId () returned 0x970 [0049.537] GetCurrentThreadId () returned 0x970 [0049.537] GetCurrentThreadId () returned 0x970 [0049.537] GetCurrentThreadId () returned 0x970 [0049.537] GetCurrentThreadId () returned 0x970 [0049.537] GetCurrentThreadId () returned 0x970 [0049.537] GetCurrentThreadId () returned 0x970 [0049.537] GetCurrentThreadId () returned 0x970 [0049.537] GetCurrentThreadId () returned 0x970 [0049.537] GetCurrentThreadId () returned 0x970 [0049.537] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.537] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.537] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb9d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.537] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.537] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.537] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feb9d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.537] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.537] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.537] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.537] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.537] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.537] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.538] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.538] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.538] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feba30, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.538] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.538] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.538] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feba30, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.538] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.538] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.538] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feba30, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.538] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x38, wMilliseconds=0x346)) [0049.538] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pwl?gjC-~dmZ/\"(*UID@4>xtsJ\"FhAOz", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0049.538] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pwl?gjC-~dmZ/\"(*UID@4>xtsJ\"FhAOz", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0049.538] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pwl?gjC-~dmZ/\"(*UID@4>xtsJ\"FhAOz", cchWideChar=32, lpMultiByteStr=0x2000ad8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pwl?gjC-~dmZ/\"(*UID@4>xtsJ\"FhAOz", lpUsedDefaultChar=0x0) returned 32 [0049.538] GetCurrentThreadId () returned 0x970 [0049.538] GetCurrentThreadId () returned 0x970 [0049.538] GetCurrentThreadId () returned 0x970 [0049.538] GetCurrentThreadId () returned 0x970 [0049.538] GetCurrentThreadId () returned 0x970 [0049.538] GetCurrentThreadId () returned 0x970 [0049.545] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0049.545] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0049.545] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x202e788, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0049.545] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x35904f8, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0049.545] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x35904f8, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAABhfCPJX4Zh1K88goYIbyWe5C/5/9nllRBdix0F5l0BCY2drGr8WMPNTXMaQH0YRcsKLXdAc7mqLEPhetPEQJ5bXM5S5pAddWIfL8t/1qfXycxed0wI7RTqm3hPitOM+1BJvUPiDLuPEs+5nJvdS9TrC5tUIFWtiYrZNwq1QT9WSgenj5gYF3tkuh6oNArJmV615xU6w1ocNhKwRd+6+OYgfItYR1EpU6A==") returned 232 [0049.545] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x38, wMilliseconds=0x356)) [0049.546] GetCurrentThreadId () returned 0x970 [0049.546] GetCurrentThreadId () returned 0x970 [0049.546] GetCurrentThreadId () returned 0x970 [0049.546] GetCurrentThreadId () returned 0x970 [0049.546] GetCurrentThreadId () returned 0x970 [0049.546] GetCurrentThreadId () returned 0x970 [0049.546] GetCurrentThreadId () returned 0x970 [0049.546] GetCurrentThreadId () returned 0x970 [0049.546] GetCurrentThreadId () returned 0x970 [0049.546] GetCurrentThreadId () returned 0x970 [0049.546] GetCurrentThreadId () returned 0x970 [0049.546] GetCurrentThreadId () returned 0x970 [0049.546] GetCurrentThreadId () returned 0x970 [0049.546] GetCurrentThreadId () returned 0x970 [0049.546] GetCurrentThreadId () returned 0x970 [0049.546] GetCurrentThreadId () returned 0x970 [0049.546] GetCurrentThreadId () returned 0x970 [0049.546] GetCurrentThreadId () returned 0x970 [0049.546] GetCurrentThreadId () returned 0x970 [0049.546] GetCurrentThreadId () returned 0x970 [0049.546] GetCurrentThreadId () returned 0x970 [0049.546] GetCurrentThreadId () returned 0x970 [0049.546] GetCurrentThreadId () returned 0x970 [0049.546] GetCurrentThreadId () returned 0x970 [0049.546] GetCurrentThreadId () returned 0x970 [0049.546] GetCurrentThreadId () returned 0x970 [0049.546] GetCurrentThreadId () returned 0x970 [0049.546] GetCurrentThreadId () returned 0x970 [0049.546] GetCurrentThreadId () returned 0x970 [0049.546] GetCurrentThreadId () returned 0x970 [0049.546] GetCurrentThreadId () returned 0x970 [0049.546] GetCurrentThreadId () returned 0x970 [0049.546] GetCurrentThreadId () returned 0x970 [0049.546] GetCurrentThreadId () returned 0x970 [0049.546] GetCurrentThreadId () returned 0x970 [0049.546] GetCurrentThreadId () returned 0x970 [0049.546] GetCurrentThreadId () returned 0x970 [0049.546] GetCurrentThreadId () returned 0x970 [0049.546] GetCurrentThreadId () returned 0x970 [0049.546] GetCurrentThreadId () returned 0x970 [0049.546] GetCurrentThreadId () returned 0x970 [0049.546] GetCurrentThreadId () returned 0x970 [0049.546] GetCurrentThreadId () returned 0x970 [0049.546] GetCurrentThreadId () returned 0x970 [0049.546] GetCurrentThreadId () returned 0x970 [0049.546] GetCurrentThreadId () returned 0x970 [0049.546] GetCurrentThreadId () returned 0x970 [0049.547] GetCurrentThreadId () returned 0x970 [0049.547] GetCurrentThreadId () returned 0x970 [0049.547] GetCurrentThreadId () returned 0x970 [0049.547] GetCurrentThreadId () returned 0x970 [0049.547] GetCurrentThreadId () returned 0x970 [0049.547] GetCurrentThreadId () returned 0x970 [0049.547] GetCurrentThreadId () returned 0x970 [0049.547] GetCurrentThreadId () returned 0x970 [0049.547] GetCurrentThreadId () returned 0x970 [0049.547] GetCurrentThreadId () returned 0x970 [0049.547] GetCurrentThreadId () returned 0x970 [0049.547] GetCurrentThreadId () returned 0x970 [0049.547] GetCurrentThreadId () returned 0x970 [0049.547] GetCurrentThreadId () returned 0x970 [0049.547] GetCurrentThreadId () returned 0x970 [0049.547] GetCurrentThreadId () returned 0x970 [0049.547] GetCurrentThreadId () returned 0x970 [0049.547] GetCurrentThreadId () returned 0x970 [0049.547] GetCurrentThreadId () returned 0x970 [0049.547] GetCurrentThreadId () returned 0x970 [0049.547] GetCurrentThreadId () returned 0x970 [0049.547] GetCurrentThreadId () returned 0x970 [0049.547] GetCurrentThreadId () returned 0x970 [0049.547] GetCurrentThreadId () returned 0x970 [0049.547] GetCurrentThreadId () returned 0x970 [0049.547] GetCurrentThreadId () returned 0x970 [0049.547] GetCurrentThreadId () returned 0x970 [0049.547] GetCurrentThreadId () returned 0x970 [0049.547] GetCurrentThreadId () returned 0x970 [0049.547] GetCurrentThreadId () returned 0x970 [0049.547] GetCurrentThreadId () returned 0x970 [0049.547] GetCurrentThreadId () returned 0x970 [0049.547] GetCurrentThreadId () returned 0x970 [0049.547] GetCurrentThreadId () returned 0x970 [0049.547] GetCurrentThreadId () returned 0x970 [0049.547] GetCurrentThreadId () returned 0x970 [0049.547] GetCurrentThreadId () returned 0x970 [0049.547] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAABhfCPJX4Zh1K88goYIbyWe5C/5/9nllRBdix0F5l0BCY2drGr8WMPNTXMaQH0YRcsKLXdAc7mqLEPhetPEQJ5bXM5S5pAddWIfL8t/1qfXycxed0wI7RTqm3hPitOM+1BJvUPiDLuPEs+5nJvdS9TrC5tUIFWtiYrZNwq1QT9WSgenj5gYF3tkuh6oNArJmV615xU6w1ocNhKwRd+6+OYgfItYR1EpU6A==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0049.547] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAABhfCPJX4Zh1K88goYIbyWe5C/5/9nllRBdix0F5l0BCY2drGr8WMPNTXMaQH0YRcsKLXdAc7mqLEPhetPEQJ5bXM5S5pAddWIfL8t/1qfXycxed0wI7RTqm3hPitOM+1BJvUPiDLuPEs+5nJvdS9TrC5tUIFWtiYrZNwq1QT9WSgenj5gYF3tkuh6oNArJmV615xU6w1ocNhKwRd+6+OYgfItYR1EpU6A==", cchWideChar=245, lpMultiByteStr=0x353900c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAABhfCPJX4Zh1K88goYIbyWe5C/5/9nllRBdix0F5l0BCY2drGr8WMPNTXMaQH0YRcsKLXdAc7mqLEPhetPEQJ5bXM5S5pAddWIfL8t/1qfXycxed0wI7RTqm3hPitOM+1BJvUPiDLuPEs+5nJvdS9TrC5tUIFWtiYrZNwq1QT9WSgenj5gYF3tkuh6oNArJmV615xU6w1ocNhKwRd+6+OYgfItYR1EpU6A==", lpUsedDefaultChar=0x0) returned 245 [0049.547] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0049.547] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0049.548] CloseHandle (hObject=0x158) returned 1 [0049.555] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi")) returned 0 [0049.556] GetLastError () returned 0x5 [0049.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi")) returned 0x20 [0049.556] SetLastError (dwErrCode=0x5) [0049.556] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=16981918267) returned 1 [0049.556] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\Файл зашифрован [auxbase.xml].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\Файл зашифрован [auxbase.xml].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0049.556] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0049.557] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0049.557] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0049.557] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0049.557] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0049.557] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0049.557] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0049.557] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0049.557] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0049.557] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0049.557] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0049.557] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0049.557] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0049.557] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0049.557] SetEndOfFile (hFile=0x158) returned 1 [0049.557] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0049.557] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0049.557] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0049.558] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0049.558] WriteFile (in: hFile=0x158, lpBuffer=0x361f6e8*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x361f6e8*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0049.558] WriteFile (in: hFile=0x158, lpBuffer=0x35f011c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f011c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0049.559] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="wM$:p}8#tWZ!x&/egEWu{\"jm{(B!=Ds^", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0049.559] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="wM$:p}8#tWZ!x&/egEWu{\"jm{(B!=Ds^", cchWideChar=32, lpMultiByteStr=0x2032d34, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wM$:p}8#tWZ!x&/egEWu{\"jm{(B!=Ds^", lpUsedDefaultChar=0x0) returned 32 [0049.559] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0049.559] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0049.559] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2d7bf7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2d7bf7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2d7bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxbase.xml", cAlternateFileName="")) returned 0x295098 [0049.559] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0049.559] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0049.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml")) returned 0x20 [0049.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml")) returned 0x20 [0049.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml")) returned 0x20 [0049.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml")) returned 0x20 [0049.560] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2d7bf7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2d7bf7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2d7bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59a)) returned 1 [0049.560] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0049.560] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0049.560] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml")) returned 0x20 [0049.560] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml")) returned 0x20 [0049.560] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0049.560] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0049.560] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0049.560] SetEndOfFile (hFile=0x158) returned 1 [0049.561] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="auxbase.xml", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0049.561] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="auxbase.xml", cchWideChar=11, lpMultiByteStr=0x1fe37cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="auxbase.xml", lpUsedDefaultChar=0x0) returned 11 [0049.561] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="auxbase.xml", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0049.561] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="auxbase.xml", cchWideChar=11, lpMultiByteStr=0x1fe362c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="auxbase.xml", lpUsedDefaultChar=0x0) returned 11 [0049.561] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe362c, cbMultiByte=11, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="auxbase.xmlion.avi\x01") returned 11 [0049.561] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="auxbase.xml", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0049.561] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="auxbase.xml", cchWideChar=11, lpMultiByteStr=0x1fe37cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="auxbase.xml", lpUsedDefaultChar=0x0) returned 11 [0049.561] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0049.561] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0049.561] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x59a [0049.561] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0049.561] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0049.561] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0049.561] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="auxbase.xml", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0049.561] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="auxbase.xml", cchWideChar=11, lpMultiByteStr=0x1fe37cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="auxbase.xml", lpUsedDefaultChar=0x0) returned 11 [0049.562] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="auxbase.xml", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0049.562] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="auxbase.xml", cchWideChar=11, lpMultiByteStr=0x1fe362c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="auxbase.xml", lpUsedDefaultChar=0x0) returned 11 [0049.562] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe362c, cbMultiByte=11, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="auxbase.xmlse.xmlion.avi\x01") returned 11 [0049.562] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="auxbase.xml", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0049.562] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="auxbase.xml", cchWideChar=11, lpMultiByteStr=0x1fe37cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="auxbase.xml", lpUsedDefaultChar=0x0) returned 11 [0049.562] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0049.563] CharToOemA (in: pSrc="auxbase.xml", pDst=0x1fe362c | out: pDst="auxbase.xml") returned 1 [0049.563] WriteFile (in: hFile=0x158, lpBuffer=0x1fe362c*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe362c*, lpNumberOfBytesWritten=0x18e048*=0xb, lpOverlapped=0x0) returned 1 [0049.563] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0049.563] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0049.563] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0049.563] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=16982641790) returned 1 [0049.563] ReadFile (in: hFile=0x15c, lpBuffer=0x3501270, nNumberOfBytesToRead=0x59a, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3501270*, lpNumberOfBytesRead=0x18dd7c*=0x59a, lpOverlapped=0x0) returned 1 [0049.564] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0049.564] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=16982780731) returned 1 [0049.573] WriteFile (in: hFile=0x158, lpBuffer=0x1fea168*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fea168*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0049.573] ReadFile (in: hFile=0x15c, lpBuffer=0x3501270, nNumberOfBytesToRead=0x59a, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3501270*, lpNumberOfBytesRead=0x18de38*=0x59a, lpOverlapped=0x0) returned 1 [0049.573] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x46 [0049.573] WriteFile (in: hFile=0x158, lpBuffer=0x3501850*, nNumberOfBytesToWrite=0x59a, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3501850*, lpNumberOfBytesWritten=0x18de10*=0x59a, lpOverlapped=0x0) returned 1 [0049.573] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x5e0 [0049.573] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0049.573] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0049.573] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0049.573] SetFilePointer (in: hFile=0x158, lDistanceToMove=11, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x29 [0049.573] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x5ea [0049.574] CloseHandle (hObject=0x15c) returned 1 [0049.574] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x5ea [0049.574] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x5ea [0049.574] SetFilePointer (in: hFile=0x158, lDistanceToMove=1514, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x5ea [0049.574] SetFilePointer (in: hFile=0x158, lDistanceToMove=1514, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x5ea [0049.574] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x5ea [0049.574] SetFilePointer (in: hFile=0x158, lDistanceToMove=1514, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x5ea [0049.574] SetEndOfFile (hFile=0x158) returned 1 [0049.574] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x5ea [0049.574] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x5ea [0049.574] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="auxbase.xml", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0049.574] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="auxbase.xml", cchWideChar=11, lpMultiByteStr=0x1fe37cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="auxbase.xml", lpUsedDefaultChar=0x0) returned 11 [0049.574] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="auxbase.xml", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0049.574] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="auxbase.xml", cchWideChar=11, lpMultiByteStr=0x1fe368c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="auxbase.xml", lpUsedDefaultChar=0x0) returned 11 [0049.574] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe368c, cbMultiByte=11, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="auxbase.xml\x18ꞗ@涤(\x18믉`믑`") returned 11 [0049.574] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="auxbase.xml", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0049.574] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="auxbase.xml", cchWideChar=11, lpMultiByteStr=0x1fe37cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="auxbase.xml", lpUsedDefaultChar=0x0) returned 11 [0049.575] WriteFile (in: hFile=0x158, lpBuffer=0x34e4d28*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x34e4d28*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0049.575] CharToOemA (in: pSrc="auxbase.xml", pDst=0x1fe368c | out: pDst="auxbase.xml") returned 1 [0049.575] WriteFile (in: hFile=0x158, lpBuffer=0x1fe368c*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe368c*, lpNumberOfBytesWritten=0x18efcc*=0xb, lpOverlapped=0x0) returned 1 [0049.575] WriteFile (in: hFile=0x158, lpBuffer=0x1fea428*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea428*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0049.575] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0049.575] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0049.575] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x62e [0049.575] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x62e [0049.575] WriteFile (in: hFile=0x158, lpBuffer=0x361f6e8*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x361f6e8*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0049.575] WriteFile (in: hFile=0x158, lpBuffer=0x35f011c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f011c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0049.575] DeleteFileW (lpFileName="") returned 0 [0049.575] GetLastError () returned 0x3 [0049.575] GetFileAttributesW (lpFileName="") returned 0xffffffff [0049.575] SetLastError (dwErrCode=0x3) [0049.575] FlushFileBuffers (hFile=0x158) returned 1 [0049.578] GetCurrentThreadId () returned 0x970 [0049.578] GetCurrentThreadId () returned 0x970 [0049.578] GetCurrentThreadId () returned 0x970 [0049.578] GetCurrentThreadId () returned 0x970 [0049.578] GetCurrentThreadId () returned 0x970 [0049.578] GetCurrentThreadId () returned 0x970 [0049.578] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x6e5 [0049.578] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x6e5 [0049.579] SetFilePointer (in: hFile=0x158, lDistanceToMove=1765, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x6e5 [0049.579] CloseHandle (hObject=0x158) returned 1 [0049.579] GetCurrentThreadId () returned 0x970 [0049.579] GetCurrentThreadId () returned 0x970 [0049.579] GetCurrentThreadId () returned 0x970 [0049.580] GetCurrentThreadId () returned 0x970 [0049.580] GetCurrentThreadId () returned 0x970 [0049.580] GetCurrentThreadId () returned 0x970 [0049.580] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\Файл зашифрован [auxbase.xml].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\Файл зашифрован [auxbase.xml].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0049.580] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6e5 [0049.580] SetFilePointer (in: hFile=0x158, lDistanceToMove=1637, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x665 [0049.580] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0049.580] GetFileType (hFile=0x158) returned 0x1 [0049.580] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x38, wMilliseconds=0x375)) [0049.580] GetCurrentThreadId () returned 0x970 [0049.580] GetCurrentThreadId () returned 0x970 [0049.580] GetCurrentThreadId () returned 0x970 [0049.580] GetCurrentThreadId () returned 0x970 [0049.580] GetCurrentThreadId () returned 0x970 [0049.580] GetCurrentThreadId () returned 0x970 [0049.580] GetCurrentThreadId () returned 0x970 [0049.580] GetCurrentThreadId () returned 0x970 [0049.580] GetCurrentThreadId () returned 0x970 [0049.580] GetCurrentThreadId () returned 0x970 [0049.580] GetCurrentThreadId () returned 0x970 [0049.580] GetCurrentThreadId () returned 0x970 [0049.580] GetCurrentThreadId () returned 0x970 [0049.580] GetCurrentThreadId () returned 0x970 [0049.580] GetCurrentThreadId () returned 0x970 [0049.580] GetCurrentThreadId () returned 0x970 [0049.580] GetCurrentThreadId () returned 0x970 [0049.580] GetCurrentThreadId () returned 0x970 [0049.580] GetCurrentThreadId () returned 0x970 [0049.580] GetCurrentThreadId () returned 0x970 [0049.580] GetCurrentThreadId () returned 0x970 [0049.580] GetCurrentThreadId () returned 0x970 [0049.580] GetCurrentThreadId () returned 0x970 [0049.580] GetCurrentThreadId () returned 0x970 [0049.580] GetCurrentThreadId () returned 0x970 [0049.580] GetCurrentThreadId () returned 0x970 [0049.580] GetCurrentThreadId () returned 0x970 [0049.580] GetCurrentThreadId () returned 0x970 [0049.581] GetCurrentThreadId () returned 0x970 [0049.581] GetCurrentThreadId () returned 0x970 [0049.581] GetCurrentThreadId () returned 0x970 [0049.581] GetCurrentThreadId () returned 0x970 [0049.581] GetCurrentThreadId () returned 0x970 [0049.581] GetCurrentThreadId () returned 0x970 [0049.581] GetCurrentThreadId () returned 0x970 [0049.581] GetCurrentThreadId () returned 0x970 [0049.581] GetCurrentThreadId () returned 0x970 [0049.581] GetCurrentThreadId () returned 0x970 [0049.581] GetCurrentThreadId () returned 0x970 [0049.581] GetCurrentThreadId () returned 0x970 [0049.581] GetCurrentThreadId () returned 0x970 [0049.581] GetCurrentThreadId () returned 0x970 [0049.581] GetCurrentThreadId () returned 0x970 [0049.581] GetCurrentThreadId () returned 0x970 [0049.581] GetCurrentThreadId () returned 0x970 [0049.581] GetCurrentThreadId () returned 0x970 [0049.581] GetCurrentThreadId () returned 0x970 [0049.581] GetCurrentThreadId () returned 0x970 [0049.581] GetCurrentThreadId () returned 0x970 [0049.581] GetCurrentThreadId () returned 0x970 [0049.581] GetCurrentThreadId () returned 0x970 [0049.581] GetCurrentThreadId () returned 0x970 [0049.581] GetCurrentThreadId () returned 0x970 [0049.581] GetCurrentThreadId () returned 0x970 [0049.581] GetCurrentThreadId () returned 0x970 [0049.581] GetCurrentThreadId () returned 0x970 [0049.581] GetCurrentThreadId () returned 0x970 [0049.581] GetCurrentThreadId () returned 0x970 [0049.581] GetCurrentThreadId () returned 0x970 [0049.581] GetCurrentThreadId () returned 0x970 [0049.581] GetCurrentThreadId () returned 0x970 [0049.581] GetCurrentThreadId () returned 0x970 [0049.581] GetCurrentThreadId () returned 0x970 [0049.581] GetCurrentThreadId () returned 0x970 [0049.581] GetCurrentThreadId () returned 0x970 [0049.581] GetCurrentThreadId () returned 0x970 [0049.581] GetCurrentThreadId () returned 0x970 [0049.581] GetCurrentThreadId () returned 0x970 [0049.581] GetCurrentThreadId () returned 0x970 [0049.581] GetCurrentThreadId () returned 0x970 [0049.581] GetCurrentThreadId () returned 0x970 [0049.581] GetCurrentThreadId () returned 0x970 [0049.581] GetCurrentThreadId () returned 0x970 [0049.581] GetCurrentThreadId () returned 0x970 [0049.581] GetCurrentThreadId () returned 0x970 [0049.582] GetCurrentThreadId () returned 0x970 [0049.582] GetCurrentThreadId () returned 0x970 [0049.582] GetCurrentThreadId () returned 0x970 [0049.582] GetCurrentThreadId () returned 0x970 [0049.582] GetCurrentThreadId () returned 0x970 [0049.582] GetCurrentThreadId () returned 0x970 [0049.582] GetCurrentThreadId () returned 0x970 [0049.582] GetCurrentThreadId () returned 0x970 [0049.582] GetCurrentThreadId () returned 0x970 [0049.582] GetCurrentThreadId () returned 0x970 [0049.582] GetCurrentThreadId () returned 0x970 [0049.582] GetCurrentThreadId () returned 0x970 [0049.582] GetCurrentThreadId () returned 0x970 [0049.582] GetCurrentThreadId () returned 0x970 [0049.582] GetCurrentThreadId () returned 0x970 [0049.582] GetCurrentThreadId () returned 0x970 [0049.582] GetCurrentThreadId () returned 0x970 [0049.582] GetCurrentThreadId () returned 0x970 [0049.582] GetCurrentThreadId () returned 0x970 [0049.582] GetCurrentThreadId () returned 0x970 [0049.582] GetCurrentThreadId () returned 0x970 [0049.582] GetCurrentThreadId () returned 0x970 [0049.582] GetCurrentThreadId () returned 0x970 [0049.582] GetCurrentThreadId () returned 0x970 [0049.582] GetCurrentThreadId () returned 0x970 [0049.582] GetCurrentThreadId () returned 0x970 [0049.582] GetCurrentThreadId () returned 0x970 [0049.582] GetCurrentThreadId () returned 0x970 [0049.582] GetCurrentThreadId () returned 0x970 [0049.582] GetCurrentThreadId () returned 0x970 [0049.582] GetCurrentThreadId () returned 0x970 [0049.582] GetCurrentThreadId () returned 0x970 [0049.582] GetCurrentThreadId () returned 0x970 [0049.582] GetCurrentThreadId () returned 0x970 [0049.582] GetCurrentThreadId () returned 0x970 [0049.582] GetCurrentThreadId () returned 0x970 [0049.582] GetCurrentThreadId () returned 0x970 [0049.582] GetCurrentThreadId () returned 0x970 [0049.582] GetCurrentThreadId () returned 0x970 [0049.582] GetCurrentThreadId () returned 0x970 [0049.582] GetCurrentThreadId () returned 0x970 [0049.582] GetCurrentThreadId () returned 0x970 [0049.582] GetCurrentThreadId () returned 0x970 [0049.582] GetCurrentThreadId () returned 0x970 [0049.582] GetCurrentThreadId () returned 0x970 [0049.582] GetCurrentThreadId () returned 0x970 [0049.582] GetCurrentThreadId () returned 0x970 [0049.583] GetCurrentThreadId () returned 0x970 [0049.583] GetCurrentThreadId () returned 0x970 [0049.583] GetCurrentThreadId () returned 0x970 [0049.583] GetCurrentThreadId () returned 0x970 [0049.583] GetCurrentThreadId () returned 0x970 [0049.583] GetCurrentThreadId () returned 0x970 [0049.583] GetCurrentThreadId () returned 0x970 [0049.583] GetCurrentThreadId () returned 0x970 [0049.583] GetCurrentThreadId () returned 0x970 [0049.583] GetCurrentThreadId () returned 0x970 [0049.583] GetCurrentThreadId () returned 0x970 [0049.583] GetCurrentThreadId () returned 0x970 [0049.583] GetCurrentThreadId () returned 0x970 [0049.583] GetCurrentThreadId () returned 0x970 [0049.583] GetCurrentThreadId () returned 0x970 [0049.583] GetCurrentThreadId () returned 0x970 [0049.583] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.583] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.583] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feba30, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.583] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.583] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.583] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feba30, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.583] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.583] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.583] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.583] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.583] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.583] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.583] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.583] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.583] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feba90, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.583] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.583] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.583] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feba90, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.583] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.583] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.583] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feba90, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.583] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x38, wMilliseconds=0x375)) [0049.583] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wM$:p}8#tWZ!x&/egEWu{\"jm{(B!=Ds^", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0049.584] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wM$:p}8#tWZ!x&/egEWu{\"jm{(B!=Ds^", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0049.584] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wM$:p}8#tWZ!x&/egEWu{\"jm{(B!=Ds^", cchWideChar=32, lpMultiByteStr=0x2000b08, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wM$:p}8#tWZ!x&/egEWu{\"jm{(B!=Ds^", lpUsedDefaultChar=0x0) returned 32 [0049.584] GetCurrentThreadId () returned 0x970 [0049.584] GetCurrentThreadId () returned 0x970 [0049.584] GetCurrentThreadId () returned 0x970 [0049.584] GetCurrentThreadId () returned 0x970 [0049.584] GetCurrentThreadId () returned 0x970 [0049.584] GetCurrentThreadId () returned 0x970 [0049.591] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0049.591] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0049.591] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x202e878, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0049.591] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x35906f8, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0049.591] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x35906f8, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAD7VjHdBDP/kGBRscVH0LY3HC7iFCuw4j1yUUWMOnhaKiiUdusj9EBEM6uGUUcKYKVEwh1+8CqEAMxQP17VEOWNDvvFtoP1H5UzY+JnJQ243QuDvszzAmh0vrvYeVz/rZdY/vNzb7QkTMa+wbBnpu62CnhBeMh+67RlvficFXiHAMRXirJrrch0ZylZVQzb0LXHz7cfBuNQ9i1HrVke+QS/TIrVaJjgFuw==") returned 232 [0049.591] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x38, wMilliseconds=0x385)) [0049.591] GetCurrentThreadId () returned 0x970 [0049.591] GetCurrentThreadId () returned 0x970 [0049.591] GetCurrentThreadId () returned 0x970 [0049.591] GetCurrentThreadId () returned 0x970 [0049.591] GetCurrentThreadId () returned 0x970 [0049.592] GetCurrentThreadId () returned 0x970 [0049.592] GetCurrentThreadId () returned 0x970 [0049.592] GetCurrentThreadId () returned 0x970 [0049.592] GetCurrentThreadId () returned 0x970 [0049.592] GetCurrentThreadId () returned 0x970 [0049.592] GetCurrentThreadId () returned 0x970 [0049.592] GetCurrentThreadId () returned 0x970 [0049.592] GetCurrentThreadId () returned 0x970 [0049.592] GetCurrentThreadId () returned 0x970 [0049.592] GetCurrentThreadId () returned 0x970 [0049.592] GetCurrentThreadId () returned 0x970 [0049.592] GetCurrentThreadId () returned 0x970 [0049.592] GetCurrentThreadId () returned 0x970 [0049.592] GetCurrentThreadId () returned 0x970 [0049.592] GetCurrentThreadId () returned 0x970 [0049.592] GetCurrentThreadId () returned 0x970 [0049.592] GetCurrentThreadId () returned 0x970 [0049.592] GetCurrentThreadId () returned 0x970 [0049.592] GetCurrentThreadId () returned 0x970 [0049.592] GetCurrentThreadId () returned 0x970 [0049.592] GetCurrentThreadId () returned 0x970 [0049.592] GetCurrentThreadId () returned 0x970 [0049.592] GetCurrentThreadId () returned 0x970 [0049.592] GetCurrentThreadId () returned 0x970 [0049.592] GetCurrentThreadId () returned 0x970 [0049.592] GetCurrentThreadId () returned 0x970 [0049.592] GetCurrentThreadId () returned 0x970 [0049.592] GetCurrentThreadId () returned 0x970 [0049.592] GetCurrentThreadId () returned 0x970 [0049.592] GetCurrentThreadId () returned 0x970 [0049.592] GetCurrentThreadId () returned 0x970 [0049.592] GetCurrentThreadId () returned 0x970 [0049.592] GetCurrentThreadId () returned 0x970 [0049.592] GetCurrentThreadId () returned 0x970 [0049.592] GetCurrentThreadId () returned 0x970 [0049.592] GetCurrentThreadId () returned 0x970 [0049.592] GetCurrentThreadId () returned 0x970 [0049.592] GetCurrentThreadId () returned 0x970 [0049.592] GetCurrentThreadId () returned 0x970 [0049.592] GetCurrentThreadId () returned 0x970 [0049.592] GetCurrentThreadId () returned 0x970 [0049.592] GetCurrentThreadId () returned 0x970 [0049.592] GetCurrentThreadId () returned 0x970 [0049.592] GetCurrentThreadId () returned 0x970 [0049.592] GetCurrentThreadId () returned 0x970 [0049.592] GetCurrentThreadId () returned 0x970 [0049.592] GetCurrentThreadId () returned 0x970 [0049.592] GetCurrentThreadId () returned 0x970 [0049.592] GetCurrentThreadId () returned 0x970 [0049.593] GetCurrentThreadId () returned 0x970 [0049.593] GetCurrentThreadId () returned 0x970 [0049.593] GetCurrentThreadId () returned 0x970 [0049.593] GetCurrentThreadId () returned 0x970 [0049.593] GetCurrentThreadId () returned 0x970 [0049.593] GetCurrentThreadId () returned 0x970 [0049.593] GetCurrentThreadId () returned 0x970 [0049.593] GetCurrentThreadId () returned 0x970 [0049.593] GetCurrentThreadId () returned 0x970 [0049.593] GetCurrentThreadId () returned 0x970 [0049.593] GetCurrentThreadId () returned 0x970 [0049.593] GetCurrentThreadId () returned 0x970 [0049.593] GetCurrentThreadId () returned 0x970 [0049.593] GetCurrentThreadId () returned 0x970 [0049.593] GetCurrentThreadId () returned 0x970 [0049.593] GetCurrentThreadId () returned 0x970 [0049.593] GetCurrentThreadId () returned 0x970 [0049.593] GetCurrentThreadId () returned 0x970 [0049.593] GetCurrentThreadId () returned 0x970 [0049.593] GetCurrentThreadId () returned 0x970 [0049.593] GetCurrentThreadId () returned 0x970 [0049.593] GetCurrentThreadId () returned 0x970 [0049.593] GetCurrentThreadId () returned 0x970 [0049.593] GetCurrentThreadId () returned 0x970 [0049.593] GetCurrentThreadId () returned 0x970 [0049.593] GetCurrentThreadId () returned 0x970 [0049.593] GetCurrentThreadId () returned 0x970 [0049.593] GetCurrentThreadId () returned 0x970 [0049.593] GetCurrentThreadId () returned 0x970 [0049.593] GetCurrentThreadId () returned 0x970 [0049.593] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAD7VjHdBDP/kGBRscVH0LY3HC7iFCuw4j1yUUWMOnhaKiiUdusj9EBEM6uGUUcKYKVEwh1+8CqEAMxQP17VEOWNDvvFtoP1H5UzY+JnJQ243QuDvszzAmh0vrvYeVz/rZdY/vNzb7QkTMa+wbBnpu62CnhBeMh+67RlvficFXiHAMRXirJrrch0ZylZVQzb0LXHz7cfBuNQ9i1HrVke+QS/TIrVaJjgFuw==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0049.593] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAD7VjHdBDP/kGBRscVH0LY3HC7iFCuw4j1yUUWMOnhaKiiUdusj9EBEM6uGUUcKYKVEwh1+8CqEAMxQP17VEOWNDvvFtoP1H5UzY+JnJQ243QuDvszzAmh0vrvYeVz/rZdY/vNzb7QkTMa+wbBnpu62CnhBeMh+67RlvficFXiHAMRXirJrrch0ZylZVQzb0LXHz7cfBuNQ9i1HrVke+QS/TIrVaJjgFuw==", cchWideChar=245, lpMultiByteStr=0x353900c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAD7VjHdBDP/kGBRscVH0LY3HC7iFCuw4j1yUUWMOnhaKiiUdusj9EBEM6uGUUcKYKVEwh1+8CqEAMxQP17VEOWNDvvFtoP1H5UzY+JnJQ243QuDvszzAmh0vrvYeVz/rZdY/vNzb7QkTMa+wbBnpu62CnhBeMh+67RlvficFXiHAMRXirJrrch0ZylZVQzb0LXHz7cfBuNQ9i1HrVke+QS/TIrVaJjgFuw==", lpUsedDefaultChar=0x0) returned 245 [0049.593] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0049.593] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0049.593] CloseHandle (hObject=0x158) returned 1 [0049.594] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml")) returned 0 [0049.594] GetLastError () returned 0x5 [0049.594] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml")) returned 0x20 [0049.594] SetLastError (dwErrCode=0x5) [0049.594] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=16985770962) returned 1 [0049.594] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\Файл зашифрован [auxpad.xml].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\Файл зашифрован [auxpad.xml].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0049.595] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0049.595] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0049.595] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0049.595] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0049.595] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0049.595] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0049.595] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0049.595] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0049.595] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0049.595] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0049.595] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0049.595] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0049.595] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0049.595] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0049.595] SetEndOfFile (hFile=0x158) returned 1 [0049.595] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0049.596] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0049.596] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0049.596] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0049.596] WriteFile (in: hFile=0x158, lpBuffer=0x361f5a8*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x361f5a8*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0049.597] WriteFile (in: hFile=0x158, lpBuffer=0x35f005c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f005c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0049.597] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="@uH\"(^4ayNtKCpfalM)A9\\1gQYdOQ}?1", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0049.597] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="@uH\"(^4ayNtKCpfalM)A9\\1gQYdOQ}?1", cchWideChar=32, lpMultiByteStr=0x2032cc4, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="@uH\"(^4ayNtKCpfalM)A9\\1gQYdOQ}?1", lpUsedDefaultChar=0x0) returned 32 [0049.597] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0049.597] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0049.597] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2b1a99, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2b1a99, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2b1a99, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxpad.xml", cAlternateFileName="")) returned 0x295098 [0049.597] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0049.597] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0049.597] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml")) returned 0x20 [0049.597] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml")) returned 0x20 [0049.597] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml")) returned 0x20 [0049.597] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml")) returned 0x20 [0049.597] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2b1a99, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2b1a99, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2b1a99, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd4)) returned 1 [0049.597] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0049.597] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0049.597] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml")) returned 0x20 [0049.597] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml")) returned 0x20 [0049.598] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0049.598] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0049.598] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0049.598] SetEndOfFile (hFile=0x158) returned 1 [0049.598] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="auxpad.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.598] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="auxpad.xml", cchWideChar=10, lpMultiByteStr=0x1fe410c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="auxpad.xml", lpUsedDefaultChar=0x0) returned 10 [0049.599] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="auxpad.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.599] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="auxpad.xml", cchWideChar=10, lpMultiByteStr=0x1fe3acc, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="auxpad.xml", lpUsedDefaultChar=0x0) returned 10 [0049.599] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe3acc, cbMultiByte=10, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="auxpad.xmllion.avi\x01") returned 10 [0049.599] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="auxpad.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.599] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="auxpad.xml", cchWideChar=10, lpMultiByteStr=0x1fe410c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="auxpad.xml", lpUsedDefaultChar=0x0) returned 10 [0049.599] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0049.599] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0049.599] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0xd4 [0049.599] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0049.599] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0049.599] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0049.599] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="auxpad.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.599] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="auxpad.xml", cchWideChar=10, lpMultiByteStr=0x1fe410c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="auxpad.xml", lpUsedDefaultChar=0x0) returned 10 [0049.599] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="auxpad.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.599] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="auxpad.xml", cchWideChar=10, lpMultiByteStr=0x1fe3acc, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="auxpad.xml", lpUsedDefaultChar=0x0) returned 10 [0049.599] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe3acc, cbMultiByte=10, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="auxpad.xmlad.xmllion.avi\x01") returned 10 [0049.599] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="auxpad.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.599] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="auxpad.xml", cchWideChar=10, lpMultiByteStr=0x1fe410c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="auxpad.xml", lpUsedDefaultChar=0x0) returned 10 [0049.599] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0049.602] CharToOemA (in: pSrc="auxpad.xml", pDst=0x1fe3acc | out: pDst="auxpad.xml") returned 1 [0049.602] WriteFile (in: hFile=0x158, lpBuffer=0x1fe3acc*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe3acc*, lpNumberOfBytesWritten=0x18e048*=0xa, lpOverlapped=0x0) returned 1 [0049.602] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0049.602] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0049.602] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0049.602] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=16986569616) returned 1 [0049.602] ReadFile (in: hFile=0x15c, lpBuffer=0x35f7b60, nNumberOfBytesToRead=0xd4, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x35f7b60*, lpNumberOfBytesRead=0x18dd7c*=0xd4, lpOverlapped=0x0) returned 1 [0049.606] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0049.606] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=16986906890) returned 1 [0049.614] WriteFile (in: hFile=0x158, lpBuffer=0x1fea210*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fea210*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0049.614] ReadFile (in: hFile=0x15c, lpBuffer=0x35f7b60, nNumberOfBytesToRead=0xd4, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x35f7b60*, lpNumberOfBytesRead=0x18de38*=0xd4, lpOverlapped=0x0) returned 1 [0049.614] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x45 [0049.614] WriteFile (in: hFile=0x158, lpBuffer=0x35f7a80*, nNumberOfBytesToWrite=0xd4, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x35f7a80*, lpNumberOfBytesWritten=0x18de10*=0xd4, lpOverlapped=0x0) returned 1 [0049.614] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x119 [0049.614] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0049.615] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0049.615] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0049.615] SetFilePointer (in: hFile=0x158, lDistanceToMove=10, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x28 [0049.615] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x123 [0049.615] CloseHandle (hObject=0x15c) returned 1 [0049.615] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x123 [0049.615] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x123 [0049.615] SetFilePointer (in: hFile=0x158, lDistanceToMove=291, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x123 [0049.615] SetFilePointer (in: hFile=0x158, lDistanceToMove=291, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x123 [0049.615] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x123 [0049.615] SetFilePointer (in: hFile=0x158, lDistanceToMove=291, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x123 [0049.615] SetEndOfFile (hFile=0x158) returned 1 [0049.615] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x123 [0049.615] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x123 [0049.616] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="auxpad.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.616] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="auxpad.xml", cchWideChar=10, lpMultiByteStr=0x1fe410c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="auxpad.xml", lpUsedDefaultChar=0x0) returned 10 [0049.616] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="auxpad.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.616] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="auxpad.xml", cchWideChar=10, lpMultiByteStr=0x1fe420c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="auxpad.xml", lpUsedDefaultChar=0x0) returned 10 [0049.616] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe420c, cbMultiByte=10, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="auxpad.xml\x18ꞗ@涤(\x18믉`믑`") returned 10 [0049.616] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="auxpad.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.616] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="auxpad.xml", cchWideChar=10, lpMultiByteStr=0x1fe410c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="auxpad.xml", lpUsedDefaultChar=0x0) returned 10 [0049.616] WriteFile (in: hFile=0x158, lpBuffer=0x34e4d28*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x34e4d28*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0049.616] CharToOemA (in: pSrc="auxpad.xml", pDst=0x1fe420c | out: pDst="auxpad.xml") returned 1 [0049.616] WriteFile (in: hFile=0x158, lpBuffer=0x1fe420c*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe420c*, lpNumberOfBytesWritten=0x18efcc*=0xa, lpOverlapped=0x0) returned 1 [0049.616] WriteFile (in: hFile=0x158, lpBuffer=0x1fea128*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea128*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0049.616] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0049.616] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0049.616] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x166 [0049.616] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x166 [0049.616] WriteFile (in: hFile=0x158, lpBuffer=0x361f5a8*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x361f5a8*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0049.616] WriteFile (in: hFile=0x158, lpBuffer=0x35f005c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f005c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0049.617] DeleteFileW (lpFileName="") returned 0 [0049.617] GetLastError () returned 0x3 [0049.617] GetFileAttributesW (lpFileName="") returned 0xffffffff [0049.617] SetLastError (dwErrCode=0x3) [0049.617] FlushFileBuffers (hFile=0x158) returned 1 [0049.620] GetCurrentThreadId () returned 0x970 [0049.620] GetCurrentThreadId () returned 0x970 [0049.620] GetCurrentThreadId () returned 0x970 [0049.620] GetCurrentThreadId () returned 0x970 [0049.620] GetCurrentThreadId () returned 0x970 [0049.620] GetCurrentThreadId () returned 0x970 [0049.620] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x21d [0049.620] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x21d [0049.620] SetFilePointer (in: hFile=0x158, lDistanceToMove=541, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x21d [0049.620] CloseHandle (hObject=0x158) returned 1 [0049.621] GetCurrentThreadId () returned 0x970 [0049.621] GetCurrentThreadId () returned 0x970 [0049.621] GetCurrentThreadId () returned 0x970 [0049.621] GetCurrentThreadId () returned 0x970 [0049.621] GetCurrentThreadId () returned 0x970 [0049.621] GetCurrentThreadId () returned 0x970 [0049.621] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\Файл зашифрован [auxpad.xml].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\Файл зашифрован [auxpad.xml].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0049.622] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x21d [0049.622] SetFilePointer (in: hFile=0x158, lDistanceToMove=413, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x19d [0049.622] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0049.622] GetFileType (hFile=0x158) returned 0x1 [0049.622] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x38, wMilliseconds=0x3a4)) [0049.622] GetCurrentThreadId () returned 0x970 [0049.622] GetCurrentThreadId () returned 0x970 [0049.622] GetCurrentThreadId () returned 0x970 [0049.622] GetCurrentThreadId () returned 0x970 [0049.622] GetCurrentThreadId () returned 0x970 [0049.622] GetCurrentThreadId () returned 0x970 [0049.622] GetCurrentThreadId () returned 0x970 [0049.622] GetCurrentThreadId () returned 0x970 [0049.622] GetCurrentThreadId () returned 0x970 [0049.622] GetCurrentThreadId () returned 0x970 [0049.622] GetCurrentThreadId () returned 0x970 [0049.622] GetCurrentThreadId () returned 0x970 [0049.622] GetCurrentThreadId () returned 0x970 [0049.622] GetCurrentThreadId () returned 0x970 [0049.622] GetCurrentThreadId () returned 0x970 [0049.622] GetCurrentThreadId () returned 0x970 [0049.622] GetCurrentThreadId () returned 0x970 [0049.622] GetCurrentThreadId () returned 0x970 [0049.622] GetCurrentThreadId () returned 0x970 [0049.622] GetCurrentThreadId () returned 0x970 [0049.622] GetCurrentThreadId () returned 0x970 [0049.622] GetCurrentThreadId () returned 0x970 [0049.622] GetCurrentThreadId () returned 0x970 [0049.622] GetCurrentThreadId () returned 0x970 [0049.622] GetCurrentThreadId () returned 0x970 [0049.622] GetCurrentThreadId () returned 0x970 [0049.622] GetCurrentThreadId () returned 0x970 [0049.622] GetCurrentThreadId () returned 0x970 [0049.622] GetCurrentThreadId () returned 0x970 [0049.622] GetCurrentThreadId () returned 0x970 [0049.622] GetCurrentThreadId () returned 0x970 [0049.622] GetCurrentThreadId () returned 0x970 [0049.622] GetCurrentThreadId () returned 0x970 [0049.622] GetCurrentThreadId () returned 0x970 [0049.622] GetCurrentThreadId () returned 0x970 [0049.623] GetCurrentThreadId () returned 0x970 [0049.623] GetCurrentThreadId () returned 0x970 [0049.623] GetCurrentThreadId () returned 0x970 [0049.623] GetCurrentThreadId () returned 0x970 [0049.623] GetCurrentThreadId () returned 0x970 [0049.623] GetCurrentThreadId () returned 0x970 [0049.623] GetCurrentThreadId () returned 0x970 [0049.623] GetCurrentThreadId () returned 0x970 [0049.623] GetCurrentThreadId () returned 0x970 [0049.623] GetCurrentThreadId () returned 0x970 [0049.623] GetCurrentThreadId () returned 0x970 [0049.623] GetCurrentThreadId () returned 0x970 [0049.623] GetCurrentThreadId () returned 0x970 [0049.623] GetCurrentThreadId () returned 0x970 [0049.623] GetCurrentThreadId () returned 0x970 [0049.623] GetCurrentThreadId () returned 0x970 [0049.623] GetCurrentThreadId () returned 0x970 [0049.623] GetCurrentThreadId () returned 0x970 [0049.623] GetCurrentThreadId () returned 0x970 [0049.623] GetCurrentThreadId () returned 0x970 [0049.623] GetCurrentThreadId () returned 0x970 [0049.623] GetCurrentThreadId () returned 0x970 [0049.623] GetCurrentThreadId () returned 0x970 [0049.623] GetCurrentThreadId () returned 0x970 [0049.623] GetCurrentThreadId () returned 0x970 [0049.623] GetCurrentThreadId () returned 0x970 [0049.623] GetCurrentThreadId () returned 0x970 [0049.623] GetCurrentThreadId () returned 0x970 [0049.623] GetCurrentThreadId () returned 0x970 [0049.623] GetCurrentThreadId () returned 0x970 [0049.623] GetCurrentThreadId () returned 0x970 [0049.623] GetCurrentThreadId () returned 0x970 [0049.623] GetCurrentThreadId () returned 0x970 [0049.623] GetCurrentThreadId () returned 0x970 [0049.623] GetCurrentThreadId () returned 0x970 [0049.623] GetCurrentThreadId () returned 0x970 [0049.623] GetCurrentThreadId () returned 0x970 [0049.623] GetCurrentThreadId () returned 0x970 [0049.623] GetCurrentThreadId () returned 0x970 [0049.623] GetCurrentThreadId () returned 0x970 [0049.623] GetCurrentThreadId () returned 0x970 [0049.623] GetCurrentThreadId () returned 0x970 [0049.623] GetCurrentThreadId () returned 0x970 [0049.623] GetCurrentThreadId () returned 0x970 [0049.623] GetCurrentThreadId () returned 0x970 [0049.623] GetCurrentThreadId () returned 0x970 [0049.623] GetCurrentThreadId () returned 0x970 [0049.623] GetCurrentThreadId () returned 0x970 [0049.624] GetCurrentThreadId () returned 0x970 [0049.624] GetCurrentThreadId () returned 0x970 [0049.624] GetCurrentThreadId () returned 0x970 [0049.624] GetCurrentThreadId () returned 0x970 [0049.624] GetCurrentThreadId () returned 0x970 [0049.624] GetCurrentThreadId () returned 0x970 [0049.624] GetCurrentThreadId () returned 0x970 [0049.624] GetCurrentThreadId () returned 0x970 [0049.624] GetCurrentThreadId () returned 0x970 [0049.624] GetCurrentThreadId () returned 0x970 [0049.624] GetCurrentThreadId () returned 0x970 [0049.624] GetCurrentThreadId () returned 0x970 [0049.624] GetCurrentThreadId () returned 0x970 [0049.624] GetCurrentThreadId () returned 0x970 [0049.624] GetCurrentThreadId () returned 0x970 [0049.624] GetCurrentThreadId () returned 0x970 [0049.624] GetCurrentThreadId () returned 0x970 [0049.624] GetCurrentThreadId () returned 0x970 [0049.624] GetCurrentThreadId () returned 0x970 [0049.624] GetCurrentThreadId () returned 0x970 [0049.624] GetCurrentThreadId () returned 0x970 [0049.624] GetCurrentThreadId () returned 0x970 [0049.624] GetCurrentThreadId () returned 0x970 [0049.624] GetCurrentThreadId () returned 0x970 [0049.624] GetCurrentThreadId () returned 0x970 [0049.624] GetCurrentThreadId () returned 0x970 [0049.624] GetCurrentThreadId () returned 0x970 [0049.624] GetCurrentThreadId () returned 0x970 [0049.624] GetCurrentThreadId () returned 0x970 [0049.624] GetCurrentThreadId () returned 0x970 [0049.624] GetCurrentThreadId () returned 0x970 [0049.624] GetCurrentThreadId () returned 0x970 [0049.624] GetCurrentThreadId () returned 0x970 [0049.624] GetCurrentThreadId () returned 0x970 [0049.624] GetCurrentThreadId () returned 0x970 [0049.624] GetCurrentThreadId () returned 0x970 [0049.624] GetCurrentThreadId () returned 0x970 [0049.624] GetCurrentThreadId () returned 0x970 [0049.624] GetCurrentThreadId () returned 0x970 [0049.624] GetCurrentThreadId () returned 0x970 [0049.624] GetCurrentThreadId () returned 0x970 [0049.624] GetCurrentThreadId () returned 0x970 [0049.624] GetCurrentThreadId () returned 0x970 [0049.624] GetCurrentThreadId () returned 0x970 [0049.624] GetCurrentThreadId () returned 0x970 [0049.624] GetCurrentThreadId () returned 0x970 [0049.624] GetCurrentThreadId () returned 0x970 [0049.624] GetCurrentThreadId () returned 0x970 [0049.624] GetCurrentThreadId () returned 0x970 [0049.625] GetCurrentThreadId () returned 0x970 [0049.625] GetCurrentThreadId () returned 0x970 [0049.625] GetCurrentThreadId () returned 0x970 [0049.625] GetCurrentThreadId () returned 0x970 [0049.625] GetCurrentThreadId () returned 0x970 [0049.625] GetCurrentThreadId () returned 0x970 [0049.625] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.625] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.625] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feba90, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.625] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.625] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.625] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feba90, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.625] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.625] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.625] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.625] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.625] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.625] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.625] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.625] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.625] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1febaf0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.625] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.625] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.625] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1febaf0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.625] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.625] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.625] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1febaf0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.625] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x38, wMilliseconds=0x3a4)) [0049.625] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="@uH\"(^4ayNtKCpfalM)A9\\1gQYdOQ}?1", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0049.625] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="@uH\"(^4ayNtKCpfalM)A9\\1gQYdOQ}?1", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0049.625] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="@uH\"(^4ayNtKCpfalM)A9\\1gQYdOQ}?1", cchWideChar=32, lpMultiByteStr=0x2000b38, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="@uH\"(^4ayNtKCpfalM)A9\\1gQYdOQ}?1", lpUsedDefaultChar=0x0) returned 32 [0049.625] GetCurrentThreadId () returned 0x970 [0049.625] GetCurrentThreadId () returned 0x970 [0049.625] GetCurrentThreadId () returned 0x970 [0049.626] GetCurrentThreadId () returned 0x970 [0049.626] GetCurrentThreadId () returned 0x970 [0049.626] GetCurrentThreadId () returned 0x970 [0049.633] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0049.633] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0049.633] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x202e968, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0049.633] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x35905f8, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0049.633] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x35905f8, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAABJ6R8jbqNd/jeT4L6+gPS+meAbaCEzO+4ceGpSJ+V5udboOx8/U7Fs69StlIrIlFisURgPL2cNrKiAO6roEkLHtIYmMv2YYYKLBc6AZG/JP0SesCguz9k+w8JNRuGOZbHiX34sbmM+2Oche6eEqWm3Zy92DXBG0wA35fqM0YLU+Gm5FnyldERzg+/8eMISjVklVoPZVg9MI7WHRfC3x8lubkM8UVr9Qxw==") returned 232 [0049.633] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x38, wMilliseconds=0x3a4)) [0049.633] GetCurrentThreadId () returned 0x970 [0049.633] GetCurrentThreadId () returned 0x970 [0049.633] GetCurrentThreadId () returned 0x970 [0049.633] GetCurrentThreadId () returned 0x970 [0049.633] GetCurrentThreadId () returned 0x970 [0049.633] GetCurrentThreadId () returned 0x970 [0049.633] GetCurrentThreadId () returned 0x970 [0049.633] GetCurrentThreadId () returned 0x970 [0049.633] GetCurrentThreadId () returned 0x970 [0049.633] GetCurrentThreadId () returned 0x970 [0049.633] GetCurrentThreadId () returned 0x970 [0049.633] GetCurrentThreadId () returned 0x970 [0049.633] GetCurrentThreadId () returned 0x970 [0049.633] GetCurrentThreadId () returned 0x970 [0049.633] GetCurrentThreadId () returned 0x970 [0049.633] GetCurrentThreadId () returned 0x970 [0049.633] GetCurrentThreadId () returned 0x970 [0049.633] GetCurrentThreadId () returned 0x970 [0049.633] GetCurrentThreadId () returned 0x970 [0049.633] GetCurrentThreadId () returned 0x970 [0049.633] GetCurrentThreadId () returned 0x970 [0049.633] GetCurrentThreadId () returned 0x970 [0049.633] GetCurrentThreadId () returned 0x970 [0049.633] GetCurrentThreadId () returned 0x970 [0049.633] GetCurrentThreadId () returned 0x970 [0049.633] GetCurrentThreadId () returned 0x970 [0049.633] GetCurrentThreadId () returned 0x970 [0049.633] GetCurrentThreadId () returned 0x970 [0049.633] GetCurrentThreadId () returned 0x970 [0049.633] GetCurrentThreadId () returned 0x970 [0049.633] GetCurrentThreadId () returned 0x970 [0049.634] GetCurrentThreadId () returned 0x970 [0049.634] GetCurrentThreadId () returned 0x970 [0049.634] GetCurrentThreadId () returned 0x970 [0049.634] GetCurrentThreadId () returned 0x970 [0049.634] GetCurrentThreadId () returned 0x970 [0049.634] GetCurrentThreadId () returned 0x970 [0049.634] GetCurrentThreadId () returned 0x970 [0049.634] GetCurrentThreadId () returned 0x970 [0049.634] GetCurrentThreadId () returned 0x970 [0049.634] GetCurrentThreadId () returned 0x970 [0049.634] GetCurrentThreadId () returned 0x970 [0049.634] GetCurrentThreadId () returned 0x970 [0049.634] GetCurrentThreadId () returned 0x970 [0049.634] GetCurrentThreadId () returned 0x970 [0049.634] GetCurrentThreadId () returned 0x970 [0049.634] GetCurrentThreadId () returned 0x970 [0049.634] GetCurrentThreadId () returned 0x970 [0049.634] GetCurrentThreadId () returned 0x970 [0049.634] GetCurrentThreadId () returned 0x970 [0049.634] GetCurrentThreadId () returned 0x970 [0049.634] GetCurrentThreadId () returned 0x970 [0049.634] GetCurrentThreadId () returned 0x970 [0049.634] GetCurrentThreadId () returned 0x970 [0049.634] GetCurrentThreadId () returned 0x970 [0049.634] GetCurrentThreadId () returned 0x970 [0049.634] GetCurrentThreadId () returned 0x970 [0049.634] GetCurrentThreadId () returned 0x970 [0049.634] GetCurrentThreadId () returned 0x970 [0049.634] GetCurrentThreadId () returned 0x970 [0049.634] GetCurrentThreadId () returned 0x970 [0049.634] GetCurrentThreadId () returned 0x970 [0049.634] GetCurrentThreadId () returned 0x970 [0049.634] GetCurrentThreadId () returned 0x970 [0049.634] GetCurrentThreadId () returned 0x970 [0049.634] GetCurrentThreadId () returned 0x970 [0049.634] GetCurrentThreadId () returned 0x970 [0049.634] GetCurrentThreadId () returned 0x970 [0049.634] GetCurrentThreadId () returned 0x970 [0049.634] GetCurrentThreadId () returned 0x970 [0049.634] GetCurrentThreadId () returned 0x970 [0049.634] GetCurrentThreadId () returned 0x970 [0049.634] GetCurrentThreadId () returned 0x970 [0049.634] GetCurrentThreadId () returned 0x970 [0049.634] GetCurrentThreadId () returned 0x970 [0049.634] GetCurrentThreadId () returned 0x970 [0049.634] GetCurrentThreadId () returned 0x970 [0049.634] GetCurrentThreadId () returned 0x970 [0049.634] GetCurrentThreadId () returned 0x970 [0049.635] GetCurrentThreadId () returned 0x970 [0049.635] GetCurrentThreadId () returned 0x970 [0049.635] GetCurrentThreadId () returned 0x970 [0049.635] GetCurrentThreadId () returned 0x970 [0049.635] GetCurrentThreadId () returned 0x970 [0049.635] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAABJ6R8jbqNd/jeT4L6+gPS+meAbaCEzO+4ceGpSJ+V5udboOx8/U7Fs69StlIrIlFisURgPL2cNrKiAO6roEkLHtIYmMv2YYYKLBc6AZG/JP0SesCguz9k+w8JNRuGOZbHiX34sbmM+2Oche6eEqWm3Zy92DXBG0wA35fqM0YLU+Gm5FnyldERzg+/8eMISjVklVoPZVg9MI7WHRfC3x8lubkM8UVr9Qxw==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0049.635] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAABJ6R8jbqNd/jeT4L6+gPS+meAbaCEzO+4ceGpSJ+V5udboOx8/U7Fs69StlIrIlFisURgPL2cNrKiAO6roEkLHtIYmMv2YYYKLBc6AZG/JP0SesCguz9k+w8JNRuGOZbHiX34sbmM+2Oche6eEqWm3Zy92DXBG0wA35fqM0YLU+Gm5FnyldERzg+/8eMISjVklVoPZVg9MI7WHRfC3x8lubkM8UVr9Qxw==", cchWideChar=245, lpMultiByteStr=0x353900c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAABJ6R8jbqNd/jeT4L6+gPS+meAbaCEzO+4ceGpSJ+V5udboOx8/U7Fs69StlIrIlFisURgPL2cNrKiAO6roEkLHtIYmMv2YYYKLBc6AZG/JP0SesCguz9k+w8JNRuGOZbHiX34sbmM+2Oche6eEqWm3Zy92DXBG0wA35fqM0YLU+Gm5FnyldERzg+/8eMISjVklVoPZVg9MI7WHRfC3x8lubkM8UVr9Qxw==", lpUsedDefaultChar=0x0) returned 245 [0049.635] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0049.635] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0049.635] CloseHandle (hObject=0x158) returned 1 [0049.636] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml")) returned 0 [0049.636] GetLastError () returned 0x5 [0049.636] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml")) returned 0x20 [0049.636] SetLastError (dwErrCode=0x5) [0049.636] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=16989928347) returned 1 [0049.636] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\Файл зашифрован [ea.xml].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\Файл зашифрован [ea.xml].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0049.636] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0049.636] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0049.636] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0049.636] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0049.636] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0049.636] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0049.637] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0049.637] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0049.637] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0049.637] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0049.637] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0049.637] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0049.637] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0049.637] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0049.637] SetEndOfFile (hFile=0x158) returned 1 [0049.637] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0049.637] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0049.637] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0049.637] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0049.637] WriteFile (in: hFile=0x158, lpBuffer=0x361f5a8*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x361f5a8*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0049.641] WriteFile (in: hFile=0x158, lpBuffer=0x35eff9c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35eff9c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0049.642] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s4YyLPGi,/)i+*M3mM@PKAg&0IlJv(w/", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0049.642] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s4YyLPGi,/)i+*M3mM@PKAg&0IlJv(w/", cchWideChar=32, lpMultiByteStr=0x2032784, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="s4YyLPGi,/)i+*M3mM@PKAg&0IlJv(w/", lpUsedDefaultChar=0x0) returned 32 [0049.642] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0049.642] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0049.642] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f4a0c5f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f4a0c5f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f4c6dbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x180, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea.xml", cAlternateFileName="")) returned 0x295098 [0049.642] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0049.642] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0049.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml")) returned 0x20 [0049.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml")) returned 0x20 [0049.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml")) returned 0x20 [0049.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml")) returned 0x20 [0049.642] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f4a0c5f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f4a0c5f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f4c6dbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x180)) returned 1 [0049.642] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0049.642] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0049.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml")) returned 0x20 [0049.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml")) returned 0x20 [0049.643] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0049.643] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0049.643] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0049.643] SetEndOfFile (hFile=0x158) returned 1 [0049.643] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ea.xml", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0049.643] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ea.xml", cchWideChar=6, lpMultiByteStr=0x1fea1ec, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ea.xml", lpUsedDefaultChar=0x0) returned 6 [0049.644] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ea.xml", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0049.644] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ea.xml", cchWideChar=6, lpMultiByteStr=0x1fea294, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ea.xml", lpUsedDefaultChar=0x0) returned 6 [0049.644] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fea294, cbMultiByte=6, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="ea.xml.xmllion.avi\x01") returned 6 [0049.644] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ea.xml", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0049.644] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ea.xml", cchWideChar=6, lpMultiByteStr=0x1fea1ec, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ea.xml", lpUsedDefaultChar=0x0) returned 6 [0049.644] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0049.644] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0049.644] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x180 [0049.644] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0049.644] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0049.644] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0049.644] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ea.xml", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0049.644] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ea.xml", cchWideChar=6, lpMultiByteStr=0x1fea1ec, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ea.xml", lpUsedDefaultChar=0x0) returned 6 [0049.644] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ea.xml", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0049.644] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ea.xml", cchWideChar=6, lpMultiByteStr=0x1fea2dc, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ea.xml", lpUsedDefaultChar=0x0) returned 6 [0049.644] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fea2dc, cbMultiByte=6, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="ea.xmlea.xml.xmllion.avi\x01") returned 6 [0049.644] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ea.xml", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0049.644] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ea.xml", cchWideChar=6, lpMultiByteStr=0x1fea1ec, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ea.xml", lpUsedDefaultChar=0x0) returned 6 [0049.644] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0049.645] CharToOemA (in: pSrc="ea.xml", pDst=0x1fea2dc | out: pDst="ea.xml") returned 1 [0049.645] WriteFile (in: hFile=0x158, lpBuffer=0x1fea2dc*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fea2dc*, lpNumberOfBytesWritten=0x18e048*=0x6, lpOverlapped=0x0) returned 1 [0049.645] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0049.645] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0049.646] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0049.646] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=16991078428) returned 1 [0049.647] ReadFile (in: hFile=0x15c, lpBuffer=0x1fcd490, nNumberOfBytesToRead=0x180, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fcd490*, lpNumberOfBytesRead=0x18dd7c*=0x180, lpOverlapped=0x0) returned 1 [0049.648] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0049.648] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=16991167910) returned 1 [0049.657] WriteFile (in: hFile=0x158, lpBuffer=0x1fea1f8*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fea1f8*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0049.657] ReadFile (in: hFile=0x15c, lpBuffer=0x1fcd490, nNumberOfBytesToRead=0x180, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x1fcd490*, lpNumberOfBytesRead=0x18de38*=0x180, lpOverlapped=0x0) returned 1 [0049.657] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x41 [0049.657] WriteFile (in: hFile=0x158, lpBuffer=0x1fcd630*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1fcd630*, lpNumberOfBytesWritten=0x18de10*=0x180, lpOverlapped=0x0) returned 1 [0049.657] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x1c1 [0049.657] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0049.657] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0049.657] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0049.657] SetFilePointer (in: hFile=0x158, lDistanceToMove=6, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x24 [0049.657] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x1cb [0049.657] CloseHandle (hObject=0x15c) returned 1 [0049.657] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1cb [0049.658] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1cb [0049.658] SetFilePointer (in: hFile=0x158, lDistanceToMove=459, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1cb [0049.658] SetFilePointer (in: hFile=0x158, lDistanceToMove=459, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x1cb [0049.658] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1cb [0049.658] SetFilePointer (in: hFile=0x158, lDistanceToMove=459, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x1cb [0049.658] SetEndOfFile (hFile=0x158) returned 1 [0049.658] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1cb [0049.658] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1cb [0049.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ea.xml", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0049.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ea.xml", cchWideChar=6, lpMultiByteStr=0x1fea2dc, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ea.xml", lpUsedDefaultChar=0x0) returned 6 [0049.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ea.xml", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0049.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ea.xml", cchWideChar=6, lpMultiByteStr=0x1fea1ec, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ea.xml", lpUsedDefaultChar=0x0) returned 6 [0049.658] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fea1ec, cbMultiByte=6, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="ea.xml") returned 6 [0049.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ea.xml", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0049.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ea.xml", cchWideChar=6, lpMultiByteStr=0x1fea2dc, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ea.xml", lpUsedDefaultChar=0x0) returned 6 [0049.658] WriteFile (in: hFile=0x158, lpBuffer=0x34e4d28*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x34e4d28*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0049.658] CharToOemA (in: pSrc="ea.xml", pDst=0x1fea1ec | out: pDst="ea.xml") returned 1 [0049.659] WriteFile (in: hFile=0x158, lpBuffer=0x1fea1ec*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fea1ec*, lpNumberOfBytesWritten=0x18efcc*=0x6, lpOverlapped=0x0) returned 1 [0049.659] WriteFile (in: hFile=0x158, lpBuffer=0x1fea110*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea110*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0049.659] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0049.659] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0049.659] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x20a [0049.659] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x20a [0049.659] WriteFile (in: hFile=0x158, lpBuffer=0x361f5a8*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x361f5a8*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0049.659] WriteFile (in: hFile=0x158, lpBuffer=0x35eff9c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35eff9c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0049.659] DeleteFileW (lpFileName="") returned 0 [0049.659] GetLastError () returned 0x3 [0049.659] GetFileAttributesW (lpFileName="") returned 0xffffffff [0049.659] SetLastError (dwErrCode=0x3) [0049.659] FlushFileBuffers (hFile=0x158) returned 1 [0049.661] GetCurrentThreadId () returned 0x970 [0049.661] GetCurrentThreadId () returned 0x970 [0049.661] GetCurrentThreadId () returned 0x970 [0049.661] GetCurrentThreadId () returned 0x970 [0049.661] GetCurrentThreadId () returned 0x970 [0049.661] GetCurrentThreadId () returned 0x970 [0049.662] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x2c1 [0049.662] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x2c1 [0049.662] SetFilePointer (in: hFile=0x158, lDistanceToMove=705, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x2c1 [0049.662] CloseHandle (hObject=0x158) returned 1 [0049.662] GetCurrentThreadId () returned 0x970 [0049.662] GetCurrentThreadId () returned 0x970 [0049.662] GetCurrentThreadId () returned 0x970 [0049.662] GetCurrentThreadId () returned 0x970 [0049.662] GetCurrentThreadId () returned 0x970 [0049.662] GetCurrentThreadId () returned 0x970 [0049.662] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\Файл зашифрован [ea.xml].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\Файл зашифрован [ea.xml].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0049.663] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2c1 [0049.663] SetFilePointer (in: hFile=0x158, lDistanceToMove=577, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x241 [0049.663] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0049.663] GetFileType (hFile=0x158) returned 0x1 [0049.663] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x38, wMilliseconds=0x3c3)) [0049.663] GetCurrentThreadId () returned 0x970 [0049.663] GetCurrentThreadId () returned 0x970 [0049.663] GetCurrentThreadId () returned 0x970 [0049.663] GetCurrentThreadId () returned 0x970 [0049.663] GetCurrentThreadId () returned 0x970 [0049.663] GetCurrentThreadId () returned 0x970 [0049.663] GetCurrentThreadId () returned 0x970 [0049.663] GetCurrentThreadId () returned 0x970 [0049.663] GetCurrentThreadId () returned 0x970 [0049.663] GetCurrentThreadId () returned 0x970 [0049.663] GetCurrentThreadId () returned 0x970 [0049.663] GetCurrentThreadId () returned 0x970 [0049.663] GetCurrentThreadId () returned 0x970 [0049.663] GetCurrentThreadId () returned 0x970 [0049.663] GetCurrentThreadId () returned 0x970 [0049.663] GetCurrentThreadId () returned 0x970 [0049.663] GetCurrentThreadId () returned 0x970 [0049.663] GetCurrentThreadId () returned 0x970 [0049.663] GetCurrentThreadId () returned 0x970 [0049.663] GetCurrentThreadId () returned 0x970 [0049.663] GetCurrentThreadId () returned 0x970 [0049.663] GetCurrentThreadId () returned 0x970 [0049.663] GetCurrentThreadId () returned 0x970 [0049.663] GetCurrentThreadId () returned 0x970 [0049.663] GetCurrentThreadId () returned 0x970 [0049.663] GetCurrentThreadId () returned 0x970 [0049.663] GetCurrentThreadId () returned 0x970 [0049.663] GetCurrentThreadId () returned 0x970 [0049.663] GetCurrentThreadId () returned 0x970 [0049.663] GetCurrentThreadId () returned 0x970 [0049.663] GetCurrentThreadId () returned 0x970 [0049.663] GetCurrentThreadId () returned 0x970 [0049.663] GetCurrentThreadId () returned 0x970 [0049.663] GetCurrentThreadId () returned 0x970 [0049.663] GetCurrentThreadId () returned 0x970 [0049.663] GetCurrentThreadId () returned 0x970 [0049.664] GetCurrentThreadId () returned 0x970 [0049.664] GetCurrentThreadId () returned 0x970 [0049.664] GetCurrentThreadId () returned 0x970 [0049.664] GetCurrentThreadId () returned 0x970 [0049.664] GetCurrentThreadId () returned 0x970 [0049.664] GetCurrentThreadId () returned 0x970 [0049.664] GetCurrentThreadId () returned 0x970 [0049.664] GetCurrentThreadId () returned 0x970 [0049.664] GetCurrentThreadId () returned 0x970 [0049.664] GetCurrentThreadId () returned 0x970 [0049.664] GetCurrentThreadId () returned 0x970 [0049.664] GetCurrentThreadId () returned 0x970 [0049.664] GetCurrentThreadId () returned 0x970 [0049.664] GetCurrentThreadId () returned 0x970 [0049.664] GetCurrentThreadId () returned 0x970 [0049.664] GetCurrentThreadId () returned 0x970 [0049.664] GetCurrentThreadId () returned 0x970 [0049.664] GetCurrentThreadId () returned 0x970 [0049.664] GetCurrentThreadId () returned 0x970 [0049.664] GetCurrentThreadId () returned 0x970 [0049.664] GetCurrentThreadId () returned 0x970 [0049.664] GetCurrentThreadId () returned 0x970 [0049.664] GetCurrentThreadId () returned 0x970 [0049.664] GetCurrentThreadId () returned 0x970 [0049.664] GetCurrentThreadId () returned 0x970 [0049.664] GetCurrentThreadId () returned 0x970 [0049.664] GetCurrentThreadId () returned 0x970 [0049.664] GetCurrentThreadId () returned 0x970 [0049.664] GetCurrentThreadId () returned 0x970 [0049.664] GetCurrentThreadId () returned 0x970 [0049.664] GetCurrentThreadId () returned 0x970 [0049.664] GetCurrentThreadId () returned 0x970 [0049.664] GetCurrentThreadId () returned 0x970 [0049.664] GetCurrentThreadId () returned 0x970 [0049.664] GetCurrentThreadId () returned 0x970 [0049.664] GetCurrentThreadId () returned 0x970 [0049.664] GetCurrentThreadId () returned 0x970 [0049.664] GetCurrentThreadId () returned 0x970 [0049.664] GetCurrentThreadId () returned 0x970 [0049.664] GetCurrentThreadId () returned 0x970 [0049.664] GetCurrentThreadId () returned 0x970 [0049.664] GetCurrentThreadId () returned 0x970 [0049.664] GetCurrentThreadId () returned 0x970 [0049.664] GetCurrentThreadId () returned 0x970 [0049.664] GetCurrentThreadId () returned 0x970 [0049.664] GetCurrentThreadId () returned 0x970 [0049.664] GetCurrentThreadId () returned 0x970 [0049.664] GetCurrentThreadId () returned 0x970 [0049.665] GetCurrentThreadId () returned 0x970 [0049.665] GetCurrentThreadId () returned 0x970 [0049.665] GetCurrentThreadId () returned 0x970 [0049.665] GetCurrentThreadId () returned 0x970 [0049.665] GetCurrentThreadId () returned 0x970 [0049.665] GetCurrentThreadId () returned 0x970 [0049.665] GetCurrentThreadId () returned 0x970 [0049.665] GetCurrentThreadId () returned 0x970 [0049.665] GetCurrentThreadId () returned 0x970 [0049.665] GetCurrentThreadId () returned 0x970 [0049.665] GetCurrentThreadId () returned 0x970 [0049.665] GetCurrentThreadId () returned 0x970 [0049.665] GetCurrentThreadId () returned 0x970 [0049.665] GetCurrentThreadId () returned 0x970 [0049.665] GetCurrentThreadId () returned 0x970 [0049.665] GetCurrentThreadId () returned 0x970 [0049.665] GetCurrentThreadId () returned 0x970 [0049.665] GetCurrentThreadId () returned 0x970 [0049.665] GetCurrentThreadId () returned 0x970 [0049.665] GetCurrentThreadId () returned 0x970 [0049.665] GetCurrentThreadId () returned 0x970 [0049.665] GetCurrentThreadId () returned 0x970 [0049.665] GetCurrentThreadId () returned 0x970 [0049.665] GetCurrentThreadId () returned 0x970 [0049.665] GetCurrentThreadId () returned 0x970 [0049.665] GetCurrentThreadId () returned 0x970 [0049.665] GetCurrentThreadId () returned 0x970 [0049.665] GetCurrentThreadId () returned 0x970 [0049.665] GetCurrentThreadId () returned 0x970 [0049.665] GetCurrentThreadId () returned 0x970 [0049.665] GetCurrentThreadId () returned 0x970 [0049.665] GetCurrentThreadId () returned 0x970 [0049.665] GetCurrentThreadId () returned 0x970 [0049.665] GetCurrentThreadId () returned 0x970 [0049.665] GetCurrentThreadId () returned 0x970 [0049.665] GetCurrentThreadId () returned 0x970 [0049.665] GetCurrentThreadId () returned 0x970 [0049.665] GetCurrentThreadId () returned 0x970 [0049.665] GetCurrentThreadId () returned 0x970 [0049.665] GetCurrentThreadId () returned 0x970 [0049.665] GetCurrentThreadId () returned 0x970 [0049.665] GetCurrentThreadId () returned 0x970 [0049.665] GetCurrentThreadId () returned 0x970 [0049.665] GetCurrentThreadId () returned 0x970 [0049.665] GetCurrentThreadId () returned 0x970 [0049.665] GetCurrentThreadId () returned 0x970 [0049.666] GetCurrentThreadId () returned 0x970 [0049.666] GetCurrentThreadId () returned 0x970 [0049.666] GetCurrentThreadId () returned 0x970 [0049.666] GetCurrentThreadId () returned 0x970 [0049.666] GetCurrentThreadId () returned 0x970 [0049.666] GetCurrentThreadId () returned 0x970 [0049.666] GetCurrentThreadId () returned 0x970 [0049.666] GetCurrentThreadId () returned 0x970 [0049.666] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.666] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.666] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1febaf0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.666] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.666] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.666] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1febaf0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.666] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.666] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.666] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.666] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.666] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.666] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.666] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.666] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.666] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1febb50, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.666] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.666] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.666] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1febb50, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.666] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.666] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.666] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1febb50, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.666] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x38, wMilliseconds=0x3c3)) [0049.666] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="s4YyLPGi,/)i+*M3mM@PKAg&0IlJv(w/", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0049.666] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="s4YyLPGi,/)i+*M3mM@PKAg&0IlJv(w/", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0049.666] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="s4YyLPGi,/)i+*M3mM@PKAg&0IlJv(w/", cchWideChar=32, lpMultiByteStr=0x2000b68, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="s4YyLPGi,/)i+*M3mM@PKAg&0IlJv(w/", lpUsedDefaultChar=0x0) returned 32 [0049.667] GetCurrentThreadId () returned 0x970 [0049.667] GetCurrentThreadId () returned 0x970 [0049.667] GetCurrentThreadId () returned 0x970 [0049.667] GetCurrentThreadId () returned 0x970 [0049.667] GetCurrentThreadId () returned 0x970 [0049.667] GetCurrentThreadId () returned 0x970 [0049.674] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0049.674] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0049.674] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x202ea58, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0049.674] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x35905f8, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0049.674] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x35905f8, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAHNG5S7fVBjpuNijmHmd622N3HwIU2H1WvXzJdm1RusLuX1k/nbxvPRJGtabs8yyqT5SDf6qxqX4EIpdrbHc2dPf0pRCWGZnq+HETNniM02l3BgfdMyYmIcXWSHzLr6RAfjN1AR2hRQizhpFpmVbsnhYqIPz1KQsg5N1P3zN3Y9CoEBhxnKKN/CsvtcOjCVDqKcQ8KfUTgaOsy2FFR+YRLa5+o3FAEwpXA==") returned 232 [0049.674] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x38, wMilliseconds=0x3d3)) [0049.674] GetCurrentThreadId () returned 0x970 [0049.674] GetCurrentThreadId () returned 0x970 [0049.674] GetCurrentThreadId () returned 0x970 [0049.674] GetCurrentThreadId () returned 0x970 [0049.674] GetCurrentThreadId () returned 0x970 [0049.674] GetCurrentThreadId () returned 0x970 [0049.674] GetCurrentThreadId () returned 0x970 [0049.674] GetCurrentThreadId () returned 0x970 [0049.674] GetCurrentThreadId () returned 0x970 [0049.674] GetCurrentThreadId () returned 0x970 [0049.674] GetCurrentThreadId () returned 0x970 [0049.674] GetCurrentThreadId () returned 0x970 [0049.674] GetCurrentThreadId () returned 0x970 [0049.674] GetCurrentThreadId () returned 0x970 [0049.674] GetCurrentThreadId () returned 0x970 [0049.674] GetCurrentThreadId () returned 0x970 [0049.674] GetCurrentThreadId () returned 0x970 [0049.674] GetCurrentThreadId () returned 0x970 [0049.674] GetCurrentThreadId () returned 0x970 [0049.674] GetCurrentThreadId () returned 0x970 [0049.674] GetCurrentThreadId () returned 0x970 [0049.674] GetCurrentThreadId () returned 0x970 [0049.675] GetCurrentThreadId () returned 0x970 [0049.675] GetCurrentThreadId () returned 0x970 [0049.675] GetCurrentThreadId () returned 0x970 [0049.675] GetCurrentThreadId () returned 0x970 [0049.675] GetCurrentThreadId () returned 0x970 [0049.675] GetCurrentThreadId () returned 0x970 [0049.675] GetCurrentThreadId () returned 0x970 [0049.675] GetCurrentThreadId () returned 0x970 [0049.675] GetCurrentThreadId () returned 0x970 [0049.675] GetCurrentThreadId () returned 0x970 [0049.675] GetCurrentThreadId () returned 0x970 [0049.675] GetCurrentThreadId () returned 0x970 [0049.675] GetCurrentThreadId () returned 0x970 [0049.675] GetCurrentThreadId () returned 0x970 [0049.675] GetCurrentThreadId () returned 0x970 [0049.675] GetCurrentThreadId () returned 0x970 [0049.675] GetCurrentThreadId () returned 0x970 [0049.675] GetCurrentThreadId () returned 0x970 [0049.675] GetCurrentThreadId () returned 0x970 [0049.675] GetCurrentThreadId () returned 0x970 [0049.675] GetCurrentThreadId () returned 0x970 [0049.675] GetCurrentThreadId () returned 0x970 [0049.675] GetCurrentThreadId () returned 0x970 [0049.675] GetCurrentThreadId () returned 0x970 [0049.675] GetCurrentThreadId () returned 0x970 [0049.675] GetCurrentThreadId () returned 0x970 [0049.675] GetCurrentThreadId () returned 0x970 [0049.675] GetCurrentThreadId () returned 0x970 [0049.675] GetCurrentThreadId () returned 0x970 [0049.675] GetCurrentThreadId () returned 0x970 [0049.675] GetCurrentThreadId () returned 0x970 [0049.675] GetCurrentThreadId () returned 0x970 [0049.675] GetCurrentThreadId () returned 0x970 [0049.675] GetCurrentThreadId () returned 0x970 [0049.675] GetCurrentThreadId () returned 0x970 [0049.675] GetCurrentThreadId () returned 0x970 [0049.675] GetCurrentThreadId () returned 0x970 [0049.675] GetCurrentThreadId () returned 0x970 [0049.675] GetCurrentThreadId () returned 0x970 [0049.675] GetCurrentThreadId () returned 0x970 [0049.675] GetCurrentThreadId () returned 0x970 [0049.675] GetCurrentThreadId () returned 0x970 [0049.675] GetCurrentThreadId () returned 0x970 [0049.675] GetCurrentThreadId () returned 0x970 [0049.675] GetCurrentThreadId () returned 0x970 [0049.675] GetCurrentThreadId () returned 0x970 [0049.675] GetCurrentThreadId () returned 0x970 [0049.675] GetCurrentThreadId () returned 0x970 [0049.675] GetCurrentThreadId () returned 0x970 [0049.676] GetCurrentThreadId () returned 0x970 [0049.676] GetCurrentThreadId () returned 0x970 [0049.676] GetCurrentThreadId () returned 0x970 [0049.676] GetCurrentThreadId () returned 0x970 [0049.676] GetCurrentThreadId () returned 0x970 [0049.676] GetCurrentThreadId () returned 0x970 [0049.676] GetCurrentThreadId () returned 0x970 [0049.676] GetCurrentThreadId () returned 0x970 [0049.676] GetCurrentThreadId () returned 0x970 [0049.676] GetCurrentThreadId () returned 0x970 [0049.676] GetCurrentThreadId () returned 0x970 [0049.676] GetCurrentThreadId () returned 0x970 [0049.676] GetCurrentThreadId () returned 0x970 [0049.676] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAHNG5S7fVBjpuNijmHmd622N3HwIU2H1WvXzJdm1RusLuX1k/nbxvPRJGtabs8yyqT5SDf6qxqX4EIpdrbHc2dPf0pRCWGZnq+HETNniM02l3BgfdMyYmIcXWSHzLr6RAfjN1AR2hRQizhpFpmVbsnhYqIPz1KQsg5N1P3zN3Y9CoEBhxnKKN/CsvtcOjCVDqKcQ8KfUTgaOsy2FFR+YRLa5+o3FAEwpXA==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0049.676] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAHNG5S7fVBjpuNijmHmd622N3HwIU2H1WvXzJdm1RusLuX1k/nbxvPRJGtabs8yyqT5SDf6qxqX4EIpdrbHc2dPf0pRCWGZnq+HETNniM02l3BgfdMyYmIcXWSHzLr6RAfjN1AR2hRQizhpFpmVbsnhYqIPz1KQsg5N1P3zN3Y9CoEBhxnKKN/CsvtcOjCVDqKcQ8KfUTgaOsy2FFR+YRLa5+o3FAEwpXA==", cchWideChar=245, lpMultiByteStr=0x353900c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAHNG5S7fVBjpuNijmHmd622N3HwIU2H1WvXzJdm1RusLuX1k/nbxvPRJGtabs8yyqT5SDf6qxqX4EIpdrbHc2dPf0pRCWGZnq+HETNniM02l3BgfdMyYmIcXWSHzLr6RAfjN1AR2hRQizhpFpmVbsnhYqIPz1KQsg5N1P3zN3Y9CoEBhxnKKN/CsvtcOjCVDqKcQ8KfUTgaOsy2FFR+YRLa5+o3FAEwpXA==", lpUsedDefaultChar=0x0) returned 245 [0049.676] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0049.676] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0049.676] CloseHandle (hObject=0x158) returned 1 [0049.677] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml")) returned 0 [0049.677] GetLastError () returned 0x5 [0049.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml")) returned 0x20 [0049.677] SetLastError (dwErrCode=0x5) [0049.677] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=16994032949) returned 1 [0049.677] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\Файл зашифрован [keypadbase.xml].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\Файл зашифрован [keypadbase.xml].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0049.679] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0049.679] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0049.679] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0049.679] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0049.679] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0049.679] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0049.679] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0049.679] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0049.679] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0049.679] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0049.679] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0049.679] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0049.679] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0049.679] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0049.679] SetEndOfFile (hFile=0x158) returned 1 [0049.679] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0049.679] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0049.679] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0049.680] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0049.680] WriteFile (in: hFile=0x158, lpBuffer=0x361f5a8*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x361f5a8*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0049.681] WriteFile (in: hFile=0x158, lpBuffer=0x35f011c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f011c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0049.681] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ujVtnZW?VhgZ%kn,Y.#XzVRR!hg*M&ca", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0049.681] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ujVtnZW?VhgZ%kn,Y.#XzVRR!hg*M&ca", cchWideChar=32, lpMultiByteStr=0x20327bc, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ujVtnZW?VhgZ%kn,Y.#XzVRR!hg*M&ca", lpUsedDefaultChar=0x0) returned 32 [0049.681] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0049.681] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0049.681] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c8fc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1c8fc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4c6dbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x45e, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypadbase.xml", cAlternateFileName="")) returned 0x295098 [0049.681] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0049.681] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0049.681] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml")) returned 0x20 [0049.681] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml")) returned 0x20 [0049.681] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml")) returned 0x20 [0049.681] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml")) returned 0x20 [0049.681] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c8fc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1c8fc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4c6dbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x45e)) returned 1 [0049.682] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0049.682] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0049.682] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml")) returned 0x20 [0049.682] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml")) returned 0x20 [0049.682] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0049.682] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0049.682] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0049.682] SetEndOfFile (hFile=0x158) returned 1 [0049.683] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="keypadbase.xml", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0049.683] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="keypadbase.xml", cchWideChar=14, lpMultiByteStr=0x1fe3a8c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="keypadbase.xml", lpUsedDefaultChar=0x0) returned 14 [0049.683] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="keypadbase.xml", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0049.683] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="keypadbase.xml", cchWideChar=14, lpMultiByteStr=0x1fe376c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="keypadbase.xml", lpUsedDefaultChar=0x0) returned 14 [0049.683] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe376c, cbMultiByte=14, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="keypadbase.xml.avi\x01") returned 14 [0049.683] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="keypadbase.xml", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0049.683] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="keypadbase.xml", cchWideChar=14, lpMultiByteStr=0x1fe3a8c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="keypadbase.xml", lpUsedDefaultChar=0x0) returned 14 [0049.683] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0049.683] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0049.683] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x45e [0049.683] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0049.683] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0049.683] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0049.683] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="keypadbase.xml", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0049.683] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="keypadbase.xml", cchWideChar=14, lpMultiByteStr=0x1fe3a8c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="keypadbase.xml", lpUsedDefaultChar=0x0) returned 14 [0049.684] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="keypadbase.xml", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0049.684] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="keypadbase.xml", cchWideChar=14, lpMultiByteStr=0x1fe376c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="keypadbase.xml", lpUsedDefaultChar=0x0) returned 14 [0049.684] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe376c, cbMultiByte=14, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="keypadbase.xmlse.xml.avi\x01") returned 14 [0049.684] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="keypadbase.xml", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0049.684] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="keypadbase.xml", cchWideChar=14, lpMultiByteStr=0x1fe3a8c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="keypadbase.xml", lpUsedDefaultChar=0x0) returned 14 [0049.684] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0049.685] CharToOemA (in: pSrc="keypadbase.xml", pDst=0x1fe376c | out: pDst="keypadbase.xml") returned 1 [0049.685] WriteFile (in: hFile=0x158, lpBuffer=0x1fe376c*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe376c*, lpNumberOfBytesWritten=0x18e048*=0xe, lpOverlapped=0x0) returned 1 [0049.685] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0049.685] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0049.685] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0049.685] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=16994853546) returned 1 [0049.685] ReadFile (in: hFile=0x15c, lpBuffer=0x3501270, nNumberOfBytesToRead=0x45e, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3501270*, lpNumberOfBytesRead=0x18dd7c*=0x45e, lpOverlapped=0x0) returned 1 [0049.687] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0049.687] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=16995009027) returned 1 [0049.695] WriteFile (in: hFile=0x158, lpBuffer=0x1fea2d0*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fea2d0*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0049.695] ReadFile (in: hFile=0x15c, lpBuffer=0x3501270, nNumberOfBytesToRead=0x45e, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3501270*, lpNumberOfBytesRead=0x18de38*=0x45e, lpOverlapped=0x0) returned 1 [0049.695] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x49 [0049.695] WriteFile (in: hFile=0x158, lpBuffer=0x35016f0*, nNumberOfBytesToWrite=0x45e, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x35016f0*, lpNumberOfBytesWritten=0x18de10*=0x45e, lpOverlapped=0x0) returned 1 [0049.695] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x4a7 [0049.695] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0049.695] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0049.695] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0049.696] SetFilePointer (in: hFile=0x158, lDistanceToMove=14, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2c [0049.696] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x4b1 [0049.696] CloseHandle (hObject=0x15c) returned 1 [0049.696] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x4b1 [0049.696] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x4b1 [0049.696] SetFilePointer (in: hFile=0x158, lDistanceToMove=1201, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x4b1 [0049.696] SetFilePointer (in: hFile=0x158, lDistanceToMove=1201, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x4b1 [0049.696] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x4b1 [0049.696] SetFilePointer (in: hFile=0x158, lDistanceToMove=1201, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x4b1 [0049.696] SetEndOfFile (hFile=0x158) returned 1 [0049.696] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x4b1 [0049.696] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x4b1 [0049.696] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="keypadbase.xml", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0049.696] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="keypadbase.xml", cchWideChar=14, lpMultiByteStr=0x1fe3a8c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="keypadbase.xml", lpUsedDefaultChar=0x0) returned 14 [0049.696] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="keypadbase.xml", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0049.696] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="keypadbase.xml", cchWideChar=14, lpMultiByteStr=0x1fe3bac, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="keypadbase.xml", lpUsedDefaultChar=0x0) returned 14 [0049.697] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe3bac, cbMultiByte=14, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="keypadbase.xml야'\x18믉`믑`") returned 14 [0049.697] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="keypadbase.xml", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0049.697] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="keypadbase.xml", cchWideChar=14, lpMultiByteStr=0x1fe3a8c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="keypadbase.xml", lpUsedDefaultChar=0x0) returned 14 [0049.697] WriteFile (in: hFile=0x158, lpBuffer=0x34e4d28*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x34e4d28*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0049.697] CharToOemA (in: pSrc="keypadbase.xml", pDst=0x1fe3bac | out: pDst="keypadbase.xml") returned 1 [0049.697] WriteFile (in: hFile=0x158, lpBuffer=0x1fe3bac*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe3bac*, lpNumberOfBytesWritten=0x18efcc*=0xe, lpOverlapped=0x0) returned 1 [0049.697] WriteFile (in: hFile=0x158, lpBuffer=0x1fea230*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea230*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0049.697] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0049.697] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0049.697] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x4f8 [0049.697] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x4f8 [0049.697] WriteFile (in: hFile=0x158, lpBuffer=0x361f5a8*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x361f5a8*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0049.697] WriteFile (in: hFile=0x158, lpBuffer=0x35f011c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f011c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0049.697] DeleteFileW (lpFileName="") returned 0 [0049.697] GetLastError () returned 0x3 [0049.697] GetFileAttributesW (lpFileName="") returned 0xffffffff [0049.697] SetLastError (dwErrCode=0x3) [0049.697] FlushFileBuffers (hFile=0x158) returned 1 [0049.700] GetCurrentThreadId () returned 0x970 [0049.700] GetCurrentThreadId () returned 0x970 [0049.700] GetCurrentThreadId () returned 0x970 [0049.700] GetCurrentThreadId () returned 0x970 [0049.700] GetCurrentThreadId () returned 0x970 [0049.700] GetCurrentThreadId () returned 0x970 [0049.700] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x5af [0049.700] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x5af [0049.700] SetFilePointer (in: hFile=0x158, lDistanceToMove=1455, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x5af [0049.700] CloseHandle (hObject=0x158) returned 1 [0049.701] GetCurrentThreadId () returned 0x970 [0049.701] GetCurrentThreadId () returned 0x970 [0049.701] GetCurrentThreadId () returned 0x970 [0049.701] GetCurrentThreadId () returned 0x970 [0049.701] GetCurrentThreadId () returned 0x970 [0049.701] GetCurrentThreadId () returned 0x970 [0049.701] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\Файл зашифрован [keypadbase.xml].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\Файл зашифрован [keypadbase.xml].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0049.701] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5af [0049.701] SetFilePointer (in: hFile=0x158, lDistanceToMove=1327, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x52f [0049.701] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0049.701] GetFileType (hFile=0x158) returned 0x1 [0049.701] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x39, wMilliseconds=0xa)) [0049.701] GetCurrentThreadId () returned 0x970 [0049.701] GetCurrentThreadId () returned 0x970 [0049.701] GetCurrentThreadId () returned 0x970 [0049.701] GetCurrentThreadId () returned 0x970 [0049.701] GetCurrentThreadId () returned 0x970 [0049.701] GetCurrentThreadId () returned 0x970 [0049.701] GetCurrentThreadId () returned 0x970 [0049.701] GetCurrentThreadId () returned 0x970 [0049.701] GetCurrentThreadId () returned 0x970 [0049.701] GetCurrentThreadId () returned 0x970 [0049.701] GetCurrentThreadId () returned 0x970 [0049.701] GetCurrentThreadId () returned 0x970 [0049.701] GetCurrentThreadId () returned 0x970 [0049.701] GetCurrentThreadId () returned 0x970 [0049.701] GetCurrentThreadId () returned 0x970 [0049.701] GetCurrentThreadId () returned 0x970 [0049.701] GetCurrentThreadId () returned 0x970 [0049.701] GetCurrentThreadId () returned 0x970 [0049.701] GetCurrentThreadId () returned 0x970 [0049.701] GetCurrentThreadId () returned 0x970 [0049.702] GetCurrentThreadId () returned 0x970 [0049.702] GetCurrentThreadId () returned 0x970 [0049.702] GetCurrentThreadId () returned 0x970 [0049.702] GetCurrentThreadId () returned 0x970 [0049.702] GetCurrentThreadId () returned 0x970 [0049.702] GetCurrentThreadId () returned 0x970 [0049.702] GetCurrentThreadId () returned 0x970 [0049.702] GetCurrentThreadId () returned 0x970 [0049.702] GetCurrentThreadId () returned 0x970 [0049.702] GetCurrentThreadId () returned 0x970 [0049.702] GetCurrentThreadId () returned 0x970 [0049.702] GetCurrentThreadId () returned 0x970 [0049.702] GetCurrentThreadId () returned 0x970 [0049.702] GetCurrentThreadId () returned 0x970 [0049.702] GetCurrentThreadId () returned 0x970 [0049.702] GetCurrentThreadId () returned 0x970 [0049.702] GetCurrentThreadId () returned 0x970 [0049.702] GetCurrentThreadId () returned 0x970 [0049.702] GetCurrentThreadId () returned 0x970 [0049.702] GetCurrentThreadId () returned 0x970 [0049.702] GetCurrentThreadId () returned 0x970 [0049.702] GetCurrentThreadId () returned 0x970 [0049.702] GetCurrentThreadId () returned 0x970 [0049.702] GetCurrentThreadId () returned 0x970 [0049.702] GetCurrentThreadId () returned 0x970 [0049.702] GetCurrentThreadId () returned 0x970 [0049.702] GetCurrentThreadId () returned 0x970 [0049.702] GetCurrentThreadId () returned 0x970 [0049.702] GetCurrentThreadId () returned 0x970 [0049.702] GetCurrentThreadId () returned 0x970 [0049.702] GetCurrentThreadId () returned 0x970 [0049.702] GetCurrentThreadId () returned 0x970 [0049.702] GetCurrentThreadId () returned 0x970 [0049.702] GetCurrentThreadId () returned 0x970 [0049.702] GetCurrentThreadId () returned 0x970 [0049.702] GetCurrentThreadId () returned 0x970 [0049.702] GetCurrentThreadId () returned 0x970 [0049.702] GetCurrentThreadId () returned 0x970 [0049.702] GetCurrentThreadId () returned 0x970 [0049.702] GetCurrentThreadId () returned 0x970 [0049.702] GetCurrentThreadId () returned 0x970 [0049.702] GetCurrentThreadId () returned 0x970 [0049.702] GetCurrentThreadId () returned 0x970 [0049.702] GetCurrentThreadId () returned 0x970 [0049.702] GetCurrentThreadId () returned 0x970 [0049.702] GetCurrentThreadId () returned 0x970 [0049.702] GetCurrentThreadId () returned 0x970 [0049.703] GetCurrentThreadId () returned 0x970 [0049.703] GetCurrentThreadId () returned 0x970 [0049.703] GetCurrentThreadId () returned 0x970 [0049.703] GetCurrentThreadId () returned 0x970 [0049.703] GetCurrentThreadId () returned 0x970 [0049.703] GetCurrentThreadId () returned 0x970 [0049.703] GetCurrentThreadId () returned 0x970 [0049.703] GetCurrentThreadId () returned 0x970 [0049.703] GetCurrentThreadId () returned 0x970 [0049.703] GetCurrentThreadId () returned 0x970 [0049.703] GetCurrentThreadId () returned 0x970 [0049.703] GetCurrentThreadId () returned 0x970 [0049.703] GetCurrentThreadId () returned 0x970 [0049.703] GetCurrentThreadId () returned 0x970 [0049.703] GetCurrentThreadId () returned 0x970 [0049.703] GetCurrentThreadId () returned 0x970 [0049.703] GetCurrentThreadId () returned 0x970 [0049.703] GetCurrentThreadId () returned 0x970 [0049.703] GetCurrentThreadId () returned 0x970 [0049.703] GetCurrentThreadId () returned 0x970 [0049.703] GetCurrentThreadId () returned 0x970 [0049.703] GetCurrentThreadId () returned 0x970 [0049.703] GetCurrentThreadId () returned 0x970 [0049.703] GetCurrentThreadId () returned 0x970 [0049.703] GetCurrentThreadId () returned 0x970 [0049.703] GetCurrentThreadId () returned 0x970 [0049.703] GetCurrentThreadId () returned 0x970 [0049.703] GetCurrentThreadId () returned 0x970 [0049.703] GetCurrentThreadId () returned 0x970 [0049.703] GetCurrentThreadId () returned 0x970 [0049.703] GetCurrentThreadId () returned 0x970 [0049.703] GetCurrentThreadId () returned 0x970 [0049.703] GetCurrentThreadId () returned 0x970 [0049.703] GetCurrentThreadId () returned 0x970 [0049.703] GetCurrentThreadId () returned 0x970 [0049.703] GetCurrentThreadId () returned 0x970 [0049.703] GetCurrentThreadId () returned 0x970 [0049.703] GetCurrentThreadId () returned 0x970 [0049.703] GetCurrentThreadId () returned 0x970 [0049.703] GetCurrentThreadId () returned 0x970 [0049.703] GetCurrentThreadId () returned 0x970 [0049.703] GetCurrentThreadId () returned 0x970 [0049.703] GetCurrentThreadId () returned 0x970 [0049.703] GetCurrentThreadId () returned 0x970 [0049.703] GetCurrentThreadId () returned 0x970 [0049.703] GetCurrentThreadId () returned 0x970 [0049.703] GetCurrentThreadId () returned 0x970 [0049.703] GetCurrentThreadId () returned 0x970 [0049.703] GetCurrentThreadId () returned 0x970 [0049.704] GetCurrentThreadId () returned 0x970 [0049.704] GetCurrentThreadId () returned 0x970 [0049.704] GetCurrentThreadId () returned 0x970 [0049.704] GetCurrentThreadId () returned 0x970 [0049.704] GetCurrentThreadId () returned 0x970 [0049.704] GetCurrentThreadId () returned 0x970 [0049.704] GetCurrentThreadId () returned 0x970 [0049.704] GetCurrentThreadId () returned 0x970 [0049.704] GetCurrentThreadId () returned 0x970 [0049.704] GetCurrentThreadId () returned 0x970 [0049.704] GetCurrentThreadId () returned 0x970 [0049.704] GetCurrentThreadId () returned 0x970 [0049.704] GetCurrentThreadId () returned 0x970 [0049.704] GetCurrentThreadId () returned 0x970 [0049.704] GetCurrentThreadId () returned 0x970 [0049.704] GetCurrentThreadId () returned 0x970 [0049.704] GetCurrentThreadId () returned 0x970 [0049.704] GetCurrentThreadId () returned 0x970 [0049.704] GetCurrentThreadId () returned 0x970 [0049.704] GetCurrentThreadId () returned 0x970 [0049.704] GetCurrentThreadId () returned 0x970 [0049.704] GetCurrentThreadId () returned 0x970 [0049.704] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.704] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.704] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1febb50, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.704] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.704] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.704] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1febb50, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.704] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.704] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.704] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.704] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.704] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.704] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.704] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.704] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.704] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1febbb0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.704] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.704] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.704] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1febbb0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.704] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.705] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.705] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1febbb0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.705] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x39, wMilliseconds=0xa)) [0049.705] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ujVtnZW?VhgZ%kn,Y.#XzVRR!hg*M&ca", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0049.705] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ujVtnZW?VhgZ%kn,Y.#XzVRR!hg*M&ca", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0049.705] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ujVtnZW?VhgZ%kn,Y.#XzVRR!hg*M&ca", cchWideChar=32, lpMultiByteStr=0x2000bf8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ujVtnZW?VhgZ%kn,Y.#XzVRR!hg*M&ca", lpUsedDefaultChar=0x0) returned 32 [0049.705] GetCurrentThreadId () returned 0x970 [0049.705] GetCurrentThreadId () returned 0x970 [0049.705] GetCurrentThreadId () returned 0x970 [0049.705] GetCurrentThreadId () returned 0x970 [0049.705] GetCurrentThreadId () returned 0x970 [0049.705] GetCurrentThreadId () returned 0x970 [0049.712] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0049.712] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0049.712] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x202eb48, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0049.712] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x35907f8, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0049.712] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x35907f8, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAC6fJgjLS0AzNrSUG6e2CjU/pQhRbqcxnIyEjKhlVQLwTlDY9uh7uyOKJH6OLeJgiqjLRkTPe2MeCWRPpTUvm5FnxfM/d1GJ9mlAdik2jyuu/A//36CrJiMTuztNTSs7ORQnbxEVAfHeHgHGENlLIWSizSpw/Xp1yqXS/dT5x6bNJkI/cXhp/gH20QhgUdxRYJfsr/mQQVjO9MdXUHIkMhnLiIddfcPGFA==") returned 232 [0049.712] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x39, wMilliseconds=0xa)) [0049.712] GetCurrentThreadId () returned 0x970 [0049.712] GetCurrentThreadId () returned 0x970 [0049.712] GetCurrentThreadId () returned 0x970 [0049.712] GetCurrentThreadId () returned 0x970 [0049.712] GetCurrentThreadId () returned 0x970 [0049.712] GetCurrentThreadId () returned 0x970 [0049.712] GetCurrentThreadId () returned 0x970 [0049.712] GetCurrentThreadId () returned 0x970 [0049.712] GetCurrentThreadId () returned 0x970 [0049.712] GetCurrentThreadId () returned 0x970 [0049.712] GetCurrentThreadId () returned 0x970 [0049.712] GetCurrentThreadId () returned 0x970 [0049.712] GetCurrentThreadId () returned 0x970 [0049.712] GetCurrentThreadId () returned 0x970 [0049.712] GetCurrentThreadId () returned 0x970 [0049.712] GetCurrentThreadId () returned 0x970 [0049.712] GetCurrentThreadId () returned 0x970 [0049.712] GetCurrentThreadId () returned 0x970 [0049.713] GetCurrentThreadId () returned 0x970 [0049.713] GetCurrentThreadId () returned 0x970 [0049.713] GetCurrentThreadId () returned 0x970 [0049.713] GetCurrentThreadId () returned 0x970 [0049.713] GetCurrentThreadId () returned 0x970 [0049.713] GetCurrentThreadId () returned 0x970 [0049.713] GetCurrentThreadId () returned 0x970 [0049.713] GetCurrentThreadId () returned 0x970 [0049.713] GetCurrentThreadId () returned 0x970 [0049.713] GetCurrentThreadId () returned 0x970 [0049.713] GetCurrentThreadId () returned 0x970 [0049.713] GetCurrentThreadId () returned 0x970 [0049.713] GetCurrentThreadId () returned 0x970 [0049.713] GetCurrentThreadId () returned 0x970 [0049.713] GetCurrentThreadId () returned 0x970 [0049.713] GetCurrentThreadId () returned 0x970 [0049.713] GetCurrentThreadId () returned 0x970 [0049.713] GetCurrentThreadId () returned 0x970 [0049.713] GetCurrentThreadId () returned 0x970 [0049.713] GetCurrentThreadId () returned 0x970 [0049.713] GetCurrentThreadId () returned 0x970 [0049.713] GetCurrentThreadId () returned 0x970 [0049.713] GetCurrentThreadId () returned 0x970 [0049.713] GetCurrentThreadId () returned 0x970 [0049.713] GetCurrentThreadId () returned 0x970 [0049.713] GetCurrentThreadId () returned 0x970 [0049.713] GetCurrentThreadId () returned 0x970 [0049.713] GetCurrentThreadId () returned 0x970 [0049.713] GetCurrentThreadId () returned 0x970 [0049.713] GetCurrentThreadId () returned 0x970 [0049.713] GetCurrentThreadId () returned 0x970 [0049.713] GetCurrentThreadId () returned 0x970 [0049.713] GetCurrentThreadId () returned 0x970 [0049.713] GetCurrentThreadId () returned 0x970 [0049.713] GetCurrentThreadId () returned 0x970 [0049.713] GetCurrentThreadId () returned 0x970 [0049.713] GetCurrentThreadId () returned 0x970 [0049.713] GetCurrentThreadId () returned 0x970 [0049.713] GetCurrentThreadId () returned 0x970 [0049.713] GetCurrentThreadId () returned 0x970 [0049.713] GetCurrentThreadId () returned 0x970 [0049.713] GetCurrentThreadId () returned 0x970 [0049.713] GetCurrentThreadId () returned 0x970 [0049.713] GetCurrentThreadId () returned 0x970 [0049.713] GetCurrentThreadId () returned 0x970 [0049.713] GetCurrentThreadId () returned 0x970 [0049.713] GetCurrentThreadId () returned 0x970 [0049.714] GetCurrentThreadId () returned 0x970 [0049.714] GetCurrentThreadId () returned 0x970 [0049.714] GetCurrentThreadId () returned 0x970 [0049.714] GetCurrentThreadId () returned 0x970 [0049.714] GetCurrentThreadId () returned 0x970 [0049.714] GetCurrentThreadId () returned 0x970 [0049.714] GetCurrentThreadId () returned 0x970 [0049.714] GetCurrentThreadId () returned 0x970 [0049.714] GetCurrentThreadId () returned 0x970 [0049.714] GetCurrentThreadId () returned 0x970 [0049.714] GetCurrentThreadId () returned 0x970 [0049.714] GetCurrentThreadId () returned 0x970 [0049.714] GetCurrentThreadId () returned 0x970 [0049.714] GetCurrentThreadId () returned 0x970 [0049.714] GetCurrentThreadId () returned 0x970 [0049.714] GetCurrentThreadId () returned 0x970 [0049.714] GetCurrentThreadId () returned 0x970 [0049.714] GetCurrentThreadId () returned 0x970 [0049.714] GetCurrentThreadId () returned 0x970 [0049.714] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAC6fJgjLS0AzNrSUG6e2CjU/pQhRbqcxnIyEjKhlVQLwTlDY9uh7uyOKJH6OLeJgiqjLRkTPe2MeCWRPpTUvm5FnxfM/d1GJ9mlAdik2jyuu/A//36CrJiMTuztNTSs7ORQnbxEVAfHeHgHGENlLIWSizSpw/Xp1yqXS/dT5x6bNJkI/cXhp/gH20QhgUdxRYJfsr/mQQVjO9MdXUHIkMhnLiIddfcPGFA==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0049.714] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAC6fJgjLS0AzNrSUG6e2CjU/pQhRbqcxnIyEjKhlVQLwTlDY9uh7uyOKJH6OLeJgiqjLRkTPe2MeCWRPpTUvm5FnxfM/d1GJ9mlAdik2jyuu/A//36CrJiMTuztNTSs7ORQnbxEVAfHeHgHGENlLIWSizSpw/Xp1yqXS/dT5x6bNJkI/cXhp/gH20QhgUdxRYJfsr/mQQVjO9MdXUHIkMhnLiIddfcPGFA==", cchWideChar=245, lpMultiByteStr=0x353900c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAC6fJgjLS0AzNrSUG6e2CjU/pQhRbqcxnIyEjKhlVQLwTlDY9uh7uyOKJH6OLeJgiqjLRkTPe2MeCWRPpTUvm5FnxfM/d1GJ9mlAdik2jyuu/A//36CrJiMTuztNTSs7ORQnbxEVAfHeHgHGENlLIWSizSpw/Xp1yqXS/dT5x6bNJkI/cXhp/gH20QhgUdxRYJfsr/mQQVjO9MdXUHIkMhnLiIddfcPGFA==", lpUsedDefaultChar=0x0) returned 245 [0049.714] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0049.714] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0049.714] CloseHandle (hObject=0x158) returned 1 [0049.715] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml")) returned 0 [0049.715] GetLastError () returned 0x5 [0049.715] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml")) returned 0x20 [0049.715] SetLastError (dwErrCode=0x5) [0049.715] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=16997841875) returned 1 [0049.715] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\Файл зашифрован [kor-kor.xml].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\Файл зашифрован [kor-kor.xml].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0049.715] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0049.715] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0049.715] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0049.716] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0049.716] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0049.716] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0049.716] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0049.716] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0049.716] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0049.716] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0049.716] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0049.716] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0049.716] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0049.716] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0049.716] SetEndOfFile (hFile=0x158) returned 1 [0049.716] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0049.716] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0049.716] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0049.716] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0049.716] WriteFile (in: hFile=0x158, lpBuffer=0x361f5a8*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x361f5a8*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0049.717] WriteFile (in: hFile=0x158, lpBuffer=0x35eff9c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35eff9c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0049.717] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="!Z=S~*EL@-3Y9}i9v$w#+*qH+d\\3Z#>1", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0049.717] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="!Z=S~*EL@-3Y9}i9v$w#+*qH+d\\3Z#>1", cchWideChar=32, lpMultiByteStr=0x2032e84, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="!Z=S~*EL@-3Y9}i9v$w#+*qH+d\\3Z#>1", lpUsedDefaultChar=0x0) returned 32 [0049.717] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0049.717] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0049.718] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4ecf1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor-kor.xml", cAlternateFileName="")) returned 0x295098 [0049.718] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0049.718] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0049.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml")) returned 0x20 [0049.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml")) returned 0x20 [0049.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml")) returned 0x20 [0049.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml")) returned 0x20 [0049.718] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4ecf1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x188)) returned 1 [0049.718] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0049.718] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0049.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml")) returned 0x20 [0049.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml")) returned 0x20 [0049.718] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0049.718] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0049.718] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0049.718] SetEndOfFile (hFile=0x158) returned 1 [0049.719] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="kor-kor.xml", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0049.719] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="kor-kor.xml", cchWideChar=11, lpMultiByteStr=0x1fe38cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kor-kor.xml", lpUsedDefaultChar=0x0) returned 11 [0049.719] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="kor-kor.xml", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0049.719] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="kor-kor.xml", cchWideChar=11, lpMultiByteStr=0x1fe37cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kor-kor.xml", lpUsedDefaultChar=0x0) returned 11 [0049.719] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe37cc, cbMultiByte=11, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="kor-kor.xmlxml.avi\x01") returned 11 [0049.719] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="kor-kor.xml", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0049.719] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="kor-kor.xml", cchWideChar=11, lpMultiByteStr=0x1fe38cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kor-kor.xml", lpUsedDefaultChar=0x0) returned 11 [0049.719] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0049.720] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0049.720] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x188 [0049.720] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0049.720] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0049.720] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0049.720] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="kor-kor.xml", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0049.720] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="kor-kor.xml", cchWideChar=11, lpMultiByteStr=0x1fe38cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kor-kor.xml", lpUsedDefaultChar=0x0) returned 11 [0049.720] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="kor-kor.xml", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0049.720] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="kor-kor.xml", cchWideChar=11, lpMultiByteStr=0x1fe37cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kor-kor.xml", lpUsedDefaultChar=0x0) returned 11 [0049.720] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe37cc, cbMultiByte=11, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="kor-kor.xmlor.xmlxml.avi\x01") returned 11 [0049.720] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="kor-kor.xml", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0049.720] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="kor-kor.xml", cchWideChar=11, lpMultiByteStr=0x1fe38cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kor-kor.xml", lpUsedDefaultChar=0x0) returned 11 [0049.720] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0049.721] CharToOemA (in: pSrc="kor-kor.xml", pDst=0x1fe37cc | out: pDst="kor-kor.xml") returned 1 [0049.721] WriteFile (in: hFile=0x158, lpBuffer=0x1fe37cc*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe37cc*, lpNumberOfBytesWritten=0x18e048*=0xb, lpOverlapped=0x0) returned 1 [0049.721] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0049.721] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0049.721] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0049.721] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=16998479802) returned 1 [0049.721] ReadFile (in: hFile=0x15c, lpBuffer=0x1fcd490, nNumberOfBytesToRead=0x188, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fcd490*, lpNumberOfBytesRead=0x18dd7c*=0x188, lpOverlapped=0x0) returned 1 [0049.722] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0049.722] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=16998585796) returned 1 [0049.731] WriteFile (in: hFile=0x158, lpBuffer=0x1fea288*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fea288*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0049.731] ReadFile (in: hFile=0x15c, lpBuffer=0x1fcd490, nNumberOfBytesToRead=0x188, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x1fcd490*, lpNumberOfBytesRead=0x18de38*=0x188, lpOverlapped=0x0) returned 1 [0049.731] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x46 [0049.731] WriteFile (in: hFile=0x158, lpBuffer=0x1fcd630*, nNumberOfBytesToWrite=0x188, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1fcd630*, lpNumberOfBytesWritten=0x18de10*=0x188, lpOverlapped=0x0) returned 1 [0049.731] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x1ce [0049.731] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0049.731] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0049.731] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0049.732] SetFilePointer (in: hFile=0x158, lDistanceToMove=11, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x29 [0049.732] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x1d8 [0049.732] CloseHandle (hObject=0x15c) returned 1 [0049.732] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1d8 [0049.732] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1d8 [0049.732] SetFilePointer (in: hFile=0x158, lDistanceToMove=472, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1d8 [0049.732] SetFilePointer (in: hFile=0x158, lDistanceToMove=472, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x1d8 [0049.732] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1d8 [0049.732] SetFilePointer (in: hFile=0x158, lDistanceToMove=472, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x1d8 [0049.732] SetEndOfFile (hFile=0x158) returned 1 [0049.732] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1d8 [0049.732] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1d8 [0049.732] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="kor-kor.xml", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0049.732] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="kor-kor.xml", cchWideChar=11, lpMultiByteStr=0x1fe38cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kor-kor.xml", lpUsedDefaultChar=0x0) returned 11 [0049.732] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="kor-kor.xml", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0049.732] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="kor-kor.xml", cchWideChar=11, lpMultiByteStr=0x1fe368c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kor-kor.xml", lpUsedDefaultChar=0x0) returned 11 [0049.733] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe368c, cbMultiByte=11, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="kor-kor.xml\x18ꞗ@涤(\x18믉`믑`") returned 11 [0049.733] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="kor-kor.xml", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0049.733] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="kor-kor.xml", cchWideChar=11, lpMultiByteStr=0x1fe38cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kor-kor.xml", lpUsedDefaultChar=0x0) returned 11 [0049.733] WriteFile (in: hFile=0x158, lpBuffer=0x34e4d28*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x34e4d28*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0049.733] CharToOemA (in: pSrc="kor-kor.xml", pDst=0x1fe368c | out: pDst="kor-kor.xml") returned 1 [0049.733] WriteFile (in: hFile=0x158, lpBuffer=0x1fe368c*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe368c*, lpNumberOfBytesWritten=0x18efcc*=0xb, lpOverlapped=0x0) returned 1 [0049.733] WriteFile (in: hFile=0x158, lpBuffer=0x1fea128*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea128*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0049.733] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0049.733] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0049.733] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x21c [0049.733] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x21c [0049.733] WriteFile (in: hFile=0x158, lpBuffer=0x361f5a8*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x361f5a8*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0049.733] WriteFile (in: hFile=0x158, lpBuffer=0x35eff9c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35eff9c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0049.733] DeleteFileW (lpFileName="") returned 0 [0049.733] GetLastError () returned 0x3 [0049.734] GetFileAttributesW (lpFileName="") returned 0xffffffff [0049.734] SetLastError (dwErrCode=0x3) [0049.734] FlushFileBuffers (hFile=0x158) returned 1 [0049.736] GetCurrentThreadId () returned 0x970 [0049.736] GetCurrentThreadId () returned 0x970 [0049.736] GetCurrentThreadId () returned 0x970 [0049.736] GetCurrentThreadId () returned 0x970 [0049.736] GetCurrentThreadId () returned 0x970 [0049.736] GetCurrentThreadId () returned 0x970 [0049.736] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x2d3 [0049.736] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x2d3 [0049.736] SetFilePointer (in: hFile=0x158, lDistanceToMove=723, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x2d3 [0049.736] CloseHandle (hObject=0x158) returned 1 [0049.737] GetCurrentThreadId () returned 0x970 [0049.737] GetCurrentThreadId () returned 0x970 [0049.737] GetCurrentThreadId () returned 0x970 [0049.737] GetCurrentThreadId () returned 0x970 [0049.737] GetCurrentThreadId () returned 0x970 [0049.737] GetCurrentThreadId () returned 0x970 [0049.737] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\Файл зашифрован [kor-kor.xml].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\Файл зашифрован [kor-kor.xml].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0049.737] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2d3 [0049.737] SetFilePointer (in: hFile=0x158, lDistanceToMove=595, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x253 [0049.737] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0049.737] GetFileType (hFile=0x158) returned 0x1 [0049.737] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x39, wMilliseconds=0x29)) [0049.737] GetCurrentThreadId () returned 0x970 [0049.737] GetCurrentThreadId () returned 0x970 [0049.737] GetCurrentThreadId () returned 0x970 [0049.737] GetCurrentThreadId () returned 0x970 [0049.737] GetCurrentThreadId () returned 0x970 [0049.737] GetCurrentThreadId () returned 0x970 [0049.737] GetCurrentThreadId () returned 0x970 [0049.737] GetCurrentThreadId () returned 0x970 [0049.737] GetCurrentThreadId () returned 0x970 [0049.737] GetCurrentThreadId () returned 0x970 [0049.737] GetCurrentThreadId () returned 0x970 [0049.737] GetCurrentThreadId () returned 0x970 [0049.737] GetCurrentThreadId () returned 0x970 [0049.737] GetCurrentThreadId () returned 0x970 [0049.737] GetCurrentThreadId () returned 0x970 [0049.737] GetCurrentThreadId () returned 0x970 [0049.737] GetCurrentThreadId () returned 0x970 [0049.737] GetCurrentThreadId () returned 0x970 [0049.737] GetCurrentThreadId () returned 0x970 [0049.737] GetCurrentThreadId () returned 0x970 [0049.737] GetCurrentThreadId () returned 0x970 [0049.737] GetCurrentThreadId () returned 0x970 [0049.737] GetCurrentThreadId () returned 0x970 [0049.738] GetCurrentThreadId () returned 0x970 [0049.738] GetCurrentThreadId () returned 0x970 [0049.738] GetCurrentThreadId () returned 0x970 [0049.738] GetCurrentThreadId () returned 0x970 [0049.738] GetCurrentThreadId () returned 0x970 [0049.738] GetCurrentThreadId () returned 0x970 [0049.738] GetCurrentThreadId () returned 0x970 [0049.738] GetCurrentThreadId () returned 0x970 [0049.738] GetCurrentThreadId () returned 0x970 [0049.738] GetCurrentThreadId () returned 0x970 [0049.738] GetCurrentThreadId () returned 0x970 [0049.738] GetCurrentThreadId () returned 0x970 [0049.738] GetCurrentThreadId () returned 0x970 [0049.738] GetCurrentThreadId () returned 0x970 [0049.738] GetCurrentThreadId () returned 0x970 [0049.738] GetCurrentThreadId () returned 0x970 [0049.738] GetCurrentThreadId () returned 0x970 [0049.738] GetCurrentThreadId () returned 0x970 [0049.738] GetCurrentThreadId () returned 0x970 [0049.738] GetCurrentThreadId () returned 0x970 [0049.738] GetCurrentThreadId () returned 0x970 [0049.738] GetCurrentThreadId () returned 0x970 [0049.738] GetCurrentThreadId () returned 0x970 [0049.738] GetCurrentThreadId () returned 0x970 [0049.738] GetCurrentThreadId () returned 0x970 [0049.738] GetCurrentThreadId () returned 0x970 [0049.738] GetCurrentThreadId () returned 0x970 [0049.738] GetCurrentThreadId () returned 0x970 [0049.738] GetCurrentThreadId () returned 0x970 [0049.738] GetCurrentThreadId () returned 0x970 [0049.738] GetCurrentThreadId () returned 0x970 [0049.738] GetCurrentThreadId () returned 0x970 [0049.738] GetCurrentThreadId () returned 0x970 [0049.738] GetCurrentThreadId () returned 0x970 [0049.738] GetCurrentThreadId () returned 0x970 [0049.738] GetCurrentThreadId () returned 0x970 [0049.738] GetCurrentThreadId () returned 0x970 [0049.738] GetCurrentThreadId () returned 0x970 [0049.738] GetCurrentThreadId () returned 0x970 [0049.738] GetCurrentThreadId () returned 0x970 [0049.738] GetCurrentThreadId () returned 0x970 [0049.738] GetCurrentThreadId () returned 0x970 [0049.738] GetCurrentThreadId () returned 0x970 [0049.738] GetCurrentThreadId () returned 0x970 [0049.738] GetCurrentThreadId () returned 0x970 [0049.738] GetCurrentThreadId () returned 0x970 [0049.739] GetCurrentThreadId () returned 0x970 [0049.739] GetCurrentThreadId () returned 0x970 [0049.739] GetCurrentThreadId () returned 0x970 [0049.739] GetCurrentThreadId () returned 0x970 [0049.739] GetCurrentThreadId () returned 0x970 [0049.739] GetCurrentThreadId () returned 0x970 [0049.739] GetCurrentThreadId () returned 0x970 [0049.739] GetCurrentThreadId () returned 0x970 [0049.739] GetCurrentThreadId () returned 0x970 [0049.739] GetCurrentThreadId () returned 0x970 [0049.739] GetCurrentThreadId () returned 0x970 [0049.739] GetCurrentThreadId () returned 0x970 [0049.739] GetCurrentThreadId () returned 0x970 [0049.739] GetCurrentThreadId () returned 0x970 [0049.739] GetCurrentThreadId () returned 0x970 [0049.739] GetCurrentThreadId () returned 0x970 [0049.739] GetCurrentThreadId () returned 0x970 [0049.739] GetCurrentThreadId () returned 0x970 [0049.739] GetCurrentThreadId () returned 0x970 [0049.739] GetCurrentThreadId () returned 0x970 [0049.739] GetCurrentThreadId () returned 0x970 [0049.739] GetCurrentThreadId () returned 0x970 [0049.739] GetCurrentThreadId () returned 0x970 [0049.739] GetCurrentThreadId () returned 0x970 [0049.739] GetCurrentThreadId () returned 0x970 [0049.739] GetCurrentThreadId () returned 0x970 [0049.739] GetCurrentThreadId () returned 0x970 [0049.739] GetCurrentThreadId () returned 0x970 [0049.739] GetCurrentThreadId () returned 0x970 [0049.739] GetCurrentThreadId () returned 0x970 [0049.739] GetCurrentThreadId () returned 0x970 [0049.739] GetCurrentThreadId () returned 0x970 [0049.739] GetCurrentThreadId () returned 0x970 [0049.739] GetCurrentThreadId () returned 0x970 [0049.739] GetCurrentThreadId () returned 0x970 [0049.739] GetCurrentThreadId () returned 0x970 [0049.739] GetCurrentThreadId () returned 0x970 [0049.739] GetCurrentThreadId () returned 0x970 [0049.739] GetCurrentThreadId () returned 0x970 [0049.739] GetCurrentThreadId () returned 0x970 [0049.739] GetCurrentThreadId () returned 0x970 [0049.739] GetCurrentThreadId () returned 0x970 [0049.739] GetCurrentThreadId () returned 0x970 [0049.739] GetCurrentThreadId () returned 0x970 [0049.739] GetCurrentThreadId () returned 0x970 [0049.739] GetCurrentThreadId () returned 0x970 [0049.739] GetCurrentThreadId () returned 0x970 [0049.739] GetCurrentThreadId () returned 0x970 [0049.739] GetCurrentThreadId () returned 0x970 [0049.740] GetCurrentThreadId () returned 0x970 [0049.740] GetCurrentThreadId () returned 0x970 [0049.740] GetCurrentThreadId () returned 0x970 [0049.740] GetCurrentThreadId () returned 0x970 [0049.740] GetCurrentThreadId () returned 0x970 [0049.740] GetCurrentThreadId () returned 0x970 [0049.740] GetCurrentThreadId () returned 0x970 [0049.740] GetCurrentThreadId () returned 0x970 [0049.740] GetCurrentThreadId () returned 0x970 [0049.740] GetCurrentThreadId () returned 0x970 [0049.740] GetCurrentThreadId () returned 0x970 [0049.740] GetCurrentThreadId () returned 0x970 [0049.740] GetCurrentThreadId () returned 0x970 [0049.740] GetCurrentThreadId () returned 0x970 [0049.740] GetCurrentThreadId () returned 0x970 [0049.740] GetCurrentThreadId () returned 0x970 [0049.740] GetCurrentThreadId () returned 0x970 [0049.740] GetCurrentThreadId () returned 0x970 [0049.740] GetCurrentThreadId () returned 0x970 [0049.740] GetCurrentThreadId () returned 0x970 [0049.740] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.740] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.740] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1febbb0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.740] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.740] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.740] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1febbb0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.740] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.740] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.740] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.740] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.740] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.740] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.740] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.740] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.740] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1febc10, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.740] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.740] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.740] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1febc10, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.740] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.740] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.741] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1febc10, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.741] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x39, wMilliseconds=0x29)) [0049.741] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="!Z=S~*EL@-3Y9}i9v$w#+*qH+d\\3Z#>1", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0049.741] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="!Z=S~*EL@-3Y9}i9v$w#+*qH+d\\3Z#>1", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0049.741] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="!Z=S~*EL@-3Y9}i9v$w#+*qH+d\\3Z#>1", cchWideChar=32, lpMultiByteStr=0x2000b68, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="!Z=S~*EL@-3Y9}i9v$w#+*qH+d\\3Z#>1", lpUsedDefaultChar=0x0) returned 32 [0049.741] GetCurrentThreadId () returned 0x970 [0049.741] GetCurrentThreadId () returned 0x970 [0049.741] GetCurrentThreadId () returned 0x970 [0049.741] GetCurrentThreadId () returned 0x970 [0049.741] GetCurrentThreadId () returned 0x970 [0049.741] GetCurrentThreadId () returned 0x970 [0049.748] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0049.748] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0049.748] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x202ec38, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0049.748] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x35906f8, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0049.748] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x35906f8, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAABJd0wuck3RpI4widDAgDbvgb0URByTxtZcDKTe6xuVEAcX/hYajbYnpm6wD8JaXUuRQamJdGqmEQndfN48FVesANB/KTmsT8YtzIM14GnhK/bjAhDAxSX9bTfzMLlPbku7KvOdf18f+oxDAH5c2a1/2LiNMeP+fITdvTxi3xCsn62NSLd8yYPD7inXhFdWA9Emlb5bwfJze+G0tFrLrnbX00TY3YE+p5g==") returned 232 [0049.748] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x39, wMilliseconds=0x39)) [0049.748] GetCurrentThreadId () returned 0x970 [0049.748] GetCurrentThreadId () returned 0x970 [0049.748] GetCurrentThreadId () returned 0x970 [0049.748] GetCurrentThreadId () returned 0x970 [0049.748] GetCurrentThreadId () returned 0x970 [0049.748] GetCurrentThreadId () returned 0x970 [0049.748] GetCurrentThreadId () returned 0x970 [0049.748] GetCurrentThreadId () returned 0x970 [0049.748] GetCurrentThreadId () returned 0x970 [0049.748] GetCurrentThreadId () returned 0x970 [0049.748] GetCurrentThreadId () returned 0x970 [0049.748] GetCurrentThreadId () returned 0x970 [0049.748] GetCurrentThreadId () returned 0x970 [0049.748] GetCurrentThreadId () returned 0x970 [0049.748] GetCurrentThreadId () returned 0x970 [0049.748] GetCurrentThreadId () returned 0x970 [0049.748] GetCurrentThreadId () returned 0x970 [0049.748] GetCurrentThreadId () returned 0x970 [0049.748] GetCurrentThreadId () returned 0x970 [0049.748] GetCurrentThreadId () returned 0x970 [0049.749] GetCurrentThreadId () returned 0x970 [0049.749] GetCurrentThreadId () returned 0x970 [0049.749] GetCurrentThreadId () returned 0x970 [0049.749] GetCurrentThreadId () returned 0x970 [0049.749] GetCurrentThreadId () returned 0x970 [0049.749] GetCurrentThreadId () returned 0x970 [0049.749] GetCurrentThreadId () returned 0x970 [0049.749] GetCurrentThreadId () returned 0x970 [0049.749] GetCurrentThreadId () returned 0x970 [0049.749] GetCurrentThreadId () returned 0x970 [0049.749] GetCurrentThreadId () returned 0x970 [0049.749] GetCurrentThreadId () returned 0x970 [0049.749] GetCurrentThreadId () returned 0x970 [0049.749] GetCurrentThreadId () returned 0x970 [0049.749] GetCurrentThreadId () returned 0x970 [0049.749] GetCurrentThreadId () returned 0x970 [0049.749] GetCurrentThreadId () returned 0x970 [0049.749] GetCurrentThreadId () returned 0x970 [0049.749] GetCurrentThreadId () returned 0x970 [0049.749] GetCurrentThreadId () returned 0x970 [0049.749] GetCurrentThreadId () returned 0x970 [0049.749] GetCurrentThreadId () returned 0x970 [0049.749] GetCurrentThreadId () returned 0x970 [0049.749] GetCurrentThreadId () returned 0x970 [0049.749] GetCurrentThreadId () returned 0x970 [0049.749] GetCurrentThreadId () returned 0x970 [0049.749] GetCurrentThreadId () returned 0x970 [0049.749] GetCurrentThreadId () returned 0x970 [0049.749] GetCurrentThreadId () returned 0x970 [0049.749] GetCurrentThreadId () returned 0x970 [0049.749] GetCurrentThreadId () returned 0x970 [0049.749] GetCurrentThreadId () returned 0x970 [0049.749] GetCurrentThreadId () returned 0x970 [0049.749] GetCurrentThreadId () returned 0x970 [0049.749] GetCurrentThreadId () returned 0x970 [0049.749] GetCurrentThreadId () returned 0x970 [0049.749] GetCurrentThreadId () returned 0x970 [0049.749] GetCurrentThreadId () returned 0x970 [0049.749] GetCurrentThreadId () returned 0x970 [0049.749] GetCurrentThreadId () returned 0x970 [0049.749] GetCurrentThreadId () returned 0x970 [0049.749] GetCurrentThreadId () returned 0x970 [0049.749] GetCurrentThreadId () returned 0x970 [0049.749] GetCurrentThreadId () returned 0x970 [0049.749] GetCurrentThreadId () returned 0x970 [0049.749] GetCurrentThreadId () returned 0x970 [0049.749] GetCurrentThreadId () returned 0x970 [0049.749] GetCurrentThreadId () returned 0x970 [0049.750] GetCurrentThreadId () returned 0x970 [0049.750] GetCurrentThreadId () returned 0x970 [0049.750] GetCurrentThreadId () returned 0x970 [0049.750] GetCurrentThreadId () returned 0x970 [0049.750] GetCurrentThreadId () returned 0x970 [0049.750] GetCurrentThreadId () returned 0x970 [0049.750] GetCurrentThreadId () returned 0x970 [0049.750] GetCurrentThreadId () returned 0x970 [0049.750] GetCurrentThreadId () returned 0x970 [0049.750] GetCurrentThreadId () returned 0x970 [0049.750] GetCurrentThreadId () returned 0x970 [0049.750] GetCurrentThreadId () returned 0x970 [0049.750] GetCurrentThreadId () returned 0x970 [0049.750] GetCurrentThreadId () returned 0x970 [0049.750] GetCurrentThreadId () returned 0x970 [0049.750] GetCurrentThreadId () returned 0x970 [0049.750] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAABJd0wuck3RpI4widDAgDbvgb0URByTxtZcDKTe6xuVEAcX/hYajbYnpm6wD8JaXUuRQamJdGqmEQndfN48FVesANB/KTmsT8YtzIM14GnhK/bjAhDAxSX9bTfzMLlPbku7KvOdf18f+oxDAH5c2a1/2LiNMeP+fITdvTxi3xCsn62NSLd8yYPD7inXhFdWA9Emlb5bwfJze+G0tFrLrnbX00TY3YE+p5g==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0049.750] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAABJd0wuck3RpI4widDAgDbvgb0URByTxtZcDKTe6xuVEAcX/hYajbYnpm6wD8JaXUuRQamJdGqmEQndfN48FVesANB/KTmsT8YtzIM14GnhK/bjAhDAxSX9bTfzMLlPbku7KvOdf18f+oxDAH5c2a1/2LiNMeP+fITdvTxi3xCsn62NSLd8yYPD7inXhFdWA9Emlb5bwfJze+G0tFrLrnbX00TY3YE+p5g==", cchWideChar=245, lpMultiByteStr=0x353900c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAABJd0wuck3RpI4widDAgDbvgb0URByTxtZcDKTe6xuVEAcX/hYajbYnpm6wD8JaXUuRQamJdGqmEQndfN48FVesANB/KTmsT8YtzIM14GnhK/bjAhDAxSX9bTfzMLlPbku7KvOdf18f+oxDAH5c2a1/2LiNMeP+fITdvTxi3xCsn62NSLd8yYPD7inXhFdWA9Emlb5bwfJze+G0tFrLrnbX00TY3YE+p5g==", lpUsedDefaultChar=0x0) returned 245 [0049.750] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0049.750] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0049.750] CloseHandle (hObject=0x158) returned 1 [0049.751] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml")) returned 0 [0049.751] GetLastError () returned 0x5 [0049.751] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml")) returned 0x20 [0049.751] SetLastError (dwErrCode=0x5) [0049.751] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=17001437236) returned 1 [0049.751] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\Файл зашифрован [keypad.xml].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\Файл зашифрован [keypad.xml].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0049.751] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0049.751] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0049.751] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0049.751] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0049.752] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0049.752] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0049.752] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0049.752] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0049.752] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0049.752] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0049.752] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0049.752] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0049.752] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0049.752] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0049.752] SetEndOfFile (hFile=0x158) returned 1 [0049.752] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0049.752] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0049.752] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0049.752] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0049.752] WriteFile (in: hFile=0x158, lpBuffer=0x361f5a8*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x361f5a8*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0049.755] WriteFile (in: hFile=0x158, lpBuffer=0x35f005c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f005c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0049.756] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1~HSy*^5O04yl7X*T^G{9\"Aam&5lti,/", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0049.756] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1~HSy*^5O04yl7X*T^G{9\"Aam&5lti,/", cchWideChar=32, lpMultiByteStr=0x2032714, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1~HSy*^5O04yl7X*T^G{9\"Aam&5lti,/", lpUsedDefaultChar=0x0) returned 32 [0049.756] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0049.756] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0049.756] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f47ab01, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f47ab01, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f47ab01, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypad.xml", cAlternateFileName="")) returned 0x295098 [0049.756] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0049.756] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0049.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml")) returned 0x20 [0049.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml")) returned 0x20 [0049.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml")) returned 0x20 [0049.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml")) returned 0x20 [0049.756] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f47ab01, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f47ab01, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f47ab01, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2d7)) returned 1 [0049.756] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0049.756] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0049.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml")) returned 0x20 [0049.757] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml")) returned 0x20 [0049.757] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0049.757] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0049.757] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0049.757] SetEndOfFile (hFile=0x158) returned 1 [0049.757] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="keypad.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.757] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="keypad.xml", cchWideChar=10, lpMultiByteStr=0x1fe3acc, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="keypad.xml", lpUsedDefaultChar=0x0) returned 10 [0049.758] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="keypad.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.758] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="keypad.xml", cchWideChar=10, lpMultiByteStr=0x1fe36cc, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="keypad.xml", lpUsedDefaultChar=0x0) returned 10 [0049.758] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe36cc, cbMultiByte=10, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="keypad.xmllxml.avi\x01") returned 10 [0049.758] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="keypad.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.758] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="keypad.xml", cchWideChar=10, lpMultiByteStr=0x1fe3acc, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="keypad.xml", lpUsedDefaultChar=0x0) returned 10 [0049.758] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0049.758] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0049.758] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2d7 [0049.758] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0049.758] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0049.758] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0049.758] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="keypad.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.758] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="keypad.xml", cchWideChar=10, lpMultiByteStr=0x1fe3acc, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="keypad.xml", lpUsedDefaultChar=0x0) returned 10 [0049.758] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="keypad.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.758] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="keypad.xml", cchWideChar=10, lpMultiByteStr=0x1fe36cc, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="keypad.xml", lpUsedDefaultChar=0x0) returned 10 [0049.758] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe36cc, cbMultiByte=10, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="keypad.xmlad.xmllxml.avi\x01") returned 10 [0049.758] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="keypad.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.759] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="keypad.xml", cchWideChar=10, lpMultiByteStr=0x1fe3acc, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="keypad.xml", lpUsedDefaultChar=0x0) returned 10 [0049.759] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0049.759] CharToOemA (in: pSrc="keypad.xml", pDst=0x1fe36cc | out: pDst="keypad.xml") returned 1 [0049.759] WriteFile (in: hFile=0x158, lpBuffer=0x1fe36cc*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe36cc*, lpNumberOfBytesWritten=0x18e048*=0xa, lpOverlapped=0x0) returned 1 [0049.759] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0049.760] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0049.760] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0049.760] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=17002314664) returned 1 [0049.760] ReadFile (in: hFile=0x15c, lpBuffer=0x1fc46c0, nNumberOfBytesToRead=0x2d7, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fc46c0*, lpNumberOfBytesRead=0x18dd7c*=0x2d7, lpOverlapped=0x0) returned 1 [0049.761] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0049.761] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=17002458909) returned 1 [0049.770] WriteFile (in: hFile=0x158, lpBuffer=0x1fea420*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fea420*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0049.770] ReadFile (in: hFile=0x15c, lpBuffer=0x1fc46c0, nNumberOfBytesToRead=0x2d7, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x1fc46c0*, lpNumberOfBytesRead=0x18de38*=0x2d7, lpOverlapped=0x0) returned 1 [0049.770] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x45 [0049.770] WriteFile (in: hFile=0x158, lpBuffer=0x1fc49a0*, nNumberOfBytesToWrite=0x2d7, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1fc49a0*, lpNumberOfBytesWritten=0x18de10*=0x2d7, lpOverlapped=0x0) returned 1 [0049.770] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x31c [0049.770] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0049.770] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0049.770] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0049.770] SetFilePointer (in: hFile=0x158, lDistanceToMove=10, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x28 [0049.770] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x326 [0049.770] CloseHandle (hObject=0x15c) returned 1 [0049.771] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x326 [0049.771] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x326 [0049.771] SetFilePointer (in: hFile=0x158, lDistanceToMove=806, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x326 [0049.771] SetFilePointer (in: hFile=0x158, lDistanceToMove=806, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x326 [0049.771] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x326 [0049.771] SetFilePointer (in: hFile=0x158, lDistanceToMove=806, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x326 [0049.771] SetEndOfFile (hFile=0x158) returned 1 [0049.771] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x326 [0049.771] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x326 [0049.771] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="keypad.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.771] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="keypad.xml", cchWideChar=10, lpMultiByteStr=0x1fe3acc, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="keypad.xml", lpUsedDefaultChar=0x0) returned 10 [0049.771] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="keypad.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.771] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="keypad.xml", cchWideChar=10, lpMultiByteStr=0x1fe378c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="keypad.xml", lpUsedDefaultChar=0x0) returned 10 [0049.771] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe378c, cbMultiByte=10, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="keypad.xml\x18ꞗ@涤(\x18믉`믑`") returned 10 [0049.771] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="keypad.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.771] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="keypad.xml", cchWideChar=10, lpMultiByteStr=0x1fe3acc, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="keypad.xml", lpUsedDefaultChar=0x0) returned 10 [0049.771] WriteFile (in: hFile=0x158, lpBuffer=0x34e4d28*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x34e4d28*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0049.771] CharToOemA (in: pSrc="keypad.xml", pDst=0x1fe378c | out: pDst="keypad.xml") returned 1 [0049.772] WriteFile (in: hFile=0x158, lpBuffer=0x1fe378c*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe378c*, lpNumberOfBytesWritten=0x18efcc*=0xa, lpOverlapped=0x0) returned 1 [0049.772] WriteFile (in: hFile=0x158, lpBuffer=0x1fea110*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea110*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0049.772] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0049.772] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0049.772] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x369 [0049.772] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x369 [0049.772] WriteFile (in: hFile=0x158, lpBuffer=0x361f5a8*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x361f5a8*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0049.772] WriteFile (in: hFile=0x158, lpBuffer=0x35f005c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f005c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0049.772] DeleteFileW (lpFileName="") returned 0 [0049.772] GetLastError () returned 0x3 [0049.772] GetFileAttributesW (lpFileName="") returned 0xffffffff [0049.772] SetLastError (dwErrCode=0x3) [0049.772] FlushFileBuffers (hFile=0x158) returned 1 [0049.775] GetCurrentThreadId () returned 0x970 [0049.775] GetCurrentThreadId () returned 0x970 [0049.775] GetCurrentThreadId () returned 0x970 [0049.775] GetCurrentThreadId () returned 0x970 [0049.775] GetCurrentThreadId () returned 0x970 [0049.775] GetCurrentThreadId () returned 0x970 [0049.775] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x420 [0049.775] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x420 [0049.775] SetFilePointer (in: hFile=0x158, lDistanceToMove=1056, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x420 [0049.775] CloseHandle (hObject=0x158) returned 1 [0049.776] GetCurrentThreadId () returned 0x970 [0049.776] GetCurrentThreadId () returned 0x970 [0049.776] GetCurrentThreadId () returned 0x970 [0049.776] GetCurrentThreadId () returned 0x970 [0049.776] GetCurrentThreadId () returned 0x970 [0049.776] GetCurrentThreadId () returned 0x970 [0049.776] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\Файл зашифрован [keypad.xml].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\Файл зашифрован [keypad.xml].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0049.776] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x420 [0049.776] SetFilePointer (in: hFile=0x158, lDistanceToMove=928, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3a0 [0049.776] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0049.776] GetFileType (hFile=0x158) returned 0x1 [0049.776] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x39, wMilliseconds=0x48)) [0049.776] GetCurrentThreadId () returned 0x970 [0049.776] GetCurrentThreadId () returned 0x970 [0049.777] GetCurrentThreadId () returned 0x970 [0049.777] GetCurrentThreadId () returned 0x970 [0049.777] GetCurrentThreadId () returned 0x970 [0049.777] GetCurrentThreadId () returned 0x970 [0049.777] GetCurrentThreadId () returned 0x970 [0049.777] GetCurrentThreadId () returned 0x970 [0049.777] GetCurrentThreadId () returned 0x970 [0049.777] GetCurrentThreadId () returned 0x970 [0049.777] GetCurrentThreadId () returned 0x970 [0049.777] GetCurrentThreadId () returned 0x970 [0049.777] GetCurrentThreadId () returned 0x970 [0049.777] GetCurrentThreadId () returned 0x970 [0049.777] GetCurrentThreadId () returned 0x970 [0049.777] GetCurrentThreadId () returned 0x970 [0049.777] GetCurrentThreadId () returned 0x970 [0049.777] GetCurrentThreadId () returned 0x970 [0049.777] GetCurrentThreadId () returned 0x970 [0049.777] GetCurrentThreadId () returned 0x970 [0049.777] GetCurrentThreadId () returned 0x970 [0049.777] GetCurrentThreadId () returned 0x970 [0049.777] GetCurrentThreadId () returned 0x970 [0049.777] GetCurrentThreadId () returned 0x970 [0049.777] GetCurrentThreadId () returned 0x970 [0049.777] GetCurrentThreadId () returned 0x970 [0049.777] GetCurrentThreadId () returned 0x970 [0049.777] GetCurrentThreadId () returned 0x970 [0049.777] GetCurrentThreadId () returned 0x970 [0049.777] GetCurrentThreadId () returned 0x970 [0049.777] GetCurrentThreadId () returned 0x970 [0049.777] GetCurrentThreadId () returned 0x970 [0049.777] GetCurrentThreadId () returned 0x970 [0049.777] GetCurrentThreadId () returned 0x970 [0049.777] GetCurrentThreadId () returned 0x970 [0049.777] GetCurrentThreadId () returned 0x970 [0049.777] GetCurrentThreadId () returned 0x970 [0049.777] GetCurrentThreadId () returned 0x970 [0049.777] GetCurrentThreadId () returned 0x970 [0049.777] GetCurrentThreadId () returned 0x970 [0049.777] GetCurrentThreadId () returned 0x970 [0049.777] GetCurrentThreadId () returned 0x970 [0049.777] GetCurrentThreadId () returned 0x970 [0049.777] GetCurrentThreadId () returned 0x970 [0049.777] GetCurrentThreadId () returned 0x970 [0049.777] GetCurrentThreadId () returned 0x970 [0049.778] GetCurrentThreadId () returned 0x970 [0049.778] GetCurrentThreadId () returned 0x970 [0049.778] GetCurrentThreadId () returned 0x970 [0049.778] GetCurrentThreadId () returned 0x970 [0049.778] GetCurrentThreadId () returned 0x970 [0049.778] GetCurrentThreadId () returned 0x970 [0049.778] GetCurrentThreadId () returned 0x970 [0049.778] GetCurrentThreadId () returned 0x970 [0049.778] GetCurrentThreadId () returned 0x970 [0049.778] GetCurrentThreadId () returned 0x970 [0049.778] GetCurrentThreadId () returned 0x970 [0049.778] GetCurrentThreadId () returned 0x970 [0049.778] GetCurrentThreadId () returned 0x970 [0049.778] GetCurrentThreadId () returned 0x970 [0049.778] GetCurrentThreadId () returned 0x970 [0049.778] GetCurrentThreadId () returned 0x970 [0049.778] GetCurrentThreadId () returned 0x970 [0049.778] GetCurrentThreadId () returned 0x970 [0049.778] GetCurrentThreadId () returned 0x970 [0049.778] GetCurrentThreadId () returned 0x970 [0049.778] GetCurrentThreadId () returned 0x970 [0049.778] GetCurrentThreadId () returned 0x970 [0049.778] GetCurrentThreadId () returned 0x970 [0049.778] GetCurrentThreadId () returned 0x970 [0049.778] GetCurrentThreadId () returned 0x970 [0049.778] GetCurrentThreadId () returned 0x970 [0049.778] GetCurrentThreadId () returned 0x970 [0049.778] GetCurrentThreadId () returned 0x970 [0049.778] GetCurrentThreadId () returned 0x970 [0049.778] GetCurrentThreadId () returned 0x970 [0049.778] GetCurrentThreadId () returned 0x970 [0049.778] GetCurrentThreadId () returned 0x970 [0049.778] GetCurrentThreadId () returned 0x970 [0049.778] GetCurrentThreadId () returned 0x970 [0049.778] GetCurrentThreadId () returned 0x970 [0049.778] GetCurrentThreadId () returned 0x970 [0049.778] GetCurrentThreadId () returned 0x970 [0049.778] GetCurrentThreadId () returned 0x970 [0049.778] GetCurrentThreadId () returned 0x970 [0049.778] GetCurrentThreadId () returned 0x970 [0049.778] GetCurrentThreadId () returned 0x970 [0049.778] GetCurrentThreadId () returned 0x970 [0049.778] GetCurrentThreadId () returned 0x970 [0049.778] GetCurrentThreadId () returned 0x970 [0049.778] GetCurrentThreadId () returned 0x970 [0049.778] GetCurrentThreadId () returned 0x970 [0049.778] GetCurrentThreadId () returned 0x970 [0049.778] GetCurrentThreadId () returned 0x970 [0049.779] GetCurrentThreadId () returned 0x970 [0049.779] GetCurrentThreadId () returned 0x970 [0049.779] GetCurrentThreadId () returned 0x970 [0049.779] GetCurrentThreadId () returned 0x970 [0049.779] GetCurrentThreadId () returned 0x970 [0049.779] GetCurrentThreadId () returned 0x970 [0049.779] GetCurrentThreadId () returned 0x970 [0049.779] GetCurrentThreadId () returned 0x970 [0049.779] GetCurrentThreadId () returned 0x970 [0049.779] GetCurrentThreadId () returned 0x970 [0049.779] GetCurrentThreadId () returned 0x970 [0049.779] GetCurrentThreadId () returned 0x970 [0049.779] GetCurrentThreadId () returned 0x970 [0049.779] GetCurrentThreadId () returned 0x970 [0049.779] GetCurrentThreadId () returned 0x970 [0049.779] GetCurrentThreadId () returned 0x970 [0049.779] GetCurrentThreadId () returned 0x970 [0049.779] GetCurrentThreadId () returned 0x970 [0049.779] GetCurrentThreadId () returned 0x970 [0049.779] GetCurrentThreadId () returned 0x970 [0049.779] GetCurrentThreadId () returned 0x970 [0049.779] GetCurrentThreadId () returned 0x970 [0049.779] GetCurrentThreadId () returned 0x970 [0049.779] GetCurrentThreadId () returned 0x970 [0049.779] GetCurrentThreadId () returned 0x970 [0049.779] GetCurrentThreadId () returned 0x970 [0049.779] GetCurrentThreadId () returned 0x970 [0049.779] GetCurrentThreadId () returned 0x970 [0049.779] GetCurrentThreadId () returned 0x970 [0049.779] GetCurrentThreadId () returned 0x970 [0049.779] GetCurrentThreadId () returned 0x970 [0049.779] GetCurrentThreadId () returned 0x970 [0049.779] GetCurrentThreadId () returned 0x970 [0049.779] GetCurrentThreadId () returned 0x970 [0049.779] GetCurrentThreadId () returned 0x970 [0049.779] GetCurrentThreadId () returned 0x970 [0049.779] GetCurrentThreadId () returned 0x970 [0049.779] GetCurrentThreadId () returned 0x970 [0049.779] GetCurrentThreadId () returned 0x970 [0049.779] GetCurrentThreadId () returned 0x970 [0049.779] GetCurrentThreadId () returned 0x970 [0049.779] GetCurrentThreadId () returned 0x970 [0049.779] GetCurrentThreadId () returned 0x970 [0049.779] GetCurrentThreadId () returned 0x970 [0049.779] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.779] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.780] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1febc10, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.780] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.780] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.780] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1febc10, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.780] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.780] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.780] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.780] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.780] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.780] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.780] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.780] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.780] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1febc70, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.780] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.780] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.780] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1febc70, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.780] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.780] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.780] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1febc70, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.780] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x39, wMilliseconds=0x58)) [0049.780] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1~HSy*^5O04yl7X*T^G{9\"Aam&5lti,/", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0049.780] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1~HSy*^5O04yl7X*T^G{9\"Aam&5lti,/", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0049.780] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1~HSy*^5O04yl7X*T^G{9\"Aam&5lti,/", cchWideChar=32, lpMultiByteStr=0x2000bf8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1~HSy*^5O04yl7X*T^G{9\"Aam&5lti,/", lpUsedDefaultChar=0x0) returned 32 [0049.780] GetCurrentThreadId () returned 0x970 [0049.780] GetCurrentThreadId () returned 0x970 [0049.780] GetCurrentThreadId () returned 0x970 [0049.780] GetCurrentThreadId () returned 0x970 [0049.780] GetCurrentThreadId () returned 0x970 [0049.780] GetCurrentThreadId () returned 0x970 [0049.787] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0049.787] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0049.787] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x202ed28, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0049.787] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x35908f8, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0049.787] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x35908f8, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAFVPFdVJbK+2kuntPvIMX0v0tWPBl5pdVf0zdBIhZ5ZSlR5kWQK2BoLj1SDIIOq5gp0PXwVj4QSYyntGHXDvf/TuwgLUyYCkgRekHu170gx34a6W231TgClHV0wSxS3yFne9SnSSJvv0hvuzVoK5jIUbCaCmUdYQpDmhmPps7v7MeJDtyiPVhxpGjR3a1aLY8J8jv/GTjIpWm4SMTeP7XdYksBNCwALzhA==") returned 232 [0049.788] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x39, wMilliseconds=0x58)) [0049.788] GetCurrentThreadId () returned 0x970 [0049.788] GetCurrentThreadId () returned 0x970 [0049.788] GetCurrentThreadId () returned 0x970 [0049.788] GetCurrentThreadId () returned 0x970 [0049.788] GetCurrentThreadId () returned 0x970 [0049.788] GetCurrentThreadId () returned 0x970 [0049.788] GetCurrentThreadId () returned 0x970 [0049.788] GetCurrentThreadId () returned 0x970 [0049.788] GetCurrentThreadId () returned 0x970 [0049.788] GetCurrentThreadId () returned 0x970 [0049.788] GetCurrentThreadId () returned 0x970 [0049.788] GetCurrentThreadId () returned 0x970 [0049.788] GetCurrentThreadId () returned 0x970 [0049.788] GetCurrentThreadId () returned 0x970 [0049.788] GetCurrentThreadId () returned 0x970 [0049.788] GetCurrentThreadId () returned 0x970 [0049.788] GetCurrentThreadId () returned 0x970 [0049.788] GetCurrentThreadId () returned 0x970 [0049.788] GetCurrentThreadId () returned 0x970 [0049.788] GetCurrentThreadId () returned 0x970 [0049.788] GetCurrentThreadId () returned 0x970 [0049.788] GetCurrentThreadId () returned 0x970 [0049.788] GetCurrentThreadId () returned 0x970 [0049.788] GetCurrentThreadId () returned 0x970 [0049.788] GetCurrentThreadId () returned 0x970 [0049.788] GetCurrentThreadId () returned 0x970 [0049.788] GetCurrentThreadId () returned 0x970 [0049.788] GetCurrentThreadId () returned 0x970 [0049.788] GetCurrentThreadId () returned 0x970 [0049.788] GetCurrentThreadId () returned 0x970 [0049.788] GetCurrentThreadId () returned 0x970 [0049.788] GetCurrentThreadId () returned 0x970 [0049.788] GetCurrentThreadId () returned 0x970 [0049.788] GetCurrentThreadId () returned 0x970 [0049.788] GetCurrentThreadId () returned 0x970 [0049.788] GetCurrentThreadId () returned 0x970 [0049.788] GetCurrentThreadId () returned 0x970 [0049.788] GetCurrentThreadId () returned 0x970 [0049.788] GetCurrentThreadId () returned 0x970 [0049.788] GetCurrentThreadId () returned 0x970 [0049.788] GetCurrentThreadId () returned 0x970 [0049.788] GetCurrentThreadId () returned 0x970 [0049.788] GetCurrentThreadId () returned 0x970 [0049.788] GetCurrentThreadId () returned 0x970 [0049.788] GetCurrentThreadId () returned 0x970 [0049.788] GetCurrentThreadId () returned 0x970 [0049.788] GetCurrentThreadId () returned 0x970 [0049.788] GetCurrentThreadId () returned 0x970 [0049.789] GetCurrentThreadId () returned 0x970 [0049.789] GetCurrentThreadId () returned 0x970 [0049.789] GetCurrentThreadId () returned 0x970 [0049.789] GetCurrentThreadId () returned 0x970 [0049.789] GetCurrentThreadId () returned 0x970 [0049.789] GetCurrentThreadId () returned 0x970 [0049.789] GetCurrentThreadId () returned 0x970 [0049.789] GetCurrentThreadId () returned 0x970 [0049.789] GetCurrentThreadId () returned 0x970 [0049.789] GetCurrentThreadId () returned 0x970 [0049.789] GetCurrentThreadId () returned 0x970 [0049.789] GetCurrentThreadId () returned 0x970 [0049.789] GetCurrentThreadId () returned 0x970 [0049.789] GetCurrentThreadId () returned 0x970 [0049.789] GetCurrentThreadId () returned 0x970 [0049.789] GetCurrentThreadId () returned 0x970 [0049.789] GetCurrentThreadId () returned 0x970 [0049.789] GetCurrentThreadId () returned 0x970 [0049.789] GetCurrentThreadId () returned 0x970 [0049.789] GetCurrentThreadId () returned 0x970 [0049.789] GetCurrentThreadId () returned 0x970 [0049.789] GetCurrentThreadId () returned 0x970 [0049.789] GetCurrentThreadId () returned 0x970 [0049.789] GetCurrentThreadId () returned 0x970 [0049.789] GetCurrentThreadId () returned 0x970 [0049.789] GetCurrentThreadId () returned 0x970 [0049.789] GetCurrentThreadId () returned 0x970 [0049.789] GetCurrentThreadId () returned 0x970 [0049.789] GetCurrentThreadId () returned 0x970 [0049.789] GetCurrentThreadId () returned 0x970 [0049.789] GetCurrentThreadId () returned 0x970 [0049.789] GetCurrentThreadId () returned 0x970 [0049.789] GetCurrentThreadId () returned 0x970 [0049.789] GetCurrentThreadId () returned 0x970 [0049.789] GetCurrentThreadId () returned 0x970 [0049.789] GetCurrentThreadId () returned 0x970 [0049.789] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAFVPFdVJbK+2kuntPvIMX0v0tWPBl5pdVf0zdBIhZ5ZSlR5kWQK2BoLj1SDIIOq5gp0PXwVj4QSYyntGHXDvf/TuwgLUyYCkgRekHu170gx34a6W231TgClHV0wSxS3yFne9SnSSJvv0hvuzVoK5jIUbCaCmUdYQpDmhmPps7v7MeJDtyiPVhxpGjR3a1aLY8J8jv/GTjIpWm4SMTeP7XdYksBNCwALzhA==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0049.789] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAFVPFdVJbK+2kuntPvIMX0v0tWPBl5pdVf0zdBIhZ5ZSlR5kWQK2BoLj1SDIIOq5gp0PXwVj4QSYyntGHXDvf/TuwgLUyYCkgRekHu170gx34a6W231TgClHV0wSxS3yFne9SnSSJvv0hvuzVoK5jIUbCaCmUdYQpDmhmPps7v7MeJDtyiPVhxpGjR3a1aLY8J8jv/GTjIpWm4SMTeP7XdYksBNCwALzhA==", cchWideChar=245, lpMultiByteStr=0x353900c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAFVPFdVJbK+2kuntPvIMX0v0tWPBl5pdVf0zdBIhZ5ZSlR5kWQK2BoLj1SDIIOq5gp0PXwVj4QSYyntGHXDvf/TuwgLUyYCkgRekHu170gx34a6W231TgClHV0wSxS3yFne9SnSSJvv0hvuzVoK5jIUbCaCmUdYQpDmhmPps7v7MeJDtyiPVhxpGjR3a1aLY8J8jv/GTjIpWm4SMTeP7XdYksBNCwALzhA==", lpUsedDefaultChar=0x0) returned 245 [0049.789] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0049.789] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0049.790] CloseHandle (hObject=0x158) returned 1 [0049.790] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml")) returned 0 [0049.790] GetLastError () returned 0x5 [0049.790] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml")) returned 0x20 [0049.790] SetLastError (dwErrCode=0x5) [0049.790] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=17005378177) returned 1 [0049.790] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\Файл зашифрован [base.xml].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\Файл зашифрован [base.xml].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0049.791] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0049.791] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0049.791] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0049.792] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0049.792] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0049.792] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0049.792] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0049.792] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0049.792] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0049.792] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0049.792] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0049.792] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0049.792] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0049.792] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0049.792] SetEndOfFile (hFile=0x158) returned 1 [0049.792] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0049.792] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0049.792] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0049.792] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0049.792] WriteFile (in: hFile=0x158, lpBuffer=0x361f648*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x361f648*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0049.794] WriteFile (in: hFile=0x158, lpBuffer=0x35f011c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f011c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0049.794] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ryV=ElrPnR7E6gS++m:OMh,l6,:6LCHq", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0049.794] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ryV=ElrPnR7E6gS++m:OMh,l6,:6LCHq", cchWideChar=32, lpMultiByteStr=0x2032ebc, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ryV=ElrPnR7E6gS++m:OMh,l6,:6LCHq", lpUsedDefaultChar=0x0) returned 32 [0049.794] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0049.794] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0049.794] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f643b69, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f643b69, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f643b69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="base.xml", cAlternateFileName="")) returned 0x295098 [0049.794] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0049.794] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0049.794] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml")) returned 0x20 [0049.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml")) returned 0x20 [0049.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml")) returned 0x20 [0049.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml")) returned 0x20 [0049.795] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f643b69, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f643b69, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f643b69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc4e)) returned 1 [0049.795] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0049.795] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0049.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml")) returned 0x20 [0049.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml")) returned 0x20 [0049.795] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0049.795] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0049.795] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0049.795] SetEndOfFile (hFile=0x158) returned 1 [0049.796] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="base.xml", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0049.796] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="base.xml", cchWideChar=8, lpMultiByteStr=0x1fe394c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="base.xml", lpUsedDefaultChar=0x0) returned 8 [0049.796] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="base.xml", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0049.796] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="base.xml", cchWideChar=8, lpMultiByteStr=0x1fe42ec, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="base.xml", lpUsedDefaultChar=0x0) returned 8 [0049.796] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe42ec, cbMultiByte=8, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="base.xmlmllxml.avi\x01") returned 8 [0049.796] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="base.xml", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0049.796] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="base.xml", cchWideChar=8, lpMultiByteStr=0x1fe394c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="base.xml", lpUsedDefaultChar=0x0) returned 8 [0049.797] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0049.797] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0049.797] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0xc4e [0049.797] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0049.797] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0049.797] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0049.797] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="base.xml", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0049.797] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="base.xml", cchWideChar=8, lpMultiByteStr=0x1fe394c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="base.xml", lpUsedDefaultChar=0x0) returned 8 [0049.797] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="base.xml", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0049.797] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="base.xml", cchWideChar=8, lpMultiByteStr=0x1fe42ec, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="base.xml", lpUsedDefaultChar=0x0) returned 8 [0049.797] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe42ec, cbMultiByte=8, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="base.xmlse.xmlmllxml.avi\x01") returned 8 [0049.797] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="base.xml", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0049.797] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="base.xml", cchWideChar=8, lpMultiByteStr=0x1fe394c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="base.xml", lpUsedDefaultChar=0x0) returned 8 [0049.797] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0049.798] CharToOemA (in: pSrc="base.xml", pDst=0x1fe42ec | out: pDst="base.xml") returned 1 [0049.798] WriteFile (in: hFile=0x158, lpBuffer=0x1fe42ec*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe42ec*, lpNumberOfBytesWritten=0x18e048*=0x8, lpOverlapped=0x0) returned 1 [0049.798] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0049.798] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0049.799] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0049.799] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=17006210882) returned 1 [0049.799] ReadFile (in: hFile=0x15c, lpBuffer=0x3501250, nNumberOfBytesToRead=0xc4e, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3501250*, lpNumberOfBytesRead=0x18dd7c*=0xc4e, lpOverlapped=0x0) returned 1 [0049.800] SetFilePointer (in: hFile=0x15c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0049.800] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=17006345510) returned 1 [0049.808] WriteFile (in: hFile=0x158, lpBuffer=0x1fea2e8*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fea2e8*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0049.808] ReadFile (in: hFile=0x15c, lpBuffer=0x3501250, nNumberOfBytesToRead=0xc4e, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3501250*, lpNumberOfBytesRead=0x18de38*=0xc4e, lpOverlapped=0x0) returned 1 [0049.808] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x43 [0049.809] WriteFile (in: hFile=0x158, lpBuffer=0x35036b0*, nNumberOfBytesToWrite=0xc4e, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x35036b0*, lpNumberOfBytesWritten=0x18de10*=0xc4e, lpOverlapped=0x0) returned 1 [0049.809] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0xc91 [0049.809] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0049.809] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0049.809] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0049.809] SetFilePointer (in: hFile=0x158, lDistanceToMove=8, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x26 [0049.809] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0xc9b [0049.809] CloseHandle (hObject=0x15c) returned 1 [0049.809] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xc9b [0049.809] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xc9b [0049.809] SetFilePointer (in: hFile=0x158, lDistanceToMove=3227, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xc9b [0049.809] SetFilePointer (in: hFile=0x158, lDistanceToMove=3227, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0xc9b [0049.809] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xc9b [0049.810] SetFilePointer (in: hFile=0x158, lDistanceToMove=3227, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0xc9b [0049.810] SetEndOfFile (hFile=0x158) returned 1 [0049.810] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xc9b [0049.810] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xc9b [0049.810] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="base.xml", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0049.810] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="base.xml", cchWideChar=8, lpMultiByteStr=0x1fe394c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="base.xml", lpUsedDefaultChar=0x0) returned 8 [0049.810] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="base.xml", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0049.810] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="base.xml", cchWideChar=8, lpMultiByteStr=0x1fe368c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="base.xml", lpUsedDefaultChar=0x0) returned 8 [0049.810] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe368c, cbMultiByte=8, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="base.xml ") returned 8 [0049.810] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="base.xml", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0049.810] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="base.xml", cchWideChar=8, lpMultiByteStr=0x1fe394c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="base.xml", lpUsedDefaultChar=0x0) returned 8 [0049.810] WriteFile (in: hFile=0x158, lpBuffer=0x34e4d28*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x34e4d28*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0049.810] CharToOemA (in: pSrc="base.xml", pDst=0x1fe368c | out: pDst="base.xml") returned 1 [0049.810] WriteFile (in: hFile=0x158, lpBuffer=0x1fe368c*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe368c*, lpNumberOfBytesWritten=0x18efcc*=0x8, lpOverlapped=0x0) returned 1 [0049.810] WriteFile (in: hFile=0x158, lpBuffer=0x1fea230*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea230*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0049.810] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0049.811] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0049.811] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xcdc [0049.811] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xcdc [0049.811] WriteFile (in: hFile=0x158, lpBuffer=0x361f648*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x361f648*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0049.811] WriteFile (in: hFile=0x158, lpBuffer=0x35f011c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f011c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0049.811] DeleteFileW (lpFileName="") returned 0 [0049.811] GetLastError () returned 0x3 [0049.811] GetFileAttributesW (lpFileName="") returned 0xffffffff [0049.811] SetLastError (dwErrCode=0x3) [0049.811] FlushFileBuffers (hFile=0x158) returned 1 [0049.813] GetCurrentThreadId () returned 0x970 [0049.813] GetCurrentThreadId () returned 0x970 [0049.813] GetCurrentThreadId () returned 0x970 [0049.813] GetCurrentThreadId () returned 0x970 [0049.813] GetCurrentThreadId () returned 0x970 [0049.813] GetCurrentThreadId () returned 0x970 [0049.813] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xd93 [0049.813] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xd93 [0049.813] SetFilePointer (in: hFile=0x158, lDistanceToMove=3475, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xd93 [0049.813] CloseHandle (hObject=0x158) returned 1 [0049.814] GetCurrentThreadId () returned 0x970 [0049.814] GetCurrentThreadId () returned 0x970 [0049.814] GetCurrentThreadId () returned 0x970 [0049.814] GetCurrentThreadId () returned 0x970 [0049.814] GetCurrentThreadId () returned 0x970 [0049.814] GetCurrentThreadId () returned 0x970 [0049.814] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\Файл зашифрован [base.xml].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\Файл зашифрован [base.xml].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0049.814] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd93 [0049.814] SetFilePointer (in: hFile=0x158, lDistanceToMove=3347, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd13 [0049.814] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0049.814] GetFileType (hFile=0x158) returned 0x1 [0049.814] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x39, wMilliseconds=0x77)) [0049.814] GetCurrentThreadId () returned 0x970 [0049.815] GetCurrentThreadId () returned 0x970 [0049.815] GetCurrentThreadId () returned 0x970 [0049.815] GetCurrentThreadId () returned 0x970 [0049.815] GetCurrentThreadId () returned 0x970 [0049.815] GetCurrentThreadId () returned 0x970 [0049.815] GetCurrentThreadId () returned 0x970 [0049.815] GetCurrentThreadId () returned 0x970 [0049.815] GetCurrentThreadId () returned 0x970 [0049.815] GetCurrentThreadId () returned 0x970 [0049.815] GetCurrentThreadId () returned 0x970 [0049.815] GetCurrentThreadId () returned 0x970 [0049.815] GetCurrentThreadId () returned 0x970 [0049.815] GetCurrentThreadId () returned 0x970 [0049.815] GetCurrentThreadId () returned 0x970 [0049.815] GetCurrentThreadId () returned 0x970 [0049.815] GetCurrentThreadId () returned 0x970 [0049.815] GetCurrentThreadId () returned 0x970 [0049.815] GetCurrentThreadId () returned 0x970 [0049.815] GetCurrentThreadId () returned 0x970 [0049.815] GetCurrentThreadId () returned 0x970 [0049.815] GetCurrentThreadId () returned 0x970 [0049.815] GetCurrentThreadId () returned 0x970 [0049.815] GetCurrentThreadId () returned 0x970 [0049.815] GetCurrentThreadId () returned 0x970 [0049.815] GetCurrentThreadId () returned 0x970 [0049.815] GetCurrentThreadId () returned 0x970 [0049.815] GetCurrentThreadId () returned 0x970 [0049.815] GetCurrentThreadId () returned 0x970 [0049.815] GetCurrentThreadId () returned 0x970 [0049.815] GetCurrentThreadId () returned 0x970 [0049.815] GetCurrentThreadId () returned 0x970 [0049.815] GetCurrentThreadId () returned 0x970 [0049.815] GetCurrentThreadId () returned 0x970 [0049.815] GetCurrentThreadId () returned 0x970 [0049.815] GetCurrentThreadId () returned 0x970 [0049.815] GetCurrentThreadId () returned 0x970 [0049.815] GetCurrentThreadId () returned 0x970 [0049.815] GetCurrentThreadId () returned 0x970 [0049.815] GetCurrentThreadId () returned 0x970 [0049.815] GetCurrentThreadId () returned 0x970 [0049.815] GetCurrentThreadId () returned 0x970 [0049.815] GetCurrentThreadId () returned 0x970 [0049.815] GetCurrentThreadId () returned 0x970 [0049.815] GetCurrentThreadId () returned 0x970 [0049.815] GetCurrentThreadId () returned 0x970 [0049.815] GetCurrentThreadId () returned 0x970 [0049.815] GetCurrentThreadId () returned 0x970 [0049.816] GetCurrentThreadId () returned 0x970 [0049.816] GetCurrentThreadId () returned 0x970 [0049.816] GetCurrentThreadId () returned 0x970 [0049.816] GetCurrentThreadId () returned 0x970 [0049.816] GetCurrentThreadId () returned 0x970 [0049.816] GetCurrentThreadId () returned 0x970 [0049.816] GetCurrentThreadId () returned 0x970 [0049.816] GetCurrentThreadId () returned 0x970 [0049.816] GetCurrentThreadId () returned 0x970 [0049.816] GetCurrentThreadId () returned 0x970 [0049.816] GetCurrentThreadId () returned 0x970 [0049.816] GetCurrentThreadId () returned 0x970 [0049.816] GetCurrentThreadId () returned 0x970 [0049.816] GetCurrentThreadId () returned 0x970 [0049.816] GetCurrentThreadId () returned 0x970 [0049.816] GetCurrentThreadId () returned 0x970 [0049.816] GetCurrentThreadId () returned 0x970 [0049.816] GetCurrentThreadId () returned 0x970 [0049.816] GetCurrentThreadId () returned 0x970 [0049.816] GetCurrentThreadId () returned 0x970 [0049.816] GetCurrentThreadId () returned 0x970 [0049.816] GetCurrentThreadId () returned 0x970 [0049.816] GetCurrentThreadId () returned 0x970 [0049.816] GetCurrentThreadId () returned 0x970 [0049.816] GetCurrentThreadId () returned 0x970 [0049.816] GetCurrentThreadId () returned 0x970 [0049.816] GetCurrentThreadId () returned 0x970 [0049.816] GetCurrentThreadId () returned 0x970 [0049.816] GetCurrentThreadId () returned 0x970 [0049.816] GetCurrentThreadId () returned 0x970 [0049.816] GetCurrentThreadId () returned 0x970 [0049.816] GetCurrentThreadId () returned 0x970 [0049.816] GetCurrentThreadId () returned 0x970 [0049.816] GetCurrentThreadId () returned 0x970 [0049.816] GetCurrentThreadId () returned 0x970 [0049.816] GetCurrentThreadId () returned 0x970 [0049.816] GetCurrentThreadId () returned 0x970 [0049.816] GetCurrentThreadId () returned 0x970 [0049.816] GetCurrentThreadId () returned 0x970 [0049.816] GetCurrentThreadId () returned 0x970 [0049.816] GetCurrentThreadId () returned 0x970 [0049.816] GetCurrentThreadId () returned 0x970 [0049.816] GetCurrentThreadId () returned 0x970 [0049.816] GetCurrentThreadId () returned 0x970 [0049.816] GetCurrentThreadId () returned 0x970 [0049.816] GetCurrentThreadId () returned 0x970 [0049.816] GetCurrentThreadId () returned 0x970 [0049.816] GetCurrentThreadId () returned 0x970 [0049.816] GetCurrentThreadId () returned 0x970 [0049.817] GetCurrentThreadId () returned 0x970 [0049.817] GetCurrentThreadId () returned 0x970 [0049.817] GetCurrentThreadId () returned 0x970 [0049.817] GetCurrentThreadId () returned 0x970 [0049.817] GetCurrentThreadId () returned 0x970 [0049.817] GetCurrentThreadId () returned 0x970 [0049.817] GetCurrentThreadId () returned 0x970 [0049.817] GetCurrentThreadId () returned 0x970 [0049.817] GetCurrentThreadId () returned 0x970 [0049.817] GetCurrentThreadId () returned 0x970 [0049.817] GetCurrentThreadId () returned 0x970 [0049.817] GetCurrentThreadId () returned 0x970 [0049.817] GetCurrentThreadId () returned 0x970 [0049.817] GetCurrentThreadId () returned 0x970 [0049.817] GetCurrentThreadId () returned 0x970 [0049.817] GetCurrentThreadId () returned 0x970 [0049.817] GetCurrentThreadId () returned 0x970 [0049.817] GetCurrentThreadId () returned 0x970 [0049.817] GetCurrentThreadId () returned 0x970 [0049.817] GetCurrentThreadId () returned 0x970 [0049.817] GetCurrentThreadId () returned 0x970 [0049.817] GetCurrentThreadId () returned 0x970 [0049.817] GetCurrentThreadId () returned 0x970 [0049.817] GetCurrentThreadId () returned 0x970 [0049.817] GetCurrentThreadId () returned 0x970 [0049.817] GetCurrentThreadId () returned 0x970 [0049.817] GetCurrentThreadId () returned 0x970 [0049.817] GetCurrentThreadId () returned 0x970 [0049.817] GetCurrentThreadId () returned 0x970 [0049.817] GetCurrentThreadId () returned 0x970 [0049.817] GetCurrentThreadId () returned 0x970 [0049.817] GetCurrentThreadId () returned 0x970 [0049.817] GetCurrentThreadId () returned 0x970 [0049.817] GetCurrentThreadId () returned 0x970 [0049.817] GetCurrentThreadId () returned 0x970 [0049.817] GetCurrentThreadId () returned 0x970 [0049.817] GetCurrentThreadId () returned 0x970 [0049.817] GetCurrentThreadId () returned 0x970 [0049.817] GetCurrentThreadId () returned 0x970 [0049.817] GetCurrentThreadId () returned 0x970 [0049.817] GetCurrentThreadId () returned 0x970 [0049.817] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.817] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.817] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1febc70, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.817] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.818] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.818] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1febc70, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.818] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.818] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.818] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.818] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.818] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.818] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.818] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.818] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.818] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1febcd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.818] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.818] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.818] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1febcd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.818] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.818] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.818] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1febcd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0049.818] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x39, wMilliseconds=0x77)) [0049.818] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ryV=ElrPnR7E6gS++m:OMh,l6,:6LCHq", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0049.818] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ryV=ElrPnR7E6gS++m:OMh,l6,:6LCHq", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0049.818] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ryV=ElrPnR7E6gS++m:OMh,l6,:6LCHq", cchWideChar=32, lpMultiByteStr=0x2000c28, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ryV=ElrPnR7E6gS++m:OMh,l6,:6LCHq", lpUsedDefaultChar=0x0) returned 32 [0049.818] GetCurrentThreadId () returned 0x970 [0049.818] GetCurrentThreadId () returned 0x970 [0049.818] GetCurrentThreadId () returned 0x970 [0049.818] GetCurrentThreadId () returned 0x970 [0049.818] GetCurrentThreadId () returned 0x970 [0049.818] GetCurrentThreadId () returned 0x970 [0049.836] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0049.836] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0049.836] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x202ee18, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0049.836] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x35908f8, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0049.836] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x35908f8, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAEdwA4a1BSJ5DiWpxjBkyYpVGGvILh4SHkU1QL9jsFzWuF5uQr3UyeV/3jMiBIPfDpH5Kzf5G8rku0Qi3GRnhHQGzcTnZNI0iqt9sYW49SNnEII4VkUqIcHEnEEvihs5ffey4q4yzCIoQYiuvmWLD7sjKN6gFOvtnz7VPjvGU8o0AkMSG0y4WEY836JL2Ib/bf5P3trliD8ivNAsZKxmj9YnOYl5v/O9SA==") returned 232 [0049.836] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x27, wSecond=0x39, wMilliseconds=0x87)) [0049.836] GetCurrentThreadId () returned 0x970 [0049.836] GetCurrentThreadId () returned 0x970 [0049.836] GetCurrentThreadId () returned 0x970 [0049.836] GetCurrentThreadId () returned 0x970 [0049.836] GetCurrentThreadId () returned 0x970 [0049.836] GetCurrentThreadId () returned 0x970 [0049.836] GetCurrentThreadId () returned 0x970 [0049.836] GetCurrentThreadId () returned 0x970 [0049.836] GetCurrentThreadId () returned 0x970 [0049.836] GetCurrentThreadId () returned 0x970 [0049.836] GetCurrentThreadId () returned 0x970 [0049.836] GetCurrentThreadId () returned 0x970 [0049.836] GetCurrentThreadId () returned 0x970 [0049.836] GetCurrentThreadId () returned 0x970 [0049.836] GetCurrentThreadId () returned 0x970 [0049.836] GetCurrentThreadId () returned 0x970 [0049.836] GetCurrentThreadId () returned 0x970 [0049.836] GetCurrentThreadId () returned 0x970 [0049.837] GetCurrentThreadId () returned 0x970 [0049.837] GetCurrentThreadId () returned 0x970 [0049.837] GetCurrentThreadId () returned 0x970 [0049.837] GetCurrentThreadId () returned 0x970 [0049.837] GetCurrentThreadId () returned 0x970 [0049.837] GetCurrentThreadId () returned 0x970 [0049.837] GetCurrentThreadId () returned 0x970 [0049.837] GetCurrentThreadId () returned 0x970 [0049.837] GetCurrentThreadId () returned 0x970 [0049.837] GetCurrentThreadId () returned 0x970 [0049.837] GetCurrentThreadId () returned 0x970 [0049.837] GetCurrentThreadId () returned 0x970 [0049.837] GetCurrentThreadId () returned 0x970 [0049.837] GetCurrentThreadId () returned 0x970 [0049.837] GetCurrentThreadId () returned 0x970 [0049.837] GetCurrentThreadId () returned 0x970 [0049.837] GetCurrentThreadId () returned 0x970 [0049.837] GetCurrentThreadId () returned 0x970 [0049.837] GetCurrentThreadId () returned 0x970 [0049.837] GetCurrentThreadId () returned 0x970 [0049.837] GetCurrentThreadId () returned 0x970 [0049.837] GetCurrentThreadId () returned 0x970 [0049.837] GetCurrentThreadId () returned 0x970 [0049.837] GetCurrentThreadId () returned 0x970 [0049.837] GetCurrentThreadId () returned 0x970 [0049.837] GetCurrentThreadId () returned 0x970 [0049.837] GetCurrentThreadId () returned 0x970 [0049.837] GetCurrentThreadId () returned 0x970 [0049.837] GetCurrentThreadId () returned 0x970 [0049.837] GetCurrentThreadId () returned 0x970 [0049.837] GetCurrentThreadId () returned 0x970 [0049.837] GetCurrentThreadId () returned 0x970 [0049.837] GetCurrentThreadId () returned 0x970 [0049.837] GetCurrentThreadId () returned 0x970 [0049.837] GetCurrentThreadId () returned 0x970 [0049.837] GetCurrentThreadId () returned 0x970 [0049.837] GetCurrentThreadId () returned 0x970 [0049.837] GetCurrentThreadId () returned 0x970 [0049.837] GetCurrentThreadId () returned 0x970 [0049.837] GetCurrentThreadId () returned 0x970 [0049.837] GetCurrentThreadId () returned 0x970 [0049.837] GetCurrentThreadId () returned 0x970 [0049.837] GetCurrentThreadId () returned 0x970 [0049.837] GetCurrentThreadId () returned 0x970 [0049.837] GetCurrentThreadId () returned 0x970 [0049.837] GetCurrentThreadId () returned 0x970 [0049.837] GetCurrentThreadId () returned 0x970 [0049.837] GetCurrentThreadId () returned 0x970 [0049.838] GetCurrentThreadId () returned 0x970 [0049.838] GetCurrentThreadId () returned 0x970 [0049.838] GetCurrentThreadId () returned 0x970 [0049.838] GetCurrentThreadId () returned 0x970 [0049.838] GetCurrentThreadId () returned 0x970 [0049.838] GetCurrentThreadId () returned 0x970 [0049.838] GetCurrentThreadId () returned 0x970 [0049.838] GetCurrentThreadId () returned 0x970 [0049.838] GetCurrentThreadId () returned 0x970 [0049.838] GetCurrentThreadId () returned 0x970 [0049.838] GetCurrentThreadId () returned 0x970 [0049.838] GetCurrentThreadId () returned 0x970 [0049.838] GetCurrentThreadId () returned 0x970 [0049.838] GetCurrentThreadId () returned 0x970 [0049.838] GetCurrentThreadId () returned 0x970 [0049.838] GetCurrentThreadId () returned 0x970 [0049.838] GetCurrentThreadId () returned 0x970 [0049.838] GetCurrentThreadId () returned 0x970 [0049.838] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAEdwA4a1BSJ5DiWpxjBkyYpVGGvILh4SHkU1QL9jsFzWuF5uQr3UyeV/3jMiBIPfDpH5Kzf5G8rku0Qi3GRnhHQGzcTnZNI0iqt9sYW49SNnEII4VkUqIcHEnEEvihs5ffey4q4yzCIoQYiuvmWLD7sjKN6gFOvtnz7VPjvGU8o0AkMSG0y4WEY836JL2Ib/bf5P3trliD8ivNAsZKxmj9YnOYl5v/O9SA==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0049.838] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAEdwA4a1BSJ5DiWpxjBkyYpVGGvILh4SHkU1QL9jsFzWuF5uQr3UyeV/3jMiBIPfDpH5Kzf5G8rku0Qi3GRnhHQGzcTnZNI0iqt9sYW49SNnEII4VkUqIcHEnEEvihs5ffey4q4yzCIoQYiuvmWLD7sjKN6gFOvtnz7VPjvGU8o0AkMSG0y4WEY836JL2Ib/bf5P3trliD8ivNAsZKxmj9YnOYl5v/O9SA==", cchWideChar=245, lpMultiByteStr=0x353900c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAEdwA4a1BSJ5DiWpxjBkyYpVGGvILh4SHkU1QL9jsFzWuF5uQr3UyeV/3jMiBIPfDpH5Kzf5G8rku0Qi3GRnhHQGzcTnZNI0iqt9sYW49SNnEII4VkUqIcHEnEEvihs5ffey4q4yzCIoQYiuvmWLD7sjKN6gFOvtnz7VPjvGU8o0AkMSG0y4WEY836JL2Ib/bf5P3trliD8ivNAsZKxmj9YnOYl5v/O9SA==", lpUsedDefaultChar=0x0) returned 245 [0049.838] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0049.838] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0049.838] CloseHandle (hObject=0x158) returned 1 [0049.839] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml")) returned 0 [0049.839] GetLastError () returned 0x5 [0049.839] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml")) returned 0x20 [0049.839] SetLastError (dwErrCode=0x5) [0049.839] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=17010248865) returned 1 [0049.839] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\Файл зашифрован [baseAltGr_rtl.xml].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\Файл зашифрован [basealtgr_rtl.xml].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0049.839] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0049.839] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0049.839] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0049.840] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0049.840] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0049.840] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0049.840] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0049.840] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0049.840] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0049.840] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0049.840] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0049.840] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0049.840] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0049.840] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0049.840] SetEndOfFile (hFile=0x158) returned 1 [0049.840] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0049.840] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0049.840] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0049.840] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0049.841] WriteFile (in: hFile=0x158, lpBuffer=0x361f6e8*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x361f6e8*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0049.841] WriteFile (in: hFile=0x158, lpBuffer=0x35eff9c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35eff9c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0049.841] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="&qhvR{\\\\r.PMW&nDX!GH4nmiON%B(J\"^0$v?D2qqGKx2r{", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0054.887] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M(kqw/?p\"6Wzw\"i>\"^0$v?D2qqGKx2r{", cchWideChar=32, lpMultiByteStr=0x2033a1c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M(kqw/?p\"6Wzw\"i>\"^0$v?D2qqGKx2r{", lpUsedDefaultChar=0x0) returned 32 [0054.887] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0054.887] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0054.887] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d546fc, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d546fc, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsptb.xml", cAlternateFileName="")) returned 0x295098 [0054.887] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0054.887] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0054.887] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml")) returned 0x20 [0054.887] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml")) returned 0x20 [0054.887] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml")) returned 0x20 [0054.887] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml")) returned 0x20 [0054.887] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d546fc, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d546fc, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8c6)) returned 1 [0054.887] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0054.888] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0054.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml")) returned 0x20 [0054.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml")) returned 0x20 [0054.888] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0054.888] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0054.888] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0054.888] SetEndOfFile (hFile=0x158) returned 1 [0054.889] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsptb.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0054.889] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsptb.xml", cchWideChar=10, lpMultiByteStr=0x1fe430c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipsptb.xml", lpUsedDefaultChar=0x0) returned 10 [0054.889] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsptb.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0054.889] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsptb.xml", cchWideChar=10, lpMultiByteStr=0x1fe3a8c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipsptb.xml", lpUsedDefaultChar=0x0) returned 10 [0054.889] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe3a8c, cbMultiByte=10, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="ipsptb.xmlatattmli\x01") returned 10 [0054.889] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsptb.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0054.889] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsptb.xml", cchWideChar=10, lpMultiByteStr=0x1fe430c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipsptb.xml", lpUsedDefaultChar=0x0) returned 10 [0054.889] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0054.889] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0054.889] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x8c6 [0054.889] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0054.889] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0054.889] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0054.889] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsptb.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0054.889] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsptb.xml", cchWideChar=10, lpMultiByteStr=0x1fe430c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipsptb.xml", lpUsedDefaultChar=0x0) returned 10 [0054.889] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsptb.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0054.889] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsptb.xml", cchWideChar=10, lpMultiByteStr=0x1fe3a8c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipsptb.xml", lpUsedDefaultChar=0x0) returned 10 [0054.890] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe3a8c, cbMultiByte=10, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="ipsptb.xmltb.xmlatattmli\x01") returned 10 [0054.890] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsptb.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0054.890] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsptb.xml", cchWideChar=10, lpMultiByteStr=0x1fe430c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipsptb.xml", lpUsedDefaultChar=0x0) returned 10 [0054.890] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0054.890] CharToOemA (in: pSrc="ipsptb.xml", pDst=0x1fe3a8c | out: pDst="ipsptb.xml") returned 1 [0054.890] WriteFile (in: hFile=0x158, lpBuffer=0x1fe3a8c*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe3a8c*, lpNumberOfBytesWritten=0x18e048*=0xa, lpOverlapped=0x0) returned 1 [0054.891] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0054.891] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0054.891] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0054.891] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=17515426002) returned 1 [0054.891] ReadFile (in: hFile=0x11c, lpBuffer=0x34fa5d0, nNumberOfBytesToRead=0x8c6, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x34fa5d0*, lpNumberOfBytesRead=0x18dd7c*=0x8c6, lpOverlapped=0x0) returned 1 [0054.892] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0054.892] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=17515563057) returned 1 [0054.901] WriteFile (in: hFile=0x158, lpBuffer=0x1fea228*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fea228*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0054.901] ReadFile (in: hFile=0x11c, lpBuffer=0x34fa5d0, nNumberOfBytesToRead=0x8c6, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x34fa5d0*, lpNumberOfBytesRead=0x18de38*=0x8c6, lpOverlapped=0x0) returned 1 [0054.901] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x45 [0054.901] WriteFile (in: hFile=0x158, lpBuffer=0x34faf20*, nNumberOfBytesToWrite=0x8c6, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x34faf20*, lpNumberOfBytesWritten=0x18de10*=0x8c6, lpOverlapped=0x0) returned 1 [0054.901] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x90b [0054.901] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0054.901] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0054.901] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0054.901] SetFilePointer (in: hFile=0x158, lDistanceToMove=10, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x28 [0054.901] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x915 [0054.901] CloseHandle (hObject=0x11c) returned 1 [0054.902] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x915 [0054.902] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x915 [0054.902] SetFilePointer (in: hFile=0x158, lDistanceToMove=2325, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x915 [0054.902] SetFilePointer (in: hFile=0x158, lDistanceToMove=2325, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x915 [0054.902] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x915 [0054.902] SetFilePointer (in: hFile=0x158, lDistanceToMove=2325, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x915 [0054.902] SetEndOfFile (hFile=0x158) returned 1 [0054.902] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x915 [0054.902] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x915 [0054.902] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsptb.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0054.902] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsptb.xml", cchWideChar=10, lpMultiByteStr=0x1fe430c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipsptb.xml", lpUsedDefaultChar=0x0) returned 10 [0054.902] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsptb.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0054.902] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsptb.xml", cchWideChar=10, lpMultiByteStr=0x1fe3bac, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipsptb.xml", lpUsedDefaultChar=0x0) returned 10 [0054.902] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe3bac, cbMultiByte=10, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="ipsptb.xml\x18ꞗ@涤(\x18믉`믑`") returned 10 [0054.902] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsptb.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0054.902] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsptb.xml", cchWideChar=10, lpMultiByteStr=0x1fe430c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipsptb.xml", lpUsedDefaultChar=0x0) returned 10 [0054.902] WriteFile (in: hFile=0x158, lpBuffer=0x376fb28*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x376fb28*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0054.903] CharToOemA (in: pSrc="ipsptb.xml", pDst=0x1fe3bac | out: pDst="ipsptb.xml") returned 1 [0054.903] WriteFile (in: hFile=0x158, lpBuffer=0x1fe3bac*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe3bac*, lpNumberOfBytesWritten=0x18efcc*=0xa, lpOverlapped=0x0) returned 1 [0054.903] WriteFile (in: hFile=0x158, lpBuffer=0x1fea110*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea110*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0054.903] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0054.903] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0054.903] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x958 [0054.903] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x958 [0054.903] WriteFile (in: hFile=0x158, lpBuffer=0x361ff08*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x361ff08*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0054.903] WriteFile (in: hFile=0x158, lpBuffer=0x35f005c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f005c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0054.903] DeleteFileW (lpFileName="") returned 0 [0054.903] GetLastError () returned 0x3 [0054.903] GetFileAttributesW (lpFileName="") returned 0xffffffff [0054.903] SetLastError (dwErrCode=0x3) [0054.903] FlushFileBuffers (hFile=0x158) returned 1 [0054.906] GetCurrentThreadId () returned 0x970 [0054.906] GetCurrentThreadId () returned 0x970 [0054.906] GetCurrentThreadId () returned 0x970 [0054.906] GetCurrentThreadId () returned 0x970 [0054.906] GetCurrentThreadId () returned 0x970 [0054.906] GetCurrentThreadId () returned 0x970 [0054.906] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xa0f [0054.906] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xa0f [0054.906] SetFilePointer (in: hFile=0x158, lDistanceToMove=2575, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xa0f [0054.906] CloseHandle (hObject=0x158) returned 1 [0054.907] GetCurrentThreadId () returned 0x970 [0054.907] GetCurrentThreadId () returned 0x970 [0054.907] GetCurrentThreadId () returned 0x970 [0054.907] GetCurrentThreadId () returned 0x970 [0054.907] GetCurrentThreadId () returned 0x970 [0054.907] GetCurrentThreadId () returned 0x970 [0054.907] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Файл зашифрован [ipsptb.xml].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\Файл зашифрован [ipsptb.xml].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0054.907] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa0f [0054.907] SetFilePointer (in: hFile=0x158, lDistanceToMove=2447, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x98f [0054.907] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0054.907] GetFileType (hFile=0x158) returned 0x1 [0054.907] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2, wMilliseconds=0xbd)) [0054.907] GetCurrentThreadId () returned 0x970 [0054.908] GetCurrentThreadId () returned 0x970 [0054.908] GetCurrentThreadId () returned 0x970 [0054.908] GetCurrentThreadId () returned 0x970 [0054.908] GetCurrentThreadId () returned 0x970 [0054.908] GetCurrentThreadId () returned 0x970 [0054.908] GetCurrentThreadId () returned 0x970 [0054.908] GetCurrentThreadId () returned 0x970 [0054.908] GetCurrentThreadId () returned 0x970 [0054.908] GetCurrentThreadId () returned 0x970 [0054.908] GetCurrentThreadId () returned 0x970 [0054.908] GetCurrentThreadId () returned 0x970 [0054.908] GetCurrentThreadId () returned 0x970 [0054.908] GetCurrentThreadId () returned 0x970 [0054.908] GetCurrentThreadId () returned 0x970 [0054.908] GetCurrentThreadId () returned 0x970 [0054.908] GetCurrentThreadId () returned 0x970 [0054.908] GetCurrentThreadId () returned 0x970 [0054.908] GetCurrentThreadId () returned 0x970 [0054.908] GetCurrentThreadId () returned 0x970 [0054.908] GetCurrentThreadId () returned 0x970 [0054.908] GetCurrentThreadId () returned 0x970 [0054.908] GetCurrentThreadId () returned 0x970 [0054.908] GetCurrentThreadId () returned 0x970 [0054.908] GetCurrentThreadId () returned 0x970 [0054.908] GetCurrentThreadId () returned 0x970 [0054.908] GetCurrentThreadId () returned 0x970 [0054.908] GetCurrentThreadId () returned 0x970 [0054.908] GetCurrentThreadId () returned 0x970 [0054.908] GetCurrentThreadId () returned 0x970 [0054.908] GetCurrentThreadId () returned 0x970 [0054.908] GetCurrentThreadId () returned 0x970 [0054.908] GetCurrentThreadId () returned 0x970 [0054.908] GetCurrentThreadId () returned 0x970 [0054.908] GetCurrentThreadId () returned 0x970 [0054.908] GetCurrentThreadId () returned 0x970 [0054.908] GetCurrentThreadId () returned 0x970 [0054.908] GetCurrentThreadId () returned 0x970 [0054.908] GetCurrentThreadId () returned 0x970 [0054.908] GetCurrentThreadId () returned 0x970 [0054.908] GetCurrentThreadId () returned 0x970 [0054.908] GetCurrentThreadId () returned 0x970 [0054.908] GetCurrentThreadId () returned 0x970 [0054.908] GetCurrentThreadId () returned 0x970 [0054.908] GetCurrentThreadId () returned 0x970 [0054.908] GetCurrentThreadId () returned 0x970 [0054.908] GetCurrentThreadId () returned 0x970 [0054.909] GetCurrentThreadId () returned 0x970 [0054.909] GetCurrentThreadId () returned 0x970 [0054.909] GetCurrentThreadId () returned 0x970 [0054.909] GetCurrentThreadId () returned 0x970 [0054.909] GetCurrentThreadId () returned 0x970 [0054.909] GetCurrentThreadId () returned 0x970 [0054.909] GetCurrentThreadId () returned 0x970 [0054.909] GetCurrentThreadId () returned 0x970 [0054.909] GetCurrentThreadId () returned 0x970 [0054.909] GetCurrentThreadId () returned 0x970 [0054.909] GetCurrentThreadId () returned 0x970 [0054.909] GetCurrentThreadId () returned 0x970 [0054.909] GetCurrentThreadId () returned 0x970 [0054.909] GetCurrentThreadId () returned 0x970 [0054.909] GetCurrentThreadId () returned 0x970 [0054.909] GetCurrentThreadId () returned 0x970 [0054.909] GetCurrentThreadId () returned 0x970 [0054.909] GetCurrentThreadId () returned 0x970 [0054.909] GetCurrentThreadId () returned 0x970 [0054.909] GetCurrentThreadId () returned 0x970 [0054.909] GetCurrentThreadId () returned 0x970 [0054.909] GetCurrentThreadId () returned 0x970 [0054.909] GetCurrentThreadId () returned 0x970 [0054.909] GetCurrentThreadId () returned 0x970 [0054.909] GetCurrentThreadId () returned 0x970 [0054.909] GetCurrentThreadId () returned 0x970 [0054.909] GetCurrentThreadId () returned 0x970 [0054.909] GetCurrentThreadId () returned 0x970 [0054.909] GetCurrentThreadId () returned 0x970 [0054.909] GetCurrentThreadId () returned 0x970 [0054.909] GetCurrentThreadId () returned 0x970 [0054.909] GetCurrentThreadId () returned 0x970 [0054.909] GetCurrentThreadId () returned 0x970 [0054.909] GetCurrentThreadId () returned 0x970 [0054.909] GetCurrentThreadId () returned 0x970 [0054.909] GetCurrentThreadId () returned 0x970 [0054.909] GetCurrentThreadId () returned 0x970 [0054.909] GetCurrentThreadId () returned 0x970 [0054.909] GetCurrentThreadId () returned 0x970 [0054.909] GetCurrentThreadId () returned 0x970 [0054.909] GetCurrentThreadId () returned 0x970 [0054.909] GetCurrentThreadId () returned 0x970 [0054.909] GetCurrentThreadId () returned 0x970 [0054.909] GetCurrentThreadId () returned 0x970 [0054.909] GetCurrentThreadId () returned 0x970 [0054.909] GetCurrentThreadId () returned 0x970 [0054.910] GetCurrentThreadId () returned 0x970 [0054.910] GetCurrentThreadId () returned 0x970 [0054.910] GetCurrentThreadId () returned 0x970 [0054.910] GetCurrentThreadId () returned 0x970 [0054.910] GetCurrentThreadId () returned 0x970 [0054.910] GetCurrentThreadId () returned 0x970 [0054.910] GetCurrentThreadId () returned 0x970 [0054.910] GetCurrentThreadId () returned 0x970 [0054.910] GetCurrentThreadId () returned 0x970 [0054.910] GetCurrentThreadId () returned 0x970 [0054.910] GetCurrentThreadId () returned 0x970 [0054.910] GetCurrentThreadId () returned 0x970 [0054.910] GetCurrentThreadId () returned 0x970 [0054.910] GetCurrentThreadId () returned 0x970 [0054.910] GetCurrentThreadId () returned 0x970 [0054.910] GetCurrentThreadId () returned 0x970 [0054.910] GetCurrentThreadId () returned 0x970 [0054.910] GetCurrentThreadId () returned 0x970 [0054.910] GetCurrentThreadId () returned 0x970 [0054.910] GetCurrentThreadId () returned 0x970 [0054.910] GetCurrentThreadId () returned 0x970 [0054.910] GetCurrentThreadId () returned 0x970 [0054.910] GetCurrentThreadId () returned 0x970 [0054.910] GetCurrentThreadId () returned 0x970 [0054.910] GetCurrentThreadId () returned 0x970 [0054.910] GetCurrentThreadId () returned 0x970 [0054.910] GetCurrentThreadId () returned 0x970 [0054.910] GetCurrentThreadId () returned 0x970 [0054.910] GetCurrentThreadId () returned 0x970 [0054.910] GetCurrentThreadId () returned 0x970 [0054.910] GetCurrentThreadId () returned 0x970 [0054.910] GetCurrentThreadId () returned 0x970 [0054.910] GetCurrentThreadId () returned 0x970 [0054.910] GetCurrentThreadId () returned 0x970 [0054.910] GetCurrentThreadId () returned 0x970 [0054.910] GetCurrentThreadId () returned 0x970 [0054.910] GetCurrentThreadId () returned 0x970 [0054.910] GetCurrentThreadId () returned 0x970 [0054.910] GetCurrentThreadId () returned 0x970 [0054.910] GetCurrentThreadId () returned 0x970 [0054.910] GetCurrentThreadId () returned 0x970 [0054.910] GetCurrentThreadId () returned 0x970 [0054.910] GetCurrentThreadId () returned 0x970 [0054.910] GetCurrentThreadId () returned 0x970 [0054.911] GetCurrentThreadId () returned 0x970 [0054.911] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0054.911] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0054.911] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fed050, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0054.911] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0054.911] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0054.911] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fed050, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0054.911] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0054.911] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0054.911] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0054.911] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0054.911] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0054.911] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0054.911] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0054.911] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0054.911] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fed0b0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0054.911] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0054.911] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0054.911] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fed0b0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0054.911] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0054.911] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0054.911] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fed0b0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0054.911] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2, wMilliseconds=0xcd)) [0054.911] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="M(kqw/?p\"6Wzw\"i>\"^0$v?D2qqGKx2r{", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0054.911] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="M(kqw/?p\"6Wzw\"i>\"^0$v?D2qqGKx2r{", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0054.911] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="M(kqw/?p\"6Wzw\"i>\"^0$v?D2qqGKx2r{", cchWideChar=32, lpMultiByteStr=0x2001618, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M(kqw/?p\"6Wzw\"i>\"^0$v?D2qqGKx2r{", lpUsedDefaultChar=0x0) returned 32 [0054.911] GetCurrentThreadId () returned 0x970 [0054.911] GetCurrentThreadId () returned 0x970 [0054.911] GetCurrentThreadId () returned 0x970 [0054.911] GetCurrentThreadId () returned 0x970 [0054.911] GetCurrentThreadId () returned 0x970 [0054.911] GetCurrentThreadId () returned 0x970 [0054.919] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0054.919] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0054.919] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x34f28b8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0054.919] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0054.919] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAEX9nnHHYh4VYew1jLh7gIp1b7Ih7Nf+GUyzItzAprFZBkiMh94BvZqctqPY18exdos7iAXpF1M2FLhDAdNl02cisHR981TTlkNX7HFbiaG4hi6lXlDSIKw5yypo0X3GN3DXKevlZZJMKUXM5RBvPspfVN+s9LyU6hQ0aBQXW0TxXDa2heQWsn/vw0vIXw+9peu3Zzxrgvbqt49W/xbIl5tE4w/xAjw9Mg==") returned 232 [0054.919] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2, wMilliseconds=0xcd)) [0054.919] GetCurrentThreadId () returned 0x970 [0054.919] GetCurrentThreadId () returned 0x970 [0054.919] GetCurrentThreadId () returned 0x970 [0054.919] GetCurrentThreadId () returned 0x970 [0054.919] GetCurrentThreadId () returned 0x970 [0054.919] GetCurrentThreadId () returned 0x970 [0054.919] GetCurrentThreadId () returned 0x970 [0054.919] GetCurrentThreadId () returned 0x970 [0054.919] GetCurrentThreadId () returned 0x970 [0054.919] GetCurrentThreadId () returned 0x970 [0054.919] GetCurrentThreadId () returned 0x970 [0054.919] GetCurrentThreadId () returned 0x970 [0054.919] GetCurrentThreadId () returned 0x970 [0054.919] GetCurrentThreadId () returned 0x970 [0054.919] GetCurrentThreadId () returned 0x970 [0054.919] GetCurrentThreadId () returned 0x970 [0054.919] GetCurrentThreadId () returned 0x970 [0054.919] GetCurrentThreadId () returned 0x970 [0054.919] GetCurrentThreadId () returned 0x970 [0054.919] GetCurrentThreadId () returned 0x970 [0054.919] GetCurrentThreadId () returned 0x970 [0054.919] GetCurrentThreadId () returned 0x970 [0054.919] GetCurrentThreadId () returned 0x970 [0054.919] GetCurrentThreadId () returned 0x970 [0054.919] GetCurrentThreadId () returned 0x970 [0054.919] GetCurrentThreadId () returned 0x970 [0054.919] GetCurrentThreadId () returned 0x970 [0054.919] GetCurrentThreadId () returned 0x970 [0054.919] GetCurrentThreadId () returned 0x970 [0054.919] GetCurrentThreadId () returned 0x970 [0054.919] GetCurrentThreadId () returned 0x970 [0054.919] GetCurrentThreadId () returned 0x970 [0054.919] GetCurrentThreadId () returned 0x970 [0054.919] GetCurrentThreadId () returned 0x970 [0054.919] GetCurrentThreadId () returned 0x970 [0054.919] GetCurrentThreadId () returned 0x970 [0054.919] GetCurrentThreadId () returned 0x970 [0054.920] GetCurrentThreadId () returned 0x970 [0054.920] GetCurrentThreadId () returned 0x970 [0054.920] GetCurrentThreadId () returned 0x970 [0054.920] GetCurrentThreadId () returned 0x970 [0054.920] GetCurrentThreadId () returned 0x970 [0054.920] GetCurrentThreadId () returned 0x970 [0054.920] GetCurrentThreadId () returned 0x970 [0054.920] GetCurrentThreadId () returned 0x970 [0054.920] GetCurrentThreadId () returned 0x970 [0054.920] GetCurrentThreadId () returned 0x970 [0054.920] GetCurrentThreadId () returned 0x970 [0054.920] GetCurrentThreadId () returned 0x970 [0054.920] GetCurrentThreadId () returned 0x970 [0054.920] GetCurrentThreadId () returned 0x970 [0054.920] GetCurrentThreadId () returned 0x970 [0054.920] GetCurrentThreadId () returned 0x970 [0054.920] GetCurrentThreadId () returned 0x970 [0054.920] GetCurrentThreadId () returned 0x970 [0054.920] GetCurrentThreadId () returned 0x970 [0054.920] GetCurrentThreadId () returned 0x970 [0054.920] GetCurrentThreadId () returned 0x970 [0054.920] GetCurrentThreadId () returned 0x970 [0054.920] GetCurrentThreadId () returned 0x970 [0054.920] GetCurrentThreadId () returned 0x970 [0054.920] GetCurrentThreadId () returned 0x970 [0054.920] GetCurrentThreadId () returned 0x970 [0054.920] GetCurrentThreadId () returned 0x970 [0054.920] GetCurrentThreadId () returned 0x970 [0054.920] GetCurrentThreadId () returned 0x970 [0054.920] GetCurrentThreadId () returned 0x970 [0054.920] GetCurrentThreadId () returned 0x970 [0054.920] GetCurrentThreadId () returned 0x970 [0054.920] GetCurrentThreadId () returned 0x970 [0054.920] GetCurrentThreadId () returned 0x970 [0054.920] GetCurrentThreadId () returned 0x970 [0054.920] GetCurrentThreadId () returned 0x970 [0054.920] GetCurrentThreadId () returned 0x970 [0054.920] GetCurrentThreadId () returned 0x970 [0054.920] GetCurrentThreadId () returned 0x970 [0054.920] GetCurrentThreadId () returned 0x970 [0054.920] GetCurrentThreadId () returned 0x970 [0054.920] GetCurrentThreadId () returned 0x970 [0054.920] GetCurrentThreadId () returned 0x970 [0054.920] GetCurrentThreadId () returned 0x970 [0054.920] GetCurrentThreadId () returned 0x970 [0054.920] GetCurrentThreadId () returned 0x970 [0054.921] GetCurrentThreadId () returned 0x970 [0054.921] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAEX9nnHHYh4VYew1jLh7gIp1b7Ih7Nf+GUyzItzAprFZBkiMh94BvZqctqPY18exdos7iAXpF1M2FLhDAdNl02cisHR981TTlkNX7HFbiaG4hi6lXlDSIKw5yypo0X3GN3DXKevlZZJMKUXM5RBvPspfVN+s9LyU6hQ0aBQXW0TxXDa2heQWsn/vw0vIXw+9peu3Zzxrgvbqt49W/xbIl5tE4w/xAjw9Mg==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0054.921] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAEX9nnHHYh4VYew1jLh7gIp1b7Ih7Nf+GUyzItzAprFZBkiMh94BvZqctqPY18exdos7iAXpF1M2FLhDAdNl02cisHR981TTlkNX7HFbiaG4hi6lXlDSIKw5yypo0X3GN3DXKevlZZJMKUXM5RBvPspfVN+s9LyU6hQ0aBQXW0TxXDa2heQWsn/vw0vIXw+9peu3Zzxrgvbqt49W/xbIl5tE4w/xAjw9Mg==", cchWideChar=245, lpMultiByteStr=0x353933c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAEX9nnHHYh4VYew1jLh7gIp1b7Ih7Nf+GUyzItzAprFZBkiMh94BvZqctqPY18exdos7iAXpF1M2FLhDAdNl02cisHR981TTlkNX7HFbiaG4hi6lXlDSIKw5yypo0X3GN3DXKevlZZJMKUXM5RBvPspfVN+s9LyU6hQ0aBQXW0TxXDa2heQWsn/vw0vIXw+9peu3Zzxrgvbqt49W/xbIl5tE4w/xAjw9Mg==", lpUsedDefaultChar=0x0) returned 245 [0054.921] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0054.921] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0054.921] CloseHandle (hObject=0x158) returned 1 [0054.922] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml")) returned 0 [0054.922] GetLastError () returned 0x5 [0054.922] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml")) returned 0x20 [0054.922] SetLastError (dwErrCode=0x5) [0054.922] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=17518544634) returned 1 [0054.922] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Файл зашифрован [ipsptg.xml].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\Файл зашифрован [ipsptg.xml].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0054.923] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0054.923] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0054.923] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0054.923] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0054.923] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0054.923] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0054.923] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0054.923] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0054.923] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0054.924] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0054.924] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0054.924] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0054.924] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0054.924] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0054.924] SetEndOfFile (hFile=0x158) returned 1 [0054.924] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0054.924] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0054.924] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0054.924] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0054.924] WriteFile (in: hFile=0x158, lpBuffer=0x361ff08*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x361ff08*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0054.925] WriteFile (in: hFile=0x158, lpBuffer=0x35eff9c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35eff9c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0054.925] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="\\e799&k.7)p{0Vw0zV,.Wpk<1I\"qy*Hn", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0054.925] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="\\e799&k.7)p{0Vw0zV,.Wpk<1I\"qy*Hn", cchWideChar=32, lpMultiByteStr=0x2033a54, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\\e799&k.7)p{0Vw0zV,.Wpk<1I\"qy*Hn", lpUsedDefaultChar=0x0) returned 32 [0054.925] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0054.925] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0054.925] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d7a859, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d7a859, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsptg.xml", cAlternateFileName="")) returned 0x295098 [0054.925] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0054.925] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0054.925] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml")) returned 0x20 [0054.926] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml")) returned 0x20 [0054.926] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml")) returned 0x20 [0054.926] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml")) returned 0x20 [0054.926] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d7a859, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d7a859, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8c0)) returned 1 [0054.926] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0054.926] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0054.926] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml")) returned 0x20 [0054.926] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml")) returned 0x20 [0054.926] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0054.926] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0054.926] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0054.926] SetEndOfFile (hFile=0x158) returned 1 [0054.927] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsptg.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0054.927] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsptg.xml", cchWideChar=10, lpMultiByteStr=0x1fe3c4c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipsptg.xml", lpUsedDefaultChar=0x0) returned 10 [0054.927] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsptg.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0054.927] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsptg.xml", cchWideChar=10, lpMultiByteStr=0x1fe428c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipsptg.xml", lpUsedDefaultChar=0x0) returned 10 [0054.927] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe428c, cbMultiByte=10, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="ipsptg.xmlatattmli\x01") returned 10 [0054.927] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsptg.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0054.927] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsptg.xml", cchWideChar=10, lpMultiByteStr=0x1fe3c4c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipsptg.xml", lpUsedDefaultChar=0x0) returned 10 [0054.927] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0054.927] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0054.927] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x8c0 [0054.928] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0054.928] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0054.928] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0054.928] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsptg.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0054.928] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsptg.xml", cchWideChar=10, lpMultiByteStr=0x1fe3c4c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipsptg.xml", lpUsedDefaultChar=0x0) returned 10 [0054.928] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsptg.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0054.928] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsptg.xml", cchWideChar=10, lpMultiByteStr=0x1fe428c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipsptg.xml", lpUsedDefaultChar=0x0) returned 10 [0054.928] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe428c, cbMultiByte=10, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="ipsptg.xmltg.xmlatattmli\x01") returned 10 [0054.928] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsptg.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0054.928] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsptg.xml", cchWideChar=10, lpMultiByteStr=0x1fe3c4c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipsptg.xml", lpUsedDefaultChar=0x0) returned 10 [0054.928] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0054.929] CharToOemA (in: pSrc="ipsptg.xml", pDst=0x1fe428c | out: pDst="ipsptg.xml") returned 1 [0054.929] WriteFile (in: hFile=0x158, lpBuffer=0x1fe428c*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe428c*, lpNumberOfBytesWritten=0x18e048*=0xa, lpOverlapped=0x0) returned 1 [0054.929] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0054.929] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0054.929] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0054.929] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=17519265452) returned 1 [0054.929] ReadFile (in: hFile=0x11c, lpBuffer=0x34fa5d0, nNumberOfBytesToRead=0x8c0, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x34fa5d0*, lpNumberOfBytesRead=0x18dd7c*=0x8c0, lpOverlapped=0x0) returned 1 [0054.931] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0054.931] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=17519403082) returned 1 [0054.939] WriteFile (in: hFile=0x158, lpBuffer=0x1fea2a0*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fea2a0*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0054.939] ReadFile (in: hFile=0x11c, lpBuffer=0x34fa5d0, nNumberOfBytesToRead=0x8c0, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x34fa5d0*, lpNumberOfBytesRead=0x18de38*=0x8c0, lpOverlapped=0x0) returned 1 [0054.939] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x45 [0054.939] WriteFile (in: hFile=0x158, lpBuffer=0x34faf20*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x34faf20*, lpNumberOfBytesWritten=0x18de10*=0x8c0, lpOverlapped=0x0) returned 1 [0054.939] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x905 [0054.939] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0054.939] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0054.940] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0054.940] SetFilePointer (in: hFile=0x158, lDistanceToMove=10, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x28 [0054.940] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x90f [0054.940] CloseHandle (hObject=0x11c) returned 1 [0054.940] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x90f [0054.940] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x90f [0054.940] SetFilePointer (in: hFile=0x158, lDistanceToMove=2319, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x90f [0054.940] SetFilePointer (in: hFile=0x158, lDistanceToMove=2319, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x90f [0054.940] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x90f [0054.940] SetFilePointer (in: hFile=0x158, lDistanceToMove=2319, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x90f [0054.940] SetEndOfFile (hFile=0x158) returned 1 [0054.940] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x90f [0054.940] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x90f [0054.940] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsptg.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0054.940] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsptg.xml", cchWideChar=10, lpMultiByteStr=0x1fe3c4c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipsptg.xml", lpUsedDefaultChar=0x0) returned 10 [0054.941] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsptg.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0054.941] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsptg.xml", cchWideChar=10, lpMultiByteStr=0x1fe35cc, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipsptg.xml", lpUsedDefaultChar=0x0) returned 10 [0054.941] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe35cc, cbMultiByte=10, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="ipsptg.xml\x18ꞗ@涤(\x18믉`믑`") returned 10 [0054.941] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsptg.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0054.941] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsptg.xml", cchWideChar=10, lpMultiByteStr=0x1fe3c4c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipsptg.xml", lpUsedDefaultChar=0x0) returned 10 [0054.941] WriteFile (in: hFile=0x158, lpBuffer=0x376fb28*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x376fb28*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0054.941] CharToOemA (in: pSrc="ipsptg.xml", pDst=0x1fe35cc | out: pDst="ipsptg.xml") returned 1 [0054.941] WriteFile (in: hFile=0x158, lpBuffer=0x1fe35cc*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe35cc*, lpNumberOfBytesWritten=0x18efcc*=0xa, lpOverlapped=0x0) returned 1 [0054.941] WriteFile (in: hFile=0x158, lpBuffer=0x1fea2d8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea2d8*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0054.941] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0054.941] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0054.942] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x952 [0054.942] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x952 [0054.942] WriteFile (in: hFile=0x158, lpBuffer=0x361ff08*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x361ff08*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0054.942] WriteFile (in: hFile=0x158, lpBuffer=0x35eff9c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35eff9c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0054.942] DeleteFileW (lpFileName="") returned 0 [0054.942] GetLastError () returned 0x3 [0054.942] GetFileAttributesW (lpFileName="") returned 0xffffffff [0054.942] SetLastError (dwErrCode=0x3) [0054.942] FlushFileBuffers (hFile=0x158) returned 1 [0054.945] GetCurrentThreadId () returned 0x970 [0054.945] GetCurrentThreadId () returned 0x970 [0054.945] GetCurrentThreadId () returned 0x970 [0054.945] GetCurrentThreadId () returned 0x970 [0054.945] GetCurrentThreadId () returned 0x970 [0054.945] GetCurrentThreadId () returned 0x970 [0054.945] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xa09 [0054.945] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xa09 [0054.945] SetFilePointer (in: hFile=0x158, lDistanceToMove=2569, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xa09 [0054.945] CloseHandle (hObject=0x158) returned 1 [0054.946] GetCurrentThreadId () returned 0x970 [0054.946] GetCurrentThreadId () returned 0x970 [0054.946] GetCurrentThreadId () returned 0x970 [0054.946] GetCurrentThreadId () returned 0x970 [0054.946] GetCurrentThreadId () returned 0x970 [0054.946] GetCurrentThreadId () returned 0x970 [0054.946] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Файл зашифрован [ipsptg.xml].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\Файл зашифрован [ipsptg.xml].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0054.946] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa09 [0054.946] SetFilePointer (in: hFile=0x158, lDistanceToMove=2441, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x989 [0054.946] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0054.946] GetFileType (hFile=0x158) returned 0x1 [0054.946] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2, wMilliseconds=0xec)) [0054.946] GetCurrentThreadId () returned 0x970 [0054.946] GetCurrentThreadId () returned 0x970 [0054.946] GetCurrentThreadId () returned 0x970 [0054.946] GetCurrentThreadId () returned 0x970 [0054.946] GetCurrentThreadId () returned 0x970 [0054.946] GetCurrentThreadId () returned 0x970 [0054.946] GetCurrentThreadId () returned 0x970 [0054.946] GetCurrentThreadId () returned 0x970 [0054.946] GetCurrentThreadId () returned 0x970 [0054.946] GetCurrentThreadId () returned 0x970 [0054.946] GetCurrentThreadId () returned 0x970 [0054.946] GetCurrentThreadId () returned 0x970 [0054.947] GetCurrentThreadId () returned 0x970 [0054.947] GetCurrentThreadId () returned 0x970 [0054.947] GetCurrentThreadId () returned 0x970 [0054.947] GetCurrentThreadId () returned 0x970 [0054.947] GetCurrentThreadId () returned 0x970 [0054.947] GetCurrentThreadId () returned 0x970 [0054.947] GetCurrentThreadId () returned 0x970 [0054.947] GetCurrentThreadId () returned 0x970 [0054.947] GetCurrentThreadId () returned 0x970 [0054.947] GetCurrentThreadId () returned 0x970 [0054.947] GetCurrentThreadId () returned 0x970 [0054.947] GetCurrentThreadId () returned 0x970 [0054.947] GetCurrentThreadId () returned 0x970 [0054.947] GetCurrentThreadId () returned 0x970 [0054.947] GetCurrentThreadId () returned 0x970 [0054.947] GetCurrentThreadId () returned 0x970 [0054.947] GetCurrentThreadId () returned 0x970 [0054.947] GetCurrentThreadId () returned 0x970 [0054.947] GetCurrentThreadId () returned 0x970 [0054.947] GetCurrentThreadId () returned 0x970 [0054.947] GetCurrentThreadId () returned 0x970 [0054.947] GetCurrentThreadId () returned 0x970 [0054.947] GetCurrentThreadId () returned 0x970 [0054.947] GetCurrentThreadId () returned 0x970 [0054.947] GetCurrentThreadId () returned 0x970 [0054.947] GetCurrentThreadId () returned 0x970 [0054.947] GetCurrentThreadId () returned 0x970 [0054.947] GetCurrentThreadId () returned 0x970 [0054.947] GetCurrentThreadId () returned 0x970 [0054.947] GetCurrentThreadId () returned 0x970 [0054.947] GetCurrentThreadId () returned 0x970 [0054.947] GetCurrentThreadId () returned 0x970 [0054.947] GetCurrentThreadId () returned 0x970 [0054.947] GetCurrentThreadId () returned 0x970 [0054.947] GetCurrentThreadId () returned 0x970 [0054.947] GetCurrentThreadId () returned 0x970 [0054.947] GetCurrentThreadId () returned 0x970 [0054.947] GetCurrentThreadId () returned 0x970 [0054.947] GetCurrentThreadId () returned 0x970 [0054.947] GetCurrentThreadId () returned 0x970 [0054.947] GetCurrentThreadId () returned 0x970 [0054.947] GetCurrentThreadId () returned 0x970 [0054.947] GetCurrentThreadId () returned 0x970 [0054.947] GetCurrentThreadId () returned 0x970 [0054.947] GetCurrentThreadId () returned 0x970 [0054.947] GetCurrentThreadId () returned 0x970 [0054.947] GetCurrentThreadId () returned 0x970 [0054.948] GetCurrentThreadId () returned 0x970 [0054.948] GetCurrentThreadId () returned 0x970 [0054.948] GetCurrentThreadId () returned 0x970 [0054.948] GetCurrentThreadId () returned 0x970 [0054.948] GetCurrentThreadId () returned 0x970 [0054.948] GetCurrentThreadId () returned 0x970 [0054.948] GetCurrentThreadId () returned 0x970 [0054.948] GetCurrentThreadId () returned 0x970 [0054.948] GetCurrentThreadId () returned 0x970 [0054.948] GetCurrentThreadId () returned 0x970 [0054.948] GetCurrentThreadId () returned 0x970 [0054.948] GetCurrentThreadId () returned 0x970 [0054.948] GetCurrentThreadId () returned 0x970 [0054.948] GetCurrentThreadId () returned 0x970 [0054.948] GetCurrentThreadId () returned 0x970 [0054.948] GetCurrentThreadId () returned 0x970 [0054.948] GetCurrentThreadId () returned 0x970 [0054.948] GetCurrentThreadId () returned 0x970 [0054.948] GetCurrentThreadId () returned 0x970 [0054.948] GetCurrentThreadId () returned 0x970 [0054.948] GetCurrentThreadId () returned 0x970 [0054.948] GetCurrentThreadId () returned 0x970 [0054.948] GetCurrentThreadId () returned 0x970 [0054.948] GetCurrentThreadId () returned 0x970 [0054.948] GetCurrentThreadId () returned 0x970 [0054.948] GetCurrentThreadId () returned 0x970 [0054.948] GetCurrentThreadId () returned 0x970 [0054.948] GetCurrentThreadId () returned 0x970 [0054.948] GetCurrentThreadId () returned 0x970 [0054.948] GetCurrentThreadId () returned 0x970 [0054.948] GetCurrentThreadId () returned 0x970 [0054.948] GetCurrentThreadId () returned 0x970 [0054.948] GetCurrentThreadId () returned 0x970 [0054.948] GetCurrentThreadId () returned 0x970 [0054.948] GetCurrentThreadId () returned 0x970 [0054.948] GetCurrentThreadId () returned 0x970 [0054.948] GetCurrentThreadId () returned 0x970 [0054.948] GetCurrentThreadId () returned 0x970 [0054.948] GetCurrentThreadId () returned 0x970 [0054.948] GetCurrentThreadId () returned 0x970 [0054.948] GetCurrentThreadId () returned 0x970 [0054.948] GetCurrentThreadId () returned 0x970 [0054.948] GetCurrentThreadId () returned 0x970 [0054.948] GetCurrentThreadId () returned 0x970 [0054.948] GetCurrentThreadId () returned 0x970 [0054.948] GetCurrentThreadId () returned 0x970 [0054.948] GetCurrentThreadId () returned 0x970 [0054.949] GetCurrentThreadId () returned 0x970 [0054.949] GetCurrentThreadId () returned 0x970 [0054.949] GetCurrentThreadId () returned 0x970 [0054.949] GetCurrentThreadId () returned 0x970 [0054.949] GetCurrentThreadId () returned 0x970 [0054.949] GetCurrentThreadId () returned 0x970 [0054.949] GetCurrentThreadId () returned 0x970 [0054.949] GetCurrentThreadId () returned 0x970 [0054.949] GetCurrentThreadId () returned 0x970 [0054.949] GetCurrentThreadId () returned 0x970 [0054.949] GetCurrentThreadId () returned 0x970 [0054.949] GetCurrentThreadId () returned 0x970 [0054.949] GetCurrentThreadId () returned 0x970 [0054.949] GetCurrentThreadId () returned 0x970 [0054.949] GetCurrentThreadId () returned 0x970 [0054.949] GetCurrentThreadId () returned 0x970 [0054.949] GetCurrentThreadId () returned 0x970 [0054.949] GetCurrentThreadId () returned 0x970 [0054.949] GetCurrentThreadId () returned 0x970 [0054.949] GetCurrentThreadId () returned 0x970 [0054.949] GetCurrentThreadId () returned 0x970 [0054.949] GetCurrentThreadId () returned 0x970 [0054.949] GetCurrentThreadId () returned 0x970 [0054.949] GetCurrentThreadId () returned 0x970 [0054.949] GetCurrentThreadId () returned 0x970 [0054.949] GetCurrentThreadId () returned 0x970 [0054.949] GetCurrentThreadId () returned 0x970 [0054.949] GetCurrentThreadId () returned 0x970 [0054.949] GetCurrentThreadId () returned 0x970 [0054.949] GetCurrentThreadId () returned 0x970 [0054.949] GetCurrentThreadId () returned 0x970 [0054.949] GetCurrentThreadId () returned 0x970 [0054.949] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0054.949] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0054.949] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fed0b0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0054.949] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0054.949] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0054.949] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fed0b0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0054.949] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0054.949] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0054.949] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0054.949] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0054.950] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0054.950] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0054.950] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0054.950] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0054.950] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fed110, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0054.950] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0054.950] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0054.950] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fed110, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0054.950] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0054.950] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0054.950] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fed110, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0054.950] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2, wMilliseconds=0xec)) [0054.950] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="\\e799&k.7)p{0Vw0zV,.Wpk<1I\"qy*Hn", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0054.950] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="\\e799&k.7)p{0Vw0zV,.Wpk<1I\"qy*Hn", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0054.950] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="\\e799&k.7)p{0Vw0zV,.Wpk<1I\"qy*Hn", cchWideChar=32, lpMultiByteStr=0x2001648, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\\e799&k.7)p{0Vw0zV,.Wpk<1I\"qy*Hn", lpUsedDefaultChar=0x0) returned 32 [0054.950] GetCurrentThreadId () returned 0x970 [0054.950] GetCurrentThreadId () returned 0x970 [0054.950] GetCurrentThreadId () returned 0x970 [0054.950] GetCurrentThreadId () returned 0x970 [0054.950] GetCurrentThreadId () returned 0x970 [0054.950] GetCurrentThreadId () returned 0x970 [0054.959] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0054.959] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0054.959] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x34f29a8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0054.959] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0054.959] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAG8tyA0MjAkmRFhC+DrzXOJqY1ozcgyS/5Hm+c77GOQUtYl+2Pqax3ufCxuIeH/w8URq5eoK5HaMUSQ6aSmB4kNngPdhDeY7UqYqKhlRZ/HIZJ8h1kKTxb04LKdWUVmbt3MB2G5lRJS625lrkb/UXiLQKz3Mc6tDreHdiNTtpBQvBwomICYO5pTQ5aAoIpHs8w+kLTv562CeEOAnNkBAIC31Y08LI5tFUQ==") returned 232 [0054.959] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2, wMilliseconds=0xfc)) [0054.959] GetCurrentThreadId () returned 0x970 [0054.959] GetCurrentThreadId () returned 0x970 [0054.959] GetCurrentThreadId () returned 0x970 [0054.959] GetCurrentThreadId () returned 0x970 [0054.959] GetCurrentThreadId () returned 0x970 [0054.959] GetCurrentThreadId () returned 0x970 [0054.959] GetCurrentThreadId () returned 0x970 [0054.959] GetCurrentThreadId () returned 0x970 [0054.959] GetCurrentThreadId () returned 0x970 [0054.959] GetCurrentThreadId () returned 0x970 [0054.959] GetCurrentThreadId () returned 0x970 [0054.959] GetCurrentThreadId () returned 0x970 [0054.959] GetCurrentThreadId () returned 0x970 [0054.959] GetCurrentThreadId () returned 0x970 [0054.959] GetCurrentThreadId () returned 0x970 [0054.959] GetCurrentThreadId () returned 0x970 [0054.959] GetCurrentThreadId () returned 0x970 [0054.960] GetCurrentThreadId () returned 0x970 [0054.960] GetCurrentThreadId () returned 0x970 [0054.960] GetCurrentThreadId () returned 0x970 [0054.960] GetCurrentThreadId () returned 0x970 [0054.960] GetCurrentThreadId () returned 0x970 [0054.960] GetCurrentThreadId () returned 0x970 [0054.960] GetCurrentThreadId () returned 0x970 [0054.960] GetCurrentThreadId () returned 0x970 [0054.960] GetCurrentThreadId () returned 0x970 [0054.960] GetCurrentThreadId () returned 0x970 [0054.960] GetCurrentThreadId () returned 0x970 [0054.960] GetCurrentThreadId () returned 0x970 [0054.960] GetCurrentThreadId () returned 0x970 [0054.960] GetCurrentThreadId () returned 0x970 [0054.960] GetCurrentThreadId () returned 0x970 [0054.960] GetCurrentThreadId () returned 0x970 [0054.960] GetCurrentThreadId () returned 0x970 [0054.960] GetCurrentThreadId () returned 0x970 [0054.960] GetCurrentThreadId () returned 0x970 [0054.960] GetCurrentThreadId () returned 0x970 [0054.960] GetCurrentThreadId () returned 0x970 [0054.960] GetCurrentThreadId () returned 0x970 [0054.960] GetCurrentThreadId () returned 0x970 [0054.960] GetCurrentThreadId () returned 0x970 [0054.960] GetCurrentThreadId () returned 0x970 [0054.960] GetCurrentThreadId () returned 0x970 [0054.960] GetCurrentThreadId () returned 0x970 [0054.960] GetCurrentThreadId () returned 0x970 [0054.960] GetCurrentThreadId () returned 0x970 [0054.960] GetCurrentThreadId () returned 0x970 [0054.960] GetCurrentThreadId () returned 0x970 [0054.960] GetCurrentThreadId () returned 0x970 [0054.960] GetCurrentThreadId () returned 0x970 [0054.960] GetCurrentThreadId () returned 0x970 [0054.960] GetCurrentThreadId () returned 0x970 [0054.960] GetCurrentThreadId () returned 0x970 [0054.960] GetCurrentThreadId () returned 0x970 [0054.960] GetCurrentThreadId () returned 0x970 [0054.960] GetCurrentThreadId () returned 0x970 [0054.960] GetCurrentThreadId () returned 0x970 [0054.960] GetCurrentThreadId () returned 0x970 [0054.960] GetCurrentThreadId () returned 0x970 [0054.960] GetCurrentThreadId () returned 0x970 [0054.960] GetCurrentThreadId () returned 0x970 [0054.960] GetCurrentThreadId () returned 0x970 [0054.960] GetCurrentThreadId () returned 0x970 [0054.960] GetCurrentThreadId () returned 0x970 [0054.961] GetCurrentThreadId () returned 0x970 [0054.961] GetCurrentThreadId () returned 0x970 [0054.961] GetCurrentThreadId () returned 0x970 [0054.961] GetCurrentThreadId () returned 0x970 [0054.961] GetCurrentThreadId () returned 0x970 [0054.961] GetCurrentThreadId () returned 0x970 [0054.961] GetCurrentThreadId () returned 0x970 [0054.961] GetCurrentThreadId () returned 0x970 [0054.961] GetCurrentThreadId () returned 0x970 [0054.961] GetCurrentThreadId () returned 0x970 [0054.961] GetCurrentThreadId () returned 0x970 [0054.961] GetCurrentThreadId () returned 0x970 [0054.961] GetCurrentThreadId () returned 0x970 [0054.961] GetCurrentThreadId () returned 0x970 [0054.961] GetCurrentThreadId () returned 0x970 [0054.961] GetCurrentThreadId () returned 0x970 [0054.961] GetCurrentThreadId () returned 0x970 [0054.961] GetCurrentThreadId () returned 0x970 [0054.961] GetCurrentThreadId () returned 0x970 [0054.961] GetCurrentThreadId () returned 0x970 [0054.961] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAG8tyA0MjAkmRFhC+DrzXOJqY1ozcgyS/5Hm+c77GOQUtYl+2Pqax3ufCxuIeH/w8URq5eoK5HaMUSQ6aSmB4kNngPdhDeY7UqYqKhlRZ/HIZJ8h1kKTxb04LKdWUVmbt3MB2G5lRJS625lrkb/UXiLQKz3Mc6tDreHdiNTtpBQvBwomICYO5pTQ5aAoIpHs8w+kLTv562CeEOAnNkBAIC31Y08LI5tFUQ==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0054.961] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAG8tyA0MjAkmRFhC+DrzXOJqY1ozcgyS/5Hm+c77GOQUtYl+2Pqax3ufCxuIeH/w8URq5eoK5HaMUSQ6aSmB4kNngPdhDeY7UqYqKhlRZ/HIZJ8h1kKTxb04LKdWUVmbt3MB2G5lRJS625lrkb/UXiLQKz3Mc6tDreHdiNTtpBQvBwomICYO5pTQ5aAoIpHs8w+kLTv562CeEOAnNkBAIC31Y08LI5tFUQ==", cchWideChar=245, lpMultiByteStr=0x353933c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAG8tyA0MjAkmRFhC+DrzXOJqY1ozcgyS/5Hm+c77GOQUtYl+2Pqax3ufCxuIeH/w8URq5eoK5HaMUSQ6aSmB4kNngPdhDeY7UqYqKhlRZ/HIZJ8h1kKTxb04LKdWUVmbt3MB2G5lRJS625lrkb/UXiLQKz3Mc6tDreHdiNTtpBQvBwomICYO5pTQ5aAoIpHs8w+kLTv562CeEOAnNkBAIC31Y08LI5tFUQ==", lpUsedDefaultChar=0x0) returned 245 [0054.961] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0054.961] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0054.961] CloseHandle (hObject=0x158) returned 1 [0054.962] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml")) returned 0 [0054.962] GetLastError () returned 0x5 [0054.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml")) returned 0x20 [0054.962] SetLastError (dwErrCode=0x5) [0054.962] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=17522766355) returned 1 [0054.964] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Файл зашифрован [ipsrom.xml].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\Файл зашифрован [ipsrom.xml].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0054.965] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0054.965] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0054.965] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0054.965] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0054.965] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0054.965] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0054.965] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0054.965] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0054.965] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0054.965] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0054.965] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0054.965] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0054.965] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0054.965] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0054.965] SetEndOfFile (hFile=0x158) returned 1 [0054.966] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0054.966] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0054.966] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0054.966] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0054.966] WriteFile (in: hFile=0x158, lpBuffer=0x361ff08*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x361ff08*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0054.967] WriteFile (in: hFile=0x158, lpBuffer=0x35f005c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f005c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0054.967] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WaL{abJtAiZDH:TqXdD@/j.-BI#b&\\pF", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0054.967] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WaL{abJtAiZDH:TqXdD@/j.-BI#b&\\pF", cchWideChar=32, lpMultiByteStr=0x2033a8c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WaL{abJtAiZDH:TqXdD@/j.-BI#b&\\pF", lpUsedDefaultChar=0x0) returned 32 [0054.967] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0054.967] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0054.967] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d7a859, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d7a859, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa54, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsrom.xml", cAlternateFileName="")) returned 0x295098 [0054.967] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0054.967] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0054.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml")) returned 0x20 [0054.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml")) returned 0x20 [0054.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml")) returned 0x20 [0054.968] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml")) returned 0x20 [0054.968] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d7a859, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d7a859, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa54)) returned 1 [0054.968] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0054.968] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0054.968] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml")) returned 0x20 [0054.968] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml")) returned 0x20 [0054.968] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0054.968] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0054.968] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0054.968] SetEndOfFile (hFile=0x158) returned 1 [0054.969] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsrom.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0054.969] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsrom.xml", cchWideChar=10, lpMultiByteStr=0x1fe43ec, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipsrom.xml", lpUsedDefaultChar=0x0) returned 10 [0054.969] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsrom.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0054.969] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsrom.xml", cchWideChar=10, lpMultiByteStr=0x1fe37ec, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipsrom.xml", lpUsedDefaultChar=0x0) returned 10 [0054.969] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe37ec, cbMultiByte=10, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="ipsrom.xmlatattmli\x01") returned 10 [0054.969] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsrom.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0054.969] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsrom.xml", cchWideChar=10, lpMultiByteStr=0x1fe43ec, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipsrom.xml", lpUsedDefaultChar=0x0) returned 10 [0054.969] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0054.969] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0054.969] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0xa54 [0054.969] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0054.969] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0054.969] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0054.969] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsrom.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0054.970] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsrom.xml", cchWideChar=10, lpMultiByteStr=0x1fe43ec, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipsrom.xml", lpUsedDefaultChar=0x0) returned 10 [0054.970] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsrom.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0054.970] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsrom.xml", cchWideChar=10, lpMultiByteStr=0x1fe37ec, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipsrom.xml", lpUsedDefaultChar=0x0) returned 10 [0054.970] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe37ec, cbMultiByte=10, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="ipsrom.xmlom.xmlatattmli\x01") returned 10 [0054.970] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsrom.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0054.970] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsrom.xml", cchWideChar=10, lpMultiByteStr=0x1fe43ec, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipsrom.xml", lpUsedDefaultChar=0x0) returned 10 [0054.970] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0054.971] CharToOemA (in: pSrc="ipsrom.xml", pDst=0x1fe37ec | out: pDst="ipsrom.xml") returned 1 [0054.971] WriteFile (in: hFile=0x158, lpBuffer=0x1fe37ec*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe37ec*, lpNumberOfBytesWritten=0x18e048*=0xa, lpOverlapped=0x0) returned 1 [0054.971] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0054.971] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0054.971] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0054.971] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=17523440753) returned 1 [0054.971] ReadFile (in: hFile=0x11c, lpBuffer=0x34fa5b0, nNumberOfBytesToRead=0xa54, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x34fa5b0*, lpNumberOfBytesRead=0x18dd7c*=0xa54, lpOverlapped=0x0) returned 1 [0054.972] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0054.973] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=17523595962) returned 1 [0054.981] WriteFile (in: hFile=0x158, lpBuffer=0x1fea120*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fea120*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0054.981] ReadFile (in: hFile=0x11c, lpBuffer=0x34fa5b0, nNumberOfBytesToRead=0xa54, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x34fa5b0*, lpNumberOfBytesRead=0x18de38*=0xa54, lpOverlapped=0x0) returned 1 [0054.981] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x45 [0054.981] WriteFile (in: hFile=0x158, lpBuffer=0x34fc810*, nNumberOfBytesToWrite=0xa54, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x34fc810*, lpNumberOfBytesWritten=0x18de10*=0xa54, lpOverlapped=0x0) returned 1 [0054.981] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0xa99 [0054.981] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0054.981] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0054.982] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0054.982] SetFilePointer (in: hFile=0x158, lDistanceToMove=10, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x28 [0054.982] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0xaa3 [0054.982] CloseHandle (hObject=0x11c) returned 1 [0054.982] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xaa3 [0054.982] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xaa3 [0054.982] SetFilePointer (in: hFile=0x158, lDistanceToMove=2723, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xaa3 [0054.982] SetFilePointer (in: hFile=0x158, lDistanceToMove=2723, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0xaa3 [0054.982] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xaa3 [0054.982] SetFilePointer (in: hFile=0x158, lDistanceToMove=2723, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0xaa3 [0054.982] SetEndOfFile (hFile=0x158) returned 1 [0054.982] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xaa3 [0054.982] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xaa3 [0054.982] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsrom.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0054.982] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsrom.xml", cchWideChar=10, lpMultiByteStr=0x1fe43ec, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipsrom.xml", lpUsedDefaultChar=0x0) returned 10 [0054.983] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsrom.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0054.983] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsrom.xml", cchWideChar=10, lpMultiByteStr=0x1fe3bac, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipsrom.xml", lpUsedDefaultChar=0x0) returned 10 [0054.983] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe3bac, cbMultiByte=10, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="ipsrom.xml\x18ꞗ@涤(\x18믉`믑`") returned 10 [0054.983] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsrom.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0054.983] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsrom.xml", cchWideChar=10, lpMultiByteStr=0x1fe43ec, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipsrom.xml", lpUsedDefaultChar=0x0) returned 10 [0054.983] WriteFile (in: hFile=0x158, lpBuffer=0x376fb28*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x376fb28*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0054.983] CharToOemA (in: pSrc="ipsrom.xml", pDst=0x1fe3bac | out: pDst="ipsrom.xml") returned 1 [0054.983] WriteFile (in: hFile=0x158, lpBuffer=0x1fe3bac*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe3bac*, lpNumberOfBytesWritten=0x18efcc*=0xa, lpOverlapped=0x0) returned 1 [0054.983] WriteFile (in: hFile=0x158, lpBuffer=0x1fea170*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea170*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0054.983] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0054.983] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0054.983] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xae6 [0054.983] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xae6 [0054.983] WriteFile (in: hFile=0x158, lpBuffer=0x361ff08*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x361ff08*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0054.983] WriteFile (in: hFile=0x158, lpBuffer=0x35f005c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f005c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0054.983] DeleteFileW (lpFileName="") returned 0 [0054.983] GetLastError () returned 0x3 [0054.984] GetFileAttributesW (lpFileName="") returned 0xffffffff [0054.984] SetLastError (dwErrCode=0x3) [0054.984] FlushFileBuffers (hFile=0x158) returned 1 [0054.987] GetCurrentThreadId () returned 0x970 [0054.987] GetCurrentThreadId () returned 0x970 [0054.987] GetCurrentThreadId () returned 0x970 [0054.987] GetCurrentThreadId () returned 0x970 [0054.987] GetCurrentThreadId () returned 0x970 [0054.987] GetCurrentThreadId () returned 0x970 [0054.987] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xb9d [0054.987] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xb9d [0054.987] SetFilePointer (in: hFile=0x158, lDistanceToMove=2973, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xb9d [0054.987] CloseHandle (hObject=0x158) returned 1 [0054.988] GetCurrentThreadId () returned 0x970 [0054.988] GetCurrentThreadId () returned 0x970 [0054.988] GetCurrentThreadId () returned 0x970 [0054.988] GetCurrentThreadId () returned 0x970 [0054.988] GetCurrentThreadId () returned 0x970 [0054.988] GetCurrentThreadId () returned 0x970 [0054.988] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Файл зашифрован [ipsrom.xml].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\Файл зашифрован [ipsrom.xml].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0054.988] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb9d [0054.988] SetFilePointer (in: hFile=0x158, lDistanceToMove=2845, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb1d [0054.988] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0054.988] GetFileType (hFile=0x158) returned 0x1 [0054.988] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2, wMilliseconds=0x11b)) [0054.988] GetCurrentThreadId () returned 0x970 [0054.988] GetCurrentThreadId () returned 0x970 [0054.988] GetCurrentThreadId () returned 0x970 [0054.988] GetCurrentThreadId () returned 0x970 [0054.988] GetCurrentThreadId () returned 0x970 [0054.988] GetCurrentThreadId () returned 0x970 [0054.988] GetCurrentThreadId () returned 0x970 [0054.988] GetCurrentThreadId () returned 0x970 [0054.988] GetCurrentThreadId () returned 0x970 [0054.988] GetCurrentThreadId () returned 0x970 [0054.988] GetCurrentThreadId () returned 0x970 [0054.988] GetCurrentThreadId () returned 0x970 [0054.988] GetCurrentThreadId () returned 0x970 [0054.988] GetCurrentThreadId () returned 0x970 [0054.988] GetCurrentThreadId () returned 0x970 [0054.988] GetCurrentThreadId () returned 0x970 [0054.988] GetCurrentThreadId () returned 0x970 [0054.988] GetCurrentThreadId () returned 0x970 [0054.988] GetCurrentThreadId () returned 0x970 [0054.988] GetCurrentThreadId () returned 0x970 [0054.988] GetCurrentThreadId () returned 0x970 [0054.988] GetCurrentThreadId () returned 0x970 [0054.988] GetCurrentThreadId () returned 0x970 [0054.989] GetCurrentThreadId () returned 0x970 [0054.989] GetCurrentThreadId () returned 0x970 [0054.989] GetCurrentThreadId () returned 0x970 [0054.989] GetCurrentThreadId () returned 0x970 [0054.989] GetCurrentThreadId () returned 0x970 [0054.989] GetCurrentThreadId () returned 0x970 [0054.989] GetCurrentThreadId () returned 0x970 [0054.989] GetCurrentThreadId () returned 0x970 [0054.989] GetCurrentThreadId () returned 0x970 [0054.989] GetCurrentThreadId () returned 0x970 [0054.989] GetCurrentThreadId () returned 0x970 [0054.989] GetCurrentThreadId () returned 0x970 [0054.989] GetCurrentThreadId () returned 0x970 [0054.989] GetCurrentThreadId () returned 0x970 [0054.989] GetCurrentThreadId () returned 0x970 [0054.989] GetCurrentThreadId () returned 0x970 [0054.989] GetCurrentThreadId () returned 0x970 [0054.989] GetCurrentThreadId () returned 0x970 [0054.989] GetCurrentThreadId () returned 0x970 [0054.989] GetCurrentThreadId () returned 0x970 [0054.989] GetCurrentThreadId () returned 0x970 [0054.989] GetCurrentThreadId () returned 0x970 [0054.989] GetCurrentThreadId () returned 0x970 [0054.989] GetCurrentThreadId () returned 0x970 [0054.989] GetCurrentThreadId () returned 0x970 [0054.989] GetCurrentThreadId () returned 0x970 [0054.989] GetCurrentThreadId () returned 0x970 [0054.989] GetCurrentThreadId () returned 0x970 [0054.989] GetCurrentThreadId () returned 0x970 [0054.989] GetCurrentThreadId () returned 0x970 [0054.989] GetCurrentThreadId () returned 0x970 [0054.989] GetCurrentThreadId () returned 0x970 [0054.989] GetCurrentThreadId () returned 0x970 [0054.989] GetCurrentThreadId () returned 0x970 [0054.989] GetCurrentThreadId () returned 0x970 [0054.989] GetCurrentThreadId () returned 0x970 [0054.989] GetCurrentThreadId () returned 0x970 [0054.989] GetCurrentThreadId () returned 0x970 [0054.989] GetCurrentThreadId () returned 0x970 [0054.989] GetCurrentThreadId () returned 0x970 [0054.989] GetCurrentThreadId () returned 0x970 [0054.989] GetCurrentThreadId () returned 0x970 [0054.989] GetCurrentThreadId () returned 0x970 [0054.989] GetCurrentThreadId () returned 0x970 [0054.989] GetCurrentThreadId () returned 0x970 [0054.990] GetCurrentThreadId () returned 0x970 [0054.990] GetCurrentThreadId () returned 0x970 [0054.990] GetCurrentThreadId () returned 0x970 [0054.990] GetCurrentThreadId () returned 0x970 [0054.990] GetCurrentThreadId () returned 0x970 [0054.990] GetCurrentThreadId () returned 0x970 [0054.990] GetCurrentThreadId () returned 0x970 [0054.990] GetCurrentThreadId () returned 0x970 [0054.990] GetCurrentThreadId () returned 0x970 [0054.990] GetCurrentThreadId () returned 0x970 [0054.990] GetCurrentThreadId () returned 0x970 [0054.990] GetCurrentThreadId () returned 0x970 [0054.990] GetCurrentThreadId () returned 0x970 [0054.990] GetCurrentThreadId () returned 0x970 [0054.990] GetCurrentThreadId () returned 0x970 [0054.990] GetCurrentThreadId () returned 0x970 [0054.990] GetCurrentThreadId () returned 0x970 [0054.990] GetCurrentThreadId () returned 0x970 [0054.990] GetCurrentThreadId () returned 0x970 [0054.990] GetCurrentThreadId () returned 0x970 [0054.990] GetCurrentThreadId () returned 0x970 [0054.990] GetCurrentThreadId () returned 0x970 [0054.990] GetCurrentThreadId () returned 0x970 [0054.990] GetCurrentThreadId () returned 0x970 [0054.990] GetCurrentThreadId () returned 0x970 [0054.990] GetCurrentThreadId () returned 0x970 [0054.990] GetCurrentThreadId () returned 0x970 [0054.990] GetCurrentThreadId () returned 0x970 [0054.990] GetCurrentThreadId () returned 0x970 [0054.990] GetCurrentThreadId () returned 0x970 [0054.990] GetCurrentThreadId () returned 0x970 [0054.990] GetCurrentThreadId () returned 0x970 [0054.990] GetCurrentThreadId () returned 0x970 [0054.990] GetCurrentThreadId () returned 0x970 [0054.990] GetCurrentThreadId () returned 0x970 [0054.990] GetCurrentThreadId () returned 0x970 [0054.990] GetCurrentThreadId () returned 0x970 [0054.990] GetCurrentThreadId () returned 0x970 [0054.990] GetCurrentThreadId () returned 0x970 [0054.990] GetCurrentThreadId () returned 0x970 [0054.990] GetCurrentThreadId () returned 0x970 [0054.990] GetCurrentThreadId () returned 0x970 [0054.990] GetCurrentThreadId () returned 0x970 [0054.990] GetCurrentThreadId () returned 0x970 [0054.990] GetCurrentThreadId () returned 0x970 [0054.990] GetCurrentThreadId () returned 0x970 [0054.991] GetCurrentThreadId () returned 0x970 [0054.991] GetCurrentThreadId () returned 0x970 [0054.991] GetCurrentThreadId () returned 0x970 [0054.991] GetCurrentThreadId () returned 0x970 [0054.991] GetCurrentThreadId () returned 0x970 [0054.991] GetCurrentThreadId () returned 0x970 [0054.991] GetCurrentThreadId () returned 0x970 [0054.991] GetCurrentThreadId () returned 0x970 [0054.991] GetCurrentThreadId () returned 0x970 [0054.991] GetCurrentThreadId () returned 0x970 [0054.991] GetCurrentThreadId () returned 0x970 [0054.991] GetCurrentThreadId () returned 0x970 [0054.991] GetCurrentThreadId () returned 0x970 [0054.991] GetCurrentThreadId () returned 0x970 [0054.991] GetCurrentThreadId () returned 0x970 [0054.991] GetCurrentThreadId () returned 0x970 [0054.991] GetCurrentThreadId () returned 0x970 [0054.991] GetCurrentThreadId () returned 0x970 [0054.991] GetCurrentThreadId () returned 0x970 [0054.991] GetCurrentThreadId () returned 0x970 [0054.991] GetCurrentThreadId () returned 0x970 [0054.991] GetCurrentThreadId () returned 0x970 [0054.991] GetCurrentThreadId () returned 0x970 [0054.991] GetCurrentThreadId () returned 0x970 [0054.991] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0054.991] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0054.991] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fed110, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0054.991] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0054.991] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0054.991] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fed110, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0054.991] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0054.991] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0054.991] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0054.991] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0054.991] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0054.991] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0054.991] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0054.991] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0054.991] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fed170, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0054.991] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0054.991] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0054.992] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fed170, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0054.992] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0054.992] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0054.992] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fed170, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0054.992] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2, wMilliseconds=0x11b)) [0054.992] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WaL{abJtAiZDH:TqXdD@/j.-BI#b&\\pF", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0054.992] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WaL{abJtAiZDH:TqXdD@/j.-BI#b&\\pF", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0054.992] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WaL{abJtAiZDH:TqXdD@/j.-BI#b&\\pF", cchWideChar=32, lpMultiByteStr=0x2001678, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WaL{abJtAiZDH:TqXdD@/j.-BI#b&\\pF", lpUsedDefaultChar=0x0) returned 32 [0054.992] GetCurrentThreadId () returned 0x970 [0054.992] GetCurrentThreadId () returned 0x970 [0054.992] GetCurrentThreadId () returned 0x970 [0054.992] GetCurrentThreadId () returned 0x970 [0054.992] GetCurrentThreadId () returned 0x970 [0054.992] GetCurrentThreadId () returned 0x970 [0054.999] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0054.999] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0054.999] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x34f2a98, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0054.999] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0054.999] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAFfIWuoChA6pUmW/UvkBi6hJXQVetKoh+6chU02gxBwfuEbcSBh5CCeJsfRbx8/sCvuHrZVK5ikJvMyPJeeepOFkbSuoVIygdqzo/PEXAEJF1wJRgyw8ErN2FKTvUI1trCLmmVCNTK6s1dsoppOJNYyzyKgVLFFQHQ7SKxort95oGo3llr/qgCMqXN3pXPKXmAPy6CX/5HGqgu4gB9C4Ba/Ry52F1s1KTw==") returned 232 [0054.999] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2, wMilliseconds=0x11b)) [0054.999] GetCurrentThreadId () returned 0x970 [0054.999] GetCurrentThreadId () returned 0x970 [0054.999] GetCurrentThreadId () returned 0x970 [0054.999] GetCurrentThreadId () returned 0x970 [0054.999] GetCurrentThreadId () returned 0x970 [0054.999] GetCurrentThreadId () returned 0x970 [0054.999] GetCurrentThreadId () returned 0x970 [0054.999] GetCurrentThreadId () returned 0x970 [0054.999] GetCurrentThreadId () returned 0x970 [0054.999] GetCurrentThreadId () returned 0x970 [0054.999] GetCurrentThreadId () returned 0x970 [0054.999] GetCurrentThreadId () returned 0x970 [0054.999] GetCurrentThreadId () returned 0x970 [0054.999] GetCurrentThreadId () returned 0x970 [0054.999] GetCurrentThreadId () returned 0x970 [0054.999] GetCurrentThreadId () returned 0x970 [0054.999] GetCurrentThreadId () returned 0x970 [0054.999] GetCurrentThreadId () returned 0x970 [0054.999] GetCurrentThreadId () returned 0x970 [0054.999] GetCurrentThreadId () returned 0x970 [0054.999] GetCurrentThreadId () returned 0x970 [0055.000] GetCurrentThreadId () returned 0x970 [0055.000] GetCurrentThreadId () returned 0x970 [0055.000] GetCurrentThreadId () returned 0x970 [0055.000] GetCurrentThreadId () returned 0x970 [0055.000] GetCurrentThreadId () returned 0x970 [0055.000] GetCurrentThreadId () returned 0x970 [0055.000] GetCurrentThreadId () returned 0x970 [0055.000] GetCurrentThreadId () returned 0x970 [0055.000] GetCurrentThreadId () returned 0x970 [0055.000] GetCurrentThreadId () returned 0x970 [0055.000] GetCurrentThreadId () returned 0x970 [0055.000] GetCurrentThreadId () returned 0x970 [0055.000] GetCurrentThreadId () returned 0x970 [0055.000] GetCurrentThreadId () returned 0x970 [0055.000] GetCurrentThreadId () returned 0x970 [0055.000] GetCurrentThreadId () returned 0x970 [0055.000] GetCurrentThreadId () returned 0x970 [0055.000] GetCurrentThreadId () returned 0x970 [0055.000] GetCurrentThreadId () returned 0x970 [0055.000] GetCurrentThreadId () returned 0x970 [0055.000] GetCurrentThreadId () returned 0x970 [0055.000] GetCurrentThreadId () returned 0x970 [0055.000] GetCurrentThreadId () returned 0x970 [0055.000] GetCurrentThreadId () returned 0x970 [0055.000] GetCurrentThreadId () returned 0x970 [0055.000] GetCurrentThreadId () returned 0x970 [0055.000] GetCurrentThreadId () returned 0x970 [0055.000] GetCurrentThreadId () returned 0x970 [0055.000] GetCurrentThreadId () returned 0x970 [0055.000] GetCurrentThreadId () returned 0x970 [0055.000] GetCurrentThreadId () returned 0x970 [0055.000] GetCurrentThreadId () returned 0x970 [0055.000] GetCurrentThreadId () returned 0x970 [0055.000] GetCurrentThreadId () returned 0x970 [0055.000] GetCurrentThreadId () returned 0x970 [0055.000] GetCurrentThreadId () returned 0x970 [0055.000] GetCurrentThreadId () returned 0x970 [0055.000] GetCurrentThreadId () returned 0x970 [0055.000] GetCurrentThreadId () returned 0x970 [0055.000] GetCurrentThreadId () returned 0x970 [0055.000] GetCurrentThreadId () returned 0x970 [0055.000] GetCurrentThreadId () returned 0x970 [0055.000] GetCurrentThreadId () returned 0x970 [0055.000] GetCurrentThreadId () returned 0x970 [0055.000] GetCurrentThreadId () returned 0x970 [0055.000] GetCurrentThreadId () returned 0x970 [0055.000] GetCurrentThreadId () returned 0x970 [0055.000] GetCurrentThreadId () returned 0x970 [0055.001] GetCurrentThreadId () returned 0x970 [0055.001] GetCurrentThreadId () returned 0x970 [0055.001] GetCurrentThreadId () returned 0x970 [0055.001] GetCurrentThreadId () returned 0x970 [0055.001] GetCurrentThreadId () returned 0x970 [0055.001] GetCurrentThreadId () returned 0x970 [0055.001] GetCurrentThreadId () returned 0x970 [0055.001] GetCurrentThreadId () returned 0x970 [0055.001] GetCurrentThreadId () returned 0x970 [0055.001] GetCurrentThreadId () returned 0x970 [0055.001] GetCurrentThreadId () returned 0x970 [0055.001] GetCurrentThreadId () returned 0x970 [0055.001] GetCurrentThreadId () returned 0x970 [0055.001] GetCurrentThreadId () returned 0x970 [0055.001] GetCurrentThreadId () returned 0x970 [0055.001] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAFfIWuoChA6pUmW/UvkBi6hJXQVetKoh+6chU02gxBwfuEbcSBh5CCeJsfRbx8/sCvuHrZVK5ikJvMyPJeeepOFkbSuoVIygdqzo/PEXAEJF1wJRgyw8ErN2FKTvUI1trCLmmVCNTK6s1dsoppOJNYyzyKgVLFFQHQ7SKxort95oGo3llr/qgCMqXN3pXPKXmAPy6CX/5HGqgu4gB9C4Ba/Ry52F1s1KTw==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0055.001] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAFfIWuoChA6pUmW/UvkBi6hJXQVetKoh+6chU02gxBwfuEbcSBh5CCeJsfRbx8/sCvuHrZVK5ikJvMyPJeeepOFkbSuoVIygdqzo/PEXAEJF1wJRgyw8ErN2FKTvUI1trCLmmVCNTK6s1dsoppOJNYyzyKgVLFFQHQ7SKxort95oGo3llr/qgCMqXN3pXPKXmAPy6CX/5HGqgu4gB9C4Ba/Ry52F1s1KTw==", cchWideChar=245, lpMultiByteStr=0x353933c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAFfIWuoChA6pUmW/UvkBi6hJXQVetKoh+6chU02gxBwfuEbcSBh5CCeJsfRbx8/sCvuHrZVK5ikJvMyPJeeepOFkbSuoVIygdqzo/PEXAEJF1wJRgyw8ErN2FKTvUI1trCLmmVCNTK6s1dsoppOJNYyzyKgVLFFQHQ7SKxort95oGo3llr/qgCMqXN3pXPKXmAPy6CX/5HGqgu4gB9C4Ba/Ry52F1s1KTw==", lpUsedDefaultChar=0x0) returned 245 [0055.001] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0055.002] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0055.002] CloseHandle (hObject=0x158) returned 1 [0055.003] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml")) returned 0 [0055.003] GetLastError () returned 0x5 [0055.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml")) returned 0x20 [0055.003] SetLastError (dwErrCode=0x5) [0055.003] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=17526629932) returned 1 [0055.003] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Файл зашифрован [ipsrus.xml].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\Файл зашифрован [ipsrus.xml].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0055.003] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0055.003] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0055.003] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0055.004] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0055.004] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0055.004] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0055.004] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0055.004] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0055.004] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0055.004] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0055.004] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0055.004] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0055.004] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0055.004] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0055.004] SetEndOfFile (hFile=0x158) returned 1 [0055.004] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0055.004] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0055.004] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0055.005] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0055.005] WriteFile (in: hFile=0x158, lpBuffer=0x361ff08*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x361ff08*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0055.005] WriteFile (in: hFile=0x158, lpBuffer=0x35eff9c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35eff9c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0055.006] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Bz>dj6#%lv}aV5(Rk)tNZy&g<3T32agi", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0055.006] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Bz>dj6#%lv}aV5(Rk)tNZy&g<3T32agi", cchWideChar=32, lpMultiByteStr=0x2033ac4, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Bz>dj6#%lv}aV5(Rk)tNZy&g<3T32agi", lpUsedDefaultChar=0x0) returned 32 [0055.006] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0055.006] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0055.006] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27da09b6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27da09b6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsrus.xml", cAlternateFileName="")) returned 0x295098 [0055.006] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0055.006] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0055.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml")) returned 0x20 [0055.007] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml")) returned 0x20 [0055.007] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml")) returned 0x20 [0055.007] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml")) returned 0x20 [0055.007] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27da09b6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27da09b6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9ee)) returned 1 [0055.007] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0055.007] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0055.007] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml")) returned 0x20 [0055.007] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml")) returned 0x20 [0055.007] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0055.007] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0055.007] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0055.007] SetEndOfFile (hFile=0x158) returned 1 [0055.008] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsrus.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.008] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsrus.xml", cchWideChar=10, lpMultiByteStr=0x1fe394c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipsrus.xml", lpUsedDefaultChar=0x0) returned 10 [0055.008] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsrus.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.008] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsrus.xml", cchWideChar=10, lpMultiByteStr=0x1fe484c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipsrus.xml", lpUsedDefaultChar=0x0) returned 10 [0055.008] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe484c, cbMultiByte=10, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="ipsrus.xmlatattmli\x01") returned 10 [0055.008] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsrus.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.008] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsrus.xml", cchWideChar=10, lpMultiByteStr=0x1fe394c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipsrus.xml", lpUsedDefaultChar=0x0) returned 10 [0055.008] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0055.008] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0055.009] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x9ee [0055.009] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0055.009] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0055.009] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0055.009] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsrus.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.009] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsrus.xml", cchWideChar=10, lpMultiByteStr=0x1fe394c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipsrus.xml", lpUsedDefaultChar=0x0) returned 10 [0055.009] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsrus.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.009] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsrus.xml", cchWideChar=10, lpMultiByteStr=0x1fe484c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipsrus.xml", lpUsedDefaultChar=0x0) returned 10 [0055.009] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe484c, cbMultiByte=10, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="ipsrus.xmlus.xmlatattmli\x01") returned 10 [0055.009] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsrus.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.009] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsrus.xml", cchWideChar=10, lpMultiByteStr=0x1fe394c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipsrus.xml", lpUsedDefaultChar=0x0) returned 10 [0055.009] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0055.010] CharToOemA (in: pSrc="ipsrus.xml", pDst=0x1fe484c | out: pDst="ipsrus.xml") returned 1 [0055.010] WriteFile (in: hFile=0x158, lpBuffer=0x1fe484c*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe484c*, lpNumberOfBytesWritten=0x18e048*=0xa, lpOverlapped=0x0) returned 1 [0055.010] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0055.010] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0055.010] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0055.010] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=17527368731) returned 1 [0055.010] ReadFile (in: hFile=0x11c, lpBuffer=0x34fa5d0, nNumberOfBytesToRead=0x9ee, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x34fa5d0*, lpNumberOfBytesRead=0x18dd7c*=0x9ee, lpOverlapped=0x0) returned 1 [0055.012] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0055.012] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=17527509183) returned 1 [0055.020] WriteFile (in: hFile=0x158, lpBuffer=0x1fea288*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fea288*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0055.020] ReadFile (in: hFile=0x11c, lpBuffer=0x34fa5d0, nNumberOfBytesToRead=0x9ee, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x34fa5d0*, lpNumberOfBytesRead=0x18de38*=0x9ee, lpOverlapped=0x0) returned 1 [0055.020] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x45 [0055.020] WriteFile (in: hFile=0x158, lpBuffer=0x34fb000*, nNumberOfBytesToWrite=0x9ee, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x34fb000*, lpNumberOfBytesWritten=0x18de10*=0x9ee, lpOverlapped=0x0) returned 1 [0055.020] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0xa33 [0055.021] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0055.021] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0055.021] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0055.021] SetFilePointer (in: hFile=0x158, lDistanceToMove=10, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x28 [0055.021] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0xa3d [0055.021] CloseHandle (hObject=0x11c) returned 1 [0055.021] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xa3d [0055.021] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xa3d [0055.021] SetFilePointer (in: hFile=0x158, lDistanceToMove=2621, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xa3d [0055.021] SetFilePointer (in: hFile=0x158, lDistanceToMove=2621, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0xa3d [0055.021] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xa3d [0055.021] SetFilePointer (in: hFile=0x158, lDistanceToMove=2621, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0xa3d [0055.021] SetEndOfFile (hFile=0x158) returned 1 [0055.021] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xa3d [0055.021] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xa3d [0055.022] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsrus.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.022] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsrus.xml", cchWideChar=10, lpMultiByteStr=0x1fe394c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipsrus.xml", lpUsedDefaultChar=0x0) returned 10 [0055.022] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsrus.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.022] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsrus.xml", cchWideChar=10, lpMultiByteStr=0x1fe35cc, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipsrus.xml", lpUsedDefaultChar=0x0) returned 10 [0055.022] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe35cc, cbMultiByte=10, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="ipsrus.xml\x18ꞗ@涤(\x18믉`믑`") returned 10 [0055.022] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsrus.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.022] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsrus.xml", cchWideChar=10, lpMultiByteStr=0x1fe394c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipsrus.xml", lpUsedDefaultChar=0x0) returned 10 [0055.022] WriteFile (in: hFile=0x158, lpBuffer=0x376fb28*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x376fb28*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0055.022] CharToOemA (in: pSrc="ipsrus.xml", pDst=0x1fe35cc | out: pDst="ipsrus.xml") returned 1 [0055.022] WriteFile (in: hFile=0x158, lpBuffer=0x1fe35cc*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe35cc*, lpNumberOfBytesWritten=0x18efcc*=0xa, lpOverlapped=0x0) returned 1 [0055.022] WriteFile (in: hFile=0x158, lpBuffer=0x1fea110*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea110*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0055.022] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0055.022] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0055.022] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xa80 [0055.022] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xa80 [0055.022] WriteFile (in: hFile=0x158, lpBuffer=0x361ff08*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x361ff08*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0055.022] WriteFile (in: hFile=0x158, lpBuffer=0x35eff9c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35eff9c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0055.023] DeleteFileW (lpFileName="") returned 0 [0055.023] GetLastError () returned 0x3 [0055.023] GetFileAttributesW (lpFileName="") returned 0xffffffff [0055.023] SetLastError (dwErrCode=0x3) [0055.023] FlushFileBuffers (hFile=0x158) returned 1 [0055.025] GetCurrentThreadId () returned 0x970 [0055.025] GetCurrentThreadId () returned 0x970 [0055.025] GetCurrentThreadId () returned 0x970 [0055.025] GetCurrentThreadId () returned 0x970 [0055.025] GetCurrentThreadId () returned 0x970 [0055.025] GetCurrentThreadId () returned 0x970 [0055.025] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xb37 [0055.025] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xb37 [0055.026] SetFilePointer (in: hFile=0x158, lDistanceToMove=2871, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xb37 [0055.026] CloseHandle (hObject=0x158) returned 1 [0055.026] GetCurrentThreadId () returned 0x970 [0055.026] GetCurrentThreadId () returned 0x970 [0055.026] GetCurrentThreadId () returned 0x970 [0055.026] GetCurrentThreadId () returned 0x970 [0055.026] GetCurrentThreadId () returned 0x970 [0055.026] GetCurrentThreadId () returned 0x970 [0055.026] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Файл зашифрован [ipsrus.xml].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\Файл зашифрован [ipsrus.xml].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0055.027] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb37 [0055.027] SetFilePointer (in: hFile=0x158, lDistanceToMove=2743, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xab7 [0055.027] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0055.027] GetFileType (hFile=0x158) returned 0x1 [0055.027] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2, wMilliseconds=0x13a)) [0055.027] GetCurrentThreadId () returned 0x970 [0055.027] GetCurrentThreadId () returned 0x970 [0055.027] GetCurrentThreadId () returned 0x970 [0055.027] GetCurrentThreadId () returned 0x970 [0055.027] GetCurrentThreadId () returned 0x970 [0055.027] GetCurrentThreadId () returned 0x970 [0055.027] GetCurrentThreadId () returned 0x970 [0055.027] GetCurrentThreadId () returned 0x970 [0055.027] GetCurrentThreadId () returned 0x970 [0055.027] GetCurrentThreadId () returned 0x970 [0055.027] GetCurrentThreadId () returned 0x970 [0055.027] GetCurrentThreadId () returned 0x970 [0055.027] GetCurrentThreadId () returned 0x970 [0055.027] GetCurrentThreadId () returned 0x970 [0055.027] GetCurrentThreadId () returned 0x970 [0055.027] GetCurrentThreadId () returned 0x970 [0055.027] GetCurrentThreadId () returned 0x970 [0055.027] GetCurrentThreadId () returned 0x970 [0055.027] GetCurrentThreadId () returned 0x970 [0055.027] GetCurrentThreadId () returned 0x970 [0055.027] GetCurrentThreadId () returned 0x970 [0055.027] GetCurrentThreadId () returned 0x970 [0055.027] GetCurrentThreadId () returned 0x970 [0055.027] GetCurrentThreadId () returned 0x970 [0055.027] GetCurrentThreadId () returned 0x970 [0055.027] GetCurrentThreadId () returned 0x970 [0055.027] GetCurrentThreadId () returned 0x970 [0055.027] GetCurrentThreadId () returned 0x970 [0055.027] GetCurrentThreadId () returned 0x970 [0055.027] GetCurrentThreadId () returned 0x970 [0055.027] GetCurrentThreadId () returned 0x970 [0055.027] GetCurrentThreadId () returned 0x970 [0055.027] GetCurrentThreadId () returned 0x970 [0055.027] GetCurrentThreadId () returned 0x970 [0055.027] GetCurrentThreadId () returned 0x970 [0055.027] GetCurrentThreadId () returned 0x970 [0055.028] GetCurrentThreadId () returned 0x970 [0055.028] GetCurrentThreadId () returned 0x970 [0055.028] GetCurrentThreadId () returned 0x970 [0055.028] GetCurrentThreadId () returned 0x970 [0055.028] GetCurrentThreadId () returned 0x970 [0055.028] GetCurrentThreadId () returned 0x970 [0055.028] GetCurrentThreadId () returned 0x970 [0055.028] GetCurrentThreadId () returned 0x970 [0055.028] GetCurrentThreadId () returned 0x970 [0055.028] GetCurrentThreadId () returned 0x970 [0055.028] GetCurrentThreadId () returned 0x970 [0055.028] GetCurrentThreadId () returned 0x970 [0055.028] GetCurrentThreadId () returned 0x970 [0055.028] GetCurrentThreadId () returned 0x970 [0055.028] GetCurrentThreadId () returned 0x970 [0055.028] GetCurrentThreadId () returned 0x970 [0055.028] GetCurrentThreadId () returned 0x970 [0055.028] GetCurrentThreadId () returned 0x970 [0055.028] GetCurrentThreadId () returned 0x970 [0055.028] GetCurrentThreadId () returned 0x970 [0055.028] GetCurrentThreadId () returned 0x970 [0055.028] GetCurrentThreadId () returned 0x970 [0055.028] GetCurrentThreadId () returned 0x970 [0055.028] GetCurrentThreadId () returned 0x970 [0055.028] GetCurrentThreadId () returned 0x970 [0055.028] GetCurrentThreadId () returned 0x970 [0055.028] GetCurrentThreadId () returned 0x970 [0055.028] GetCurrentThreadId () returned 0x970 [0055.028] GetCurrentThreadId () returned 0x970 [0055.028] GetCurrentThreadId () returned 0x970 [0055.028] GetCurrentThreadId () returned 0x970 [0055.028] GetCurrentThreadId () returned 0x970 [0055.028] GetCurrentThreadId () returned 0x970 [0055.028] GetCurrentThreadId () returned 0x970 [0055.028] GetCurrentThreadId () returned 0x970 [0055.028] GetCurrentThreadId () returned 0x970 [0055.028] GetCurrentThreadId () returned 0x970 [0055.028] GetCurrentThreadId () returned 0x970 [0055.028] GetCurrentThreadId () returned 0x970 [0055.028] GetCurrentThreadId () returned 0x970 [0055.028] GetCurrentThreadId () returned 0x970 [0055.028] GetCurrentThreadId () returned 0x970 [0055.028] GetCurrentThreadId () returned 0x970 [0055.028] GetCurrentThreadId () returned 0x970 [0055.028] GetCurrentThreadId () returned 0x970 [0055.028] GetCurrentThreadId () returned 0x970 [0055.028] GetCurrentThreadId () returned 0x970 [0055.028] GetCurrentThreadId () returned 0x970 [0055.029] GetCurrentThreadId () returned 0x970 [0055.029] GetCurrentThreadId () returned 0x970 [0055.029] GetCurrentThreadId () returned 0x970 [0055.029] GetCurrentThreadId () returned 0x970 [0055.029] GetCurrentThreadId () returned 0x970 [0055.029] GetCurrentThreadId () returned 0x970 [0055.029] GetCurrentThreadId () returned 0x970 [0055.029] GetCurrentThreadId () returned 0x970 [0055.029] GetCurrentThreadId () returned 0x970 [0055.029] GetCurrentThreadId () returned 0x970 [0055.029] GetCurrentThreadId () returned 0x970 [0055.029] GetCurrentThreadId () returned 0x970 [0055.029] GetCurrentThreadId () returned 0x970 [0055.029] GetCurrentThreadId () returned 0x970 [0055.029] GetCurrentThreadId () returned 0x970 [0055.029] GetCurrentThreadId () returned 0x970 [0055.029] GetCurrentThreadId () returned 0x970 [0055.029] GetCurrentThreadId () returned 0x970 [0055.029] GetCurrentThreadId () returned 0x970 [0055.029] GetCurrentThreadId () returned 0x970 [0055.029] GetCurrentThreadId () returned 0x970 [0055.029] GetCurrentThreadId () returned 0x970 [0055.029] GetCurrentThreadId () returned 0x970 [0055.029] GetCurrentThreadId () returned 0x970 [0055.029] GetCurrentThreadId () returned 0x970 [0055.029] GetCurrentThreadId () returned 0x970 [0055.029] GetCurrentThreadId () returned 0x970 [0055.029] GetCurrentThreadId () returned 0x970 [0055.029] GetCurrentThreadId () returned 0x970 [0055.029] GetCurrentThreadId () returned 0x970 [0055.029] GetCurrentThreadId () returned 0x970 [0055.029] GetCurrentThreadId () returned 0x970 [0055.029] GetCurrentThreadId () returned 0x970 [0055.029] GetCurrentThreadId () returned 0x970 [0055.029] GetCurrentThreadId () returned 0x970 [0055.029] GetCurrentThreadId () returned 0x970 [0055.029] GetCurrentThreadId () returned 0x970 [0055.029] GetCurrentThreadId () returned 0x970 [0055.029] GetCurrentThreadId () returned 0x970 [0055.029] GetCurrentThreadId () returned 0x970 [0055.029] GetCurrentThreadId () returned 0x970 [0055.029] GetCurrentThreadId () returned 0x970 [0055.029] GetCurrentThreadId () returned 0x970 [0055.029] GetCurrentThreadId () returned 0x970 [0055.029] GetCurrentThreadId () returned 0x970 [0055.030] GetCurrentThreadId () returned 0x970 [0055.030] GetCurrentThreadId () returned 0x970 [0055.030] GetCurrentThreadId () returned 0x970 [0055.030] GetCurrentThreadId () returned 0x970 [0055.030] GetCurrentThreadId () returned 0x970 [0055.030] GetCurrentThreadId () returned 0x970 [0055.030] GetCurrentThreadId () returned 0x970 [0055.030] GetCurrentThreadId () returned 0x970 [0055.030] GetCurrentThreadId () returned 0x970 [0055.030] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.030] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.030] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fed170, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0055.030] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.030] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.030] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fed170, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0055.030] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.030] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.030] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0055.030] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.030] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.030] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0055.030] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.030] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.030] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fed1d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0055.030] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.030] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.030] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fed1d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0055.030] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.030] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.030] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fed1d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0055.030] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2, wMilliseconds=0x13a)) [0055.030] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Bz>dj6#%lv}aV5(Rk)tNZy&g<3T32agi", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0055.030] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Bz>dj6#%lv}aV5(Rk)tNZy&g<3T32agi", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0055.030] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Bz>dj6#%lv}aV5(Rk)tNZy&g<3T32agi", cchWideChar=32, lpMultiByteStr=0x20016a8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Bz>dj6#%lv}aV5(Rk)tNZy&g<3T32agi", lpUsedDefaultChar=0x0) returned 32 [0055.031] GetCurrentThreadId () returned 0x970 [0055.031] GetCurrentThreadId () returned 0x970 [0055.031] GetCurrentThreadId () returned 0x970 [0055.031] GetCurrentThreadId () returned 0x970 [0055.031] GetCurrentThreadId () returned 0x970 [0055.031] GetCurrentThreadId () returned 0x970 [0055.038] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0055.038] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0055.038] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x34f2b88, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0055.038] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0055.038] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAADwMz2bDMsbWCEIPPfuxYv1SiENcJLK3FJNS43hFFf8gXz+4lYZoGS1A9ZR2IOs2MljNG/F7IhKeKaClTp3yhiU+Wfp4J8ynPz5evqIRkC67c7uH6Kuar367nYwdNdQgXGgGXUEqWNXTgmVAO9rbQpvfo0/TOenGFlmjmNiOvIk7Dp61bRUM760gEsxr0Cefuvj9c8Xg0HQzQckdVaaTpIRWN9az8/a78w==") returned 232 [0055.038] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2, wMilliseconds=0x14a)) [0055.038] GetCurrentThreadId () returned 0x970 [0055.038] GetCurrentThreadId () returned 0x970 [0055.038] GetCurrentThreadId () returned 0x970 [0055.038] GetCurrentThreadId () returned 0x970 [0055.038] GetCurrentThreadId () returned 0x970 [0055.038] GetCurrentThreadId () returned 0x970 [0055.038] GetCurrentThreadId () returned 0x970 [0055.038] GetCurrentThreadId () returned 0x970 [0055.038] GetCurrentThreadId () returned 0x970 [0055.038] GetCurrentThreadId () returned 0x970 [0055.038] GetCurrentThreadId () returned 0x970 [0055.038] GetCurrentThreadId () returned 0x970 [0055.038] GetCurrentThreadId () returned 0x970 [0055.038] GetCurrentThreadId () returned 0x970 [0055.038] GetCurrentThreadId () returned 0x970 [0055.038] GetCurrentThreadId () returned 0x970 [0055.038] GetCurrentThreadId () returned 0x970 [0055.038] GetCurrentThreadId () returned 0x970 [0055.038] GetCurrentThreadId () returned 0x970 [0055.038] GetCurrentThreadId () returned 0x970 [0055.038] GetCurrentThreadId () returned 0x970 [0055.038] GetCurrentThreadId () returned 0x970 [0055.038] GetCurrentThreadId () returned 0x970 [0055.039] GetCurrentThreadId () returned 0x970 [0055.039] GetCurrentThreadId () returned 0x970 [0055.039] GetCurrentThreadId () returned 0x970 [0055.039] GetCurrentThreadId () returned 0x970 [0055.039] GetCurrentThreadId () returned 0x970 [0055.039] GetCurrentThreadId () returned 0x970 [0055.039] GetCurrentThreadId () returned 0x970 [0055.039] GetCurrentThreadId () returned 0x970 [0055.039] GetCurrentThreadId () returned 0x970 [0055.039] GetCurrentThreadId () returned 0x970 [0055.039] GetCurrentThreadId () returned 0x970 [0055.039] GetCurrentThreadId () returned 0x970 [0055.039] GetCurrentThreadId () returned 0x970 [0055.039] GetCurrentThreadId () returned 0x970 [0055.039] GetCurrentThreadId () returned 0x970 [0055.039] GetCurrentThreadId () returned 0x970 [0055.039] GetCurrentThreadId () returned 0x970 [0055.039] GetCurrentThreadId () returned 0x970 [0055.039] GetCurrentThreadId () returned 0x970 [0055.039] GetCurrentThreadId () returned 0x970 [0055.039] GetCurrentThreadId () returned 0x970 [0055.039] GetCurrentThreadId () returned 0x970 [0055.039] GetCurrentThreadId () returned 0x970 [0055.039] GetCurrentThreadId () returned 0x970 [0055.039] GetCurrentThreadId () returned 0x970 [0055.039] GetCurrentThreadId () returned 0x970 [0055.039] GetCurrentThreadId () returned 0x970 [0055.039] GetCurrentThreadId () returned 0x970 [0055.039] GetCurrentThreadId () returned 0x970 [0055.039] GetCurrentThreadId () returned 0x970 [0055.039] GetCurrentThreadId () returned 0x970 [0055.039] GetCurrentThreadId () returned 0x970 [0055.039] GetCurrentThreadId () returned 0x970 [0055.039] GetCurrentThreadId () returned 0x970 [0055.039] GetCurrentThreadId () returned 0x970 [0055.039] GetCurrentThreadId () returned 0x970 [0055.039] GetCurrentThreadId () returned 0x970 [0055.039] GetCurrentThreadId () returned 0x970 [0055.039] GetCurrentThreadId () returned 0x970 [0055.039] GetCurrentThreadId () returned 0x970 [0055.039] GetCurrentThreadId () returned 0x970 [0055.039] GetCurrentThreadId () returned 0x970 [0055.039] GetCurrentThreadId () returned 0x970 [0055.039] GetCurrentThreadId () returned 0x970 [0055.039] GetCurrentThreadId () returned 0x970 [0055.039] GetCurrentThreadId () returned 0x970 [0055.039] GetCurrentThreadId () returned 0x970 [0055.039] GetCurrentThreadId () returned 0x970 [0055.040] GetCurrentThreadId () returned 0x970 [0055.040] GetCurrentThreadId () returned 0x970 [0055.040] GetCurrentThreadId () returned 0x970 [0055.040] GetCurrentThreadId () returned 0x970 [0055.040] GetCurrentThreadId () returned 0x970 [0055.040] GetCurrentThreadId () returned 0x970 [0055.040] GetCurrentThreadId () returned 0x970 [0055.040] GetCurrentThreadId () returned 0x970 [0055.040] GetCurrentThreadId () returned 0x970 [0055.040] GetCurrentThreadId () returned 0x970 [0055.040] GetCurrentThreadId () returned 0x970 [0055.040] GetCurrentThreadId () returned 0x970 [0055.040] GetCurrentThreadId () returned 0x970 [0055.040] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAADwMz2bDMsbWCEIPPfuxYv1SiENcJLK3FJNS43hFFf8gXz+4lYZoGS1A9ZR2IOs2MljNG/F7IhKeKaClTp3yhiU+Wfp4J8ynPz5evqIRkC67c7uH6Kuar367nYwdNdQgXGgGXUEqWNXTgmVAO9rbQpvfo0/TOenGFlmjmNiOvIk7Dp61bRUM760gEsxr0Cefuvj9c8Xg0HQzQckdVaaTpIRWN9az8/a78w==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0055.040] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAADwMz2bDMsbWCEIPPfuxYv1SiENcJLK3FJNS43hFFf8gXz+4lYZoGS1A9ZR2IOs2MljNG/F7IhKeKaClTp3yhiU+Wfp4J8ynPz5evqIRkC67c7uH6Kuar367nYwdNdQgXGgGXUEqWNXTgmVAO9rbQpvfo0/TOenGFlmjmNiOvIk7Dp61bRUM760gEsxr0Cefuvj9c8Xg0HQzQckdVaaTpIRWN9az8/a78w==", cchWideChar=245, lpMultiByteStr=0x353933c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAADwMz2bDMsbWCEIPPfuxYv1SiENcJLK3FJNS43hFFf8gXz+4lYZoGS1A9ZR2IOs2MljNG/F7IhKeKaClTp3yhiU+Wfp4J8ynPz5evqIRkC67c7uH6Kuar367nYwdNdQgXGgGXUEqWNXTgmVAO9rbQpvfo0/TOenGFlmjmNiOvIk7Dp61bRUM760gEsxr0Cefuvj9c8Xg0HQzQckdVaaTpIRWN9az8/a78w==", lpUsedDefaultChar=0x0) returned 245 [0055.040] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0055.040] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0055.040] CloseHandle (hObject=0x158) returned 1 [0055.041] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml")) returned 0 [0055.041] GetLastError () returned 0x5 [0055.041] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml")) returned 0x20 [0055.041] SetLastError (dwErrCode=0x5) [0055.041] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=17530438584) returned 1 [0055.041] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Файл зашифрован [ipssrb.xml].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\Файл зашифрован [ipssrb.xml].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0055.041] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0055.041] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0055.042] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0055.042] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0055.042] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0055.042] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0055.042] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0055.042] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0055.042] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0055.042] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0055.042] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0055.042] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0055.042] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0055.042] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0055.042] SetEndOfFile (hFile=0x158) returned 1 [0055.042] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0055.042] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0055.042] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0055.042] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0055.043] WriteFile (in: hFile=0x158, lpBuffer=0x361ff08*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x361ff08*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0055.043] WriteFile (in: hFile=0x158, lpBuffer=0x35f005c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f005c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0055.043] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="iV-Z3QFKQjU82-nDVsDFN)C.VZXGY/D.", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0055.043] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="iV-Z3QFKQjU82-nDVsDFN)C.VZXGY/D.", cchWideChar=32, lpMultiByteStr=0x2033afc, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iV-Z3QFKQjU82-nDVsDFN)C.VZXGY/D.", lpUsedDefaultChar=0x0) returned 32 [0055.043] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0055.043] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0055.044] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27da09b6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27da09b6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssrb.xml", cAlternateFileName="")) returned 0x295098 [0055.044] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0055.044] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0055.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml")) returned 0x20 [0055.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml")) returned 0x20 [0055.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml")) returned 0x20 [0055.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml")) returned 0x20 [0055.044] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27da09b6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27da09b6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa08)) returned 1 [0055.044] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0055.044] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0055.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml")) returned 0x20 [0055.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml")) returned 0x20 [0055.044] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0055.045] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0055.045] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0055.045] SetEndOfFile (hFile=0x158) returned 1 [0055.045] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipssrb.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.045] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipssrb.xml", cchWideChar=10, lpMultiByteStr=0x1fe430c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipssrb.xml", lpUsedDefaultChar=0x0) returned 10 [0055.045] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipssrb.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.046] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipssrb.xml", cchWideChar=10, lpMultiByteStr=0x1fe35ac, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipssrb.xml", lpUsedDefaultChar=0x0) returned 10 [0055.046] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe35ac, cbMultiByte=10, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="ipssrb.xmlatattmli\x01") returned 10 [0055.046] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipssrb.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.046] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipssrb.xml", cchWideChar=10, lpMultiByteStr=0x1fe430c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipssrb.xml", lpUsedDefaultChar=0x0) returned 10 [0055.046] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0055.046] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0055.046] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0xa08 [0055.046] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0055.046] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0055.046] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0055.046] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipssrb.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.046] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipssrb.xml", cchWideChar=10, lpMultiByteStr=0x1fe430c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipssrb.xml", lpUsedDefaultChar=0x0) returned 10 [0055.046] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipssrb.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.046] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipssrb.xml", cchWideChar=10, lpMultiByteStr=0x1fe35ac, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipssrb.xml", lpUsedDefaultChar=0x0) returned 10 [0055.046] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe35ac, cbMultiByte=10, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="ipssrb.xmlrb.xmlatattmli\x01") returned 10 [0055.046] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipssrb.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.046] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipssrb.xml", cchWideChar=10, lpMultiByteStr=0x1fe430c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipssrb.xml", lpUsedDefaultChar=0x0) returned 10 [0055.046] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0055.047] CharToOemA (in: pSrc="ipssrb.xml", pDst=0x1fe35ac | out: pDst="ipssrb.xml") returned 1 [0055.047] WriteFile (in: hFile=0x158, lpBuffer=0x1fe35ac*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe35ac*, lpNumberOfBytesWritten=0x18e048*=0xa, lpOverlapped=0x0) returned 1 [0055.047] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0055.047] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0055.048] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0055.048] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=17531108365) returned 1 [0055.048] ReadFile (in: hFile=0x11c, lpBuffer=0x378d0a0, nNumberOfBytesToRead=0xa08, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x378d0a0*, lpNumberOfBytesRead=0x18dd7c*=0xa08, lpOverlapped=0x0) returned 1 [0055.049] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0055.049] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=17531262572) returned 1 [0055.058] WriteFile (in: hFile=0x158, lpBuffer=0x1fea2b8*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fea2b8*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0055.058] ReadFile (in: hFile=0x11c, lpBuffer=0x378d0a0, nNumberOfBytesToRead=0xa08, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x378d0a0*, lpNumberOfBytesRead=0x18de38*=0xa08, lpOverlapped=0x0) returned 1 [0055.058] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x45 [0055.058] WriteFile (in: hFile=0x158, lpBuffer=0x378dad0*, nNumberOfBytesToWrite=0xa08, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x378dad0*, lpNumberOfBytesWritten=0x18de10*=0xa08, lpOverlapped=0x0) returned 1 [0055.058] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0xa4d [0055.058] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0055.058] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0055.058] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0055.058] SetFilePointer (in: hFile=0x158, lDistanceToMove=10, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x28 [0055.058] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0xa57 [0055.059] CloseHandle (hObject=0x11c) returned 1 [0055.059] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xa57 [0055.059] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xa57 [0055.059] SetFilePointer (in: hFile=0x158, lDistanceToMove=2647, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xa57 [0055.059] SetFilePointer (in: hFile=0x158, lDistanceToMove=2647, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0xa57 [0055.059] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xa57 [0055.059] SetFilePointer (in: hFile=0x158, lDistanceToMove=2647, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0xa57 [0055.059] SetEndOfFile (hFile=0x158) returned 1 [0055.059] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xa57 [0055.059] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xa57 [0055.059] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipssrb.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.059] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipssrb.xml", cchWideChar=10, lpMultiByteStr=0x1fe430c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipssrb.xml", lpUsedDefaultChar=0x0) returned 10 [0055.059] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipssrb.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.059] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipssrb.xml", cchWideChar=10, lpMultiByteStr=0x1fe3bac, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipssrb.xml", lpUsedDefaultChar=0x0) returned 10 [0055.059] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe3bac, cbMultiByte=10, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="ipssrb.xml\x18ꞗ@涤(\x18믉`믑`") returned 10 [0055.059] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipssrb.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.059] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipssrb.xml", cchWideChar=10, lpMultiByteStr=0x1fe430c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipssrb.xml", lpUsedDefaultChar=0x0) returned 10 [0055.059] WriteFile (in: hFile=0x158, lpBuffer=0x3770b58*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3770b58*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0055.060] CharToOemA (in: pSrc="ipssrb.xml", pDst=0x1fe3bac | out: pDst="ipssrb.xml") returned 1 [0055.060] WriteFile (in: hFile=0x158, lpBuffer=0x1fe3bac*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe3bac*, lpNumberOfBytesWritten=0x18efcc*=0xa, lpOverlapped=0x0) returned 1 [0055.060] WriteFile (in: hFile=0x158, lpBuffer=0x1fea2d8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea2d8*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0055.060] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0055.060] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0055.060] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xa9a [0055.060] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xa9a [0055.060] WriteFile (in: hFile=0x158, lpBuffer=0x361ff08*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x361ff08*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0055.060] WriteFile (in: hFile=0x158, lpBuffer=0x35f005c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f005c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0055.060] DeleteFileW (lpFileName="") returned 0 [0055.060] GetLastError () returned 0x3 [0055.060] GetFileAttributesW (lpFileName="") returned 0xffffffff [0055.060] SetLastError (dwErrCode=0x3) [0055.060] FlushFileBuffers (hFile=0x158) returned 1 [0055.063] GetCurrentThreadId () returned 0x970 [0055.063] GetCurrentThreadId () returned 0x970 [0055.063] GetCurrentThreadId () returned 0x970 [0055.063] GetCurrentThreadId () returned 0x970 [0055.063] GetCurrentThreadId () returned 0x970 [0055.063] GetCurrentThreadId () returned 0x970 [0055.063] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xb51 [0055.063] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xb51 [0055.063] SetFilePointer (in: hFile=0x158, lDistanceToMove=2897, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xb51 [0055.063] CloseHandle (hObject=0x158) returned 1 [0055.063] GetCurrentThreadId () returned 0x970 [0055.064] GetCurrentThreadId () returned 0x970 [0055.064] GetCurrentThreadId () returned 0x970 [0055.064] GetCurrentThreadId () returned 0x970 [0055.064] GetCurrentThreadId () returned 0x970 [0055.064] GetCurrentThreadId () returned 0x970 [0055.064] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Файл зашифрован [ipssrb.xml].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\Файл зашифрован [ipssrb.xml].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0055.064] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb51 [0055.064] SetFilePointer (in: hFile=0x158, lDistanceToMove=2769, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xad1 [0055.064] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0055.064] GetFileType (hFile=0x158) returned 0x1 [0055.064] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2, wMilliseconds=0x159)) [0055.064] GetCurrentThreadId () returned 0x970 [0055.064] GetCurrentThreadId () returned 0x970 [0055.064] GetCurrentThreadId () returned 0x970 [0055.064] GetCurrentThreadId () returned 0x970 [0055.064] GetCurrentThreadId () returned 0x970 [0055.064] GetCurrentThreadId () returned 0x970 [0055.064] GetCurrentThreadId () returned 0x970 [0055.064] GetCurrentThreadId () returned 0x970 [0055.064] GetCurrentThreadId () returned 0x970 [0055.064] GetCurrentThreadId () returned 0x970 [0055.064] GetCurrentThreadId () returned 0x970 [0055.064] GetCurrentThreadId () returned 0x970 [0055.064] GetCurrentThreadId () returned 0x970 [0055.064] GetCurrentThreadId () returned 0x970 [0055.064] GetCurrentThreadId () returned 0x970 [0055.064] GetCurrentThreadId () returned 0x970 [0055.064] GetCurrentThreadId () returned 0x970 [0055.064] GetCurrentThreadId () returned 0x970 [0055.064] GetCurrentThreadId () returned 0x970 [0055.064] GetCurrentThreadId () returned 0x970 [0055.064] GetCurrentThreadId () returned 0x970 [0055.064] GetCurrentThreadId () returned 0x970 [0055.064] GetCurrentThreadId () returned 0x970 [0055.064] GetCurrentThreadId () returned 0x970 [0055.064] GetCurrentThreadId () returned 0x970 [0055.064] GetCurrentThreadId () returned 0x970 [0055.065] GetCurrentThreadId () returned 0x970 [0055.065] GetCurrentThreadId () returned 0x970 [0055.065] GetCurrentThreadId () returned 0x970 [0055.065] GetCurrentThreadId () returned 0x970 [0055.065] GetCurrentThreadId () returned 0x970 [0055.065] GetCurrentThreadId () returned 0x970 [0055.065] GetCurrentThreadId () returned 0x970 [0055.065] GetCurrentThreadId () returned 0x970 [0055.065] GetCurrentThreadId () returned 0x970 [0055.065] GetCurrentThreadId () returned 0x970 [0055.065] GetCurrentThreadId () returned 0x970 [0055.065] GetCurrentThreadId () returned 0x970 [0055.065] GetCurrentThreadId () returned 0x970 [0055.065] GetCurrentThreadId () returned 0x970 [0055.065] GetCurrentThreadId () returned 0x970 [0055.065] GetCurrentThreadId () returned 0x970 [0055.065] GetCurrentThreadId () returned 0x970 [0055.065] GetCurrentThreadId () returned 0x970 [0055.065] GetCurrentThreadId () returned 0x970 [0055.065] GetCurrentThreadId () returned 0x970 [0055.065] GetCurrentThreadId () returned 0x970 [0055.065] GetCurrentThreadId () returned 0x970 [0055.065] GetCurrentThreadId () returned 0x970 [0055.065] GetCurrentThreadId () returned 0x970 [0055.065] GetCurrentThreadId () returned 0x970 [0055.065] GetCurrentThreadId () returned 0x970 [0055.065] GetCurrentThreadId () returned 0x970 [0055.065] GetCurrentThreadId () returned 0x970 [0055.065] GetCurrentThreadId () returned 0x970 [0055.065] GetCurrentThreadId () returned 0x970 [0055.065] GetCurrentThreadId () returned 0x970 [0055.065] GetCurrentThreadId () returned 0x970 [0055.065] GetCurrentThreadId () returned 0x970 [0055.065] GetCurrentThreadId () returned 0x970 [0055.065] GetCurrentThreadId () returned 0x970 [0055.065] GetCurrentThreadId () returned 0x970 [0055.065] GetCurrentThreadId () returned 0x970 [0055.065] GetCurrentThreadId () returned 0x970 [0055.065] GetCurrentThreadId () returned 0x970 [0055.065] GetCurrentThreadId () returned 0x970 [0055.065] GetCurrentThreadId () returned 0x970 [0055.065] GetCurrentThreadId () returned 0x970 [0055.065] GetCurrentThreadId () returned 0x970 [0055.065] GetCurrentThreadId () returned 0x970 [0055.065] GetCurrentThreadId () returned 0x970 [0055.065] GetCurrentThreadId () returned 0x970 [0055.066] GetCurrentThreadId () returned 0x970 [0055.066] GetCurrentThreadId () returned 0x970 [0055.066] GetCurrentThreadId () returned 0x970 [0055.066] GetCurrentThreadId () returned 0x970 [0055.066] GetCurrentThreadId () returned 0x970 [0055.066] GetCurrentThreadId () returned 0x970 [0055.066] GetCurrentThreadId () returned 0x970 [0055.066] GetCurrentThreadId () returned 0x970 [0055.066] GetCurrentThreadId () returned 0x970 [0055.066] GetCurrentThreadId () returned 0x970 [0055.066] GetCurrentThreadId () returned 0x970 [0055.066] GetCurrentThreadId () returned 0x970 [0055.066] GetCurrentThreadId () returned 0x970 [0055.066] GetCurrentThreadId () returned 0x970 [0055.066] GetCurrentThreadId () returned 0x970 [0055.066] GetCurrentThreadId () returned 0x970 [0055.066] GetCurrentThreadId () returned 0x970 [0055.066] GetCurrentThreadId () returned 0x970 [0055.066] GetCurrentThreadId () returned 0x970 [0055.066] GetCurrentThreadId () returned 0x970 [0055.066] GetCurrentThreadId () returned 0x970 [0055.066] GetCurrentThreadId () returned 0x970 [0055.066] GetCurrentThreadId () returned 0x970 [0055.066] GetCurrentThreadId () returned 0x970 [0055.066] GetCurrentThreadId () returned 0x970 [0055.066] GetCurrentThreadId () returned 0x970 [0055.066] GetCurrentThreadId () returned 0x970 [0055.066] GetCurrentThreadId () returned 0x970 [0055.066] GetCurrentThreadId () returned 0x970 [0055.066] GetCurrentThreadId () returned 0x970 [0055.066] GetCurrentThreadId () returned 0x970 [0055.066] GetCurrentThreadId () returned 0x970 [0055.066] GetCurrentThreadId () returned 0x970 [0055.066] GetCurrentThreadId () returned 0x970 [0055.066] GetCurrentThreadId () returned 0x970 [0055.066] GetCurrentThreadId () returned 0x970 [0055.066] GetCurrentThreadId () returned 0x970 [0055.066] GetCurrentThreadId () returned 0x970 [0055.066] GetCurrentThreadId () returned 0x970 [0055.066] GetCurrentThreadId () returned 0x970 [0055.067] GetCurrentThreadId () returned 0x970 [0055.067] GetCurrentThreadId () returned 0x970 [0055.067] GetCurrentThreadId () returned 0x970 [0055.067] GetCurrentThreadId () returned 0x970 [0055.067] GetCurrentThreadId () returned 0x970 [0055.067] GetCurrentThreadId () returned 0x970 [0055.067] GetCurrentThreadId () returned 0x970 [0055.067] GetCurrentThreadId () returned 0x970 [0055.067] GetCurrentThreadId () returned 0x970 [0055.067] GetCurrentThreadId () returned 0x970 [0055.067] GetCurrentThreadId () returned 0x970 [0055.067] GetCurrentThreadId () returned 0x970 [0055.067] GetCurrentThreadId () returned 0x970 [0055.067] GetCurrentThreadId () returned 0x970 [0055.067] GetCurrentThreadId () returned 0x970 [0055.067] GetCurrentThreadId () returned 0x970 [0055.067] GetCurrentThreadId () returned 0x970 [0055.067] GetCurrentThreadId () returned 0x970 [0055.067] GetCurrentThreadId () returned 0x970 [0055.067] GetCurrentThreadId () returned 0x970 [0055.067] GetCurrentThreadId () returned 0x970 [0055.067] GetCurrentThreadId () returned 0x970 [0055.067] GetCurrentThreadId () returned 0x970 [0055.067] GetCurrentThreadId () returned 0x970 [0055.067] GetCurrentThreadId () returned 0x970 [0055.067] GetCurrentThreadId () returned 0x970 [0055.067] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.067] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.067] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fed1d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0055.067] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.067] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.067] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fed1d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0055.067] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.067] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.067] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0055.067] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.067] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.067] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0055.067] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.067] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.067] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fed230, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0055.068] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.068] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.068] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fed230, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0055.068] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.068] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.068] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fed230, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0055.068] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2, wMilliseconds=0x169)) [0055.068] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="iV-Z3QFKQjU82-nDVsDFN)C.VZXGY/D.", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0055.068] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="iV-Z3QFKQjU82-nDVsDFN)C.VZXGY/D.", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0055.068] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="iV-Z3QFKQjU82-nDVsDFN)C.VZXGY/D.", cchWideChar=32, lpMultiByteStr=0x20016d8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iV-Z3QFKQjU82-nDVsDFN)C.VZXGY/D.", lpUsedDefaultChar=0x0) returned 32 [0055.068] GetCurrentThreadId () returned 0x970 [0055.068] GetCurrentThreadId () returned 0x970 [0055.068] GetCurrentThreadId () returned 0x970 [0055.068] GetCurrentThreadId () returned 0x970 [0055.068] GetCurrentThreadId () returned 0x970 [0055.068] GetCurrentThreadId () returned 0x970 [0055.075] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0055.075] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0055.075] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x34f2c78, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0055.075] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0055.075] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAENZXURNxFcFOJ3/8AOgS9ZlFbRmuEYWpO5jzegdLNC9/wCjuWIk3+uE+f8w0ZPbJAUyoSzdOLP0Ofv6SdduXGa0XXFer7z14hOUX5LxRLdoMEDz+k0PnBLQoaauoKHJxKIdOPAlbYL0Ed1Kp/eEHKFbTU3PGlYQLyWOtf7El97Gc/ogRaaqD3fhiv6fzOXiyo6hr754jPeaz0qBAa3uX+8ZLjHcBzRxAg==") returned 232 [0055.075] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2, wMilliseconds=0x169)) [0055.075] GetCurrentThreadId () returned 0x970 [0055.075] GetCurrentThreadId () returned 0x970 [0055.075] GetCurrentThreadId () returned 0x970 [0055.075] GetCurrentThreadId () returned 0x970 [0055.075] GetCurrentThreadId () returned 0x970 [0055.075] GetCurrentThreadId () returned 0x970 [0055.075] GetCurrentThreadId () returned 0x970 [0055.076] GetCurrentThreadId () returned 0x970 [0055.076] GetCurrentThreadId () returned 0x970 [0055.076] GetCurrentThreadId () returned 0x970 [0055.076] GetCurrentThreadId () returned 0x970 [0055.076] GetCurrentThreadId () returned 0x970 [0055.076] GetCurrentThreadId () returned 0x970 [0055.076] GetCurrentThreadId () returned 0x970 [0055.076] GetCurrentThreadId () returned 0x970 [0055.076] GetCurrentThreadId () returned 0x970 [0055.076] GetCurrentThreadId () returned 0x970 [0055.076] GetCurrentThreadId () returned 0x970 [0055.076] GetCurrentThreadId () returned 0x970 [0055.076] GetCurrentThreadId () returned 0x970 [0055.076] GetCurrentThreadId () returned 0x970 [0055.076] GetCurrentThreadId () returned 0x970 [0055.076] GetCurrentThreadId () returned 0x970 [0055.076] GetCurrentThreadId () returned 0x970 [0055.076] GetCurrentThreadId () returned 0x970 [0055.076] GetCurrentThreadId () returned 0x970 [0055.076] GetCurrentThreadId () returned 0x970 [0055.076] GetCurrentThreadId () returned 0x970 [0055.076] GetCurrentThreadId () returned 0x970 [0055.076] GetCurrentThreadId () returned 0x970 [0055.076] GetCurrentThreadId () returned 0x970 [0055.076] GetCurrentThreadId () returned 0x970 [0055.076] GetCurrentThreadId () returned 0x970 [0055.076] GetCurrentThreadId () returned 0x970 [0055.076] GetCurrentThreadId () returned 0x970 [0055.076] GetCurrentThreadId () returned 0x970 [0055.076] GetCurrentThreadId () returned 0x970 [0055.076] GetCurrentThreadId () returned 0x970 [0055.076] GetCurrentThreadId () returned 0x970 [0055.076] GetCurrentThreadId () returned 0x970 [0055.076] GetCurrentThreadId () returned 0x970 [0055.076] GetCurrentThreadId () returned 0x970 [0055.076] GetCurrentThreadId () returned 0x970 [0055.076] GetCurrentThreadId () returned 0x970 [0055.076] GetCurrentThreadId () returned 0x970 [0055.076] GetCurrentThreadId () returned 0x970 [0055.076] GetCurrentThreadId () returned 0x970 [0055.076] GetCurrentThreadId () returned 0x970 [0055.076] GetCurrentThreadId () returned 0x970 [0055.076] GetCurrentThreadId () returned 0x970 [0055.076] GetCurrentThreadId () returned 0x970 [0055.076] GetCurrentThreadId () returned 0x970 [0055.076] GetCurrentThreadId () returned 0x970 [0055.076] GetCurrentThreadId () returned 0x970 [0055.076] GetCurrentThreadId () returned 0x970 [0055.076] GetCurrentThreadId () returned 0x970 [0055.077] GetCurrentThreadId () returned 0x970 [0055.077] GetCurrentThreadId () returned 0x970 [0055.077] GetCurrentThreadId () returned 0x970 [0055.077] GetCurrentThreadId () returned 0x970 [0055.077] GetCurrentThreadId () returned 0x970 [0055.077] GetCurrentThreadId () returned 0x970 [0055.077] GetCurrentThreadId () returned 0x970 [0055.077] GetCurrentThreadId () returned 0x970 [0055.077] GetCurrentThreadId () returned 0x970 [0055.077] GetCurrentThreadId () returned 0x970 [0055.077] GetCurrentThreadId () returned 0x970 [0055.077] GetCurrentThreadId () returned 0x970 [0055.077] GetCurrentThreadId () returned 0x970 [0055.077] GetCurrentThreadId () returned 0x970 [0055.077] GetCurrentThreadId () returned 0x970 [0055.077] GetCurrentThreadId () returned 0x970 [0055.077] GetCurrentThreadId () returned 0x970 [0055.077] GetCurrentThreadId () returned 0x970 [0055.077] GetCurrentThreadId () returned 0x970 [0055.077] GetCurrentThreadId () returned 0x970 [0055.077] GetCurrentThreadId () returned 0x970 [0055.077] GetCurrentThreadId () returned 0x970 [0055.077] GetCurrentThreadId () returned 0x970 [0055.077] GetCurrentThreadId () returned 0x970 [0055.077] GetCurrentThreadId () returned 0x970 [0055.077] GetCurrentThreadId () returned 0x970 [0055.077] GetCurrentThreadId () returned 0x970 [0055.077] GetCurrentThreadId () returned 0x970 [0055.077] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAENZXURNxFcFOJ3/8AOgS9ZlFbRmuEYWpO5jzegdLNC9/wCjuWIk3+uE+f8w0ZPbJAUyoSzdOLP0Ofv6SdduXGa0XXFer7z14hOUX5LxRLdoMEDz+k0PnBLQoaauoKHJxKIdOPAlbYL0Ed1Kp/eEHKFbTU3PGlYQLyWOtf7El97Gc/ogRaaqD3fhiv6fzOXiyo6hr754jPeaz0qBAa3uX+8ZLjHcBzRxAg==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0055.077] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAENZXURNxFcFOJ3/8AOgS9ZlFbRmuEYWpO5jzegdLNC9/wCjuWIk3+uE+f8w0ZPbJAUyoSzdOLP0Ofv6SdduXGa0XXFer7z14hOUX5LxRLdoMEDz+k0PnBLQoaauoKHJxKIdOPAlbYL0Ed1Kp/eEHKFbTU3PGlYQLyWOtf7El97Gc/ogRaaqD3fhiv6fzOXiyo6hr754jPeaz0qBAa3uX+8ZLjHcBzRxAg==", cchWideChar=245, lpMultiByteStr=0x353933c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAENZXURNxFcFOJ3/8AOgS9ZlFbRmuEYWpO5jzegdLNC9/wCjuWIk3+uE+f8w0ZPbJAUyoSzdOLP0Ofv6SdduXGa0XXFer7z14hOUX5LxRLdoMEDz+k0PnBLQoaauoKHJxKIdOPAlbYL0Ed1Kp/eEHKFbTU3PGlYQLyWOtf7El97Gc/ogRaaqD3fhiv6fzOXiyo6hr754jPeaz0qBAa3uX+8ZLjHcBzRxAg==", lpUsedDefaultChar=0x0) returned 245 [0055.077] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0055.077] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0055.077] CloseHandle (hObject=0x158) returned 1 [0055.078] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml")) returned 0 [0055.078] GetLastError () returned 0x5 [0055.078] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml")) returned 0x20 [0055.078] SetLastError (dwErrCode=0x5) [0055.078] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=17534159334) returned 1 [0055.078] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Файл зашифрован [ipssrl.xml].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\Файл зашифрован [ipssrl.xml].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0055.079] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0055.079] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0055.079] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0055.079] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0055.079] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0055.080] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0055.080] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0055.080] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0055.080] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0055.080] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0055.080] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0055.080] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0055.080] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0055.080] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0055.080] SetEndOfFile (hFile=0x158) returned 1 [0055.080] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0055.080] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0055.080] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0055.080] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0055.080] WriteFile (in: hFile=0x158, lpBuffer=0x361ff08*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x361ff08*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0055.081] WriteFile (in: hFile=0x158, lpBuffer=0x35eff9c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35eff9c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0055.081] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Vc0eeZgEl-11c%cdZ23vVt24v,u1NBOn", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0055.081] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Vc0eeZgEl-11c%cdZ23vVt24v,u1NBOn", cchWideChar=32, lpMultiByteStr=0x2033b34, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Vc0eeZgEl-11c%cdZ23vVt24v,u1NBOn", lpUsedDefaultChar=0x0) returned 32 [0055.081] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0055.081] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0055.081] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27dc6b13, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27dc6b13, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa24, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssrl.xml", cAlternateFileName="")) returned 0x295098 [0055.082] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0055.082] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0055.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml")) returned 0x20 [0055.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml")) returned 0x20 [0055.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml")) returned 0x20 [0055.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml")) returned 0x20 [0055.082] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27dc6b13, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27dc6b13, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa24)) returned 1 [0055.082] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0055.082] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0055.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml")) returned 0x20 [0055.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml")) returned 0x20 [0055.082] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0055.083] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0055.083] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0055.083] SetEndOfFile (hFile=0x158) returned 1 [0055.083] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipssrl.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.083] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipssrl.xml", cchWideChar=10, lpMultiByteStr=0x1fe3c4c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipssrl.xml", lpUsedDefaultChar=0x0) returned 10 [0055.083] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipssrl.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.083] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipssrl.xml", cchWideChar=10, lpMultiByteStr=0x1fe376c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipssrl.xml", lpUsedDefaultChar=0x0) returned 10 [0055.083] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe376c, cbMultiByte=10, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="ipssrl.xmlatattmli\x01") returned 10 [0055.084] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipssrl.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.084] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipssrl.xml", cchWideChar=10, lpMultiByteStr=0x1fe3c4c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipssrl.xml", lpUsedDefaultChar=0x0) returned 10 [0055.084] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0055.084] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0055.084] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0xa24 [0055.084] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0055.084] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0055.084] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0055.084] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipssrl.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.084] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipssrl.xml", cchWideChar=10, lpMultiByteStr=0x1fe3c4c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipssrl.xml", lpUsedDefaultChar=0x0) returned 10 [0055.084] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipssrl.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.084] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipssrl.xml", cchWideChar=10, lpMultiByteStr=0x1fe376c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipssrl.xml", lpUsedDefaultChar=0x0) returned 10 [0055.084] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe376c, cbMultiByte=10, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="ipssrl.xmlrl.xmlatattmli\x01") returned 10 [0055.084] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipssrl.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.084] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipssrl.xml", cchWideChar=10, lpMultiByteStr=0x1fe3c4c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipssrl.xml", lpUsedDefaultChar=0x0) returned 10 [0055.084] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0055.085] CharToOemA (in: pSrc="ipssrl.xml", pDst=0x1fe376c | out: pDst="ipssrl.xml") returned 1 [0055.085] WriteFile (in: hFile=0x158, lpBuffer=0x1fe376c*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe376c*, lpNumberOfBytesWritten=0x18e048*=0xa, lpOverlapped=0x0) returned 1 [0055.085] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0055.085] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0055.085] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0055.086] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=17534897167) returned 1 [0055.086] ReadFile (in: hFile=0x11c, lpBuffer=0x378d0a0, nNumberOfBytesToRead=0xa24, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x378d0a0*, lpNumberOfBytesRead=0x18dd7c*=0xa24, lpOverlapped=0x0) returned 1 [0055.087] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0055.087] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=17535029013) returned 1 [0055.095] WriteFile (in: hFile=0x158, lpBuffer=0x1fea228*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fea228*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0055.095] ReadFile (in: hFile=0x11c, lpBuffer=0x378d0a0, nNumberOfBytesToRead=0xa24, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x378d0a0*, lpNumberOfBytesRead=0x18de38*=0xa24, lpOverlapped=0x0) returned 1 [0055.095] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x45 [0055.095] WriteFile (in: hFile=0x158, lpBuffer=0x378dad0*, nNumberOfBytesToWrite=0xa24, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x378dad0*, lpNumberOfBytesWritten=0x18de10*=0xa24, lpOverlapped=0x0) returned 1 [0055.096] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0xa69 [0055.096] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0055.096] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0055.096] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0055.096] SetFilePointer (in: hFile=0x158, lDistanceToMove=10, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x28 [0055.096] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0xa73 [0055.096] CloseHandle (hObject=0x11c) returned 1 [0055.096] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xa73 [0055.096] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xa73 [0055.096] SetFilePointer (in: hFile=0x158, lDistanceToMove=2675, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xa73 [0055.096] SetFilePointer (in: hFile=0x158, lDistanceToMove=2675, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0xa73 [0055.096] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xa73 [0055.096] SetFilePointer (in: hFile=0x158, lDistanceToMove=2675, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0xa73 [0055.096] SetEndOfFile (hFile=0x158) returned 1 [0055.096] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xa73 [0055.097] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xa73 [0055.097] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipssrl.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.097] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipssrl.xml", cchWideChar=10, lpMultiByteStr=0x1fe3c4c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipssrl.xml", lpUsedDefaultChar=0x0) returned 10 [0055.097] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipssrl.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.097] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipssrl.xml", cchWideChar=10, lpMultiByteStr=0x1fe35cc, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipssrl.xml", lpUsedDefaultChar=0x0) returned 10 [0055.097] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe35cc, cbMultiByte=10, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="ipssrl.xml\x18ꞗ@涤(\x18믉`믑`") returned 10 [0055.097] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipssrl.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.097] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipssrl.xml", cchWideChar=10, lpMultiByteStr=0x1fe3c4c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipssrl.xml", lpUsedDefaultChar=0x0) returned 10 [0055.097] WriteFile (in: hFile=0x158, lpBuffer=0x3770b58*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3770b58*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0055.097] CharToOemA (in: pSrc="ipssrl.xml", pDst=0x1fe35cc | out: pDst="ipssrl.xml") returned 1 [0055.097] WriteFile (in: hFile=0x158, lpBuffer=0x1fe35cc*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe35cc*, lpNumberOfBytesWritten=0x18efcc*=0xa, lpOverlapped=0x0) returned 1 [0055.097] WriteFile (in: hFile=0x158, lpBuffer=0x1fea170*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea170*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0055.097] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0055.097] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0055.098] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xab6 [0055.098] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xab6 [0055.098] WriteFile (in: hFile=0x158, lpBuffer=0x361ff08*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x361ff08*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0055.098] WriteFile (in: hFile=0x158, lpBuffer=0x35eff9c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35eff9c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0055.098] DeleteFileW (lpFileName="") returned 0 [0055.098] GetLastError () returned 0x3 [0055.098] GetFileAttributesW (lpFileName="") returned 0xffffffff [0055.098] SetLastError (dwErrCode=0x3) [0055.098] FlushFileBuffers (hFile=0x158) returned 1 [0055.101] GetCurrentThreadId () returned 0x970 [0055.101] GetCurrentThreadId () returned 0x970 [0055.101] GetCurrentThreadId () returned 0x970 [0055.101] GetCurrentThreadId () returned 0x970 [0055.101] GetCurrentThreadId () returned 0x970 [0055.101] GetCurrentThreadId () returned 0x970 [0055.101] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xb6d [0055.102] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xb6d [0055.102] SetFilePointer (in: hFile=0x158, lDistanceToMove=2925, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xb6d [0055.102] CloseHandle (hObject=0x158) returned 1 [0055.102] GetCurrentThreadId () returned 0x970 [0055.102] GetCurrentThreadId () returned 0x970 [0055.102] GetCurrentThreadId () returned 0x970 [0055.102] GetCurrentThreadId () returned 0x970 [0055.102] GetCurrentThreadId () returned 0x970 [0055.102] GetCurrentThreadId () returned 0x970 [0055.102] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Файл зашифрован [ipssrl.xml].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\Файл зашифрован [ipssrl.xml].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0055.103] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb6d [0055.103] SetFilePointer (in: hFile=0x158, lDistanceToMove=2797, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xaed [0055.103] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0055.103] GetFileType (hFile=0x158) returned 0x1 [0055.103] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2, wMilliseconds=0x188)) [0055.103] GetCurrentThreadId () returned 0x970 [0055.103] GetCurrentThreadId () returned 0x970 [0055.103] GetCurrentThreadId () returned 0x970 [0055.103] GetCurrentThreadId () returned 0x970 [0055.103] GetCurrentThreadId () returned 0x970 [0055.103] GetCurrentThreadId () returned 0x970 [0055.103] GetCurrentThreadId () returned 0x970 [0055.103] GetCurrentThreadId () returned 0x970 [0055.103] GetCurrentThreadId () returned 0x970 [0055.103] GetCurrentThreadId () returned 0x970 [0055.103] GetCurrentThreadId () returned 0x970 [0055.103] GetCurrentThreadId () returned 0x970 [0055.103] GetCurrentThreadId () returned 0x970 [0055.103] GetCurrentThreadId () returned 0x970 [0055.103] GetCurrentThreadId () returned 0x970 [0055.103] GetCurrentThreadId () returned 0x970 [0055.103] GetCurrentThreadId () returned 0x970 [0055.103] GetCurrentThreadId () returned 0x970 [0055.103] GetCurrentThreadId () returned 0x970 [0055.103] GetCurrentThreadId () returned 0x970 [0055.103] GetCurrentThreadId () returned 0x970 [0055.103] GetCurrentThreadId () returned 0x970 [0055.103] GetCurrentThreadId () returned 0x970 [0055.103] GetCurrentThreadId () returned 0x970 [0055.103] GetCurrentThreadId () returned 0x970 [0055.103] GetCurrentThreadId () returned 0x970 [0055.103] GetCurrentThreadId () returned 0x970 [0055.103] GetCurrentThreadId () returned 0x970 [0055.103] GetCurrentThreadId () returned 0x970 [0055.103] GetCurrentThreadId () returned 0x970 [0055.103] GetCurrentThreadId () returned 0x970 [0055.103] GetCurrentThreadId () returned 0x970 [0055.103] GetCurrentThreadId () returned 0x970 [0055.103] GetCurrentThreadId () returned 0x970 [0055.104] GetCurrentThreadId () returned 0x970 [0055.104] GetCurrentThreadId () returned 0x970 [0055.104] GetCurrentThreadId () returned 0x970 [0055.104] GetCurrentThreadId () returned 0x970 [0055.104] GetCurrentThreadId () returned 0x970 [0055.104] GetCurrentThreadId () returned 0x970 [0055.104] GetCurrentThreadId () returned 0x970 [0055.104] GetCurrentThreadId () returned 0x970 [0055.104] GetCurrentThreadId () returned 0x970 [0055.104] GetCurrentThreadId () returned 0x970 [0055.104] GetCurrentThreadId () returned 0x970 [0055.104] GetCurrentThreadId () returned 0x970 [0055.104] GetCurrentThreadId () returned 0x970 [0055.104] GetCurrentThreadId () returned 0x970 [0055.104] GetCurrentThreadId () returned 0x970 [0055.104] GetCurrentThreadId () returned 0x970 [0055.104] GetCurrentThreadId () returned 0x970 [0055.104] GetCurrentThreadId () returned 0x970 [0055.104] GetCurrentThreadId () returned 0x970 [0055.104] GetCurrentThreadId () returned 0x970 [0055.104] GetCurrentThreadId () returned 0x970 [0055.104] GetCurrentThreadId () returned 0x970 [0055.104] GetCurrentThreadId () returned 0x970 [0055.104] GetCurrentThreadId () returned 0x970 [0055.104] GetCurrentThreadId () returned 0x970 [0055.104] GetCurrentThreadId () returned 0x970 [0055.104] GetCurrentThreadId () returned 0x970 [0055.104] GetCurrentThreadId () returned 0x970 [0055.104] GetCurrentThreadId () returned 0x970 [0055.104] GetCurrentThreadId () returned 0x970 [0055.104] GetCurrentThreadId () returned 0x970 [0055.104] GetCurrentThreadId () returned 0x970 [0055.104] GetCurrentThreadId () returned 0x970 [0055.104] GetCurrentThreadId () returned 0x970 [0055.104] GetCurrentThreadId () returned 0x970 [0055.104] GetCurrentThreadId () returned 0x970 [0055.104] GetCurrentThreadId () returned 0x970 [0055.104] GetCurrentThreadId () returned 0x970 [0055.104] GetCurrentThreadId () returned 0x970 [0055.104] GetCurrentThreadId () returned 0x970 [0055.104] GetCurrentThreadId () returned 0x970 [0055.104] GetCurrentThreadId () returned 0x970 [0055.104] GetCurrentThreadId () returned 0x970 [0055.104] GetCurrentThreadId () returned 0x970 [0055.104] GetCurrentThreadId () returned 0x970 [0055.104] GetCurrentThreadId () returned 0x970 [0055.104] GetCurrentThreadId () returned 0x970 [0055.104] GetCurrentThreadId () returned 0x970 [0055.104] GetCurrentThreadId () returned 0x970 [0055.105] GetCurrentThreadId () returned 0x970 [0055.105] GetCurrentThreadId () returned 0x970 [0055.105] GetCurrentThreadId () returned 0x970 [0055.105] GetCurrentThreadId () returned 0x970 [0055.105] GetCurrentThreadId () returned 0x970 [0055.105] GetCurrentThreadId () returned 0x970 [0055.105] GetCurrentThreadId () returned 0x970 [0055.105] GetCurrentThreadId () returned 0x970 [0055.105] GetCurrentThreadId () returned 0x970 [0055.105] GetCurrentThreadId () returned 0x970 [0055.105] GetCurrentThreadId () returned 0x970 [0055.105] GetCurrentThreadId () returned 0x970 [0055.105] GetCurrentThreadId () returned 0x970 [0055.105] GetCurrentThreadId () returned 0x970 [0055.105] GetCurrentThreadId () returned 0x970 [0055.105] GetCurrentThreadId () returned 0x970 [0055.105] GetCurrentThreadId () returned 0x970 [0055.105] GetCurrentThreadId () returned 0x970 [0055.105] GetCurrentThreadId () returned 0x970 [0055.105] GetCurrentThreadId () returned 0x970 [0055.105] GetCurrentThreadId () returned 0x970 [0055.105] GetCurrentThreadId () returned 0x970 [0055.105] GetCurrentThreadId () returned 0x970 [0055.105] GetCurrentThreadId () returned 0x970 [0055.105] GetCurrentThreadId () returned 0x970 [0055.105] GetCurrentThreadId () returned 0x970 [0055.105] GetCurrentThreadId () returned 0x970 [0055.105] GetCurrentThreadId () returned 0x970 [0055.105] GetCurrentThreadId () returned 0x970 [0055.105] GetCurrentThreadId () returned 0x970 [0055.105] GetCurrentThreadId () returned 0x970 [0055.105] GetCurrentThreadId () returned 0x970 [0055.105] GetCurrentThreadId () returned 0x970 [0055.105] GetCurrentThreadId () returned 0x970 [0055.105] GetCurrentThreadId () returned 0x970 [0055.105] GetCurrentThreadId () returned 0x970 [0055.105] GetCurrentThreadId () returned 0x970 [0055.105] GetCurrentThreadId () returned 0x970 [0055.105] GetCurrentThreadId () returned 0x970 [0055.105] GetCurrentThreadId () returned 0x970 [0055.105] GetCurrentThreadId () returned 0x970 [0055.105] GetCurrentThreadId () returned 0x970 [0055.105] GetCurrentThreadId () returned 0x970 [0055.105] GetCurrentThreadId () returned 0x970 [0055.105] GetCurrentThreadId () returned 0x970 [0055.105] GetCurrentThreadId () returned 0x970 [0055.106] GetCurrentThreadId () returned 0x970 [0055.106] GetCurrentThreadId () returned 0x970 [0055.106] GetCurrentThreadId () returned 0x970 [0055.106] GetCurrentThreadId () returned 0x970 [0055.106] GetCurrentThreadId () returned 0x970 [0055.106] GetCurrentThreadId () returned 0x970 [0055.106] GetCurrentThreadId () returned 0x970 [0055.106] GetCurrentThreadId () returned 0x970 [0055.106] GetCurrentThreadId () returned 0x970 [0055.106] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.106] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.106] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fed230, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0055.106] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.106] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.106] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fed230, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0055.106] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.106] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.106] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0055.106] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.106] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.106] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0055.106] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.106] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.106] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fed290, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0055.106] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.106] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.106] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fed290, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0055.106] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.106] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.106] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fed290, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0055.106] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2, wMilliseconds=0x188)) [0055.106] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Vc0eeZgEl-11c%cdZ23vVt24v,u1NBOn", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0055.106] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Vc0eeZgEl-11c%cdZ23vVt24v,u1NBOn", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0055.106] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Vc0eeZgEl-11c%cdZ23vVt24v,u1NBOn", cchWideChar=32, lpMultiByteStr=0x2001708, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Vc0eeZgEl-11c%cdZ23vVt24v,u1NBOn", lpUsedDefaultChar=0x0) returned 32 [0055.107] GetCurrentThreadId () returned 0x970 [0055.107] GetCurrentThreadId () returned 0x970 [0055.107] GetCurrentThreadId () returned 0x970 [0055.107] GetCurrentThreadId () returned 0x970 [0055.107] GetCurrentThreadId () returned 0x970 [0055.107] GetCurrentThreadId () returned 0x970 [0055.115] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0055.115] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0055.115] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x34f2d68, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0055.115] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0055.115] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAACGdiI8oaqB3iDyeGh9wO/rTonh3Fc8jeTJ+MTVtwuenDpq7DygSj47uO+8+Lrloyt3t2/4mHnVJziNZpYJxL2SW8HmGs3Q5pH5cAsZ/qWWONowUR91cEAWYMza6j5J0i5ICgkCAh7i39UWjYQRsIE2/d85ANc7MmQSBSoxZwMW0UXmCwtsPX1T71qnsS3O3WOlfaGB1zEFsF/Ya2DqXPANAnH4efoH6UQ==") returned 232 [0055.115] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2, wMilliseconds=0x198)) [0055.115] GetCurrentThreadId () returned 0x970 [0055.115] GetCurrentThreadId () returned 0x970 [0055.115] GetCurrentThreadId () returned 0x970 [0055.115] GetCurrentThreadId () returned 0x970 [0055.115] GetCurrentThreadId () returned 0x970 [0055.116] GetCurrentThreadId () returned 0x970 [0055.116] GetCurrentThreadId () returned 0x970 [0055.116] GetCurrentThreadId () returned 0x970 [0055.116] GetCurrentThreadId () returned 0x970 [0055.116] GetCurrentThreadId () returned 0x970 [0055.116] GetCurrentThreadId () returned 0x970 [0055.116] GetCurrentThreadId () returned 0x970 [0055.116] GetCurrentThreadId () returned 0x970 [0055.116] GetCurrentThreadId () returned 0x970 [0055.116] GetCurrentThreadId () returned 0x970 [0055.116] GetCurrentThreadId () returned 0x970 [0055.116] GetCurrentThreadId () returned 0x970 [0055.116] GetCurrentThreadId () returned 0x970 [0055.116] GetCurrentThreadId () returned 0x970 [0055.116] GetCurrentThreadId () returned 0x970 [0055.116] GetCurrentThreadId () returned 0x970 [0055.116] GetCurrentThreadId () returned 0x970 [0055.116] GetCurrentThreadId () returned 0x970 [0055.116] GetCurrentThreadId () returned 0x970 [0055.116] GetCurrentThreadId () returned 0x970 [0055.116] GetCurrentThreadId () returned 0x970 [0055.116] GetCurrentThreadId () returned 0x970 [0055.116] GetCurrentThreadId () returned 0x970 [0055.116] GetCurrentThreadId () returned 0x970 [0055.116] GetCurrentThreadId () returned 0x970 [0055.116] GetCurrentThreadId () returned 0x970 [0055.116] GetCurrentThreadId () returned 0x970 [0055.116] GetCurrentThreadId () returned 0x970 [0055.116] GetCurrentThreadId () returned 0x970 [0055.116] GetCurrentThreadId () returned 0x970 [0055.116] GetCurrentThreadId () returned 0x970 [0055.116] GetCurrentThreadId () returned 0x970 [0055.116] GetCurrentThreadId () returned 0x970 [0055.116] GetCurrentThreadId () returned 0x970 [0055.116] GetCurrentThreadId () returned 0x970 [0055.116] GetCurrentThreadId () returned 0x970 [0055.116] GetCurrentThreadId () returned 0x970 [0055.116] GetCurrentThreadId () returned 0x970 [0055.116] GetCurrentThreadId () returned 0x970 [0055.116] GetCurrentThreadId () returned 0x970 [0055.116] GetCurrentThreadId () returned 0x970 [0055.116] GetCurrentThreadId () returned 0x970 [0055.116] GetCurrentThreadId () returned 0x970 [0055.116] GetCurrentThreadId () returned 0x970 [0055.116] GetCurrentThreadId () returned 0x970 [0055.116] GetCurrentThreadId () returned 0x970 [0055.116] GetCurrentThreadId () returned 0x970 [0055.116] GetCurrentThreadId () returned 0x970 [0055.117] GetCurrentThreadId () returned 0x970 [0055.117] GetCurrentThreadId () returned 0x970 [0055.117] GetCurrentThreadId () returned 0x970 [0055.117] GetCurrentThreadId () returned 0x970 [0055.117] GetCurrentThreadId () returned 0x970 [0055.117] GetCurrentThreadId () returned 0x970 [0055.117] GetCurrentThreadId () returned 0x970 [0055.117] GetCurrentThreadId () returned 0x970 [0055.117] GetCurrentThreadId () returned 0x970 [0055.117] GetCurrentThreadId () returned 0x970 [0055.117] GetCurrentThreadId () returned 0x970 [0055.117] GetCurrentThreadId () returned 0x970 [0055.117] GetCurrentThreadId () returned 0x970 [0055.117] GetCurrentThreadId () returned 0x970 [0055.117] GetCurrentThreadId () returned 0x970 [0055.117] GetCurrentThreadId () returned 0x970 [0055.117] GetCurrentThreadId () returned 0x970 [0055.117] GetCurrentThreadId () returned 0x970 [0055.117] GetCurrentThreadId () returned 0x970 [0055.117] GetCurrentThreadId () returned 0x970 [0055.117] GetCurrentThreadId () returned 0x970 [0055.117] GetCurrentThreadId () returned 0x970 [0055.117] GetCurrentThreadId () returned 0x970 [0055.117] GetCurrentThreadId () returned 0x970 [0055.117] GetCurrentThreadId () returned 0x970 [0055.117] GetCurrentThreadId () returned 0x970 [0055.117] GetCurrentThreadId () returned 0x970 [0055.117] GetCurrentThreadId () returned 0x970 [0055.117] GetCurrentThreadId () returned 0x970 [0055.117] GetCurrentThreadId () returned 0x970 [0055.117] GetCurrentThreadId () returned 0x970 [0055.117] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAACGdiI8oaqB3iDyeGh9wO/rTonh3Fc8jeTJ+MTVtwuenDpq7DygSj47uO+8+Lrloyt3t2/4mHnVJziNZpYJxL2SW8HmGs3Q5pH5cAsZ/qWWONowUR91cEAWYMza6j5J0i5ICgkCAh7i39UWjYQRsIE2/d85ANc7MmQSBSoxZwMW0UXmCwtsPX1T71qnsS3O3WOlfaGB1zEFsF/Ya2DqXPANAnH4efoH6UQ==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0055.117] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAACGdiI8oaqB3iDyeGh9wO/rTonh3Fc8jeTJ+MTVtwuenDpq7DygSj47uO+8+Lrloyt3t2/4mHnVJziNZpYJxL2SW8HmGs3Q5pH5cAsZ/qWWONowUR91cEAWYMza6j5J0i5ICgkCAh7i39UWjYQRsIE2/d85ANc7MmQSBSoxZwMW0UXmCwtsPX1T71qnsS3O3WOlfaGB1zEFsF/Ya2DqXPANAnH4efoH6UQ==", cchWideChar=245, lpMultiByteStr=0x353933c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAACGdiI8oaqB3iDyeGh9wO/rTonh3Fc8jeTJ+MTVtwuenDpq7DygSj47uO+8+Lrloyt3t2/4mHnVJziNZpYJxL2SW8HmGs3Q5pH5cAsZ/qWWONowUR91cEAWYMza6j5J0i5ICgkCAh7i39UWjYQRsIE2/d85ANc7MmQSBSoxZwMW0UXmCwtsPX1T71qnsS3O3WOlfaGB1zEFsF/Ya2DqXPANAnH4efoH6UQ==", lpUsedDefaultChar=0x0) returned 245 [0055.117] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0055.118] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0055.118] CloseHandle (hObject=0x158) returned 1 [0055.118] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml")) returned 0 [0055.118] GetLastError () returned 0x5 [0055.119] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml")) returned 0x20 [0055.119] SetLastError (dwErrCode=0x5) [0055.119] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=17538204216) returned 1 [0055.119] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Файл зашифрован [ipssve.xml].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\Файл зашифрован [ipssve.xml].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0055.119] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0055.119] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0055.119] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0055.119] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0055.119] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0055.119] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0055.119] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0055.119] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0055.119] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0055.120] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0055.120] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0055.120] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0055.120] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0055.120] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0055.120] SetEndOfFile (hFile=0x158) returned 1 [0055.120] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0055.120] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0055.120] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0055.120] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0055.120] WriteFile (in: hFile=0x158, lpBuffer=0x361ff08*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x361ff08*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0055.121] WriteFile (in: hFile=0x158, lpBuffer=0x35f005c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f005c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0055.121] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="!f5(#43x.l>qGxGCRq5ZYoxDLc16=y/P", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0055.121] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="!f5(#43x.l>qGxGCRq5ZYoxDLc16=y/P", cchWideChar=32, lpMultiByteStr=0x2033b6c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="!f5(#43x.l>qGxGCRq5ZYoxDLc16=y/P", lpUsedDefaultChar=0x0) returned 32 [0055.121] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0055.121] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0055.121] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27decc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27decc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssve.xml", cAlternateFileName="")) returned 0x295098 [0055.121] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0055.121] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0055.121] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml")) returned 0x20 [0055.122] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml")) returned 0x20 [0055.122] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml")) returned 0x20 [0055.122] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml")) returned 0x20 [0055.122] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27decc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27decc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9d8)) returned 1 [0055.122] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0055.122] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0055.122] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml")) returned 0x20 [0055.122] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml")) returned 0x20 [0055.122] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0055.122] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0055.122] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0055.122] SetEndOfFile (hFile=0x158) returned 1 [0055.123] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipssve.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.123] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipssve.xml", cchWideChar=10, lpMultiByteStr=0x1fe43ec, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipssve.xml", lpUsedDefaultChar=0x0) returned 10 [0055.123] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipssve.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.123] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipssve.xml", cchWideChar=10, lpMultiByteStr=0x1fe47cc, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipssve.xml", lpUsedDefaultChar=0x0) returned 10 [0055.123] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe47cc, cbMultiByte=10, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="ipssve.xmlatattmli\x01") returned 10 [0055.123] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipssve.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.123] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipssve.xml", cchWideChar=10, lpMultiByteStr=0x1fe43ec, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipssve.xml", lpUsedDefaultChar=0x0) returned 10 [0055.123] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0055.123] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0055.123] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x9d8 [0055.124] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0055.124] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0055.124] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0055.124] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipssve.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.124] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipssve.xml", cchWideChar=10, lpMultiByteStr=0x1fe43ec, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipssve.xml", lpUsedDefaultChar=0x0) returned 10 [0055.124] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipssve.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.124] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipssve.xml", cchWideChar=10, lpMultiByteStr=0x1fe47cc, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipssve.xml", lpUsedDefaultChar=0x0) returned 10 [0055.124] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe47cc, cbMultiByte=10, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="ipssve.xmlve.xmlatattmli\x01") returned 10 [0055.124] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipssve.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.124] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipssve.xml", cchWideChar=10, lpMultiByteStr=0x1fe43ec, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipssve.xml", lpUsedDefaultChar=0x0) returned 10 [0055.124] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0055.125] CharToOemA (in: pSrc="ipssve.xml", pDst=0x1fe47cc | out: pDst="ipssve.xml") returned 1 [0055.125] WriteFile (in: hFile=0x158, lpBuffer=0x1fe47cc*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe47cc*, lpNumberOfBytesWritten=0x18e048*=0xa, lpOverlapped=0x0) returned 1 [0055.125] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0055.125] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0055.125] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0055.125] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=17538864177) returned 1 [0055.125] ReadFile (in: hFile=0x11c, lpBuffer=0x378d0a0, nNumberOfBytesToRead=0x9d8, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x378d0a0*, lpNumberOfBytesRead=0x18dd7c*=0x9d8, lpOverlapped=0x0) returned 1 [0055.127] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0055.127] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=17539023927) returned 1 [0055.135] WriteFile (in: hFile=0x158, lpBuffer=0x1fea2a0*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fea2a0*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0055.135] ReadFile (in: hFile=0x11c, lpBuffer=0x378d0a0, nNumberOfBytesToRead=0x9d8, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x378d0a0*, lpNumberOfBytesRead=0x18de38*=0x9d8, lpOverlapped=0x0) returned 1 [0055.135] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x45 [0055.136] WriteFile (in: hFile=0x158, lpBuffer=0x378dad0*, nNumberOfBytesToWrite=0x9d8, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x378dad0*, lpNumberOfBytesWritten=0x18de10*=0x9d8, lpOverlapped=0x0) returned 1 [0055.136] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0xa1d [0055.136] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0055.136] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0055.136] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0055.136] SetFilePointer (in: hFile=0x158, lDistanceToMove=10, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x28 [0055.136] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0xa27 [0055.136] CloseHandle (hObject=0x11c) returned 1 [0055.136] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xa27 [0055.136] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xa27 [0055.136] SetFilePointer (in: hFile=0x158, lDistanceToMove=2599, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xa27 [0055.136] SetFilePointer (in: hFile=0x158, lDistanceToMove=2599, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0xa27 [0055.136] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xa27 [0055.136] SetFilePointer (in: hFile=0x158, lDistanceToMove=2599, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0xa27 [0055.137] SetEndOfFile (hFile=0x158) returned 1 [0055.137] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xa27 [0055.137] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xa27 [0055.137] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipssve.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.137] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipssve.xml", cchWideChar=10, lpMultiByteStr=0x1fe43ec, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipssve.xml", lpUsedDefaultChar=0x0) returned 10 [0055.137] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipssve.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.137] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipssve.xml", cchWideChar=10, lpMultiByteStr=0x1fe3bac, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipssve.xml", lpUsedDefaultChar=0x0) returned 10 [0055.137] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe3bac, cbMultiByte=10, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="ipssve.xml\x18ꞗ@涤(\x18믉`믑`") returned 10 [0055.137] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipssve.xml", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.137] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipssve.xml", cchWideChar=10, lpMultiByteStr=0x1fe43ec, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ipssve.xml", lpUsedDefaultChar=0x0) returned 10 [0055.137] WriteFile (in: hFile=0x158, lpBuffer=0x3770b58*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3770b58*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0055.137] CharToOemA (in: pSrc="ipssve.xml", pDst=0x1fe3bac | out: pDst="ipssve.xml") returned 1 [0055.137] WriteFile (in: hFile=0x158, lpBuffer=0x1fe3bac*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe3bac*, lpNumberOfBytesWritten=0x18efcc*=0xa, lpOverlapped=0x0) returned 1 [0055.137] WriteFile (in: hFile=0x158, lpBuffer=0x1fea110*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea110*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0055.137] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0055.137] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0055.137] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xa6a [0055.138] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xa6a [0055.138] WriteFile (in: hFile=0x158, lpBuffer=0x361ff08*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x361ff08*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0055.138] WriteFile (in: hFile=0x158, lpBuffer=0x35f005c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f005c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0055.138] DeleteFileW (lpFileName="") returned 0 [0055.138] GetLastError () returned 0x3 [0055.138] GetFileAttributesW (lpFileName="") returned 0xffffffff [0055.138] SetLastError (dwErrCode=0x3) [0055.138] FlushFileBuffers (hFile=0x158) returned 1 [0055.140] GetCurrentThreadId () returned 0x970 [0055.140] GetCurrentThreadId () returned 0x970 [0055.141] GetCurrentThreadId () returned 0x970 [0055.141] GetCurrentThreadId () returned 0x970 [0055.141] GetCurrentThreadId () returned 0x970 [0055.141] GetCurrentThreadId () returned 0x970 [0055.141] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xb21 [0055.141] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xb21 [0055.141] SetFilePointer (in: hFile=0x158, lDistanceToMove=2849, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xb21 [0055.141] CloseHandle (hObject=0x158) returned 1 [0055.141] GetCurrentThreadId () returned 0x970 [0055.141] GetCurrentThreadId () returned 0x970 [0055.141] GetCurrentThreadId () returned 0x970 [0055.142] GetCurrentThreadId () returned 0x970 [0055.142] GetCurrentThreadId () returned 0x970 [0055.142] GetCurrentThreadId () returned 0x970 [0055.142] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Файл зашифрован [ipssve.xml].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\Файл зашифрован [ipssve.xml].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0055.142] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb21 [0055.142] SetFilePointer (in: hFile=0x158, lDistanceToMove=2721, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xaa1 [0055.142] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0055.142] GetFileType (hFile=0x158) returned 0x1 [0055.142] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2, wMilliseconds=0x1a7)) [0055.142] GetCurrentThreadId () returned 0x970 [0055.142] GetCurrentThreadId () returned 0x970 [0055.142] GetCurrentThreadId () returned 0x970 [0055.142] GetCurrentThreadId () returned 0x970 [0055.142] GetCurrentThreadId () returned 0x970 [0055.142] GetCurrentThreadId () returned 0x970 [0055.142] GetCurrentThreadId () returned 0x970 [0055.142] GetCurrentThreadId () returned 0x970 [0055.142] GetCurrentThreadId () returned 0x970 [0055.142] GetCurrentThreadId () returned 0x970 [0055.142] GetCurrentThreadId () returned 0x970 [0055.142] GetCurrentThreadId () returned 0x970 [0055.142] GetCurrentThreadId () returned 0x970 [0055.142] GetCurrentThreadId () returned 0x970 [0055.142] GetCurrentThreadId () returned 0x970 [0055.142] GetCurrentThreadId () returned 0x970 [0055.142] GetCurrentThreadId () returned 0x970 [0055.142] GetCurrentThreadId () returned 0x970 [0055.142] GetCurrentThreadId () returned 0x970 [0055.142] GetCurrentThreadId () returned 0x970 [0055.142] GetCurrentThreadId () returned 0x970 [0055.142] GetCurrentThreadId () returned 0x970 [0055.142] GetCurrentThreadId () returned 0x970 [0055.142] GetCurrentThreadId () returned 0x970 [0055.142] GetCurrentThreadId () returned 0x970 [0055.142] GetCurrentThreadId () returned 0x970 [0055.142] GetCurrentThreadId () returned 0x970 [0055.143] GetCurrentThreadId () returned 0x970 [0055.143] GetCurrentThreadId () returned 0x970 [0055.143] GetCurrentThreadId () returned 0x970 [0055.143] GetCurrentThreadId () returned 0x970 [0055.143] GetCurrentThreadId () returned 0x970 [0055.143] GetCurrentThreadId () returned 0x970 [0055.143] GetCurrentThreadId () returned 0x970 [0055.143] GetCurrentThreadId () returned 0x970 [0055.143] GetCurrentThreadId () returned 0x970 [0055.143] GetCurrentThreadId () returned 0x970 [0055.143] GetCurrentThreadId () returned 0x970 [0055.143] GetCurrentThreadId () returned 0x970 [0055.143] GetCurrentThreadId () returned 0x970 [0055.143] GetCurrentThreadId () returned 0x970 [0055.143] GetCurrentThreadId () returned 0x970 [0055.143] GetCurrentThreadId () returned 0x970 [0055.143] GetCurrentThreadId () returned 0x970 [0055.143] GetCurrentThreadId () returned 0x970 [0055.143] GetCurrentThreadId () returned 0x970 [0055.143] GetCurrentThreadId () returned 0x970 [0055.143] GetCurrentThreadId () returned 0x970 [0055.143] GetCurrentThreadId () returned 0x970 [0055.143] GetCurrentThreadId () returned 0x970 [0055.143] GetCurrentThreadId () returned 0x970 [0055.143] GetCurrentThreadId () returned 0x970 [0055.143] GetCurrentThreadId () returned 0x970 [0055.143] GetCurrentThreadId () returned 0x970 [0055.143] GetCurrentThreadId () returned 0x970 [0055.143] GetCurrentThreadId () returned 0x970 [0055.143] GetCurrentThreadId () returned 0x970 [0055.143] GetCurrentThreadId () returned 0x970 [0055.143] GetCurrentThreadId () returned 0x970 [0055.143] GetCurrentThreadId () returned 0x970 [0055.143] GetCurrentThreadId () returned 0x970 [0055.143] GetCurrentThreadId () returned 0x970 [0055.143] GetCurrentThreadId () returned 0x970 [0055.143] GetCurrentThreadId () returned 0x970 [0055.143] GetCurrentThreadId () returned 0x970 [0055.143] GetCurrentThreadId () returned 0x970 [0055.143] GetCurrentThreadId () returned 0x970 [0055.143] GetCurrentThreadId () returned 0x970 [0055.143] GetCurrentThreadId () returned 0x970 [0055.143] GetCurrentThreadId () returned 0x970 [0055.143] GetCurrentThreadId () returned 0x970 [0055.143] GetCurrentThreadId () returned 0x970 [0055.143] GetCurrentThreadId () returned 0x970 [0055.143] GetCurrentThreadId () returned 0x970 [0055.143] GetCurrentThreadId () returned 0x970 [0055.144] GetCurrentThreadId () returned 0x970 [0055.144] GetCurrentThreadId () returned 0x970 [0055.144] GetCurrentThreadId () returned 0x970 [0055.144] GetCurrentThreadId () returned 0x970 [0055.144] GetCurrentThreadId () returned 0x970 [0055.144] GetCurrentThreadId () returned 0x970 [0055.144] GetCurrentThreadId () returned 0x970 [0055.144] GetCurrentThreadId () returned 0x970 [0055.144] GetCurrentThreadId () returned 0x970 [0055.144] GetCurrentThreadId () returned 0x970 [0055.144] GetCurrentThreadId () returned 0x970 [0055.144] GetCurrentThreadId () returned 0x970 [0055.144] GetCurrentThreadId () returned 0x970 [0055.144] GetCurrentThreadId () returned 0x970 [0055.144] GetCurrentThreadId () returned 0x970 [0055.144] GetCurrentThreadId () returned 0x970 [0055.144] GetCurrentThreadId () returned 0x970 [0055.144] GetCurrentThreadId () returned 0x970 [0055.144] GetCurrentThreadId () returned 0x970 [0055.144] GetCurrentThreadId () returned 0x970 [0055.144] GetCurrentThreadId () returned 0x970 [0055.144] GetCurrentThreadId () returned 0x970 [0055.144] GetCurrentThreadId () returned 0x970 [0055.144] GetCurrentThreadId () returned 0x970 [0055.144] GetCurrentThreadId () returned 0x970 [0055.144] GetCurrentThreadId () returned 0x970 [0055.144] GetCurrentThreadId () returned 0x970 [0055.144] GetCurrentThreadId () returned 0x970 [0055.144] GetCurrentThreadId () returned 0x970 [0055.144] GetCurrentThreadId () returned 0x970 [0055.144] GetCurrentThreadId () returned 0x970 [0055.144] GetCurrentThreadId () returned 0x970 [0055.144] GetCurrentThreadId () returned 0x970 [0055.144] GetCurrentThreadId () returned 0x970 [0055.144] GetCurrentThreadId () returned 0x970 [0055.144] GetCurrentThreadId () returned 0x970 [0055.144] GetCurrentThreadId () returned 0x970 [0055.144] GetCurrentThreadId () returned 0x970 [0055.144] GetCurrentThreadId () returned 0x970 [0055.144] GetCurrentThreadId () returned 0x970 [0055.144] GetCurrentThreadId () returned 0x970 [0055.144] GetCurrentThreadId () returned 0x970 [0055.144] GetCurrentThreadId () returned 0x970 [0055.144] GetCurrentThreadId () returned 0x970 [0055.144] GetCurrentThreadId () returned 0x970 [0055.144] GetCurrentThreadId () returned 0x970 [0055.145] GetCurrentThreadId () returned 0x970 [0055.145] GetCurrentThreadId () returned 0x970 [0055.145] GetCurrentThreadId () returned 0x970 [0055.145] GetCurrentThreadId () returned 0x970 [0055.145] GetCurrentThreadId () returned 0x970 [0055.145] GetCurrentThreadId () returned 0x970 [0055.145] GetCurrentThreadId () returned 0x970 [0055.145] GetCurrentThreadId () returned 0x970 [0055.145] GetCurrentThreadId () returned 0x970 [0055.145] GetCurrentThreadId () returned 0x970 [0055.145] GetCurrentThreadId () returned 0x970 [0055.145] GetCurrentThreadId () returned 0x970 [0055.145] GetCurrentThreadId () returned 0x970 [0055.145] GetCurrentThreadId () returned 0x970 [0055.145] GetCurrentThreadId () returned 0x970 [0055.145] GetCurrentThreadId () returned 0x970 [0055.145] GetCurrentThreadId () returned 0x970 [0055.145] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.145] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.145] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fed290, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0055.145] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.145] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.145] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fed290, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0055.145] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.145] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.145] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0055.145] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.145] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.145] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0055.145] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.145] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.145] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fed2f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0055.145] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.145] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.145] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fed2f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0055.145] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.145] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.145] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fed2f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0055.146] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2, wMilliseconds=0x1b7)) [0055.146] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="!f5(#43x.l>qGxGCRq5ZYoxDLc16=y/P", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0055.146] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="!f5(#43x.l>qGxGCRq5ZYoxDLc16=y/P", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0055.146] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="!f5(#43x.l>qGxGCRq5ZYoxDLc16=y/P", cchWideChar=32, lpMultiByteStr=0x2001738, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="!f5(#43x.l>qGxGCRq5ZYoxDLc16=y/P", lpUsedDefaultChar=0x0) returned 32 [0055.146] GetCurrentThreadId () returned 0x970 [0055.146] GetCurrentThreadId () returned 0x970 [0055.146] GetCurrentThreadId () returned 0x970 [0055.146] GetCurrentThreadId () returned 0x970 [0055.146] GetCurrentThreadId () returned 0x970 [0055.146] GetCurrentThreadId () returned 0x970 [0055.153] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0055.153] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0055.153] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x34f2e58, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0055.153] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0055.153] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAHpSTi3Zzvqffw8gt4dPsEhPhRFMkTPqnN6uIvVXc96EfFLpJgw95ITHyJRaYPSFmOa4j6/MseKiEJJb6gKdEO1E3krEY3wco8LhTaPjeMI3H+7YxJkTSvNUDCNLaY8XXdJVpolXbEYC/aDrxHnBBx10tgbIgLyYCcKq2tEUg2afFJK2tUnluYkaWARPyo4+R+imxRnpFD+YGA0yzoHtZq7IjNs7hR1Dbg==") returned 232 [0055.153] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2, wMilliseconds=0x1b7)) [0055.153] GetCurrentThreadId () returned 0x970 [0055.153] GetCurrentThreadId () returned 0x970 [0055.153] GetCurrentThreadId () returned 0x970 [0055.153] GetCurrentThreadId () returned 0x970 [0055.153] GetCurrentThreadId () returned 0x970 [0055.153] GetCurrentThreadId () returned 0x970 [0055.153] GetCurrentThreadId () returned 0x970 [0055.153] GetCurrentThreadId () returned 0x970 [0055.153] GetCurrentThreadId () returned 0x970 [0055.153] GetCurrentThreadId () returned 0x970 [0055.153] GetCurrentThreadId () returned 0x970 [0055.153] GetCurrentThreadId () returned 0x970 [0055.153] GetCurrentThreadId () returned 0x970 [0055.153] GetCurrentThreadId () returned 0x970 [0055.153] GetCurrentThreadId () returned 0x970 [0055.153] GetCurrentThreadId () returned 0x970 [0055.153] GetCurrentThreadId () returned 0x970 [0055.153] GetCurrentThreadId () returned 0x970 [0055.153] GetCurrentThreadId () returned 0x970 [0055.153] GetCurrentThreadId () returned 0x970 [0055.153] GetCurrentThreadId () returned 0x970 [0055.153] GetCurrentThreadId () returned 0x970 [0055.154] GetCurrentThreadId () returned 0x970 [0055.154] GetCurrentThreadId () returned 0x970 [0055.154] GetCurrentThreadId () returned 0x970 [0055.154] GetCurrentThreadId () returned 0x970 [0055.154] GetCurrentThreadId () returned 0x970 [0055.154] GetCurrentThreadId () returned 0x970 [0055.154] GetCurrentThreadId () returned 0x970 [0055.154] GetCurrentThreadId () returned 0x970 [0055.154] GetCurrentThreadId () returned 0x970 [0055.154] GetCurrentThreadId () returned 0x970 [0055.154] GetCurrentThreadId () returned 0x970 [0055.154] GetCurrentThreadId () returned 0x970 [0055.154] GetCurrentThreadId () returned 0x970 [0055.154] GetCurrentThreadId () returned 0x970 [0055.154] GetCurrentThreadId () returned 0x970 [0055.154] GetCurrentThreadId () returned 0x970 [0055.154] GetCurrentThreadId () returned 0x970 [0055.154] GetCurrentThreadId () returned 0x970 [0055.154] GetCurrentThreadId () returned 0x970 [0055.154] GetCurrentThreadId () returned 0x970 [0055.154] GetCurrentThreadId () returned 0x970 [0055.154] GetCurrentThreadId () returned 0x970 [0055.154] GetCurrentThreadId () returned 0x970 [0055.154] GetCurrentThreadId () returned 0x970 [0055.154] GetCurrentThreadId () returned 0x970 [0055.154] GetCurrentThreadId () returned 0x970 [0055.154] GetCurrentThreadId () returned 0x970 [0055.154] GetCurrentThreadId () returned 0x970 [0055.154] GetCurrentThreadId () returned 0x970 [0055.154] GetCurrentThreadId () returned 0x970 [0055.154] GetCurrentThreadId () returned 0x970 [0055.154] GetCurrentThreadId () returned 0x970 [0055.154] GetCurrentThreadId () returned 0x970 [0055.154] GetCurrentThreadId () returned 0x970 [0055.154] GetCurrentThreadId () returned 0x970 [0055.154] GetCurrentThreadId () returned 0x970 [0055.154] GetCurrentThreadId () returned 0x970 [0055.154] GetCurrentThreadId () returned 0x970 [0055.154] GetCurrentThreadId () returned 0x970 [0055.154] GetCurrentThreadId () returned 0x970 [0055.154] GetCurrentThreadId () returned 0x970 [0055.154] GetCurrentThreadId () returned 0x970 [0055.154] GetCurrentThreadId () returned 0x970 [0055.154] GetCurrentThreadId () returned 0x970 [0055.154] GetCurrentThreadId () returned 0x970 [0055.154] GetCurrentThreadId () returned 0x970 [0055.154] GetCurrentThreadId () returned 0x970 [0055.155] GetCurrentThreadId () returned 0x970 [0055.155] GetCurrentThreadId () returned 0x970 [0055.155] GetCurrentThreadId () returned 0x970 [0055.155] GetCurrentThreadId () returned 0x970 [0055.155] GetCurrentThreadId () returned 0x970 [0055.155] GetCurrentThreadId () returned 0x970 [0055.155] GetCurrentThreadId () returned 0x970 [0055.155] GetCurrentThreadId () returned 0x970 [0055.155] GetCurrentThreadId () returned 0x970 [0055.155] GetCurrentThreadId () returned 0x970 [0055.155] GetCurrentThreadId () returned 0x970 [0055.155] GetCurrentThreadId () returned 0x970 [0055.155] GetCurrentThreadId () returned 0x970 [0055.155] GetCurrentThreadId () returned 0x970 [0055.155] GetCurrentThreadId () returned 0x970 [0055.155] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAHpSTi3Zzvqffw8gt4dPsEhPhRFMkTPqnN6uIvVXc96EfFLpJgw95ITHyJRaYPSFmOa4j6/MseKiEJJb6gKdEO1E3krEY3wco8LhTaPjeMI3H+7YxJkTSvNUDCNLaY8XXdJVpolXbEYC/aDrxHnBBx10tgbIgLyYCcKq2tEUg2afFJK2tUnluYkaWARPyo4+R+imxRnpFD+YGA0yzoHtZq7IjNs7hR1Dbg==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0055.155] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAHpSTi3Zzvqffw8gt4dPsEhPhRFMkTPqnN6uIvVXc96EfFLpJgw95ITHyJRaYPSFmOa4j6/MseKiEJJb6gKdEO1E3krEY3wco8LhTaPjeMI3H+7YxJkTSvNUDCNLaY8XXdJVpolXbEYC/aDrxHnBBx10tgbIgLyYCcKq2tEUg2afFJK2tUnluYkaWARPyo4+R+imxRnpFD+YGA0yzoHtZq7IjNs7hR1Dbg==", cchWideChar=245, lpMultiByteStr=0x353933c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAHpSTi3Zzvqffw8gt4dPsEhPhRFMkTPqnN6uIvVXc96EfFLpJgw95ITHyJRaYPSFmOa4j6/MseKiEJJb6gKdEO1E3krEY3wco8LhTaPjeMI3H+7YxJkTSvNUDCNLaY8XXdJVpolXbEYC/aDrxHnBBx10tgbIgLyYCcKq2tEUg2afFJK2tUnluYkaWARPyo4+R+imxRnpFD+YGA0yzoHtZq7IjNs7hR1Dbg==", lpUsedDefaultChar=0x0) returned 245 [0055.155] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0055.155] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0055.155] CloseHandle (hObject=0x158) returned 1 [0055.156] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml")) returned 0 [0055.156] GetLastError () returned 0x5 [0055.156] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml")) returned 0x20 [0055.156] SetLastError (dwErrCode=0x5) [0055.156] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=17541941251) returned 1 [0055.156] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\Файл зашифрован [OFFICE.ODF].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\Файл зашифрован [office.odf].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0055.156] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0055.157] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0055.157] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0055.157] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0055.157] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0055.157] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0055.157] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0055.157] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0055.157] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0055.157] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0055.157] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0055.157] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0055.157] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0055.157] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0055.157] SetEndOfFile (hFile=0x158) returned 1 [0055.157] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0055.157] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0055.157] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0055.158] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0055.158] WriteFile (in: hFile=0x158, lpBuffer=0x361ff08*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x361ff08*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0055.158] WriteFile (in: hFile=0x158, lpBuffer=0x35eff9c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35eff9c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0055.159] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="P*.Qc^Zh,i9@.:#chP:ryka{f\"GRo!^l", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0055.159] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="P*.Qc^Zh,i9@.:#chP:ryka{f\"GRo!^l", cchWideChar=32, lpMultiByteStr=0x2033ba4, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="P*.Qc^Zh,i9@.:#chP:ryka{f\"GRo!^l", lpUsedDefaultChar=0x0) returned 32 [0055.159] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0055.159] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0055.159] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cbc7d00, ftCreationTime.dwHighDateTime=0x1cbe3e3, ftLastAccessTime.dwLowDateTime=0xcef24e20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7cbc7d00, ftLastWriteTime.dwHighDateTime=0x1cbe3e3, nFileSizeHigh=0x0, nFileSizeLow=0x419360, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE.ODF", cAlternateFileName="")) returned 0x295098 [0055.159] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0055.159] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0055.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf")) returned 0x20 [0055.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf")) returned 0x20 [0055.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf")) returned 0x20 [0055.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf")) returned 0x20 [0055.159] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cbc7d00, ftCreationTime.dwHighDateTime=0x1cbe3e3, ftLastAccessTime.dwLowDateTime=0xcef24e20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7cbc7d00, ftLastWriteTime.dwHighDateTime=0x1cbe3e3, nFileSizeHigh=0x0, nFileSizeLow=0x419360)) returned 1 [0055.159] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0055.159] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0055.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf")) returned 0x20 [0055.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf")) returned 0x20 [0055.159] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0055.159] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0055.159] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0055.160] SetEndOfFile (hFile=0x158) returned 1 [0055.160] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OFFICE.ODF", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.160] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OFFICE.ODF", cchWideChar=10, lpMultiByteStr=0x1fe394c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OFFICE.ODF", lpUsedDefaultChar=0x0) returned 10 [0055.160] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OFFICE.ODF", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.160] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OFFICE.ODF", cchWideChar=10, lpMultiByteStr=0x1fe488c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OFFICE.ODF", lpUsedDefaultChar=0x0) returned 10 [0055.160] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe488c, cbMultiByte=10, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="OFFICE.ODFatattmli\x01") returned 10 [0055.161] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OFFICE.ODF", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.161] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OFFICE.ODF", cchWideChar=10, lpMultiByteStr=0x1fe394c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OFFICE.ODF", lpUsedDefaultChar=0x0) returned 10 [0055.161] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0055.161] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0055.161] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x419360 [0055.161] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0055.161] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0055.161] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0055.161] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OFFICE.ODF", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.161] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OFFICE.ODF", cchWideChar=10, lpMultiByteStr=0x1fe394c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OFFICE.ODF", lpUsedDefaultChar=0x0) returned 10 [0055.161] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OFFICE.ODF", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.161] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OFFICE.ODF", cchWideChar=10, lpMultiByteStr=0x1fe488c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OFFICE.ODF", lpUsedDefaultChar=0x0) returned 10 [0055.161] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe488c, cbMultiByte=10, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="OFFICE.ODFCE.ODFatattmli\x01") returned 10 [0055.161] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OFFICE.ODF", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.161] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OFFICE.ODF", cchWideChar=10, lpMultiByteStr=0x1fe394c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OFFICE.ODF", lpUsedDefaultChar=0x0) returned 10 [0055.161] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0055.162] CharToOemA (in: pSrc="OFFICE.ODF", pDst=0x1fe488c | out: pDst="OFFICE.ODF") returned 1 [0055.162] WriteFile (in: hFile=0x158, lpBuffer=0x1fe488c*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe488c*, lpNumberOfBytesWritten=0x18e048*=0xa, lpOverlapped=0x0) returned 1 [0055.162] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0055.162] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0055.162] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0055.163] VirtualAlloc (lpAddress=0x0, dwSize=0x110000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ee90000 [0055.163] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=17542639668) returned 1 [0055.163] ReadFile (in: hFile=0x11c, lpBuffer=0x7ee90010, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x7ee90010*, lpNumberOfBytesRead=0x18dd7c*=0x100000, lpOverlapped=0x0) returned 1 [0055.193] ReadFile (in: hFile=0x11c, lpBuffer=0x7ee90010, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x7ee90010*, lpNumberOfBytesRead=0x18dd7c*=0x100000, lpOverlapped=0x0) returned 1 [0055.213] ReadFile (in: hFile=0x11c, lpBuffer=0x7ee90010, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x7ee90010*, lpNumberOfBytesRead=0x18dd7c*=0x100000, lpOverlapped=0x0) returned 1 [0055.232] ReadFile (in: hFile=0x11c, lpBuffer=0x7ee90010, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x7ee90010*, lpNumberOfBytesRead=0x18dd7c*=0x100000, lpOverlapped=0x0) returned 1 [0055.244] ReadFile (in: hFile=0x11c, lpBuffer=0x7ee90010, nNumberOfBytesToRead=0x19360, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x7ee90010*, lpNumberOfBytesRead=0x18dd7c*=0x19360, lpOverlapped=0x0) returned 1 [0055.252] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0055.252] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=17551508320) returned 1 [0055.260] WriteFile (in: hFile=0x158, lpBuffer=0x1fea120*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fea120*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0055.260] ReadFile (in: hFile=0x11c, lpBuffer=0x7ee90010, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x7ee90010*, lpNumberOfBytesRead=0x18de38*=0x100000, lpOverlapped=0x0) returned 1 [0055.265] VirtualAlloc (lpAddress=0x0, dwSize=0x110000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ed80000 [0055.279] VirtualAlloc (lpAddress=0x0, dwSize=0x110000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ec70000 [0055.320] VirtualFree (lpAddress=0x7ec70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.324] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x45 [0055.324] WriteFile (in: hFile=0x158, lpBuffer=0x7ed80010*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x7ed80010*, lpNumberOfBytesWritten=0x18de10*=0x100000, lpOverlapped=0x0) returned 1 [0055.341] VirtualFree (lpAddress=0x7ed80000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.346] ReadFile (in: hFile=0x11c, lpBuffer=0x7ee90010, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x7ee90010*, lpNumberOfBytesRead=0x18de38*=0x100000, lpOverlapped=0x0) returned 1 [0055.365] VirtualAlloc (lpAddress=0x0, dwSize=0x110000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ed80000 [0055.379] VirtualAlloc (lpAddress=0x0, dwSize=0x110000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ec70000 [0055.418] VirtualFree (lpAddress=0x7ec70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.422] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x100045 [0055.422] WriteFile (in: hFile=0x158, lpBuffer=0x7ed80010*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x7ed80010*, lpNumberOfBytesWritten=0x18de10*=0x100000, lpOverlapped=0x0) returned 1 [0055.439] VirtualFree (lpAddress=0x7ed80000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.444] ReadFile (in: hFile=0x11c, lpBuffer=0x7ee90010, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x7ee90010*, lpNumberOfBytesRead=0x18de38*=0x100000, lpOverlapped=0x0) returned 1 [0055.456] VirtualAlloc (lpAddress=0x0, dwSize=0x110000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ed80000 [0055.469] VirtualAlloc (lpAddress=0x0, dwSize=0x110000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ec70000 [0055.509] VirtualFree (lpAddress=0x7ec70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.513] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x200045 [0055.513] WriteFile (in: hFile=0x158, lpBuffer=0x7ed80010*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x7ed80010*, lpNumberOfBytesWritten=0x18de10*=0x100000, lpOverlapped=0x0) returned 1 [0055.531] VirtualFree (lpAddress=0x7ed80000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.535] ReadFile (in: hFile=0x11c, lpBuffer=0x7ee90010, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x7ee90010*, lpNumberOfBytesRead=0x18de38*=0x100000, lpOverlapped=0x0) returned 1 [0055.548] VirtualAlloc (lpAddress=0x0, dwSize=0x110000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ed80000 [0055.562] VirtualAlloc (lpAddress=0x0, dwSize=0x110000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ec70000 [0055.602] VirtualFree (lpAddress=0x7ec70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.606] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x300045 [0055.606] WriteFile (in: hFile=0x158, lpBuffer=0x7ed80010*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x7ed80010*, lpNumberOfBytesWritten=0x18de10*=0x100000, lpOverlapped=0x0) returned 1 [0055.624] VirtualFree (lpAddress=0x7ed80000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.629] ReadFile (in: hFile=0x11c, lpBuffer=0x7ee90010, nNumberOfBytesToRead=0x19360, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x7ee90010*, lpNumberOfBytesRead=0x18de38*=0x19360, lpOverlapped=0x0) returned 1 [0055.640] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x400045 [0055.640] WriteFile (in: hFile=0x158, lpBuffer=0x37ce870*, nNumberOfBytesToWrite=0x19360, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x37ce870*, lpNumberOfBytesWritten=0x18de10*=0x19360, lpOverlapped=0x0) returned 1 [0055.641] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x4193a5 [0055.641] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0055.641] VirtualFree (lpAddress=0x7ee90000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.646] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0055.646] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0055.647] SetFilePointer (in: hFile=0x158, lDistanceToMove=10, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x28 [0055.647] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x4193af [0055.647] CloseHandle (hObject=0x11c) returned 1 [0055.647] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x4193af [0055.647] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x4193af [0055.647] SetFilePointer (in: hFile=0x158, lDistanceToMove=4297647, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x4193af [0055.647] SetFilePointer (in: hFile=0x158, lDistanceToMove=4297647, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x4193af [0055.647] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x4193af [0055.647] SetFilePointer (in: hFile=0x158, lDistanceToMove=4297647, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x4193af [0055.647] SetEndOfFile (hFile=0x158) returned 1 [0055.647] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x4193af [0055.647] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x4193af [0055.647] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OFFICE.ODF", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.647] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OFFICE.ODF", cchWideChar=10, lpMultiByteStr=0x1fe394c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OFFICE.ODF", lpUsedDefaultChar=0x0) returned 10 [0055.648] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OFFICE.ODF", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.648] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OFFICE.ODF", cchWideChar=10, lpMultiByteStr=0x1fe35cc, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OFFICE.ODF", lpUsedDefaultChar=0x0) returned 10 [0055.648] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe35cc, cbMultiByte=10, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="OFFICE.ODF\x18ꞗ@涤(\x18믉`믑`") returned 10 [0055.648] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OFFICE.ODF", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.648] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OFFICE.ODF", cchWideChar=10, lpMultiByteStr=0x1fe394c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OFFICE.ODF", lpUsedDefaultChar=0x0) returned 10 [0055.648] WriteFile (in: hFile=0x158, lpBuffer=0x3770b58*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3770b58*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0055.648] CharToOemA (in: pSrc="OFFICE.ODF", pDst=0x1fe35cc | out: pDst="OFFICE.ODF") returned 1 [0055.648] WriteFile (in: hFile=0x158, lpBuffer=0x1fe35cc*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe35cc*, lpNumberOfBytesWritten=0x18efcc*=0xa, lpOverlapped=0x0) returned 1 [0055.648] WriteFile (in: hFile=0x158, lpBuffer=0x1fea2d8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea2d8*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0055.648] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0055.648] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0055.648] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x4193f2 [0055.648] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x4193f2 [0055.648] WriteFile (in: hFile=0x158, lpBuffer=0x361ff08*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x361ff08*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0055.648] WriteFile (in: hFile=0x158, lpBuffer=0x35eff9c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35eff9c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0055.648] DeleteFileW (lpFileName="") returned 0 [0055.649] GetLastError () returned 0x3 [0055.649] GetFileAttributesW (lpFileName="") returned 0xffffffff [0055.649] SetLastError (dwErrCode=0x3) [0055.649] FlushFileBuffers (hFile=0x158) returned 1 [0055.661] GetCurrentThreadId () returned 0x970 [0055.661] GetCurrentThreadId () returned 0x970 [0055.661] GetCurrentThreadId () returned 0x970 [0055.661] GetCurrentThreadId () returned 0x970 [0055.661] GetCurrentThreadId () returned 0x970 [0055.661] GetCurrentThreadId () returned 0x970 [0055.661] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x4194a9 [0055.661] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x4194a9 [0055.661] SetFilePointer (in: hFile=0x158, lDistanceToMove=4297897, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x4194a9 [0055.661] CloseHandle (hObject=0x158) returned 1 [0055.732] GetCurrentThreadId () returned 0x970 [0055.732] GetCurrentThreadId () returned 0x970 [0055.732] GetCurrentThreadId () returned 0x970 [0055.732] GetCurrentThreadId () returned 0x970 [0055.732] GetCurrentThreadId () returned 0x970 [0055.732] GetCurrentThreadId () returned 0x970 [0055.732] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\Файл зашифрован [OFFICE.ODF].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\Файл зашифрован [office.odf].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0055.732] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4194a9 [0055.732] SetFilePointer (in: hFile=0x158, lDistanceToMove=4297769, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x419429 [0055.732] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0055.733] GetFileType (hFile=0x158) returned 0x1 [0055.733] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x3, wMilliseconds=0x10)) [0055.733] GetCurrentThreadId () returned 0x970 [0055.733] GetCurrentThreadId () returned 0x970 [0055.733] GetCurrentThreadId () returned 0x970 [0055.733] GetCurrentThreadId () returned 0x970 [0055.733] GetCurrentThreadId () returned 0x970 [0055.733] GetCurrentThreadId () returned 0x970 [0055.733] GetCurrentThreadId () returned 0x970 [0055.733] GetCurrentThreadId () returned 0x970 [0055.733] GetCurrentThreadId () returned 0x970 [0055.733] GetCurrentThreadId () returned 0x970 [0055.733] GetCurrentThreadId () returned 0x970 [0055.733] GetCurrentThreadId () returned 0x970 [0055.733] GetCurrentThreadId () returned 0x970 [0055.733] GetCurrentThreadId () returned 0x970 [0055.733] GetCurrentThreadId () returned 0x970 [0055.733] GetCurrentThreadId () returned 0x970 [0055.733] GetCurrentThreadId () returned 0x970 [0055.733] GetCurrentThreadId () returned 0x970 [0055.733] GetCurrentThreadId () returned 0x970 [0055.733] GetCurrentThreadId () returned 0x970 [0055.733] GetCurrentThreadId () returned 0x970 [0055.733] GetCurrentThreadId () returned 0x970 [0055.733] GetCurrentThreadId () returned 0x970 [0055.733] GetCurrentThreadId () returned 0x970 [0055.733] GetCurrentThreadId () returned 0x970 [0055.733] GetCurrentThreadId () returned 0x970 [0055.733] GetCurrentThreadId () returned 0x970 [0055.733] GetCurrentThreadId () returned 0x970 [0055.733] GetCurrentThreadId () returned 0x970 [0055.733] GetCurrentThreadId () returned 0x970 [0055.733] GetCurrentThreadId () returned 0x970 [0055.733] GetCurrentThreadId () returned 0x970 [0055.733] GetCurrentThreadId () returned 0x970 [0055.733] GetCurrentThreadId () returned 0x970 [0055.733] GetCurrentThreadId () returned 0x970 [0055.733] GetCurrentThreadId () returned 0x970 [0055.733] GetCurrentThreadId () returned 0x970 [0055.733] GetCurrentThreadId () returned 0x970 [0055.733] GetCurrentThreadId () returned 0x970 [0055.733] GetCurrentThreadId () returned 0x970 [0055.733] GetCurrentThreadId () returned 0x970 [0055.734] GetCurrentThreadId () returned 0x970 [0055.734] GetCurrentThreadId () returned 0x970 [0055.734] GetCurrentThreadId () returned 0x970 [0055.734] GetCurrentThreadId () returned 0x970 [0055.734] GetCurrentThreadId () returned 0x970 [0055.734] GetCurrentThreadId () returned 0x970 [0055.734] GetCurrentThreadId () returned 0x970 [0055.734] GetCurrentThreadId () returned 0x970 [0055.734] GetCurrentThreadId () returned 0x970 [0055.734] GetCurrentThreadId () returned 0x970 [0055.734] GetCurrentThreadId () returned 0x970 [0055.734] GetCurrentThreadId () returned 0x970 [0055.734] GetCurrentThreadId () returned 0x970 [0055.734] GetCurrentThreadId () returned 0x970 [0055.734] GetCurrentThreadId () returned 0x970 [0055.734] GetCurrentThreadId () returned 0x970 [0055.734] GetCurrentThreadId () returned 0x970 [0055.734] GetCurrentThreadId () returned 0x970 [0055.734] GetCurrentThreadId () returned 0x970 [0055.734] GetCurrentThreadId () returned 0x970 [0055.734] GetCurrentThreadId () returned 0x970 [0055.734] GetCurrentThreadId () returned 0x970 [0055.734] GetCurrentThreadId () returned 0x970 [0055.734] GetCurrentThreadId () returned 0x970 [0055.734] GetCurrentThreadId () returned 0x970 [0055.734] GetCurrentThreadId () returned 0x970 [0055.734] GetCurrentThreadId () returned 0x970 [0055.734] GetCurrentThreadId () returned 0x970 [0055.734] GetCurrentThreadId () returned 0x970 [0055.734] GetCurrentThreadId () returned 0x970 [0055.734] GetCurrentThreadId () returned 0x970 [0055.734] GetCurrentThreadId () returned 0x970 [0055.734] GetCurrentThreadId () returned 0x970 [0055.734] GetCurrentThreadId () returned 0x970 [0055.734] GetCurrentThreadId () returned 0x970 [0055.734] GetCurrentThreadId () returned 0x970 [0055.734] GetCurrentThreadId () returned 0x970 [0055.734] GetCurrentThreadId () returned 0x970 [0055.734] GetCurrentThreadId () returned 0x970 [0055.734] GetCurrentThreadId () returned 0x970 [0055.734] GetCurrentThreadId () returned 0x970 [0055.734] GetCurrentThreadId () returned 0x970 [0055.734] GetCurrentThreadId () returned 0x970 [0055.734] GetCurrentThreadId () returned 0x970 [0055.734] GetCurrentThreadId () returned 0x970 [0055.734] GetCurrentThreadId () returned 0x970 [0055.734] GetCurrentThreadId () returned 0x970 [0055.735] GetCurrentThreadId () returned 0x970 [0055.735] GetCurrentThreadId () returned 0x970 [0055.735] GetCurrentThreadId () returned 0x970 [0055.735] GetCurrentThreadId () returned 0x970 [0055.735] GetCurrentThreadId () returned 0x970 [0055.735] GetCurrentThreadId () returned 0x970 [0055.735] GetCurrentThreadId () returned 0x970 [0055.735] GetCurrentThreadId () returned 0x970 [0055.735] GetCurrentThreadId () returned 0x970 [0055.735] GetCurrentThreadId () returned 0x970 [0055.735] GetCurrentThreadId () returned 0x970 [0055.735] GetCurrentThreadId () returned 0x970 [0055.735] GetCurrentThreadId () returned 0x970 [0055.735] GetCurrentThreadId () returned 0x970 [0055.735] GetCurrentThreadId () returned 0x970 [0055.735] GetCurrentThreadId () returned 0x970 [0055.735] GetCurrentThreadId () returned 0x970 [0055.735] GetCurrentThreadId () returned 0x970 [0055.735] GetCurrentThreadId () returned 0x970 [0055.735] GetCurrentThreadId () returned 0x970 [0055.735] GetCurrentThreadId () returned 0x970 [0055.735] GetCurrentThreadId () returned 0x970 [0055.735] GetCurrentThreadId () returned 0x970 [0055.735] GetCurrentThreadId () returned 0x970 [0055.735] GetCurrentThreadId () returned 0x970 [0055.735] GetCurrentThreadId () returned 0x970 [0055.735] GetCurrentThreadId () returned 0x970 [0055.735] GetCurrentThreadId () returned 0x970 [0055.735] GetCurrentThreadId () returned 0x970 [0055.735] GetCurrentThreadId () returned 0x970 [0055.735] GetCurrentThreadId () returned 0x970 [0055.735] GetCurrentThreadId () returned 0x970 [0055.735] GetCurrentThreadId () returned 0x970 [0055.735] GetCurrentThreadId () returned 0x970 [0055.735] GetCurrentThreadId () returned 0x970 [0055.735] GetCurrentThreadId () returned 0x970 [0055.735] GetCurrentThreadId () returned 0x970 [0055.735] GetCurrentThreadId () returned 0x970 [0055.735] GetCurrentThreadId () returned 0x970 [0055.735] GetCurrentThreadId () returned 0x970 [0055.735] GetCurrentThreadId () returned 0x970 [0055.735] GetCurrentThreadId () returned 0x970 [0055.735] GetCurrentThreadId () returned 0x970 [0055.735] GetCurrentThreadId () returned 0x970 [0055.735] GetCurrentThreadId () returned 0x970 [0055.735] GetCurrentThreadId () returned 0x970 [0055.735] GetCurrentThreadId () returned 0x970 [0055.735] GetCurrentThreadId () returned 0x970 [0055.736] GetCurrentThreadId () returned 0x970 [0055.736] GetCurrentThreadId () returned 0x970 [0055.736] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.736] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.736] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fed2f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0055.736] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.736] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.736] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fed2f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0055.736] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.736] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.736] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0055.736] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.736] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.736] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0055.736] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.736] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.736] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fed350, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0055.736] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.736] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.736] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fed350, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0055.736] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.736] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.736] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fed350, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0055.736] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x3, wMilliseconds=0x10)) [0055.736] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="P*.Qc^Zh,i9@.:#chP:ryka{f\"GRo!^l", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0055.736] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="P*.Qc^Zh,i9@.:#chP:ryka{f\"GRo!^l", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0055.736] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="P*.Qc^Zh,i9@.:#chP:ryka{f\"GRo!^l", cchWideChar=32, lpMultiByteStr=0x2001768, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="P*.Qc^Zh,i9@.:#chP:ryka{f\"GRo!^l", lpUsedDefaultChar=0x0) returned 32 [0055.736] GetCurrentThreadId () returned 0x970 [0055.736] GetCurrentThreadId () returned 0x970 [0055.736] GetCurrentThreadId () returned 0x970 [0055.736] GetCurrentThreadId () returned 0x970 [0055.736] GetCurrentThreadId () returned 0x970 [0055.736] GetCurrentThreadId () returned 0x970 [0055.744] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0055.744] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0055.744] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x34f2f48, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0055.744] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0055.744] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAFAFf+txsNOX3RBaeNilLQgEm76EtXC3DLVuO0nZWkVaZgvLjVz6ltrpLbP33EZGKc8RzWruAB/RTxbFquDzXsV1//e9v9tRF7VjfH1CrWFA6FhtNLuQrUwc9aerSAiH/Qzl3EyilSa8F9dPqHO0jl4Y5xf6IBYgxM6zm5pLfJmtQLEvBwIJQvojAo/lLcVIyKIdvPsGw/HuHHD6q4KNU345Vtt7PrL2ng==") returned 232 [0055.744] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x3, wMilliseconds=0x20)) [0055.744] GetCurrentThreadId () returned 0x970 [0055.744] GetCurrentThreadId () returned 0x970 [0055.744] GetCurrentThreadId () returned 0x970 [0055.744] GetCurrentThreadId () returned 0x970 [0055.744] GetCurrentThreadId () returned 0x970 [0055.744] GetCurrentThreadId () returned 0x970 [0055.744] GetCurrentThreadId () returned 0x970 [0055.744] GetCurrentThreadId () returned 0x970 [0055.744] GetCurrentThreadId () returned 0x970 [0055.744] GetCurrentThreadId () returned 0x970 [0055.744] GetCurrentThreadId () returned 0x970 [0055.744] GetCurrentThreadId () returned 0x970 [0055.744] GetCurrentThreadId () returned 0x970 [0055.744] GetCurrentThreadId () returned 0x970 [0055.744] GetCurrentThreadId () returned 0x970 [0055.745] GetCurrentThreadId () returned 0x970 [0055.745] GetCurrentThreadId () returned 0x970 [0055.745] GetCurrentThreadId () returned 0x970 [0055.745] GetCurrentThreadId () returned 0x970 [0055.745] GetCurrentThreadId () returned 0x970 [0055.745] GetCurrentThreadId () returned 0x970 [0055.745] GetCurrentThreadId () returned 0x970 [0055.745] GetCurrentThreadId () returned 0x970 [0055.745] GetCurrentThreadId () returned 0x970 [0055.745] GetCurrentThreadId () returned 0x970 [0055.745] GetCurrentThreadId () returned 0x970 [0055.745] GetCurrentThreadId () returned 0x970 [0055.745] GetCurrentThreadId () returned 0x970 [0055.745] GetCurrentThreadId () returned 0x970 [0055.745] GetCurrentThreadId () returned 0x970 [0055.745] GetCurrentThreadId () returned 0x970 [0055.745] GetCurrentThreadId () returned 0x970 [0055.745] GetCurrentThreadId () returned 0x970 [0055.745] GetCurrentThreadId () returned 0x970 [0055.745] GetCurrentThreadId () returned 0x970 [0055.745] GetCurrentThreadId () returned 0x970 [0055.745] GetCurrentThreadId () returned 0x970 [0055.745] GetCurrentThreadId () returned 0x970 [0055.745] GetCurrentThreadId () returned 0x970 [0055.745] GetCurrentThreadId () returned 0x970 [0055.745] GetCurrentThreadId () returned 0x970 [0055.745] GetCurrentThreadId () returned 0x970 [0055.745] GetCurrentThreadId () returned 0x970 [0055.745] GetCurrentThreadId () returned 0x970 [0055.745] GetCurrentThreadId () returned 0x970 [0055.745] GetCurrentThreadId () returned 0x970 [0055.745] GetCurrentThreadId () returned 0x970 [0055.745] GetCurrentThreadId () returned 0x970 [0055.745] GetCurrentThreadId () returned 0x970 [0055.745] GetCurrentThreadId () returned 0x970 [0055.745] GetCurrentThreadId () returned 0x970 [0055.745] GetCurrentThreadId () returned 0x970 [0055.745] GetCurrentThreadId () returned 0x970 [0055.745] GetCurrentThreadId () returned 0x970 [0055.745] GetCurrentThreadId () returned 0x970 [0055.745] GetCurrentThreadId () returned 0x970 [0055.745] GetCurrentThreadId () returned 0x970 [0055.745] GetCurrentThreadId () returned 0x970 [0055.745] GetCurrentThreadId () returned 0x970 [0055.745] GetCurrentThreadId () returned 0x970 [0055.745] GetCurrentThreadId () returned 0x970 [0055.746] GetCurrentThreadId () returned 0x970 [0055.746] GetCurrentThreadId () returned 0x970 [0055.746] GetCurrentThreadId () returned 0x970 [0055.746] GetCurrentThreadId () returned 0x970 [0055.746] GetCurrentThreadId () returned 0x970 [0055.746] GetCurrentThreadId () returned 0x970 [0055.746] GetCurrentThreadId () returned 0x970 [0055.746] GetCurrentThreadId () returned 0x970 [0055.746] GetCurrentThreadId () returned 0x970 [0055.746] GetCurrentThreadId () returned 0x970 [0055.746] GetCurrentThreadId () returned 0x970 [0055.746] GetCurrentThreadId () returned 0x970 [0055.746] GetCurrentThreadId () returned 0x970 [0055.746] GetCurrentThreadId () returned 0x970 [0055.746] GetCurrentThreadId () returned 0x970 [0055.746] GetCurrentThreadId () returned 0x970 [0055.746] GetCurrentThreadId () returned 0x970 [0055.746] GetCurrentThreadId () returned 0x970 [0055.746] GetCurrentThreadId () returned 0x970 [0055.746] GetCurrentThreadId () returned 0x970 [0055.746] GetCurrentThreadId () returned 0x970 [0055.746] GetCurrentThreadId () returned 0x970 [0055.746] GetCurrentThreadId () returned 0x970 [0055.746] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAFAFf+txsNOX3RBaeNilLQgEm76EtXC3DLVuO0nZWkVaZgvLjVz6ltrpLbP33EZGKc8RzWruAB/RTxbFquDzXsV1//e9v9tRF7VjfH1CrWFA6FhtNLuQrUwc9aerSAiH/Qzl3EyilSa8F9dPqHO0jl4Y5xf6IBYgxM6zm5pLfJmtQLEvBwIJQvojAo/lLcVIyKIdvPsGw/HuHHD6q4KNU345Vtt7PrL2ng==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0055.746] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAFAFf+txsNOX3RBaeNilLQgEm76EtXC3DLVuO0nZWkVaZgvLjVz6ltrpLbP33EZGKc8RzWruAB/RTxbFquDzXsV1//e9v9tRF7VjfH1CrWFA6FhtNLuQrUwc9aerSAiH/Qzl3EyilSa8F9dPqHO0jl4Y5xf6IBYgxM6zm5pLfJmtQLEvBwIJQvojAo/lLcVIyKIdvPsGw/HuHHD6q4KNU345Vtt7PrL2ng==", cchWideChar=245, lpMultiByteStr=0x353933c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAFAFf+txsNOX3RBaeNilLQgEm76EtXC3DLVuO0nZWkVaZgvLjVz6ltrpLbP33EZGKc8RzWruAB/RTxbFquDzXsV1//e9v9tRF7VjfH1CrWFA6FhtNLuQrUwc9aerSAiH/Qzl3EyilSa8F9dPqHO0jl4Y5xf6IBYgxM6zm5pLfJmtQLEvBwIJQvojAo/lLcVIyKIdvPsGw/HuHHD6q4KNU345Vtt7PrL2ng==", lpUsedDefaultChar=0x0) returned 245 [0055.746] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0055.746] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0055.746] CloseHandle (hObject=0x158) returned 1 [0055.815] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf")) returned 0 [0055.816] GetLastError () returned 0x5 [0055.816] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf")) returned 0x20 [0055.816] SetLastError (dwErrCode=0x5) [0055.816] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=17607931328) returned 1 [0055.816] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\Файл зашифрован [AccessMUI.XML].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\Файл зашифрован [accessmui.xml].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0055.818] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0055.818] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0055.818] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0055.818] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0055.818] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0055.818] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0055.818] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0055.818] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0055.818] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0055.818] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0055.818] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0055.818] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0055.818] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0055.818] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0055.818] SetEndOfFile (hFile=0x158) returned 1 [0055.819] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0055.819] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0055.819] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0055.819] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0055.819] WriteFile (in: hFile=0x158, lpBuffer=0x361ff08*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x361ff08*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0055.820] WriteFile (in: hFile=0x158, lpBuffer=0x35f005c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f005c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0055.820] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="*gd^38+ryTPaKfkVd5\"GvsFwid+B{S0^", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0055.820] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="*gd^38+ryTPaKfkVd5\"GvsFwid+B{S0^", cchWideChar=32, lpMultiByteStr=0x2033bdc, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*gd^38+ryTPaKfkVd5\"GvsFwid+B{S0^", lpUsedDefaultChar=0x0) returned 32 [0055.820] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0055.820] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0055.820] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa5fe940, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x15419830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa5fe940, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x545, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUI.XML", cAlternateFileName="ACCESS~1.XML")) returned 0x295098 [0055.820] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0055.820] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0055.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml")) returned 0x20 [0055.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml")) returned 0x20 [0055.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml")) returned 0x20 [0055.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml")) returned 0x20 [0055.820] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa5fe940, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x15419830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa5fe940, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x545)) returned 1 [0055.820] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0055.820] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0055.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml")) returned 0x20 [0055.821] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml")) returned 0x20 [0055.821] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0055.821] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0055.821] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0055.821] SetEndOfFile (hFile=0x158) returned 1 [0055.822] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AccessMUI.XML", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0055.822] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AccessMUI.XML", cchWideChar=13, lpMultiByteStr=0x1fe430c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AccessMUI.XML", lpUsedDefaultChar=0x0) returned 13 [0055.822] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AccessMUI.XML", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0055.822] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AccessMUI.XML", cchWideChar=13, lpMultiByteStr=0x1fe39ec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AccessMUI.XML", lpUsedDefaultChar=0x0) returned 13 [0055.822] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe39ec, cbMultiByte=13, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="AccessMUI.XMLttmli\x01") returned 13 [0055.822] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AccessMUI.XML", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0055.822] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AccessMUI.XML", cchWideChar=13, lpMultiByteStr=0x1fe430c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AccessMUI.XML", lpUsedDefaultChar=0x0) returned 13 [0055.822] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0055.822] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0055.822] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x545 [0055.822] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0055.822] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0055.822] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0055.822] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AccessMUI.XML", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0055.822] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AccessMUI.XML", cchWideChar=13, lpMultiByteStr=0x1fe430c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AccessMUI.XML", lpUsedDefaultChar=0x0) returned 13 [0055.822] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AccessMUI.XML", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0055.822] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AccessMUI.XML", cchWideChar=13, lpMultiByteStr=0x1fe39ec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AccessMUI.XML", lpUsedDefaultChar=0x0) returned 13 [0055.823] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe39ec, cbMultiByte=13, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="AccessMUI.XMLUI.XMLttmli\x01") returned 13 [0055.823] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AccessMUI.XML", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0055.823] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AccessMUI.XML", cchWideChar=13, lpMultiByteStr=0x1fe430c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AccessMUI.XML", lpUsedDefaultChar=0x0) returned 13 [0055.823] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0055.823] CharToOemA (in: pSrc="AccessMUI.XML", pDst=0x1fe39ec | out: pDst="AccessMUI.XML") returned 1 [0055.823] WriteFile (in: hFile=0x158, lpBuffer=0x1fe39ec*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe39ec*, lpNumberOfBytesWritten=0x18e048*=0xd, lpOverlapped=0x0) returned 1 [0055.824] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0055.824] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0055.824] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0055.824] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=17608728205) returned 1 [0055.824] ReadFile (in: hFile=0x11c, lpBuffer=0x378d0a0, nNumberOfBytesToRead=0x545, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x378d0a0*, lpNumberOfBytesRead=0x18dd7c*=0x545, lpOverlapped=0x0) returned 1 [0055.825] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0055.825] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=17608868346) returned 1 [0055.834] WriteFile (in: hFile=0x158, lpBuffer=0x1fea288*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fea288*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0055.834] ReadFile (in: hFile=0x11c, lpBuffer=0x378d0a0, nNumberOfBytesToRead=0x545, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x378d0a0*, lpNumberOfBytesRead=0x18de38*=0x545, lpOverlapped=0x0) returned 1 [0055.834] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x48 [0055.834] WriteFile (in: hFile=0x158, lpBuffer=0x378d600*, nNumberOfBytesToWrite=0x545, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x378d600*, lpNumberOfBytesWritten=0x18de10*=0x545, lpOverlapped=0x0) returned 1 [0055.834] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x58d [0055.834] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0055.834] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0055.834] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0055.835] SetFilePointer (in: hFile=0x158, lDistanceToMove=13, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2b [0055.835] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x597 [0055.835] CloseHandle (hObject=0x11c) returned 1 [0055.835] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x597 [0055.835] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x597 [0055.835] SetFilePointer (in: hFile=0x158, lDistanceToMove=1431, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x597 [0055.835] SetFilePointer (in: hFile=0x158, lDistanceToMove=1431, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x597 [0055.835] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x597 [0055.835] SetFilePointer (in: hFile=0x158, lDistanceToMove=1431, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x597 [0055.835] SetEndOfFile (hFile=0x158) returned 1 [0055.835] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x597 [0055.835] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x597 [0055.835] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AccessMUI.XML", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0055.835] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AccessMUI.XML", cchWideChar=13, lpMultiByteStr=0x1fe430c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AccessMUI.XML", lpUsedDefaultChar=0x0) returned 13 [0055.835] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AccessMUI.XML", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0055.835] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AccessMUI.XML", cchWideChar=13, lpMultiByteStr=0x1fe3bac, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AccessMUI.XML", lpUsedDefaultChar=0x0) returned 13 [0055.835] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe3bac, cbMultiByte=13, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="AccessMUI.XML@涤(\x18믉`믑`") returned 13 [0055.836] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AccessMUI.XML", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0055.836] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AccessMUI.XML", cchWideChar=13, lpMultiByteStr=0x1fe430c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AccessMUI.XML", lpUsedDefaultChar=0x0) returned 13 [0055.836] WriteFile (in: hFile=0x158, lpBuffer=0x3770b58*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3770b58*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0055.836] CharToOemA (in: pSrc="AccessMUI.XML", pDst=0x1fe3bac | out: pDst="AccessMUI.XML") returned 1 [0055.836] WriteFile (in: hFile=0x158, lpBuffer=0x1fe3bac*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe3bac*, lpNumberOfBytesWritten=0x18efcc*=0xd, lpOverlapped=0x0) returned 1 [0055.836] WriteFile (in: hFile=0x158, lpBuffer=0x1fea170*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea170*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0055.836] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0055.836] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0055.836] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x5dd [0055.836] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x5dd [0055.836] WriteFile (in: hFile=0x158, lpBuffer=0x361ff08*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x361ff08*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0055.836] WriteFile (in: hFile=0x158, lpBuffer=0x35f005c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f005c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0055.836] DeleteFileW (lpFileName="") returned 0 [0055.836] GetLastError () returned 0x3 [0055.836] GetFileAttributesW (lpFileName="") returned 0xffffffff [0055.836] SetLastError (dwErrCode=0x3) [0055.836] FlushFileBuffers (hFile=0x158) returned 1 [0055.839] GetCurrentThreadId () returned 0x970 [0055.839] GetCurrentThreadId () returned 0x970 [0055.839] GetCurrentThreadId () returned 0x970 [0055.839] GetCurrentThreadId () returned 0x970 [0055.839] GetCurrentThreadId () returned 0x970 [0055.839] GetCurrentThreadId () returned 0x970 [0055.839] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x694 [0055.839] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x694 [0055.839] SetFilePointer (in: hFile=0x158, lDistanceToMove=1684, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x694 [0055.839] CloseHandle (hObject=0x158) returned 1 [0055.840] GetCurrentThreadId () returned 0x970 [0055.840] GetCurrentThreadId () returned 0x970 [0055.840] GetCurrentThreadId () returned 0x970 [0055.840] GetCurrentThreadId () returned 0x970 [0055.840] GetCurrentThreadId () returned 0x970 [0055.840] GetCurrentThreadId () returned 0x970 [0055.840] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\Файл зашифрован [AccessMUI.XML].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\Файл зашифрован [accessmui.xml].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0055.840] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x694 [0055.840] SetFilePointer (in: hFile=0x158, lDistanceToMove=1556, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x614 [0055.840] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0055.840] GetFileType (hFile=0x158) returned 0x1 [0055.840] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x3, wMilliseconds=0x6e)) [0055.840] GetCurrentThreadId () returned 0x970 [0055.841] GetCurrentThreadId () returned 0x970 [0055.841] GetCurrentThreadId () returned 0x970 [0055.841] GetCurrentThreadId () returned 0x970 [0055.841] GetCurrentThreadId () returned 0x970 [0055.841] GetCurrentThreadId () returned 0x970 [0055.841] GetCurrentThreadId () returned 0x970 [0055.841] GetCurrentThreadId () returned 0x970 [0055.841] GetCurrentThreadId () returned 0x970 [0055.841] GetCurrentThreadId () returned 0x970 [0055.841] GetCurrentThreadId () returned 0x970 [0055.841] GetCurrentThreadId () returned 0x970 [0055.841] GetCurrentThreadId () returned 0x970 [0055.841] GetCurrentThreadId () returned 0x970 [0055.841] GetCurrentThreadId () returned 0x970 [0055.841] GetCurrentThreadId () returned 0x970 [0055.841] GetCurrentThreadId () returned 0x970 [0055.841] GetCurrentThreadId () returned 0x970 [0055.841] GetCurrentThreadId () returned 0x970 [0055.841] GetCurrentThreadId () returned 0x970 [0055.841] GetCurrentThreadId () returned 0x970 [0055.841] GetCurrentThreadId () returned 0x970 [0055.841] GetCurrentThreadId () returned 0x970 [0055.841] GetCurrentThreadId () returned 0x970 [0055.841] GetCurrentThreadId () returned 0x970 [0055.841] GetCurrentThreadId () returned 0x970 [0055.841] GetCurrentThreadId () returned 0x970 [0055.841] GetCurrentThreadId () returned 0x970 [0055.841] GetCurrentThreadId () returned 0x970 [0055.841] GetCurrentThreadId () returned 0x970 [0055.841] GetCurrentThreadId () returned 0x970 [0055.841] GetCurrentThreadId () returned 0x970 [0055.841] GetCurrentThreadId () returned 0x970 [0055.841] GetCurrentThreadId () returned 0x970 [0055.841] GetCurrentThreadId () returned 0x970 [0055.841] GetCurrentThreadId () returned 0x970 [0055.841] GetCurrentThreadId () returned 0x970 [0055.841] GetCurrentThreadId () returned 0x970 [0055.841] GetCurrentThreadId () returned 0x970 [0055.841] GetCurrentThreadId () returned 0x970 [0055.841] GetCurrentThreadId () returned 0x970 [0055.841] GetCurrentThreadId () returned 0x970 [0055.841] GetCurrentThreadId () returned 0x970 [0055.841] GetCurrentThreadId () returned 0x970 [0055.841] GetCurrentThreadId () returned 0x970 [0055.841] GetCurrentThreadId () returned 0x970 [0055.841] GetCurrentThreadId () returned 0x970 [0055.842] GetCurrentThreadId () returned 0x970 [0055.842] GetCurrentThreadId () returned 0x970 [0055.842] GetCurrentThreadId () returned 0x970 [0055.842] GetCurrentThreadId () returned 0x970 [0055.842] GetCurrentThreadId () returned 0x970 [0055.842] GetCurrentThreadId () returned 0x970 [0055.842] GetCurrentThreadId () returned 0x970 [0055.842] GetCurrentThreadId () returned 0x970 [0055.842] GetCurrentThreadId () returned 0x970 [0055.842] GetCurrentThreadId () returned 0x970 [0055.842] GetCurrentThreadId () returned 0x970 [0055.842] GetCurrentThreadId () returned 0x970 [0055.842] GetCurrentThreadId () returned 0x970 [0055.842] GetCurrentThreadId () returned 0x970 [0055.842] GetCurrentThreadId () returned 0x970 [0055.842] GetCurrentThreadId () returned 0x970 [0055.842] GetCurrentThreadId () returned 0x970 [0055.842] GetCurrentThreadId () returned 0x970 [0055.842] GetCurrentThreadId () returned 0x970 [0055.842] GetCurrentThreadId () returned 0x970 [0055.842] GetCurrentThreadId () returned 0x970 [0055.842] GetCurrentThreadId () returned 0x970 [0055.842] GetCurrentThreadId () returned 0x970 [0055.842] GetCurrentThreadId () returned 0x970 [0055.842] GetCurrentThreadId () returned 0x970 [0055.842] GetCurrentThreadId () returned 0x970 [0055.842] GetCurrentThreadId () returned 0x970 [0055.842] GetCurrentThreadId () returned 0x970 [0055.842] GetCurrentThreadId () returned 0x970 [0055.842] GetCurrentThreadId () returned 0x970 [0055.842] GetCurrentThreadId () returned 0x970 [0055.842] GetCurrentThreadId () returned 0x970 [0055.842] GetCurrentThreadId () returned 0x970 [0055.842] GetCurrentThreadId () returned 0x970 [0055.842] GetCurrentThreadId () returned 0x970 [0055.842] GetCurrentThreadId () returned 0x970 [0055.842] GetCurrentThreadId () returned 0x970 [0055.842] GetCurrentThreadId () returned 0x970 [0055.842] GetCurrentThreadId () returned 0x970 [0055.842] GetCurrentThreadId () returned 0x970 [0055.842] GetCurrentThreadId () returned 0x970 [0055.842] GetCurrentThreadId () returned 0x970 [0055.842] GetCurrentThreadId () returned 0x970 [0055.842] GetCurrentThreadId () returned 0x970 [0055.842] GetCurrentThreadId () returned 0x970 [0055.842] GetCurrentThreadId () returned 0x970 [0055.842] GetCurrentThreadId () returned 0x970 [0055.842] GetCurrentThreadId () returned 0x970 [0055.843] GetCurrentThreadId () returned 0x970 [0055.843] GetCurrentThreadId () returned 0x970 [0055.843] GetCurrentThreadId () returned 0x970 [0055.843] GetCurrentThreadId () returned 0x970 [0055.843] GetCurrentThreadId () returned 0x970 [0055.843] GetCurrentThreadId () returned 0x970 [0055.843] GetCurrentThreadId () returned 0x970 [0055.843] GetCurrentThreadId () returned 0x970 [0055.843] GetCurrentThreadId () returned 0x970 [0055.843] GetCurrentThreadId () returned 0x970 [0055.843] GetCurrentThreadId () returned 0x970 [0055.843] GetCurrentThreadId () returned 0x970 [0055.843] GetCurrentThreadId () returned 0x970 [0055.843] GetCurrentThreadId () returned 0x970 [0055.843] GetCurrentThreadId () returned 0x970 [0055.843] GetCurrentThreadId () returned 0x970 [0055.843] GetCurrentThreadId () returned 0x970 [0055.843] GetCurrentThreadId () returned 0x970 [0055.843] GetCurrentThreadId () returned 0x970 [0055.843] GetCurrentThreadId () returned 0x970 [0055.843] GetCurrentThreadId () returned 0x970 [0055.843] GetCurrentThreadId () returned 0x970 [0055.843] GetCurrentThreadId () returned 0x970 [0055.843] GetCurrentThreadId () returned 0x970 [0055.843] GetCurrentThreadId () returned 0x970 [0055.843] GetCurrentThreadId () returned 0x970 [0055.843] GetCurrentThreadId () returned 0x970 [0055.843] GetCurrentThreadId () returned 0x970 [0055.843] GetCurrentThreadId () returned 0x970 [0055.843] GetCurrentThreadId () returned 0x970 [0055.843] GetCurrentThreadId () returned 0x970 [0055.843] GetCurrentThreadId () returned 0x970 [0055.843] GetCurrentThreadId () returned 0x970 [0055.843] GetCurrentThreadId () returned 0x970 [0055.843] GetCurrentThreadId () returned 0x970 [0055.843] GetCurrentThreadId () returned 0x970 [0055.843] GetCurrentThreadId () returned 0x970 [0055.843] GetCurrentThreadId () returned 0x970 [0055.843] GetCurrentThreadId () returned 0x970 [0055.843] GetCurrentThreadId () returned 0x970 [0055.843] GetCurrentThreadId () returned 0x970 [0055.843] GetCurrentThreadId () returned 0x970 [0055.843] GetCurrentThreadId () returned 0x970 [0055.843] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.843] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.843] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fed350, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0055.843] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.844] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.844] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fed350, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0055.844] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.844] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.844] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0055.844] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.844] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.844] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0055.844] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.844] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.844] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fed3b0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0055.844] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.844] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.844] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fed3b0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0055.844] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.844] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.844] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fed3b0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0055.844] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x3, wMilliseconds=0x6e)) [0055.844] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="*gd^38+ryTPaKfkVd5\"GvsFwid+B{S0^", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0055.844] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="*gd^38+ryTPaKfkVd5\"GvsFwid+B{S0^", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0055.844] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="*gd^38+ryTPaKfkVd5\"GvsFwid+B{S0^", cchWideChar=32, lpMultiByteStr=0x20017f8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*gd^38+ryTPaKfkVd5\"GvsFwid+B{S0^", lpUsedDefaultChar=0x0) returned 32 [0055.844] GetCurrentThreadId () returned 0x970 [0055.844] GetCurrentThreadId () returned 0x970 [0055.844] GetCurrentThreadId () returned 0x970 [0055.844] GetCurrentThreadId () returned 0x970 [0055.844] GetCurrentThreadId () returned 0x970 [0055.844] GetCurrentThreadId () returned 0x970 [0055.852] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0055.852] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0055.852] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x34f3038, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0055.852] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0055.852] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAADZaKHJnogKvdj+acARiwbRGuU+rP2N0+ywashaUG/2f9+1cWOTTKSQVO3JJVd1+xIB5aUbvSxlz0xGZrOzG++iG2ksGh1nQT5mFSYRYxq6u4wyL5BYeph6/JZiwowr51Bg6kAtOvDQfNBhHWlDpUDFEqO5jE6f6bVG3KBVSbRzSV24RYRgOESZ2bXBIIz4os7wy6wZLh/JyCkLdRnAJuy8r0mhrXi+w6g==") returned 232 [0055.852] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x3, wMilliseconds=0x7d)) [0055.852] GetCurrentThreadId () returned 0x970 [0055.852] GetCurrentThreadId () returned 0x970 [0055.852] GetCurrentThreadId () returned 0x970 [0055.852] GetCurrentThreadId () returned 0x970 [0055.852] GetCurrentThreadId () returned 0x970 [0055.852] GetCurrentThreadId () returned 0x970 [0055.852] GetCurrentThreadId () returned 0x970 [0055.852] GetCurrentThreadId () returned 0x970 [0055.852] GetCurrentThreadId () returned 0x970 [0055.852] GetCurrentThreadId () returned 0x970 [0055.852] GetCurrentThreadId () returned 0x970 [0055.852] GetCurrentThreadId () returned 0x970 [0055.852] GetCurrentThreadId () returned 0x970 [0055.852] GetCurrentThreadId () returned 0x970 [0055.852] GetCurrentThreadId () returned 0x970 [0055.852] GetCurrentThreadId () returned 0x970 [0055.852] GetCurrentThreadId () returned 0x970 [0055.852] GetCurrentThreadId () returned 0x970 [0055.852] GetCurrentThreadId () returned 0x970 [0055.852] GetCurrentThreadId () returned 0x970 [0055.852] GetCurrentThreadId () returned 0x970 [0055.852] GetCurrentThreadId () returned 0x970 [0055.852] GetCurrentThreadId () returned 0x970 [0055.852] GetCurrentThreadId () returned 0x970 [0055.852] GetCurrentThreadId () returned 0x970 [0055.852] GetCurrentThreadId () returned 0x970 [0055.852] GetCurrentThreadId () returned 0x970 [0055.852] GetCurrentThreadId () returned 0x970 [0055.852] GetCurrentThreadId () returned 0x970 [0055.852] GetCurrentThreadId () returned 0x970 [0055.852] GetCurrentThreadId () returned 0x970 [0055.852] GetCurrentThreadId () returned 0x970 [0055.852] GetCurrentThreadId () returned 0x970 [0055.852] GetCurrentThreadId () returned 0x970 [0055.853] GetCurrentThreadId () returned 0x970 [0055.853] GetCurrentThreadId () returned 0x970 [0055.853] GetCurrentThreadId () returned 0x970 [0055.853] GetCurrentThreadId () returned 0x970 [0055.853] GetCurrentThreadId () returned 0x970 [0055.853] GetCurrentThreadId () returned 0x970 [0055.853] GetCurrentThreadId () returned 0x970 [0055.853] GetCurrentThreadId () returned 0x970 [0055.853] GetCurrentThreadId () returned 0x970 [0055.853] GetCurrentThreadId () returned 0x970 [0055.853] GetCurrentThreadId () returned 0x970 [0055.853] GetCurrentThreadId () returned 0x970 [0055.853] GetCurrentThreadId () returned 0x970 [0055.853] GetCurrentThreadId () returned 0x970 [0055.853] GetCurrentThreadId () returned 0x970 [0055.853] GetCurrentThreadId () returned 0x970 [0055.853] GetCurrentThreadId () returned 0x970 [0055.853] GetCurrentThreadId () returned 0x970 [0055.853] GetCurrentThreadId () returned 0x970 [0055.853] GetCurrentThreadId () returned 0x970 [0055.853] GetCurrentThreadId () returned 0x970 [0055.853] GetCurrentThreadId () returned 0x970 [0055.853] GetCurrentThreadId () returned 0x970 [0055.853] GetCurrentThreadId () returned 0x970 [0055.853] GetCurrentThreadId () returned 0x970 [0055.853] GetCurrentThreadId () returned 0x970 [0055.853] GetCurrentThreadId () returned 0x970 [0055.853] GetCurrentThreadId () returned 0x970 [0055.853] GetCurrentThreadId () returned 0x970 [0055.853] GetCurrentThreadId () returned 0x970 [0055.853] GetCurrentThreadId () returned 0x970 [0055.853] GetCurrentThreadId () returned 0x970 [0055.853] GetCurrentThreadId () returned 0x970 [0055.853] GetCurrentThreadId () returned 0x970 [0055.853] GetCurrentThreadId () returned 0x970 [0055.853] GetCurrentThreadId () returned 0x970 [0055.853] GetCurrentThreadId () returned 0x970 [0055.853] GetCurrentThreadId () returned 0x970 [0055.853] GetCurrentThreadId () returned 0x970 [0055.853] GetCurrentThreadId () returned 0x970 [0055.853] GetCurrentThreadId () returned 0x970 [0055.853] GetCurrentThreadId () returned 0x970 [0055.853] GetCurrentThreadId () returned 0x970 [0055.853] GetCurrentThreadId () returned 0x970 [0055.853] GetCurrentThreadId () returned 0x970 [0055.853] GetCurrentThreadId () returned 0x970 [0055.853] GetCurrentThreadId () returned 0x970 [0055.854] GetCurrentThreadId () returned 0x970 [0055.854] GetCurrentThreadId () returned 0x970 [0055.854] GetCurrentThreadId () returned 0x970 [0055.854] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAADZaKHJnogKvdj+acARiwbRGuU+rP2N0+ywashaUG/2f9+1cWOTTKSQVO3JJVd1+xIB5aUbvSxlz0xGZrOzG++iG2ksGh1nQT5mFSYRYxq6u4wyL5BYeph6/JZiwowr51Bg6kAtOvDQfNBhHWlDpUDFEqO5jE6f6bVG3KBVSbRzSV24RYRgOESZ2bXBIIz4os7wy6wZLh/JyCkLdRnAJuy8r0mhrXi+w6g==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0055.854] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAADZaKHJnogKvdj+acARiwbRGuU+rP2N0+ywashaUG/2f9+1cWOTTKSQVO3JJVd1+xIB5aUbvSxlz0xGZrOzG++iG2ksGh1nQT5mFSYRYxq6u4wyL5BYeph6/JZiwowr51Bg6kAtOvDQfNBhHWlDpUDFEqO5jE6f6bVG3KBVSbRzSV24RYRgOESZ2bXBIIz4os7wy6wZLh/JyCkLdRnAJuy8r0mhrXi+w6g==", cchWideChar=245, lpMultiByteStr=0x353933c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAADZaKHJnogKvdj+acARiwbRGuU+rP2N0+ywashaUG/2f9+1cWOTTKSQVO3JJVd1+xIB5aUbvSxlz0xGZrOzG++iG2ksGh1nQT5mFSYRYxq6u4wyL5BYeph6/JZiwowr51Bg6kAtOvDQfNBhHWlDpUDFEqO5jE6f6bVG3KBVSbRzSV24RYRgOESZ2bXBIIz4os7wy6wZLh/JyCkLdRnAJuy8r0mhrXi+w6g==", lpUsedDefaultChar=0x0) returned 245 [0055.854] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0055.854] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0055.854] CloseHandle (hObject=0x158) returned 1 [0055.854] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml")) returned 1 [0055.856] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=17611987213) returned 1 [0055.857] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\Файл зашифрован [AccessMUISet.XML].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\Файл зашифрован [accessmuiset.xml].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0055.857] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0055.857] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0055.857] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0055.857] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0055.857] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0055.857] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0055.857] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0055.857] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0055.857] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0055.857] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0055.857] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0055.857] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0055.858] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0055.858] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0055.858] SetEndOfFile (hFile=0x158) returned 1 [0055.858] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0055.858] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0055.858] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0055.858] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0055.858] WriteFile (in: hFile=0x158, lpBuffer=0x361ff08*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x361ff08*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0055.859] WriteFile (in: hFile=0x158, lpBuffer=0x35eff9c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35eff9c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0055.859] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="9YmNbR~qpfOE&g)\\2DwthqW}\"YfU7YT6", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0055.859] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="9YmNbR~qpfOE&g)\\2DwthqW}\"YfU7YT6", cchWideChar=32, lpMultiByteStr=0x2033c84, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="9YmNbR~qpfOE&g)\\2DwthqW}\"YfU7YT6", lpUsedDefaultChar=0x0) returned 32 [0055.859] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0055.859] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0055.859] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUISet.XML", cAlternateFileName="ACCESS~2.XML")) returned 0x295098 [0055.859] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0055.859] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0055.859] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml")) returned 0x20 [0055.859] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml")) returned 0x20 [0055.859] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml")) returned 0x20 [0055.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml")) returned 0x20 [0055.860] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333)) returned 1 [0055.860] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0055.860] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0055.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml")) returned 0x20 [0055.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml")) returned 0x20 [0055.860] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0055.860] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0055.860] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0055.860] SetEndOfFile (hFile=0x158) returned 1 [0055.861] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AccessMUISet.XML", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0055.861] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AccessMUISet.XML", cchWideChar=16, lpMultiByteStr=0x1ff8a14, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AccessMUISet.XML", lpUsedDefaultChar=0x0) returned 16 [0055.861] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AccessMUISet.XML", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0055.861] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AccessMUISet.XML", cchWideChar=16, lpMultiByteStr=0x1ff885c, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AccessMUISet.XML", lpUsedDefaultChar=0x0) returned 16 [0055.861] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff885c, cbMultiByte=16, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="AccessMUISet.XMLli\x01") returned 16 [0055.861] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AccessMUISet.XML", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0055.861] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AccessMUISet.XML", cchWideChar=16, lpMultiByteStr=0x1ff8a14, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AccessMUISet.XML", lpUsedDefaultChar=0x0) returned 16 [0055.861] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0055.861] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0055.861] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x333 [0055.861] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0055.861] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0055.861] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0055.878] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AccessMUISet.XML", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0055.878] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AccessMUISet.XML", cchWideChar=16, lpMultiByteStr=0x1ff8a14, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AccessMUISet.XML", lpUsedDefaultChar=0x0) returned 16 [0055.878] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AccessMUISet.XML", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0055.878] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AccessMUISet.XML", cchWideChar=16, lpMultiByteStr=0x1ff885c, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AccessMUISet.XML", lpUsedDefaultChar=0x0) returned 16 [0055.878] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff885c, cbMultiByte=16, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="AccessMUISet.XMLet.XMLli\x01") returned 16 [0055.878] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AccessMUISet.XML", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0055.878] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AccessMUISet.XML", cchWideChar=16, lpMultiByteStr=0x1ff8a14, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AccessMUISet.XML", lpUsedDefaultChar=0x0) returned 16 [0055.878] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0055.879] CharToOemA (in: pSrc="AccessMUISet.XML", pDst=0x1ff885c | out: pDst="AccessMUISet.XML") returned 1 [0055.879] WriteFile (in: hFile=0x158, lpBuffer=0x1ff885c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1ff885c*, lpNumberOfBytesWritten=0x18e048*=0x10, lpOverlapped=0x0) returned 1 [0055.879] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0055.879] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0055.879] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0055.879] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=17614277867) returned 1 [0055.879] ReadFile (in: hFile=0x11c, lpBuffer=0x378d0a0, nNumberOfBytesToRead=0x333, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x378d0a0*, lpNumberOfBytesRead=0x18dd7c*=0x333, lpOverlapped=0x0) returned 1 [0055.881] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0055.881] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=17614408670) returned 1 [0055.889] WriteFile (in: hFile=0x158, lpBuffer=0x1fea2b8*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fea2b8*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0055.889] ReadFile (in: hFile=0x11c, lpBuffer=0x378d0a0, nNumberOfBytesToRead=0x333, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x378d0a0*, lpNumberOfBytesRead=0x18de38*=0x333, lpOverlapped=0x0) returned 1 [0055.889] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x4b [0055.889] WriteFile (in: hFile=0x158, lpBuffer=0x378d410*, nNumberOfBytesToWrite=0x333, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x378d410*, lpNumberOfBytesWritten=0x18de10*=0x333, lpOverlapped=0x0) returned 1 [0055.889] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x37e [0055.889] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0055.889] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0055.889] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0055.889] SetFilePointer (in: hFile=0x158, lDistanceToMove=16, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2e [0055.889] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x388 [0055.889] CloseHandle (hObject=0x11c) returned 1 [0055.890] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x388 [0055.890] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x388 [0055.890] SetFilePointer (in: hFile=0x158, lDistanceToMove=904, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x388 [0055.890] SetFilePointer (in: hFile=0x158, lDistanceToMove=904, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x388 [0055.890] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x388 [0055.890] SetFilePointer (in: hFile=0x158, lDistanceToMove=904, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x388 [0055.890] SetEndOfFile (hFile=0x158) returned 1 [0055.890] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x388 [0055.890] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x388 [0055.890] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AccessMUISet.XML", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0055.890] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AccessMUISet.XML", cchWideChar=16, lpMultiByteStr=0x1ff885c, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AccessMUISet.XML", lpUsedDefaultChar=0x0) returned 16 [0055.890] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AccessMUISet.XML", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0055.890] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AccessMUISet.XML", cchWideChar=16, lpMultiByteStr=0x1ff8a14, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AccessMUISet.XML", lpUsedDefaultChar=0x0) returned 16 [0055.890] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff8a14, cbMultiByte=16, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="AccessMUISet.XML\x18믉`믑`") returned 16 [0055.890] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AccessMUISet.XML", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0055.890] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AccessMUISet.XML", cchWideChar=16, lpMultiByteStr=0x1ff885c, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AccessMUISet.XML", lpUsedDefaultChar=0x0) returned 16 [0055.890] WriteFile (in: hFile=0x158, lpBuffer=0x3770b58*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3770b58*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0055.891] CharToOemA (in: pSrc="AccessMUISet.XML", pDst=0x1ff8a14 | out: pDst="AccessMUISet.XML") returned 1 [0055.891] WriteFile (in: hFile=0x158, lpBuffer=0x1ff8a14*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1ff8a14*, lpNumberOfBytesWritten=0x18efcc*=0x10, lpOverlapped=0x0) returned 1 [0055.891] WriteFile (in: hFile=0x158, lpBuffer=0x1fea110*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea110*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0055.891] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0055.891] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0055.891] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x3d1 [0055.891] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x3d1 [0055.891] WriteFile (in: hFile=0x158, lpBuffer=0x361ff08*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x361ff08*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0055.891] WriteFile (in: hFile=0x158, lpBuffer=0x35eff9c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35eff9c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0055.891] DeleteFileW (lpFileName="") returned 0 [0055.891] GetLastError () returned 0x3 [0055.891] GetFileAttributesW (lpFileName="") returned 0xffffffff [0055.891] SetLastError (dwErrCode=0x3) [0055.891] FlushFileBuffers (hFile=0x158) returned 1 [0055.895] GetCurrentThreadId () returned 0x970 [0055.895] GetCurrentThreadId () returned 0x970 [0055.895] GetCurrentThreadId () returned 0x970 [0055.895] GetCurrentThreadId () returned 0x970 [0055.895] GetCurrentThreadId () returned 0x970 [0055.895] GetCurrentThreadId () returned 0x970 [0055.895] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x488 [0055.895] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x488 [0055.895] SetFilePointer (in: hFile=0x158, lDistanceToMove=1160, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x488 [0055.895] CloseHandle (hObject=0x158) returned 1 [0055.896] GetCurrentThreadId () returned 0x970 [0055.896] GetCurrentThreadId () returned 0x970 [0055.896] GetCurrentThreadId () returned 0x970 [0055.896] GetCurrentThreadId () returned 0x970 [0055.896] GetCurrentThreadId () returned 0x970 [0055.896] GetCurrentThreadId () returned 0x970 [0055.896] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\Файл зашифрован [AccessMUISet.XML].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\Файл зашифрован [accessmuiset.xml].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0055.896] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x488 [0055.896] SetFilePointer (in: hFile=0x158, lDistanceToMove=1032, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x408 [0055.896] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0055.896] GetFileType (hFile=0x158) returned 0x1 [0055.896] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x3, wMilliseconds=0xac)) [0055.896] GetCurrentThreadId () returned 0x970 [0055.896] GetCurrentThreadId () returned 0x970 [0055.896] GetCurrentThreadId () returned 0x970 [0055.896] GetCurrentThreadId () returned 0x970 [0055.896] GetCurrentThreadId () returned 0x970 [0055.896] GetCurrentThreadId () returned 0x970 [0055.896] GetCurrentThreadId () returned 0x970 [0055.896] GetCurrentThreadId () returned 0x970 [0055.896] GetCurrentThreadId () returned 0x970 [0055.896] GetCurrentThreadId () returned 0x970 [0055.896] GetCurrentThreadId () returned 0x970 [0055.896] GetCurrentThreadId () returned 0x970 [0055.896] GetCurrentThreadId () returned 0x970 [0055.896] GetCurrentThreadId () returned 0x970 [0055.896] GetCurrentThreadId () returned 0x970 [0055.896] GetCurrentThreadId () returned 0x970 [0055.896] GetCurrentThreadId () returned 0x970 [0055.896] GetCurrentThreadId () returned 0x970 [0055.897] GetCurrentThreadId () returned 0x970 [0055.897] GetCurrentThreadId () returned 0x970 [0055.897] GetCurrentThreadId () returned 0x970 [0055.897] GetCurrentThreadId () returned 0x970 [0055.897] GetCurrentThreadId () returned 0x970 [0055.897] GetCurrentThreadId () returned 0x970 [0055.897] GetCurrentThreadId () returned 0x970 [0055.897] GetCurrentThreadId () returned 0x970 [0055.897] GetCurrentThreadId () returned 0x970 [0055.897] GetCurrentThreadId () returned 0x970 [0055.897] GetCurrentThreadId () returned 0x970 [0055.897] GetCurrentThreadId () returned 0x970 [0055.897] GetCurrentThreadId () returned 0x970 [0055.897] GetCurrentThreadId () returned 0x970 [0055.897] GetCurrentThreadId () returned 0x970 [0055.897] GetCurrentThreadId () returned 0x970 [0055.897] GetCurrentThreadId () returned 0x970 [0055.897] GetCurrentThreadId () returned 0x970 [0055.897] GetCurrentThreadId () returned 0x970 [0055.897] GetCurrentThreadId () returned 0x970 [0055.897] GetCurrentThreadId () returned 0x970 [0055.897] GetCurrentThreadId () returned 0x970 [0055.897] GetCurrentThreadId () returned 0x970 [0055.897] GetCurrentThreadId () returned 0x970 [0055.897] GetCurrentThreadId () returned 0x970 [0055.897] GetCurrentThreadId () returned 0x970 [0055.897] GetCurrentThreadId () returned 0x970 [0055.897] GetCurrentThreadId () returned 0x970 [0055.897] GetCurrentThreadId () returned 0x970 [0055.897] GetCurrentThreadId () returned 0x970 [0055.897] GetCurrentThreadId () returned 0x970 [0055.897] GetCurrentThreadId () returned 0x970 [0055.897] GetCurrentThreadId () returned 0x970 [0055.897] GetCurrentThreadId () returned 0x970 [0055.897] GetCurrentThreadId () returned 0x970 [0055.897] GetCurrentThreadId () returned 0x970 [0055.897] GetCurrentThreadId () returned 0x970 [0055.897] GetCurrentThreadId () returned 0x970 [0055.897] GetCurrentThreadId () returned 0x970 [0055.897] GetCurrentThreadId () returned 0x970 [0055.897] GetCurrentThreadId () returned 0x970 [0055.897] GetCurrentThreadId () returned 0x970 [0055.897] GetCurrentThreadId () returned 0x970 [0055.897] GetCurrentThreadId () returned 0x970 [0055.897] GetCurrentThreadId () returned 0x970 [0055.897] GetCurrentThreadId () returned 0x970 [0055.897] GetCurrentThreadId () returned 0x970 [0055.897] GetCurrentThreadId () returned 0x970 [0055.898] GetCurrentThreadId () returned 0x970 [0055.898] GetCurrentThreadId () returned 0x970 [0055.898] GetCurrentThreadId () returned 0x970 [0055.898] GetCurrentThreadId () returned 0x970 [0055.898] GetCurrentThreadId () returned 0x970 [0055.898] GetCurrentThreadId () returned 0x970 [0055.898] GetCurrentThreadId () returned 0x970 [0055.898] GetCurrentThreadId () returned 0x970 [0055.898] GetCurrentThreadId () returned 0x970 [0055.898] GetCurrentThreadId () returned 0x970 [0055.898] GetCurrentThreadId () returned 0x970 [0055.898] GetCurrentThreadId () returned 0x970 [0055.898] GetCurrentThreadId () returned 0x970 [0055.898] GetCurrentThreadId () returned 0x970 [0055.898] GetCurrentThreadId () returned 0x970 [0055.898] GetCurrentThreadId () returned 0x970 [0055.898] GetCurrentThreadId () returned 0x970 [0055.898] GetCurrentThreadId () returned 0x970 [0055.898] GetCurrentThreadId () returned 0x970 [0055.898] GetCurrentThreadId () returned 0x970 [0055.898] GetCurrentThreadId () returned 0x970 [0055.898] GetCurrentThreadId () returned 0x970 [0055.898] GetCurrentThreadId () returned 0x970 [0055.898] GetCurrentThreadId () returned 0x970 [0055.898] GetCurrentThreadId () returned 0x970 [0055.898] GetCurrentThreadId () returned 0x970 [0055.898] GetCurrentThreadId () returned 0x970 [0055.898] GetCurrentThreadId () returned 0x970 [0055.898] GetCurrentThreadId () returned 0x970 [0055.898] GetCurrentThreadId () returned 0x970 [0055.898] GetCurrentThreadId () returned 0x970 [0055.898] GetCurrentThreadId () returned 0x970 [0055.898] GetCurrentThreadId () returned 0x970 [0055.898] GetCurrentThreadId () returned 0x970 [0055.898] GetCurrentThreadId () returned 0x970 [0055.898] GetCurrentThreadId () returned 0x970 [0055.898] GetCurrentThreadId () returned 0x970 [0055.898] GetCurrentThreadId () returned 0x970 [0055.898] GetCurrentThreadId () returned 0x970 [0055.898] GetCurrentThreadId () returned 0x970 [0055.898] GetCurrentThreadId () returned 0x970 [0055.898] GetCurrentThreadId () returned 0x970 [0055.898] GetCurrentThreadId () returned 0x970 [0055.898] GetCurrentThreadId () returned 0x970 [0055.898] GetCurrentThreadId () returned 0x970 [0055.898] GetCurrentThreadId () returned 0x970 [0055.898] GetCurrentThreadId () returned 0x970 [0055.899] GetCurrentThreadId () returned 0x970 [0055.899] GetCurrentThreadId () returned 0x970 [0055.899] GetCurrentThreadId () returned 0x970 [0055.899] GetCurrentThreadId () returned 0x970 [0055.899] GetCurrentThreadId () returned 0x970 [0055.899] GetCurrentThreadId () returned 0x970 [0055.899] GetCurrentThreadId () returned 0x970 [0055.899] GetCurrentThreadId () returned 0x970 [0055.899] GetCurrentThreadId () returned 0x970 [0055.899] GetCurrentThreadId () returned 0x970 [0055.899] GetCurrentThreadId () returned 0x970 [0055.899] GetCurrentThreadId () returned 0x970 [0055.899] GetCurrentThreadId () returned 0x970 [0055.899] GetCurrentThreadId () returned 0x970 [0055.899] GetCurrentThreadId () returned 0x970 [0055.899] GetCurrentThreadId () returned 0x970 [0055.899] GetCurrentThreadId () returned 0x970 [0055.899] GetCurrentThreadId () returned 0x970 [0055.899] GetCurrentThreadId () returned 0x970 [0055.899] GetCurrentThreadId () returned 0x970 [0055.899] GetCurrentThreadId () returned 0x970 [0055.899] GetCurrentThreadId () returned 0x970 [0055.899] GetCurrentThreadId () returned 0x970 [0055.899] GetCurrentThreadId () returned 0x970 [0055.899] GetCurrentThreadId () returned 0x970 [0055.899] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.899] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.899] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fed3b0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0055.899] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.899] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.899] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fed3b0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0055.899] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.899] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.899] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0055.899] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.899] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.899] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0055.899] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.899] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.899] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fed410, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0055.899] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.899] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.899] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fed410, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0055.900] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.900] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.900] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fed410, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0055.900] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x3, wMilliseconds=0xac)) [0055.900] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="9YmNbR~qpfOE&g)\\2DwthqW}\"YfU7YT6", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0055.900] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="9YmNbR~qpfOE&g)\\2DwthqW}\"YfU7YT6", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0055.900] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="9YmNbR~qpfOE&g)\\2DwthqW}\"YfU7YT6", cchWideChar=32, lpMultiByteStr=0x2001768, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="9YmNbR~qpfOE&g)\\2DwthqW}\"YfU7YT6", lpUsedDefaultChar=0x0) returned 32 [0055.900] GetCurrentThreadId () returned 0x970 [0055.900] GetCurrentThreadId () returned 0x970 [0055.900] GetCurrentThreadId () returned 0x970 [0055.900] GetCurrentThreadId () returned 0x970 [0055.900] GetCurrentThreadId () returned 0x970 [0055.900] GetCurrentThreadId () returned 0x970 [0055.907] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0055.907] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0055.907] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x34f3128, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0055.907] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0055.907] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAABCA3mCMqH8A6wrRYIaGH3D7ZYl9Zpfx9N8xaEooiNfosft1mpKDI+pDnEpo2eqEV9ftNIpRlH8bYCG+XQm+1TzozLua0MrI0nJcQEDu5lNYMbQc0n7jU/yYOQ8no9d5+z/c/zYdylqFq78OlxaIKH0lIDBq7t8AgW7cve7/9db/C4MJdNVlk1bLHvPes4ytPVtCL2uE9C/CBzHDnYH//S0PR73IJ6V7kw==") returned 232 [0055.907] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x3, wMilliseconds=0xac)) [0055.907] GetCurrentThreadId () returned 0x970 [0055.907] GetCurrentThreadId () returned 0x970 [0055.907] GetCurrentThreadId () returned 0x970 [0055.907] GetCurrentThreadId () returned 0x970 [0055.907] GetCurrentThreadId () returned 0x970 [0055.907] GetCurrentThreadId () returned 0x970 [0055.907] GetCurrentThreadId () returned 0x970 [0055.907] GetCurrentThreadId () returned 0x970 [0055.907] GetCurrentThreadId () returned 0x970 [0055.907] GetCurrentThreadId () returned 0x970 [0055.907] GetCurrentThreadId () returned 0x970 [0055.907] GetCurrentThreadId () returned 0x970 [0055.907] GetCurrentThreadId () returned 0x970 [0055.907] GetCurrentThreadId () returned 0x970 [0055.907] GetCurrentThreadId () returned 0x970 [0055.907] GetCurrentThreadId () returned 0x970 [0055.907] GetCurrentThreadId () returned 0x970 [0055.907] GetCurrentThreadId () returned 0x970 [0055.907] GetCurrentThreadId () returned 0x970 [0055.907] GetCurrentThreadId () returned 0x970 [0055.907] GetCurrentThreadId () returned 0x970 [0055.907] GetCurrentThreadId () returned 0x970 [0055.907] GetCurrentThreadId () returned 0x970 [0055.907] GetCurrentThreadId () returned 0x970 [0055.907] GetCurrentThreadId () returned 0x970 [0055.907] GetCurrentThreadId () returned 0x970 [0055.907] GetCurrentThreadId () returned 0x970 [0055.907] GetCurrentThreadId () returned 0x970 [0055.907] GetCurrentThreadId () returned 0x970 [0055.908] GetCurrentThreadId () returned 0x970 [0055.908] GetCurrentThreadId () returned 0x970 [0055.908] GetCurrentThreadId () returned 0x970 [0055.908] GetCurrentThreadId () returned 0x970 [0055.908] GetCurrentThreadId () returned 0x970 [0055.908] GetCurrentThreadId () returned 0x970 [0055.908] GetCurrentThreadId () returned 0x970 [0055.908] GetCurrentThreadId () returned 0x970 [0055.908] GetCurrentThreadId () returned 0x970 [0055.908] GetCurrentThreadId () returned 0x970 [0055.908] GetCurrentThreadId () returned 0x970 [0055.908] GetCurrentThreadId () returned 0x970 [0055.908] GetCurrentThreadId () returned 0x970 [0055.908] GetCurrentThreadId () returned 0x970 [0055.908] GetCurrentThreadId () returned 0x970 [0055.908] GetCurrentThreadId () returned 0x970 [0055.908] GetCurrentThreadId () returned 0x970 [0055.908] GetCurrentThreadId () returned 0x970 [0055.908] GetCurrentThreadId () returned 0x970 [0055.908] GetCurrentThreadId () returned 0x970 [0055.908] GetCurrentThreadId () returned 0x970 [0055.908] GetCurrentThreadId () returned 0x970 [0055.908] GetCurrentThreadId () returned 0x970 [0055.908] GetCurrentThreadId () returned 0x970 [0055.908] GetCurrentThreadId () returned 0x970 [0055.908] GetCurrentThreadId () returned 0x970 [0055.908] GetCurrentThreadId () returned 0x970 [0055.908] GetCurrentThreadId () returned 0x970 [0055.908] GetCurrentThreadId () returned 0x970 [0055.908] GetCurrentThreadId () returned 0x970 [0055.908] GetCurrentThreadId () returned 0x970 [0055.908] GetCurrentThreadId () returned 0x970 [0055.908] GetCurrentThreadId () returned 0x970 [0055.908] GetCurrentThreadId () returned 0x970 [0055.908] GetCurrentThreadId () returned 0x970 [0055.908] GetCurrentThreadId () returned 0x970 [0055.908] GetCurrentThreadId () returned 0x970 [0055.908] GetCurrentThreadId () returned 0x970 [0055.908] GetCurrentThreadId () returned 0x970 [0055.908] GetCurrentThreadId () returned 0x970 [0055.908] GetCurrentThreadId () returned 0x970 [0055.908] GetCurrentThreadId () returned 0x970 [0055.908] GetCurrentThreadId () returned 0x970 [0055.908] GetCurrentThreadId () returned 0x970 [0055.908] GetCurrentThreadId () returned 0x970 [0055.908] GetCurrentThreadId () returned 0x970 [0055.908] GetCurrentThreadId () returned 0x970 [0055.908] GetCurrentThreadId () returned 0x970 [0055.908] GetCurrentThreadId () returned 0x970 [0055.909] GetCurrentThreadId () returned 0x970 [0055.909] GetCurrentThreadId () returned 0x970 [0055.909] GetCurrentThreadId () returned 0x970 [0055.909] GetCurrentThreadId () returned 0x970 [0055.909] GetCurrentThreadId () returned 0x970 [0055.909] GetCurrentThreadId () returned 0x970 [0055.909] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAABCA3mCMqH8A6wrRYIaGH3D7ZYl9Zpfx9N8xaEooiNfosft1mpKDI+pDnEpo2eqEV9ftNIpRlH8bYCG+XQm+1TzozLua0MrI0nJcQEDu5lNYMbQc0n7jU/yYOQ8no9d5+z/c/zYdylqFq78OlxaIKH0lIDBq7t8AgW7cve7/9db/C4MJdNVlk1bLHvPes4ytPVtCL2uE9C/CBzHDnYH//S0PR73IJ6V7kw==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0055.909] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAABCA3mCMqH8A6wrRYIaGH3D7ZYl9Zpfx9N8xaEooiNfosft1mpKDI+pDnEpo2eqEV9ftNIpRlH8bYCG+XQm+1TzozLua0MrI0nJcQEDu5lNYMbQc0n7jU/yYOQ8no9d5+z/c/zYdylqFq78OlxaIKH0lIDBq7t8AgW7cve7/9db/C4MJdNVlk1bLHvPes4ytPVtCL2uE9C/CBzHDnYH//S0PR73IJ6V7kw==", cchWideChar=245, lpMultiByteStr=0x353933c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAABCA3mCMqH8A6wrRYIaGH3D7ZYl9Zpfx9N8xaEooiNfosft1mpKDI+pDnEpo2eqEV9ftNIpRlH8bYCG+XQm+1TzozLua0MrI0nJcQEDu5lNYMbQc0n7jU/yYOQ8no9d5+z/c/zYdylqFq78OlxaIKH0lIDBq7t8AgW7cve7/9db/C4MJdNVlk1bLHvPes4ytPVtCL2uE9C/CBzHDnYH//S0PR73IJ6V7kw==", lpUsedDefaultChar=0x0) returned 245 [0055.909] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0055.909] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0055.909] CloseHandle (hObject=0x158) returned 1 [0055.910] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml")) returned 1 [0055.910] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=17617381569) returned 1 [0055.910] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\Файл зашифрован [SETUP.XML].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\Файл зашифрован [setup.xml].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0055.911] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0055.911] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0055.911] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0055.911] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0055.911] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0055.911] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0055.911] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0055.911] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0055.911] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0055.911] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0055.911] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0055.911] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0055.911] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0055.911] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0055.911] SetEndOfFile (hFile=0x158) returned 1 [0055.912] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0055.912] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0055.912] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0055.912] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0055.912] WriteFile (in: hFile=0x158, lpBuffer=0x361ff08*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x361ff08*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0055.912] WriteFile (in: hFile=0x158, lpBuffer=0x35f005c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f005c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0055.913] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Z=ut1k~u^n{m$^H\\sM?C+Y133=!rB$2!", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0055.913] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Z=ut1k~u^n{m$^H\\sM?C+Y133=!rB$2!", cchWideChar=32, lpMultiByteStr=0x2033c14, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Z=ut1k~u^n{m$^H\\sM?C+Y133=!rB$2!", lpUsedDefaultChar=0x0) returned 32 [0055.913] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0055.913] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0055.913] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc111bb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0x295098 [0055.913] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0055.913] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0055.913] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml")) returned 0x20 [0055.913] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml")) returned 0x20 [0055.913] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml")) returned 0x20 [0055.913] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml")) returned 0x20 [0055.913] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc111bb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40)) returned 1 [0055.913] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0055.913] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0055.913] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml")) returned 0x20 [0055.913] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml")) returned 0x20 [0055.913] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0055.914] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0055.914] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0055.914] SetEndOfFile (hFile=0x158) returned 1 [0055.914] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0055.914] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x1fe43ec, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SETUP.XML", lpUsedDefaultChar=0x0) returned 9 [0055.914] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0055.914] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x1fe36ec, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SETUP.XML", lpUsedDefaultChar=0x0) returned 9 [0055.915] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe36ec, cbMultiByte=9, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="SETUP.XMLLet.XMLli\x01") returned 9 [0055.915] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0055.915] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x1fe43ec, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SETUP.XML", lpUsedDefaultChar=0x0) returned 9 [0055.915] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0055.915] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0055.915] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0xa40 [0055.915] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0055.915] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0055.915] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0055.915] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0055.915] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x1fe43ec, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SETUP.XML", lpUsedDefaultChar=0x0) returned 9 [0055.915] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0055.915] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x1fe36ec, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SETUP.XML", lpUsedDefaultChar=0x0) returned 9 [0055.915] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe36ec, cbMultiByte=9, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="SETUP.XMLUP.XMLLet.XMLli\x01") returned 9 [0055.915] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0055.915] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x1fe43ec, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SETUP.XML", lpUsedDefaultChar=0x0) returned 9 [0055.915] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0055.916] CharToOemA (in: pSrc="SETUP.XML", pDst=0x1fe36ec | out: pDst="SETUP.XML") returned 1 [0055.916] WriteFile (in: hFile=0x158, lpBuffer=0x1fe36ec*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe36ec*, lpNumberOfBytesWritten=0x18e048*=0x9, lpOverlapped=0x0) returned 1 [0055.916] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0055.916] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0055.916] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0055.916] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=17617989110) returned 1 [0055.916] ReadFile (in: hFile=0x11c, lpBuffer=0x378d080, nNumberOfBytesToRead=0xa40, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x378d080*, lpNumberOfBytesRead=0x18dd7c*=0xa40, lpOverlapped=0x0) returned 1 [0055.918] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0055.918] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=17618123549) returned 1 [0055.926] WriteFile (in: hFile=0x158, lpBuffer=0x1fea228*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fea228*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0055.926] ReadFile (in: hFile=0x11c, lpBuffer=0x378d080, nNumberOfBytesToRead=0xa40, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x378d080*, lpNumberOfBytesRead=0x18de38*=0xa40, lpOverlapped=0x0) returned 1 [0055.926] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x44 [0055.926] WriteFile (in: hFile=0x158, lpBuffer=0x37cf3a0*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x37cf3a0*, lpNumberOfBytesWritten=0x18de10*=0xa40, lpOverlapped=0x0) returned 1 [0055.926] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0xa84 [0055.926] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0055.927] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0055.927] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0055.927] SetFilePointer (in: hFile=0x158, lDistanceToMove=9, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x27 [0055.927] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0xa8e [0055.927] CloseHandle (hObject=0x11c) returned 1 [0055.927] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xa8e [0055.927] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xa8e [0055.927] SetFilePointer (in: hFile=0x158, lDistanceToMove=2702, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xa8e [0055.927] SetFilePointer (in: hFile=0x158, lDistanceToMove=2702, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0xa8e [0055.927] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xa8e [0055.927] SetFilePointer (in: hFile=0x158, lDistanceToMove=2702, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0xa8e [0055.927] SetEndOfFile (hFile=0x158) returned 1 [0055.927] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xa8e [0055.927] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xa8e [0055.927] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0055.927] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x1fe43ec, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SETUP.XML", lpUsedDefaultChar=0x0) returned 9 [0055.927] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0055.928] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x1fe3bac, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SETUP.XML", lpUsedDefaultChar=0x0) returned 9 [0055.928] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe3bac, cbMultiByte=9, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="SETUP.XML") returned 9 [0055.928] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0055.928] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x1fe43ec, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SETUP.XML", lpUsedDefaultChar=0x0) returned 9 [0055.928] WriteFile (in: hFile=0x158, lpBuffer=0x3770b58*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3770b58*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0055.928] CharToOemA (in: pSrc="SETUP.XML", pDst=0x1fe3bac | out: pDst="SETUP.XML") returned 1 [0055.928] WriteFile (in: hFile=0x158, lpBuffer=0x1fe3bac*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe3bac*, lpNumberOfBytesWritten=0x18efcc*=0x9, lpOverlapped=0x0) returned 1 [0055.928] WriteFile (in: hFile=0x158, lpBuffer=0x1fea2d8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea2d8*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0055.928] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0055.928] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0055.928] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xad0 [0055.928] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xad0 [0055.928] WriteFile (in: hFile=0x158, lpBuffer=0x361ff08*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x361ff08*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0055.928] WriteFile (in: hFile=0x158, lpBuffer=0x35f005c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f005c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0055.928] DeleteFileW (lpFileName="") returned 0 [0055.928] GetLastError () returned 0x3 [0055.928] GetFileAttributesW (lpFileName="") returned 0xffffffff [0055.928] SetLastError (dwErrCode=0x3) [0055.928] FlushFileBuffers (hFile=0x158) returned 1 [0055.931] GetCurrentThreadId () returned 0x970 [0055.931] GetCurrentThreadId () returned 0x970 [0055.931] GetCurrentThreadId () returned 0x970 [0055.931] GetCurrentThreadId () returned 0x970 [0055.931] GetCurrentThreadId () returned 0x970 [0055.931] GetCurrentThreadId () returned 0x970 [0055.931] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xb87 [0055.931] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xb87 [0055.931] SetFilePointer (in: hFile=0x158, lDistanceToMove=2951, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xb87 [0055.931] CloseHandle (hObject=0x158) returned 1 [0055.932] GetCurrentThreadId () returned 0x970 [0055.932] GetCurrentThreadId () returned 0x970 [0055.932] GetCurrentThreadId () returned 0x970 [0055.932] GetCurrentThreadId () returned 0x970 [0055.932] GetCurrentThreadId () returned 0x970 [0055.932] GetCurrentThreadId () returned 0x970 [0055.932] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\Файл зашифрован [SETUP.XML].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\Файл зашифрован [setup.xml].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0055.932] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb87 [0055.932] SetFilePointer (in: hFile=0x158, lDistanceToMove=2823, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb07 [0055.932] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0055.932] GetFileType (hFile=0x158) returned 0x1 [0055.932] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x3, wMilliseconds=0xcb)) [0055.932] GetCurrentThreadId () returned 0x970 [0055.932] GetCurrentThreadId () returned 0x970 [0055.932] GetCurrentThreadId () returned 0x970 [0055.932] GetCurrentThreadId () returned 0x970 [0055.933] GetCurrentThreadId () returned 0x970 [0055.933] GetCurrentThreadId () returned 0x970 [0055.933] GetCurrentThreadId () returned 0x970 [0055.933] GetCurrentThreadId () returned 0x970 [0055.933] GetCurrentThreadId () returned 0x970 [0055.933] GetCurrentThreadId () returned 0x970 [0055.933] GetCurrentThreadId () returned 0x970 [0055.933] GetCurrentThreadId () returned 0x970 [0055.933] GetCurrentThreadId () returned 0x970 [0055.933] GetCurrentThreadId () returned 0x970 [0055.933] GetCurrentThreadId () returned 0x970 [0055.933] GetCurrentThreadId () returned 0x970 [0055.933] GetCurrentThreadId () returned 0x970 [0055.933] GetCurrentThreadId () returned 0x970 [0055.933] GetCurrentThreadId () returned 0x970 [0055.933] GetCurrentThreadId () returned 0x970 [0055.933] GetCurrentThreadId () returned 0x970 [0055.933] GetCurrentThreadId () returned 0x970 [0055.933] GetCurrentThreadId () returned 0x970 [0055.933] GetCurrentThreadId () returned 0x970 [0055.933] GetCurrentThreadId () returned 0x970 [0055.933] GetCurrentThreadId () returned 0x970 [0055.933] GetCurrentThreadId () returned 0x970 [0055.933] GetCurrentThreadId () returned 0x970 [0055.933] GetCurrentThreadId () returned 0x970 [0055.933] GetCurrentThreadId () returned 0x970 [0055.933] GetCurrentThreadId () returned 0x970 [0055.933] GetCurrentThreadId () returned 0x970 [0055.933] GetCurrentThreadId () returned 0x970 [0055.933] GetCurrentThreadId () returned 0x970 [0055.933] GetCurrentThreadId () returned 0x970 [0055.933] GetCurrentThreadId () returned 0x970 [0055.933] GetCurrentThreadId () returned 0x970 [0055.933] GetCurrentThreadId () returned 0x970 [0055.933] GetCurrentThreadId () returned 0x970 [0055.933] GetCurrentThreadId () returned 0x970 [0055.933] GetCurrentThreadId () returned 0x970 [0055.933] GetCurrentThreadId () returned 0x970 [0055.933] GetCurrentThreadId () returned 0x970 [0055.933] GetCurrentThreadId () returned 0x970 [0055.933] GetCurrentThreadId () returned 0x970 [0055.933] GetCurrentThreadId () returned 0x970 [0055.933] GetCurrentThreadId () returned 0x970 [0055.933] GetCurrentThreadId () returned 0x970 [0055.933] GetCurrentThreadId () returned 0x970 [0055.933] GetCurrentThreadId () returned 0x970 [0055.933] GetCurrentThreadId () returned 0x970 [0055.934] GetCurrentThreadId () returned 0x970 [0055.934] GetCurrentThreadId () returned 0x970 [0055.934] GetCurrentThreadId () returned 0x970 [0055.934] GetCurrentThreadId () returned 0x970 [0055.934] GetCurrentThreadId () returned 0x970 [0055.934] GetCurrentThreadId () returned 0x970 [0055.934] GetCurrentThreadId () returned 0x970 [0055.934] GetCurrentThreadId () returned 0x970 [0055.934] GetCurrentThreadId () returned 0x970 [0055.934] GetCurrentThreadId () returned 0x970 [0055.934] GetCurrentThreadId () returned 0x970 [0055.934] GetCurrentThreadId () returned 0x970 [0055.934] GetCurrentThreadId () returned 0x970 [0055.934] GetCurrentThreadId () returned 0x970 [0055.934] GetCurrentThreadId () returned 0x970 [0055.934] GetCurrentThreadId () returned 0x970 [0055.934] GetCurrentThreadId () returned 0x970 [0055.934] GetCurrentThreadId () returned 0x970 [0055.934] GetCurrentThreadId () returned 0x970 [0055.934] GetCurrentThreadId () returned 0x970 [0055.934] GetCurrentThreadId () returned 0x970 [0055.934] GetCurrentThreadId () returned 0x970 [0055.934] GetCurrentThreadId () returned 0x970 [0055.934] GetCurrentThreadId () returned 0x970 [0055.934] GetCurrentThreadId () returned 0x970 [0055.934] GetCurrentThreadId () returned 0x970 [0055.934] GetCurrentThreadId () returned 0x970 [0055.934] GetCurrentThreadId () returned 0x970 [0055.934] GetCurrentThreadId () returned 0x970 [0055.934] GetCurrentThreadId () returned 0x970 [0055.934] GetCurrentThreadId () returned 0x970 [0055.934] GetCurrentThreadId () returned 0x970 [0055.934] GetCurrentThreadId () returned 0x970 [0055.934] GetCurrentThreadId () returned 0x970 [0055.934] GetCurrentThreadId () returned 0x970 [0055.934] GetCurrentThreadId () returned 0x970 [0055.934] GetCurrentThreadId () returned 0x970 [0055.934] GetCurrentThreadId () returned 0x970 [0055.934] GetCurrentThreadId () returned 0x970 [0055.934] GetCurrentThreadId () returned 0x970 [0055.934] GetCurrentThreadId () returned 0x970 [0055.934] GetCurrentThreadId () returned 0x970 [0055.934] GetCurrentThreadId () returned 0x970 [0055.934] GetCurrentThreadId () returned 0x970 [0055.934] GetCurrentThreadId () returned 0x970 [0055.934] GetCurrentThreadId () returned 0x970 [0055.934] GetCurrentThreadId () returned 0x970 [0055.934] GetCurrentThreadId () returned 0x970 [0055.934] GetCurrentThreadId () returned 0x970 [0055.935] GetCurrentThreadId () returned 0x970 [0055.935] GetCurrentThreadId () returned 0x970 [0055.935] GetCurrentThreadId () returned 0x970 [0055.935] GetCurrentThreadId () returned 0x970 [0055.935] GetCurrentThreadId () returned 0x970 [0055.935] GetCurrentThreadId () returned 0x970 [0055.935] GetCurrentThreadId () returned 0x970 [0055.935] GetCurrentThreadId () returned 0x970 [0055.935] GetCurrentThreadId () returned 0x970 [0055.935] GetCurrentThreadId () returned 0x970 [0055.935] GetCurrentThreadId () returned 0x970 [0055.935] GetCurrentThreadId () returned 0x970 [0055.935] GetCurrentThreadId () returned 0x970 [0055.935] GetCurrentThreadId () returned 0x970 [0055.935] GetCurrentThreadId () returned 0x970 [0055.935] GetCurrentThreadId () returned 0x970 [0055.935] GetCurrentThreadId () returned 0x970 [0055.935] GetCurrentThreadId () returned 0x970 [0055.935] GetCurrentThreadId () returned 0x970 [0055.935] GetCurrentThreadId () returned 0x970 [0055.935] GetCurrentThreadId () returned 0x970 [0055.935] GetCurrentThreadId () returned 0x970 [0055.935] GetCurrentThreadId () returned 0x970 [0055.935] GetCurrentThreadId () returned 0x970 [0055.935] GetCurrentThreadId () returned 0x970 [0055.935] GetCurrentThreadId () returned 0x970 [0055.935] GetCurrentThreadId () returned 0x970 [0055.935] GetCurrentThreadId () returned 0x970 [0055.935] GetCurrentThreadId () returned 0x970 [0055.935] GetCurrentThreadId () returned 0x970 [0055.935] GetCurrentThreadId () returned 0x970 [0055.935] GetCurrentThreadId () returned 0x970 [0055.935] GetCurrentThreadId () returned 0x970 [0055.935] GetCurrentThreadId () returned 0x970 [0055.935] GetCurrentThreadId () returned 0x970 [0055.935] GetCurrentThreadId () returned 0x970 [0055.935] GetCurrentThreadId () returned 0x970 [0055.935] GetCurrentThreadId () returned 0x970 [0055.935] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.935] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.935] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fed410, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0055.935] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.935] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.935] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fed410, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0055.935] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.935] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.935] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0055.936] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.936] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.936] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0055.936] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.936] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.936] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fed470, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0055.936] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.936] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.936] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fed470, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0055.936] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.936] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.936] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fed470, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0055.936] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x3, wMilliseconds=0xcb)) [0055.936] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Z=ut1k~u^n{m$^H\\sM?C+Y133=!rB$2!", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0055.936] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Z=ut1k~u^n{m$^H\\sM?C+Y133=!rB$2!", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0055.936] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Z=ut1k~u^n{m$^H\\sM?C+Y133=!rB$2!", cchWideChar=32, lpMultiByteStr=0x20017f8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Z=ut1k~u^n{m$^H\\sM?C+Y133=!rB$2!", lpUsedDefaultChar=0x0) returned 32 [0055.936] GetCurrentThreadId () returned 0x970 [0055.936] GetCurrentThreadId () returned 0x970 [0055.936] GetCurrentThreadId () returned 0x970 [0055.936] GetCurrentThreadId () returned 0x970 [0055.936] GetCurrentThreadId () returned 0x970 [0055.936] GetCurrentThreadId () returned 0x970 [0055.943] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0055.943] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0055.943] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x34f3218, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0055.943] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0055.943] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAFabSatiqekdgvJCDX0bTxix9WV0zlt2BnZjQNaFnQ7CEZc6ux50aRVBBeWz4UQgwD5xFjbibxigDziqCiw0QiNHN+H0f/A+0WUU6D/CimD+m9HzB1x206o15pJT+VvxNQ1UYA0Mi/DBipC1dWgHMqEv2K6hKZd/XoR5k25OsDDjl9N/AUN4rcFKDxrayX3++RKPFTMF9wUAGVnVMSflRpOJqSq/Sq9wFA==") returned 232 [0055.943] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x3, wMilliseconds=0xdb)) [0055.943] GetCurrentThreadId () returned 0x970 [0055.943] GetCurrentThreadId () returned 0x970 [0055.943] GetCurrentThreadId () returned 0x970 [0055.943] GetCurrentThreadId () returned 0x970 [0055.943] GetCurrentThreadId () returned 0x970 [0055.943] GetCurrentThreadId () returned 0x970 [0055.943] GetCurrentThreadId () returned 0x970 [0055.943] GetCurrentThreadId () returned 0x970 [0055.944] GetCurrentThreadId () returned 0x970 [0055.944] GetCurrentThreadId () returned 0x970 [0055.944] GetCurrentThreadId () returned 0x970 [0055.944] GetCurrentThreadId () returned 0x970 [0055.944] GetCurrentThreadId () returned 0x970 [0055.944] GetCurrentThreadId () returned 0x970 [0055.944] GetCurrentThreadId () returned 0x970 [0055.944] GetCurrentThreadId () returned 0x970 [0055.944] GetCurrentThreadId () returned 0x970 [0055.944] GetCurrentThreadId () returned 0x970 [0055.944] GetCurrentThreadId () returned 0x970 [0055.944] GetCurrentThreadId () returned 0x970 [0055.944] GetCurrentThreadId () returned 0x970 [0055.944] GetCurrentThreadId () returned 0x970 [0055.944] GetCurrentThreadId () returned 0x970 [0055.944] GetCurrentThreadId () returned 0x970 [0055.944] GetCurrentThreadId () returned 0x970 [0055.944] GetCurrentThreadId () returned 0x970 [0055.944] GetCurrentThreadId () returned 0x970 [0055.944] GetCurrentThreadId () returned 0x970 [0055.944] GetCurrentThreadId () returned 0x970 [0055.944] GetCurrentThreadId () returned 0x970 [0055.944] GetCurrentThreadId () returned 0x970 [0055.944] GetCurrentThreadId () returned 0x970 [0055.944] GetCurrentThreadId () returned 0x970 [0055.944] GetCurrentThreadId () returned 0x970 [0055.944] GetCurrentThreadId () returned 0x970 [0055.944] GetCurrentThreadId () returned 0x970 [0055.944] GetCurrentThreadId () returned 0x970 [0055.944] GetCurrentThreadId () returned 0x970 [0055.944] GetCurrentThreadId () returned 0x970 [0055.944] GetCurrentThreadId () returned 0x970 [0055.944] GetCurrentThreadId () returned 0x970 [0055.944] GetCurrentThreadId () returned 0x970 [0055.944] GetCurrentThreadId () returned 0x970 [0055.944] GetCurrentThreadId () returned 0x970 [0055.944] GetCurrentThreadId () returned 0x970 [0055.944] GetCurrentThreadId () returned 0x970 [0055.944] GetCurrentThreadId () returned 0x970 [0055.944] GetCurrentThreadId () returned 0x970 [0055.944] GetCurrentThreadId () returned 0x970 [0055.944] GetCurrentThreadId () returned 0x970 [0055.944] GetCurrentThreadId () returned 0x970 [0055.944] GetCurrentThreadId () returned 0x970 [0055.944] GetCurrentThreadId () returned 0x970 [0055.944] GetCurrentThreadId () returned 0x970 [0055.944] GetCurrentThreadId () returned 0x970 [0055.944] GetCurrentThreadId () returned 0x970 [0055.944] GetCurrentThreadId () returned 0x970 [0055.944] GetCurrentThreadId () returned 0x970 [0055.944] GetCurrentThreadId () returned 0x970 [0055.944] GetCurrentThreadId () returned 0x970 [0055.945] GetCurrentThreadId () returned 0x970 [0055.945] GetCurrentThreadId () returned 0x970 [0055.945] GetCurrentThreadId () returned 0x970 [0055.945] GetCurrentThreadId () returned 0x970 [0055.945] GetCurrentThreadId () returned 0x970 [0055.945] GetCurrentThreadId () returned 0x970 [0055.945] GetCurrentThreadId () returned 0x970 [0055.945] GetCurrentThreadId () returned 0x970 [0055.945] GetCurrentThreadId () returned 0x970 [0055.945] GetCurrentThreadId () returned 0x970 [0055.945] GetCurrentThreadId () returned 0x970 [0055.945] GetCurrentThreadId () returned 0x970 [0055.945] GetCurrentThreadId () returned 0x970 [0055.945] GetCurrentThreadId () returned 0x970 [0055.945] GetCurrentThreadId () returned 0x970 [0055.945] GetCurrentThreadId () returned 0x970 [0055.945] GetCurrentThreadId () returned 0x970 [0055.945] GetCurrentThreadId () returned 0x970 [0055.945] GetCurrentThreadId () returned 0x970 [0055.945] GetCurrentThreadId () returned 0x970 [0055.945] GetCurrentThreadId () returned 0x970 [0055.945] GetCurrentThreadId () returned 0x970 [0055.945] GetCurrentThreadId () returned 0x970 [0055.945] GetCurrentThreadId () returned 0x970 [0055.945] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAFabSatiqekdgvJCDX0bTxix9WV0zlt2BnZjQNaFnQ7CEZc6ux50aRVBBeWz4UQgwD5xFjbibxigDziqCiw0QiNHN+H0f/A+0WUU6D/CimD+m9HzB1x206o15pJT+VvxNQ1UYA0Mi/DBipC1dWgHMqEv2K6hKZd/XoR5k25OsDDjl9N/AUN4rcFKDxrayX3++RKPFTMF9wUAGVnVMSflRpOJqSq/Sq9wFA==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0055.945] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAFabSatiqekdgvJCDX0bTxix9WV0zlt2BnZjQNaFnQ7CEZc6ux50aRVBBeWz4UQgwD5xFjbibxigDziqCiw0QiNHN+H0f/A+0WUU6D/CimD+m9HzB1x206o15pJT+VvxNQ1UYA0Mi/DBipC1dWgHMqEv2K6hKZd/XoR5k25OsDDjl9N/AUN4rcFKDxrayX3++RKPFTMF9wUAGVnVMSflRpOJqSq/Sq9wFA==", cchWideChar=245, lpMultiByteStr=0x353933c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAFabSatiqekdgvJCDX0bTxix9WV0zlt2BnZjQNaFnQ7CEZc6ux50aRVBBeWz4UQgwD5xFjbibxigDziqCiw0QiNHN+H0f/A+0WUU6D/CimD+m9HzB1x206o15pJT+VvxNQ1UYA0Mi/DBipC1dWgHMqEv2K6hKZd/XoR5k25OsDDjl9N/AUN4rcFKDxrayX3++RKPFTMF9wUAGVnVMSflRpOJqSq/Sq9wFA==", lpUsedDefaultChar=0x0) returned 245 [0055.945] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0055.945] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0055.945] CloseHandle (hObject=0x158) returned 1 [0055.946] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml")) returned 1 [0055.947] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=17621003506) returned 1 [0055.947] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\Файл зашифрован [ExcelMUI.XML].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\Файл зашифрован [excelmui.xml].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0055.947] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0055.947] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0055.947] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0055.947] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0055.947] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0055.947] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0055.947] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0055.947] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0055.947] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0055.947] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0055.948] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0055.948] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0055.948] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0055.948] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0055.948] SetEndOfFile (hFile=0x158) returned 1 [0055.948] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0055.948] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0055.948] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0055.948] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0055.948] WriteFile (in: hFile=0x158, lpBuffer=0x361ff08*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x361ff08*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0055.949] WriteFile (in: hFile=0x158, lpBuffer=0x35eff9c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35eff9c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0055.949] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o//c:wu341p93HsW~u=dfkPYSJ(F-zqw", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0055.949] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o//c:wu341p93HsW~u=dfkPYSJ(F-zqw", cchWideChar=32, lpMultiByteStr=0x2032ddc, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="o//c:wu341p93HsW~u=dfkPYSJ(F-zqw", lpUsedDefaultChar=0x0) returned 32 [0055.949] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0055.949] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0055.949] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.XML", cAlternateFileName="")) returned 0x295098 [0055.949] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0055.949] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0055.949] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml")) returned 0x20 [0055.949] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml")) returned 0x20 [0055.949] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml")) returned 0x20 [0055.949] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml")) returned 0x20 [0055.950] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x61d)) returned 1 [0055.950] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0055.950] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0055.950] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml")) returned 0x20 [0055.950] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml")) returned 0x20 [0055.950] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0055.950] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0055.950] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0055.950] SetEndOfFile (hFile=0x158) returned 1 [0055.951] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ExcelMUI.XML", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0055.951] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ExcelMUI.XML", cchWideChar=12, lpMultiByteStr=0x1fe394c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ExcelMUI.XML", lpUsedDefaultChar=0x0) returned 12 [0055.951] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ExcelMUI.XML", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0055.951] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ExcelMUI.XML", cchWideChar=12, lpMultiByteStr=0x1fe39cc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ExcelMUI.XML", lpUsedDefaultChar=0x0) returned 12 [0055.951] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe39cc, cbMultiByte=12, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="ExcelMUI.XML.XMLli\x01") returned 12 [0055.951] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ExcelMUI.XML", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0055.951] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ExcelMUI.XML", cchWideChar=12, lpMultiByteStr=0x1fe394c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ExcelMUI.XML", lpUsedDefaultChar=0x0) returned 12 [0055.951] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0055.951] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0055.951] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x61d [0055.951] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0055.951] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0055.951] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0055.951] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ExcelMUI.XML", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0055.951] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ExcelMUI.XML", cchWideChar=12, lpMultiByteStr=0x1fe394c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ExcelMUI.XML", lpUsedDefaultChar=0x0) returned 12 [0055.951] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ExcelMUI.XML", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0055.952] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ExcelMUI.XML", cchWideChar=12, lpMultiByteStr=0x1fe39cc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ExcelMUI.XML", lpUsedDefaultChar=0x0) returned 12 [0055.952] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe39cc, cbMultiByte=12, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="ExcelMUI.XMLUI.XML.XMLli\x01") returned 12 [0055.952] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ExcelMUI.XML", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0055.952] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ExcelMUI.XML", cchWideChar=12, lpMultiByteStr=0x1fe394c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ExcelMUI.XML", lpUsedDefaultChar=0x0) returned 12 [0055.952] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0055.952] CharToOemA (in: pSrc="ExcelMUI.XML", pDst=0x1fe39cc | out: pDst="ExcelMUI.XML") returned 1 [0055.952] WriteFile (in: hFile=0x158, lpBuffer=0x1fe39cc*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe39cc*, lpNumberOfBytesWritten=0x18e048*=0xc, lpOverlapped=0x0) returned 1 [0055.953] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0055.953] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0055.953] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0055.953] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=17621620908) returned 1 [0055.953] ReadFile (in: hFile=0x11c, lpBuffer=0x378d0a0, nNumberOfBytesToRead=0x61d, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x378d0a0*, lpNumberOfBytesRead=0x18dd7c*=0x61d, lpOverlapped=0x0) returned 1 [0055.954] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0055.954] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=17621773592) returned 1 [0055.962] WriteFile (in: hFile=0x158, lpBuffer=0x1fea3d8*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fea3d8*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0055.962] ReadFile (in: hFile=0x11c, lpBuffer=0x378d0a0, nNumberOfBytesToRead=0x61d, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x378d0a0*, lpNumberOfBytesRead=0x18de38*=0x61d, lpOverlapped=0x0) returned 1 [0055.963] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x47 [0055.963] WriteFile (in: hFile=0x158, lpBuffer=0x378d710*, nNumberOfBytesToWrite=0x61d, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x378d710*, lpNumberOfBytesWritten=0x18de10*=0x61d, lpOverlapped=0x0) returned 1 [0055.963] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x664 [0055.963] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0055.963] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0055.963] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0055.963] SetFilePointer (in: hFile=0x158, lDistanceToMove=12, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2a [0055.963] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x66e [0055.963] CloseHandle (hObject=0x11c) returned 1 [0055.963] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x66e [0055.963] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x66e [0055.963] SetFilePointer (in: hFile=0x158, lDistanceToMove=1646, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x66e [0055.963] SetFilePointer (in: hFile=0x158, lDistanceToMove=1646, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x66e [0055.963] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x66e [0055.964] SetFilePointer (in: hFile=0x158, lDistanceToMove=1646, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x66e [0055.964] SetEndOfFile (hFile=0x158) returned 1 [0055.964] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x66e [0055.964] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x66e [0055.964] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ExcelMUI.XML", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0055.964] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ExcelMUI.XML", cchWideChar=12, lpMultiByteStr=0x1fe394c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ExcelMUI.XML", lpUsedDefaultChar=0x0) returned 12 [0055.964] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ExcelMUI.XML", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0055.964] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ExcelMUI.XML", cchWideChar=12, lpMultiByteStr=0x1fe3c4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ExcelMUI.XML", lpUsedDefaultChar=0x0) returned 12 [0055.964] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe3c4c, cbMultiByte=12, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="ExcelMUI.XMLꞗ@涤(\x18믉`믑`") returned 12 [0055.964] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ExcelMUI.XML", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0055.964] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ExcelMUI.XML", cchWideChar=12, lpMultiByteStr=0x1fe394c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ExcelMUI.XML", lpUsedDefaultChar=0x0) returned 12 [0055.964] WriteFile (in: hFile=0x158, lpBuffer=0x3770b58*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3770b58*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0055.964] CharToOemA (in: pSrc="ExcelMUI.XML", pDst=0x1fe3c4c | out: pDst="ExcelMUI.XML") returned 1 [0055.964] WriteFile (in: hFile=0x158, lpBuffer=0x1fe3c4c*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe3c4c*, lpNumberOfBytesWritten=0x18efcc*=0xc, lpOverlapped=0x0) returned 1 [0055.964] WriteFile (in: hFile=0x158, lpBuffer=0x1fea170*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea170*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0055.964] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0055.964] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0055.965] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x6b3 [0055.965] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x6b3 [0055.965] WriteFile (in: hFile=0x158, lpBuffer=0x361ff08*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x361ff08*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0055.965] WriteFile (in: hFile=0x158, lpBuffer=0x35eff9c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35eff9c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0055.965] DeleteFileW (lpFileName="") returned 0 [0055.965] GetLastError () returned 0x3 [0055.965] GetFileAttributesW (lpFileName="") returned 0xffffffff [0055.965] SetLastError (dwErrCode=0x3) [0055.965] FlushFileBuffers (hFile=0x158) returned 1 [0055.967] GetCurrentThreadId () returned 0x970 [0055.968] GetCurrentThreadId () returned 0x970 [0055.968] GetCurrentThreadId () returned 0x970 [0055.968] GetCurrentThreadId () returned 0x970 [0055.968] GetCurrentThreadId () returned 0x970 [0055.968] GetCurrentThreadId () returned 0x970 [0055.968] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x76a [0055.968] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x76a [0055.968] SetFilePointer (in: hFile=0x158, lDistanceToMove=1898, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x76a [0055.968] CloseHandle (hObject=0x158) returned 1 [0055.968] GetCurrentThreadId () returned 0x970 [0055.968] GetCurrentThreadId () returned 0x970 [0055.968] GetCurrentThreadId () returned 0x970 [0055.968] GetCurrentThreadId () returned 0x970 [0055.968] GetCurrentThreadId () returned 0x970 [0055.968] GetCurrentThreadId () returned 0x970 [0055.969] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\Файл зашифрован [ExcelMUI.XML].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\Файл зашифрован [excelmui.xml].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0055.969] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x76a [0055.969] SetFilePointer (in: hFile=0x158, lDistanceToMove=1770, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6ea [0055.969] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0055.969] GetFileType (hFile=0x158) returned 0x1 [0055.969] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x3, wMilliseconds=0xea)) [0055.969] GetCurrentThreadId () returned 0x970 [0055.969] GetCurrentThreadId () returned 0x970 [0055.969] GetCurrentThreadId () returned 0x970 [0055.969] GetCurrentThreadId () returned 0x970 [0055.969] GetCurrentThreadId () returned 0x970 [0055.969] GetCurrentThreadId () returned 0x970 [0055.969] GetCurrentThreadId () returned 0x970 [0055.969] GetCurrentThreadId () returned 0x970 [0055.969] GetCurrentThreadId () returned 0x970 [0055.969] GetCurrentThreadId () returned 0x970 [0055.969] GetCurrentThreadId () returned 0x970 [0055.969] GetCurrentThreadId () returned 0x970 [0055.969] GetCurrentThreadId () returned 0x970 [0055.969] GetCurrentThreadId () returned 0x970 [0055.969] GetCurrentThreadId () returned 0x970 [0055.969] GetCurrentThreadId () returned 0x970 [0055.969] GetCurrentThreadId () returned 0x970 [0055.969] GetCurrentThreadId () returned 0x970 [0055.969] GetCurrentThreadId () returned 0x970 [0055.969] GetCurrentThreadId () returned 0x970 [0055.969] GetCurrentThreadId () returned 0x970 [0055.969] GetCurrentThreadId () returned 0x970 [0055.969] GetCurrentThreadId () returned 0x970 [0055.969] GetCurrentThreadId () returned 0x970 [0055.969] GetCurrentThreadId () returned 0x970 [0055.969] GetCurrentThreadId () returned 0x970 [0055.969] GetCurrentThreadId () returned 0x970 [0055.969] GetCurrentThreadId () returned 0x970 [0055.969] GetCurrentThreadId () returned 0x970 [0055.969] GetCurrentThreadId () returned 0x970 [0055.969] GetCurrentThreadId () returned 0x970 [0055.970] GetCurrentThreadId () returned 0x970 [0055.970] GetCurrentThreadId () returned 0x970 [0055.970] GetCurrentThreadId () returned 0x970 [0055.970] GetCurrentThreadId () returned 0x970 [0055.970] GetCurrentThreadId () returned 0x970 [0055.970] GetCurrentThreadId () returned 0x970 [0055.970] GetCurrentThreadId () returned 0x970 [0055.970] GetCurrentThreadId () returned 0x970 [0055.970] GetCurrentThreadId () returned 0x970 [0055.970] GetCurrentThreadId () returned 0x970 [0055.970] GetCurrentThreadId () returned 0x970 [0055.970] GetCurrentThreadId () returned 0x970 [0055.970] GetCurrentThreadId () returned 0x970 [0055.970] GetCurrentThreadId () returned 0x970 [0055.970] GetCurrentThreadId () returned 0x970 [0055.970] GetCurrentThreadId () returned 0x970 [0055.970] GetCurrentThreadId () returned 0x970 [0055.970] GetCurrentThreadId () returned 0x970 [0055.970] GetCurrentThreadId () returned 0x970 [0055.970] GetCurrentThreadId () returned 0x970 [0055.970] GetCurrentThreadId () returned 0x970 [0055.970] GetCurrentThreadId () returned 0x970 [0055.970] GetCurrentThreadId () returned 0x970 [0055.970] GetCurrentThreadId () returned 0x970 [0055.970] GetCurrentThreadId () returned 0x970 [0055.970] GetCurrentThreadId () returned 0x970 [0055.970] GetCurrentThreadId () returned 0x970 [0055.970] GetCurrentThreadId () returned 0x970 [0055.970] GetCurrentThreadId () returned 0x970 [0055.970] GetCurrentThreadId () returned 0x970 [0055.970] GetCurrentThreadId () returned 0x970 [0055.970] GetCurrentThreadId () returned 0x970 [0055.970] GetCurrentThreadId () returned 0x970 [0055.970] GetCurrentThreadId () returned 0x970 [0055.970] GetCurrentThreadId () returned 0x970 [0055.970] GetCurrentThreadId () returned 0x970 [0055.970] GetCurrentThreadId () returned 0x970 [0055.970] GetCurrentThreadId () returned 0x970 [0055.970] GetCurrentThreadId () returned 0x970 [0055.970] GetCurrentThreadId () returned 0x970 [0055.970] GetCurrentThreadId () returned 0x970 [0055.970] GetCurrentThreadId () returned 0x970 [0055.970] GetCurrentThreadId () returned 0x970 [0055.970] GetCurrentThreadId () returned 0x970 [0055.970] GetCurrentThreadId () returned 0x970 [0055.970] GetCurrentThreadId () returned 0x970 [0055.970] GetCurrentThreadId () returned 0x970 [0055.970] GetCurrentThreadId () returned 0x970 [0055.970] GetCurrentThreadId () returned 0x970 [0055.971] GetCurrentThreadId () returned 0x970 [0055.971] GetCurrentThreadId () returned 0x970 [0055.971] GetCurrentThreadId () returned 0x970 [0055.971] GetCurrentThreadId () returned 0x970 [0055.971] GetCurrentThreadId () returned 0x970 [0055.971] GetCurrentThreadId () returned 0x970 [0055.971] GetCurrentThreadId () returned 0x970 [0055.971] GetCurrentThreadId () returned 0x970 [0055.971] GetCurrentThreadId () returned 0x970 [0055.971] GetCurrentThreadId () returned 0x970 [0055.971] GetCurrentThreadId () returned 0x970 [0055.971] GetCurrentThreadId () returned 0x970 [0055.971] GetCurrentThreadId () returned 0x970 [0055.971] GetCurrentThreadId () returned 0x970 [0055.971] GetCurrentThreadId () returned 0x970 [0055.971] GetCurrentThreadId () returned 0x970 [0055.971] GetCurrentThreadId () returned 0x970 [0055.971] GetCurrentThreadId () returned 0x970 [0055.971] GetCurrentThreadId () returned 0x970 [0055.971] GetCurrentThreadId () returned 0x970 [0055.971] GetCurrentThreadId () returned 0x970 [0055.971] GetCurrentThreadId () returned 0x970 [0055.971] GetCurrentThreadId () returned 0x970 [0055.971] GetCurrentThreadId () returned 0x970 [0055.971] GetCurrentThreadId () returned 0x970 [0055.971] GetCurrentThreadId () returned 0x970 [0055.971] GetCurrentThreadId () returned 0x970 [0055.971] GetCurrentThreadId () returned 0x970 [0055.971] GetCurrentThreadId () returned 0x970 [0055.971] GetCurrentThreadId () returned 0x970 [0055.971] GetCurrentThreadId () returned 0x970 [0055.971] GetCurrentThreadId () returned 0x970 [0055.971] GetCurrentThreadId () returned 0x970 [0055.971] GetCurrentThreadId () returned 0x970 [0055.971] GetCurrentThreadId () returned 0x970 [0055.971] GetCurrentThreadId () returned 0x970 [0055.971] GetCurrentThreadId () returned 0x970 [0055.971] GetCurrentThreadId () returned 0x970 [0055.971] GetCurrentThreadId () returned 0x970 [0055.971] GetCurrentThreadId () returned 0x970 [0055.971] GetCurrentThreadId () returned 0x970 [0055.971] GetCurrentThreadId () returned 0x970 [0055.971] GetCurrentThreadId () returned 0x970 [0055.971] GetCurrentThreadId () returned 0x970 [0055.971] GetCurrentThreadId () returned 0x970 [0055.971] GetCurrentThreadId () returned 0x970 [0055.972] GetCurrentThreadId () returned 0x970 [0055.972] GetCurrentThreadId () returned 0x970 [0055.972] GetCurrentThreadId () returned 0x970 [0055.972] GetCurrentThreadId () returned 0x970 [0055.972] GetCurrentThreadId () returned 0x970 [0055.972] GetCurrentThreadId () returned 0x970 [0055.972] GetCurrentThreadId () returned 0x970 [0055.972] GetCurrentThreadId () returned 0x970 [0055.972] GetCurrentThreadId () returned 0x970 [0055.972] GetCurrentThreadId () returned 0x970 [0055.972] GetCurrentThreadId () returned 0x970 [0055.972] GetCurrentThreadId () returned 0x970 [0055.972] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.972] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.972] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fed470, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0055.972] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.972] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.972] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fed470, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0055.972] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.972] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.972] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0055.972] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.972] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.972] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0055.972] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.972] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.972] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fed4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0055.972] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.972] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.972] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fed4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0055.972] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.972] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.972] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fed4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0055.972] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x3, wMilliseconds=0xfa)) [0055.972] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="o//c:wu341p93HsW~u=dfkPYSJ(F-zqw", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0055.972] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="o//c:wu341p93HsW~u=dfkPYSJ(F-zqw", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0055.972] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="o//c:wu341p93HsW~u=dfkPYSJ(F-zqw", cchWideChar=32, lpMultiByteStr=0x2001888, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="o//c:wu341p93HsW~u=dfkPYSJ(F-zqw", lpUsedDefaultChar=0x0) returned 32 [0055.973] GetCurrentThreadId () returned 0x970 [0055.973] GetCurrentThreadId () returned 0x970 [0055.973] GetCurrentThreadId () returned 0x970 [0055.973] GetCurrentThreadId () returned 0x970 [0055.973] GetCurrentThreadId () returned 0x970 [0055.973] GetCurrentThreadId () returned 0x970 [0055.979] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0055.979] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0055.980] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x34f3308, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0055.980] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0055.980] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAFG/1FIBcRD1luwziwp1GHE0U0MrOzt7lyF44dwoy531/lO4r7ZJn2j+y9bJTS0rYsPP85fLI5ykUtABnnjLFWtMoUGVMIGGcTcPlJHLALAy/KaJwgiHXiQ6yjKndKxeNEsRgUyj2LKcl/bFaf8Q5kjz8YsKQ6+OPNo/ZSRUIxASovqSTK8Y44RU0xXVEzKxJaL5LAQZMH8hmDN/FupBxocYNsu/pCUGSA==") returned 232 [0055.980] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x3, wMilliseconds=0xfa)) [0055.980] GetCurrentThreadId () returned 0x970 [0055.980] GetCurrentThreadId () returned 0x970 [0055.980] GetCurrentThreadId () returned 0x970 [0055.980] GetCurrentThreadId () returned 0x970 [0055.980] GetCurrentThreadId () returned 0x970 [0055.980] GetCurrentThreadId () returned 0x970 [0055.980] GetCurrentThreadId () returned 0x970 [0055.980] GetCurrentThreadId () returned 0x970 [0055.980] GetCurrentThreadId () returned 0x970 [0055.980] GetCurrentThreadId () returned 0x970 [0055.980] GetCurrentThreadId () returned 0x970 [0055.980] GetCurrentThreadId () returned 0x970 [0055.980] GetCurrentThreadId () returned 0x970 [0055.980] GetCurrentThreadId () returned 0x970 [0055.980] GetCurrentThreadId () returned 0x970 [0055.980] GetCurrentThreadId () returned 0x970 [0055.980] GetCurrentThreadId () returned 0x970 [0055.980] GetCurrentThreadId () returned 0x970 [0055.980] GetCurrentThreadId () returned 0x970 [0055.980] GetCurrentThreadId () returned 0x970 [0055.980] GetCurrentThreadId () returned 0x970 [0055.980] GetCurrentThreadId () returned 0x970 [0055.980] GetCurrentThreadId () returned 0x970 [0055.980] GetCurrentThreadId () returned 0x970 [0055.980] GetCurrentThreadId () returned 0x970 [0055.980] GetCurrentThreadId () returned 0x970 [0055.980] GetCurrentThreadId () returned 0x970 [0055.980] GetCurrentThreadId () returned 0x970 [0055.980] GetCurrentThreadId () returned 0x970 [0055.980] GetCurrentThreadId () returned 0x970 [0055.980] GetCurrentThreadId () returned 0x970 [0055.980] GetCurrentThreadId () returned 0x970 [0055.980] GetCurrentThreadId () returned 0x970 [0055.980] GetCurrentThreadId () returned 0x970 [0055.980] GetCurrentThreadId () returned 0x970 [0055.980] GetCurrentThreadId () returned 0x970 [0055.980] GetCurrentThreadId () returned 0x970 [0055.980] GetCurrentThreadId () returned 0x970 [0055.980] GetCurrentThreadId () returned 0x970 [0055.980] GetCurrentThreadId () returned 0x970 [0055.980] GetCurrentThreadId () returned 0x970 [0055.980] GetCurrentThreadId () returned 0x970 [0055.980] GetCurrentThreadId () returned 0x970 [0055.980] GetCurrentThreadId () returned 0x970 [0055.980] GetCurrentThreadId () returned 0x970 [0055.980] GetCurrentThreadId () returned 0x970 [0055.981] GetCurrentThreadId () returned 0x970 [0055.981] GetCurrentThreadId () returned 0x970 [0055.981] GetCurrentThreadId () returned 0x970 [0055.981] GetCurrentThreadId () returned 0x970 [0055.981] GetCurrentThreadId () returned 0x970 [0055.981] GetCurrentThreadId () returned 0x970 [0055.981] GetCurrentThreadId () returned 0x970 [0055.981] GetCurrentThreadId () returned 0x970 [0055.981] GetCurrentThreadId () returned 0x970 [0055.981] GetCurrentThreadId () returned 0x970 [0055.981] GetCurrentThreadId () returned 0x970 [0055.981] GetCurrentThreadId () returned 0x970 [0055.981] GetCurrentThreadId () returned 0x970 [0055.981] GetCurrentThreadId () returned 0x970 [0055.981] GetCurrentThreadId () returned 0x970 [0055.981] GetCurrentThreadId () returned 0x970 [0055.981] GetCurrentThreadId () returned 0x970 [0055.981] GetCurrentThreadId () returned 0x970 [0055.981] GetCurrentThreadId () returned 0x970 [0055.981] GetCurrentThreadId () returned 0x970 [0055.981] GetCurrentThreadId () returned 0x970 [0055.981] GetCurrentThreadId () returned 0x970 [0055.981] GetCurrentThreadId () returned 0x970 [0055.981] GetCurrentThreadId () returned 0x970 [0055.981] GetCurrentThreadId () returned 0x970 [0055.981] GetCurrentThreadId () returned 0x970 [0055.981] GetCurrentThreadId () returned 0x970 [0055.981] GetCurrentThreadId () returned 0x970 [0055.981] GetCurrentThreadId () returned 0x970 [0055.981] GetCurrentThreadId () returned 0x970 [0055.981] GetCurrentThreadId () returned 0x970 [0055.981] GetCurrentThreadId () returned 0x970 [0055.981] GetCurrentThreadId () returned 0x970 [0055.981] GetCurrentThreadId () returned 0x970 [0055.981] GetCurrentThreadId () returned 0x970 [0055.981] GetCurrentThreadId () returned 0x970 [0055.981] GetCurrentThreadId () returned 0x970 [0055.981] GetCurrentThreadId () returned 0x970 [0055.981] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAFG/1FIBcRD1luwziwp1GHE0U0MrOzt7lyF44dwoy531/lO4r7ZJn2j+y9bJTS0rYsPP85fLI5ykUtABnnjLFWtMoUGVMIGGcTcPlJHLALAy/KaJwgiHXiQ6yjKndKxeNEsRgUyj2LKcl/bFaf8Q5kjz8YsKQ6+OPNo/ZSRUIxASovqSTK8Y44RU0xXVEzKxJaL5LAQZMH8hmDN/FupBxocYNsu/pCUGSA==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0055.981] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAFG/1FIBcRD1luwziwp1GHE0U0MrOzt7lyF44dwoy531/lO4r7ZJn2j+y9bJTS0rYsPP85fLI5ykUtABnnjLFWtMoUGVMIGGcTcPlJHLALAy/KaJwgiHXiQ6yjKndKxeNEsRgUyj2LKcl/bFaf8Q5kjz8YsKQ6+OPNo/ZSRUIxASovqSTK8Y44RU0xXVEzKxJaL5LAQZMH8hmDN/FupBxocYNsu/pCUGSA==", cchWideChar=245, lpMultiByteStr=0x353933c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAFG/1FIBcRD1luwziwp1GHE0U0MrOzt7lyF44dwoy531/lO4r7ZJn2j+y9bJTS0rYsPP85fLI5ykUtABnnjLFWtMoUGVMIGGcTcPlJHLALAy/KaJwgiHXiQ6yjKndKxeNEsRgUyj2LKcl/bFaf8Q5kjz8YsKQ6+OPNo/ZSRUIxASovqSTK8Y44RU0xXVEzKxJaL5LAQZMH8hmDN/FupBxocYNsu/pCUGSA==", lpUsedDefaultChar=0x0) returned 245 [0055.981] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0055.981] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0055.982] CloseHandle (hObject=0x158) returned 1 [0055.982] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml")) returned 1 [0055.983] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=17624633304) returned 1 [0055.983] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\Файл зашифрован [SETUP.XML].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\Файл зашифрован [setup.xml].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0055.984] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0055.984] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0055.985] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0055.985] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0055.985] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0055.985] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0055.985] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0055.985] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0055.985] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0055.985] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0055.985] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0055.985] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0055.985] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0055.985] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0055.985] SetEndOfFile (hFile=0x158) returned 1 [0055.985] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0055.985] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0055.985] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0055.985] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0055.985] WriteFile (in: hFile=0x158, lpBuffer=0x361ff08*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x361ff08*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0055.986] WriteFile (in: hFile=0x158, lpBuffer=0x35f005c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f005c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0055.987] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="):(x8*SY7KC<+o}ck3\\$r8RD42+#Azb}", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0055.987] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="):(x8*SY7KC<+o}ck3\\$r8RD42+#Azb}", cchWideChar=32, lpMultiByteStr=0x2032cfc, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="):(x8*SY7KC<+o}ck3\\$r8RD42+#Azb}", lpUsedDefaultChar=0x0) returned 32 [0055.987] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0055.987] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0055.987] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0x295098 [0055.987] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0055.987] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0055.987] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml")) returned 0x20 [0055.987] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml")) returned 0x20 [0055.987] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml")) returned 0x20 [0055.987] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml")) returned 0x20 [0055.987] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8)) returned 1 [0055.987] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0055.987] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0055.987] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml")) returned 0x20 [0055.987] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml")) returned 0x20 [0055.987] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0055.988] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0055.988] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0055.988] SetEndOfFile (hFile=0x158) returned 1 [0055.988] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0055.988] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x1fe430c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SETUP.XML", lpUsedDefaultChar=0x0) returned 9 [0055.988] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0055.988] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x1fe384c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SETUP.XML", lpUsedDefaultChar=0x0) returned 9 [0055.988] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe384c, cbMultiByte=9, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="SETUP.XMLXML.XMLli\x01") returned 9 [0055.989] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0055.989] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x1fe430c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SETUP.XML", lpUsedDefaultChar=0x0) returned 9 [0055.989] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0055.989] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0055.989] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x8f8 [0055.989] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0055.989] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0055.989] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0055.989] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0055.989] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x1fe430c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SETUP.XML", lpUsedDefaultChar=0x0) returned 9 [0055.989] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0055.989] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x1fe384c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SETUP.XML", lpUsedDefaultChar=0x0) returned 9 [0055.989] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe384c, cbMultiByte=9, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="SETUP.XMLUP.XMLXML.XMLli\x01") returned 9 [0055.989] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0055.989] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x1fe430c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SETUP.XML", lpUsedDefaultChar=0x0) returned 9 [0055.989] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0055.990] CharToOemA (in: pSrc="SETUP.XML", pDst=0x1fe384c | out: pDst="SETUP.XML") returned 1 [0055.990] WriteFile (in: hFile=0x158, lpBuffer=0x1fe384c*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe384c*, lpNumberOfBytesWritten=0x18e048*=0x9, lpOverlapped=0x0) returned 1 [0055.990] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0055.990] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0055.990] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0055.991] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=17625396692) returned 1 [0055.991] ReadFile (in: hFile=0x11c, lpBuffer=0x378d0a0, nNumberOfBytesToRead=0x8f8, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x378d0a0*, lpNumberOfBytesRead=0x18dd7c*=0x8f8, lpOverlapped=0x0) returned 1 [0055.992] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0055.992] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=17625526274) returned 1 [0056.000] WriteFile (in: hFile=0x158, lpBuffer=0x1fea120*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fea120*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0056.000] ReadFile (in: hFile=0x11c, lpBuffer=0x378d0a0, nNumberOfBytesToRead=0x8f8, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x378d0a0*, lpNumberOfBytesRead=0x18de38*=0x8f8, lpOverlapped=0x0) returned 1 [0056.000] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x44 [0056.000] WriteFile (in: hFile=0x158, lpBuffer=0x378d9f0*, nNumberOfBytesToWrite=0x8f8, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x378d9f0*, lpNumberOfBytesWritten=0x18de10*=0x8f8, lpOverlapped=0x0) returned 1 [0056.000] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x93c [0056.000] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0056.000] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0056.000] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0056.000] SetFilePointer (in: hFile=0x158, lDistanceToMove=9, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x27 [0056.001] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x946 [0056.001] CloseHandle (hObject=0x11c) returned 1 [0056.001] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x946 [0056.001] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x946 [0056.001] SetFilePointer (in: hFile=0x158, lDistanceToMove=2374, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x946 [0056.001] SetFilePointer (in: hFile=0x158, lDistanceToMove=2374, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x946 [0056.001] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x946 [0056.001] SetFilePointer (in: hFile=0x158, lDistanceToMove=2374, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x946 [0056.001] SetEndOfFile (hFile=0x158) returned 1 [0056.001] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x946 [0056.001] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x946 [0056.001] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0056.001] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x1fe430c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SETUP.XML", lpUsedDefaultChar=0x0) returned 9 [0056.001] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0056.001] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x1fe3bac, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SETUP.XML", lpUsedDefaultChar=0x0) returned 9 [0056.001] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe3bac, cbMultiByte=9, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="SETUP.XML") returned 9 [0056.001] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0056.001] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x1fe430c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SETUP.XML", lpUsedDefaultChar=0x0) returned 9 [0056.002] WriteFile (in: hFile=0x158, lpBuffer=0x3770b58*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3770b58*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0056.002] CharToOemA (in: pSrc="SETUP.XML", pDst=0x1fe3bac | out: pDst="SETUP.XML") returned 1 [0056.002] WriteFile (in: hFile=0x158, lpBuffer=0x1fe3bac*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe3bac*, lpNumberOfBytesWritten=0x18efcc*=0x9, lpOverlapped=0x0) returned 1 [0056.002] WriteFile (in: hFile=0x158, lpBuffer=0x1fea110*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea110*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0056.002] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0056.002] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0056.002] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x988 [0056.002] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x988 [0056.002] WriteFile (in: hFile=0x158, lpBuffer=0x361ff08*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x361ff08*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0056.002] WriteFile (in: hFile=0x158, lpBuffer=0x35f005c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f005c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0056.002] DeleteFileW (lpFileName="") returned 0 [0056.002] GetLastError () returned 0x3 [0056.002] GetFileAttributesW (lpFileName="") returned 0xffffffff [0056.002] SetLastError (dwErrCode=0x3) [0056.002] FlushFileBuffers (hFile=0x158) returned 1 [0056.008] GetCurrentThreadId () returned 0x970 [0056.008] GetCurrentThreadId () returned 0x970 [0056.008] GetCurrentThreadId () returned 0x970 [0056.008] GetCurrentThreadId () returned 0x970 [0056.008] GetCurrentThreadId () returned 0x970 [0056.008] GetCurrentThreadId () returned 0x970 [0056.008] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xa3f [0056.008] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xa3f [0056.008] SetFilePointer (in: hFile=0x158, lDistanceToMove=2623, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xa3f [0056.008] CloseHandle (hObject=0x158) returned 1 [0056.009] GetCurrentThreadId () returned 0x970 [0056.009] GetCurrentThreadId () returned 0x970 [0056.009] GetCurrentThreadId () returned 0x970 [0056.009] GetCurrentThreadId () returned 0x970 [0056.009] GetCurrentThreadId () returned 0x970 [0056.009] GetCurrentThreadId () returned 0x970 [0056.009] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\Файл зашифрован [SETUP.XML].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\Файл зашифрован [setup.xml].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0056.009] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa3f [0056.009] SetFilePointer (in: hFile=0x158, lDistanceToMove=2495, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9bf [0056.009] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0056.009] GetFileType (hFile=0x158) returned 0x1 [0056.009] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x3, wMilliseconds=0x119)) [0056.009] GetCurrentThreadId () returned 0x970 [0056.009] GetCurrentThreadId () returned 0x970 [0056.009] GetCurrentThreadId () returned 0x970 [0056.009] GetCurrentThreadId () returned 0x970 [0056.009] GetCurrentThreadId () returned 0x970 [0056.009] GetCurrentThreadId () returned 0x970 [0056.009] GetCurrentThreadId () returned 0x970 [0056.009] GetCurrentThreadId () returned 0x970 [0056.009] GetCurrentThreadId () returned 0x970 [0056.009] GetCurrentThreadId () returned 0x970 [0056.009] GetCurrentThreadId () returned 0x970 [0056.009] GetCurrentThreadId () returned 0x970 [0056.009] GetCurrentThreadId () returned 0x970 [0056.009] GetCurrentThreadId () returned 0x970 [0056.010] GetCurrentThreadId () returned 0x970 [0056.010] GetCurrentThreadId () returned 0x970 [0056.010] GetCurrentThreadId () returned 0x970 [0056.010] GetCurrentThreadId () returned 0x970 [0056.010] GetCurrentThreadId () returned 0x970 [0056.010] GetCurrentThreadId () returned 0x970 [0056.010] GetCurrentThreadId () returned 0x970 [0056.010] GetCurrentThreadId () returned 0x970 [0056.010] GetCurrentThreadId () returned 0x970 [0056.010] GetCurrentThreadId () returned 0x970 [0056.010] GetCurrentThreadId () returned 0x970 [0056.010] GetCurrentThreadId () returned 0x970 [0056.010] GetCurrentThreadId () returned 0x970 [0056.010] GetCurrentThreadId () returned 0x970 [0056.010] GetCurrentThreadId () returned 0x970 [0056.010] GetCurrentThreadId () returned 0x970 [0056.010] GetCurrentThreadId () returned 0x970 [0056.010] GetCurrentThreadId () returned 0x970 [0056.010] GetCurrentThreadId () returned 0x970 [0056.010] GetCurrentThreadId () returned 0x970 [0056.010] GetCurrentThreadId () returned 0x970 [0056.010] GetCurrentThreadId () returned 0x970 [0056.010] GetCurrentThreadId () returned 0x970 [0056.010] GetCurrentThreadId () returned 0x970 [0056.010] GetCurrentThreadId () returned 0x970 [0056.010] GetCurrentThreadId () returned 0x970 [0056.010] GetCurrentThreadId () returned 0x970 [0056.010] GetCurrentThreadId () returned 0x970 [0056.010] GetCurrentThreadId () returned 0x970 [0056.010] GetCurrentThreadId () returned 0x970 [0056.010] GetCurrentThreadId () returned 0x970 [0056.010] GetCurrentThreadId () returned 0x970 [0056.010] GetCurrentThreadId () returned 0x970 [0056.010] GetCurrentThreadId () returned 0x970 [0056.010] GetCurrentThreadId () returned 0x970 [0056.010] GetCurrentThreadId () returned 0x970 [0056.010] GetCurrentThreadId () returned 0x970 [0056.010] GetCurrentThreadId () returned 0x970 [0056.010] GetCurrentThreadId () returned 0x970 [0056.010] GetCurrentThreadId () returned 0x970 [0056.010] GetCurrentThreadId () returned 0x970 [0056.010] GetCurrentThreadId () returned 0x970 [0056.010] GetCurrentThreadId () returned 0x970 [0056.010] GetCurrentThreadId () returned 0x970 [0056.010] GetCurrentThreadId () returned 0x970 [0056.010] GetCurrentThreadId () returned 0x970 [0056.010] GetCurrentThreadId () returned 0x970 [0056.011] GetCurrentThreadId () returned 0x970 [0056.011] GetCurrentThreadId () returned 0x970 [0056.011] GetCurrentThreadId () returned 0x970 [0056.011] GetCurrentThreadId () returned 0x970 [0056.011] GetCurrentThreadId () returned 0x970 [0056.011] GetCurrentThreadId () returned 0x970 [0056.011] GetCurrentThreadId () returned 0x970 [0056.011] GetCurrentThreadId () returned 0x970 [0056.011] GetCurrentThreadId () returned 0x970 [0056.011] GetCurrentThreadId () returned 0x970 [0056.011] GetCurrentThreadId () returned 0x970 [0056.011] GetCurrentThreadId () returned 0x970 [0056.011] GetCurrentThreadId () returned 0x970 [0056.011] GetCurrentThreadId () returned 0x970 [0056.011] GetCurrentThreadId () returned 0x970 [0056.011] GetCurrentThreadId () returned 0x970 [0056.011] GetCurrentThreadId () returned 0x970 [0056.011] GetCurrentThreadId () returned 0x970 [0056.011] GetCurrentThreadId () returned 0x970 [0056.011] GetCurrentThreadId () returned 0x970 [0056.011] GetCurrentThreadId () returned 0x970 [0056.011] GetCurrentThreadId () returned 0x970 [0056.011] GetCurrentThreadId () returned 0x970 [0056.011] GetCurrentThreadId () returned 0x970 [0056.011] GetCurrentThreadId () returned 0x970 [0056.011] GetCurrentThreadId () returned 0x970 [0056.011] GetCurrentThreadId () returned 0x970 [0056.011] GetCurrentThreadId () returned 0x970 [0056.011] GetCurrentThreadId () returned 0x970 [0056.011] GetCurrentThreadId () returned 0x970 [0056.011] GetCurrentThreadId () returned 0x970 [0056.011] GetCurrentThreadId () returned 0x970 [0056.011] GetCurrentThreadId () returned 0x970 [0056.011] GetCurrentThreadId () returned 0x970 [0056.011] GetCurrentThreadId () returned 0x970 [0056.011] GetCurrentThreadId () returned 0x970 [0056.011] GetCurrentThreadId () returned 0x970 [0056.011] GetCurrentThreadId () returned 0x970 [0056.011] GetCurrentThreadId () returned 0x970 [0056.011] GetCurrentThreadId () returned 0x970 [0056.011] GetCurrentThreadId () returned 0x970 [0056.011] GetCurrentThreadId () returned 0x970 [0056.011] GetCurrentThreadId () returned 0x970 [0056.011] GetCurrentThreadId () returned 0x970 [0056.011] GetCurrentThreadId () returned 0x970 [0056.011] GetCurrentThreadId () returned 0x970 [0056.011] GetCurrentThreadId () returned 0x970 [0056.011] GetCurrentThreadId () returned 0x970 [0056.011] GetCurrentThreadId () returned 0x970 [0056.011] GetCurrentThreadId () returned 0x970 [0056.012] GetCurrentThreadId () returned 0x970 [0056.012] GetCurrentThreadId () returned 0x970 [0056.012] GetCurrentThreadId () returned 0x970 [0056.012] GetCurrentThreadId () returned 0x970 [0056.012] GetCurrentThreadId () returned 0x970 [0056.012] GetCurrentThreadId () returned 0x970 [0056.012] GetCurrentThreadId () returned 0x970 [0056.012] GetCurrentThreadId () returned 0x970 [0056.012] GetCurrentThreadId () returned 0x970 [0056.012] GetCurrentThreadId () returned 0x970 [0056.012] GetCurrentThreadId () returned 0x970 [0056.012] GetCurrentThreadId () returned 0x970 [0056.012] GetCurrentThreadId () returned 0x970 [0056.012] GetCurrentThreadId () returned 0x970 [0056.012] GetCurrentThreadId () returned 0x970 [0056.012] GetCurrentThreadId () returned 0x970 [0056.012] GetCurrentThreadId () returned 0x970 [0056.012] GetCurrentThreadId () returned 0x970 [0056.012] GetCurrentThreadId () returned 0x970 [0056.012] GetCurrentThreadId () returned 0x970 [0056.012] GetCurrentThreadId () returned 0x970 [0056.012] GetCurrentThreadId () returned 0x970 [0056.012] GetCurrentThreadId () returned 0x970 [0056.012] GetCurrentThreadId () returned 0x970 [0056.012] GetCurrentThreadId () returned 0x970 [0056.012] GetCurrentThreadId () returned 0x970 [0056.012] GetCurrentThreadId () returned 0x970 [0056.012] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0056.012] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0056.012] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fed4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0056.012] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0056.012] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0056.012] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fed4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0056.012] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0056.012] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0056.012] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0056.012] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0056.012] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0056.012] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0056.012] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0056.012] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0056.012] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fed530, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0056.012] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0056.013] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0056.013] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fed530, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0056.013] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0056.013] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0056.013] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fed530, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0056.013] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x3, wMilliseconds=0x119)) [0056.013] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="):(x8*SY7KC<+o}ck3\\$r8RD42+#Azb}", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0056.013] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="):(x8*SY7KC<+o}ck3\\$r8RD42+#Azb}", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0056.013] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="):(x8*SY7KC<+o}ck3\\$r8RD42+#Azb}", cchWideChar=32, lpMultiByteStr=0x20017f8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="):(x8*SY7KC<+o}ck3\\$r8RD42+#Azb}", lpUsedDefaultChar=0x0) returned 32 [0056.013] GetCurrentThreadId () returned 0x970 [0056.013] GetCurrentThreadId () returned 0x970 [0056.013] GetCurrentThreadId () returned 0x970 [0056.013] GetCurrentThreadId () returned 0x970 [0056.013] GetCurrentThreadId () returned 0x970 [0056.013] GetCurrentThreadId () returned 0x970 [0056.020] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0056.020] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0056.020] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x34f33f8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0056.020] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0056.020] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAGcW/pciftSb+H4X7iS3tHO4nrEfoSAYoauew9vxXtZF8XXdNxaGiHZTL1bf/41c5EN+B5Vp3k1eWo/BRZBUP6tPcXinrBJUVpipZ1Zp2XLp1u7y6Lhk/7gOVYOqzzbZnmY8xNhEXyy0dxa1yKkJTT8clR4pYDD3rBiM2KBoA/P+7zJJxrrdO9J3UGGubVae0cDDMV3ZD0xyci/Yh+vhAhubZN2zq57oTg==") returned 232 [0056.020] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x3, wMilliseconds=0x129)) [0056.020] GetCurrentThreadId () returned 0x970 [0056.020] GetCurrentThreadId () returned 0x970 [0056.020] GetCurrentThreadId () returned 0x970 [0056.020] GetCurrentThreadId () returned 0x970 [0056.020] GetCurrentThreadId () returned 0x970 [0056.020] GetCurrentThreadId () returned 0x970 [0056.020] GetCurrentThreadId () returned 0x970 [0056.020] GetCurrentThreadId () returned 0x970 [0056.020] GetCurrentThreadId () returned 0x970 [0056.020] GetCurrentThreadId () returned 0x970 [0056.020] GetCurrentThreadId () returned 0x970 [0056.020] GetCurrentThreadId () returned 0x970 [0056.020] GetCurrentThreadId () returned 0x970 [0056.020] GetCurrentThreadId () returned 0x970 [0056.020] GetCurrentThreadId () returned 0x970 [0056.020] GetCurrentThreadId () returned 0x970 [0056.021] GetCurrentThreadId () returned 0x970 [0056.021] GetCurrentThreadId () returned 0x970 [0056.021] GetCurrentThreadId () returned 0x970 [0056.021] GetCurrentThreadId () returned 0x970 [0056.021] GetCurrentThreadId () returned 0x970 [0056.021] GetCurrentThreadId () returned 0x970 [0056.021] GetCurrentThreadId () returned 0x970 [0056.021] GetCurrentThreadId () returned 0x970 [0056.021] GetCurrentThreadId () returned 0x970 [0056.021] GetCurrentThreadId () returned 0x970 [0056.021] GetCurrentThreadId () returned 0x970 [0056.021] GetCurrentThreadId () returned 0x970 [0056.021] GetCurrentThreadId () returned 0x970 [0056.021] GetCurrentThreadId () returned 0x970 [0056.021] GetCurrentThreadId () returned 0x970 [0056.021] GetCurrentThreadId () returned 0x970 [0056.021] GetCurrentThreadId () returned 0x970 [0056.021] GetCurrentThreadId () returned 0x970 [0056.021] GetCurrentThreadId () returned 0x970 [0056.021] GetCurrentThreadId () returned 0x970 [0056.021] GetCurrentThreadId () returned 0x970 [0056.021] GetCurrentThreadId () returned 0x970 [0056.021] GetCurrentThreadId () returned 0x970 [0056.021] GetCurrentThreadId () returned 0x970 [0056.021] GetCurrentThreadId () returned 0x970 [0056.021] GetCurrentThreadId () returned 0x970 [0056.021] GetCurrentThreadId () returned 0x970 [0056.021] GetCurrentThreadId () returned 0x970 [0056.021] GetCurrentThreadId () returned 0x970 [0056.021] GetCurrentThreadId () returned 0x970 [0056.021] GetCurrentThreadId () returned 0x970 [0056.021] GetCurrentThreadId () returned 0x970 [0056.021] GetCurrentThreadId () returned 0x970 [0056.021] GetCurrentThreadId () returned 0x970 [0056.021] GetCurrentThreadId () returned 0x970 [0056.021] GetCurrentThreadId () returned 0x970 [0056.021] GetCurrentThreadId () returned 0x970 [0056.021] GetCurrentThreadId () returned 0x970 [0056.021] GetCurrentThreadId () returned 0x970 [0056.021] GetCurrentThreadId () returned 0x970 [0056.021] GetCurrentThreadId () returned 0x970 [0056.021] GetCurrentThreadId () returned 0x970 [0056.021] GetCurrentThreadId () returned 0x970 [0056.021] GetCurrentThreadId () returned 0x970 [0056.021] GetCurrentThreadId () returned 0x970 [0056.021] GetCurrentThreadId () returned 0x970 [0056.021] GetCurrentThreadId () returned 0x970 [0056.021] GetCurrentThreadId () returned 0x970 [0056.022] GetCurrentThreadId () returned 0x970 [0056.022] GetCurrentThreadId () returned 0x970 [0056.022] GetCurrentThreadId () returned 0x970 [0056.022] GetCurrentThreadId () returned 0x970 [0056.022] GetCurrentThreadId () returned 0x970 [0056.022] GetCurrentThreadId () returned 0x970 [0056.022] GetCurrentThreadId () returned 0x970 [0056.022] GetCurrentThreadId () returned 0x970 [0056.022] GetCurrentThreadId () returned 0x970 [0056.022] GetCurrentThreadId () returned 0x970 [0056.022] GetCurrentThreadId () returned 0x970 [0056.022] GetCurrentThreadId () returned 0x970 [0056.022] GetCurrentThreadId () returned 0x970 [0056.022] GetCurrentThreadId () returned 0x970 [0056.022] GetCurrentThreadId () returned 0x970 [0056.022] GetCurrentThreadId () returned 0x970 [0056.022] GetCurrentThreadId () returned 0x970 [0056.022] GetCurrentThreadId () returned 0x970 [0056.022] GetCurrentThreadId () returned 0x970 [0056.022] GetCurrentThreadId () returned 0x970 [0056.022] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAGcW/pciftSb+H4X7iS3tHO4nrEfoSAYoauew9vxXtZF8XXdNxaGiHZTL1bf/41c5EN+B5Vp3k1eWo/BRZBUP6tPcXinrBJUVpipZ1Zp2XLp1u7y6Lhk/7gOVYOqzzbZnmY8xNhEXyy0dxa1yKkJTT8clR4pYDD3rBiM2KBoA/P+7zJJxrrdO9J3UGGubVae0cDDMV3ZD0xyci/Yh+vhAhubZN2zq57oTg==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0056.022] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAGcW/pciftSb+H4X7iS3tHO4nrEfoSAYoauew9vxXtZF8XXdNxaGiHZTL1bf/41c5EN+B5Vp3k1eWo/BRZBUP6tPcXinrBJUVpipZ1Zp2XLp1u7y6Lhk/7gOVYOqzzbZnmY8xNhEXyy0dxa1yKkJTT8clR4pYDD3rBiM2KBoA/P+7zJJxrrdO9J3UGGubVae0cDDMV3ZD0xyci/Yh+vhAhubZN2zq57oTg==", cchWideChar=245, lpMultiByteStr=0x353933c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAGcW/pciftSb+H4X7iS3tHO4nrEfoSAYoauew9vxXtZF8XXdNxaGiHZTL1bf/41c5EN+B5Vp3k1eWo/BRZBUP6tPcXinrBJUVpipZ1Zp2XLp1u7y6Lhk/7gOVYOqzzbZnmY8xNhEXyy0dxa1yKkJTT8clR4pYDD3rBiM2KBoA/P+7zJJxrrdO9J3UGGubVae0cDDMV3ZD0xyci/Yh+vhAhubZN2zq57oTg==", lpUsedDefaultChar=0x0) returned 245 [0056.022] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0056.022] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0056.022] CloseHandle (hObject=0x158) returned 1 [0056.023] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml")) returned 1 [0056.026] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=17628917852) returned 1 [0056.026] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\Файл зашифрован [GrooveMUI.XML].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\Файл зашифрован [groovemui.xml].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0056.028] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0056.028] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0056.028] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0056.028] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0056.028] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0056.028] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0056.028] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0056.028] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0056.028] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0056.028] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0056.028] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0056.028] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0056.028] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0056.028] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0056.028] SetEndOfFile (hFile=0x158) returned 1 [0056.028] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0056.029] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0056.029] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0056.029] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0056.029] WriteFile (in: hFile=0x158, lpBuffer=0x361ff08*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x361ff08*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0056.030] WriteFile (in: hFile=0x158, lpBuffer=0x35eff9c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35eff9c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0056.030] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u#3lf}YR)#sdjV~Sm6V\")yxRxe@j7A\"r", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0056.030] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u#3lf}YR)#sdjV~Sm6V\")yxRxe@j7A\"r", cchWideChar=32, lpMultiByteStr=0x2032e14, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="u#3lf}YR)#sdjV~Sm6V\")yxRxe@j7A\"r", lpUsedDefaultChar=0x0) returned 32 [0056.030] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0056.030] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0056.030] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd658ff0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveMUI.XML", cAlternateFileName="GROOVE~1.XML")) returned 0x295098 [0056.030] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0056.030] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0056.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml")) returned 0x20 [0056.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml")) returned 0x20 [0056.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml")) returned 0x20 [0056.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml")) returned 0x20 [0056.030] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd658ff0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x391)) returned 1 [0056.030] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0056.031] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0056.031] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml")) returned 0x20 [0056.031] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml")) returned 0x20 [0056.031] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0056.031] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0056.031] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0056.031] SetEndOfFile (hFile=0x158) returned 1 [0056.032] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GrooveMUI.XML", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0056.032] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GrooveMUI.XML", cchWideChar=13, lpMultiByteStr=0x1fe358c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GrooveMUI.XML", lpUsedDefaultChar=0x0) returned 13 [0056.032] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GrooveMUI.XML", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0056.032] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GrooveMUI.XML", cchWideChar=13, lpMultiByteStr=0x1fe380c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GrooveMUI.XML", lpUsedDefaultChar=0x0) returned 13 [0056.032] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe380c, cbMultiByte=13, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="GrooveMUI.XMLXMLli\x01") returned 13 [0056.032] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GrooveMUI.XML", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0056.032] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GrooveMUI.XML", cchWideChar=13, lpMultiByteStr=0x1fe358c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GrooveMUI.XML", lpUsedDefaultChar=0x0) returned 13 [0056.032] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0056.032] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0056.032] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x391 [0056.032] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0056.032] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0056.032] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0056.032] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GrooveMUI.XML", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0056.032] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GrooveMUI.XML", cchWideChar=13, lpMultiByteStr=0x1fe358c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GrooveMUI.XML", lpUsedDefaultChar=0x0) returned 13 [0056.032] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GrooveMUI.XML", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0056.032] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GrooveMUI.XML", cchWideChar=13, lpMultiByteStr=0x1fe380c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GrooveMUI.XML", lpUsedDefaultChar=0x0) returned 13 [0056.032] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe380c, cbMultiByte=13, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="GrooveMUI.XMLUI.XMLXMLli\x01") returned 13 [0056.033] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GrooveMUI.XML", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0056.033] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GrooveMUI.XML", cchWideChar=13, lpMultiByteStr=0x1fe358c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GrooveMUI.XML", lpUsedDefaultChar=0x0) returned 13 [0056.033] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0056.034] CharToOemA (in: pSrc="GrooveMUI.XML", pDst=0x1fe380c | out: pDst="GrooveMUI.XML") returned 1 [0056.034] WriteFile (in: hFile=0x158, lpBuffer=0x1fe380c*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe380c*, lpNumberOfBytesWritten=0x18e048*=0xd, lpOverlapped=0x0) returned 1 [0056.034] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0056.035] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0056.035] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0056.035] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=17629815277) returned 1 [0056.035] ReadFile (in: hFile=0x11c, lpBuffer=0x378d0a0, nNumberOfBytesToRead=0x391, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x378d0a0*, lpNumberOfBytesRead=0x18dd7c*=0x391, lpOverlapped=0x0) returned 1 [0056.036] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0056.036] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=17629947777) returned 1 [0056.044] WriteFile (in: hFile=0x158, lpBuffer=0x1fea288*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fea288*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0056.044] ReadFile (in: hFile=0x11c, lpBuffer=0x378d0a0, nNumberOfBytesToRead=0x391, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x378d0a0*, lpNumberOfBytesRead=0x18de38*=0x391, lpOverlapped=0x0) returned 1 [0056.044] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x48 [0056.044] WriteFile (in: hFile=0x158, lpBuffer=0x378d460*, nNumberOfBytesToWrite=0x391, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x378d460*, lpNumberOfBytesWritten=0x18de10*=0x391, lpOverlapped=0x0) returned 1 [0056.045] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x3d9 [0056.045] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0056.045] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0056.045] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0056.045] SetFilePointer (in: hFile=0x158, lDistanceToMove=13, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2b [0056.045] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x3e3 [0056.045] CloseHandle (hObject=0x11c) returned 1 [0056.045] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x3e3 [0056.045] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x3e3 [0056.045] SetFilePointer (in: hFile=0x158, lDistanceToMove=995, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x3e3 [0056.045] SetFilePointer (in: hFile=0x158, lDistanceToMove=995, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x3e3 [0056.045] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x3e3 [0056.045] SetFilePointer (in: hFile=0x158, lDistanceToMove=995, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x3e3 [0056.045] SetEndOfFile (hFile=0x158) returned 1 [0056.045] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x3e3 [0056.046] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x3e3 [0056.046] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GrooveMUI.XML", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0056.046] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GrooveMUI.XML", cchWideChar=13, lpMultiByteStr=0x1fe358c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GrooveMUI.XML", lpUsedDefaultChar=0x0) returned 13 [0056.046] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GrooveMUI.XML", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0056.046] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GrooveMUI.XML", cchWideChar=13, lpMultiByteStr=0x1fe3c4c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GrooveMUI.XML", lpUsedDefaultChar=0x0) returned 13 [0056.046] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe3c4c, cbMultiByte=13, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="GrooveMUI.XML@涤(\x18믉`믑`") returned 13 [0056.046] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GrooveMUI.XML", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0056.046] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GrooveMUI.XML", cchWideChar=13, lpMultiByteStr=0x1fe358c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GrooveMUI.XML", lpUsedDefaultChar=0x0) returned 13 [0056.046] WriteFile (in: hFile=0x158, lpBuffer=0x3770b58*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3770b58*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0056.046] CharToOemA (in: pSrc="GrooveMUI.XML", pDst=0x1fe3c4c | out: pDst="GrooveMUI.XML") returned 1 [0056.046] WriteFile (in: hFile=0x158, lpBuffer=0x1fe3c4c*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe3c4c*, lpNumberOfBytesWritten=0x18efcc*=0xd, lpOverlapped=0x0) returned 1 [0056.046] WriteFile (in: hFile=0x158, lpBuffer=0x1fea2d8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea2d8*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0056.046] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0056.046] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0056.046] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x429 [0056.046] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x429 [0056.047] WriteFile (in: hFile=0x158, lpBuffer=0x361ff08*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x361ff08*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0056.047] WriteFile (in: hFile=0x158, lpBuffer=0x35eff9c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35eff9c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0056.047] DeleteFileW (lpFileName="") returned 0 [0056.047] GetLastError () returned 0x3 [0056.047] GetFileAttributesW (lpFileName="") returned 0xffffffff [0056.047] SetLastError (dwErrCode=0x3) [0056.047] FlushFileBuffers (hFile=0x158) returned 1 [0056.051] GetCurrentThreadId () returned 0x970 [0056.051] GetCurrentThreadId () returned 0x970 [0056.051] GetCurrentThreadId () returned 0x970 [0056.051] GetCurrentThreadId () returned 0x970 [0056.051] GetCurrentThreadId () returned 0x970 [0056.051] GetCurrentThreadId () returned 0x970 [0056.051] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x4e0 [0056.051] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x4e0 [0056.051] SetFilePointer (in: hFile=0x158, lDistanceToMove=1248, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x4e0 [0056.051] CloseHandle (hObject=0x158) returned 1 [0056.052] GetCurrentThreadId () returned 0x970 [0056.052] GetCurrentThreadId () returned 0x970 [0056.052] GetCurrentThreadId () returned 0x970 [0056.052] GetCurrentThreadId () returned 0x970 [0056.052] GetCurrentThreadId () returned 0x970 [0056.052] GetCurrentThreadId () returned 0x970 [0056.052] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\Файл зашифрован [GrooveMUI.XML].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\Файл зашифрован [groovemui.xml].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0056.052] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4e0 [0056.052] SetFilePointer (in: hFile=0x158, lDistanceToMove=1120, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x460 [0056.053] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0056.053] GetFileType (hFile=0x158) returned 0x1 [0056.053] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x3, wMilliseconds=0x148)) [0056.053] GetCurrentThreadId () returned 0x970 [0056.053] GetCurrentThreadId () returned 0x970 [0056.053] GetCurrentThreadId () returned 0x970 [0056.053] GetCurrentThreadId () returned 0x970 [0056.053] GetCurrentThreadId () returned 0x970 [0056.053] GetCurrentThreadId () returned 0x970 [0056.053] GetCurrentThreadId () returned 0x970 [0056.053] GetCurrentThreadId () returned 0x970 [0056.053] GetCurrentThreadId () returned 0x970 [0056.053] GetCurrentThreadId () returned 0x970 [0056.053] GetCurrentThreadId () returned 0x970 [0056.053] GetCurrentThreadId () returned 0x970 [0056.053] GetCurrentThreadId () returned 0x970 [0056.053] GetCurrentThreadId () returned 0x970 [0056.053] GetCurrentThreadId () returned 0x970 [0056.053] GetCurrentThreadId () returned 0x970 [0056.053] GetCurrentThreadId () returned 0x970 [0056.053] GetCurrentThreadId () returned 0x970 [0056.053] GetCurrentThreadId () returned 0x970 [0056.053] GetCurrentThreadId () returned 0x970 [0056.053] GetCurrentThreadId () returned 0x970 [0056.053] GetCurrentThreadId () returned 0x970 [0056.053] GetCurrentThreadId () returned 0x970 [0056.053] GetCurrentThreadId () returned 0x970 [0056.053] GetCurrentThreadId () returned 0x970 [0056.053] GetCurrentThreadId () returned 0x970 [0056.053] GetCurrentThreadId () returned 0x970 [0056.053] GetCurrentThreadId () returned 0x970 [0056.053] GetCurrentThreadId () returned 0x970 [0056.053] GetCurrentThreadId () returned 0x970 [0056.053] GetCurrentThreadId () returned 0x970 [0056.053] GetCurrentThreadId () returned 0x970 [0056.053] GetCurrentThreadId () returned 0x970 [0056.053] GetCurrentThreadId () returned 0x970 [0056.053] GetCurrentThreadId () returned 0x970 [0056.053] GetCurrentThreadId () returned 0x970 [0056.053] GetCurrentThreadId () returned 0x970 [0056.053] GetCurrentThreadId () returned 0x970 [0056.053] GetCurrentThreadId () returned 0x970 [0056.053] GetCurrentThreadId () returned 0x970 [0056.053] GetCurrentThreadId () returned 0x970 [0056.054] GetCurrentThreadId () returned 0x970 [0056.054] GetCurrentThreadId () returned 0x970 [0056.054] GetCurrentThreadId () returned 0x970 [0056.054] GetCurrentThreadId () returned 0x970 [0056.054] GetCurrentThreadId () returned 0x970 [0056.054] GetCurrentThreadId () returned 0x970 [0056.054] GetCurrentThreadId () returned 0x970 [0056.054] GetCurrentThreadId () returned 0x970 [0056.054] GetCurrentThreadId () returned 0x970 [0056.054] GetCurrentThreadId () returned 0x970 [0056.054] GetCurrentThreadId () returned 0x970 [0056.054] GetCurrentThreadId () returned 0x970 [0056.054] GetCurrentThreadId () returned 0x970 [0056.054] GetCurrentThreadId () returned 0x970 [0056.054] GetCurrentThreadId () returned 0x970 [0056.054] GetCurrentThreadId () returned 0x970 [0056.054] GetCurrentThreadId () returned 0x970 [0056.054] GetCurrentThreadId () returned 0x970 [0056.054] GetCurrentThreadId () returned 0x970 [0056.054] GetCurrentThreadId () returned 0x970 [0056.054] GetCurrentThreadId () returned 0x970 [0056.054] GetCurrentThreadId () returned 0x970 [0056.054] GetCurrentThreadId () returned 0x970 [0056.054] GetCurrentThreadId () returned 0x970 [0056.054] GetCurrentThreadId () returned 0x970 [0056.054] GetCurrentThreadId () returned 0x970 [0056.054] GetCurrentThreadId () returned 0x970 [0056.054] GetCurrentThreadId () returned 0x970 [0056.054] GetCurrentThreadId () returned 0x970 [0056.054] GetCurrentThreadId () returned 0x970 [0056.054] GetCurrentThreadId () returned 0x970 [0056.054] GetCurrentThreadId () returned 0x970 [0056.054] GetCurrentThreadId () returned 0x970 [0056.054] GetCurrentThreadId () returned 0x970 [0056.054] GetCurrentThreadId () returned 0x970 [0056.054] GetCurrentThreadId () returned 0x970 [0056.054] GetCurrentThreadId () returned 0x970 [0056.054] GetCurrentThreadId () returned 0x970 [0056.054] GetCurrentThreadId () returned 0x970 [0056.054] GetCurrentThreadId () returned 0x970 [0056.054] GetCurrentThreadId () returned 0x970 [0056.054] GetCurrentThreadId () returned 0x970 [0056.054] GetCurrentThreadId () returned 0x970 [0056.054] GetCurrentThreadId () returned 0x970 [0056.054] GetCurrentThreadId () returned 0x970 [0056.054] GetCurrentThreadId () returned 0x970 [0056.054] GetCurrentThreadId () returned 0x970 [0056.054] GetCurrentThreadId () returned 0x970 [0056.055] GetCurrentThreadId () returned 0x970 [0056.055] GetCurrentThreadId () returned 0x970 [0056.055] GetCurrentThreadId () returned 0x970 [0056.055] GetCurrentThreadId () returned 0x970 [0056.055] GetCurrentThreadId () returned 0x970 [0056.055] GetCurrentThreadId () returned 0x970 [0056.055] GetCurrentThreadId () returned 0x970 [0056.055] GetCurrentThreadId () returned 0x970 [0056.055] GetCurrentThreadId () returned 0x970 [0056.055] GetCurrentThreadId () returned 0x970 [0056.055] GetCurrentThreadId () returned 0x970 [0056.055] GetCurrentThreadId () returned 0x970 [0056.055] GetCurrentThreadId () returned 0x970 [0056.055] GetCurrentThreadId () returned 0x970 [0056.055] GetCurrentThreadId () returned 0x970 [0056.055] GetCurrentThreadId () returned 0x970 [0056.055] GetCurrentThreadId () returned 0x970 [0056.055] GetCurrentThreadId () returned 0x970 [0056.055] GetCurrentThreadId () returned 0x970 [0056.055] GetCurrentThreadId () returned 0x970 [0056.055] GetCurrentThreadId () returned 0x970 [0056.055] GetCurrentThreadId () returned 0x970 [0056.055] GetCurrentThreadId () returned 0x970 [0056.055] GetCurrentThreadId () returned 0x970 [0056.055] GetCurrentThreadId () returned 0x970 [0056.055] GetCurrentThreadId () returned 0x970 [0056.055] GetCurrentThreadId () returned 0x970 [0056.055] GetCurrentThreadId () returned 0x970 [0056.055] GetCurrentThreadId () returned 0x970 [0056.055] GetCurrentThreadId () returned 0x970 [0056.055] GetCurrentThreadId () returned 0x970 [0056.055] GetCurrentThreadId () returned 0x970 [0056.055] GetCurrentThreadId () returned 0x970 [0056.055] GetCurrentThreadId () returned 0x970 [0056.055] GetCurrentThreadId () returned 0x970 [0056.055] GetCurrentThreadId () returned 0x970 [0056.055] GetCurrentThreadId () returned 0x970 [0056.055] GetCurrentThreadId () returned 0x970 [0056.055] GetCurrentThreadId () returned 0x970 [0056.055] GetCurrentThreadId () returned 0x970 [0056.055] GetCurrentThreadId () returned 0x970 [0056.055] GetCurrentThreadId () returned 0x970 [0056.055] GetCurrentThreadId () returned 0x970 [0056.055] GetCurrentThreadId () returned 0x970 [0056.055] GetCurrentThreadId () returned 0x970 [0056.055] GetCurrentThreadId () returned 0x970 [0056.055] GetCurrentThreadId () returned 0x970 [0056.055] GetCurrentThreadId () returned 0x970 [0056.055] GetCurrentThreadId () returned 0x970 [0056.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0056.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0056.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fed530, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0056.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0056.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0056.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fed530, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0056.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0056.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0056.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0056.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0056.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0056.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0056.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0056.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0056.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fed590, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0056.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0056.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0056.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fed590, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0056.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0056.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0056.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fed590, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0056.056] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x3, wMilliseconds=0x148)) [0056.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="u#3lf}YR)#sdjV~Sm6V\")yxRxe@j7A\"r", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0056.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="u#3lf}YR)#sdjV~Sm6V\")yxRxe@j7A\"r", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0056.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="u#3lf}YR)#sdjV~Sm6V\")yxRxe@j7A\"r", cchWideChar=32, lpMultiByteStr=0x20018e8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="u#3lf}YR)#sdjV~Sm6V\")yxRxe@j7A\"r", lpUsedDefaultChar=0x0) returned 32 [0056.056] GetCurrentThreadId () returned 0x970 [0056.056] GetCurrentThreadId () returned 0x970 [0056.056] GetCurrentThreadId () returned 0x970 [0056.056] GetCurrentThreadId () returned 0x970 [0056.056] GetCurrentThreadId () returned 0x970 [0056.056] GetCurrentThreadId () returned 0x970 [0056.063] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0056.063] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0056.063] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x34f34e8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0056.064] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0056.064] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAIAoUD8XyH0HVfKQkSLEFceqVQIvfMigOLaHtQf4ZgLYLlk2A1b4meoNurbTnK6XNF78dGoVU/4fPkIcOPwH81DYnFcaYmpxTzAkDRQarVFNhZcRy5KnnrCMOtFAeZmsCQ2IE6/yZ6F8AIJOcJY7RblaPIqEDm4RFZB7Z/1vjBn5tVUNjgqMVEronMIAfC5Wytn7xFtIpXUokBkCexCdCNI/ddwh+uMOHg==") returned 232 [0056.064] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x3, wMilliseconds=0x148)) [0056.064] GetCurrentThreadId () returned 0x970 [0056.064] GetCurrentThreadId () returned 0x970 [0056.064] GetCurrentThreadId () returned 0x970 [0056.064] GetCurrentThreadId () returned 0x970 [0056.064] GetCurrentThreadId () returned 0x970 [0056.064] GetCurrentThreadId () returned 0x970 [0056.064] GetCurrentThreadId () returned 0x970 [0056.064] GetCurrentThreadId () returned 0x970 [0056.064] GetCurrentThreadId () returned 0x970 [0056.064] GetCurrentThreadId () returned 0x970 [0056.064] GetCurrentThreadId () returned 0x970 [0056.064] GetCurrentThreadId () returned 0x970 [0056.064] GetCurrentThreadId () returned 0x970 [0056.064] GetCurrentThreadId () returned 0x970 [0056.064] GetCurrentThreadId () returned 0x970 [0056.064] GetCurrentThreadId () returned 0x970 [0056.064] GetCurrentThreadId () returned 0x970 [0056.064] GetCurrentThreadId () returned 0x970 [0056.064] GetCurrentThreadId () returned 0x970 [0056.064] GetCurrentThreadId () returned 0x970 [0056.064] GetCurrentThreadId () returned 0x970 [0056.064] GetCurrentThreadId () returned 0x970 [0056.064] GetCurrentThreadId () returned 0x970 [0056.064] GetCurrentThreadId () returned 0x970 [0056.064] GetCurrentThreadId () returned 0x970 [0056.064] GetCurrentThreadId () returned 0x970 [0056.064] GetCurrentThreadId () returned 0x970 [0056.064] GetCurrentThreadId () returned 0x970 [0056.064] GetCurrentThreadId () returned 0x970 [0056.064] GetCurrentThreadId () returned 0x970 [0056.064] GetCurrentThreadId () returned 0x970 [0056.064] GetCurrentThreadId () returned 0x970 [0056.064] GetCurrentThreadId () returned 0x970 [0056.064] GetCurrentThreadId () returned 0x970 [0056.064] GetCurrentThreadId () returned 0x970 [0056.064] GetCurrentThreadId () returned 0x970 [0056.064] GetCurrentThreadId () returned 0x970 [0056.064] GetCurrentThreadId () returned 0x970 [0056.064] GetCurrentThreadId () returned 0x970 [0056.064] GetCurrentThreadId () returned 0x970 [0056.065] GetCurrentThreadId () returned 0x970 [0056.065] GetCurrentThreadId () returned 0x970 [0056.065] GetCurrentThreadId () returned 0x970 [0056.065] GetCurrentThreadId () returned 0x970 [0056.065] GetCurrentThreadId () returned 0x970 [0056.065] GetCurrentThreadId () returned 0x970 [0056.065] GetCurrentThreadId () returned 0x970 [0056.065] GetCurrentThreadId () returned 0x970 [0056.065] GetCurrentThreadId () returned 0x970 [0056.065] GetCurrentThreadId () returned 0x970 [0056.065] GetCurrentThreadId () returned 0x970 [0056.065] GetCurrentThreadId () returned 0x970 [0056.065] GetCurrentThreadId () returned 0x970 [0056.065] GetCurrentThreadId () returned 0x970 [0056.065] GetCurrentThreadId () returned 0x970 [0056.065] GetCurrentThreadId () returned 0x970 [0056.065] GetCurrentThreadId () returned 0x970 [0056.065] GetCurrentThreadId () returned 0x970 [0056.065] GetCurrentThreadId () returned 0x970 [0056.065] GetCurrentThreadId () returned 0x970 [0056.065] GetCurrentThreadId () returned 0x970 [0056.065] GetCurrentThreadId () returned 0x970 [0056.065] GetCurrentThreadId () returned 0x970 [0056.065] GetCurrentThreadId () returned 0x970 [0056.065] GetCurrentThreadId () returned 0x970 [0056.065] GetCurrentThreadId () returned 0x970 [0056.065] GetCurrentThreadId () returned 0x970 [0056.065] GetCurrentThreadId () returned 0x970 [0056.065] GetCurrentThreadId () returned 0x970 [0056.065] GetCurrentThreadId () returned 0x970 [0056.065] GetCurrentThreadId () returned 0x970 [0056.065] GetCurrentThreadId () returned 0x970 [0056.065] GetCurrentThreadId () returned 0x970 [0056.065] GetCurrentThreadId () returned 0x970 [0056.065] GetCurrentThreadId () returned 0x970 [0056.065] GetCurrentThreadId () returned 0x970 [0056.065] GetCurrentThreadId () returned 0x970 [0056.065] GetCurrentThreadId () returned 0x970 [0056.065] GetCurrentThreadId () returned 0x970 [0056.065] GetCurrentThreadId () returned 0x970 [0056.065] GetCurrentThreadId () returned 0x970 [0056.065] GetCurrentThreadId () returned 0x970 [0056.065] GetCurrentThreadId () returned 0x970 [0056.065] GetCurrentThreadId () returned 0x970 [0056.065] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAIAoUD8XyH0HVfKQkSLEFceqVQIvfMigOLaHtQf4ZgLYLlk2A1b4meoNurbTnK6XNF78dGoVU/4fPkIcOPwH81DYnFcaYmpxTzAkDRQarVFNhZcRy5KnnrCMOtFAeZmsCQ2IE6/yZ6F8AIJOcJY7RblaPIqEDm4RFZB7Z/1vjBn5tVUNjgqMVEronMIAfC5Wytn7xFtIpXUokBkCexCdCNI/ddwh+uMOHg==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0056.065] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAIAoUD8XyH0HVfKQkSLEFceqVQIvfMigOLaHtQf4ZgLYLlk2A1b4meoNurbTnK6XNF78dGoVU/4fPkIcOPwH81DYnFcaYmpxTzAkDRQarVFNhZcRy5KnnrCMOtFAeZmsCQ2IE6/yZ6F8AIJOcJY7RblaPIqEDm4RFZB7Z/1vjBn5tVUNjgqMVEronMIAfC5Wytn7xFtIpXUokBkCexCdCNI/ddwh+uMOHg==", cchWideChar=245, lpMultiByteStr=0x353933c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAIAoUD8XyH0HVfKQkSLEFceqVQIvfMigOLaHtQf4ZgLYLlk2A1b4meoNurbTnK6XNF78dGoVU/4fPkIcOPwH81DYnFcaYmpxTzAkDRQarVFNhZcRy5KnnrCMOtFAeZmsCQ2IE6/yZ6F8AIJOcJY7RblaPIqEDm4RFZB7Z/1vjBn5tVUNjgqMVEronMIAfC5Wytn7xFtIpXUokBkCexCdCNI/ddwh+uMOHg==", lpUsedDefaultChar=0x0) returned 245 [0056.066] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0056.066] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0056.066] CloseHandle (hObject=0x158) returned 1 [0056.066] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml")) returned 1 [0056.067] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=17633057718) returned 1 [0056.067] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\Файл зашифрован [SETUP.XML].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\Файл зашифрован [setup.xml].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0056.067] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0056.068] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0056.068] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0056.068] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0056.068] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0056.068] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0056.068] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0056.068] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0056.068] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0056.068] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0056.068] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0056.068] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0056.068] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0056.068] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0056.068] SetEndOfFile (hFile=0x158) returned 1 [0056.068] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0056.068] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0056.068] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0056.068] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0056.069] WriteFile (in: hFile=0x158, lpBuffer=0x361ff08*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x361ff08*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0056.069] WriteFile (in: hFile=0x158, lpBuffer=0x35f005c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f005c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0056.069] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="z-0OetoeO#hKKE{Sr-S}zTZ*@W/63/o1", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0056.069] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="z-0OetoeO#hKKE{Sr-S}zTZ*@W/63/o1", cchWideChar=32, lpMultiByteStr=0x2033d9c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="z-0OetoeO#hKKE{Sr-S}zTZ*@W/63/o1", lpUsedDefaultChar=0x0) returned 32 [0056.069] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0056.070] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0056.070] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee803530, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0x295098 [0056.070] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0056.070] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0056.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml")) returned 0x20 [0056.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml")) returned 0x20 [0056.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml")) returned 0x20 [0056.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml")) returned 0x20 [0056.073] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee803530, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac)) returned 1 [0056.073] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0056.073] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0056.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml")) returned 0x20 [0056.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml")) returned 0x20 [0056.073] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0056.073] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0056.073] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0056.073] SetEndOfFile (hFile=0x158) returned 1 [0056.074] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0056.074] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x1fe43ec, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SETUP.XML", lpUsedDefaultChar=0x0) returned 9 [0056.074] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0056.074] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x1fe434c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SETUP.XML", lpUsedDefaultChar=0x0) returned 9 [0056.074] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe434c, cbMultiByte=9, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="SETUP.XML.XMLXMLli\x01") returned 9 [0056.074] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0056.074] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x1fe43ec, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SETUP.XML", lpUsedDefaultChar=0x0) returned 9 [0056.075] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0056.075] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0056.075] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x5ac [0056.075] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0056.075] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0056.075] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0056.075] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0056.075] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x1fe43ec, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SETUP.XML", lpUsedDefaultChar=0x0) returned 9 [0056.075] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0056.075] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x1fe434c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SETUP.XML", lpUsedDefaultChar=0x0) returned 9 [0056.075] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe434c, cbMultiByte=9, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="SETUP.XMLUP.XML.XMLXMLli\x01") returned 9 [0056.075] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0056.075] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x1fe43ec, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SETUP.XML", lpUsedDefaultChar=0x0) returned 9 [0056.075] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0056.076] CharToOemA (in: pSrc="SETUP.XML", pDst=0x1fe434c | out: pDst="SETUP.XML") returned 1 [0056.076] WriteFile (in: hFile=0x158, lpBuffer=0x1fe434c*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe434c*, lpNumberOfBytesWritten=0x18e048*=0x9, lpOverlapped=0x0) returned 1 [0056.076] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0056.076] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0056.076] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0056.076] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=17633973556) returned 1 [0056.076] ReadFile (in: hFile=0x11c, lpBuffer=0x378d0a0, nNumberOfBytesToRead=0x5ac, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x378d0a0*, lpNumberOfBytesRead=0x18dd7c*=0x5ac, lpOverlapped=0x0) returned 1 [0056.078] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0056.078] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=17634105005) returned 1 [0056.086] WriteFile (in: hFile=0x158, lpBuffer=0x1fea2b8*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fea2b8*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0056.086] ReadFile (in: hFile=0x11c, lpBuffer=0x378d0a0, nNumberOfBytesToRead=0x5ac, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x378d0a0*, lpNumberOfBytesRead=0x18de38*=0x5ac, lpOverlapped=0x0) returned 1 [0056.086] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x44 [0056.086] WriteFile (in: hFile=0x158, lpBuffer=0x378d680*, nNumberOfBytesToWrite=0x5ac, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x378d680*, lpNumberOfBytesWritten=0x18de10*=0x5ac, lpOverlapped=0x0) returned 1 [0056.086] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x5f0 [0056.086] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0056.086] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0056.086] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0056.086] SetFilePointer (in: hFile=0x158, lDistanceToMove=9, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x27 [0056.087] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x5fa [0056.087] CloseHandle (hObject=0x11c) returned 1 [0056.087] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x5fa [0056.087] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x5fa [0056.087] SetFilePointer (in: hFile=0x158, lDistanceToMove=1530, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x5fa [0056.087] SetFilePointer (in: hFile=0x158, lDistanceToMove=1530, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x5fa [0056.087] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x5fa [0056.087] SetFilePointer (in: hFile=0x158, lDistanceToMove=1530, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x5fa [0056.087] SetEndOfFile (hFile=0x158) returned 1 [0056.087] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x5fa [0056.087] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x5fa [0056.087] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0056.087] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x1fe43ec, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SETUP.XML", lpUsedDefaultChar=0x0) returned 9 [0056.087] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0056.087] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x1fe3bac, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SETUP.XML", lpUsedDefaultChar=0x0) returned 9 [0056.087] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe3bac, cbMultiByte=9, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="SETUP.XML") returned 9 [0056.087] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0056.087] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x1fe43ec, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SETUP.XML", lpUsedDefaultChar=0x0) returned 9 [0056.088] WriteFile (in: hFile=0x158, lpBuffer=0x3770b58*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3770b58*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0056.088] CharToOemA (in: pSrc="SETUP.XML", pDst=0x1fe3bac | out: pDst="SETUP.XML") returned 1 [0056.088] WriteFile (in: hFile=0x158, lpBuffer=0x1fe3bac*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe3bac*, lpNumberOfBytesWritten=0x18efcc*=0x9, lpOverlapped=0x0) returned 1 [0056.088] WriteFile (in: hFile=0x158, lpBuffer=0x1fea170*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea170*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0056.088] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0056.088] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0056.088] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x63c [0056.088] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x63c [0056.088] WriteFile (in: hFile=0x158, lpBuffer=0x361ff08*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x361ff08*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0056.088] WriteFile (in: hFile=0x158, lpBuffer=0x35f005c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f005c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0056.088] DeleteFileW (lpFileName="") returned 0 [0056.088] GetLastError () returned 0x3 [0056.088] GetFileAttributesW (lpFileName="") returned 0xffffffff [0056.088] SetLastError (dwErrCode=0x3) [0056.088] FlushFileBuffers (hFile=0x158) returned 1 [0056.091] GetCurrentThreadId () returned 0x970 [0056.091] GetCurrentThreadId () returned 0x970 [0056.091] GetCurrentThreadId () returned 0x970 [0056.091] GetCurrentThreadId () returned 0x970 [0056.091] GetCurrentThreadId () returned 0x970 [0056.091] GetCurrentThreadId () returned 0x970 [0056.091] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x6f3 [0056.091] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x6f3 [0056.091] SetFilePointer (in: hFile=0x158, lDistanceToMove=1779, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x6f3 [0056.091] CloseHandle (hObject=0x158) returned 1 [0056.092] GetCurrentThreadId () returned 0x970 [0056.092] GetCurrentThreadId () returned 0x970 [0056.092] GetCurrentThreadId () returned 0x970 [0056.092] GetCurrentThreadId () returned 0x970 [0056.092] GetCurrentThreadId () returned 0x970 [0056.092] GetCurrentThreadId () returned 0x970 [0056.092] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\Файл зашифрован [SETUP.XML].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\Файл зашифрован [setup.xml].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0056.092] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6f3 [0056.092] SetFilePointer (in: hFile=0x158, lDistanceToMove=1651, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x673 [0056.092] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0056.092] GetFileType (hFile=0x158) returned 0x1 [0056.092] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x3, wMilliseconds=0x167)) [0056.092] GetCurrentThreadId () returned 0x970 [0056.092] GetCurrentThreadId () returned 0x970 [0056.092] GetCurrentThreadId () returned 0x970 [0056.092] GetCurrentThreadId () returned 0x970 [0056.092] GetCurrentThreadId () returned 0x970 [0056.092] GetCurrentThreadId () returned 0x970 [0056.092] GetCurrentThreadId () returned 0x970 [0056.092] GetCurrentThreadId () returned 0x970 [0056.092] GetCurrentThreadId () returned 0x970 [0056.093] GetCurrentThreadId () returned 0x970 [0056.093] GetCurrentThreadId () returned 0x970 [0056.093] GetCurrentThreadId () returned 0x970 [0056.093] GetCurrentThreadId () returned 0x970 [0056.093] GetCurrentThreadId () returned 0x970 [0056.093] GetCurrentThreadId () returned 0x970 [0056.093] GetCurrentThreadId () returned 0x970 [0056.093] GetCurrentThreadId () returned 0x970 [0056.093] GetCurrentThreadId () returned 0x970 [0056.093] GetCurrentThreadId () returned 0x970 [0056.093] GetCurrentThreadId () returned 0x970 [0056.093] GetCurrentThreadId () returned 0x970 [0056.093] GetCurrentThreadId () returned 0x970 [0056.093] GetCurrentThreadId () returned 0x970 [0056.093] GetCurrentThreadId () returned 0x970 [0056.093] GetCurrentThreadId () returned 0x970 [0056.093] GetCurrentThreadId () returned 0x970 [0056.093] GetCurrentThreadId () returned 0x970 [0056.093] GetCurrentThreadId () returned 0x970 [0056.093] GetCurrentThreadId () returned 0x970 [0056.093] GetCurrentThreadId () returned 0x970 [0056.093] GetCurrentThreadId () returned 0x970 [0056.093] GetCurrentThreadId () returned 0x970 [0056.093] GetCurrentThreadId () returned 0x970 [0056.093] GetCurrentThreadId () returned 0x970 [0056.093] GetCurrentThreadId () returned 0x970 [0056.093] GetCurrentThreadId () returned 0x970 [0056.093] GetCurrentThreadId () returned 0x970 [0056.093] GetCurrentThreadId () returned 0x970 [0056.093] GetCurrentThreadId () returned 0x970 [0056.093] GetCurrentThreadId () returned 0x970 [0056.093] GetCurrentThreadId () returned 0x970 [0056.093] GetCurrentThreadId () returned 0x970 [0056.093] GetCurrentThreadId () returned 0x970 [0056.093] GetCurrentThreadId () returned 0x970 [0056.093] GetCurrentThreadId () returned 0x970 [0056.093] GetCurrentThreadId () returned 0x970 [0056.093] GetCurrentThreadId () returned 0x970 [0056.093] GetCurrentThreadId () returned 0x970 [0056.093] GetCurrentThreadId () returned 0x970 [0056.093] GetCurrentThreadId () returned 0x970 [0056.093] GetCurrentThreadId () returned 0x970 [0056.093] GetCurrentThreadId () returned 0x970 [0056.093] GetCurrentThreadId () returned 0x970 [0056.093] GetCurrentThreadId () returned 0x970 [0056.093] GetCurrentThreadId () returned 0x970 [0056.094] GetCurrentThreadId () returned 0x970 [0056.094] GetCurrentThreadId () returned 0x970 [0056.094] GetCurrentThreadId () returned 0x970 [0056.094] GetCurrentThreadId () returned 0x970 [0056.094] GetCurrentThreadId () returned 0x970 [0056.094] GetCurrentThreadId () returned 0x970 [0056.094] GetCurrentThreadId () returned 0x970 [0056.094] GetCurrentThreadId () returned 0x970 [0056.094] GetCurrentThreadId () returned 0x970 [0056.094] GetCurrentThreadId () returned 0x970 [0056.094] GetCurrentThreadId () returned 0x970 [0056.094] GetCurrentThreadId () returned 0x970 [0056.094] GetCurrentThreadId () returned 0x970 [0056.094] GetCurrentThreadId () returned 0x970 [0056.094] GetCurrentThreadId () returned 0x970 [0056.094] GetCurrentThreadId () returned 0x970 [0056.094] GetCurrentThreadId () returned 0x970 [0056.094] GetCurrentThreadId () returned 0x970 [0056.094] GetCurrentThreadId () returned 0x970 [0056.094] GetCurrentThreadId () returned 0x970 [0056.094] GetCurrentThreadId () returned 0x970 [0056.094] GetCurrentThreadId () returned 0x970 [0056.094] GetCurrentThreadId () returned 0x970 [0056.094] GetCurrentThreadId () returned 0x970 [0056.094] GetCurrentThreadId () returned 0x970 [0056.094] GetCurrentThreadId () returned 0x970 [0056.094] GetCurrentThreadId () returned 0x970 [0056.094] GetCurrentThreadId () returned 0x970 [0056.094] GetCurrentThreadId () returned 0x970 [0056.094] GetCurrentThreadId () returned 0x970 [0056.094] GetCurrentThreadId () returned 0x970 [0056.094] GetCurrentThreadId () returned 0x970 [0056.094] GetCurrentThreadId () returned 0x970 [0056.094] GetCurrentThreadId () returned 0x970 [0056.094] GetCurrentThreadId () returned 0x970 [0056.094] GetCurrentThreadId () returned 0x970 [0056.094] GetCurrentThreadId () returned 0x970 [0056.094] GetCurrentThreadId () returned 0x970 [0056.094] GetCurrentThreadId () returned 0x970 [0056.094] GetCurrentThreadId () returned 0x970 [0056.094] GetCurrentThreadId () returned 0x970 [0056.094] GetCurrentThreadId () returned 0x970 [0056.094] GetCurrentThreadId () returned 0x970 [0056.094] GetCurrentThreadId () returned 0x970 [0056.094] GetCurrentThreadId () returned 0x970 [0056.094] GetCurrentThreadId () returned 0x970 [0056.094] GetCurrentThreadId () returned 0x970 [0056.095] GetCurrentThreadId () returned 0x970 [0056.095] GetCurrentThreadId () returned 0x970 [0056.095] GetCurrentThreadId () returned 0x970 [0056.095] GetCurrentThreadId () returned 0x970 [0056.095] GetCurrentThreadId () returned 0x970 [0056.095] GetCurrentThreadId () returned 0x970 [0056.095] GetCurrentThreadId () returned 0x970 [0056.095] GetCurrentThreadId () returned 0x970 [0056.095] GetCurrentThreadId () returned 0x970 [0056.095] GetCurrentThreadId () returned 0x970 [0056.095] GetCurrentThreadId () returned 0x970 [0056.095] GetCurrentThreadId () returned 0x970 [0056.095] GetCurrentThreadId () returned 0x970 [0056.095] GetCurrentThreadId () returned 0x970 [0056.095] GetCurrentThreadId () returned 0x970 [0056.095] GetCurrentThreadId () returned 0x970 [0056.095] GetCurrentThreadId () returned 0x970 [0056.095] GetCurrentThreadId () returned 0x970 [0056.095] GetCurrentThreadId () returned 0x970 [0056.095] GetCurrentThreadId () returned 0x970 [0056.095] GetCurrentThreadId () returned 0x970 [0056.095] GetCurrentThreadId () returned 0x970 [0056.095] GetCurrentThreadId () returned 0x970 [0056.095] GetCurrentThreadId () returned 0x970 [0056.095] GetCurrentThreadId () returned 0x970 [0056.095] GetCurrentThreadId () returned 0x970 [0056.095] GetCurrentThreadId () returned 0x970 [0056.095] GetCurrentThreadId () returned 0x970 [0056.095] GetCurrentThreadId () returned 0x970 [0056.095] GetCurrentThreadId () returned 0x970 [0056.095] GetCurrentThreadId () returned 0x970 [0056.095] GetCurrentThreadId () returned 0x970 [0056.095] GetCurrentThreadId () returned 0x970 [0056.095] GetCurrentThreadId () returned 0x970 [0056.095] GetCurrentThreadId () returned 0x970 [0056.095] GetCurrentThreadId () returned 0x970 [0056.095] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0056.095] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0056.095] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fed590, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0056.095] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0056.095] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0056.095] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fed590, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0056.095] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0056.095] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0056.096] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0056.096] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0056.096] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0056.096] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0056.096] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0056.096] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0056.096] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fed5f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0056.096] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0056.096] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0056.096] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fed5f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0056.096] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0056.096] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0056.096] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fed5f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0056.096] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x3, wMilliseconds=0x177)) [0056.096] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="z-0OetoeO#hKKE{Sr-S}zTZ*@W/63/o1", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0056.096] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="z-0OetoeO#hKKE{Sr-S}zTZ*@W/63/o1", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0056.096] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="z-0OetoeO#hKKE{Sr-S}zTZ*@W/63/o1", cchWideChar=32, lpMultiByteStr=0x20017f8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="z-0OetoeO#hKKE{Sr-S}zTZ*@W/63/o1", lpUsedDefaultChar=0x0) returned 32 [0056.096] GetCurrentThreadId () returned 0x970 [0056.096] GetCurrentThreadId () returned 0x970 [0056.096] GetCurrentThreadId () returned 0x970 [0056.096] GetCurrentThreadId () returned 0x970 [0056.096] GetCurrentThreadId () returned 0x970 [0056.096] GetCurrentThreadId () returned 0x970 [0056.103] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0056.103] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0056.103] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x34f35d8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0056.103] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0056.103] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAHH/3+N9iGA7hAXCJNcY0kCRhpQg6bYieNj5jpKDeH+lpO8XaCjRObSrDTTDUe2iul3lBVASF0xj0a+PSMLji4RYciGga6j3jT7WlUSz+i/aeY1Xa9CegQqivj2jTdu5ACKXeBwwyOJ2aGSXeMORads3QSpDtXR2Kid8UFJZprCSBUKGTS0iiLLZehFmzr5wn12SFKiu8l6UNN1p3SdJwU5auNziooYyfw==") returned 232 [0056.103] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x3, wMilliseconds=0x177)) [0056.103] GetCurrentThreadId () returned 0x970 [0056.103] GetCurrentThreadId () returned 0x970 [0056.103] GetCurrentThreadId () returned 0x970 [0056.103] GetCurrentThreadId () returned 0x970 [0056.103] GetCurrentThreadId () returned 0x970 [0056.103] GetCurrentThreadId () returned 0x970 [0056.103] GetCurrentThreadId () returned 0x970 [0056.103] GetCurrentThreadId () returned 0x970 [0056.103] GetCurrentThreadId () returned 0x970 [0056.103] GetCurrentThreadId () returned 0x970 [0056.104] GetCurrentThreadId () returned 0x970 [0056.104] GetCurrentThreadId () returned 0x970 [0056.104] GetCurrentThreadId () returned 0x970 [0056.104] GetCurrentThreadId () returned 0x970 [0056.104] GetCurrentThreadId () returned 0x970 [0056.104] GetCurrentThreadId () returned 0x970 [0056.104] GetCurrentThreadId () returned 0x970 [0056.104] GetCurrentThreadId () returned 0x970 [0056.104] GetCurrentThreadId () returned 0x970 [0056.104] GetCurrentThreadId () returned 0x970 [0056.104] GetCurrentThreadId () returned 0x970 [0056.104] GetCurrentThreadId () returned 0x970 [0056.104] GetCurrentThreadId () returned 0x970 [0056.104] GetCurrentThreadId () returned 0x970 [0056.104] GetCurrentThreadId () returned 0x970 [0056.104] GetCurrentThreadId () returned 0x970 [0056.104] GetCurrentThreadId () returned 0x970 [0056.104] GetCurrentThreadId () returned 0x970 [0056.104] GetCurrentThreadId () returned 0x970 [0056.104] GetCurrentThreadId () returned 0x970 [0056.104] GetCurrentThreadId () returned 0x970 [0056.104] GetCurrentThreadId () returned 0x970 [0056.104] GetCurrentThreadId () returned 0x970 [0056.104] GetCurrentThreadId () returned 0x970 [0056.104] GetCurrentThreadId () returned 0x970 [0056.104] GetCurrentThreadId () returned 0x970 [0056.104] GetCurrentThreadId () returned 0x970 [0056.104] GetCurrentThreadId () returned 0x970 [0056.104] GetCurrentThreadId () returned 0x970 [0056.104] GetCurrentThreadId () returned 0x970 [0056.104] GetCurrentThreadId () returned 0x970 [0056.104] GetCurrentThreadId () returned 0x970 [0056.104] GetCurrentThreadId () returned 0x970 [0056.104] GetCurrentThreadId () returned 0x970 [0056.104] GetCurrentThreadId () returned 0x970 [0056.104] GetCurrentThreadId () returned 0x970 [0056.104] GetCurrentThreadId () returned 0x970 [0056.104] GetCurrentThreadId () returned 0x970 [0056.104] GetCurrentThreadId () returned 0x970 [0056.104] GetCurrentThreadId () returned 0x970 [0056.104] GetCurrentThreadId () returned 0x970 [0056.104] GetCurrentThreadId () returned 0x970 [0056.104] GetCurrentThreadId () returned 0x970 [0056.104] GetCurrentThreadId () returned 0x970 [0056.104] GetCurrentThreadId () returned 0x970 [0056.104] GetCurrentThreadId () returned 0x970 [0056.104] GetCurrentThreadId () returned 0x970 [0056.104] GetCurrentThreadId () returned 0x970 [0056.104] GetCurrentThreadId () returned 0x970 [0056.104] GetCurrentThreadId () returned 0x970 [0056.104] GetCurrentThreadId () returned 0x970 [0056.105] GetCurrentThreadId () returned 0x970 [0056.105] GetCurrentThreadId () returned 0x970 [0056.105] GetCurrentThreadId () returned 0x970 [0056.105] GetCurrentThreadId () returned 0x970 [0056.105] GetCurrentThreadId () returned 0x970 [0056.105] GetCurrentThreadId () returned 0x970 [0056.105] GetCurrentThreadId () returned 0x970 [0056.105] GetCurrentThreadId () returned 0x970 [0056.105] GetCurrentThreadId () returned 0x970 [0056.105] GetCurrentThreadId () returned 0x970 [0056.105] GetCurrentThreadId () returned 0x970 [0056.105] GetCurrentThreadId () returned 0x970 [0056.105] GetCurrentThreadId () returned 0x970 [0056.105] GetCurrentThreadId () returned 0x970 [0056.105] GetCurrentThreadId () returned 0x970 [0056.105] GetCurrentThreadId () returned 0x970 [0056.105] GetCurrentThreadId () returned 0x970 [0056.105] GetCurrentThreadId () returned 0x970 [0056.105] GetCurrentThreadId () returned 0x970 [0056.105] GetCurrentThreadId () returned 0x970 [0056.105] GetCurrentThreadId () returned 0x970 [0056.105] GetCurrentThreadId () returned 0x970 [0056.105] GetCurrentThreadId () returned 0x970 [0056.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAHH/3+N9iGA7hAXCJNcY0kCRhpQg6bYieNj5jpKDeH+lpO8XaCjRObSrDTTDUe2iul3lBVASF0xj0a+PSMLji4RYciGga6j3jT7WlUSz+i/aeY1Xa9CegQqivj2jTdu5ACKXeBwwyOJ2aGSXeMORads3QSpDtXR2Kid8UFJZprCSBUKGTS0iiLLZehFmzr5wn12SFKiu8l6UNN1p3SdJwU5auNziooYyfw==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0056.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAHH/3+N9iGA7hAXCJNcY0kCRhpQg6bYieNj5jpKDeH+lpO8XaCjRObSrDTTDUe2iul3lBVASF0xj0a+PSMLji4RYciGga6j3jT7WlUSz+i/aeY1Xa9CegQqivj2jTdu5ACKXeBwwyOJ2aGSXeMORads3QSpDtXR2Kid8UFJZprCSBUKGTS0iiLLZehFmzr5wn12SFKiu8l6UNN1p3SdJwU5auNziooYyfw==", cchWideChar=245, lpMultiByteStr=0x353933c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAHH/3+N9iGA7hAXCJNcY0kCRhpQg6bYieNj5jpKDeH+lpO8XaCjRObSrDTTDUe2iul3lBVASF0xj0a+PSMLji4RYciGga6j3jT7WlUSz+i/aeY1Xa9CegQqivj2jTdu5ACKXeBwwyOJ2aGSXeMORads3QSpDtXR2Kid8UFJZprCSBUKGTS0iiLLZehFmzr5wn12SFKiu8l6UNN1p3SdJwU5auNziooYyfw==", lpUsedDefaultChar=0x0) returned 245 [0056.105] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0056.105] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0056.105] CloseHandle (hObject=0x158) returned 1 [0056.106] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml")) returned 1 [0056.107] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=17637010122) returned 1 [0056.107] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\Файл зашифрован [InfoPathMUI.XML].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\Файл зашифрован [infopathmui.xml].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0056.114] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0056.114] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0056.114] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0056.114] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0056.114] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0056.114] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0056.114] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0056.114] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0056.114] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0056.114] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0056.114] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0056.114] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0056.114] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0056.114] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0056.114] SetEndOfFile (hFile=0x158) returned 1 [0056.115] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0056.115] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0056.115] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0056.115] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0056.115] WriteFile (in: hFile=0x158, lpBuffer=0x361ff08*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x361ff08*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0056.116] WriteFile (in: hFile=0x158, lpBuffer=0x35eff9c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35eff9c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0056.116] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="8N+EPCSxnFScYW8R$", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0056.985] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{ryEG$\"~\"NAS&H%>N+EPCSxnFScYW8R$", cchWideChar=32, lpMultiByteStr=0x20341c4, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{ryEG$\"~\"NAS&H%>N+EPCSxnFScYW8R$", lpUsedDefaultChar=0x0) returned 32 [0056.985] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0056.985] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0056.985] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5bc88d0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0x295098 [0056.985] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0056.985] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0056.985] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml")) returned 0x20 [0056.985] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml")) returned 0x20 [0056.985] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml")) returned 0x20 [0056.985] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml")) returned 0x20 [0056.985] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5bc88d0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750)) returned 1 [0056.985] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0056.985] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0056.985] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml")) returned 0x20 [0056.985] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml")) returned 0x20 [0056.986] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0056.986] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0056.986] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0056.986] SetEndOfFile (hFile=0x158) returned 1 [0056.987] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0056.987] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x1fe358c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SETUP.XML", lpUsedDefaultChar=0x0) returned 9 [0056.987] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0056.987] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x1fe354c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SETUP.XML", lpUsedDefaultChar=0x0) returned 9 [0056.987] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe354c, cbMultiByte=9, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="SETUP.XMLI.XMLXMLi\x01") returned 9 [0056.987] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0056.987] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x1fe358c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SETUP.XML", lpUsedDefaultChar=0x0) returned 9 [0056.987] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0056.987] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0056.987] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x750 [0056.987] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0056.987] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0056.987] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0056.987] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0056.987] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x1fe358c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SETUP.XML", lpUsedDefaultChar=0x0) returned 9 [0056.987] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0056.987] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x1fe354c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SETUP.XML", lpUsedDefaultChar=0x0) returned 9 [0056.987] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe354c, cbMultiByte=9, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="SETUP.XMLUP.XMLI.XMLXMLi\x01") returned 9 [0056.988] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0056.988] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x1fe358c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SETUP.XML", lpUsedDefaultChar=0x0) returned 9 [0056.988] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0056.988] CharToOemA (in: pSrc="SETUP.XML", pDst=0x1fe354c | out: pDst="SETUP.XML") returned 1 [0056.988] WriteFile (in: hFile=0x158, lpBuffer=0x1fe354c*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe354c*, lpNumberOfBytesWritten=0x18e048*=0x9, lpOverlapped=0x0) returned 1 [0056.989] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0056.989] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0056.989] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0056.989] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=17725230739) returned 1 [0056.989] ReadFile (in: hFile=0x11c, lpBuffer=0x378d0a0, nNumberOfBytesToRead=0x750, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x378d0a0*, lpNumberOfBytesRead=0x18dd7c*=0x750, lpOverlapped=0x0) returned 1 [0056.990] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0056.990] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=17725375541) returned 1 [0056.999] WriteFile (in: hFile=0x158, lpBuffer=0x1fea1f8*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fea1f8*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0056.999] ReadFile (in: hFile=0x11c, lpBuffer=0x378d0a0, nNumberOfBytesToRead=0x750, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x378d0a0*, lpNumberOfBytesRead=0x18de38*=0x750, lpOverlapped=0x0) returned 1 [0056.999] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x44 [0056.999] WriteFile (in: hFile=0x158, lpBuffer=0x378d860*, nNumberOfBytesToWrite=0x750, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x378d860*, lpNumberOfBytesWritten=0x18de10*=0x750, lpOverlapped=0x0) returned 1 [0056.999] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x794 [0056.999] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0056.999] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0056.999] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0057.000] SetFilePointer (in: hFile=0x158, lDistanceToMove=9, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x27 [0057.000] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x79e [0057.000] CloseHandle (hObject=0x11c) returned 1 [0057.000] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x79e [0057.000] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x79e [0057.000] SetFilePointer (in: hFile=0x158, lDistanceToMove=1950, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x79e [0057.000] SetFilePointer (in: hFile=0x158, lDistanceToMove=1950, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x79e [0057.000] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x79e [0057.000] SetFilePointer (in: hFile=0x158, lDistanceToMove=1950, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x79e [0057.000] SetEndOfFile (hFile=0x158) returned 1 [0057.000] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x79e [0057.000] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x79e [0057.000] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0057.000] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x1fe358c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SETUP.XML", lpUsedDefaultChar=0x0) returned 9 [0057.001] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0057.001] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x1fe394c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SETUP.XML", lpUsedDefaultChar=0x0) returned 9 [0057.001] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe394c, cbMultiByte=9, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="SETUP.XML") returned 9 [0057.001] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0057.001] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x1fe358c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SETUP.XML", lpUsedDefaultChar=0x0) returned 9 [0057.001] WriteFile (in: hFile=0x158, lpBuffer=0x3770b58*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3770b58*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0057.001] CharToOemA (in: pSrc="SETUP.XML", pDst=0x1fe394c | out: pDst="SETUP.XML") returned 1 [0057.001] WriteFile (in: hFile=0x158, lpBuffer=0x1fe394c*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe394c*, lpNumberOfBytesWritten=0x18efcc*=0x9, lpOverlapped=0x0) returned 1 [0057.001] WriteFile (in: hFile=0x158, lpBuffer=0x1fea110*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea110*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0057.001] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0057.001] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0057.001] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x7e0 [0057.001] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x7e0 [0057.001] WriteFile (in: hFile=0x158, lpBuffer=0x361ff08*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x361ff08*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0057.001] WriteFile (in: hFile=0x158, lpBuffer=0x35eff9c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35eff9c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0057.002] DeleteFileW (lpFileName="") returned 0 [0057.002] GetLastError () returned 0x3 [0057.002] GetFileAttributesW (lpFileName="") returned 0xffffffff [0057.002] SetLastError (dwErrCode=0x3) [0057.002] FlushFileBuffers (hFile=0x158) returned 1 [0057.004] GetCurrentThreadId () returned 0x970 [0057.004] GetCurrentThreadId () returned 0x970 [0057.004] GetCurrentThreadId () returned 0x970 [0057.004] GetCurrentThreadId () returned 0x970 [0057.004] GetCurrentThreadId () returned 0x970 [0057.004] GetCurrentThreadId () returned 0x970 [0057.004] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x897 [0057.004] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x897 [0057.004] SetFilePointer (in: hFile=0x158, lDistanceToMove=2199, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x897 [0057.004] CloseHandle (hObject=0x158) returned 1 [0057.005] GetCurrentThreadId () returned 0x970 [0057.005] GetCurrentThreadId () returned 0x970 [0057.005] GetCurrentThreadId () returned 0x970 [0057.005] GetCurrentThreadId () returned 0x970 [0057.005] GetCurrentThreadId () returned 0x970 [0057.005] GetCurrentThreadId () returned 0x970 [0057.006] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\Файл зашифрован [SETUP.XML].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\Файл зашифрован [setup.xml].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0057.006] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x897 [0057.006] SetFilePointer (in: hFile=0x158, lDistanceToMove=2071, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x817 [0057.006] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0057.006] GetFileType (hFile=0x158) returned 0x1 [0057.006] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x4, wMilliseconds=0x118)) [0057.006] GetCurrentThreadId () returned 0x970 [0057.006] GetCurrentThreadId () returned 0x970 [0057.006] GetCurrentThreadId () returned 0x970 [0057.006] GetCurrentThreadId () returned 0x970 [0057.006] GetCurrentThreadId () returned 0x970 [0057.006] GetCurrentThreadId () returned 0x970 [0057.006] GetCurrentThreadId () returned 0x970 [0057.006] GetCurrentThreadId () returned 0x970 [0057.006] GetCurrentThreadId () returned 0x970 [0057.006] GetCurrentThreadId () returned 0x970 [0057.006] GetCurrentThreadId () returned 0x970 [0057.006] GetCurrentThreadId () returned 0x970 [0057.006] GetCurrentThreadId () returned 0x970 [0057.006] GetCurrentThreadId () returned 0x970 [0057.006] GetCurrentThreadId () returned 0x970 [0057.006] GetCurrentThreadId () returned 0x970 [0057.006] GetCurrentThreadId () returned 0x970 [0057.006] GetCurrentThreadId () returned 0x970 [0057.006] GetCurrentThreadId () returned 0x970 [0057.006] GetCurrentThreadId () returned 0x970 [0057.006] GetCurrentThreadId () returned 0x970 [0057.006] GetCurrentThreadId () returned 0x970 [0057.006] GetCurrentThreadId () returned 0x970 [0057.006] GetCurrentThreadId () returned 0x970 [0057.006] GetCurrentThreadId () returned 0x970 [0057.006] GetCurrentThreadId () returned 0x970 [0057.006] GetCurrentThreadId () returned 0x970 [0057.006] GetCurrentThreadId () returned 0x970 [0057.007] GetCurrentThreadId () returned 0x970 [0057.007] GetCurrentThreadId () returned 0x970 [0057.007] GetCurrentThreadId () returned 0x970 [0057.007] GetCurrentThreadId () returned 0x970 [0057.007] GetCurrentThreadId () returned 0x970 [0057.007] GetCurrentThreadId () returned 0x970 [0057.007] GetCurrentThreadId () returned 0x970 [0057.007] GetCurrentThreadId () returned 0x970 [0057.007] GetCurrentThreadId () returned 0x970 [0057.007] GetCurrentThreadId () returned 0x970 [0057.007] GetCurrentThreadId () returned 0x970 [0057.007] GetCurrentThreadId () returned 0x970 [0057.007] GetCurrentThreadId () returned 0x970 [0057.007] GetCurrentThreadId () returned 0x970 [0057.007] GetCurrentThreadId () returned 0x970 [0057.007] GetCurrentThreadId () returned 0x970 [0057.007] GetCurrentThreadId () returned 0x970 [0057.007] GetCurrentThreadId () returned 0x970 [0057.007] GetCurrentThreadId () returned 0x970 [0057.007] GetCurrentThreadId () returned 0x970 [0057.007] GetCurrentThreadId () returned 0x970 [0057.007] GetCurrentThreadId () returned 0x970 [0057.007] GetCurrentThreadId () returned 0x970 [0057.007] GetCurrentThreadId () returned 0x970 [0057.007] GetCurrentThreadId () returned 0x970 [0057.007] GetCurrentThreadId () returned 0x970 [0057.007] GetCurrentThreadId () returned 0x970 [0057.007] GetCurrentThreadId () returned 0x970 [0057.007] GetCurrentThreadId () returned 0x970 [0057.007] GetCurrentThreadId () returned 0x970 [0057.007] GetCurrentThreadId () returned 0x970 [0057.007] GetCurrentThreadId () returned 0x970 [0057.007] GetCurrentThreadId () returned 0x970 [0057.007] GetCurrentThreadId () returned 0x970 [0057.007] GetCurrentThreadId () returned 0x970 [0057.007] GetCurrentThreadId () returned 0x970 [0057.007] GetCurrentThreadId () returned 0x970 [0057.007] GetCurrentThreadId () returned 0x970 [0057.007] GetCurrentThreadId () returned 0x970 [0057.007] GetCurrentThreadId () returned 0x970 [0057.007] GetCurrentThreadId () returned 0x970 [0057.007] GetCurrentThreadId () returned 0x970 [0057.007] GetCurrentThreadId () returned 0x970 [0057.007] GetCurrentThreadId () returned 0x970 [0057.007] GetCurrentThreadId () returned 0x970 [0057.007] GetCurrentThreadId () returned 0x970 [0057.007] GetCurrentThreadId () returned 0x970 [0057.007] GetCurrentThreadId () returned 0x970 [0057.008] GetCurrentThreadId () returned 0x970 [0057.008] GetCurrentThreadId () returned 0x970 [0057.008] GetCurrentThreadId () returned 0x970 [0057.008] GetCurrentThreadId () returned 0x970 [0057.008] GetCurrentThreadId () returned 0x970 [0057.008] GetCurrentThreadId () returned 0x970 [0057.008] GetCurrentThreadId () returned 0x970 [0057.008] GetCurrentThreadId () returned 0x970 [0057.008] GetCurrentThreadId () returned 0x970 [0057.008] GetCurrentThreadId () returned 0x970 [0057.008] GetCurrentThreadId () returned 0x970 [0057.008] GetCurrentThreadId () returned 0x970 [0057.008] GetCurrentThreadId () returned 0x970 [0057.008] GetCurrentThreadId () returned 0x970 [0057.008] GetCurrentThreadId () returned 0x970 [0057.008] GetCurrentThreadId () returned 0x970 [0057.008] GetCurrentThreadId () returned 0x970 [0057.008] GetCurrentThreadId () returned 0x970 [0057.008] GetCurrentThreadId () returned 0x970 [0057.008] GetCurrentThreadId () returned 0x970 [0057.008] GetCurrentThreadId () returned 0x970 [0057.008] GetCurrentThreadId () returned 0x970 [0057.008] GetCurrentThreadId () returned 0x970 [0057.008] GetCurrentThreadId () returned 0x970 [0057.008] GetCurrentThreadId () returned 0x970 [0057.008] GetCurrentThreadId () returned 0x970 [0057.008] GetCurrentThreadId () returned 0x970 [0057.008] GetCurrentThreadId () returned 0x970 [0057.008] GetCurrentThreadId () returned 0x970 [0057.008] GetCurrentThreadId () returned 0x970 [0057.008] GetCurrentThreadId () returned 0x970 [0057.008] GetCurrentThreadId () returned 0x970 [0057.008] GetCurrentThreadId () returned 0x970 [0057.008] GetCurrentThreadId () returned 0x970 [0057.008] GetCurrentThreadId () returned 0x970 [0057.008] GetCurrentThreadId () returned 0x970 [0057.008] GetCurrentThreadId () returned 0x970 [0057.008] GetCurrentThreadId () returned 0x970 [0057.008] GetCurrentThreadId () returned 0x970 [0057.008] GetCurrentThreadId () returned 0x970 [0057.008] GetCurrentThreadId () returned 0x970 [0057.008] GetCurrentThreadId () returned 0x970 [0057.008] GetCurrentThreadId () returned 0x970 [0057.008] GetCurrentThreadId () returned 0x970 [0057.008] GetCurrentThreadId () returned 0x970 [0057.008] GetCurrentThreadId () returned 0x970 [0057.008] GetCurrentThreadId () returned 0x970 [0057.008] GetCurrentThreadId () returned 0x970 [0057.008] GetCurrentThreadId () returned 0x970 [0057.009] GetCurrentThreadId () returned 0x970 [0057.009] GetCurrentThreadId () returned 0x970 [0057.009] GetCurrentThreadId () returned 0x970 [0057.009] GetCurrentThreadId () returned 0x970 [0057.009] GetCurrentThreadId () returned 0x970 [0057.009] GetCurrentThreadId () returned 0x970 [0057.009] GetCurrentThreadId () returned 0x970 [0057.009] GetCurrentThreadId () returned 0x970 [0057.009] GetCurrentThreadId () returned 0x970 [0057.009] GetCurrentThreadId () returned 0x970 [0057.009] GetCurrentThreadId () returned 0x970 [0057.009] GetCurrentThreadId () returned 0x970 [0057.009] GetCurrentThreadId () returned 0x970 [0057.009] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0057.009] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0057.009] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fedcb0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0057.009] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0057.009] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0057.009] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fedcb0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0057.009] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0057.009] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0057.009] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0057.009] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0057.009] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0057.009] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0057.009] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0057.009] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0057.009] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fedd10, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0057.009] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0057.009] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0057.009] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fedd10, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0057.009] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0057.009] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0057.009] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fedd10, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0057.009] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x4, wMilliseconds=0x118)) [0057.009] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="{ryEG$\"~\"NAS&H%>N+EPCSxnFScYW8R$", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0057.010] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="{ryEG$\"~\"NAS&H%>N+EPCSxnFScYW8R$", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0057.010] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="{ryEG$\"~\"NAS&H%>N+EPCSxnFScYW8R$", cchWideChar=32, lpMultiByteStr=0x2001b88, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{ryEG$\"~\"NAS&H%>N+EPCSxnFScYW8R$", lpUsedDefaultChar=0x0) returned 32 [0057.010] GetCurrentThreadId () returned 0x970 [0057.010] GetCurrentThreadId () returned 0x970 [0057.010] GetCurrentThreadId () returned 0x970 [0057.010] GetCurrentThreadId () returned 0x970 [0057.010] GetCurrentThreadId () returned 0x970 [0057.010] GetCurrentThreadId () returned 0x970 [0057.017] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0057.017] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0057.017] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x34f47a8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0057.017] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0057.017] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAEU/QvTxBm6nRtMtAbFtDPpjQqaMef2ppTM8y/asiSxswSuMsnpzo6rNmekfU2ygIbCWbKyPXPgDsh+g/DyAHxPXyT6LTs4qP5+zdB2yl0yr/jFCGjkSpoE7FVXab67kSpDp7U44GFX0PGhCH9/wR7fdb2e4ifyTPntSSOSAVGbvl/z7T/F/L+KD4IawO5OZ+Rmtjzhunbi40NWjt4PrnSV9zrQo7XUGZw==") returned 232 [0057.017] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x4, wMilliseconds=0x127)) [0057.017] GetCurrentThreadId () returned 0x970 [0057.017] GetCurrentThreadId () returned 0x970 [0057.017] GetCurrentThreadId () returned 0x970 [0057.017] GetCurrentThreadId () returned 0x970 [0057.017] GetCurrentThreadId () returned 0x970 [0057.017] GetCurrentThreadId () returned 0x970 [0057.017] GetCurrentThreadId () returned 0x970 [0057.017] GetCurrentThreadId () returned 0x970 [0057.018] GetCurrentThreadId () returned 0x970 [0057.018] GetCurrentThreadId () returned 0x970 [0057.018] GetCurrentThreadId () returned 0x970 [0057.018] GetCurrentThreadId () returned 0x970 [0057.018] GetCurrentThreadId () returned 0x970 [0057.018] GetCurrentThreadId () returned 0x970 [0057.018] GetCurrentThreadId () returned 0x970 [0057.018] GetCurrentThreadId () returned 0x970 [0057.018] GetCurrentThreadId () returned 0x970 [0057.018] GetCurrentThreadId () returned 0x970 [0057.018] GetCurrentThreadId () returned 0x970 [0057.018] GetCurrentThreadId () returned 0x970 [0057.018] GetCurrentThreadId () returned 0x970 [0057.018] GetCurrentThreadId () returned 0x970 [0057.018] GetCurrentThreadId () returned 0x970 [0057.018] GetCurrentThreadId () returned 0x970 [0057.018] GetCurrentThreadId () returned 0x970 [0057.018] GetCurrentThreadId () returned 0x970 [0057.018] GetCurrentThreadId () returned 0x970 [0057.018] GetCurrentThreadId () returned 0x970 [0057.018] GetCurrentThreadId () returned 0x970 [0057.018] GetCurrentThreadId () returned 0x970 [0057.018] GetCurrentThreadId () returned 0x970 [0057.018] GetCurrentThreadId () returned 0x970 [0057.018] GetCurrentThreadId () returned 0x970 [0057.018] GetCurrentThreadId () returned 0x970 [0057.018] GetCurrentThreadId () returned 0x970 [0057.018] GetCurrentThreadId () returned 0x970 [0057.018] GetCurrentThreadId () returned 0x970 [0057.018] GetCurrentThreadId () returned 0x970 [0057.018] GetCurrentThreadId () returned 0x970 [0057.018] GetCurrentThreadId () returned 0x970 [0057.018] GetCurrentThreadId () returned 0x970 [0057.018] GetCurrentThreadId () returned 0x970 [0057.018] GetCurrentThreadId () returned 0x970 [0057.018] GetCurrentThreadId () returned 0x970 [0057.018] GetCurrentThreadId () returned 0x970 [0057.018] GetCurrentThreadId () returned 0x970 [0057.018] GetCurrentThreadId () returned 0x970 [0057.018] GetCurrentThreadId () returned 0x970 [0057.018] GetCurrentThreadId () returned 0x970 [0057.018] GetCurrentThreadId () returned 0x970 [0057.018] GetCurrentThreadId () returned 0x970 [0057.018] GetCurrentThreadId () returned 0x970 [0057.018] GetCurrentThreadId () returned 0x970 [0057.018] GetCurrentThreadId () returned 0x970 [0057.018] GetCurrentThreadId () returned 0x970 [0057.019] GetCurrentThreadId () returned 0x970 [0057.019] GetCurrentThreadId () returned 0x970 [0057.019] GetCurrentThreadId () returned 0x970 [0057.019] GetCurrentThreadId () returned 0x970 [0057.019] GetCurrentThreadId () returned 0x970 [0057.019] GetCurrentThreadId () returned 0x970 [0057.019] GetCurrentThreadId () returned 0x970 [0057.019] GetCurrentThreadId () returned 0x970 [0057.019] GetCurrentThreadId () returned 0x970 [0057.019] GetCurrentThreadId () returned 0x970 [0057.019] GetCurrentThreadId () returned 0x970 [0057.019] GetCurrentThreadId () returned 0x970 [0057.019] GetCurrentThreadId () returned 0x970 [0057.019] GetCurrentThreadId () returned 0x970 [0057.019] GetCurrentThreadId () returned 0x970 [0057.019] GetCurrentThreadId () returned 0x970 [0057.019] GetCurrentThreadId () returned 0x970 [0057.019] GetCurrentThreadId () returned 0x970 [0057.019] GetCurrentThreadId () returned 0x970 [0057.019] GetCurrentThreadId () returned 0x970 [0057.019] GetCurrentThreadId () returned 0x970 [0057.019] GetCurrentThreadId () returned 0x970 [0057.019] GetCurrentThreadId () returned 0x970 [0057.019] GetCurrentThreadId () returned 0x970 [0057.019] GetCurrentThreadId () returned 0x970 [0057.019] GetCurrentThreadId () returned 0x970 [0057.019] GetCurrentThreadId () returned 0x970 [0057.019] GetCurrentThreadId () returned 0x970 [0057.019] GetCurrentThreadId () returned 0x970 [0057.019] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAEU/QvTxBm6nRtMtAbFtDPpjQqaMef2ppTM8y/asiSxswSuMsnpzo6rNmekfU2ygIbCWbKyPXPgDsh+g/DyAHxPXyT6LTs4qP5+zdB2yl0yr/jFCGjkSpoE7FVXab67kSpDp7U44GFX0PGhCH9/wR7fdb2e4ifyTPntSSOSAVGbvl/z7T/F/L+KD4IawO5OZ+Rmtjzhunbi40NWjt4PrnSV9zrQo7XUGZw==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0057.019] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAEU/QvTxBm6nRtMtAbFtDPpjQqaMef2ppTM8y/asiSxswSuMsnpzo6rNmekfU2ygIbCWbKyPXPgDsh+g/DyAHxPXyT6LTs4qP5+zdB2yl0yr/jFCGjkSpoE7FVXab67kSpDp7U44GFX0PGhCH9/wR7fdb2e4ifyTPntSSOSAVGbvl/z7T/F/L+KD4IawO5OZ+Rmtjzhunbi40NWjt4PrnSV9zrQo7XUGZw==", cchWideChar=245, lpMultiByteStr=0x353933c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAEU/QvTxBm6nRtMtAbFtDPpjQqaMef2ppTM8y/asiSxswSuMsnpzo6rNmekfU2ygIbCWbKyPXPgDsh+g/DyAHxPXyT6LTs4qP5+zdB2yl0yr/jFCGjkSpoE7FVXab67kSpDp7U44GFX0PGhCH9/wR7fdb2e4ifyTPntSSOSAVGbvl/z7T/F/L+KD4IawO5OZ+Rmtjzhunbi40NWjt4PrnSV9zrQo7XUGZw==", lpUsedDefaultChar=0x0) returned 245 [0057.019] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0057.019] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0057.019] CloseHandle (hObject=0x158) returned 1 [0057.020] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml")) returned 1 [0057.021] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=17728450855) returned 1 [0057.021] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Файл зашифрован [Proof.XML].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\Файл зашифрован [proof.xml].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0057.022] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0057.022] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0057.022] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0057.022] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0057.022] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0057.022] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0057.022] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0057.022] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0057.022] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0057.022] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0057.022] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0057.022] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0057.022] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0057.022] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0057.022] SetEndOfFile (hFile=0x158) returned 1 [0057.022] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0057.023] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0057.023] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0057.023] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0057.023] WriteFile (in: hFile=0x158, lpBuffer=0x361ff08*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x361ff08*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0057.024] WriteFile (in: hFile=0x158, lpBuffer=0x35f005c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f005c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0057.024] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="$bp})M70kem<\"\\H-+.oXyeTMFN\"D4G7\\", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0057.024] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="$bp})M70kem<\"\\H-+.oXyeTMFN\"D4G7\\", cchWideChar=32, lpMultiByteStr=0x2033eec, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="$bp})M70kem<\"\\H-+.oXyeTMFN\"D4G7\\", lpUsedDefaultChar=0x0) returned 32 [0057.024] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0057.024] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0057.024] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf01be3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 0x295098 [0057.024] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0057.024] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0057.024] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml")) returned 0x20 [0057.024] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml")) returned 0x20 [0057.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml")) returned 0x20 [0057.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml")) returned 0x20 [0057.025] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf01be3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543)) returned 1 [0057.025] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0057.025] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0057.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml")) returned 0x20 [0057.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml")) returned 0x20 [0057.025] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0057.025] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0057.025] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0057.025] SetEndOfFile (hFile=0x158) returned 1 [0057.026] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Proof.XML", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0057.026] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Proof.XML", cchWideChar=9, lpMultiByteStr=0x1fe43ec, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Proof.XML", lpUsedDefaultChar=0x0) returned 9 [0057.026] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Proof.XML", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0057.026] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Proof.XML", cchWideChar=9, lpMultiByteStr=0x1fe3a8c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Proof.XML", lpUsedDefaultChar=0x0) returned 9 [0057.026] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe3a8c, cbMultiByte=9, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="Proof.XMLI.XMLXMLi\x01") returned 9 [0057.026] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Proof.XML", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0057.026] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Proof.XML", cchWideChar=9, lpMultiByteStr=0x1fe43ec, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Proof.XML", lpUsedDefaultChar=0x0) returned 9 [0057.026] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0057.026] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0057.026] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x543 [0057.026] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0057.027] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0057.027] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0057.027] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Proof.XML", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0057.027] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Proof.XML", cchWideChar=9, lpMultiByteStr=0x1fe43ec, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Proof.XML", lpUsedDefaultChar=0x0) returned 9 [0057.027] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Proof.XML", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0057.027] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Proof.XML", cchWideChar=9, lpMultiByteStr=0x1fe3a8c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Proof.XML", lpUsedDefaultChar=0x0) returned 9 [0057.027] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe3a8c, cbMultiByte=9, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="Proof.XMLof.XMLI.XMLXMLi\x01") returned 9 [0057.027] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Proof.XML", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0057.027] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Proof.XML", cchWideChar=9, lpMultiByteStr=0x1fe43ec, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Proof.XML", lpUsedDefaultChar=0x0) returned 9 [0057.027] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0057.028] CharToOemA (in: pSrc="Proof.XML", pDst=0x1fe3a8c | out: pDst="Proof.XML") returned 1 [0057.028] WriteFile (in: hFile=0x158, lpBuffer=0x1fe3a8c*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe3a8c*, lpNumberOfBytesWritten=0x18e048*=0x9, lpOverlapped=0x0) returned 1 [0057.028] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0057.028] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0057.028] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0057.028] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=17729156553) returned 1 [0057.028] ReadFile (in: hFile=0x11c, lpBuffer=0x378d0a0, nNumberOfBytesToRead=0x543, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x378d0a0*, lpNumberOfBytesRead=0x18dd7c*=0x543, lpOverlapped=0x0) returned 1 [0057.030] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0057.030] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=17729300371) returned 1 [0057.038] WriteFile (in: hFile=0x158, lpBuffer=0x1fea258*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fea258*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0057.038] ReadFile (in: hFile=0x11c, lpBuffer=0x378d0a0, nNumberOfBytesToRead=0x543, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x378d0a0*, lpNumberOfBytesRead=0x18de38*=0x543, lpOverlapped=0x0) returned 1 [0057.038] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x44 [0057.038] WriteFile (in: hFile=0x158, lpBuffer=0x378d600*, nNumberOfBytesToWrite=0x543, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x378d600*, lpNumberOfBytesWritten=0x18de10*=0x543, lpOverlapped=0x0) returned 1 [0057.039] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x587 [0057.039] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0057.039] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0057.039] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0057.039] SetFilePointer (in: hFile=0x158, lDistanceToMove=9, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x27 [0057.039] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x591 [0057.039] CloseHandle (hObject=0x11c) returned 1 [0057.039] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x591 [0057.039] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x591 [0057.039] SetFilePointer (in: hFile=0x158, lDistanceToMove=1425, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x591 [0057.039] SetFilePointer (in: hFile=0x158, lDistanceToMove=1425, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x591 [0057.039] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x591 [0057.039] SetFilePointer (in: hFile=0x158, lDistanceToMove=1425, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x591 [0057.039] SetEndOfFile (hFile=0x158) returned 1 [0057.039] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x591 [0057.040] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x591 [0057.040] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Proof.XML", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0057.040] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Proof.XML", cchWideChar=9, lpMultiByteStr=0x1fe43ec, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Proof.XML", lpUsedDefaultChar=0x0) returned 9 [0057.040] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Proof.XML", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0057.040] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Proof.XML", cchWideChar=9, lpMultiByteStr=0x1fe430c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Proof.XML", lpUsedDefaultChar=0x0) returned 9 [0057.040] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe430c, cbMultiByte=9, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="Proof.XML") returned 9 [0057.040] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Proof.XML", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0057.040] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Proof.XML", cchWideChar=9, lpMultiByteStr=0x1fe43ec, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Proof.XML", lpUsedDefaultChar=0x0) returned 9 [0057.040] WriteFile (in: hFile=0x158, lpBuffer=0x3770b58*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3770b58*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0057.040] CharToOemA (in: pSrc="Proof.XML", pDst=0x1fe430c | out: pDst="Proof.XML") returned 1 [0057.040] WriteFile (in: hFile=0x158, lpBuffer=0x1fe430c*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe430c*, lpNumberOfBytesWritten=0x18efcc*=0x9, lpOverlapped=0x0) returned 1 [0057.040] WriteFile (in: hFile=0x158, lpBuffer=0x1fea2d8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea2d8*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0057.040] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0057.040] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0057.040] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x5d3 [0057.040] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x5d3 [0057.040] WriteFile (in: hFile=0x158, lpBuffer=0x361ff08*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x361ff08*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0057.041] WriteFile (in: hFile=0x158, lpBuffer=0x35f005c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f005c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0057.041] DeleteFileW (lpFileName="") returned 0 [0057.041] GetLastError () returned 0x3 [0057.041] GetFileAttributesW (lpFileName="") returned 0xffffffff [0057.041] SetLastError (dwErrCode=0x3) [0057.041] FlushFileBuffers (hFile=0x158) returned 1 [0057.043] GetCurrentThreadId () returned 0x970 [0057.043] GetCurrentThreadId () returned 0x970 [0057.043] GetCurrentThreadId () returned 0x970 [0057.043] GetCurrentThreadId () returned 0x970 [0057.043] GetCurrentThreadId () returned 0x970 [0057.043] GetCurrentThreadId () returned 0x970 [0057.043] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x68a [0057.044] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x68a [0057.044] SetFilePointer (in: hFile=0x158, lDistanceToMove=1674, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x68a [0057.044] CloseHandle (hObject=0x158) returned 1 [0057.044] GetCurrentThreadId () returned 0x970 [0057.044] GetCurrentThreadId () returned 0x970 [0057.045] GetCurrentThreadId () returned 0x970 [0057.045] GetCurrentThreadId () returned 0x970 [0057.045] GetCurrentThreadId () returned 0x970 [0057.045] GetCurrentThreadId () returned 0x970 [0057.045] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Файл зашифрован [Proof.XML].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\Файл зашифрован [proof.xml].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0057.045] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x68a [0057.045] SetFilePointer (in: hFile=0x158, lDistanceToMove=1546, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x60a [0057.045] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0057.045] GetFileType (hFile=0x158) returned 0x1 [0057.045] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x4, wMilliseconds=0x137)) [0057.045] GetCurrentThreadId () returned 0x970 [0057.045] GetCurrentThreadId () returned 0x970 [0057.045] GetCurrentThreadId () returned 0x970 [0057.045] GetCurrentThreadId () returned 0x970 [0057.045] GetCurrentThreadId () returned 0x970 [0057.045] GetCurrentThreadId () returned 0x970 [0057.045] GetCurrentThreadId () returned 0x970 [0057.045] GetCurrentThreadId () returned 0x970 [0057.045] GetCurrentThreadId () returned 0x970 [0057.045] GetCurrentThreadId () returned 0x970 [0057.045] GetCurrentThreadId () returned 0x970 [0057.045] GetCurrentThreadId () returned 0x970 [0057.045] GetCurrentThreadId () returned 0x970 [0057.045] GetCurrentThreadId () returned 0x970 [0057.045] GetCurrentThreadId () returned 0x970 [0057.045] GetCurrentThreadId () returned 0x970 [0057.045] GetCurrentThreadId () returned 0x970 [0057.045] GetCurrentThreadId () returned 0x970 [0057.045] GetCurrentThreadId () returned 0x970 [0057.045] GetCurrentThreadId () returned 0x970 [0057.045] GetCurrentThreadId () returned 0x970 [0057.045] GetCurrentThreadId () returned 0x970 [0057.045] GetCurrentThreadId () returned 0x970 [0057.046] GetCurrentThreadId () returned 0x970 [0057.046] GetCurrentThreadId () returned 0x970 [0057.046] GetCurrentThreadId () returned 0x970 [0057.046] GetCurrentThreadId () returned 0x970 [0057.046] GetCurrentThreadId () returned 0x970 [0057.046] GetCurrentThreadId () returned 0x970 [0057.046] GetCurrentThreadId () returned 0x970 [0057.046] GetCurrentThreadId () returned 0x970 [0057.046] GetCurrentThreadId () returned 0x970 [0057.046] GetCurrentThreadId () returned 0x970 [0057.046] GetCurrentThreadId () returned 0x970 [0057.046] GetCurrentThreadId () returned 0x970 [0057.046] GetCurrentThreadId () returned 0x970 [0057.046] GetCurrentThreadId () returned 0x970 [0057.046] GetCurrentThreadId () returned 0x970 [0057.046] GetCurrentThreadId () returned 0x970 [0057.046] GetCurrentThreadId () returned 0x970 [0057.046] GetCurrentThreadId () returned 0x970 [0057.046] GetCurrentThreadId () returned 0x970 [0057.046] GetCurrentThreadId () returned 0x970 [0057.046] GetCurrentThreadId () returned 0x970 [0057.046] GetCurrentThreadId () returned 0x970 [0057.046] GetCurrentThreadId () returned 0x970 [0057.046] GetCurrentThreadId () returned 0x970 [0057.046] GetCurrentThreadId () returned 0x970 [0057.046] GetCurrentThreadId () returned 0x970 [0057.046] GetCurrentThreadId () returned 0x970 [0057.046] GetCurrentThreadId () returned 0x970 [0057.046] GetCurrentThreadId () returned 0x970 [0057.046] GetCurrentThreadId () returned 0x970 [0057.046] GetCurrentThreadId () returned 0x970 [0057.046] GetCurrentThreadId () returned 0x970 [0057.046] GetCurrentThreadId () returned 0x970 [0057.046] GetCurrentThreadId () returned 0x970 [0057.046] GetCurrentThreadId () returned 0x970 [0057.046] GetCurrentThreadId () returned 0x970 [0057.046] GetCurrentThreadId () returned 0x970 [0057.046] GetCurrentThreadId () returned 0x970 [0057.046] GetCurrentThreadId () returned 0x970 [0057.046] GetCurrentThreadId () returned 0x970 [0057.046] GetCurrentThreadId () returned 0x970 [0057.046] GetCurrentThreadId () returned 0x970 [0057.046] GetCurrentThreadId () returned 0x970 [0057.046] GetCurrentThreadId () returned 0x970 [0057.046] GetCurrentThreadId () returned 0x970 [0057.046] GetCurrentThreadId () returned 0x970 [0057.047] GetCurrentThreadId () returned 0x970 [0057.047] GetCurrentThreadId () returned 0x970 [0057.047] GetCurrentThreadId () returned 0x970 [0057.047] GetCurrentThreadId () returned 0x970 [0057.047] GetCurrentThreadId () returned 0x970 [0057.047] GetCurrentThreadId () returned 0x970 [0057.047] GetCurrentThreadId () returned 0x970 [0057.047] GetCurrentThreadId () returned 0x970 [0057.047] GetCurrentThreadId () returned 0x970 [0057.047] GetCurrentThreadId () returned 0x970 [0057.047] GetCurrentThreadId () returned 0x970 [0057.047] GetCurrentThreadId () returned 0x970 [0057.047] GetCurrentThreadId () returned 0x970 [0057.047] GetCurrentThreadId () returned 0x970 [0057.047] GetCurrentThreadId () returned 0x970 [0057.047] GetCurrentThreadId () returned 0x970 [0057.047] GetCurrentThreadId () returned 0x970 [0057.047] GetCurrentThreadId () returned 0x970 [0057.047] GetCurrentThreadId () returned 0x970 [0057.047] GetCurrentThreadId () returned 0x970 [0057.047] GetCurrentThreadId () returned 0x970 [0057.047] GetCurrentThreadId () returned 0x970 [0057.047] GetCurrentThreadId () returned 0x970 [0057.047] GetCurrentThreadId () returned 0x970 [0057.047] GetCurrentThreadId () returned 0x970 [0057.047] GetCurrentThreadId () returned 0x970 [0057.047] GetCurrentThreadId () returned 0x970 [0057.047] GetCurrentThreadId () returned 0x970 [0057.047] GetCurrentThreadId () returned 0x970 [0057.047] GetCurrentThreadId () returned 0x970 [0057.047] GetCurrentThreadId () returned 0x970 [0057.047] GetCurrentThreadId () returned 0x970 [0057.047] GetCurrentThreadId () returned 0x970 [0057.047] GetCurrentThreadId () returned 0x970 [0057.047] GetCurrentThreadId () returned 0x970 [0057.047] GetCurrentThreadId () returned 0x970 [0057.047] GetCurrentThreadId () returned 0x970 [0057.047] GetCurrentThreadId () returned 0x970 [0057.047] GetCurrentThreadId () returned 0x970 [0057.047] GetCurrentThreadId () returned 0x970 [0057.047] GetCurrentThreadId () returned 0x970 [0057.047] GetCurrentThreadId () returned 0x970 [0057.047] GetCurrentThreadId () returned 0x970 [0057.047] GetCurrentThreadId () returned 0x970 [0057.047] GetCurrentThreadId () returned 0x970 [0057.047] GetCurrentThreadId () returned 0x970 [0057.048] GetCurrentThreadId () returned 0x970 [0057.048] GetCurrentThreadId () returned 0x970 [0057.048] GetCurrentThreadId () returned 0x970 [0057.048] GetCurrentThreadId () returned 0x970 [0057.048] GetCurrentThreadId () returned 0x970 [0057.048] GetCurrentThreadId () returned 0x970 [0057.048] GetCurrentThreadId () returned 0x970 [0057.048] GetCurrentThreadId () returned 0x970 [0057.048] GetCurrentThreadId () returned 0x970 [0057.048] GetCurrentThreadId () returned 0x970 [0057.048] GetCurrentThreadId () returned 0x970 [0057.048] GetCurrentThreadId () returned 0x970 [0057.048] GetCurrentThreadId () returned 0x970 [0057.048] GetCurrentThreadId () returned 0x970 [0057.048] GetCurrentThreadId () returned 0x970 [0057.048] GetCurrentThreadId () returned 0x970 [0057.048] GetCurrentThreadId () returned 0x970 [0057.048] GetCurrentThreadId () returned 0x970 [0057.048] GetCurrentThreadId () returned 0x970 [0057.048] GetCurrentThreadId () returned 0x970 [0057.048] GetCurrentThreadId () returned 0x970 [0057.048] GetCurrentThreadId () returned 0x970 [0057.048] GetCurrentThreadId () returned 0x970 [0057.048] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0057.048] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0057.048] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fedd10, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0057.048] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0057.048] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0057.048] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fedd10, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0057.048] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0057.048] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0057.048] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0057.048] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0057.048] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0057.048] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0057.048] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0057.048] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0057.048] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fedd70, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0057.048] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0057.049] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0057.049] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fedd70, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0057.049] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0057.049] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0057.049] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fedd70, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0057.049] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x4, wMilliseconds=0x146)) [0057.049] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="$bp})M70kem<\"\\H-+.oXyeTMFN\"D4G7\\", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0057.049] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="$bp})M70kem<\"\\H-+.oXyeTMFN\"D4G7\\", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0057.049] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="$bp})M70kem<\"\\H-+.oXyeTMFN\"D4G7\\", cchWideChar=32, lpMultiByteStr=0x2001c78, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="$bp})M70kem<\"\\H-+.oXyeTMFN\"D4G7\\", lpUsedDefaultChar=0x0) returned 32 [0057.049] GetCurrentThreadId () returned 0x970 [0057.049] GetCurrentThreadId () returned 0x970 [0057.049] GetCurrentThreadId () returned 0x970 [0057.049] GetCurrentThreadId () returned 0x970 [0057.049] GetCurrentThreadId () returned 0x970 [0057.049] GetCurrentThreadId () returned 0x970 [0057.056] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0057.056] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0057.056] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x34f4898, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0057.056] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0057.056] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAHPbrirOnRY2L4vCRItjrcx3bdhA3hd9yjkf0qUtkBveX1vBLG1DzmTumWXZR4bHv9AI5IND9whL4NG/pHN6QsToOaQHl4jT51sZTJYu/bS6YU33S88RkXUwU/PfgYw73QCOKW38t3xKYxBqrGgFdN493OPngH8P2INU7IoJCIgAuzyD9k9/cV+/671k6t4tg781LpEO6MgeHqmWTPywd3vNW6KBN3idwQ==") returned 232 [0057.056] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x4, wMilliseconds=0x146)) [0057.056] GetCurrentThreadId () returned 0x970 [0057.056] GetCurrentThreadId () returned 0x970 [0057.056] GetCurrentThreadId () returned 0x970 [0057.056] GetCurrentThreadId () returned 0x970 [0057.056] GetCurrentThreadId () returned 0x970 [0057.056] GetCurrentThreadId () returned 0x970 [0057.057] GetCurrentThreadId () returned 0x970 [0057.057] GetCurrentThreadId () returned 0x970 [0057.057] GetCurrentThreadId () returned 0x970 [0057.057] GetCurrentThreadId () returned 0x970 [0057.057] GetCurrentThreadId () returned 0x970 [0057.057] GetCurrentThreadId () returned 0x970 [0057.057] GetCurrentThreadId () returned 0x970 [0057.057] GetCurrentThreadId () returned 0x970 [0057.057] GetCurrentThreadId () returned 0x970 [0057.057] GetCurrentThreadId () returned 0x970 [0057.057] GetCurrentThreadId () returned 0x970 [0057.057] GetCurrentThreadId () returned 0x970 [0057.057] GetCurrentThreadId () returned 0x970 [0057.057] GetCurrentThreadId () returned 0x970 [0057.057] GetCurrentThreadId () returned 0x970 [0057.057] GetCurrentThreadId () returned 0x970 [0057.057] GetCurrentThreadId () returned 0x970 [0057.057] GetCurrentThreadId () returned 0x970 [0057.057] GetCurrentThreadId () returned 0x970 [0057.057] GetCurrentThreadId () returned 0x970 [0057.057] GetCurrentThreadId () returned 0x970 [0057.057] GetCurrentThreadId () returned 0x970 [0057.057] GetCurrentThreadId () returned 0x970 [0057.057] GetCurrentThreadId () returned 0x970 [0057.057] GetCurrentThreadId () returned 0x970 [0057.057] GetCurrentThreadId () returned 0x970 [0057.057] GetCurrentThreadId () returned 0x970 [0057.057] GetCurrentThreadId () returned 0x970 [0057.057] GetCurrentThreadId () returned 0x970 [0057.057] GetCurrentThreadId () returned 0x970 [0057.057] GetCurrentThreadId () returned 0x970 [0057.057] GetCurrentThreadId () returned 0x970 [0057.057] GetCurrentThreadId () returned 0x970 [0057.057] GetCurrentThreadId () returned 0x970 [0057.057] GetCurrentThreadId () returned 0x970 [0057.057] GetCurrentThreadId () returned 0x970 [0057.057] GetCurrentThreadId () returned 0x970 [0057.057] GetCurrentThreadId () returned 0x970 [0057.057] GetCurrentThreadId () returned 0x970 [0057.057] GetCurrentThreadId () returned 0x970 [0057.057] GetCurrentThreadId () returned 0x970 [0057.057] GetCurrentThreadId () returned 0x970 [0057.057] GetCurrentThreadId () returned 0x970 [0057.057] GetCurrentThreadId () returned 0x970 [0057.057] GetCurrentThreadId () returned 0x970 [0057.057] GetCurrentThreadId () returned 0x970 [0057.057] GetCurrentThreadId () returned 0x970 [0057.057] GetCurrentThreadId () returned 0x970 [0057.058] GetCurrentThreadId () returned 0x970 [0057.058] GetCurrentThreadId () returned 0x970 [0057.058] GetCurrentThreadId () returned 0x970 [0057.058] GetCurrentThreadId () returned 0x970 [0057.058] GetCurrentThreadId () returned 0x970 [0057.058] GetCurrentThreadId () returned 0x970 [0057.058] GetCurrentThreadId () returned 0x970 [0057.058] GetCurrentThreadId () returned 0x970 [0057.058] GetCurrentThreadId () returned 0x970 [0057.058] GetCurrentThreadId () returned 0x970 [0057.058] GetCurrentThreadId () returned 0x970 [0057.058] GetCurrentThreadId () returned 0x970 [0057.058] GetCurrentThreadId () returned 0x970 [0057.058] GetCurrentThreadId () returned 0x970 [0057.058] GetCurrentThreadId () returned 0x970 [0057.058] GetCurrentThreadId () returned 0x970 [0057.058] GetCurrentThreadId () returned 0x970 [0057.058] GetCurrentThreadId () returned 0x970 [0057.058] GetCurrentThreadId () returned 0x970 [0057.058] GetCurrentThreadId () returned 0x970 [0057.058] GetCurrentThreadId () returned 0x970 [0057.058] GetCurrentThreadId () returned 0x970 [0057.058] GetCurrentThreadId () returned 0x970 [0057.058] GetCurrentThreadId () returned 0x970 [0057.058] GetCurrentThreadId () returned 0x970 [0057.058] GetCurrentThreadId () returned 0x970 [0057.058] GetCurrentThreadId () returned 0x970 [0057.058] GetCurrentThreadId () returned 0x970 [0057.058] GetCurrentThreadId () returned 0x970 [0057.058] GetCurrentThreadId () returned 0x970 [0057.058] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAHPbrirOnRY2L4vCRItjrcx3bdhA3hd9yjkf0qUtkBveX1vBLG1DzmTumWXZR4bHv9AI5IND9whL4NG/pHN6QsToOaQHl4jT51sZTJYu/bS6YU33S88RkXUwU/PfgYw73QCOKW38t3xKYxBqrGgFdN493OPngH8P2INU7IoJCIgAuzyD9k9/cV+/671k6t4tg781LpEO6MgeHqmWTPywd3vNW6KBN3idwQ==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0057.058] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAHPbrirOnRY2L4vCRItjrcx3bdhA3hd9yjkf0qUtkBveX1vBLG1DzmTumWXZR4bHv9AI5IND9whL4NG/pHN6QsToOaQHl4jT51sZTJYu/bS6YU33S88RkXUwU/PfgYw73QCOKW38t3xKYxBqrGgFdN493OPngH8P2INU7IoJCIgAuzyD9k9/cV+/671k6t4tg781LpEO6MgeHqmWTPywd3vNW6KBN3idwQ==", cchWideChar=245, lpMultiByteStr=0x353933c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAHPbrirOnRY2L4vCRItjrcx3bdhA3hd9yjkf0qUtkBveX1vBLG1DzmTumWXZR4bHv9AI5IND9whL4NG/pHN6QsToOaQHl4jT51sZTJYu/bS6YU33S88RkXUwU/PfgYw73QCOKW38t3xKYxBqrGgFdN493OPngH8P2INU7IoJCIgAuzyD9k9/cV+/671k6t4tg781LpEO6MgeHqmWTPywd3vNW6KBN3idwQ==", lpUsedDefaultChar=0x0) returned 245 [0057.058] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0057.058] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0057.058] CloseHandle (hObject=0x158) returned 1 [0057.059] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml")) returned 1 [0057.060] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=17732345300) returned 1 [0057.060] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Файл зашифрован [Proof.XML].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\Файл зашифрован [proof.xml].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0057.060] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0057.061] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0057.061] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0057.061] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0057.061] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0057.061] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0057.061] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0057.061] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0057.061] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0057.061] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0057.061] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0057.061] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0057.061] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0057.061] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0057.061] SetEndOfFile (hFile=0x158) returned 1 [0057.061] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0057.061] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0057.061] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0057.062] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0057.062] WriteFile (in: hFile=0x158, lpBuffer=0x361ff08*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x361ff08*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0057.062] WriteFile (in: hFile=0x158, lpBuffer=0x35eff9c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35eff9c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0057.063] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CHI}D\"=FK", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0059.167] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="=.SJ6<@6GShS):Dft$Mp\"(~A8VQu*va>", cchWideChar=32, lpMultiByteStr=0x2034a14, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="=.SJ6<@6GShS):Dft$Mp\"(~A8VQu*va>", lpUsedDefaultChar=0x0) returned 32 [0059.167] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0059.167] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0059.167] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x8864, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0x295098 [0059.167] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0059.167] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0059.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png")) returned 0x20 [0059.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png")) returned 0x20 [0059.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png")) returned 0x20 [0059.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png")) returned 0x20 [0059.167] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x8864)) returned 1 [0059.167] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0059.167] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0059.168] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png")) returned 0x20 [0059.168] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png")) returned 0x20 [0059.168] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0059.168] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0059.168] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0059.168] SetEndOfFile (hFile=0x158) returned 1 [0059.169] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0059.169] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe370c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0059.169] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0059.169] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe3a2c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0059.169] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe3a2c, cbMultiByte=12, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="THMBNAIL.PNGer.gifg") returned 12 [0059.169] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0059.169] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe370c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0059.169] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0059.169] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0059.169] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x8864 [0059.169] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0059.169] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0059.169] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0059.169] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0059.169] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe370c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0059.170] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0059.170] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe3a2c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0059.170] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe3a2c, cbMultiByte=12, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="THMBNAIL.PNGIL.PNGer.gifg") returned 12 [0059.170] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0059.170] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe370c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0059.170] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0059.171] CharToOemA (in: pSrc="THMBNAIL.PNG", pDst=0x1fe3a2c | out: pDst="THMBNAIL.PNG") returned 1 [0059.171] WriteFile (in: hFile=0x158, lpBuffer=0x1fe3a2c*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe3a2c*, lpNumberOfBytesWritten=0x18e048*=0xc, lpOverlapped=0x0) returned 1 [0059.171] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0059.171] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0059.171] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0059.171] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=17943439949) returned 1 [0059.171] ReadFile (in: hFile=0x11c, lpBuffer=0x37a9c40, nNumberOfBytesToRead=0x8864, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37a9c40*, lpNumberOfBytesRead=0x18dd7c*=0x8864, lpOverlapped=0x0) returned 1 [0059.173] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0059.173] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=17943638372) returned 1 [0059.181] WriteFile (in: hFile=0x158, lpBuffer=0x1fea2a0*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fea2a0*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0059.182] ReadFile (in: hFile=0x11c, lpBuffer=0x37a9c40, nNumberOfBytesToRead=0x8864, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x37a9c40*, lpNumberOfBytesRead=0x18de38*=0x8864, lpOverlapped=0x0) returned 1 [0059.183] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x47 [0059.183] WriteFile (in: hFile=0x158, lpBuffer=0x37f3d60*, nNumberOfBytesToWrite=0x8864, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x37f3d60*, lpNumberOfBytesWritten=0x18de10*=0x8864, lpOverlapped=0x0) returned 1 [0059.183] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x88ab [0059.183] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0059.184] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0059.184] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0059.184] SetFilePointer (in: hFile=0x158, lDistanceToMove=12, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2a [0059.184] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x88b5 [0059.184] CloseHandle (hObject=0x11c) returned 1 [0059.184] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x88b5 [0059.184] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x88b5 [0059.184] SetFilePointer (in: hFile=0x158, lDistanceToMove=34997, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x88b5 [0059.184] SetFilePointer (in: hFile=0x158, lDistanceToMove=34997, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x88b5 [0059.184] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x88b5 [0059.184] SetFilePointer (in: hFile=0x158, lDistanceToMove=34997, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x88b5 [0059.184] SetEndOfFile (hFile=0x158) returned 1 [0059.187] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x88b5 [0059.187] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x88b5 [0059.188] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0059.188] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe370c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0059.188] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0059.188] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe37ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0059.188] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe37ec, cbMultiByte=12, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="THMBNAIL.PNGꞗ@涤(\x18믉`믑`") returned 12 [0059.188] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0059.188] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe370c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0059.188] WriteFile (in: hFile=0x158, lpBuffer=0x378d718*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x378d718*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0059.188] CharToOemA (in: pSrc="THMBNAIL.PNG", pDst=0x1fe37ec | out: pDst="THMBNAIL.PNG") returned 1 [0059.188] WriteFile (in: hFile=0x158, lpBuffer=0x1fe37ec*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe37ec*, lpNumberOfBytesWritten=0x18efcc*=0xc, lpOverlapped=0x0) returned 1 [0059.188] WriteFile (in: hFile=0x158, lpBuffer=0x1fea110*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea110*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0059.188] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0059.188] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0059.188] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x88fa [0059.188] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x88fa [0059.188] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0059.189] WriteFile (in: hFile=0x158, lpBuffer=0x35f01dc*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f01dc*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0059.189] DeleteFileW (lpFileName="") returned 0 [0059.189] GetLastError () returned 0x3 [0059.189] GetFileAttributesW (lpFileName="") returned 0xffffffff [0059.189] SetLastError (dwErrCode=0x3) [0059.189] FlushFileBuffers (hFile=0x158) returned 1 [0059.192] GetCurrentThreadId () returned 0x970 [0059.192] GetCurrentThreadId () returned 0x970 [0059.192] GetCurrentThreadId () returned 0x970 [0059.192] GetCurrentThreadId () returned 0x970 [0059.192] GetCurrentThreadId () returned 0x970 [0059.192] GetCurrentThreadId () returned 0x970 [0059.192] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x89b1 [0059.192] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x89b1 [0059.192] SetFilePointer (in: hFile=0x158, lDistanceToMove=35249, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x89b1 [0059.192] CloseHandle (hObject=0x158) returned 1 [0059.193] GetCurrentThreadId () returned 0x970 [0059.193] GetCurrentThreadId () returned 0x970 [0059.193] GetCurrentThreadId () returned 0x970 [0059.193] GetCurrentThreadId () returned 0x970 [0059.193] GetCurrentThreadId () returned 0x970 [0059.193] GetCurrentThreadId () returned 0x970 [0059.193] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\Файл зашифрован [THMBNAIL.PNG].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\Файл зашифрован [thmbnail.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0059.194] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x89b1 [0059.194] SetFilePointer (in: hFile=0x158, lDistanceToMove=35121, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8931 [0059.194] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0059.194] GetFileType (hFile=0x158) returned 0x1 [0059.194] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x6, wMilliseconds=0x1d0)) [0059.194] GetCurrentThreadId () returned 0x970 [0059.194] GetCurrentThreadId () returned 0x970 [0059.194] GetCurrentThreadId () returned 0x970 [0059.194] GetCurrentThreadId () returned 0x970 [0059.194] GetCurrentThreadId () returned 0x970 [0059.194] GetCurrentThreadId () returned 0x970 [0059.194] GetCurrentThreadId () returned 0x970 [0059.194] GetCurrentThreadId () returned 0x970 [0059.194] GetCurrentThreadId () returned 0x970 [0059.194] GetCurrentThreadId () returned 0x970 [0059.194] GetCurrentThreadId () returned 0x970 [0059.194] GetCurrentThreadId () returned 0x970 [0059.194] GetCurrentThreadId () returned 0x970 [0059.194] GetCurrentThreadId () returned 0x970 [0059.194] GetCurrentThreadId () returned 0x970 [0059.194] GetCurrentThreadId () returned 0x970 [0059.194] GetCurrentThreadId () returned 0x970 [0059.194] GetCurrentThreadId () returned 0x970 [0059.194] GetCurrentThreadId () returned 0x970 [0059.194] GetCurrentThreadId () returned 0x970 [0059.194] GetCurrentThreadId () returned 0x970 [0059.194] GetCurrentThreadId () returned 0x970 [0059.194] GetCurrentThreadId () returned 0x970 [0059.194] GetCurrentThreadId () returned 0x970 [0059.194] GetCurrentThreadId () returned 0x970 [0059.194] GetCurrentThreadId () returned 0x970 [0059.194] GetCurrentThreadId () returned 0x970 [0059.194] GetCurrentThreadId () returned 0x970 [0059.194] GetCurrentThreadId () returned 0x970 [0059.194] GetCurrentThreadId () returned 0x970 [0059.194] GetCurrentThreadId () returned 0x970 [0059.194] GetCurrentThreadId () returned 0x970 [0059.195] GetCurrentThreadId () returned 0x970 [0059.195] GetCurrentThreadId () returned 0x970 [0059.195] GetCurrentThreadId () returned 0x970 [0059.195] GetCurrentThreadId () returned 0x970 [0059.195] GetCurrentThreadId () returned 0x970 [0059.195] GetCurrentThreadId () returned 0x970 [0059.195] GetCurrentThreadId () returned 0x970 [0059.195] GetCurrentThreadId () returned 0x970 [0059.195] GetCurrentThreadId () returned 0x970 [0059.195] GetCurrentThreadId () returned 0x970 [0059.195] GetCurrentThreadId () returned 0x970 [0059.195] GetCurrentThreadId () returned 0x970 [0059.195] GetCurrentThreadId () returned 0x970 [0059.195] GetCurrentThreadId () returned 0x970 [0059.195] GetCurrentThreadId () returned 0x970 [0059.195] GetCurrentThreadId () returned 0x970 [0059.195] GetCurrentThreadId () returned 0x970 [0059.195] GetCurrentThreadId () returned 0x970 [0059.195] GetCurrentThreadId () returned 0x970 [0059.195] GetCurrentThreadId () returned 0x970 [0059.195] GetCurrentThreadId () returned 0x970 [0059.195] GetCurrentThreadId () returned 0x970 [0059.195] GetCurrentThreadId () returned 0x970 [0059.195] GetCurrentThreadId () returned 0x970 [0059.195] GetCurrentThreadId () returned 0x970 [0059.195] GetCurrentThreadId () returned 0x970 [0059.195] GetCurrentThreadId () returned 0x970 [0059.195] GetCurrentThreadId () returned 0x970 [0059.195] GetCurrentThreadId () returned 0x970 [0059.195] GetCurrentThreadId () returned 0x970 [0059.195] GetCurrentThreadId () returned 0x970 [0059.195] GetCurrentThreadId () returned 0x970 [0059.195] GetCurrentThreadId () returned 0x970 [0059.195] GetCurrentThreadId () returned 0x970 [0059.195] GetCurrentThreadId () returned 0x970 [0059.195] GetCurrentThreadId () returned 0x970 [0059.195] GetCurrentThreadId () returned 0x970 [0059.195] GetCurrentThreadId () returned 0x970 [0059.195] GetCurrentThreadId () returned 0x970 [0059.195] GetCurrentThreadId () returned 0x970 [0059.195] GetCurrentThreadId () returned 0x970 [0059.195] GetCurrentThreadId () returned 0x970 [0059.195] GetCurrentThreadId () returned 0x970 [0059.195] GetCurrentThreadId () returned 0x970 [0059.195] GetCurrentThreadId () returned 0x970 [0059.195] GetCurrentThreadId () returned 0x970 [0059.195] GetCurrentThreadId () returned 0x970 [0059.195] GetCurrentThreadId () returned 0x970 [0059.196] GetCurrentThreadId () returned 0x970 [0059.196] GetCurrentThreadId () returned 0x970 [0059.196] GetCurrentThreadId () returned 0x970 [0059.196] GetCurrentThreadId () returned 0x970 [0059.196] GetCurrentThreadId () returned 0x970 [0059.196] GetCurrentThreadId () returned 0x970 [0059.196] GetCurrentThreadId () returned 0x970 [0059.196] GetCurrentThreadId () returned 0x970 [0059.196] GetCurrentThreadId () returned 0x970 [0059.196] GetCurrentThreadId () returned 0x970 [0059.196] GetCurrentThreadId () returned 0x970 [0059.196] GetCurrentThreadId () returned 0x970 [0059.196] GetCurrentThreadId () returned 0x970 [0059.196] GetCurrentThreadId () returned 0x970 [0059.196] GetCurrentThreadId () returned 0x970 [0059.196] GetCurrentThreadId () returned 0x970 [0059.196] GetCurrentThreadId () returned 0x970 [0059.196] GetCurrentThreadId () returned 0x970 [0059.196] GetCurrentThreadId () returned 0x970 [0059.196] GetCurrentThreadId () returned 0x970 [0059.196] GetCurrentThreadId () returned 0x970 [0059.196] GetCurrentThreadId () returned 0x970 [0059.196] GetCurrentThreadId () returned 0x970 [0059.196] GetCurrentThreadId () returned 0x970 [0059.196] GetCurrentThreadId () returned 0x970 [0059.196] GetCurrentThreadId () returned 0x970 [0059.196] GetCurrentThreadId () returned 0x970 [0059.196] GetCurrentThreadId () returned 0x970 [0059.196] GetCurrentThreadId () returned 0x970 [0059.196] GetCurrentThreadId () returned 0x970 [0059.196] GetCurrentThreadId () returned 0x970 [0059.196] GetCurrentThreadId () returned 0x970 [0059.196] GetCurrentThreadId () returned 0x970 [0059.196] GetCurrentThreadId () returned 0x970 [0059.196] GetCurrentThreadId () returned 0x970 [0059.196] GetCurrentThreadId () returned 0x970 [0059.196] GetCurrentThreadId () returned 0x970 [0059.196] GetCurrentThreadId () returned 0x970 [0059.196] GetCurrentThreadId () returned 0x970 [0059.196] GetCurrentThreadId () returned 0x970 [0059.196] GetCurrentThreadId () returned 0x970 [0059.196] GetCurrentThreadId () returned 0x970 [0059.196] GetCurrentThreadId () returned 0x970 [0059.196] GetCurrentThreadId () returned 0x970 [0059.196] GetCurrentThreadId () returned 0x970 [0059.196] GetCurrentThreadId () returned 0x970 [0059.196] GetCurrentThreadId () returned 0x970 [0059.196] GetCurrentThreadId () returned 0x970 [0059.197] GetCurrentThreadId () returned 0x970 [0059.197] GetCurrentThreadId () returned 0x970 [0059.197] GetCurrentThreadId () returned 0x970 [0059.197] GetCurrentThreadId () returned 0x970 [0059.197] GetCurrentThreadId () returned 0x970 [0059.197] GetCurrentThreadId () returned 0x970 [0059.197] GetCurrentThreadId () returned 0x970 [0059.197] GetCurrentThreadId () returned 0x970 [0059.197] GetCurrentThreadId () returned 0x970 [0059.197] GetCurrentThreadId () returned 0x970 [0059.197] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.197] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.197] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feefd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0059.197] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.197] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.197] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1feefd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0059.197] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.197] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.197] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0059.197] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.197] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.197] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0059.197] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.197] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.197] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fef030, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0059.197] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.197] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.197] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fef030, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0059.197] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.197] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.197] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fef030, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0059.197] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x6, wMilliseconds=0x1d0)) [0059.197] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="=.SJ6<@6GShS):Dft$Mp\"(~A8VQu*va>", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0059.197] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="=.SJ6<@6GShS):Dft$Mp\"(~A8VQu*va>", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0059.197] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="=.SJ6<@6GShS):Dft$Mp\"(~A8VQu*va>", cchWideChar=32, lpMultiByteStr=0x2002638, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="=.SJ6<@6GShS):Dft$Mp\"(~A8VQu*va>", lpUsedDefaultChar=0x0) returned 32 [0059.198] GetCurrentThreadId () returned 0x970 [0059.198] GetCurrentThreadId () returned 0x970 [0059.198] GetCurrentThreadId () returned 0x970 [0059.198] GetCurrentThreadId () returned 0x970 [0059.198] GetCurrentThreadId () returned 0x970 [0059.198] GetCurrentThreadId () returned 0x970 [0059.205] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0059.205] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0059.205] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x34f7778, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0059.205] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0059.205] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAEnm1JDH440cBeEPXIA+puFn5OMQORr14iVJXpiugvZF14RZzBd+mZmJsEIjt4c5AI/Ak4QhXSeUD15ElK+ACiQG+Cd7EqTl3pgVwcTToXzjikUkjVZnN78pd9qgdxlAYjKSyDElWuMTqHDqu8Du5uPuOydqRaaj6bE6HtjKIXHcA0xBpy7RRVICwm1Z5w9Bcjp3LTGCPyypZeasZ9vLwkUnc28Bsp8/5w==") returned 232 [0059.205] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x6, wMilliseconds=0x1df)) [0059.205] GetCurrentThreadId () returned 0x970 [0059.205] GetCurrentThreadId () returned 0x970 [0059.205] GetCurrentThreadId () returned 0x970 [0059.205] GetCurrentThreadId () returned 0x970 [0059.205] GetCurrentThreadId () returned 0x970 [0059.205] GetCurrentThreadId () returned 0x970 [0059.205] GetCurrentThreadId () returned 0x970 [0059.205] GetCurrentThreadId () returned 0x970 [0059.205] GetCurrentThreadId () returned 0x970 [0059.205] GetCurrentThreadId () returned 0x970 [0059.205] GetCurrentThreadId () returned 0x970 [0059.205] GetCurrentThreadId () returned 0x970 [0059.205] GetCurrentThreadId () returned 0x970 [0059.205] GetCurrentThreadId () returned 0x970 [0059.205] GetCurrentThreadId () returned 0x970 [0059.206] GetCurrentThreadId () returned 0x970 [0059.206] GetCurrentThreadId () returned 0x970 [0059.206] GetCurrentThreadId () returned 0x970 [0059.206] GetCurrentThreadId () returned 0x970 [0059.206] GetCurrentThreadId () returned 0x970 [0059.206] GetCurrentThreadId () returned 0x970 [0059.206] GetCurrentThreadId () returned 0x970 [0059.206] GetCurrentThreadId () returned 0x970 [0059.206] GetCurrentThreadId () returned 0x970 [0059.206] GetCurrentThreadId () returned 0x970 [0059.206] GetCurrentThreadId () returned 0x970 [0059.206] GetCurrentThreadId () returned 0x970 [0059.206] GetCurrentThreadId () returned 0x970 [0059.206] GetCurrentThreadId () returned 0x970 [0059.206] GetCurrentThreadId () returned 0x970 [0059.206] GetCurrentThreadId () returned 0x970 [0059.206] GetCurrentThreadId () returned 0x970 [0059.206] GetCurrentThreadId () returned 0x970 [0059.206] GetCurrentThreadId () returned 0x970 [0059.206] GetCurrentThreadId () returned 0x970 [0059.206] GetCurrentThreadId () returned 0x970 [0059.206] GetCurrentThreadId () returned 0x970 [0059.206] GetCurrentThreadId () returned 0x970 [0059.206] GetCurrentThreadId () returned 0x970 [0059.206] GetCurrentThreadId () returned 0x970 [0059.206] GetCurrentThreadId () returned 0x970 [0059.206] GetCurrentThreadId () returned 0x970 [0059.206] GetCurrentThreadId () returned 0x970 [0059.206] GetCurrentThreadId () returned 0x970 [0059.206] GetCurrentThreadId () returned 0x970 [0059.206] GetCurrentThreadId () returned 0x970 [0059.206] GetCurrentThreadId () returned 0x970 [0059.206] GetCurrentThreadId () returned 0x970 [0059.206] GetCurrentThreadId () returned 0x970 [0059.206] GetCurrentThreadId () returned 0x970 [0059.206] GetCurrentThreadId () returned 0x970 [0059.206] GetCurrentThreadId () returned 0x970 [0059.206] GetCurrentThreadId () returned 0x970 [0059.206] GetCurrentThreadId () returned 0x970 [0059.206] GetCurrentThreadId () returned 0x970 [0059.206] GetCurrentThreadId () returned 0x970 [0059.206] GetCurrentThreadId () returned 0x970 [0059.206] GetCurrentThreadId () returned 0x970 [0059.206] GetCurrentThreadId () returned 0x970 [0059.206] GetCurrentThreadId () returned 0x970 [0059.206] GetCurrentThreadId () returned 0x970 [0059.206] GetCurrentThreadId () returned 0x970 [0059.207] GetCurrentThreadId () returned 0x970 [0059.207] GetCurrentThreadId () returned 0x970 [0059.207] GetCurrentThreadId () returned 0x970 [0059.207] GetCurrentThreadId () returned 0x970 [0059.207] GetCurrentThreadId () returned 0x970 [0059.207] GetCurrentThreadId () returned 0x970 [0059.207] GetCurrentThreadId () returned 0x970 [0059.207] GetCurrentThreadId () returned 0x970 [0059.207] GetCurrentThreadId () returned 0x970 [0059.207] GetCurrentThreadId () returned 0x970 [0059.207] GetCurrentThreadId () returned 0x970 [0059.207] GetCurrentThreadId () returned 0x970 [0059.207] GetCurrentThreadId () returned 0x970 [0059.207] GetCurrentThreadId () returned 0x970 [0059.207] GetCurrentThreadId () returned 0x970 [0059.207] GetCurrentThreadId () returned 0x970 [0059.207] GetCurrentThreadId () returned 0x970 [0059.207] GetCurrentThreadId () returned 0x970 [0059.207] GetCurrentThreadId () returned 0x970 [0059.207] GetCurrentThreadId () returned 0x970 [0059.207] GetCurrentThreadId () returned 0x970 [0059.207] GetCurrentThreadId () returned 0x970 [0059.207] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAEnm1JDH440cBeEPXIA+puFn5OMQORr14iVJXpiugvZF14RZzBd+mZmJsEIjt4c5AI/Ak4QhXSeUD15ElK+ACiQG+Cd7EqTl3pgVwcTToXzjikUkjVZnN78pd9qgdxlAYjKSyDElWuMTqHDqu8Du5uPuOydqRaaj6bE6HtjKIXHcA0xBpy7RRVICwm1Z5w9Bcjp3LTGCPyypZeasZ9vLwkUnc28Bsp8/5w==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0059.207] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAEnm1JDH440cBeEPXIA+puFn5OMQORr14iVJXpiugvZF14RZzBd+mZmJsEIjt4c5AI/Ak4QhXSeUD15ElK+ACiQG+Cd7EqTl3pgVwcTToXzjikUkjVZnN78pd9qgdxlAYjKSyDElWuMTqHDqu8Du5uPuOydqRaaj6bE6HtjKIXHcA0xBpy7RRVICwm1Z5w9Bcjp3LTGCPyypZeasZ9vLwkUnc28Bsp8/5w==", cchWideChar=245, lpMultiByteStr=0x353933c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAEnm1JDH440cBeEPXIA+puFn5OMQORr14iVJXpiugvZF14RZzBd+mZmJsEIjt4c5AI/Ak4QhXSeUD15ElK+ACiQG+Cd7EqTl3pgVwcTToXzjikUkjVZnN78pd9qgdxlAYjKSyDElWuMTqHDqu8Du5uPuOydqRaaj6bE6HtjKIXHcA0xBpy7RRVICwm1Z5w9Bcjp3LTGCPyypZeasZ9vLwkUnc28Bsp8/5w==", lpUsedDefaultChar=0x0) returned 245 [0059.207] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0059.207] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0059.207] CloseHandle (hObject=0x158) returned 1 [0059.208] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png")) returned 1 [0059.209] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=17947262571) returned 1 [0059.209] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\Файл зашифрован [PREVIEW.GIF].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\Файл зашифрован [preview.gif].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0059.211] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0059.211] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0059.211] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0059.211] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0059.211] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0059.211] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0059.211] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0059.211] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0059.211] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0059.211] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0059.211] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0059.211] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0059.212] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0059.212] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0059.212] SetEndOfFile (hFile=0x158) returned 1 [0059.212] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0059.212] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0059.212] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0059.212] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0059.212] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0059.213] WriteFile (in: hFile=0x158, lpBuffer=0x35f011c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f011c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0059.213] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="~5q8k334@=6&$Vv0:#\\+0tNqzT3TpiN)", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0059.213] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="~5q8k334@=6&$Vv0:#\\+0tNqzT3TpiN)", cchWideChar=32, lpMultiByteStr=0x2034cec, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="~5q8k334@=6&$Vv0:#\\+0tNqzT3TpiN)", lpUsedDefaultChar=0x0) returned 32 [0059.213] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0059.213] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0059.213] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6d2cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x885, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 0x295098 [0059.213] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0059.213] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0059.213] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif")) returned 0x20 [0059.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif")) returned 0x20 [0059.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif")) returned 0x20 [0059.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif")) returned 0x20 [0059.214] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6d2cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x885)) returned 1 [0059.214] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0059.214] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0059.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif")) returned 0x20 [0059.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif")) returned 0x20 [0059.214] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0059.214] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0059.214] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0059.214] SetEndOfFile (hFile=0x158) returned 1 [0059.215] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0059.215] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe35cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0059.215] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0059.215] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe35ec, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0059.215] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe35ec, cbMultiByte=11, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="PREVIEW.GIFGer.gifg") returned 11 [0059.215] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0059.215] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe35cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0059.215] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0059.215] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0059.215] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x885 [0059.216] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0059.216] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0059.216] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0059.216] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0059.216] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe35cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0059.216] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0059.216] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe35ec, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0059.216] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe35ec, cbMultiByte=11, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="PREVIEW.GIFEW.GIFGer.gifg") returned 11 [0059.216] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0059.216] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe35cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0059.216] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0059.217] CharToOemA (in: pSrc="PREVIEW.GIF", pDst=0x1fe35ec | out: pDst="PREVIEW.GIF") returned 1 [0059.217] WriteFile (in: hFile=0x158, lpBuffer=0x1fe35ec*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe35ec*, lpNumberOfBytesWritten=0x18e048*=0xb, lpOverlapped=0x0) returned 1 [0059.217] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0059.217] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0059.217] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0059.217] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=17948064927) returned 1 [0059.217] ReadFile (in: hFile=0x11c, lpBuffer=0x37a9c60, nNumberOfBytesToRead=0x885, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37a9c60*, lpNumberOfBytesRead=0x18dd7c*=0x885, lpOverlapped=0x0) returned 1 [0059.330] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0059.330] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=17959385321) returned 1 [0059.339] WriteFile (in: hFile=0x158, lpBuffer=0x1fea288*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fea288*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0059.339] ReadFile (in: hFile=0x11c, lpBuffer=0x37a9c60, nNumberOfBytesToRead=0x885, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x37a9c60*, lpNumberOfBytesRead=0x18de38*=0x885, lpOverlapped=0x0) returned 1 [0059.339] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x46 [0059.339] WriteFile (in: hFile=0x158, lpBuffer=0x37aa5b0*, nNumberOfBytesToWrite=0x885, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x37aa5b0*, lpNumberOfBytesWritten=0x18de10*=0x885, lpOverlapped=0x0) returned 1 [0059.339] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x8cb [0059.339] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0059.340] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0059.340] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0059.340] SetFilePointer (in: hFile=0x158, lDistanceToMove=11, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x29 [0059.340] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x8d5 [0059.340] CloseHandle (hObject=0x11c) returned 1 [0059.340] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x8d5 [0059.340] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x8d5 [0059.340] SetFilePointer (in: hFile=0x158, lDistanceToMove=2261, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x8d5 [0059.340] SetFilePointer (in: hFile=0x158, lDistanceToMove=2261, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x8d5 [0059.340] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x8d5 [0059.340] SetFilePointer (in: hFile=0x158, lDistanceToMove=2261, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x8d5 [0059.340] SetEndOfFile (hFile=0x158) returned 1 [0059.340] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x8d5 [0059.341] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x8d5 [0059.341] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0059.341] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe35cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0059.341] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0059.341] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe41ac, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0059.341] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe41ac, cbMultiByte=11, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="PREVIEW.GIF\x18ꞗ@涤(\x18믉`믑`") returned 11 [0059.341] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0059.341] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe35cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0059.341] WriteFile (in: hFile=0x158, lpBuffer=0x378d718*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x378d718*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0059.341] CharToOemA (in: pSrc="PREVIEW.GIF", pDst=0x1fe41ac | out: pDst="PREVIEW.GIF") returned 1 [0059.341] WriteFile (in: hFile=0x158, lpBuffer=0x1fe41ac*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe41ac*, lpNumberOfBytesWritten=0x18efcc*=0xb, lpOverlapped=0x0) returned 1 [0059.341] WriteFile (in: hFile=0x158, lpBuffer=0x1fea2d8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea2d8*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0059.341] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0059.341] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0059.341] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x919 [0059.341] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x919 [0059.341] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0059.342] WriteFile (in: hFile=0x158, lpBuffer=0x35f011c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f011c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0059.342] DeleteFileW (lpFileName="") returned 0 [0059.342] GetLastError () returned 0x3 [0059.342] GetFileAttributesW (lpFileName="") returned 0xffffffff [0059.342] SetLastError (dwErrCode=0x3) [0059.342] FlushFileBuffers (hFile=0x158) returned 1 [0059.344] GetCurrentThreadId () returned 0x970 [0059.344] GetCurrentThreadId () returned 0x970 [0059.344] GetCurrentThreadId () returned 0x970 [0059.344] GetCurrentThreadId () returned 0x970 [0059.344] GetCurrentThreadId () returned 0x970 [0059.344] GetCurrentThreadId () returned 0x970 [0059.344] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x9d0 [0059.344] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x9d0 [0059.344] SetFilePointer (in: hFile=0x158, lDistanceToMove=2512, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x9d0 [0059.345] CloseHandle (hObject=0x158) returned 1 [0059.345] GetCurrentThreadId () returned 0x970 [0059.346] GetCurrentThreadId () returned 0x970 [0059.346] GetCurrentThreadId () returned 0x970 [0059.346] GetCurrentThreadId () returned 0x970 [0059.346] GetCurrentThreadId () returned 0x970 [0059.346] GetCurrentThreadId () returned 0x970 [0059.346] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\Файл зашифрован [PREVIEW.GIF].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\Файл зашифрован [preview.gif].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0059.346] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9d0 [0059.346] SetFilePointer (in: hFile=0x158, lDistanceToMove=2384, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x950 [0059.346] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0059.346] GetFileType (hFile=0x158) returned 0x1 [0059.346] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x6, wMilliseconds=0x26c)) [0059.346] GetCurrentThreadId () returned 0x970 [0059.346] GetCurrentThreadId () returned 0x970 [0059.346] GetCurrentThreadId () returned 0x970 [0059.346] GetCurrentThreadId () returned 0x970 [0059.346] GetCurrentThreadId () returned 0x970 [0059.346] GetCurrentThreadId () returned 0x970 [0059.346] GetCurrentThreadId () returned 0x970 [0059.346] GetCurrentThreadId () returned 0x970 [0059.346] GetCurrentThreadId () returned 0x970 [0059.346] GetCurrentThreadId () returned 0x970 [0059.346] GetCurrentThreadId () returned 0x970 [0059.346] GetCurrentThreadId () returned 0x970 [0059.346] GetCurrentThreadId () returned 0x970 [0059.346] GetCurrentThreadId () returned 0x970 [0059.346] GetCurrentThreadId () returned 0x970 [0059.346] GetCurrentThreadId () returned 0x970 [0059.346] GetCurrentThreadId () returned 0x970 [0059.346] GetCurrentThreadId () returned 0x970 [0059.346] GetCurrentThreadId () returned 0x970 [0059.346] GetCurrentThreadId () returned 0x970 [0059.346] GetCurrentThreadId () returned 0x970 [0059.347] GetCurrentThreadId () returned 0x970 [0059.347] GetCurrentThreadId () returned 0x970 [0059.347] GetCurrentThreadId () returned 0x970 [0059.347] GetCurrentThreadId () returned 0x970 [0059.347] GetCurrentThreadId () returned 0x970 [0059.347] GetCurrentThreadId () returned 0x970 [0059.347] GetCurrentThreadId () returned 0x970 [0059.347] GetCurrentThreadId () returned 0x970 [0059.347] GetCurrentThreadId () returned 0x970 [0059.347] GetCurrentThreadId () returned 0x970 [0059.347] GetCurrentThreadId () returned 0x970 [0059.347] GetCurrentThreadId () returned 0x970 [0059.347] GetCurrentThreadId () returned 0x970 [0059.347] GetCurrentThreadId () returned 0x970 [0059.347] GetCurrentThreadId () returned 0x970 [0059.347] GetCurrentThreadId () returned 0x970 [0059.347] GetCurrentThreadId () returned 0x970 [0059.347] GetCurrentThreadId () returned 0x970 [0059.347] GetCurrentThreadId () returned 0x970 [0059.347] GetCurrentThreadId () returned 0x970 [0059.347] GetCurrentThreadId () returned 0x970 [0059.347] GetCurrentThreadId () returned 0x970 [0059.347] GetCurrentThreadId () returned 0x970 [0059.347] GetCurrentThreadId () returned 0x970 [0059.347] GetCurrentThreadId () returned 0x970 [0059.347] GetCurrentThreadId () returned 0x970 [0059.347] GetCurrentThreadId () returned 0x970 [0059.347] GetCurrentThreadId () returned 0x970 [0059.347] GetCurrentThreadId () returned 0x970 [0059.347] GetCurrentThreadId () returned 0x970 [0059.347] GetCurrentThreadId () returned 0x970 [0059.347] GetCurrentThreadId () returned 0x970 [0059.347] GetCurrentThreadId () returned 0x970 [0059.347] GetCurrentThreadId () returned 0x970 [0059.347] GetCurrentThreadId () returned 0x970 [0059.347] GetCurrentThreadId () returned 0x970 [0059.347] GetCurrentThreadId () returned 0x970 [0059.347] GetCurrentThreadId () returned 0x970 [0059.347] GetCurrentThreadId () returned 0x970 [0059.347] GetCurrentThreadId () returned 0x970 [0059.347] GetCurrentThreadId () returned 0x970 [0059.347] GetCurrentThreadId () returned 0x970 [0059.347] GetCurrentThreadId () returned 0x970 [0059.347] GetCurrentThreadId () returned 0x970 [0059.347] GetCurrentThreadId () returned 0x970 [0059.347] GetCurrentThreadId () returned 0x970 [0059.347] GetCurrentThreadId () returned 0x970 [0059.348] GetCurrentThreadId () returned 0x970 [0059.348] GetCurrentThreadId () returned 0x970 [0059.348] GetCurrentThreadId () returned 0x970 [0059.348] GetCurrentThreadId () returned 0x970 [0059.348] GetCurrentThreadId () returned 0x970 [0059.348] GetCurrentThreadId () returned 0x970 [0059.348] GetCurrentThreadId () returned 0x970 [0059.348] GetCurrentThreadId () returned 0x970 [0059.348] GetCurrentThreadId () returned 0x970 [0059.348] GetCurrentThreadId () returned 0x970 [0059.348] GetCurrentThreadId () returned 0x970 [0059.348] GetCurrentThreadId () returned 0x970 [0059.348] GetCurrentThreadId () returned 0x970 [0059.348] GetCurrentThreadId () returned 0x970 [0059.348] GetCurrentThreadId () returned 0x970 [0059.348] GetCurrentThreadId () returned 0x970 [0059.348] GetCurrentThreadId () returned 0x970 [0059.348] GetCurrentThreadId () returned 0x970 [0059.348] GetCurrentThreadId () returned 0x970 [0059.348] GetCurrentThreadId () returned 0x970 [0059.348] GetCurrentThreadId () returned 0x970 [0059.348] GetCurrentThreadId () returned 0x970 [0059.348] GetCurrentThreadId () returned 0x970 [0059.348] GetCurrentThreadId () returned 0x970 [0059.348] GetCurrentThreadId () returned 0x970 [0059.348] GetCurrentThreadId () returned 0x970 [0059.348] GetCurrentThreadId () returned 0x970 [0059.348] GetCurrentThreadId () returned 0x970 [0059.348] GetCurrentThreadId () returned 0x970 [0059.348] GetCurrentThreadId () returned 0x970 [0059.348] GetCurrentThreadId () returned 0x970 [0059.348] GetCurrentThreadId () returned 0x970 [0059.348] GetCurrentThreadId () returned 0x970 [0059.348] GetCurrentThreadId () returned 0x970 [0059.348] GetCurrentThreadId () returned 0x970 [0059.348] GetCurrentThreadId () returned 0x970 [0059.348] GetCurrentThreadId () returned 0x970 [0059.348] GetCurrentThreadId () returned 0x970 [0059.348] GetCurrentThreadId () returned 0x970 [0059.348] GetCurrentThreadId () returned 0x970 [0059.348] GetCurrentThreadId () returned 0x970 [0059.348] GetCurrentThreadId () returned 0x970 [0059.348] GetCurrentThreadId () returned 0x970 [0059.348] GetCurrentThreadId () returned 0x970 [0059.348] GetCurrentThreadId () returned 0x970 [0059.348] GetCurrentThreadId () returned 0x970 [0059.348] GetCurrentThreadId () returned 0x970 [0059.349] GetCurrentThreadId () returned 0x970 [0059.349] GetCurrentThreadId () returned 0x970 [0059.349] GetCurrentThreadId () returned 0x970 [0059.349] GetCurrentThreadId () returned 0x970 [0059.349] GetCurrentThreadId () returned 0x970 [0059.349] GetCurrentThreadId () returned 0x970 [0059.349] GetCurrentThreadId () returned 0x970 [0059.349] GetCurrentThreadId () returned 0x970 [0059.349] GetCurrentThreadId () returned 0x970 [0059.349] GetCurrentThreadId () returned 0x970 [0059.349] GetCurrentThreadId () returned 0x970 [0059.349] GetCurrentThreadId () returned 0x970 [0059.349] GetCurrentThreadId () returned 0x970 [0059.349] GetCurrentThreadId () returned 0x970 [0059.349] GetCurrentThreadId () returned 0x970 [0059.349] GetCurrentThreadId () returned 0x970 [0059.349] GetCurrentThreadId () returned 0x970 [0059.349] GetCurrentThreadId () returned 0x970 [0059.349] GetCurrentThreadId () returned 0x970 [0059.349] GetCurrentThreadId () returned 0x970 [0059.349] GetCurrentThreadId () returned 0x970 [0059.349] GetCurrentThreadId () returned 0x970 [0059.349] GetCurrentThreadId () returned 0x970 [0059.349] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.349] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.349] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fef030, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0059.349] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.349] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.349] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fef030, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0059.349] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.349] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.349] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0059.349] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.349] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.349] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0059.349] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.349] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.349] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fef090, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0059.349] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.350] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.350] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fef090, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0059.350] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.350] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.350] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fef090, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0059.350] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x6, wMilliseconds=0x26c)) [0059.350] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="~5q8k334@=6&$Vv0:#\\+0tNqzT3TpiN)", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0059.350] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="~5q8k334@=6&$Vv0:#\\+0tNqzT3TpiN)", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0059.350] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="~5q8k334@=6&$Vv0:#\\+0tNqzT3TpiN)", cchWideChar=32, lpMultiByteStr=0x20024e8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="~5q8k334@=6&$Vv0:#\\+0tNqzT3TpiN)", lpUsedDefaultChar=0x0) returned 32 [0059.350] GetCurrentThreadId () returned 0x970 [0059.350] GetCurrentThreadId () returned 0x970 [0059.350] GetCurrentThreadId () returned 0x970 [0059.350] GetCurrentThreadId () returned 0x970 [0059.350] GetCurrentThreadId () returned 0x970 [0059.350] GetCurrentThreadId () returned 0x970 [0059.359] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0059.359] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0059.359] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x34f7868, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0059.359] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0059.359] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAE/jywEbp/OxhnIsN/PDobq9c31Xv4dNTqGCdCoCOmFpjCdqwIEhk+dXSwjHQWtXSuHWqbgfcY5qKOF+L0VEw5XQruwRhfkCzSaouwFD6NARj9GjlBxu5TuEQka0r/zgsOe6eZhf+vd8jkNxdMZwE4BODIlZdHu5SVPkOImPS1Iu+UuyhhQ27D1mlUwEuqYx+e7uQZkM5In7MFG4oZ9GXybHblTp0olreA==") returned 232 [0059.359] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x6, wMilliseconds=0x27b)) [0059.359] GetCurrentThreadId () returned 0x970 [0059.359] GetCurrentThreadId () returned 0x970 [0059.359] GetCurrentThreadId () returned 0x970 [0059.359] GetCurrentThreadId () returned 0x970 [0059.359] GetCurrentThreadId () returned 0x970 [0059.359] GetCurrentThreadId () returned 0x970 [0059.359] GetCurrentThreadId () returned 0x970 [0059.359] GetCurrentThreadId () returned 0x970 [0059.359] GetCurrentThreadId () returned 0x970 [0059.359] GetCurrentThreadId () returned 0x970 [0059.359] GetCurrentThreadId () returned 0x970 [0059.359] GetCurrentThreadId () returned 0x970 [0059.359] GetCurrentThreadId () returned 0x970 [0059.359] GetCurrentThreadId () returned 0x970 [0059.359] GetCurrentThreadId () returned 0x970 [0059.359] GetCurrentThreadId () returned 0x970 [0059.359] GetCurrentThreadId () returned 0x970 [0059.359] GetCurrentThreadId () returned 0x970 [0059.359] GetCurrentThreadId () returned 0x970 [0059.359] GetCurrentThreadId () returned 0x970 [0059.359] GetCurrentThreadId () returned 0x970 [0059.359] GetCurrentThreadId () returned 0x970 [0059.359] GetCurrentThreadId () returned 0x970 [0059.359] GetCurrentThreadId () returned 0x970 [0059.359] GetCurrentThreadId () returned 0x970 [0059.359] GetCurrentThreadId () returned 0x970 [0059.359] GetCurrentThreadId () returned 0x970 [0059.359] GetCurrentThreadId () returned 0x970 [0059.359] GetCurrentThreadId () returned 0x970 [0059.359] GetCurrentThreadId () returned 0x970 [0059.359] GetCurrentThreadId () returned 0x970 [0059.359] GetCurrentThreadId () returned 0x970 [0059.359] GetCurrentThreadId () returned 0x970 [0059.359] GetCurrentThreadId () returned 0x970 [0059.360] GetCurrentThreadId () returned 0x970 [0059.360] GetCurrentThreadId () returned 0x970 [0059.360] GetCurrentThreadId () returned 0x970 [0059.360] GetCurrentThreadId () returned 0x970 [0059.360] GetCurrentThreadId () returned 0x970 [0059.360] GetCurrentThreadId () returned 0x970 [0059.360] GetCurrentThreadId () returned 0x970 [0059.360] GetCurrentThreadId () returned 0x970 [0059.360] GetCurrentThreadId () returned 0x970 [0059.360] GetCurrentThreadId () returned 0x970 [0059.360] GetCurrentThreadId () returned 0x970 [0059.360] GetCurrentThreadId () returned 0x970 [0059.360] GetCurrentThreadId () returned 0x970 [0059.360] GetCurrentThreadId () returned 0x970 [0059.360] GetCurrentThreadId () returned 0x970 [0059.360] GetCurrentThreadId () returned 0x970 [0059.360] GetCurrentThreadId () returned 0x970 [0059.360] GetCurrentThreadId () returned 0x970 [0059.360] GetCurrentThreadId () returned 0x970 [0059.360] GetCurrentThreadId () returned 0x970 [0059.360] GetCurrentThreadId () returned 0x970 [0059.360] GetCurrentThreadId () returned 0x970 [0059.360] GetCurrentThreadId () returned 0x970 [0059.360] GetCurrentThreadId () returned 0x970 [0059.360] GetCurrentThreadId () returned 0x970 [0059.360] GetCurrentThreadId () returned 0x970 [0059.360] GetCurrentThreadId () returned 0x970 [0059.360] GetCurrentThreadId () returned 0x970 [0059.360] GetCurrentThreadId () returned 0x970 [0059.360] GetCurrentThreadId () returned 0x970 [0059.360] GetCurrentThreadId () returned 0x970 [0059.360] GetCurrentThreadId () returned 0x970 [0059.360] GetCurrentThreadId () returned 0x970 [0059.360] GetCurrentThreadId () returned 0x970 [0059.360] GetCurrentThreadId () returned 0x970 [0059.360] GetCurrentThreadId () returned 0x970 [0059.360] GetCurrentThreadId () returned 0x970 [0059.360] GetCurrentThreadId () returned 0x970 [0059.360] GetCurrentThreadId () returned 0x970 [0059.360] GetCurrentThreadId () returned 0x970 [0059.360] GetCurrentThreadId () returned 0x970 [0059.360] GetCurrentThreadId () returned 0x970 [0059.360] GetCurrentThreadId () returned 0x970 [0059.360] GetCurrentThreadId () returned 0x970 [0059.360] GetCurrentThreadId () returned 0x970 [0059.360] GetCurrentThreadId () returned 0x970 [0059.360] GetCurrentThreadId () returned 0x970 [0059.361] GetCurrentThreadId () returned 0x970 [0059.361] GetCurrentThreadId () returned 0x970 [0059.361] GetCurrentThreadId () returned 0x970 [0059.361] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAE/jywEbp/OxhnIsN/PDobq9c31Xv4dNTqGCdCoCOmFpjCdqwIEhk+dXSwjHQWtXSuHWqbgfcY5qKOF+L0VEw5XQruwRhfkCzSaouwFD6NARj9GjlBxu5TuEQka0r/zgsOe6eZhf+vd8jkNxdMZwE4BODIlZdHu5SVPkOImPS1Iu+UuyhhQ27D1mlUwEuqYx+e7uQZkM5In7MFG4oZ9GXybHblTp0olreA==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0059.361] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAE/jywEbp/OxhnIsN/PDobq9c31Xv4dNTqGCdCoCOmFpjCdqwIEhk+dXSwjHQWtXSuHWqbgfcY5qKOF+L0VEw5XQruwRhfkCzSaouwFD6NARj9GjlBxu5TuEQka0r/zgsOe6eZhf+vd8jkNxdMZwE4BODIlZdHu5SVPkOImPS1Iu+UuyhhQ27D1mlUwEuqYx+e7uQZkM5In7MFG4oZ9GXybHblTp0olreA==", cchWideChar=245, lpMultiByteStr=0x353933c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAE/jywEbp/OxhnIsN/PDobq9c31Xv4dNTqGCdCoCOmFpjCdqwIEhk+dXSwjHQWtXSuHWqbgfcY5qKOF+L0VEw5XQruwRhfkCzSaouwFD6NARj9GjlBxu5TuEQka0r/zgsOe6eZhf+vd8jkNxdMZwE4BODIlZdHu5SVPkOImPS1Iu+UuyhhQ27D1mlUwEuqYx+e7uQZkM5In7MFG4oZ9GXybHblTp0olreA==", lpUsedDefaultChar=0x0) returned 245 [0059.361] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0059.361] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0059.361] CloseHandle (hObject=0x158) returned 1 [0059.362] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif")) returned 1 [0059.363] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=17962613795) returned 1 [0059.369] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\Файл зашифрован [THMBNAIL.PNG].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\Файл зашифрован [thmbnail.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0059.370] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0059.370] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0059.370] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0059.370] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0059.370] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0059.370] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0059.370] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0059.370] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0059.370] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0059.370] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0059.370] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0059.370] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0059.370] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0059.370] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0059.371] SetEndOfFile (hFile=0x158) returned 1 [0059.371] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0059.371] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0059.371] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0059.371] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0059.371] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0059.372] WriteFile (in: hFile=0x158, lpBuffer=0x35f01dc*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f01dc*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0059.372] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=")zfxNlbL76$++.m0<.$ONBXz(@7=*-Jw", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0059.372] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=")zfxNlbL76$++.m0<.$ONBXz(@7=*-Jw", cchWideChar=32, lpMultiByteStr=0x2034cb4, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=")zfxNlbL76$++.m0<.$ONBXz(@7=*-Jw", lpUsedDefaultChar=0x0) returned 32 [0059.372] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0059.372] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0059.372] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5093, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0x295098 [0059.372] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0059.372] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0059.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png")) returned 0x20 [0059.373] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png")) returned 0x20 [0059.373] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png")) returned 0x20 [0059.373] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png")) returned 0x20 [0059.373] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5093)) returned 1 [0059.373] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0059.373] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0059.373] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png")) returned 0x20 [0059.373] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png")) returned 0x20 [0059.373] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0059.373] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0059.373] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0059.373] SetEndOfFile (hFile=0x158) returned 1 [0059.374] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0059.374] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe36ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0059.374] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0059.374] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe37ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0059.374] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe37ac, cbMultiByte=12, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="THMBNAIL.PNGer.gifg") returned 12 [0059.374] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0059.374] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe36ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0059.374] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0059.375] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0059.375] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x5093 [0059.375] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0059.375] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0059.375] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0059.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0059.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe36ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0059.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0059.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe37ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0059.375] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe37ac, cbMultiByte=12, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="THMBNAIL.PNGIL.PNGer.gifg") returned 12 [0059.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0059.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe36ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0059.375] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0059.376] CharToOemA (in: pSrc="THMBNAIL.PNG", pDst=0x1fe37ac | out: pDst="THMBNAIL.PNG") returned 1 [0059.376] WriteFile (in: hFile=0x158, lpBuffer=0x1fe37ac*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe37ac*, lpNumberOfBytesWritten=0x18e048*=0xc, lpOverlapped=0x0) returned 1 [0059.376] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0059.376] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0059.376] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0059.376] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=17963985872) returned 1 [0059.376] ReadFile (in: hFile=0x11c, lpBuffer=0x37a9c40, nNumberOfBytesToRead=0x5093, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37a9c40*, lpNumberOfBytesRead=0x18dd7c*=0x5093, lpOverlapped=0x0) returned 1 [0059.378] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0059.378] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=17964166342) returned 1 [0059.387] WriteFile (in: hFile=0x158, lpBuffer=0x1fea210*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fea210*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0059.387] ReadFile (in: hFile=0x11c, lpBuffer=0x37a9c40, nNumberOfBytesToRead=0x5093, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x37a9c40*, lpNumberOfBytesRead=0x18de38*=0x5093, lpOverlapped=0x0) returned 1 [0059.388] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x47 [0059.388] WriteFile (in: hFile=0x158, lpBuffer=0x37f0560*, nNumberOfBytesToWrite=0x5093, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x37f0560*, lpNumberOfBytesWritten=0x18de10*=0x5093, lpOverlapped=0x0) returned 1 [0059.388] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x50da [0059.388] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0059.388] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0059.388] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0059.389] SetFilePointer (in: hFile=0x158, lDistanceToMove=12, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2a [0059.389] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x50e4 [0059.389] CloseHandle (hObject=0x11c) returned 1 [0059.389] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x50e4 [0059.389] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x50e4 [0059.389] SetFilePointer (in: hFile=0x158, lDistanceToMove=20708, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x50e4 [0059.389] SetFilePointer (in: hFile=0x158, lDistanceToMove=20708, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x50e4 [0059.389] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x50e4 [0059.389] SetFilePointer (in: hFile=0x158, lDistanceToMove=20708, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x50e4 [0059.389] SetEndOfFile (hFile=0x158) returned 1 [0059.389] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x50e4 [0059.389] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x50e4 [0059.389] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0059.389] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe36ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0059.389] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0059.390] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe37ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0059.390] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe37ec, cbMultiByte=12, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="THMBNAIL.PNGꞗ@涤(\x18믉`믑`") returned 12 [0059.390] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0059.390] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe36ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0059.390] WriteFile (in: hFile=0x158, lpBuffer=0x378d718*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x378d718*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0059.390] CharToOemA (in: pSrc="THMBNAIL.PNG", pDst=0x1fe37ec | out: pDst="THMBNAIL.PNG") returned 1 [0059.390] WriteFile (in: hFile=0x158, lpBuffer=0x1fe37ec*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe37ec*, lpNumberOfBytesWritten=0x18efcc*=0xc, lpOverlapped=0x0) returned 1 [0059.390] WriteFile (in: hFile=0x158, lpBuffer=0x1fea170*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea170*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0059.390] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0059.390] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0059.390] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x5129 [0059.390] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x5129 [0059.390] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0059.390] WriteFile (in: hFile=0x158, lpBuffer=0x35f01dc*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f01dc*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0059.390] DeleteFileW (lpFileName="") returned 0 [0059.390] GetLastError () returned 0x3 [0059.391] GetFileAttributesW (lpFileName="") returned 0xffffffff [0059.391] SetLastError (dwErrCode=0x3) [0059.391] FlushFileBuffers (hFile=0x158) returned 1 [0059.394] GetCurrentThreadId () returned 0x970 [0059.394] GetCurrentThreadId () returned 0x970 [0059.395] GetCurrentThreadId () returned 0x970 [0059.395] GetCurrentThreadId () returned 0x970 [0059.395] GetCurrentThreadId () returned 0x970 [0059.395] GetCurrentThreadId () returned 0x970 [0059.395] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x51e0 [0059.395] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x51e0 [0059.395] SetFilePointer (in: hFile=0x158, lDistanceToMove=20960, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x51e0 [0059.395] CloseHandle (hObject=0x158) returned 1 [0059.396] GetCurrentThreadId () returned 0x970 [0059.396] GetCurrentThreadId () returned 0x970 [0059.396] GetCurrentThreadId () returned 0x970 [0059.396] GetCurrentThreadId () returned 0x970 [0059.396] GetCurrentThreadId () returned 0x970 [0059.396] GetCurrentThreadId () returned 0x970 [0059.396] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\Файл зашифрован [THMBNAIL.PNG].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\Файл зашифрован [thmbnail.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0059.396] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x51e0 [0059.396] SetFilePointer (in: hFile=0x158, lDistanceToMove=20832, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5160 [0059.396] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0059.396] GetFileType (hFile=0x158) returned 0x1 [0059.396] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x6, wMilliseconds=0x29a)) [0059.396] GetCurrentThreadId () returned 0x970 [0059.397] GetCurrentThreadId () returned 0x970 [0059.397] GetCurrentThreadId () returned 0x970 [0059.397] GetCurrentThreadId () returned 0x970 [0059.397] GetCurrentThreadId () returned 0x970 [0059.397] GetCurrentThreadId () returned 0x970 [0059.397] GetCurrentThreadId () returned 0x970 [0059.397] GetCurrentThreadId () returned 0x970 [0059.397] GetCurrentThreadId () returned 0x970 [0059.397] GetCurrentThreadId () returned 0x970 [0059.397] GetCurrentThreadId () returned 0x970 [0059.397] GetCurrentThreadId () returned 0x970 [0059.397] GetCurrentThreadId () returned 0x970 [0059.397] GetCurrentThreadId () returned 0x970 [0059.397] GetCurrentThreadId () returned 0x970 [0059.397] GetCurrentThreadId () returned 0x970 [0059.397] GetCurrentThreadId () returned 0x970 [0059.397] GetCurrentThreadId () returned 0x970 [0059.397] GetCurrentThreadId () returned 0x970 [0059.397] GetCurrentThreadId () returned 0x970 [0059.397] GetCurrentThreadId () returned 0x970 [0059.397] GetCurrentThreadId () returned 0x970 [0059.397] GetCurrentThreadId () returned 0x970 [0059.397] GetCurrentThreadId () returned 0x970 [0059.397] GetCurrentThreadId () returned 0x970 [0059.397] GetCurrentThreadId () returned 0x970 [0059.397] GetCurrentThreadId () returned 0x970 [0059.397] GetCurrentThreadId () returned 0x970 [0059.397] GetCurrentThreadId () returned 0x970 [0059.397] GetCurrentThreadId () returned 0x970 [0059.397] GetCurrentThreadId () returned 0x970 [0059.397] GetCurrentThreadId () returned 0x970 [0059.397] GetCurrentThreadId () returned 0x970 [0059.397] GetCurrentThreadId () returned 0x970 [0059.397] GetCurrentThreadId () returned 0x970 [0059.397] GetCurrentThreadId () returned 0x970 [0059.397] GetCurrentThreadId () returned 0x970 [0059.397] GetCurrentThreadId () returned 0x970 [0059.397] GetCurrentThreadId () returned 0x970 [0059.397] GetCurrentThreadId () returned 0x970 [0059.397] GetCurrentThreadId () returned 0x970 [0059.397] GetCurrentThreadId () returned 0x970 [0059.397] GetCurrentThreadId () returned 0x970 [0059.397] GetCurrentThreadId () returned 0x970 [0059.397] GetCurrentThreadId () returned 0x970 [0059.397] GetCurrentThreadId () returned 0x970 [0059.397] GetCurrentThreadId () returned 0x970 [0059.398] GetCurrentThreadId () returned 0x970 [0059.398] GetCurrentThreadId () returned 0x970 [0059.398] GetCurrentThreadId () returned 0x970 [0059.398] GetCurrentThreadId () returned 0x970 [0059.398] GetCurrentThreadId () returned 0x970 [0059.398] GetCurrentThreadId () returned 0x970 [0059.398] GetCurrentThreadId () returned 0x970 [0059.398] GetCurrentThreadId () returned 0x970 [0059.398] GetCurrentThreadId () returned 0x970 [0059.398] GetCurrentThreadId () returned 0x970 [0059.398] GetCurrentThreadId () returned 0x970 [0059.398] GetCurrentThreadId () returned 0x970 [0059.398] GetCurrentThreadId () returned 0x970 [0059.398] GetCurrentThreadId () returned 0x970 [0059.398] GetCurrentThreadId () returned 0x970 [0059.398] GetCurrentThreadId () returned 0x970 [0059.398] GetCurrentThreadId () returned 0x970 [0059.398] GetCurrentThreadId () returned 0x970 [0059.398] GetCurrentThreadId () returned 0x970 [0059.398] GetCurrentThreadId () returned 0x970 [0059.398] GetCurrentThreadId () returned 0x970 [0059.398] GetCurrentThreadId () returned 0x970 [0059.398] GetCurrentThreadId () returned 0x970 [0059.398] GetCurrentThreadId () returned 0x970 [0059.398] GetCurrentThreadId () returned 0x970 [0059.398] GetCurrentThreadId () returned 0x970 [0059.398] GetCurrentThreadId () returned 0x970 [0059.398] GetCurrentThreadId () returned 0x970 [0059.398] GetCurrentThreadId () returned 0x970 [0059.398] GetCurrentThreadId () returned 0x970 [0059.398] GetCurrentThreadId () returned 0x970 [0059.398] GetCurrentThreadId () returned 0x970 [0059.398] GetCurrentThreadId () returned 0x970 [0059.398] GetCurrentThreadId () returned 0x970 [0059.398] GetCurrentThreadId () returned 0x970 [0059.398] GetCurrentThreadId () returned 0x970 [0059.398] GetCurrentThreadId () returned 0x970 [0059.398] GetCurrentThreadId () returned 0x970 [0059.398] GetCurrentThreadId () returned 0x970 [0059.398] GetCurrentThreadId () returned 0x970 [0059.398] GetCurrentThreadId () returned 0x970 [0059.398] GetCurrentThreadId () returned 0x970 [0059.398] GetCurrentThreadId () returned 0x970 [0059.398] GetCurrentThreadId () returned 0x970 [0059.398] GetCurrentThreadId () returned 0x970 [0059.398] GetCurrentThreadId () returned 0x970 [0059.398] GetCurrentThreadId () returned 0x970 [0059.399] GetCurrentThreadId () returned 0x970 [0059.399] GetCurrentThreadId () returned 0x970 [0059.399] GetCurrentThreadId () returned 0x970 [0059.399] GetCurrentThreadId () returned 0x970 [0059.399] GetCurrentThreadId () returned 0x970 [0059.399] GetCurrentThreadId () returned 0x970 [0059.399] GetCurrentThreadId () returned 0x970 [0059.399] GetCurrentThreadId () returned 0x970 [0059.399] GetCurrentThreadId () returned 0x970 [0059.399] GetCurrentThreadId () returned 0x970 [0059.399] GetCurrentThreadId () returned 0x970 [0059.399] GetCurrentThreadId () returned 0x970 [0059.399] GetCurrentThreadId () returned 0x970 [0059.399] GetCurrentThreadId () returned 0x970 [0059.399] GetCurrentThreadId () returned 0x970 [0059.399] GetCurrentThreadId () returned 0x970 [0059.399] GetCurrentThreadId () returned 0x970 [0059.399] GetCurrentThreadId () returned 0x970 [0059.399] GetCurrentThreadId () returned 0x970 [0059.399] GetCurrentThreadId () returned 0x970 [0059.399] GetCurrentThreadId () returned 0x970 [0059.399] GetCurrentThreadId () returned 0x970 [0059.399] GetCurrentThreadId () returned 0x970 [0059.399] GetCurrentThreadId () returned 0x970 [0059.399] GetCurrentThreadId () returned 0x970 [0059.399] GetCurrentThreadId () returned 0x970 [0059.399] GetCurrentThreadId () returned 0x970 [0059.399] GetCurrentThreadId () returned 0x970 [0059.399] GetCurrentThreadId () returned 0x970 [0059.399] GetCurrentThreadId () returned 0x970 [0059.399] GetCurrentThreadId () returned 0x970 [0059.399] GetCurrentThreadId () returned 0x970 [0059.399] GetCurrentThreadId () returned 0x970 [0059.399] GetCurrentThreadId () returned 0x970 [0059.399] GetCurrentThreadId () returned 0x970 [0059.399] GetCurrentThreadId () returned 0x970 [0059.399] GetCurrentThreadId () returned 0x970 [0059.399] GetCurrentThreadId () returned 0x970 [0059.399] GetCurrentThreadId () returned 0x970 [0059.399] GetCurrentThreadId () returned 0x970 [0059.399] GetCurrentThreadId () returned 0x970 [0059.399] GetCurrentThreadId () returned 0x970 [0059.399] GetCurrentThreadId () returned 0x970 [0059.399] GetCurrentThreadId () returned 0x970 [0059.399] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.399] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.400] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fef090, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0059.400] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.400] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.400] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fef090, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0059.400] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.400] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.400] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0059.400] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.400] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.400] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0059.400] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.400] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.400] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fef0f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0059.400] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.400] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.400] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fef0f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0059.400] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.400] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.400] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fef0f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0059.400] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x6, wMilliseconds=0x29a)) [0059.400] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr=")zfxNlbL76$++.m0<.$ONBXz(@7=*-Jw", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0059.400] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr=")zfxNlbL76$++.m0<.$ONBXz(@7=*-Jw", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0059.400] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr=")zfxNlbL76$++.m0<.$ONBXz(@7=*-Jw", cchWideChar=32, lpMultiByteStr=0x2002698, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=")zfxNlbL76$++.m0<.$ONBXz(@7=*-Jw", lpUsedDefaultChar=0x0) returned 32 [0059.400] GetCurrentThreadId () returned 0x970 [0059.400] GetCurrentThreadId () returned 0x970 [0059.400] GetCurrentThreadId () returned 0x970 [0059.400] GetCurrentThreadId () returned 0x970 [0059.400] GetCurrentThreadId () returned 0x970 [0059.400] GetCurrentThreadId () returned 0x970 [0059.408] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0059.408] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0059.408] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x34f7958, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0059.408] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0059.408] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAFq+Y6tIV5O5m3ZdDjuVht9KIpJzuWW+nAJnqUX7iT1xCpXd8ejRMCfCqWTbhkDcHARhsQ1VVxqANLYmMKUw3kdvedfByl80TvxOqc317XbECLyDmJbUSvxii2jURfirWgeUgAZzxbkEi9owMJTckAA5QTxMnERJEOO9WZ4n8bylzkqJtvEUvnVJJ60XFtTwdzLGO9Woh3/WOkf/u2cN9keZ9VEmpy1o9w==") returned 232 [0059.408] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x6, wMilliseconds=0x2aa)) [0059.408] GetCurrentThreadId () returned 0x970 [0059.408] GetCurrentThreadId () returned 0x970 [0059.408] GetCurrentThreadId () returned 0x970 [0059.408] GetCurrentThreadId () returned 0x970 [0059.408] GetCurrentThreadId () returned 0x970 [0059.408] GetCurrentThreadId () returned 0x970 [0059.408] GetCurrentThreadId () returned 0x970 [0059.408] GetCurrentThreadId () returned 0x970 [0059.408] GetCurrentThreadId () returned 0x970 [0059.408] GetCurrentThreadId () returned 0x970 [0059.408] GetCurrentThreadId () returned 0x970 [0059.408] GetCurrentThreadId () returned 0x970 [0059.408] GetCurrentThreadId () returned 0x970 [0059.408] GetCurrentThreadId () returned 0x970 [0059.408] GetCurrentThreadId () returned 0x970 [0059.408] GetCurrentThreadId () returned 0x970 [0059.408] GetCurrentThreadId () returned 0x970 [0059.408] GetCurrentThreadId () returned 0x970 [0059.408] GetCurrentThreadId () returned 0x970 [0059.408] GetCurrentThreadId () returned 0x970 [0059.408] GetCurrentThreadId () returned 0x970 [0059.408] GetCurrentThreadId () returned 0x970 [0059.408] GetCurrentThreadId () returned 0x970 [0059.408] GetCurrentThreadId () returned 0x970 [0059.408] GetCurrentThreadId () returned 0x970 [0059.408] GetCurrentThreadId () returned 0x970 [0059.409] GetCurrentThreadId () returned 0x970 [0059.409] GetCurrentThreadId () returned 0x970 [0059.409] GetCurrentThreadId () returned 0x970 [0059.409] GetCurrentThreadId () returned 0x970 [0059.409] GetCurrentThreadId () returned 0x970 [0059.409] GetCurrentThreadId () returned 0x970 [0059.409] GetCurrentThreadId () returned 0x970 [0059.409] GetCurrentThreadId () returned 0x970 [0059.409] GetCurrentThreadId () returned 0x970 [0059.409] GetCurrentThreadId () returned 0x970 [0059.409] GetCurrentThreadId () returned 0x970 [0059.409] GetCurrentThreadId () returned 0x970 [0059.409] GetCurrentThreadId () returned 0x970 [0059.409] GetCurrentThreadId () returned 0x970 [0059.409] GetCurrentThreadId () returned 0x970 [0059.409] GetCurrentThreadId () returned 0x970 [0059.409] GetCurrentThreadId () returned 0x970 [0059.409] GetCurrentThreadId () returned 0x970 [0059.409] GetCurrentThreadId () returned 0x970 [0059.409] GetCurrentThreadId () returned 0x970 [0059.409] GetCurrentThreadId () returned 0x970 [0059.409] GetCurrentThreadId () returned 0x970 [0059.409] GetCurrentThreadId () returned 0x970 [0059.409] GetCurrentThreadId () returned 0x970 [0059.409] GetCurrentThreadId () returned 0x970 [0059.409] GetCurrentThreadId () returned 0x970 [0059.409] GetCurrentThreadId () returned 0x970 [0059.409] GetCurrentThreadId () returned 0x970 [0059.409] GetCurrentThreadId () returned 0x970 [0059.409] GetCurrentThreadId () returned 0x970 [0059.409] GetCurrentThreadId () returned 0x970 [0059.409] GetCurrentThreadId () returned 0x970 [0059.409] GetCurrentThreadId () returned 0x970 [0059.409] GetCurrentThreadId () returned 0x970 [0059.409] GetCurrentThreadId () returned 0x970 [0059.409] GetCurrentThreadId () returned 0x970 [0059.409] GetCurrentThreadId () returned 0x970 [0059.409] GetCurrentThreadId () returned 0x970 [0059.409] GetCurrentThreadId () returned 0x970 [0059.409] GetCurrentThreadId () returned 0x970 [0059.409] GetCurrentThreadId () returned 0x970 [0059.409] GetCurrentThreadId () returned 0x970 [0059.409] GetCurrentThreadId () returned 0x970 [0059.409] GetCurrentThreadId () returned 0x970 [0059.409] GetCurrentThreadId () returned 0x970 [0059.409] GetCurrentThreadId () returned 0x970 [0059.409] GetCurrentThreadId () returned 0x970 [0059.410] GetCurrentThreadId () returned 0x970 [0059.410] GetCurrentThreadId () returned 0x970 [0059.410] GetCurrentThreadId () returned 0x970 [0059.410] GetCurrentThreadId () returned 0x970 [0059.410] GetCurrentThreadId () returned 0x970 [0059.410] GetCurrentThreadId () returned 0x970 [0059.410] GetCurrentThreadId () returned 0x970 [0059.410] GetCurrentThreadId () returned 0x970 [0059.410] GetCurrentThreadId () returned 0x970 [0059.410] GetCurrentThreadId () returned 0x970 [0059.410] GetCurrentThreadId () returned 0x970 [0059.410] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAFq+Y6tIV5O5m3ZdDjuVht9KIpJzuWW+nAJnqUX7iT1xCpXd8ejRMCfCqWTbhkDcHARhsQ1VVxqANLYmMKUw3kdvedfByl80TvxOqc317XbECLyDmJbUSvxii2jURfirWgeUgAZzxbkEi9owMJTckAA5QTxMnERJEOO9WZ4n8bylzkqJtvEUvnVJJ60XFtTwdzLGO9Woh3/WOkf/u2cN9keZ9VEmpy1o9w==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0059.410] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAFq+Y6tIV5O5m3ZdDjuVht9KIpJzuWW+nAJnqUX7iT1xCpXd8ejRMCfCqWTbhkDcHARhsQ1VVxqANLYmMKUw3kdvedfByl80TvxOqc317XbECLyDmJbUSvxii2jURfirWgeUgAZzxbkEi9owMJTckAA5QTxMnERJEOO9WZ4n8bylzkqJtvEUvnVJJ60XFtTwdzLGO9Woh3/WOkf/u2cN9keZ9VEmpy1o9w==", cchWideChar=245, lpMultiByteStr=0x353933c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAFq+Y6tIV5O5m3ZdDjuVht9KIpJzuWW+nAJnqUX7iT1xCpXd8ejRMCfCqWTbhkDcHARhsQ1VVxqANLYmMKUw3kdvedfByl80TvxOqc317XbECLyDmJbUSvxii2jURfirWgeUgAZzxbkEi9owMJTckAA5QTxMnERJEOO9WZ4n8bylzkqJtvEUvnVJJ60XFtTwdzLGO9Woh3/WOkf/u2cN9keZ9VEmpy1o9w==", lpUsedDefaultChar=0x0) returned 245 [0059.410] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0059.410] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0059.410] CloseHandle (hObject=0x158) returned 1 [0059.411] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png")) returned 1 [0059.412] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=17967539795) returned 1 [0059.412] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\Файл зашифрован [PREVIEW.GIF].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\Файл зашифрован [preview.gif].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0059.414] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0059.414] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0059.414] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0059.414] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0059.414] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0059.414] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0059.414] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0059.414] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0059.414] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0059.414] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0059.415] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0059.415] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0059.415] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0059.415] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0059.415] SetEndOfFile (hFile=0x158) returned 1 [0059.415] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0059.415] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0059.415] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0059.415] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0059.415] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0059.416] WriteFile (in: hFile=0x158, lpBuffer=0x35f011c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f011c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0059.416] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="@#=Y&\"fs*fD}v\"8qF{RLlnBj/UhNCk+X", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0059.416] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="@#=Y&\"fs*fD}v\"8qF{RLlnBj/UhNCk+X", cchWideChar=32, lpMultiByteStr=0x2034d24, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="@#=Y&\"fs*fD}v\"8qF{RLlnBj/UhNCk+X", lpUsedDefaultChar=0x0) returned 32 [0059.416] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0059.416] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0059.416] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6d2cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x618, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 0x295098 [0059.416] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0059.416] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0059.416] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif")) returned 0x20 [0059.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif")) returned 0x20 [0059.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif")) returned 0x20 [0059.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif")) returned 0x20 [0059.418] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6d2cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x618)) returned 1 [0059.418] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0059.418] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0059.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif")) returned 0x20 [0059.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif")) returned 0x20 [0059.418] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0059.418] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0059.418] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0059.418] SetEndOfFile (hFile=0x158) returned 1 [0059.419] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0059.419] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe410c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0059.419] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0059.419] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe3c4c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0059.419] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe3c4c, cbMultiByte=11, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="PREVIEW.GIFGer.gifg") returned 11 [0059.419] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0059.419] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe410c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0059.419] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0059.419] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0059.419] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x618 [0059.419] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0059.419] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0059.420] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0059.420] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0059.420] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe410c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0059.420] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0059.420] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe3c4c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0059.420] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe3c4c, cbMultiByte=11, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="PREVIEW.GIFEW.GIFGer.gifg") returned 11 [0059.420] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0059.420] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe410c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0059.420] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0059.421] CharToOemA (in: pSrc="PREVIEW.GIF", pDst=0x1fe3c4c | out: pDst="PREVIEW.GIF") returned 1 [0059.421] WriteFile (in: hFile=0x158, lpBuffer=0x1fe3c4c*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe3c4c*, lpNumberOfBytesWritten=0x18e048*=0xb, lpOverlapped=0x0) returned 1 [0059.421] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0059.421] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0059.421] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0059.421] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=17968455027) returned 1 [0059.421] ReadFile (in: hFile=0x11c, lpBuffer=0x37a9c60, nNumberOfBytesToRead=0x618, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37a9c60*, lpNumberOfBytesRead=0x18dd7c*=0x618, lpOverlapped=0x0) returned 1 [0059.493] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0059.493] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=17975651896) returned 1 [0059.502] WriteFile (in: hFile=0x158, lpBuffer=0x1fea180*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fea180*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0059.502] ReadFile (in: hFile=0x11c, lpBuffer=0x37a9c60, nNumberOfBytesToRead=0x618, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x37a9c60*, lpNumberOfBytesRead=0x18de38*=0x618, lpOverlapped=0x0) returned 1 [0059.502] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x46 [0059.502] WriteFile (in: hFile=0x158, lpBuffer=0x37aa2d0*, nNumberOfBytesToWrite=0x618, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x37aa2d0*, lpNumberOfBytesWritten=0x18de10*=0x618, lpOverlapped=0x0) returned 1 [0059.502] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x65e [0059.502] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0059.502] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0059.502] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0059.503] SetFilePointer (in: hFile=0x158, lDistanceToMove=11, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x29 [0059.503] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x668 [0059.503] CloseHandle (hObject=0x11c) returned 1 [0059.503] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x668 [0059.503] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x668 [0059.503] SetFilePointer (in: hFile=0x158, lDistanceToMove=1640, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x668 [0059.503] SetFilePointer (in: hFile=0x158, lDistanceToMove=1640, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x668 [0059.503] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x668 [0059.503] SetFilePointer (in: hFile=0x158, lDistanceToMove=1640, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x668 [0059.503] SetEndOfFile (hFile=0x158) returned 1 [0059.503] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x668 [0059.503] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x668 [0059.503] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0059.503] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe410c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0059.503] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0059.503] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe41ac, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0059.504] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe41ac, cbMultiByte=11, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="PREVIEW.GIF\x18ꞗ@涤(\x18믉`믑`") returned 11 [0059.504] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0059.504] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe410c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0059.504] WriteFile (in: hFile=0x158, lpBuffer=0x378d718*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x378d718*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0059.504] CharToOemA (in: pSrc="PREVIEW.GIF", pDst=0x1fe41ac | out: pDst="PREVIEW.GIF") returned 1 [0059.504] WriteFile (in: hFile=0x158, lpBuffer=0x1fe41ac*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe41ac*, lpNumberOfBytesWritten=0x18efcc*=0xb, lpOverlapped=0x0) returned 1 [0059.504] WriteFile (in: hFile=0x158, lpBuffer=0x1fea110*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea110*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0059.504] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0059.504] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0059.504] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x6ac [0059.504] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x6ac [0059.504] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0059.504] WriteFile (in: hFile=0x158, lpBuffer=0x35f011c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f011c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0059.504] DeleteFileW (lpFileName="") returned 0 [0059.504] GetLastError () returned 0x3 [0059.504] GetFileAttributesW (lpFileName="") returned 0xffffffff [0059.504] SetLastError (dwErrCode=0x3) [0059.505] FlushFileBuffers (hFile=0x158) returned 1 [0059.507] GetCurrentThreadId () returned 0x970 [0059.507] GetCurrentThreadId () returned 0x970 [0059.507] GetCurrentThreadId () returned 0x970 [0059.507] GetCurrentThreadId () returned 0x970 [0059.507] GetCurrentThreadId () returned 0x970 [0059.507] GetCurrentThreadId () returned 0x970 [0059.507] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x763 [0059.507] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x763 [0059.507] SetFilePointer (in: hFile=0x158, lDistanceToMove=1891, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x763 [0059.507] CloseHandle (hObject=0x158) returned 1 [0059.508] GetCurrentThreadId () returned 0x970 [0059.508] GetCurrentThreadId () returned 0x970 [0059.509] GetCurrentThreadId () returned 0x970 [0059.509] GetCurrentThreadId () returned 0x970 [0059.509] GetCurrentThreadId () returned 0x970 [0059.509] GetCurrentThreadId () returned 0x970 [0059.509] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\Файл зашифрован [PREVIEW.GIF].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\Файл зашифрован [preview.gif].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0059.509] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x763 [0059.509] SetFilePointer (in: hFile=0x158, lDistanceToMove=1763, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6e3 [0059.509] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0059.509] GetFileType (hFile=0x158) returned 0x1 [0059.509] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x6, wMilliseconds=0x308)) [0059.509] GetCurrentThreadId () returned 0x970 [0059.509] GetCurrentThreadId () returned 0x970 [0059.509] GetCurrentThreadId () returned 0x970 [0059.509] GetCurrentThreadId () returned 0x970 [0059.509] GetCurrentThreadId () returned 0x970 [0059.509] GetCurrentThreadId () returned 0x970 [0059.509] GetCurrentThreadId () returned 0x970 [0059.509] GetCurrentThreadId () returned 0x970 [0059.509] GetCurrentThreadId () returned 0x970 [0059.509] GetCurrentThreadId () returned 0x970 [0059.509] GetCurrentThreadId () returned 0x970 [0059.509] GetCurrentThreadId () returned 0x970 [0059.509] GetCurrentThreadId () returned 0x970 [0059.509] GetCurrentThreadId () returned 0x970 [0059.509] GetCurrentThreadId () returned 0x970 [0059.509] GetCurrentThreadId () returned 0x970 [0059.509] GetCurrentThreadId () returned 0x970 [0059.509] GetCurrentThreadId () returned 0x970 [0059.509] GetCurrentThreadId () returned 0x970 [0059.509] GetCurrentThreadId () returned 0x970 [0059.509] GetCurrentThreadId () returned 0x970 [0059.509] GetCurrentThreadId () returned 0x970 [0059.510] GetCurrentThreadId () returned 0x970 [0059.510] GetCurrentThreadId () returned 0x970 [0059.510] GetCurrentThreadId () returned 0x970 [0059.510] GetCurrentThreadId () returned 0x970 [0059.510] GetCurrentThreadId () returned 0x970 [0059.510] GetCurrentThreadId () returned 0x970 [0059.510] GetCurrentThreadId () returned 0x970 [0059.510] GetCurrentThreadId () returned 0x970 [0059.510] GetCurrentThreadId () returned 0x970 [0059.510] GetCurrentThreadId () returned 0x970 [0059.510] GetCurrentThreadId () returned 0x970 [0059.510] GetCurrentThreadId () returned 0x970 [0059.510] GetCurrentThreadId () returned 0x970 [0059.510] GetCurrentThreadId () returned 0x970 [0059.510] GetCurrentThreadId () returned 0x970 [0059.510] GetCurrentThreadId () returned 0x970 [0059.510] GetCurrentThreadId () returned 0x970 [0059.510] GetCurrentThreadId () returned 0x970 [0059.510] GetCurrentThreadId () returned 0x970 [0059.510] GetCurrentThreadId () returned 0x970 [0059.510] GetCurrentThreadId () returned 0x970 [0059.510] GetCurrentThreadId () returned 0x970 [0059.510] GetCurrentThreadId () returned 0x970 [0059.510] GetCurrentThreadId () returned 0x970 [0059.510] GetCurrentThreadId () returned 0x970 [0059.510] GetCurrentThreadId () returned 0x970 [0059.510] GetCurrentThreadId () returned 0x970 [0059.510] GetCurrentThreadId () returned 0x970 [0059.510] GetCurrentThreadId () returned 0x970 [0059.510] GetCurrentThreadId () returned 0x970 [0059.510] GetCurrentThreadId () returned 0x970 [0059.510] GetCurrentThreadId () returned 0x970 [0059.510] GetCurrentThreadId () returned 0x970 [0059.510] GetCurrentThreadId () returned 0x970 [0059.510] GetCurrentThreadId () returned 0x970 [0059.510] GetCurrentThreadId () returned 0x970 [0059.510] GetCurrentThreadId () returned 0x970 [0059.510] GetCurrentThreadId () returned 0x970 [0059.510] GetCurrentThreadId () returned 0x970 [0059.510] GetCurrentThreadId () returned 0x970 [0059.510] GetCurrentThreadId () returned 0x970 [0059.510] GetCurrentThreadId () returned 0x970 [0059.510] GetCurrentThreadId () returned 0x970 [0059.510] GetCurrentThreadId () returned 0x970 [0059.510] GetCurrentThreadId () returned 0x970 [0059.510] GetCurrentThreadId () returned 0x970 [0059.511] GetCurrentThreadId () returned 0x970 [0059.511] GetCurrentThreadId () returned 0x970 [0059.511] GetCurrentThreadId () returned 0x970 [0059.511] GetCurrentThreadId () returned 0x970 [0059.511] GetCurrentThreadId () returned 0x970 [0059.511] GetCurrentThreadId () returned 0x970 [0059.511] GetCurrentThreadId () returned 0x970 [0059.511] GetCurrentThreadId () returned 0x970 [0059.511] GetCurrentThreadId () returned 0x970 [0059.511] GetCurrentThreadId () returned 0x970 [0059.511] GetCurrentThreadId () returned 0x970 [0059.511] GetCurrentThreadId () returned 0x970 [0059.511] GetCurrentThreadId () returned 0x970 [0059.511] GetCurrentThreadId () returned 0x970 [0059.511] GetCurrentThreadId () returned 0x970 [0059.511] GetCurrentThreadId () returned 0x970 [0059.511] GetCurrentThreadId () returned 0x970 [0059.511] GetCurrentThreadId () returned 0x970 [0059.511] GetCurrentThreadId () returned 0x970 [0059.511] GetCurrentThreadId () returned 0x970 [0059.511] GetCurrentThreadId () returned 0x970 [0059.511] GetCurrentThreadId () returned 0x970 [0059.511] GetCurrentThreadId () returned 0x970 [0059.511] GetCurrentThreadId () returned 0x970 [0059.511] GetCurrentThreadId () returned 0x970 [0059.511] GetCurrentThreadId () returned 0x970 [0059.511] GetCurrentThreadId () returned 0x970 [0059.511] GetCurrentThreadId () returned 0x970 [0059.511] GetCurrentThreadId () returned 0x970 [0059.511] GetCurrentThreadId () returned 0x970 [0059.511] GetCurrentThreadId () returned 0x970 [0059.511] GetCurrentThreadId () returned 0x970 [0059.511] GetCurrentThreadId () returned 0x970 [0059.511] GetCurrentThreadId () returned 0x970 [0059.511] GetCurrentThreadId () returned 0x970 [0059.511] GetCurrentThreadId () returned 0x970 [0059.511] GetCurrentThreadId () returned 0x970 [0059.511] GetCurrentThreadId () returned 0x970 [0059.511] GetCurrentThreadId () returned 0x970 [0059.511] GetCurrentThreadId () returned 0x970 [0059.511] GetCurrentThreadId () returned 0x970 [0059.511] GetCurrentThreadId () returned 0x970 [0059.511] GetCurrentThreadId () returned 0x970 [0059.511] GetCurrentThreadId () returned 0x970 [0059.511] GetCurrentThreadId () returned 0x970 [0059.511] GetCurrentThreadId () returned 0x970 [0059.511] GetCurrentThreadId () returned 0x970 [0059.511] GetCurrentThreadId () returned 0x970 [0059.512] GetCurrentThreadId () returned 0x970 [0059.512] GetCurrentThreadId () returned 0x970 [0059.512] GetCurrentThreadId () returned 0x970 [0059.512] GetCurrentThreadId () returned 0x970 [0059.512] GetCurrentThreadId () returned 0x970 [0059.512] GetCurrentThreadId () returned 0x970 [0059.512] GetCurrentThreadId () returned 0x970 [0059.512] GetCurrentThreadId () returned 0x970 [0059.512] GetCurrentThreadId () returned 0x970 [0059.512] GetCurrentThreadId () returned 0x970 [0059.512] GetCurrentThreadId () returned 0x970 [0059.512] GetCurrentThreadId () returned 0x970 [0059.512] GetCurrentThreadId () returned 0x970 [0059.512] GetCurrentThreadId () returned 0x970 [0059.512] GetCurrentThreadId () returned 0x970 [0059.512] GetCurrentThreadId () returned 0x970 [0059.512] GetCurrentThreadId () returned 0x970 [0059.512] GetCurrentThreadId () returned 0x970 [0059.512] GetCurrentThreadId () returned 0x970 [0059.512] GetCurrentThreadId () returned 0x970 [0059.512] GetCurrentThreadId () returned 0x970 [0059.512] GetCurrentThreadId () returned 0x970 [0059.512] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.512] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.512] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fef0f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0059.512] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.512] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.512] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fef0f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0059.512] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.512] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.512] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0059.512] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.512] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.512] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0059.512] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.513] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.513] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fef150, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0059.513] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.513] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.513] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fef150, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0059.513] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.513] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.513] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fef150, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0059.513] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x6, wMilliseconds=0x317)) [0059.513] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="@#=Y&\"fs*fD}v\"8qF{RLlnBj/UhNCk+X", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0059.513] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="@#=Y&\"fs*fD}v\"8qF{RLlnBj/UhNCk+X", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0059.513] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="@#=Y&\"fs*fD}v\"8qF{RLlnBj/UhNCk+X", cchWideChar=32, lpMultiByteStr=0x20024e8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="@#=Y&\"fs*fD}v\"8qF{RLlnBj/UhNCk+X", lpUsedDefaultChar=0x0) returned 32 [0059.513] GetCurrentThreadId () returned 0x970 [0059.513] GetCurrentThreadId () returned 0x970 [0059.513] GetCurrentThreadId () returned 0x970 [0059.513] GetCurrentThreadId () returned 0x970 [0059.513] GetCurrentThreadId () returned 0x970 [0059.513] GetCurrentThreadId () returned 0x970 [0059.520] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0059.520] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0059.520] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x34f7a48, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0059.520] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0059.520] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAADY8d6Nacvw7v0DBlGa2zhustb0CtAPG1kXWCYQDEHC+AW3bj9YzftVlImRDVCVsMYWLycYdrOSvLOS71bgKfv+GSd5icJJYQXSHExJF33aQ0x4l6q1wBIXBPqi6rX8pPOhM+kAmGOFIuaUAilp3+vtVZ5BEIce7wetJCXuxmN9yiLnXSdTJY7zSHFOoZo7c6n8zRSWGtX/f0TXEJQ5WNtxP1MFFaxzYDg==") returned 232 [0059.521] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x6, wMilliseconds=0x317)) [0059.521] GetCurrentThreadId () returned 0x970 [0059.521] GetCurrentThreadId () returned 0x970 [0059.521] GetCurrentThreadId () returned 0x970 [0059.521] GetCurrentThreadId () returned 0x970 [0059.521] GetCurrentThreadId () returned 0x970 [0059.521] GetCurrentThreadId () returned 0x970 [0059.521] GetCurrentThreadId () returned 0x970 [0059.521] GetCurrentThreadId () returned 0x970 [0059.521] GetCurrentThreadId () returned 0x970 [0059.521] GetCurrentThreadId () returned 0x970 [0059.521] GetCurrentThreadId () returned 0x970 [0059.521] GetCurrentThreadId () returned 0x970 [0059.521] GetCurrentThreadId () returned 0x970 [0059.521] GetCurrentThreadId () returned 0x970 [0059.521] GetCurrentThreadId () returned 0x970 [0059.521] GetCurrentThreadId () returned 0x970 [0059.521] GetCurrentThreadId () returned 0x970 [0059.521] GetCurrentThreadId () returned 0x970 [0059.521] GetCurrentThreadId () returned 0x970 [0059.521] GetCurrentThreadId () returned 0x970 [0059.521] GetCurrentThreadId () returned 0x970 [0059.521] GetCurrentThreadId () returned 0x970 [0059.521] GetCurrentThreadId () returned 0x970 [0059.521] GetCurrentThreadId () returned 0x970 [0059.521] GetCurrentThreadId () returned 0x970 [0059.521] GetCurrentThreadId () returned 0x970 [0059.521] GetCurrentThreadId () returned 0x970 [0059.521] GetCurrentThreadId () returned 0x970 [0059.521] GetCurrentThreadId () returned 0x970 [0059.521] GetCurrentThreadId () returned 0x970 [0059.521] GetCurrentThreadId () returned 0x970 [0059.521] GetCurrentThreadId () returned 0x970 [0059.521] GetCurrentThreadId () returned 0x970 [0059.521] GetCurrentThreadId () returned 0x970 [0059.521] GetCurrentThreadId () returned 0x970 [0059.521] GetCurrentThreadId () returned 0x970 [0059.521] GetCurrentThreadId () returned 0x970 [0059.521] GetCurrentThreadId () returned 0x970 [0059.521] GetCurrentThreadId () returned 0x970 [0059.521] GetCurrentThreadId () returned 0x970 [0059.521] GetCurrentThreadId () returned 0x970 [0059.521] GetCurrentThreadId () returned 0x970 [0059.521] GetCurrentThreadId () returned 0x970 [0059.521] GetCurrentThreadId () returned 0x970 [0059.522] GetCurrentThreadId () returned 0x970 [0059.522] GetCurrentThreadId () returned 0x970 [0059.522] GetCurrentThreadId () returned 0x970 [0059.522] GetCurrentThreadId () returned 0x970 [0059.522] GetCurrentThreadId () returned 0x970 [0059.522] GetCurrentThreadId () returned 0x970 [0059.522] GetCurrentThreadId () returned 0x970 [0059.522] GetCurrentThreadId () returned 0x970 [0059.522] GetCurrentThreadId () returned 0x970 [0059.522] GetCurrentThreadId () returned 0x970 [0059.522] GetCurrentThreadId () returned 0x970 [0059.522] GetCurrentThreadId () returned 0x970 [0059.522] GetCurrentThreadId () returned 0x970 [0059.522] GetCurrentThreadId () returned 0x970 [0059.522] GetCurrentThreadId () returned 0x970 [0059.522] GetCurrentThreadId () returned 0x970 [0059.522] GetCurrentThreadId () returned 0x970 [0059.522] GetCurrentThreadId () returned 0x970 [0059.522] GetCurrentThreadId () returned 0x970 [0059.522] GetCurrentThreadId () returned 0x970 [0059.522] GetCurrentThreadId () returned 0x970 [0059.522] GetCurrentThreadId () returned 0x970 [0059.522] GetCurrentThreadId () returned 0x970 [0059.522] GetCurrentThreadId () returned 0x970 [0059.522] GetCurrentThreadId () returned 0x970 [0059.522] GetCurrentThreadId () returned 0x970 [0059.522] GetCurrentThreadId () returned 0x970 [0059.522] GetCurrentThreadId () returned 0x970 [0059.522] GetCurrentThreadId () returned 0x970 [0059.522] GetCurrentThreadId () returned 0x970 [0059.522] GetCurrentThreadId () returned 0x970 [0059.522] GetCurrentThreadId () returned 0x970 [0059.522] GetCurrentThreadId () returned 0x970 [0059.522] GetCurrentThreadId () returned 0x970 [0059.522] GetCurrentThreadId () returned 0x970 [0059.522] GetCurrentThreadId () returned 0x970 [0059.522] GetCurrentThreadId () returned 0x970 [0059.522] GetCurrentThreadId () returned 0x970 [0059.522] GetCurrentThreadId () returned 0x970 [0059.522] GetCurrentThreadId () returned 0x970 [0059.522] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAADY8d6Nacvw7v0DBlGa2zhustb0CtAPG1kXWCYQDEHC+AW3bj9YzftVlImRDVCVsMYWLycYdrOSvLOS71bgKfv+GSd5icJJYQXSHExJF33aQ0x4l6q1wBIXBPqi6rX8pPOhM+kAmGOFIuaUAilp3+vtVZ5BEIce7wetJCXuxmN9yiLnXSdTJY7zSHFOoZo7c6n8zRSWGtX/f0TXEJQ5WNtxP1MFFaxzYDg==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0059.522] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAADY8d6Nacvw7v0DBlGa2zhustb0CtAPG1kXWCYQDEHC+AW3bj9YzftVlImRDVCVsMYWLycYdrOSvLOS71bgKfv+GSd5icJJYQXSHExJF33aQ0x4l6q1wBIXBPqi6rX8pPOhM+kAmGOFIuaUAilp3+vtVZ5BEIce7wetJCXuxmN9yiLnXSdTJY7zSHFOoZo7c6n8zRSWGtX/f0TXEJQ5WNtxP1MFFaxzYDg==", cchWideChar=245, lpMultiByteStr=0x353933c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAADY8d6Nacvw7v0DBlGa2zhustb0CtAPG1kXWCYQDEHC+AW3bj9YzftVlImRDVCVsMYWLycYdrOSvLOS71bgKfv+GSd5icJJYQXSHExJF33aQ0x4l6q1wBIXBPqi6rX8pPOhM+kAmGOFIuaUAilp3+vtVZ5BEIce7wetJCXuxmN9yiLnXSdTJY7zSHFOoZo7c6n8zRSWGtX/f0TXEJQ5WNtxP1MFFaxzYDg==", lpUsedDefaultChar=0x0) returned 245 [0059.522] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0059.523] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0059.523] CloseHandle (hObject=0x158) returned 1 [0059.524] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif")) returned 1 [0059.524] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=17978790077) returned 1 [0059.525] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\Файл зашифрован [THMBNAIL.PNG].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\Файл зашифрован [thmbnail.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0059.525] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0059.525] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0059.525] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0059.525] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0059.525] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0059.525] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0059.525] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0059.525] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0059.525] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0059.525] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0059.525] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0059.526] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0059.526] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0059.526] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0059.526] SetEndOfFile (hFile=0x158) returned 1 [0059.526] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0059.526] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0059.526] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0059.526] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0059.526] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0059.527] WriteFile (in: hFile=0x158, lpBuffer=0x35f01dc*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f01dc*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0059.527] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m^@m/C=rJAoVE?~MxjKAxM*tQF,1tn+n", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0059.527] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m^@m/C=rJAoVE?~MxjKAxM*tQF,1tn+n", cchWideChar=32, lpMultiByteStr=0x2034d5c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="m^@m/C=rJAoVE?~MxjKAxM*tQF,1tn+n", lpUsedDefaultChar=0x0) returned 32 [0059.527] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0059.527] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0059.527] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x80f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0x295098 [0059.527] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0059.527] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0059.527] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png")) returned 0x20 [0059.528] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png")) returned 0x20 [0059.528] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png")) returned 0x20 [0059.528] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png")) returned 0x20 [0059.528] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x80f1)) returned 1 [0059.528] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0059.528] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0059.528] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png")) returned 0x20 [0059.528] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png")) returned 0x20 [0059.528] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0059.528] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0059.528] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0059.528] SetEndOfFile (hFile=0x158) returned 1 [0059.529] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0059.529] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe370c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0059.529] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0059.529] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe366c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0059.529] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe366c, cbMultiByte=12, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="THMBNAIL.PNGer.gifg") returned 12 [0059.529] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0059.529] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe370c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0059.529] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0059.529] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0059.530] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x80f1 [0059.530] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0059.530] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0059.530] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0059.530] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0059.530] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe370c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0059.530] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0059.530] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe366c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0059.530] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe366c, cbMultiByte=12, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="THMBNAIL.PNGIL.PNGer.gifg") returned 12 [0059.530] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0059.530] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe370c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0059.530] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0059.531] CharToOemA (in: pSrc="THMBNAIL.PNG", pDst=0x1fe366c | out: pDst="THMBNAIL.PNG") returned 1 [0059.531] WriteFile (in: hFile=0x158, lpBuffer=0x1fe366c*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe366c*, lpNumberOfBytesWritten=0x18e048*=0xc, lpOverlapped=0x0) returned 1 [0059.531] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0059.531] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0059.531] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0059.531] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=17979478928) returned 1 [0059.531] ReadFile (in: hFile=0x11c, lpBuffer=0x37a9c40, nNumberOfBytesToRead=0x80f1, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37a9c40*, lpNumberOfBytesRead=0x18dd7c*=0x80f1, lpOverlapped=0x0) returned 1 [0059.534] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0059.534] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=17979786538) returned 1 [0059.543] WriteFile (in: hFile=0x158, lpBuffer=0x1fea228*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fea228*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0059.543] ReadFile (in: hFile=0x11c, lpBuffer=0x37a9c40, nNumberOfBytesToRead=0x80f1, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x37a9c40*, lpNumberOfBytesRead=0x18de38*=0x80f1, lpOverlapped=0x0) returned 1 [0059.544] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x47 [0059.544] WriteFile (in: hFile=0x158, lpBuffer=0x37f3560*, nNumberOfBytesToWrite=0x80f1, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x37f3560*, lpNumberOfBytesWritten=0x18de10*=0x80f1, lpOverlapped=0x0) returned 1 [0059.545] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x8138 [0059.545] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0059.545] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0059.545] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0059.545] SetFilePointer (in: hFile=0x158, lDistanceToMove=12, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2a [0059.545] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x8142 [0059.546] CloseHandle (hObject=0x11c) returned 1 [0059.546] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x8142 [0059.546] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x8142 [0059.546] SetFilePointer (in: hFile=0x158, lDistanceToMove=33090, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x8142 [0059.546] SetFilePointer (in: hFile=0x158, lDistanceToMove=33090, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x8142 [0059.546] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x8142 [0059.546] SetFilePointer (in: hFile=0x158, lDistanceToMove=33090, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x8142 [0059.546] SetEndOfFile (hFile=0x158) returned 1 [0059.546] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x8142 [0059.546] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x8142 [0059.546] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0059.546] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe370c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0059.546] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0059.546] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe37ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0059.546] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe37ec, cbMultiByte=12, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="THMBNAIL.PNGꞗ@涤(\x18믉`믑`") returned 12 [0059.546] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0059.546] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe370c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0059.547] WriteFile (in: hFile=0x158, lpBuffer=0x378d718*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x378d718*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0059.547] CharToOemA (in: pSrc="THMBNAIL.PNG", pDst=0x1fe37ec | out: pDst="THMBNAIL.PNG") returned 1 [0059.547] WriteFile (in: hFile=0x158, lpBuffer=0x1fe37ec*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe37ec*, lpNumberOfBytesWritten=0x18efcc*=0xc, lpOverlapped=0x0) returned 1 [0059.547] WriteFile (in: hFile=0x158, lpBuffer=0x1fea2d8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea2d8*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0059.547] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0059.547] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0059.547] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x8187 [0059.547] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x8187 [0059.547] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0059.547] WriteFile (in: hFile=0x158, lpBuffer=0x35f01dc*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f01dc*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0059.547] DeleteFileW (lpFileName="") returned 0 [0059.547] GetLastError () returned 0x3 [0059.547] GetFileAttributesW (lpFileName="") returned 0xffffffff [0059.547] SetLastError (dwErrCode=0x3) [0059.547] FlushFileBuffers (hFile=0x158) returned 1 [0059.551] GetCurrentThreadId () returned 0x970 [0059.551] GetCurrentThreadId () returned 0x970 [0059.551] GetCurrentThreadId () returned 0x970 [0059.551] GetCurrentThreadId () returned 0x970 [0059.551] GetCurrentThreadId () returned 0x970 [0059.551] GetCurrentThreadId () returned 0x970 [0059.551] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x823e [0059.551] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x823e [0059.551] SetFilePointer (in: hFile=0x158, lDistanceToMove=33342, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x823e [0059.551] CloseHandle (hObject=0x158) returned 1 [0059.552] GetCurrentThreadId () returned 0x970 [0059.552] GetCurrentThreadId () returned 0x970 [0059.552] GetCurrentThreadId () returned 0x970 [0059.552] GetCurrentThreadId () returned 0x970 [0059.552] GetCurrentThreadId () returned 0x970 [0059.552] GetCurrentThreadId () returned 0x970 [0059.552] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\Файл зашифрован [THMBNAIL.PNG].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\Файл зашифрован [thmbnail.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0059.552] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x823e [0059.552] SetFilePointer (in: hFile=0x158, lDistanceToMove=33214, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x81be [0059.552] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0059.552] GetFileType (hFile=0x158) returned 0x1 [0059.552] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x6, wMilliseconds=0x336)) [0059.552] GetCurrentThreadId () returned 0x970 [0059.553] GetCurrentThreadId () returned 0x970 [0059.553] GetCurrentThreadId () returned 0x970 [0059.553] GetCurrentThreadId () returned 0x970 [0059.553] GetCurrentThreadId () returned 0x970 [0059.553] GetCurrentThreadId () returned 0x970 [0059.553] GetCurrentThreadId () returned 0x970 [0059.553] GetCurrentThreadId () returned 0x970 [0059.553] GetCurrentThreadId () returned 0x970 [0059.553] GetCurrentThreadId () returned 0x970 [0059.553] GetCurrentThreadId () returned 0x970 [0059.553] GetCurrentThreadId () returned 0x970 [0059.553] GetCurrentThreadId () returned 0x970 [0059.553] GetCurrentThreadId () returned 0x970 [0059.553] GetCurrentThreadId () returned 0x970 [0059.553] GetCurrentThreadId () returned 0x970 [0059.553] GetCurrentThreadId () returned 0x970 [0059.553] GetCurrentThreadId () returned 0x970 [0059.553] GetCurrentThreadId () returned 0x970 [0059.553] GetCurrentThreadId () returned 0x970 [0059.553] GetCurrentThreadId () returned 0x970 [0059.553] GetCurrentThreadId () returned 0x970 [0059.553] GetCurrentThreadId () returned 0x970 [0059.553] GetCurrentThreadId () returned 0x970 [0059.553] GetCurrentThreadId () returned 0x970 [0059.553] GetCurrentThreadId () returned 0x970 [0059.553] GetCurrentThreadId () returned 0x970 [0059.553] GetCurrentThreadId () returned 0x970 [0059.553] GetCurrentThreadId () returned 0x970 [0059.553] GetCurrentThreadId () returned 0x970 [0059.553] GetCurrentThreadId () returned 0x970 [0059.553] GetCurrentThreadId () returned 0x970 [0059.553] GetCurrentThreadId () returned 0x970 [0059.553] GetCurrentThreadId () returned 0x970 [0059.553] GetCurrentThreadId () returned 0x970 [0059.553] GetCurrentThreadId () returned 0x970 [0059.553] GetCurrentThreadId () returned 0x970 [0059.553] GetCurrentThreadId () returned 0x970 [0059.553] GetCurrentThreadId () returned 0x970 [0059.553] GetCurrentThreadId () returned 0x970 [0059.553] GetCurrentThreadId () returned 0x970 [0059.553] GetCurrentThreadId () returned 0x970 [0059.553] GetCurrentThreadId () returned 0x970 [0059.553] GetCurrentThreadId () returned 0x970 [0059.553] GetCurrentThreadId () returned 0x970 [0059.553] GetCurrentThreadId () returned 0x970 [0059.553] GetCurrentThreadId () returned 0x970 [0059.554] GetCurrentThreadId () returned 0x970 [0059.554] GetCurrentThreadId () returned 0x970 [0059.554] GetCurrentThreadId () returned 0x970 [0059.554] GetCurrentThreadId () returned 0x970 [0059.554] GetCurrentThreadId () returned 0x970 [0059.554] GetCurrentThreadId () returned 0x970 [0059.554] GetCurrentThreadId () returned 0x970 [0059.554] GetCurrentThreadId () returned 0x970 [0059.554] GetCurrentThreadId () returned 0x970 [0059.554] GetCurrentThreadId () returned 0x970 [0059.554] GetCurrentThreadId () returned 0x970 [0059.554] GetCurrentThreadId () returned 0x970 [0059.554] GetCurrentThreadId () returned 0x970 [0059.554] GetCurrentThreadId () returned 0x970 [0059.554] GetCurrentThreadId () returned 0x970 [0059.554] GetCurrentThreadId () returned 0x970 [0059.554] GetCurrentThreadId () returned 0x970 [0059.554] GetCurrentThreadId () returned 0x970 [0059.554] GetCurrentThreadId () returned 0x970 [0059.554] GetCurrentThreadId () returned 0x970 [0059.554] GetCurrentThreadId () returned 0x970 [0059.554] GetCurrentThreadId () returned 0x970 [0059.554] GetCurrentThreadId () returned 0x970 [0059.554] GetCurrentThreadId () returned 0x970 [0059.554] GetCurrentThreadId () returned 0x970 [0059.554] GetCurrentThreadId () returned 0x970 [0059.554] GetCurrentThreadId () returned 0x970 [0059.554] GetCurrentThreadId () returned 0x970 [0059.554] GetCurrentThreadId () returned 0x970 [0059.554] GetCurrentThreadId () returned 0x970 [0059.554] GetCurrentThreadId () returned 0x970 [0059.554] GetCurrentThreadId () returned 0x970 [0059.554] GetCurrentThreadId () returned 0x970 [0059.554] GetCurrentThreadId () returned 0x970 [0059.554] GetCurrentThreadId () returned 0x970 [0059.554] GetCurrentThreadId () returned 0x970 [0059.554] GetCurrentThreadId () returned 0x970 [0059.554] GetCurrentThreadId () returned 0x970 [0059.554] GetCurrentThreadId () returned 0x970 [0059.554] GetCurrentThreadId () returned 0x970 [0059.554] GetCurrentThreadId () returned 0x970 [0059.554] GetCurrentThreadId () returned 0x970 [0059.554] GetCurrentThreadId () returned 0x970 [0059.554] GetCurrentThreadId () returned 0x970 [0059.554] GetCurrentThreadId () returned 0x970 [0059.554] GetCurrentThreadId () returned 0x970 [0059.555] GetCurrentThreadId () returned 0x970 [0059.555] GetCurrentThreadId () returned 0x970 [0059.555] GetCurrentThreadId () returned 0x970 [0059.555] GetCurrentThreadId () returned 0x970 [0059.555] GetCurrentThreadId () returned 0x970 [0059.555] GetCurrentThreadId () returned 0x970 [0059.555] GetCurrentThreadId () returned 0x970 [0059.555] GetCurrentThreadId () returned 0x970 [0059.555] GetCurrentThreadId () returned 0x970 [0059.555] GetCurrentThreadId () returned 0x970 [0059.555] GetCurrentThreadId () returned 0x970 [0059.555] GetCurrentThreadId () returned 0x970 [0059.555] GetCurrentThreadId () returned 0x970 [0059.555] GetCurrentThreadId () returned 0x970 [0059.555] GetCurrentThreadId () returned 0x970 [0059.555] GetCurrentThreadId () returned 0x970 [0059.555] GetCurrentThreadId () returned 0x970 [0059.555] GetCurrentThreadId () returned 0x970 [0059.555] GetCurrentThreadId () returned 0x970 [0059.555] GetCurrentThreadId () returned 0x970 [0059.555] GetCurrentThreadId () returned 0x970 [0059.555] GetCurrentThreadId () returned 0x970 [0059.555] GetCurrentThreadId () returned 0x970 [0059.555] GetCurrentThreadId () returned 0x970 [0059.555] GetCurrentThreadId () returned 0x970 [0059.555] GetCurrentThreadId () returned 0x970 [0059.555] GetCurrentThreadId () returned 0x970 [0059.555] GetCurrentThreadId () returned 0x970 [0059.555] GetCurrentThreadId () returned 0x970 [0059.555] GetCurrentThreadId () returned 0x970 [0059.555] GetCurrentThreadId () returned 0x970 [0059.555] GetCurrentThreadId () returned 0x970 [0059.555] GetCurrentThreadId () returned 0x970 [0059.555] GetCurrentThreadId () returned 0x970 [0059.555] GetCurrentThreadId () returned 0x970 [0059.555] GetCurrentThreadId () returned 0x970 [0059.555] GetCurrentThreadId () returned 0x970 [0059.555] GetCurrentThreadId () returned 0x970 [0059.555] GetCurrentThreadId () returned 0x970 [0059.555] GetCurrentThreadId () returned 0x970 [0059.555] GetCurrentThreadId () returned 0x970 [0059.555] GetCurrentThreadId () returned 0x970 [0059.555] GetCurrentThreadId () returned 0x970 [0059.555] GetCurrentThreadId () returned 0x970 [0059.555] GetCurrentThreadId () returned 0x970 [0059.555] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.555] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.556] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fef150, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0059.556] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.556] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.556] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fef150, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0059.556] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.556] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.556] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0059.556] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.556] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.556] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0059.556] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.556] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.556] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fef1b0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0059.556] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.556] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.556] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fef1b0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0059.556] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.556] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.556] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fef1b0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0059.556] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x6, wMilliseconds=0x336)) [0059.556] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="m^@m/C=rJAoVE?~MxjKAxM*tQF,1tn+n", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0059.556] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="m^@m/C=rJAoVE?~MxjKAxM*tQF,1tn+n", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0059.556] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="m^@m/C=rJAoVE?~MxjKAxM*tQF,1tn+n", cchWideChar=32, lpMultiByteStr=0x20026f8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="m^@m/C=rJAoVE?~MxjKAxM*tQF,1tn+n", lpUsedDefaultChar=0x0) returned 32 [0059.556] GetCurrentThreadId () returned 0x970 [0059.556] GetCurrentThreadId () returned 0x970 [0059.556] GetCurrentThreadId () returned 0x970 [0059.556] GetCurrentThreadId () returned 0x970 [0059.556] GetCurrentThreadId () returned 0x970 [0059.556] GetCurrentThreadId () returned 0x970 [0059.564] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0059.564] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0059.564] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x34f7b38, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0059.564] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0059.564] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAACglS83PDh8i0aH1AgYy5ffwpPh8gjiMLoN7fLh2F6uXs1geNwaGjTomA1PJAysOZumWYEhs3ElqbLNfB2a2IMRR42LerBsBSSXyM127vbEC3S35NLpyj6TvbqX/MbWsaJ3arth9k2RWmrhhhXsqUc1mRd4OsxvouzdD/9V7tleAYVQLYWBH+6GK12cwI8xJ91nGmtH0oU6GZHeQkmtliD7xvQNCL/vwHQ==") returned 232 [0059.564] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x6, wMilliseconds=0x346)) [0059.564] GetCurrentThreadId () returned 0x970 [0059.564] GetCurrentThreadId () returned 0x970 [0059.564] GetCurrentThreadId () returned 0x970 [0059.564] GetCurrentThreadId () returned 0x970 [0059.564] GetCurrentThreadId () returned 0x970 [0059.564] GetCurrentThreadId () returned 0x970 [0059.564] GetCurrentThreadId () returned 0x970 [0059.564] GetCurrentThreadId () returned 0x970 [0059.564] GetCurrentThreadId () returned 0x970 [0059.564] GetCurrentThreadId () returned 0x970 [0059.564] GetCurrentThreadId () returned 0x970 [0059.564] GetCurrentThreadId () returned 0x970 [0059.564] GetCurrentThreadId () returned 0x970 [0059.564] GetCurrentThreadId () returned 0x970 [0059.564] GetCurrentThreadId () returned 0x970 [0059.564] GetCurrentThreadId () returned 0x970 [0059.564] GetCurrentThreadId () returned 0x970 [0059.564] GetCurrentThreadId () returned 0x970 [0059.564] GetCurrentThreadId () returned 0x970 [0059.564] GetCurrentThreadId () returned 0x970 [0059.564] GetCurrentThreadId () returned 0x970 [0059.564] GetCurrentThreadId () returned 0x970 [0059.564] GetCurrentThreadId () returned 0x970 [0059.564] GetCurrentThreadId () returned 0x970 [0059.564] GetCurrentThreadId () returned 0x970 [0059.564] GetCurrentThreadId () returned 0x970 [0059.564] GetCurrentThreadId () returned 0x970 [0059.565] GetCurrentThreadId () returned 0x970 [0059.565] GetCurrentThreadId () returned 0x970 [0059.565] GetCurrentThreadId () returned 0x970 [0059.565] GetCurrentThreadId () returned 0x970 [0059.565] GetCurrentThreadId () returned 0x970 [0059.565] GetCurrentThreadId () returned 0x970 [0059.565] GetCurrentThreadId () returned 0x970 [0059.565] GetCurrentThreadId () returned 0x970 [0059.565] GetCurrentThreadId () returned 0x970 [0059.565] GetCurrentThreadId () returned 0x970 [0059.565] GetCurrentThreadId () returned 0x970 [0059.565] GetCurrentThreadId () returned 0x970 [0059.565] GetCurrentThreadId () returned 0x970 [0059.565] GetCurrentThreadId () returned 0x970 [0059.565] GetCurrentThreadId () returned 0x970 [0059.565] GetCurrentThreadId () returned 0x970 [0059.565] GetCurrentThreadId () returned 0x970 [0059.565] GetCurrentThreadId () returned 0x970 [0059.565] GetCurrentThreadId () returned 0x970 [0059.565] GetCurrentThreadId () returned 0x970 [0059.565] GetCurrentThreadId () returned 0x970 [0059.565] GetCurrentThreadId () returned 0x970 [0059.565] GetCurrentThreadId () returned 0x970 [0059.565] GetCurrentThreadId () returned 0x970 [0059.565] GetCurrentThreadId () returned 0x970 [0059.565] GetCurrentThreadId () returned 0x970 [0059.565] GetCurrentThreadId () returned 0x970 [0059.565] GetCurrentThreadId () returned 0x970 [0059.565] GetCurrentThreadId () returned 0x970 [0059.565] GetCurrentThreadId () returned 0x970 [0059.565] GetCurrentThreadId () returned 0x970 [0059.565] GetCurrentThreadId () returned 0x970 [0059.565] GetCurrentThreadId () returned 0x970 [0059.565] GetCurrentThreadId () returned 0x970 [0059.565] GetCurrentThreadId () returned 0x970 [0059.565] GetCurrentThreadId () returned 0x970 [0059.565] GetCurrentThreadId () returned 0x970 [0059.565] GetCurrentThreadId () returned 0x970 [0059.565] GetCurrentThreadId () returned 0x970 [0059.565] GetCurrentThreadId () returned 0x970 [0059.565] GetCurrentThreadId () returned 0x970 [0059.565] GetCurrentThreadId () returned 0x970 [0059.565] GetCurrentThreadId () returned 0x970 [0059.565] GetCurrentThreadId () returned 0x970 [0059.565] GetCurrentThreadId () returned 0x970 [0059.565] GetCurrentThreadId () returned 0x970 [0059.565] GetCurrentThreadId () returned 0x970 [0059.566] GetCurrentThreadId () returned 0x970 [0059.566] GetCurrentThreadId () returned 0x970 [0059.566] GetCurrentThreadId () returned 0x970 [0059.566] GetCurrentThreadId () returned 0x970 [0059.566] GetCurrentThreadId () returned 0x970 [0059.566] GetCurrentThreadId () returned 0x970 [0059.566] GetCurrentThreadId () returned 0x970 [0059.566] GetCurrentThreadId () returned 0x970 [0059.566] GetCurrentThreadId () returned 0x970 [0059.566] GetCurrentThreadId () returned 0x970 [0059.566] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAACglS83PDh8i0aH1AgYy5ffwpPh8gjiMLoN7fLh2F6uXs1geNwaGjTomA1PJAysOZumWYEhs3ElqbLNfB2a2IMRR42LerBsBSSXyM127vbEC3S35NLpyj6TvbqX/MbWsaJ3arth9k2RWmrhhhXsqUc1mRd4OsxvouzdD/9V7tleAYVQLYWBH+6GK12cwI8xJ91nGmtH0oU6GZHeQkmtliD7xvQNCL/vwHQ==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0059.566] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAACglS83PDh8i0aH1AgYy5ffwpPh8gjiMLoN7fLh2F6uXs1geNwaGjTomA1PJAysOZumWYEhs3ElqbLNfB2a2IMRR42LerBsBSSXyM127vbEC3S35NLpyj6TvbqX/MbWsaJ3arth9k2RWmrhhhXsqUc1mRd4OsxvouzdD/9V7tleAYVQLYWBH+6GK12cwI8xJ91nGmtH0oU6GZHeQkmtliD7xvQNCL/vwHQ==", cchWideChar=245, lpMultiByteStr=0x353933c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAACglS83PDh8i0aH1AgYy5ffwpPh8gjiMLoN7fLh2F6uXs1geNwaGjTomA1PJAysOZumWYEhs3ElqbLNfB2a2IMRR42LerBsBSSXyM127vbEC3S35NLpyj6TvbqX/MbWsaJ3arth9k2RWmrhhhXsqUc1mRd4OsxvouzdD/9V7tleAYVQLYWBH+6GK12cwI8xJ91nGmtH0oU6GZHeQkmtliD7xvQNCL/vwHQ==", lpUsedDefaultChar=0x0) returned 245 [0059.566] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0059.566] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0059.566] CloseHandle (hObject=0x158) returned 1 [0059.567] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png")) returned 1 [0059.568] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=17983132646) returned 1 [0059.568] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\Файл зашифрован [PREVIEW.GIF].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\Файл зашифрован [preview.gif].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0059.570] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0059.570] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0059.570] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0059.570] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0059.570] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0059.570] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0059.570] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0059.570] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0059.570] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0059.570] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0059.570] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0059.570] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0059.570] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0059.571] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0059.571] SetEndOfFile (hFile=0x158) returned 1 [0059.571] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0059.571] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0059.571] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0059.571] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0059.571] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0059.572] WriteFile (in: hFile=0x158, lpBuffer=0x35f011c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f011c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0059.572] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="jq*nk)?*f>Mzk7)x?+dZ49+Oq3)gEu4A", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0059.572] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="jq*nk)?*f>Mzk7)x?+dZ49+Oq3)gEu4A", cchWideChar=32, lpMultiByteStr=0x2034d94, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jq*nk)?*f>Mzk7)x?+dZ49+Oq3)gEu4A", lpUsedDefaultChar=0x0) returned 32 [0059.572] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0059.572] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0059.572] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x785, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 0x295098 [0059.572] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0059.572] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0059.572] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif")) returned 0x20 [0059.572] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif")) returned 0x20 [0059.572] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif")) returned 0x20 [0059.572] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif")) returned 0x20 [0059.572] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x785)) returned 1 [0059.573] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0059.573] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0059.573] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif")) returned 0x20 [0059.573] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif")) returned 0x20 [0059.573] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0059.573] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0059.573] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0059.573] SetEndOfFile (hFile=0x158) returned 1 [0059.574] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0059.574] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe35cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0059.574] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0059.574] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe358c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0059.574] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe358c, cbMultiByte=11, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="PREVIEW.GIFGer.gifg") returned 11 [0059.574] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0059.574] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe35cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0059.574] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0059.574] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0059.574] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x785 [0059.574] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0059.575] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0059.575] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0059.575] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0059.575] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe35cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0059.575] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0059.575] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe358c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0059.575] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe358c, cbMultiByte=11, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="PREVIEW.GIFEW.GIFGer.gifg") returned 11 [0059.575] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0059.575] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe35cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0059.575] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0059.576] CharToOemA (in: pSrc="PREVIEW.GIF", pDst=0x1fe358c | out: pDst="PREVIEW.GIF") returned 1 [0059.576] WriteFile (in: hFile=0x158, lpBuffer=0x1fe358c*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe358c*, lpNumberOfBytesWritten=0x18e048*=0xb, lpOverlapped=0x0) returned 1 [0059.576] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0059.576] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0059.576] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0059.576] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=17983962050) returned 1 [0059.576] ReadFile (in: hFile=0x11c, lpBuffer=0x37a9c60, nNumberOfBytesToRead=0x785, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37a9c60*, lpNumberOfBytesRead=0x18dd7c*=0x785, lpOverlapped=0x0) returned 1 [0059.578] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0059.578] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=17984171669) returned 1 [0059.587] WriteFile (in: hFile=0x158, lpBuffer=0x1fea2a0*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fea2a0*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0059.587] ReadFile (in: hFile=0x11c, lpBuffer=0x37a9c60, nNumberOfBytesToRead=0x785, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x37a9c60*, lpNumberOfBytesRead=0x18de38*=0x785, lpOverlapped=0x0) returned 1 [0059.587] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x46 [0059.587] WriteFile (in: hFile=0x158, lpBuffer=0x37aa420*, nNumberOfBytesToWrite=0x785, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x37aa420*, lpNumberOfBytesWritten=0x18de10*=0x785, lpOverlapped=0x0) returned 1 [0059.587] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x7cb [0059.587] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0059.587] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0059.587] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0059.588] SetFilePointer (in: hFile=0x158, lDistanceToMove=11, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x29 [0059.588] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x7d5 [0059.588] CloseHandle (hObject=0x11c) returned 1 [0059.588] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x7d5 [0059.588] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x7d5 [0059.588] SetFilePointer (in: hFile=0x158, lDistanceToMove=2005, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x7d5 [0059.588] SetFilePointer (in: hFile=0x158, lDistanceToMove=2005, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x7d5 [0059.588] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x7d5 [0059.588] SetFilePointer (in: hFile=0x158, lDistanceToMove=2005, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x7d5 [0059.588] SetEndOfFile (hFile=0x158) returned 1 [0059.588] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x7d5 [0059.588] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x7d5 [0059.588] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0059.588] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe35cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0059.588] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0059.588] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe41ac, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0059.588] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe41ac, cbMultiByte=11, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="PREVIEW.GIF\x18ꞗ@涤(\x18믉`믑`") returned 11 [0059.589] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0059.589] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe35cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0059.589] WriteFile (in: hFile=0x158, lpBuffer=0x378d718*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x378d718*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0059.589] CharToOemA (in: pSrc="PREVIEW.GIF", pDst=0x1fe41ac | out: pDst="PREVIEW.GIF") returned 1 [0059.589] WriteFile (in: hFile=0x158, lpBuffer=0x1fe41ac*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe41ac*, lpNumberOfBytesWritten=0x18efcc*=0xb, lpOverlapped=0x0) returned 1 [0059.589] WriteFile (in: hFile=0x158, lpBuffer=0x1fea170*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea170*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0059.589] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0059.589] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0059.589] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x819 [0059.589] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x819 [0059.589] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0059.589] WriteFile (in: hFile=0x158, lpBuffer=0x35f011c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f011c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0059.589] DeleteFileW (lpFileName="") returned 0 [0059.589] GetLastError () returned 0x3 [0059.589] GetFileAttributesW (lpFileName="") returned 0xffffffff [0059.589] SetLastError (dwErrCode=0x3) [0059.589] FlushFileBuffers (hFile=0x158) returned 1 [0059.592] GetCurrentThreadId () returned 0x970 [0059.592] GetCurrentThreadId () returned 0x970 [0059.592] GetCurrentThreadId () returned 0x970 [0059.592] GetCurrentThreadId () returned 0x970 [0059.592] GetCurrentThreadId () returned 0x970 [0059.592] GetCurrentThreadId () returned 0x970 [0059.592] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x8d0 [0059.592] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x8d0 [0059.593] SetFilePointer (in: hFile=0x158, lDistanceToMove=2256, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x8d0 [0059.593] CloseHandle (hObject=0x158) returned 1 [0059.593] GetCurrentThreadId () returned 0x970 [0059.593] GetCurrentThreadId () returned 0x970 [0059.593] GetCurrentThreadId () returned 0x970 [0059.593] GetCurrentThreadId () returned 0x970 [0059.593] GetCurrentThreadId () returned 0x970 [0059.593] GetCurrentThreadId () returned 0x970 [0059.594] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\Файл зашифрован [PREVIEW.GIF].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\Файл зашифрован [preview.gif].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0059.594] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8d0 [0059.594] SetFilePointer (in: hFile=0x158, lDistanceToMove=2128, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x850 [0059.594] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0059.594] GetFileType (hFile=0x158) returned 0x1 [0059.594] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x6, wMilliseconds=0x365)) [0059.594] GetCurrentThreadId () returned 0x970 [0059.594] GetCurrentThreadId () returned 0x970 [0059.594] GetCurrentThreadId () returned 0x970 [0059.594] GetCurrentThreadId () returned 0x970 [0059.594] GetCurrentThreadId () returned 0x970 [0059.594] GetCurrentThreadId () returned 0x970 [0059.594] GetCurrentThreadId () returned 0x970 [0059.594] GetCurrentThreadId () returned 0x970 [0059.594] GetCurrentThreadId () returned 0x970 [0059.594] GetCurrentThreadId () returned 0x970 [0059.594] GetCurrentThreadId () returned 0x970 [0059.594] GetCurrentThreadId () returned 0x970 [0059.594] GetCurrentThreadId () returned 0x970 [0059.594] GetCurrentThreadId () returned 0x970 [0059.594] GetCurrentThreadId () returned 0x970 [0059.594] GetCurrentThreadId () returned 0x970 [0059.594] GetCurrentThreadId () returned 0x970 [0059.594] GetCurrentThreadId () returned 0x970 [0059.594] GetCurrentThreadId () returned 0x970 [0059.594] GetCurrentThreadId () returned 0x970 [0059.594] GetCurrentThreadId () returned 0x970 [0059.594] GetCurrentThreadId () returned 0x970 [0059.594] GetCurrentThreadId () returned 0x970 [0059.594] GetCurrentThreadId () returned 0x970 [0059.594] GetCurrentThreadId () returned 0x970 [0059.594] GetCurrentThreadId () returned 0x970 [0059.594] GetCurrentThreadId () returned 0x970 [0059.594] GetCurrentThreadId () returned 0x970 [0059.594] GetCurrentThreadId () returned 0x970 [0059.594] GetCurrentThreadId () returned 0x970 [0059.594] GetCurrentThreadId () returned 0x970 [0059.595] GetCurrentThreadId () returned 0x970 [0059.595] GetCurrentThreadId () returned 0x970 [0059.595] GetCurrentThreadId () returned 0x970 [0059.595] GetCurrentThreadId () returned 0x970 [0059.595] GetCurrentThreadId () returned 0x970 [0059.595] GetCurrentThreadId () returned 0x970 [0059.595] GetCurrentThreadId () returned 0x970 [0059.595] GetCurrentThreadId () returned 0x970 [0059.595] GetCurrentThreadId () returned 0x970 [0059.595] GetCurrentThreadId () returned 0x970 [0059.595] GetCurrentThreadId () returned 0x970 [0059.595] GetCurrentThreadId () returned 0x970 [0059.595] GetCurrentThreadId () returned 0x970 [0059.595] GetCurrentThreadId () returned 0x970 [0059.595] GetCurrentThreadId () returned 0x970 [0059.595] GetCurrentThreadId () returned 0x970 [0059.595] GetCurrentThreadId () returned 0x970 [0059.595] GetCurrentThreadId () returned 0x970 [0059.595] GetCurrentThreadId () returned 0x970 [0059.595] GetCurrentThreadId () returned 0x970 [0059.595] GetCurrentThreadId () returned 0x970 [0059.595] GetCurrentThreadId () returned 0x970 [0059.595] GetCurrentThreadId () returned 0x970 [0059.595] GetCurrentThreadId () returned 0x970 [0059.595] GetCurrentThreadId () returned 0x970 [0059.595] GetCurrentThreadId () returned 0x970 [0059.595] GetCurrentThreadId () returned 0x970 [0059.595] GetCurrentThreadId () returned 0x970 [0059.595] GetCurrentThreadId () returned 0x970 [0059.595] GetCurrentThreadId () returned 0x970 [0059.595] GetCurrentThreadId () returned 0x970 [0059.595] GetCurrentThreadId () returned 0x970 [0059.595] GetCurrentThreadId () returned 0x970 [0059.595] GetCurrentThreadId () returned 0x970 [0059.595] GetCurrentThreadId () returned 0x970 [0059.595] GetCurrentThreadId () returned 0x970 [0059.595] GetCurrentThreadId () returned 0x970 [0059.595] GetCurrentThreadId () returned 0x970 [0059.595] GetCurrentThreadId () returned 0x970 [0059.595] GetCurrentThreadId () returned 0x970 [0059.595] GetCurrentThreadId () returned 0x970 [0059.595] GetCurrentThreadId () returned 0x970 [0059.595] GetCurrentThreadId () returned 0x970 [0059.595] GetCurrentThreadId () returned 0x970 [0059.595] GetCurrentThreadId () returned 0x970 [0059.595] GetCurrentThreadId () returned 0x970 [0059.595] GetCurrentThreadId () returned 0x970 [0059.595] GetCurrentThreadId () returned 0x970 [0059.596] GetCurrentThreadId () returned 0x970 [0059.596] GetCurrentThreadId () returned 0x970 [0059.596] GetCurrentThreadId () returned 0x970 [0059.596] GetCurrentThreadId () returned 0x970 [0059.596] GetCurrentThreadId () returned 0x970 [0059.596] GetCurrentThreadId () returned 0x970 [0059.596] GetCurrentThreadId () returned 0x970 [0059.596] GetCurrentThreadId () returned 0x970 [0059.596] GetCurrentThreadId () returned 0x970 [0059.596] GetCurrentThreadId () returned 0x970 [0059.596] GetCurrentThreadId () returned 0x970 [0059.596] GetCurrentThreadId () returned 0x970 [0059.596] GetCurrentThreadId () returned 0x970 [0059.596] GetCurrentThreadId () returned 0x970 [0059.596] GetCurrentThreadId () returned 0x970 [0059.596] GetCurrentThreadId () returned 0x970 [0059.596] GetCurrentThreadId () returned 0x970 [0059.596] GetCurrentThreadId () returned 0x970 [0059.596] GetCurrentThreadId () returned 0x970 [0059.596] GetCurrentThreadId () returned 0x970 [0059.596] GetCurrentThreadId () returned 0x970 [0059.596] GetCurrentThreadId () returned 0x970 [0059.596] GetCurrentThreadId () returned 0x970 [0059.596] GetCurrentThreadId () returned 0x970 [0059.596] GetCurrentThreadId () returned 0x970 [0059.596] GetCurrentThreadId () returned 0x970 [0059.596] GetCurrentThreadId () returned 0x970 [0059.596] GetCurrentThreadId () returned 0x970 [0059.596] GetCurrentThreadId () returned 0x970 [0059.596] GetCurrentThreadId () returned 0x970 [0059.596] GetCurrentThreadId () returned 0x970 [0059.596] GetCurrentThreadId () returned 0x970 [0059.596] GetCurrentThreadId () returned 0x970 [0059.596] GetCurrentThreadId () returned 0x970 [0059.596] GetCurrentThreadId () returned 0x970 [0059.596] GetCurrentThreadId () returned 0x970 [0059.596] GetCurrentThreadId () returned 0x970 [0059.596] GetCurrentThreadId () returned 0x970 [0059.596] GetCurrentThreadId () returned 0x970 [0059.596] GetCurrentThreadId () returned 0x970 [0059.596] GetCurrentThreadId () returned 0x970 [0059.596] GetCurrentThreadId () returned 0x970 [0059.596] GetCurrentThreadId () returned 0x970 [0059.596] GetCurrentThreadId () returned 0x970 [0059.596] GetCurrentThreadId () returned 0x970 [0059.596] GetCurrentThreadId () returned 0x970 [0059.596] GetCurrentThreadId () returned 0x970 [0059.596] GetCurrentThreadId () returned 0x970 [0059.597] GetCurrentThreadId () returned 0x970 [0059.597] GetCurrentThreadId () returned 0x970 [0059.597] GetCurrentThreadId () returned 0x970 [0059.597] GetCurrentThreadId () returned 0x970 [0059.597] GetCurrentThreadId () returned 0x970 [0059.597] GetCurrentThreadId () returned 0x970 [0059.597] GetCurrentThreadId () returned 0x970 [0059.597] GetCurrentThreadId () returned 0x970 [0059.597] GetCurrentThreadId () returned 0x970 [0059.597] GetCurrentThreadId () returned 0x970 [0059.597] GetCurrentThreadId () returned 0x970 [0059.597] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.597] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.597] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fef1b0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0059.597] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.597] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.597] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fef1b0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0059.597] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.597] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.597] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0059.597] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.597] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.597] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0059.597] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.597] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.597] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fef210, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0059.597] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.597] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.597] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fef210, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0059.597] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.597] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.597] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fef210, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0059.597] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x6, wMilliseconds=0x365)) [0059.597] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jq*nk)?*f>Mzk7)x?+dZ49+Oq3)gEu4A", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0059.597] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jq*nk)?*f>Mzk7)x?+dZ49+Oq3)gEu4A", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0059.597] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jq*nk)?*f>Mzk7)x?+dZ49+Oq3)gEu4A", cchWideChar=32, lpMultiByteStr=0x20024e8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jq*nk)?*f>Mzk7)x?+dZ49+Oq3)gEu4A", lpUsedDefaultChar=0x0) returned 32 [0059.598] GetCurrentThreadId () returned 0x970 [0059.598] GetCurrentThreadId () returned 0x970 [0059.598] GetCurrentThreadId () returned 0x970 [0059.598] GetCurrentThreadId () returned 0x970 [0059.598] GetCurrentThreadId () returned 0x970 [0059.598] GetCurrentThreadId () returned 0x970 [0059.605] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0059.605] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0059.605] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x34f7c28, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0059.605] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0059.605] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAADMc081ebfYD2tYZQusZvEE8caZIJ7WTgvDz6QpihppVkE7vbA0Hlw++pWJO3njPV+iUyfgSCxyh4lFv5K3w+rN/m7JhAb0pLk2pWvlehGQqmEXs4kNNIyJtpgfCQ3SZlfS8jwbW5umZJ5DVj+nXuhf0plpFHtmQO+WLRfSI0OpRc+NowskEnQMqaAUdgxw/6c/BohHOWS8D4VouC16fd/DTDaWNABjU+A==") returned 232 [0059.605] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x6, wMilliseconds=0x365)) [0059.605] GetCurrentThreadId () returned 0x970 [0059.605] GetCurrentThreadId () returned 0x970 [0059.605] GetCurrentThreadId () returned 0x970 [0059.605] GetCurrentThreadId () returned 0x970 [0059.605] GetCurrentThreadId () returned 0x970 [0059.605] GetCurrentThreadId () returned 0x970 [0059.605] GetCurrentThreadId () returned 0x970 [0059.605] GetCurrentThreadId () returned 0x970 [0059.605] GetCurrentThreadId () returned 0x970 [0059.605] GetCurrentThreadId () returned 0x970 [0059.605] GetCurrentThreadId () returned 0x970 [0059.605] GetCurrentThreadId () returned 0x970 [0059.605] GetCurrentThreadId () returned 0x970 [0059.605] GetCurrentThreadId () returned 0x970 [0059.605] GetCurrentThreadId () returned 0x970 [0059.605] GetCurrentThreadId () returned 0x970 [0059.605] GetCurrentThreadId () returned 0x970 [0059.606] GetCurrentThreadId () returned 0x970 [0059.606] GetCurrentThreadId () returned 0x970 [0059.606] GetCurrentThreadId () returned 0x970 [0059.606] GetCurrentThreadId () returned 0x970 [0059.606] GetCurrentThreadId () returned 0x970 [0059.606] GetCurrentThreadId () returned 0x970 [0059.606] GetCurrentThreadId () returned 0x970 [0059.606] GetCurrentThreadId () returned 0x970 [0059.606] GetCurrentThreadId () returned 0x970 [0059.606] GetCurrentThreadId () returned 0x970 [0059.606] GetCurrentThreadId () returned 0x970 [0059.606] GetCurrentThreadId () returned 0x970 [0059.606] GetCurrentThreadId () returned 0x970 [0059.606] GetCurrentThreadId () returned 0x970 [0059.606] GetCurrentThreadId () returned 0x970 [0059.606] GetCurrentThreadId () returned 0x970 [0059.606] GetCurrentThreadId () returned 0x970 [0059.606] GetCurrentThreadId () returned 0x970 [0059.606] GetCurrentThreadId () returned 0x970 [0059.606] GetCurrentThreadId () returned 0x970 [0059.606] GetCurrentThreadId () returned 0x970 [0059.606] GetCurrentThreadId () returned 0x970 [0059.606] GetCurrentThreadId () returned 0x970 [0059.606] GetCurrentThreadId () returned 0x970 [0059.606] GetCurrentThreadId () returned 0x970 [0059.606] GetCurrentThreadId () returned 0x970 [0059.606] GetCurrentThreadId () returned 0x970 [0059.606] GetCurrentThreadId () returned 0x970 [0059.606] GetCurrentThreadId () returned 0x970 [0059.606] GetCurrentThreadId () returned 0x970 [0059.606] GetCurrentThreadId () returned 0x970 [0059.606] GetCurrentThreadId () returned 0x970 [0059.606] GetCurrentThreadId () returned 0x970 [0059.606] GetCurrentThreadId () returned 0x970 [0059.606] GetCurrentThreadId () returned 0x970 [0059.606] GetCurrentThreadId () returned 0x970 [0059.606] GetCurrentThreadId () returned 0x970 [0059.606] GetCurrentThreadId () returned 0x970 [0059.606] GetCurrentThreadId () returned 0x970 [0059.606] GetCurrentThreadId () returned 0x970 [0059.606] GetCurrentThreadId () returned 0x970 [0059.606] GetCurrentThreadId () returned 0x970 [0059.606] GetCurrentThreadId () returned 0x970 [0059.606] GetCurrentThreadId () returned 0x970 [0059.606] GetCurrentThreadId () returned 0x970 [0059.606] GetCurrentThreadId () returned 0x970 [0059.606] GetCurrentThreadId () returned 0x970 [0059.607] GetCurrentThreadId () returned 0x970 [0059.607] GetCurrentThreadId () returned 0x970 [0059.607] GetCurrentThreadId () returned 0x970 [0059.607] GetCurrentThreadId () returned 0x970 [0059.607] GetCurrentThreadId () returned 0x970 [0059.607] GetCurrentThreadId () returned 0x970 [0059.607] GetCurrentThreadId () returned 0x970 [0059.607] GetCurrentThreadId () returned 0x970 [0059.607] GetCurrentThreadId () returned 0x970 [0059.607] GetCurrentThreadId () returned 0x970 [0059.607] GetCurrentThreadId () returned 0x970 [0059.607] GetCurrentThreadId () returned 0x970 [0059.607] GetCurrentThreadId () returned 0x970 [0059.607] GetCurrentThreadId () returned 0x970 [0059.607] GetCurrentThreadId () returned 0x970 [0059.607] GetCurrentThreadId () returned 0x970 [0059.607] GetCurrentThreadId () returned 0x970 [0059.607] GetCurrentThreadId () returned 0x970 [0059.607] GetCurrentThreadId () returned 0x970 [0059.607] GetCurrentThreadId () returned 0x970 [0059.607] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAADMc081ebfYD2tYZQusZvEE8caZIJ7WTgvDz6QpihppVkE7vbA0Hlw++pWJO3njPV+iUyfgSCxyh4lFv5K3w+rN/m7JhAb0pLk2pWvlehGQqmEXs4kNNIyJtpgfCQ3SZlfS8jwbW5umZJ5DVj+nXuhf0plpFHtmQO+WLRfSI0OpRc+NowskEnQMqaAUdgxw/6c/BohHOWS8D4VouC16fd/DTDaWNABjU+A==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0059.607] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAADMc081ebfYD2tYZQusZvEE8caZIJ7WTgvDz6QpihppVkE7vbA0Hlw++pWJO3njPV+iUyfgSCxyh4lFv5K3w+rN/m7JhAb0pLk2pWvlehGQqmEXs4kNNIyJtpgfCQ3SZlfS8jwbW5umZJ5DVj+nXuhf0plpFHtmQO+WLRfSI0OpRc+NowskEnQMqaAUdgxw/6c/BohHOWS8D4VouC16fd/DTDaWNABjU+A==", cchWideChar=245, lpMultiByteStr=0x353933c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAADMc081ebfYD2tYZQusZvEE8caZIJ7WTgvDz6QpihppVkE7vbA0Hlw++pWJO3njPV+iUyfgSCxyh4lFv5K3w+rN/m7JhAb0pLk2pWvlehGQqmEXs4kNNIyJtpgfCQ3SZlfS8jwbW5umZJ5DVj+nXuhf0plpFHtmQO+WLRfSI0OpRc+NowskEnQMqaAUdgxw/6c/BohHOWS8D4VouC16fd/DTDaWNABjU+A==", lpUsedDefaultChar=0x0) returned 245 [0059.607] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0059.607] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0059.607] CloseHandle (hObject=0x158) returned 1 [0059.608] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif")) returned 1 [0059.609] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=17987249495) returned 1 [0059.609] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\Файл зашифрован [THMBNAIL.PNG].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\Файл зашифрован [thmbnail.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0059.609] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0059.609] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0059.610] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0059.610] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0059.610] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0059.610] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0059.610] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0059.610] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0059.610] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0059.610] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0059.610] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0059.610] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0059.610] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0059.610] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0059.610] SetEndOfFile (hFile=0x158) returned 1 [0059.610] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0059.610] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0059.610] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0059.610] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0059.611] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0059.611] WriteFile (in: hFile=0x158, lpBuffer=0x35f01dc*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f01dc*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0059.611] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".<(>0TuV0mOTUo+ZV*?0rlTzAT#R{#ff", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0059.611] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".<(>0TuV0mOTUo+ZV*?0rlTzAT#R{#ff", cchWideChar=32, lpMultiByteStr=0x2034dcc, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".<(>0TuV0mOTUo+ZV*?0rlTzAT#R{#ff", lpUsedDefaultChar=0x0) returned 32 [0059.611] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0059.612] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0059.612] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6b0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0x295098 [0059.612] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0059.612] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0059.612] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png")) returned 0x20 [0059.612] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png")) returned 0x20 [0059.612] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png")) returned 0x20 [0059.613] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png")) returned 0x20 [0059.613] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6b0f)) returned 1 [0059.613] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0059.613] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0059.613] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png")) returned 0x20 [0059.613] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png")) returned 0x20 [0059.613] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0059.613] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0059.613] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0059.613] SetEndOfFile (hFile=0x158) returned 1 [0059.614] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0059.614] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe36ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0059.614] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0059.614] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe430c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0059.614] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe430c, cbMultiByte=12, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="THMBNAIL.PNGer.gifg") returned 12 [0059.614] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0059.614] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe36ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0059.614] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0059.614] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0059.614] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x6b0f [0059.614] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0059.615] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0059.615] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0059.615] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0059.615] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe36ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0059.615] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0059.615] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe430c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0059.615] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe430c, cbMultiByte=12, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="THMBNAIL.PNGIL.PNGer.gifg") returned 12 [0059.615] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0059.615] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe36ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0059.615] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0059.616] CharToOemA (in: pSrc="THMBNAIL.PNG", pDst=0x1fe430c | out: pDst="THMBNAIL.PNG") returned 1 [0059.616] WriteFile (in: hFile=0x158, lpBuffer=0x1fe430c*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe430c*, lpNumberOfBytesWritten=0x18e048*=0xc, lpOverlapped=0x0) returned 1 [0059.616] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0059.616] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0059.616] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0059.616] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=17987962127) returned 1 [0059.616] ReadFile (in: hFile=0x11c, lpBuffer=0x37a9c40, nNumberOfBytesToRead=0x6b0f, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37a9c40*, lpNumberOfBytesRead=0x18dd7c*=0x6b0f, lpOverlapped=0x0) returned 1 [0059.703] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0059.703] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=17996651767) returned 1 [0059.711] WriteFile (in: hFile=0x158, lpBuffer=0x1fea288*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fea288*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0059.712] ReadFile (in: hFile=0x11c, lpBuffer=0x37a9c40, nNumberOfBytesToRead=0x6b0f, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x37a9c40*, lpNumberOfBytesRead=0x18de38*=0x6b0f, lpOverlapped=0x0) returned 1 [0059.712] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x47 [0059.712] WriteFile (in: hFile=0x158, lpBuffer=0x37f1f60*, nNumberOfBytesToWrite=0x6b0f, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x37f1f60*, lpNumberOfBytesWritten=0x18de10*=0x6b0f, lpOverlapped=0x0) returned 1 [0059.713] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x6b56 [0059.713] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0059.713] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0059.713] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0059.713] SetFilePointer (in: hFile=0x158, lDistanceToMove=12, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2a [0059.713] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x6b60 [0059.713] CloseHandle (hObject=0x11c) returned 1 [0059.714] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x6b60 [0059.714] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x6b60 [0059.714] SetFilePointer (in: hFile=0x158, lDistanceToMove=27488, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x6b60 [0059.714] SetFilePointer (in: hFile=0x158, lDistanceToMove=27488, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x6b60 [0059.714] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x6b60 [0059.714] SetFilePointer (in: hFile=0x158, lDistanceToMove=27488, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x6b60 [0059.714] SetEndOfFile (hFile=0x158) returned 1 [0059.714] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x6b60 [0059.714] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x6b60 [0059.714] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0059.714] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe36ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0059.714] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0059.714] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe37ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0059.714] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe37ec, cbMultiByte=12, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="THMBNAIL.PNGꞗ@涤(\x18믉`믑`") returned 12 [0059.714] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0059.714] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe36ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0059.714] WriteFile (in: hFile=0x158, lpBuffer=0x378d718*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x378d718*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0059.715] CharToOemA (in: pSrc="THMBNAIL.PNG", pDst=0x1fe37ec | out: pDst="THMBNAIL.PNG") returned 1 [0059.715] WriteFile (in: hFile=0x158, lpBuffer=0x1fe37ec*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe37ec*, lpNumberOfBytesWritten=0x18efcc*=0xc, lpOverlapped=0x0) returned 1 [0059.715] WriteFile (in: hFile=0x158, lpBuffer=0x1fea110*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea110*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0059.715] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0059.715] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0059.715] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x6ba5 [0059.715] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x6ba5 [0059.715] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0059.715] WriteFile (in: hFile=0x158, lpBuffer=0x35f01dc*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f01dc*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0059.715] DeleteFileW (lpFileName="") returned 0 [0059.715] GetLastError () returned 0x3 [0059.715] GetFileAttributesW (lpFileName="") returned 0xffffffff [0059.715] SetLastError (dwErrCode=0x3) [0059.715] FlushFileBuffers (hFile=0x158) returned 1 [0059.721] GetCurrentThreadId () returned 0x970 [0059.721] GetCurrentThreadId () returned 0x970 [0059.721] GetCurrentThreadId () returned 0x970 [0059.721] GetCurrentThreadId () returned 0x970 [0059.721] GetCurrentThreadId () returned 0x970 [0059.721] GetCurrentThreadId () returned 0x970 [0059.721] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x6c5c [0059.721] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x6c5c [0059.721] SetFilePointer (in: hFile=0x158, lDistanceToMove=27740, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x6c5c [0059.721] CloseHandle (hObject=0x158) returned 1 [0059.723] GetCurrentThreadId () returned 0x970 [0059.723] GetCurrentThreadId () returned 0x970 [0059.723] GetCurrentThreadId () returned 0x970 [0059.723] GetCurrentThreadId () returned 0x970 [0059.723] GetCurrentThreadId () returned 0x970 [0059.723] GetCurrentThreadId () returned 0x970 [0059.723] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\Файл зашифрован [THMBNAIL.PNG].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\Файл зашифрован [thmbnail.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0059.723] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6c5c [0059.723] SetFilePointer (in: hFile=0x158, lDistanceToMove=27612, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6bdc [0059.723] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0059.723] GetFileType (hFile=0x158) returned 0x1 [0059.723] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x6, wMilliseconds=0x3e2)) [0059.723] GetCurrentThreadId () returned 0x970 [0059.723] GetCurrentThreadId () returned 0x970 [0059.723] GetCurrentThreadId () returned 0x970 [0059.723] GetCurrentThreadId () returned 0x970 [0059.723] GetCurrentThreadId () returned 0x970 [0059.723] GetCurrentThreadId () returned 0x970 [0059.723] GetCurrentThreadId () returned 0x970 [0059.723] GetCurrentThreadId () returned 0x970 [0059.723] GetCurrentThreadId () returned 0x970 [0059.723] GetCurrentThreadId () returned 0x970 [0059.723] GetCurrentThreadId () returned 0x970 [0059.723] GetCurrentThreadId () returned 0x970 [0059.723] GetCurrentThreadId () returned 0x970 [0059.723] GetCurrentThreadId () returned 0x970 [0059.723] GetCurrentThreadId () returned 0x970 [0059.723] GetCurrentThreadId () returned 0x970 [0059.723] GetCurrentThreadId () returned 0x970 [0059.723] GetCurrentThreadId () returned 0x970 [0059.723] GetCurrentThreadId () returned 0x970 [0059.724] GetCurrentThreadId () returned 0x970 [0059.724] GetCurrentThreadId () returned 0x970 [0059.724] GetCurrentThreadId () returned 0x970 [0059.724] GetCurrentThreadId () returned 0x970 [0059.724] GetCurrentThreadId () returned 0x970 [0059.724] GetCurrentThreadId () returned 0x970 [0059.724] GetCurrentThreadId () returned 0x970 [0059.724] GetCurrentThreadId () returned 0x970 [0059.724] GetCurrentThreadId () returned 0x970 [0059.724] GetCurrentThreadId () returned 0x970 [0059.724] GetCurrentThreadId () returned 0x970 [0059.724] GetCurrentThreadId () returned 0x970 [0059.724] GetCurrentThreadId () returned 0x970 [0059.724] GetCurrentThreadId () returned 0x970 [0059.724] GetCurrentThreadId () returned 0x970 [0059.724] GetCurrentThreadId () returned 0x970 [0059.724] GetCurrentThreadId () returned 0x970 [0059.724] GetCurrentThreadId () returned 0x970 [0059.724] GetCurrentThreadId () returned 0x970 [0059.724] GetCurrentThreadId () returned 0x970 [0059.724] GetCurrentThreadId () returned 0x970 [0059.724] GetCurrentThreadId () returned 0x970 [0059.724] GetCurrentThreadId () returned 0x970 [0059.724] GetCurrentThreadId () returned 0x970 [0059.724] GetCurrentThreadId () returned 0x970 [0059.724] GetCurrentThreadId () returned 0x970 [0059.724] GetCurrentThreadId () returned 0x970 [0059.724] GetCurrentThreadId () returned 0x970 [0059.724] GetCurrentThreadId () returned 0x970 [0059.724] GetCurrentThreadId () returned 0x970 [0059.724] GetCurrentThreadId () returned 0x970 [0059.724] GetCurrentThreadId () returned 0x970 [0059.724] GetCurrentThreadId () returned 0x970 [0059.724] GetCurrentThreadId () returned 0x970 [0059.724] GetCurrentThreadId () returned 0x970 [0059.724] GetCurrentThreadId () returned 0x970 [0059.724] GetCurrentThreadId () returned 0x970 [0059.724] GetCurrentThreadId () returned 0x970 [0059.724] GetCurrentThreadId () returned 0x970 [0059.724] GetCurrentThreadId () returned 0x970 [0059.724] GetCurrentThreadId () returned 0x970 [0059.724] GetCurrentThreadId () returned 0x970 [0059.724] GetCurrentThreadId () returned 0x970 [0059.724] GetCurrentThreadId () returned 0x970 [0059.724] GetCurrentThreadId () returned 0x970 [0059.724] GetCurrentThreadId () returned 0x970 [0059.724] GetCurrentThreadId () returned 0x970 [0059.724] GetCurrentThreadId () returned 0x970 [0059.725] GetCurrentThreadId () returned 0x970 [0059.725] GetCurrentThreadId () returned 0x970 [0059.725] GetCurrentThreadId () returned 0x970 [0059.725] GetCurrentThreadId () returned 0x970 [0059.725] GetCurrentThreadId () returned 0x970 [0059.725] GetCurrentThreadId () returned 0x970 [0059.725] GetCurrentThreadId () returned 0x970 [0059.725] GetCurrentThreadId () returned 0x970 [0059.725] GetCurrentThreadId () returned 0x970 [0059.725] GetCurrentThreadId () returned 0x970 [0059.725] GetCurrentThreadId () returned 0x970 [0059.725] GetCurrentThreadId () returned 0x970 [0059.725] GetCurrentThreadId () returned 0x970 [0059.725] GetCurrentThreadId () returned 0x970 [0059.725] GetCurrentThreadId () returned 0x970 [0059.725] GetCurrentThreadId () returned 0x970 [0059.725] GetCurrentThreadId () returned 0x970 [0059.725] GetCurrentThreadId () returned 0x970 [0059.725] GetCurrentThreadId () returned 0x970 [0059.725] GetCurrentThreadId () returned 0x970 [0059.725] GetCurrentThreadId () returned 0x970 [0059.725] GetCurrentThreadId () returned 0x970 [0059.725] GetCurrentThreadId () returned 0x970 [0059.725] GetCurrentThreadId () returned 0x970 [0059.725] GetCurrentThreadId () returned 0x970 [0059.725] GetCurrentThreadId () returned 0x970 [0059.725] GetCurrentThreadId () returned 0x970 [0059.725] GetCurrentThreadId () returned 0x970 [0059.725] GetCurrentThreadId () returned 0x970 [0059.725] GetCurrentThreadId () returned 0x970 [0059.725] GetCurrentThreadId () returned 0x970 [0059.725] GetCurrentThreadId () returned 0x970 [0059.725] GetCurrentThreadId () returned 0x970 [0059.725] GetCurrentThreadId () returned 0x970 [0059.725] GetCurrentThreadId () returned 0x970 [0059.725] GetCurrentThreadId () returned 0x970 [0059.725] GetCurrentThreadId () returned 0x970 [0059.725] GetCurrentThreadId () returned 0x970 [0059.725] GetCurrentThreadId () returned 0x970 [0059.725] GetCurrentThreadId () returned 0x970 [0059.725] GetCurrentThreadId () returned 0x970 [0059.725] GetCurrentThreadId () returned 0x970 [0059.725] GetCurrentThreadId () returned 0x970 [0059.725] GetCurrentThreadId () returned 0x970 [0059.725] GetCurrentThreadId () returned 0x970 [0059.726] GetCurrentThreadId () returned 0x970 [0059.726] GetCurrentThreadId () returned 0x970 [0059.726] GetCurrentThreadId () returned 0x970 [0059.726] GetCurrentThreadId () returned 0x970 [0059.726] GetCurrentThreadId () returned 0x970 [0059.726] GetCurrentThreadId () returned 0x970 [0059.726] GetCurrentThreadId () returned 0x970 [0059.726] GetCurrentThreadId () returned 0x970 [0059.726] GetCurrentThreadId () returned 0x970 [0059.726] GetCurrentThreadId () returned 0x970 [0059.726] GetCurrentThreadId () returned 0x970 [0059.726] GetCurrentThreadId () returned 0x970 [0059.726] GetCurrentThreadId () returned 0x970 [0059.726] GetCurrentThreadId () returned 0x970 [0059.726] GetCurrentThreadId () returned 0x970 [0059.726] GetCurrentThreadId () returned 0x970 [0059.726] GetCurrentThreadId () returned 0x970 [0059.726] GetCurrentThreadId () returned 0x970 [0059.726] GetCurrentThreadId () returned 0x970 [0059.726] GetCurrentThreadId () returned 0x970 [0059.726] GetCurrentThreadId () returned 0x970 [0059.726] GetCurrentThreadId () returned 0x970 [0059.726] GetCurrentThreadId () returned 0x970 [0059.726] GetCurrentThreadId () returned 0x970 [0059.726] GetCurrentThreadId () returned 0x970 [0059.726] GetCurrentThreadId () returned 0x970 [0059.726] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.726] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.726] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fef210, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0059.726] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.726] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.726] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fef210, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0059.726] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.726] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.726] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0059.726] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.726] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.726] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0059.726] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.726] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.727] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fef270, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0059.727] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.727] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.727] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fef270, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0059.727] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.727] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.727] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fef270, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0059.727] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x6, wMilliseconds=0x3e2)) [0059.727] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr=".<(>0TuV0mOTUo+ZV*?0rlTzAT#R{#ff", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0059.727] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr=".<(>0TuV0mOTUo+ZV*?0rlTzAT#R{#ff", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0059.727] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr=".<(>0TuV0mOTUo+ZV*?0rlTzAT#R{#ff", cchWideChar=32, lpMultiByteStr=0x2002758, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".<(>0TuV0mOTUo+ZV*?0rlTzAT#R{#ff", lpUsedDefaultChar=0x0) returned 32 [0059.727] GetCurrentThreadId () returned 0x970 [0059.727] GetCurrentThreadId () returned 0x970 [0059.727] GetCurrentThreadId () returned 0x970 [0059.727] GetCurrentThreadId () returned 0x970 [0059.727] GetCurrentThreadId () returned 0x970 [0059.727] GetCurrentThreadId () returned 0x970 [0059.734] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0059.734] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0059.734] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x34f7d18, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0059.734] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0059.734] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAGLfdiH/KDNNJiNBMFEf7ldQGOn0Qk2fKTi5VzHeHwsRkzu3c4D4X1cabFZ0oezpU/2oATeGV4VAR436mEiFaFGbgqx49XE02H2C4TzGSfRNiUfsRVm8hCK3gnjZDFZ+aMX7IkxQ15GMM/y+i9Sr7uxP5Bo2o4gdGsJTtrckKQQeb0HLA6utWdBkQbOtwwimJ3CmZ7dGsAcKTjRPs2YpUmJ7q9masmsT2A==") returned 232 [0059.734] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x7, wMilliseconds=0xa)) [0059.735] GetCurrentThreadId () returned 0x970 [0059.735] GetCurrentThreadId () returned 0x970 [0059.735] GetCurrentThreadId () returned 0x970 [0059.735] GetCurrentThreadId () returned 0x970 [0059.735] GetCurrentThreadId () returned 0x970 [0059.735] GetCurrentThreadId () returned 0x970 [0059.735] GetCurrentThreadId () returned 0x970 [0059.735] GetCurrentThreadId () returned 0x970 [0059.735] GetCurrentThreadId () returned 0x970 [0059.735] GetCurrentThreadId () returned 0x970 [0059.735] GetCurrentThreadId () returned 0x970 [0059.735] GetCurrentThreadId () returned 0x970 [0059.735] GetCurrentThreadId () returned 0x970 [0059.735] GetCurrentThreadId () returned 0x970 [0059.735] GetCurrentThreadId () returned 0x970 [0059.735] GetCurrentThreadId () returned 0x970 [0059.735] GetCurrentThreadId () returned 0x970 [0059.735] GetCurrentThreadId () returned 0x970 [0059.735] GetCurrentThreadId () returned 0x970 [0059.735] GetCurrentThreadId () returned 0x970 [0059.735] GetCurrentThreadId () returned 0x970 [0059.735] GetCurrentThreadId () returned 0x970 [0059.735] GetCurrentThreadId () returned 0x970 [0059.735] GetCurrentThreadId () returned 0x970 [0059.735] GetCurrentThreadId () returned 0x970 [0059.735] GetCurrentThreadId () returned 0x970 [0059.735] GetCurrentThreadId () returned 0x970 [0059.735] GetCurrentThreadId () returned 0x970 [0059.735] GetCurrentThreadId () returned 0x970 [0059.735] GetCurrentThreadId () returned 0x970 [0059.735] GetCurrentThreadId () returned 0x970 [0059.735] GetCurrentThreadId () returned 0x970 [0059.735] GetCurrentThreadId () returned 0x970 [0059.735] GetCurrentThreadId () returned 0x970 [0059.735] GetCurrentThreadId () returned 0x970 [0059.735] GetCurrentThreadId () returned 0x970 [0059.735] GetCurrentThreadId () returned 0x970 [0059.735] GetCurrentThreadId () returned 0x970 [0059.735] GetCurrentThreadId () returned 0x970 [0059.735] GetCurrentThreadId () returned 0x970 [0059.735] GetCurrentThreadId () returned 0x970 [0059.735] GetCurrentThreadId () returned 0x970 [0059.735] GetCurrentThreadId () returned 0x970 [0059.735] GetCurrentThreadId () returned 0x970 [0059.735] GetCurrentThreadId () returned 0x970 [0059.735] GetCurrentThreadId () returned 0x970 [0059.735] GetCurrentThreadId () returned 0x970 [0059.736] GetCurrentThreadId () returned 0x970 [0059.736] GetCurrentThreadId () returned 0x970 [0059.736] GetCurrentThreadId () returned 0x970 [0059.736] GetCurrentThreadId () returned 0x970 [0059.736] GetCurrentThreadId () returned 0x970 [0059.736] GetCurrentThreadId () returned 0x970 [0059.736] GetCurrentThreadId () returned 0x970 [0059.736] GetCurrentThreadId () returned 0x970 [0059.736] GetCurrentThreadId () returned 0x970 [0059.736] GetCurrentThreadId () returned 0x970 [0059.736] GetCurrentThreadId () returned 0x970 [0059.736] GetCurrentThreadId () returned 0x970 [0059.736] GetCurrentThreadId () returned 0x970 [0059.736] GetCurrentThreadId () returned 0x970 [0059.736] GetCurrentThreadId () returned 0x970 [0059.736] GetCurrentThreadId () returned 0x970 [0059.736] GetCurrentThreadId () returned 0x970 [0059.736] GetCurrentThreadId () returned 0x970 [0059.736] GetCurrentThreadId () returned 0x970 [0059.736] GetCurrentThreadId () returned 0x970 [0059.736] GetCurrentThreadId () returned 0x970 [0059.736] GetCurrentThreadId () returned 0x970 [0059.736] GetCurrentThreadId () returned 0x970 [0059.736] GetCurrentThreadId () returned 0x970 [0059.736] GetCurrentThreadId () returned 0x970 [0059.736] GetCurrentThreadId () returned 0x970 [0059.736] GetCurrentThreadId () returned 0x970 [0059.736] GetCurrentThreadId () returned 0x970 [0059.736] GetCurrentThreadId () returned 0x970 [0059.736] GetCurrentThreadId () returned 0x970 [0059.736] GetCurrentThreadId () returned 0x970 [0059.736] GetCurrentThreadId () returned 0x970 [0059.736] GetCurrentThreadId () returned 0x970 [0059.736] GetCurrentThreadId () returned 0x970 [0059.736] GetCurrentThreadId () returned 0x970 [0059.736] GetCurrentThreadId () returned 0x970 [0059.736] GetCurrentThreadId () returned 0x970 [0059.736] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAGLfdiH/KDNNJiNBMFEf7ldQGOn0Qk2fKTi5VzHeHwsRkzu3c4D4X1cabFZ0oezpU/2oATeGV4VAR436mEiFaFGbgqx49XE02H2C4TzGSfRNiUfsRVm8hCK3gnjZDFZ+aMX7IkxQ15GMM/y+i9Sr7uxP5Bo2o4gdGsJTtrckKQQeb0HLA6utWdBkQbOtwwimJ3CmZ7dGsAcKTjRPs2YpUmJ7q9masmsT2A==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0059.736] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAGLfdiH/KDNNJiNBMFEf7ldQGOn0Qk2fKTi5VzHeHwsRkzu3c4D4X1cabFZ0oezpU/2oATeGV4VAR436mEiFaFGbgqx49XE02H2C4TzGSfRNiUfsRVm8hCK3gnjZDFZ+aMX7IkxQ15GMM/y+i9Sr7uxP5Bo2o4gdGsJTtrckKQQeb0HLA6utWdBkQbOtwwimJ3CmZ7dGsAcKTjRPs2YpUmJ7q9masmsT2A==", cchWideChar=245, lpMultiByteStr=0x353933c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAGLfdiH/KDNNJiNBMFEf7ldQGOn0Qk2fKTi5VzHeHwsRkzu3c4D4X1cabFZ0oezpU/2oATeGV4VAR436mEiFaFGbgqx49XE02H2C4TzGSfRNiUfsRVm8hCK3gnjZDFZ+aMX7IkxQ15GMM/y+i9Sr7uxP5Bo2o4gdGsJTtrckKQQeb0HLA6utWdBkQbOtwwimJ3CmZ7dGsAcKTjRPs2YpUmJ7q9masmsT2A==", lpUsedDefaultChar=0x0) returned 245 [0059.736] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0059.736] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0059.737] CloseHandle (hObject=0x158) returned 1 [0059.738] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png")) returned 1 [0059.739] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=18000202236) returned 1 [0059.739] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\Файл зашифрован [PREVIEW.GIF].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\Файл зашифрован [preview.gif].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0059.740] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0059.740] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0059.741] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0059.741] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0059.741] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0059.741] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0059.741] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0059.741] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0059.741] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0059.741] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0059.741] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0059.741] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0059.741] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0059.741] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0059.741] SetEndOfFile (hFile=0x158) returned 1 [0059.741] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0059.742] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0059.742] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0059.742] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0059.742] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0059.743] WriteFile (in: hFile=0x158, lpBuffer=0x35f011c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f011c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0059.743] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="7&aXLl+\"ad})44y#MA#pI{7-6pJqiG?X", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0059.743] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="7&aXLl+\"ad})44y#MA#pI{7-6pJqiG?X", cchWideChar=32, lpMultiByteStr=0x2034e04, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7&aXLl+\"ad})44y#MA#pI{7-6pJqiG?X", lpUsedDefaultChar=0x0) returned 32 [0059.743] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0059.743] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0059.743] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xd97, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 0x295098 [0059.743] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0059.743] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0059.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif")) returned 0x20 [0059.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif")) returned 0x20 [0059.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif")) returned 0x20 [0059.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif")) returned 0x20 [0059.743] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xd97)) returned 1 [0059.743] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0059.744] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0059.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif")) returned 0x20 [0059.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif")) returned 0x20 [0059.744] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0059.744] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0059.744] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0059.744] SetEndOfFile (hFile=0x158) returned 1 [0059.745] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0059.745] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe410c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0059.745] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0059.745] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe432c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0059.745] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe432c, cbMultiByte=11, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="PREVIEW.GIFGer.gifg") returned 11 [0059.745] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0059.745] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe410c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0059.745] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0059.745] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0059.745] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0xd97 [0059.745] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0059.745] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0059.745] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0059.745] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0059.745] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe410c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0059.746] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0059.746] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe432c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0059.746] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe432c, cbMultiByte=11, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="PREVIEW.GIFEW.GIFGer.gifg") returned 11 [0059.746] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0059.746] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe410c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0059.746] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0059.747] CharToOemA (in: pSrc="PREVIEW.GIF", pDst=0x1fe432c | out: pDst="PREVIEW.GIF") returned 1 [0059.747] WriteFile (in: hFile=0x158, lpBuffer=0x1fe432c*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe432c*, lpNumberOfBytesWritten=0x18e048*=0xb, lpOverlapped=0x0) returned 1 [0059.747] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0059.747] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0059.747] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0059.747] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=18001054576) returned 1 [0059.747] ReadFile (in: hFile=0x11c, lpBuffer=0x37a9c40, nNumberOfBytesToRead=0xd97, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37a9c40*, lpNumberOfBytesRead=0x18dd7c*=0xd97, lpOverlapped=0x0) returned 1 [0059.748] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0059.748] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=18001189167) returned 1 [0059.757] WriteFile (in: hFile=0x158, lpBuffer=0x1fea3d8*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fea3d8*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0059.757] ReadFile (in: hFile=0x11c, lpBuffer=0x37a9c40, nNumberOfBytesToRead=0xd97, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x37a9c40*, lpNumberOfBytesRead=0x18de38*=0xd97, lpOverlapped=0x0) returned 1 [0059.757] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x46 [0059.757] WriteFile (in: hFile=0x158, lpBuffer=0x37ec260*, nNumberOfBytesToWrite=0xd97, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x37ec260*, lpNumberOfBytesWritten=0x18de10*=0xd97, lpOverlapped=0x0) returned 1 [0059.758] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0xddd [0059.758] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0059.758] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0059.758] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0059.758] SetFilePointer (in: hFile=0x158, lDistanceToMove=11, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x29 [0059.758] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0xde7 [0059.758] CloseHandle (hObject=0x11c) returned 1 [0059.758] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xde7 [0059.758] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xde7 [0059.758] SetFilePointer (in: hFile=0x158, lDistanceToMove=3559, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xde7 [0059.758] SetFilePointer (in: hFile=0x158, lDistanceToMove=3559, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0xde7 [0059.758] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xde7 [0059.758] SetFilePointer (in: hFile=0x158, lDistanceToMove=3559, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0xde7 [0059.758] SetEndOfFile (hFile=0x158) returned 1 [0059.758] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xde7 [0059.759] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xde7 [0059.759] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0059.759] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe410c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0059.759] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0059.759] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe41ac, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0059.759] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe41ac, cbMultiByte=11, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="PREVIEW.GIF\x18ꞗ@涤(\x18믉`믑`") returned 11 [0059.759] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0059.759] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe410c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0059.759] WriteFile (in: hFile=0x158, lpBuffer=0x378d718*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x378d718*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0059.759] CharToOemA (in: pSrc="PREVIEW.GIF", pDst=0x1fe41ac | out: pDst="PREVIEW.GIF") returned 1 [0059.759] WriteFile (in: hFile=0x158, lpBuffer=0x1fe41ac*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe41ac*, lpNumberOfBytesWritten=0x18efcc*=0xb, lpOverlapped=0x0) returned 1 [0059.759] WriteFile (in: hFile=0x158, lpBuffer=0x1fea2d8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea2d8*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0059.759] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0059.759] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0059.759] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xe2b [0059.759] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xe2b [0059.759] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0059.760] WriteFile (in: hFile=0x158, lpBuffer=0x35f011c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f011c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0059.760] DeleteFileW (lpFileName="") returned 0 [0059.760] GetLastError () returned 0x3 [0059.760] GetFileAttributesW (lpFileName="") returned 0xffffffff [0059.760] SetLastError (dwErrCode=0x3) [0059.760] FlushFileBuffers (hFile=0x158) returned 1 [0059.763] GetCurrentThreadId () returned 0x970 [0059.763] GetCurrentThreadId () returned 0x970 [0059.763] GetCurrentThreadId () returned 0x970 [0059.763] GetCurrentThreadId () returned 0x970 [0059.763] GetCurrentThreadId () returned 0x970 [0059.763] GetCurrentThreadId () returned 0x970 [0059.763] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xee2 [0059.763] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xee2 [0059.763] SetFilePointer (in: hFile=0x158, lDistanceToMove=3810, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xee2 [0059.763] CloseHandle (hObject=0x158) returned 1 [0059.764] GetCurrentThreadId () returned 0x970 [0059.764] GetCurrentThreadId () returned 0x970 [0059.764] GetCurrentThreadId () returned 0x970 [0059.764] GetCurrentThreadId () returned 0x970 [0059.764] GetCurrentThreadId () returned 0x970 [0059.764] GetCurrentThreadId () returned 0x970 [0059.764] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\Файл зашифрован [PREVIEW.GIF].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\Файл зашифрован [preview.gif].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0059.765] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xee2 [0059.765] SetFilePointer (in: hFile=0x158, lDistanceToMove=3682, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe62 [0059.765] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0059.765] GetFileType (hFile=0x158) returned 0x1 [0059.765] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x7, wMilliseconds=0x29)) [0059.765] GetCurrentThreadId () returned 0x970 [0059.765] GetCurrentThreadId () returned 0x970 [0059.765] GetCurrentThreadId () returned 0x970 [0059.765] GetCurrentThreadId () returned 0x970 [0059.765] GetCurrentThreadId () returned 0x970 [0059.765] GetCurrentThreadId () returned 0x970 [0059.765] GetCurrentThreadId () returned 0x970 [0059.765] GetCurrentThreadId () returned 0x970 [0059.765] GetCurrentThreadId () returned 0x970 [0059.765] GetCurrentThreadId () returned 0x970 [0059.765] GetCurrentThreadId () returned 0x970 [0059.765] GetCurrentThreadId () returned 0x970 [0059.765] GetCurrentThreadId () returned 0x970 [0059.765] GetCurrentThreadId () returned 0x970 [0059.765] GetCurrentThreadId () returned 0x970 [0059.765] GetCurrentThreadId () returned 0x970 [0059.765] GetCurrentThreadId () returned 0x970 [0059.765] GetCurrentThreadId () returned 0x970 [0059.765] GetCurrentThreadId () returned 0x970 [0059.765] GetCurrentThreadId () returned 0x970 [0059.765] GetCurrentThreadId () returned 0x970 [0059.765] GetCurrentThreadId () returned 0x970 [0059.765] GetCurrentThreadId () returned 0x970 [0059.765] GetCurrentThreadId () returned 0x970 [0059.765] GetCurrentThreadId () returned 0x970 [0059.765] GetCurrentThreadId () returned 0x970 [0059.765] GetCurrentThreadId () returned 0x970 [0059.765] GetCurrentThreadId () returned 0x970 [0059.765] GetCurrentThreadId () returned 0x970 [0059.765] GetCurrentThreadId () returned 0x970 [0059.765] GetCurrentThreadId () returned 0x970 [0059.765] GetCurrentThreadId () returned 0x970 [0059.765] GetCurrentThreadId () returned 0x970 [0059.765] GetCurrentThreadId () returned 0x970 [0059.766] GetCurrentThreadId () returned 0x970 [0059.766] GetCurrentThreadId () returned 0x970 [0059.766] GetCurrentThreadId () returned 0x970 [0059.766] GetCurrentThreadId () returned 0x970 [0059.766] GetCurrentThreadId () returned 0x970 [0059.766] GetCurrentThreadId () returned 0x970 [0059.766] GetCurrentThreadId () returned 0x970 [0059.766] GetCurrentThreadId () returned 0x970 [0059.766] GetCurrentThreadId () returned 0x970 [0059.766] GetCurrentThreadId () returned 0x970 [0059.766] GetCurrentThreadId () returned 0x970 [0059.766] GetCurrentThreadId () returned 0x970 [0059.766] GetCurrentThreadId () returned 0x970 [0059.766] GetCurrentThreadId () returned 0x970 [0059.766] GetCurrentThreadId () returned 0x970 [0059.766] GetCurrentThreadId () returned 0x970 [0059.766] GetCurrentThreadId () returned 0x970 [0059.766] GetCurrentThreadId () returned 0x970 [0059.766] GetCurrentThreadId () returned 0x970 [0059.766] GetCurrentThreadId () returned 0x970 [0059.766] GetCurrentThreadId () returned 0x970 [0059.766] GetCurrentThreadId () returned 0x970 [0059.766] GetCurrentThreadId () returned 0x970 [0059.766] GetCurrentThreadId () returned 0x970 [0059.766] GetCurrentThreadId () returned 0x970 [0059.766] GetCurrentThreadId () returned 0x970 [0059.766] GetCurrentThreadId () returned 0x970 [0059.766] GetCurrentThreadId () returned 0x970 [0059.766] GetCurrentThreadId () returned 0x970 [0059.766] GetCurrentThreadId () returned 0x970 [0059.766] GetCurrentThreadId () returned 0x970 [0059.766] GetCurrentThreadId () returned 0x970 [0059.766] GetCurrentThreadId () returned 0x970 [0059.766] GetCurrentThreadId () returned 0x970 [0059.766] GetCurrentThreadId () returned 0x970 [0059.766] GetCurrentThreadId () returned 0x970 [0059.766] GetCurrentThreadId () returned 0x970 [0059.766] GetCurrentThreadId () returned 0x970 [0059.766] GetCurrentThreadId () returned 0x970 [0059.766] GetCurrentThreadId () returned 0x970 [0059.766] GetCurrentThreadId () returned 0x970 [0059.766] GetCurrentThreadId () returned 0x970 [0059.766] GetCurrentThreadId () returned 0x970 [0059.766] GetCurrentThreadId () returned 0x970 [0059.766] GetCurrentThreadId () returned 0x970 [0059.766] GetCurrentThreadId () returned 0x970 [0059.766] GetCurrentThreadId () returned 0x970 [0059.767] GetCurrentThreadId () returned 0x970 [0059.767] GetCurrentThreadId () returned 0x970 [0059.767] GetCurrentThreadId () returned 0x970 [0059.767] GetCurrentThreadId () returned 0x970 [0059.767] GetCurrentThreadId () returned 0x970 [0059.767] GetCurrentThreadId () returned 0x970 [0059.767] GetCurrentThreadId () returned 0x970 [0059.767] GetCurrentThreadId () returned 0x970 [0059.767] GetCurrentThreadId () returned 0x970 [0059.767] GetCurrentThreadId () returned 0x970 [0059.767] GetCurrentThreadId () returned 0x970 [0059.767] GetCurrentThreadId () returned 0x970 [0059.767] GetCurrentThreadId () returned 0x970 [0059.767] GetCurrentThreadId () returned 0x970 [0059.767] GetCurrentThreadId () returned 0x970 [0059.767] GetCurrentThreadId () returned 0x970 [0059.767] GetCurrentThreadId () returned 0x970 [0059.767] GetCurrentThreadId () returned 0x970 [0059.767] GetCurrentThreadId () returned 0x970 [0059.767] GetCurrentThreadId () returned 0x970 [0059.767] GetCurrentThreadId () returned 0x970 [0059.767] GetCurrentThreadId () returned 0x970 [0059.767] GetCurrentThreadId () returned 0x970 [0059.767] GetCurrentThreadId () returned 0x970 [0059.767] GetCurrentThreadId () returned 0x970 [0059.767] GetCurrentThreadId () returned 0x970 [0059.767] GetCurrentThreadId () returned 0x970 [0059.767] GetCurrentThreadId () returned 0x970 [0059.767] GetCurrentThreadId () returned 0x970 [0059.767] GetCurrentThreadId () returned 0x970 [0059.767] GetCurrentThreadId () returned 0x970 [0059.767] GetCurrentThreadId () returned 0x970 [0059.767] GetCurrentThreadId () returned 0x970 [0059.767] GetCurrentThreadId () returned 0x970 [0059.767] GetCurrentThreadId () returned 0x970 [0059.767] GetCurrentThreadId () returned 0x970 [0059.767] GetCurrentThreadId () returned 0x970 [0059.767] GetCurrentThreadId () returned 0x970 [0059.767] GetCurrentThreadId () returned 0x970 [0059.767] GetCurrentThreadId () returned 0x970 [0059.767] GetCurrentThreadId () returned 0x970 [0059.767] GetCurrentThreadId () returned 0x970 [0059.767] GetCurrentThreadId () returned 0x970 [0059.767] GetCurrentThreadId () returned 0x970 [0059.767] GetCurrentThreadId () returned 0x970 [0059.768] GetCurrentThreadId () returned 0x970 [0059.768] GetCurrentThreadId () returned 0x970 [0059.768] GetCurrentThreadId () returned 0x970 [0059.768] GetCurrentThreadId () returned 0x970 [0059.768] GetCurrentThreadId () returned 0x970 [0059.768] GetCurrentThreadId () returned 0x970 [0059.768] GetCurrentThreadId () returned 0x970 [0059.768] GetCurrentThreadId () returned 0x970 [0059.768] GetCurrentThreadId () returned 0x970 [0059.768] GetCurrentThreadId () returned 0x970 [0059.768] GetCurrentThreadId () returned 0x970 [0059.768] GetCurrentThreadId () returned 0x970 [0059.768] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.768] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.768] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fef270, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0059.768] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.768] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.768] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fef270, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0059.768] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.768] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.768] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0059.768] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.768] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.768] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0059.768] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.768] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.768] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fef2d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0059.768] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.768] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.768] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fef2d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0059.768] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.768] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.768] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fef2d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0059.768] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x7, wMilliseconds=0x29)) [0059.768] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="7&aXLl+\"ad})44y#MA#pI{7-6pJqiG?X", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0059.768] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="7&aXLl+\"ad})44y#MA#pI{7-6pJqiG?X", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0059.769] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="7&aXLl+\"ad})44y#MA#pI{7-6pJqiG?X", cchWideChar=32, lpMultiByteStr=0x20024e8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7&aXLl+\"ad})44y#MA#pI{7-6pJqiG?X", lpUsedDefaultChar=0x0) returned 32 [0059.769] GetCurrentThreadId () returned 0x970 [0059.769] GetCurrentThreadId () returned 0x970 [0059.769] GetCurrentThreadId () returned 0x970 [0059.769] GetCurrentThreadId () returned 0x970 [0059.769] GetCurrentThreadId () returned 0x970 [0059.769] GetCurrentThreadId () returned 0x970 [0059.776] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0059.776] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0059.776] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x34f7e08, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0059.776] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0059.776] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAHnOJNNdnYNA+o2PHQ1OGsPbsTX0vFc6aJ5SlAxlIa8/xDVMDWcxGZnyPdboC17az6zM3/O8m0yVmk442tJ6oaTAEV0fKqKXGVd9E4Nma4kcXPzFdMwJ97mrBpl19xdfYcYLFylSw5tuNqT5fmryPGZ7kUxr7O4flQId2+NCYWRjqg/15V6C8JeSTxo4hcq76XfX+6ajYRMKTLlD8s0z5A7tvkNqJXxNZA==") returned 232 [0059.776] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x7, wMilliseconds=0x29)) [0059.776] GetCurrentThreadId () returned 0x970 [0059.776] GetCurrentThreadId () returned 0x970 [0059.776] GetCurrentThreadId () returned 0x970 [0059.776] GetCurrentThreadId () returned 0x970 [0059.776] GetCurrentThreadId () returned 0x970 [0059.776] GetCurrentThreadId () returned 0x970 [0059.776] GetCurrentThreadId () returned 0x970 [0059.776] GetCurrentThreadId () returned 0x970 [0059.776] GetCurrentThreadId () returned 0x970 [0059.776] GetCurrentThreadId () returned 0x970 [0059.776] GetCurrentThreadId () returned 0x970 [0059.776] GetCurrentThreadId () returned 0x970 [0059.776] GetCurrentThreadId () returned 0x970 [0059.776] GetCurrentThreadId () returned 0x970 [0059.776] GetCurrentThreadId () returned 0x970 [0059.776] GetCurrentThreadId () returned 0x970 [0059.776] GetCurrentThreadId () returned 0x970 [0059.776] GetCurrentThreadId () returned 0x970 [0059.776] GetCurrentThreadId () returned 0x970 [0059.776] GetCurrentThreadId () returned 0x970 [0059.777] GetCurrentThreadId () returned 0x970 [0059.777] GetCurrentThreadId () returned 0x970 [0059.777] GetCurrentThreadId () returned 0x970 [0059.777] GetCurrentThreadId () returned 0x970 [0059.777] GetCurrentThreadId () returned 0x970 [0059.777] GetCurrentThreadId () returned 0x970 [0059.777] GetCurrentThreadId () returned 0x970 [0059.777] GetCurrentThreadId () returned 0x970 [0059.777] GetCurrentThreadId () returned 0x970 [0059.777] GetCurrentThreadId () returned 0x970 [0059.777] GetCurrentThreadId () returned 0x970 [0059.777] GetCurrentThreadId () returned 0x970 [0059.777] GetCurrentThreadId () returned 0x970 [0059.777] GetCurrentThreadId () returned 0x970 [0059.777] GetCurrentThreadId () returned 0x970 [0059.777] GetCurrentThreadId () returned 0x970 [0059.777] GetCurrentThreadId () returned 0x970 [0059.777] GetCurrentThreadId () returned 0x970 [0059.777] GetCurrentThreadId () returned 0x970 [0059.777] GetCurrentThreadId () returned 0x970 [0059.777] GetCurrentThreadId () returned 0x970 [0059.777] GetCurrentThreadId () returned 0x970 [0059.777] GetCurrentThreadId () returned 0x970 [0059.777] GetCurrentThreadId () returned 0x970 [0059.777] GetCurrentThreadId () returned 0x970 [0059.777] GetCurrentThreadId () returned 0x970 [0059.777] GetCurrentThreadId () returned 0x970 [0059.777] GetCurrentThreadId () returned 0x970 [0059.777] GetCurrentThreadId () returned 0x970 [0059.777] GetCurrentThreadId () returned 0x970 [0059.777] GetCurrentThreadId () returned 0x970 [0059.777] GetCurrentThreadId () returned 0x970 [0059.777] GetCurrentThreadId () returned 0x970 [0059.777] GetCurrentThreadId () returned 0x970 [0059.777] GetCurrentThreadId () returned 0x970 [0059.777] GetCurrentThreadId () returned 0x970 [0059.777] GetCurrentThreadId () returned 0x970 [0059.777] GetCurrentThreadId () returned 0x970 [0059.777] GetCurrentThreadId () returned 0x970 [0059.777] GetCurrentThreadId () returned 0x970 [0059.777] GetCurrentThreadId () returned 0x970 [0059.777] GetCurrentThreadId () returned 0x970 [0059.777] GetCurrentThreadId () returned 0x970 [0059.777] GetCurrentThreadId () returned 0x970 [0059.777] GetCurrentThreadId () returned 0x970 [0059.778] GetCurrentThreadId () returned 0x970 [0059.778] GetCurrentThreadId () returned 0x970 [0059.778] GetCurrentThreadId () returned 0x970 [0059.778] GetCurrentThreadId () returned 0x970 [0059.778] GetCurrentThreadId () returned 0x970 [0059.778] GetCurrentThreadId () returned 0x970 [0059.778] GetCurrentThreadId () returned 0x970 [0059.778] GetCurrentThreadId () returned 0x970 [0059.778] GetCurrentThreadId () returned 0x970 [0059.778] GetCurrentThreadId () returned 0x970 [0059.778] GetCurrentThreadId () returned 0x970 [0059.778] GetCurrentThreadId () returned 0x970 [0059.778] GetCurrentThreadId () returned 0x970 [0059.778] GetCurrentThreadId () returned 0x970 [0059.778] GetCurrentThreadId () returned 0x970 [0059.778] GetCurrentThreadId () returned 0x970 [0059.778] GetCurrentThreadId () returned 0x970 [0059.778] GetCurrentThreadId () returned 0x970 [0059.778] GetCurrentThreadId () returned 0x970 [0059.778] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAHnOJNNdnYNA+o2PHQ1OGsPbsTX0vFc6aJ5SlAxlIa8/xDVMDWcxGZnyPdboC17az6zM3/O8m0yVmk442tJ6oaTAEV0fKqKXGVd9E4Nma4kcXPzFdMwJ97mrBpl19xdfYcYLFylSw5tuNqT5fmryPGZ7kUxr7O4flQId2+NCYWRjqg/15V6C8JeSTxo4hcq76XfX+6ajYRMKTLlD8s0z5A7tvkNqJXxNZA==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0059.778] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAHnOJNNdnYNA+o2PHQ1OGsPbsTX0vFc6aJ5SlAxlIa8/xDVMDWcxGZnyPdboC17az6zM3/O8m0yVmk442tJ6oaTAEV0fKqKXGVd9E4Nma4kcXPzFdMwJ97mrBpl19xdfYcYLFylSw5tuNqT5fmryPGZ7kUxr7O4flQId2+NCYWRjqg/15V6C8JeSTxo4hcq76XfX+6ajYRMKTLlD8s0z5A7tvkNqJXxNZA==", cchWideChar=245, lpMultiByteStr=0x353933c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAHnOJNNdnYNA+o2PHQ1OGsPbsTX0vFc6aJ5SlAxlIa8/xDVMDWcxGZnyPdboC17az6zM3/O8m0yVmk442tJ6oaTAEV0fKqKXGVd9E4Nma4kcXPzFdMwJ97mrBpl19xdfYcYLFylSw5tuNqT5fmryPGZ7kUxr7O4flQId2+NCYWRjqg/15V6C8JeSTxo4hcq76XfX+6ajYRMKTLlD8s0z5A7tvkNqJXxNZA==", lpUsedDefaultChar=0x0) returned 245 [0059.778] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0059.778] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0059.778] CloseHandle (hObject=0x158) returned 1 [0059.779] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif")) returned 1 [0059.780] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=18004319931) returned 1 [0059.780] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\Файл зашифрован [THMBNAIL.PNG].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\Файл зашифрован [thmbnail.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0059.780] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0059.780] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0059.780] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0059.780] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0059.780] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0059.780] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0059.780] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0059.780] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0059.781] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0059.781] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0059.781] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0059.781] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0059.781] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0059.781] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0059.781] SetEndOfFile (hFile=0x158) returned 1 [0059.781] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0059.781] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0059.781] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0059.781] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0059.781] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0059.782] WriteFile (in: hFile=0x158, lpBuffer=0x35f01dc*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f01dc*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0059.782] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="#8(U0KJeaqB/PYR\"t1Y=TP7n.=7y!Ql0", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0059.782] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="#8(U0KJeaqB/PYR\"t1Y=TP7n.=7y!Ql0", cchWideChar=32, lpMultiByteStr=0x2034e3c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="#8(U0KJeaqB/PYR\"t1Y=TP7n.=7y!Ql0", lpUsedDefaultChar=0x0) returned 32 [0059.782] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0059.782] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0059.782] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7c5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0x295098 [0059.782] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0059.782] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0059.782] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png")) returned 0x20 [0059.783] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png")) returned 0x20 [0059.783] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png")) returned 0x20 [0059.783] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png")) returned 0x20 [0059.783] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7c5d)) returned 1 [0059.783] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0059.783] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0059.783] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png")) returned 0x20 [0059.783] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png")) returned 0x20 [0059.783] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0059.783] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0059.783] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0059.783] SetEndOfFile (hFile=0x158) returned 1 [0059.784] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0059.784] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe370c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0059.784] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0059.784] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe368c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0059.784] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe368c, cbMultiByte=12, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="THMBNAIL.PNGer.gifg") returned 12 [0059.784] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0059.784] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe370c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0059.784] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0059.784] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0059.784] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x7c5d [0059.785] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0059.785] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0059.785] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0059.785] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0059.785] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe370c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0059.785] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0059.785] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe368c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0059.785] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe368c, cbMultiByte=12, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="THMBNAIL.PNGIL.PNGer.gifg") returned 12 [0059.785] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0059.785] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe370c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0059.785] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0059.786] CharToOemA (in: pSrc="THMBNAIL.PNG", pDst=0x1fe368c | out: pDst="THMBNAIL.PNG") returned 1 [0059.786] WriteFile (in: hFile=0x158, lpBuffer=0x1fe368c*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe368c*, lpNumberOfBytesWritten=0x18e048*=0xc, lpOverlapped=0x0) returned 1 [0059.787] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0059.787] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0059.787] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0059.787] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=18005026040) returned 1 [0059.787] ReadFile (in: hFile=0x11c, lpBuffer=0x37a9c40, nNumberOfBytesToRead=0x7c5d, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37a9c40*, lpNumberOfBytesRead=0x18dd7c*=0x7c5d, lpOverlapped=0x0) returned 1 [0059.826] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0059.826] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=18008965068) returned 1 [0059.835] WriteFile (in: hFile=0x158, lpBuffer=0x1fea120*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fea120*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0059.835] ReadFile (in: hFile=0x11c, lpBuffer=0x37a9c40, nNumberOfBytesToRead=0x7c5d, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x37a9c40*, lpNumberOfBytesRead=0x18de38*=0x7c5d, lpOverlapped=0x0) returned 1 [0059.836] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x47 [0059.836] WriteFile (in: hFile=0x158, lpBuffer=0x37f3160*, nNumberOfBytesToWrite=0x7c5d, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x37f3160*, lpNumberOfBytesWritten=0x18de10*=0x7c5d, lpOverlapped=0x0) returned 1 [0059.836] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x7ca4 [0059.836] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0059.836] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0059.836] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0059.837] SetFilePointer (in: hFile=0x158, lDistanceToMove=12, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2a [0059.837] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x7cae [0059.837] CloseHandle (hObject=0x11c) returned 1 [0059.837] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x7cae [0059.837] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x7cae [0059.837] SetFilePointer (in: hFile=0x158, lDistanceToMove=31918, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x7cae [0059.837] SetFilePointer (in: hFile=0x158, lDistanceToMove=31918, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x7cae [0059.837] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x7cae [0059.837] SetFilePointer (in: hFile=0x158, lDistanceToMove=31918, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x7cae [0059.837] SetEndOfFile (hFile=0x158) returned 1 [0059.837] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x7cae [0059.837] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x7cae [0059.837] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0059.837] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe370c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0059.838] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0059.838] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe37ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0059.838] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe37ec, cbMultiByte=12, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="THMBNAIL.PNGꞗ@涤(\x18믉`믑`") returned 12 [0059.838] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0059.838] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe370c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0059.838] WriteFile (in: hFile=0x158, lpBuffer=0x378d718*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x378d718*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0059.838] CharToOemA (in: pSrc="THMBNAIL.PNG", pDst=0x1fe37ec | out: pDst="THMBNAIL.PNG") returned 1 [0059.838] WriteFile (in: hFile=0x158, lpBuffer=0x1fe37ec*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe37ec*, lpNumberOfBytesWritten=0x18efcc*=0xc, lpOverlapped=0x0) returned 1 [0059.838] WriteFile (in: hFile=0x158, lpBuffer=0x1fea170*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea170*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0059.838] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0059.838] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0059.838] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x7cf3 [0059.838] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x7cf3 [0059.838] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0059.838] WriteFile (in: hFile=0x158, lpBuffer=0x35f01dc*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f01dc*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0059.838] DeleteFileW (lpFileName="") returned 0 [0059.838] GetLastError () returned 0x3 [0059.839] GetFileAttributesW (lpFileName="") returned 0xffffffff [0059.839] SetLastError (dwErrCode=0x3) [0059.839] FlushFileBuffers (hFile=0x158) returned 1 [0059.958] GetCurrentThreadId () returned 0x970 [0059.958] GetCurrentThreadId () returned 0x970 [0059.958] GetCurrentThreadId () returned 0x970 [0059.958] GetCurrentThreadId () returned 0x970 [0059.958] GetCurrentThreadId () returned 0x970 [0059.958] GetCurrentThreadId () returned 0x970 [0059.958] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x7daa [0059.959] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x7daa [0059.959] SetFilePointer (in: hFile=0x158, lDistanceToMove=32170, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x7daa [0059.959] CloseHandle (hObject=0x158) returned 1 [0059.960] GetCurrentThreadId () returned 0x970 [0059.960] GetCurrentThreadId () returned 0x970 [0059.960] GetCurrentThreadId () returned 0x970 [0059.960] GetCurrentThreadId () returned 0x970 [0059.960] GetCurrentThreadId () returned 0x970 [0059.960] GetCurrentThreadId () returned 0x970 [0059.960] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\Файл зашифрован [THMBNAIL.PNG].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\Файл зашифрован [thmbnail.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0059.960] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7daa [0059.960] SetFilePointer (in: hFile=0x158, lDistanceToMove=32042, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7d2a [0059.960] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0059.960] GetFileType (hFile=0x158) returned 0x1 [0059.960] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x7, wMilliseconds=0xe4)) [0059.960] GetCurrentThreadId () returned 0x970 [0059.960] GetCurrentThreadId () returned 0x970 [0059.960] GetCurrentThreadId () returned 0x970 [0059.960] GetCurrentThreadId () returned 0x970 [0059.961] GetCurrentThreadId () returned 0x970 [0059.961] GetCurrentThreadId () returned 0x970 [0059.961] GetCurrentThreadId () returned 0x970 [0059.961] GetCurrentThreadId () returned 0x970 [0059.961] GetCurrentThreadId () returned 0x970 [0059.961] GetCurrentThreadId () returned 0x970 [0059.961] GetCurrentThreadId () returned 0x970 [0059.961] GetCurrentThreadId () returned 0x970 [0059.961] GetCurrentThreadId () returned 0x970 [0059.961] GetCurrentThreadId () returned 0x970 [0059.961] GetCurrentThreadId () returned 0x970 [0059.961] GetCurrentThreadId () returned 0x970 [0059.961] GetCurrentThreadId () returned 0x970 [0059.961] GetCurrentThreadId () returned 0x970 [0059.961] GetCurrentThreadId () returned 0x970 [0059.961] GetCurrentThreadId () returned 0x970 [0059.961] GetCurrentThreadId () returned 0x970 [0059.961] GetCurrentThreadId () returned 0x970 [0059.961] GetCurrentThreadId () returned 0x970 [0059.961] GetCurrentThreadId () returned 0x970 [0059.961] GetCurrentThreadId () returned 0x970 [0059.961] GetCurrentThreadId () returned 0x970 [0059.961] GetCurrentThreadId () returned 0x970 [0059.961] GetCurrentThreadId () returned 0x970 [0059.961] GetCurrentThreadId () returned 0x970 [0059.961] GetCurrentThreadId () returned 0x970 [0059.961] GetCurrentThreadId () returned 0x970 [0059.961] GetCurrentThreadId () returned 0x970 [0059.961] GetCurrentThreadId () returned 0x970 [0059.961] GetCurrentThreadId () returned 0x970 [0059.961] GetCurrentThreadId () returned 0x970 [0059.961] GetCurrentThreadId () returned 0x970 [0059.961] GetCurrentThreadId () returned 0x970 [0059.961] GetCurrentThreadId () returned 0x970 [0059.961] GetCurrentThreadId () returned 0x970 [0059.961] GetCurrentThreadId () returned 0x970 [0059.961] GetCurrentThreadId () returned 0x970 [0059.961] GetCurrentThreadId () returned 0x970 [0059.961] GetCurrentThreadId () returned 0x970 [0059.961] GetCurrentThreadId () returned 0x970 [0059.961] GetCurrentThreadId () returned 0x970 [0059.961] GetCurrentThreadId () returned 0x970 [0059.961] GetCurrentThreadId () returned 0x970 [0059.961] GetCurrentThreadId () returned 0x970 [0059.962] GetCurrentThreadId () returned 0x970 [0059.962] GetCurrentThreadId () returned 0x970 [0059.962] GetCurrentThreadId () returned 0x970 [0059.962] GetCurrentThreadId () returned 0x970 [0059.962] GetCurrentThreadId () returned 0x970 [0059.962] GetCurrentThreadId () returned 0x970 [0059.962] GetCurrentThreadId () returned 0x970 [0059.962] GetCurrentThreadId () returned 0x970 [0059.962] GetCurrentThreadId () returned 0x970 [0059.962] GetCurrentThreadId () returned 0x970 [0059.962] GetCurrentThreadId () returned 0x970 [0059.962] GetCurrentThreadId () returned 0x970 [0059.962] GetCurrentThreadId () returned 0x970 [0059.962] GetCurrentThreadId () returned 0x970 [0059.962] GetCurrentThreadId () returned 0x970 [0059.962] GetCurrentThreadId () returned 0x970 [0059.962] GetCurrentThreadId () returned 0x970 [0059.962] GetCurrentThreadId () returned 0x970 [0059.962] GetCurrentThreadId () returned 0x970 [0059.962] GetCurrentThreadId () returned 0x970 [0059.962] GetCurrentThreadId () returned 0x970 [0059.962] GetCurrentThreadId () returned 0x970 [0059.962] GetCurrentThreadId () returned 0x970 [0059.962] GetCurrentThreadId () returned 0x970 [0059.962] GetCurrentThreadId () returned 0x970 [0059.962] GetCurrentThreadId () returned 0x970 [0059.962] GetCurrentThreadId () returned 0x970 [0059.962] GetCurrentThreadId () returned 0x970 [0059.962] GetCurrentThreadId () returned 0x970 [0059.962] GetCurrentThreadId () returned 0x970 [0059.962] GetCurrentThreadId () returned 0x970 [0059.962] GetCurrentThreadId () returned 0x970 [0059.962] GetCurrentThreadId () returned 0x970 [0059.962] GetCurrentThreadId () returned 0x970 [0059.962] GetCurrentThreadId () returned 0x970 [0059.962] GetCurrentThreadId () returned 0x970 [0059.962] GetCurrentThreadId () returned 0x970 [0059.962] GetCurrentThreadId () returned 0x970 [0059.962] GetCurrentThreadId () returned 0x970 [0059.962] GetCurrentThreadId () returned 0x970 [0059.962] GetCurrentThreadId () returned 0x970 [0059.962] GetCurrentThreadId () returned 0x970 [0059.962] GetCurrentThreadId () returned 0x970 [0059.962] GetCurrentThreadId () returned 0x970 [0059.962] GetCurrentThreadId () returned 0x970 [0059.962] GetCurrentThreadId () returned 0x970 [0059.963] GetCurrentThreadId () returned 0x970 [0059.963] GetCurrentThreadId () returned 0x970 [0059.963] GetCurrentThreadId () returned 0x970 [0059.963] GetCurrentThreadId () returned 0x970 [0059.963] GetCurrentThreadId () returned 0x970 [0059.963] GetCurrentThreadId () returned 0x970 [0059.963] GetCurrentThreadId () returned 0x970 [0059.963] GetCurrentThreadId () returned 0x970 [0059.963] GetCurrentThreadId () returned 0x970 [0059.963] GetCurrentThreadId () returned 0x970 [0059.963] GetCurrentThreadId () returned 0x970 [0059.963] GetCurrentThreadId () returned 0x970 [0059.963] GetCurrentThreadId () returned 0x970 [0059.963] GetCurrentThreadId () returned 0x970 [0059.963] GetCurrentThreadId () returned 0x970 [0059.963] GetCurrentThreadId () returned 0x970 [0059.963] GetCurrentThreadId () returned 0x970 [0059.963] GetCurrentThreadId () returned 0x970 [0059.963] GetCurrentThreadId () returned 0x970 [0059.963] GetCurrentThreadId () returned 0x970 [0059.963] GetCurrentThreadId () returned 0x970 [0059.963] GetCurrentThreadId () returned 0x970 [0059.963] GetCurrentThreadId () returned 0x970 [0059.963] GetCurrentThreadId () returned 0x970 [0059.963] GetCurrentThreadId () returned 0x970 [0059.963] GetCurrentThreadId () returned 0x970 [0059.963] GetCurrentThreadId () returned 0x970 [0059.963] GetCurrentThreadId () returned 0x970 [0059.963] GetCurrentThreadId () returned 0x970 [0059.963] GetCurrentThreadId () returned 0x970 [0059.963] GetCurrentThreadId () returned 0x970 [0059.963] GetCurrentThreadId () returned 0x970 [0059.963] GetCurrentThreadId () returned 0x970 [0059.963] GetCurrentThreadId () returned 0x970 [0059.963] GetCurrentThreadId () returned 0x970 [0059.963] GetCurrentThreadId () returned 0x970 [0059.963] GetCurrentThreadId () returned 0x970 [0059.963] GetCurrentThreadId () returned 0x970 [0059.963] GetCurrentThreadId () returned 0x970 [0059.963] GetCurrentThreadId () returned 0x970 [0059.963] GetCurrentThreadId () returned 0x970 [0059.963] GetCurrentThreadId () returned 0x970 [0059.963] GetCurrentThreadId () returned 0x970 [0059.963] GetCurrentThreadId () returned 0x970 [0059.964] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.964] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.964] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fef2d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0059.964] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.964] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.964] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fef2d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0059.964] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.964] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.964] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0059.964] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.964] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.964] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0059.964] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.964] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.964] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fef330, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0059.964] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.964] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.964] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fef330, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0059.964] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.964] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.964] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fef330, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0059.964] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x7, wMilliseconds=0xe4)) [0059.964] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="#8(U0KJeaqB/PYR\"t1Y=TP7n.=7y!Ql0", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0059.964] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="#8(U0KJeaqB/PYR\"t1Y=TP7n.=7y!Ql0", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0059.964] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="#8(U0KJeaqB/PYR\"t1Y=TP7n.=7y!Ql0", cchWideChar=32, lpMultiByteStr=0x20027b8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="#8(U0KJeaqB/PYR\"t1Y=TP7n.=7y!Ql0", lpUsedDefaultChar=0x0) returned 32 [0059.964] GetCurrentThreadId () returned 0x970 [0059.964] GetCurrentThreadId () returned 0x970 [0059.964] GetCurrentThreadId () returned 0x970 [0059.964] GetCurrentThreadId () returned 0x970 [0059.965] GetCurrentThreadId () returned 0x970 [0059.965] GetCurrentThreadId () returned 0x970 [0059.972] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0059.972] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0059.972] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x34f7ef8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0059.972] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0059.972] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAHRxZhw4r1nI0b0DAT6+4jZlu2P6Q0x/5cLO3ManoUyJjNc2Yye9lF+ovMhWNGPWmvW3d7ZOa8Mvcs3kagrKE1HUzXcdmMAbPJH+SkrCM7JJ8+GLdpVrpy7ocG4Od/3camPD426F6pjT1Vr+y/imo2XjrND/MDuIKBaLfd7TbDs2KiF16MJ76w0HSv3zqty2TaWw2X9ztdKqalG/6HmtIQ8LqRTU5kqinQ==") returned 232 [0059.972] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x7, wMilliseconds=0xf4)) [0059.972] GetCurrentThreadId () returned 0x970 [0059.972] GetCurrentThreadId () returned 0x970 [0059.972] GetCurrentThreadId () returned 0x970 [0059.972] GetCurrentThreadId () returned 0x970 [0059.972] GetCurrentThreadId () returned 0x970 [0059.972] GetCurrentThreadId () returned 0x970 [0059.972] GetCurrentThreadId () returned 0x970 [0059.972] GetCurrentThreadId () returned 0x970 [0059.972] GetCurrentThreadId () returned 0x970 [0059.972] GetCurrentThreadId () returned 0x970 [0059.972] GetCurrentThreadId () returned 0x970 [0059.972] GetCurrentThreadId () returned 0x970 [0059.972] GetCurrentThreadId () returned 0x970 [0059.973] GetCurrentThreadId () returned 0x970 [0059.973] GetCurrentThreadId () returned 0x970 [0059.973] GetCurrentThreadId () returned 0x970 [0059.973] GetCurrentThreadId () returned 0x970 [0059.973] GetCurrentThreadId () returned 0x970 [0059.973] GetCurrentThreadId () returned 0x970 [0059.973] GetCurrentThreadId () returned 0x970 [0059.973] GetCurrentThreadId () returned 0x970 [0059.973] GetCurrentThreadId () returned 0x970 [0059.973] GetCurrentThreadId () returned 0x970 [0059.973] GetCurrentThreadId () returned 0x970 [0059.973] GetCurrentThreadId () returned 0x970 [0059.973] GetCurrentThreadId () returned 0x970 [0059.973] GetCurrentThreadId () returned 0x970 [0059.973] GetCurrentThreadId () returned 0x970 [0059.973] GetCurrentThreadId () returned 0x970 [0059.973] GetCurrentThreadId () returned 0x970 [0059.973] GetCurrentThreadId () returned 0x970 [0059.973] GetCurrentThreadId () returned 0x970 [0059.973] GetCurrentThreadId () returned 0x970 [0059.973] GetCurrentThreadId () returned 0x970 [0059.973] GetCurrentThreadId () returned 0x970 [0059.973] GetCurrentThreadId () returned 0x970 [0059.973] GetCurrentThreadId () returned 0x970 [0059.973] GetCurrentThreadId () returned 0x970 [0059.973] GetCurrentThreadId () returned 0x970 [0059.973] GetCurrentThreadId () returned 0x970 [0059.973] GetCurrentThreadId () returned 0x970 [0059.973] GetCurrentThreadId () returned 0x970 [0059.973] GetCurrentThreadId () returned 0x970 [0059.973] GetCurrentThreadId () returned 0x970 [0059.973] GetCurrentThreadId () returned 0x970 [0059.973] GetCurrentThreadId () returned 0x970 [0059.973] GetCurrentThreadId () returned 0x970 [0059.973] GetCurrentThreadId () returned 0x970 [0059.973] GetCurrentThreadId () returned 0x970 [0059.973] GetCurrentThreadId () returned 0x970 [0059.973] GetCurrentThreadId () returned 0x970 [0059.973] GetCurrentThreadId () returned 0x970 [0059.973] GetCurrentThreadId () returned 0x970 [0059.973] GetCurrentThreadId () returned 0x970 [0059.973] GetCurrentThreadId () returned 0x970 [0059.973] GetCurrentThreadId () returned 0x970 [0059.973] GetCurrentThreadId () returned 0x970 [0059.973] GetCurrentThreadId () returned 0x970 [0059.973] GetCurrentThreadId () returned 0x970 [0059.974] GetCurrentThreadId () returned 0x970 [0059.974] GetCurrentThreadId () returned 0x970 [0059.974] GetCurrentThreadId () returned 0x970 [0059.974] GetCurrentThreadId () returned 0x970 [0059.974] GetCurrentThreadId () returned 0x970 [0059.974] GetCurrentThreadId () returned 0x970 [0059.974] GetCurrentThreadId () returned 0x970 [0059.974] GetCurrentThreadId () returned 0x970 [0059.974] GetCurrentThreadId () returned 0x970 [0059.974] GetCurrentThreadId () returned 0x970 [0059.974] GetCurrentThreadId () returned 0x970 [0059.974] GetCurrentThreadId () returned 0x970 [0059.974] GetCurrentThreadId () returned 0x970 [0059.974] GetCurrentThreadId () returned 0x970 [0059.974] GetCurrentThreadId () returned 0x970 [0059.974] GetCurrentThreadId () returned 0x970 [0059.974] GetCurrentThreadId () returned 0x970 [0059.974] GetCurrentThreadId () returned 0x970 [0059.974] GetCurrentThreadId () returned 0x970 [0059.974] GetCurrentThreadId () returned 0x970 [0059.974] GetCurrentThreadId () returned 0x970 [0059.974] GetCurrentThreadId () returned 0x970 [0059.974] GetCurrentThreadId () returned 0x970 [0059.974] GetCurrentThreadId () returned 0x970 [0059.974] GetCurrentThreadId () returned 0x970 [0059.974] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAHRxZhw4r1nI0b0DAT6+4jZlu2P6Q0x/5cLO3ManoUyJjNc2Yye9lF+ovMhWNGPWmvW3d7ZOa8Mvcs3kagrKE1HUzXcdmMAbPJH+SkrCM7JJ8+GLdpVrpy7ocG4Od/3camPD426F6pjT1Vr+y/imo2XjrND/MDuIKBaLfd7TbDs2KiF16MJ76w0HSv3zqty2TaWw2X9ztdKqalG/6HmtIQ8LqRTU5kqinQ==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0059.974] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAHRxZhw4r1nI0b0DAT6+4jZlu2P6Q0x/5cLO3ManoUyJjNc2Yye9lF+ovMhWNGPWmvW3d7ZOa8Mvcs3kagrKE1HUzXcdmMAbPJH+SkrCM7JJ8+GLdpVrpy7ocG4Od/3camPD426F6pjT1Vr+y/imo2XjrND/MDuIKBaLfd7TbDs2KiF16MJ76w0HSv3zqty2TaWw2X9ztdKqalG/6HmtIQ8LqRTU5kqinQ==", cchWideChar=245, lpMultiByteStr=0x353933c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAHRxZhw4r1nI0b0DAT6+4jZlu2P6Q0x/5cLO3ManoUyJjNc2Yye9lF+ovMhWNGPWmvW3d7ZOa8Mvcs3kagrKE1HUzXcdmMAbPJH+SkrCM7JJ8+GLdpVrpy7ocG4Od/3camPD426F6pjT1Vr+y/imo2XjrND/MDuIKBaLfd7TbDs2KiF16MJ76w0HSv3zqty2TaWw2X9ztdKqalG/6HmtIQ8LqRTU5kqinQ==", lpUsedDefaultChar=0x0) returned 245 [0059.974] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0059.974] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0059.974] CloseHandle (hObject=0x158) returned 1 [0059.975] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png")) returned 1 [0059.976] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=18023989389) returned 1 [0059.977] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\Файл зашифрован [PREVIEW.GIF].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\Файл зашифрован [preview.gif].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0059.989] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0059.989] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0059.989] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0059.989] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0059.989] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0059.989] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0059.989] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0059.989] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0059.989] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0059.990] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0059.990] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0059.990] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0059.990] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0059.990] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0059.990] SetEndOfFile (hFile=0x158) returned 1 [0059.990] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0059.990] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0059.990] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0059.990] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0059.990] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0059.991] WriteFile (in: hFile=0x158, lpBuffer=0x35f011c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f011c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0059.991] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WC$)Naod):WPx>3&1>+=gd%hr0q", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0059.991] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WC$)Naod):WPx>3&1>+=gd%hr0q", cchWideChar=32, lpMultiByteStr=0x2034e74, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WC$)Naod):WPx>3&1>+=gd%hr0q", lpUsedDefaultChar=0x0) returned 32 [0059.991] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0059.991] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0059.991] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xaa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 0x295098 [0059.991] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0059.991] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0059.991] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif")) returned 0x20 [0059.992] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif")) returned 0x20 [0059.992] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif")) returned 0x20 [0059.992] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif")) returned 0x20 [0059.992] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xaa2)) returned 1 [0059.992] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0059.992] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0059.992] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif")) returned 0x20 [0059.992] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif")) returned 0x20 [0059.992] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0059.992] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0059.992] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0059.992] SetEndOfFile (hFile=0x158) returned 1 [0059.993] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0059.993] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe35cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0059.993] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0059.993] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe488c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0059.993] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe488c, cbMultiByte=11, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="PREVIEW.GIFGer.gifg") returned 11 [0059.993] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0059.993] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe35cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0059.993] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0059.994] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0059.994] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0xaa2 [0059.994] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0059.994] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0059.994] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0059.994] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0059.994] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe35cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0059.994] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0059.994] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe488c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0059.994] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe488c, cbMultiByte=11, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="PREVIEW.GIFEW.GIFGer.gifg") returned 11 [0059.994] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0059.994] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe35cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0059.994] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0059.995] CharToOemA (in: pSrc="PREVIEW.GIF", pDst=0x1fe488c | out: pDst="PREVIEW.GIF") returned 1 [0059.995] WriteFile (in: hFile=0x158, lpBuffer=0x1fe488c*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe488c*, lpNumberOfBytesWritten=0x18e048*=0xb, lpOverlapped=0x0) returned 1 [0059.995] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0059.995] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0059.995] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0059.995] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=18025890935) returned 1 [0059.996] ReadFile (in: hFile=0x11c, lpBuffer=0x37a9c40, nNumberOfBytesToRead=0xaa2, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37a9c40*, lpNumberOfBytesRead=0x18dd7c*=0xaa2, lpOverlapped=0x0) returned 1 [0060.023] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0060.023] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=18028670559) returned 1 [0060.032] WriteFile (in: hFile=0x158, lpBuffer=0x1fea2b8*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fea2b8*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0060.033] ReadFile (in: hFile=0x11c, lpBuffer=0x37a9c40, nNumberOfBytesToRead=0xaa2, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x37a9c40*, lpNumberOfBytesRead=0x18de38*=0xaa2, lpOverlapped=0x0) returned 1 [0060.033] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x46 [0060.033] WriteFile (in: hFile=0x158, lpBuffer=0x37ebf60*, nNumberOfBytesToWrite=0xaa2, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x37ebf60*, lpNumberOfBytesWritten=0x18de10*=0xaa2, lpOverlapped=0x0) returned 1 [0060.033] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0xae8 [0060.033] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0060.033] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0060.033] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0060.033] SetFilePointer (in: hFile=0x158, lDistanceToMove=11, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x29 [0060.033] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0xaf2 [0060.033] CloseHandle (hObject=0x11c) returned 1 [0060.034] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xaf2 [0060.034] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xaf2 [0060.034] SetFilePointer (in: hFile=0x158, lDistanceToMove=2802, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xaf2 [0060.034] SetFilePointer (in: hFile=0x158, lDistanceToMove=2802, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0xaf2 [0060.034] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xaf2 [0060.034] SetFilePointer (in: hFile=0x158, lDistanceToMove=2802, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0xaf2 [0060.034] SetEndOfFile (hFile=0x158) returned 1 [0060.034] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xaf2 [0060.034] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xaf2 [0060.034] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0060.034] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe35cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0060.034] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0060.034] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe41ac, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0060.034] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe41ac, cbMultiByte=11, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="PREVIEW.GIF\x18ꞗ@涤(\x18믉`믑`") returned 11 [0060.034] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0060.034] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe35cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0060.035] WriteFile (in: hFile=0x158, lpBuffer=0x378d718*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x378d718*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0060.035] CharToOemA (in: pSrc="PREVIEW.GIF", pDst=0x1fe41ac | out: pDst="PREVIEW.GIF") returned 1 [0060.035] WriteFile (in: hFile=0x158, lpBuffer=0x1fe41ac*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe41ac*, lpNumberOfBytesWritten=0x18efcc*=0xb, lpOverlapped=0x0) returned 1 [0060.035] WriteFile (in: hFile=0x158, lpBuffer=0x1fea110*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea110*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0060.035] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0060.035] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0060.035] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xb36 [0060.035] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xb36 [0060.035] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0060.035] WriteFile (in: hFile=0x158, lpBuffer=0x35f011c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f011c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0060.035] DeleteFileW (lpFileName="") returned 0 [0060.035] GetLastError () returned 0x3 [0060.035] GetFileAttributesW (lpFileName="") returned 0xffffffff [0060.035] SetLastError (dwErrCode=0x3) [0060.035] FlushFileBuffers (hFile=0x158) returned 1 [0060.038] GetCurrentThreadId () returned 0x970 [0060.038] GetCurrentThreadId () returned 0x970 [0060.038] GetCurrentThreadId () returned 0x970 [0060.038] GetCurrentThreadId () returned 0x970 [0060.038] GetCurrentThreadId () returned 0x970 [0060.038] GetCurrentThreadId () returned 0x970 [0060.038] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xbed [0060.038] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xbed [0060.038] SetFilePointer (in: hFile=0x158, lDistanceToMove=3053, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xbed [0060.038] CloseHandle (hObject=0x158) returned 1 [0060.039] GetCurrentThreadId () returned 0x970 [0060.039] GetCurrentThreadId () returned 0x970 [0060.039] GetCurrentThreadId () returned 0x970 [0060.039] GetCurrentThreadId () returned 0x970 [0060.039] GetCurrentThreadId () returned 0x970 [0060.039] GetCurrentThreadId () returned 0x970 [0060.040] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\Файл зашифрован [PREVIEW.GIF].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\Файл зашифрован [preview.gif].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0060.040] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbed [0060.040] SetFilePointer (in: hFile=0x158, lDistanceToMove=2925, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb6d [0060.040] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0060.040] GetFileType (hFile=0x158) returned 0x1 [0060.040] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x7, wMilliseconds=0x132)) [0060.040] GetCurrentThreadId () returned 0x970 [0060.040] GetCurrentThreadId () returned 0x970 [0060.040] GetCurrentThreadId () returned 0x970 [0060.040] GetCurrentThreadId () returned 0x970 [0060.040] GetCurrentThreadId () returned 0x970 [0060.040] GetCurrentThreadId () returned 0x970 [0060.040] GetCurrentThreadId () returned 0x970 [0060.040] GetCurrentThreadId () returned 0x970 [0060.040] GetCurrentThreadId () returned 0x970 [0060.040] GetCurrentThreadId () returned 0x970 [0060.040] GetCurrentThreadId () returned 0x970 [0060.040] GetCurrentThreadId () returned 0x970 [0060.040] GetCurrentThreadId () returned 0x970 [0060.040] GetCurrentThreadId () returned 0x970 [0060.040] GetCurrentThreadId () returned 0x970 [0060.040] GetCurrentThreadId () returned 0x970 [0060.040] GetCurrentThreadId () returned 0x970 [0060.040] GetCurrentThreadId () returned 0x970 [0060.040] GetCurrentThreadId () returned 0x970 [0060.040] GetCurrentThreadId () returned 0x970 [0060.040] GetCurrentThreadId () returned 0x970 [0060.040] GetCurrentThreadId () returned 0x970 [0060.040] GetCurrentThreadId () returned 0x970 [0060.040] GetCurrentThreadId () returned 0x970 [0060.040] GetCurrentThreadId () returned 0x970 [0060.040] GetCurrentThreadId () returned 0x970 [0060.041] GetCurrentThreadId () returned 0x970 [0060.041] GetCurrentThreadId () returned 0x970 [0060.041] GetCurrentThreadId () returned 0x970 [0060.041] GetCurrentThreadId () returned 0x970 [0060.041] GetCurrentThreadId () returned 0x970 [0060.041] GetCurrentThreadId () returned 0x970 [0060.041] GetCurrentThreadId () returned 0x970 [0060.041] GetCurrentThreadId () returned 0x970 [0060.041] GetCurrentThreadId () returned 0x970 [0060.041] GetCurrentThreadId () returned 0x970 [0060.041] GetCurrentThreadId () returned 0x970 [0060.041] GetCurrentThreadId () returned 0x970 [0060.041] GetCurrentThreadId () returned 0x970 [0060.041] GetCurrentThreadId () returned 0x970 [0060.041] GetCurrentThreadId () returned 0x970 [0060.041] GetCurrentThreadId () returned 0x970 [0060.041] GetCurrentThreadId () returned 0x970 [0060.041] GetCurrentThreadId () returned 0x970 [0060.041] GetCurrentThreadId () returned 0x970 [0060.041] GetCurrentThreadId () returned 0x970 [0060.041] GetCurrentThreadId () returned 0x970 [0060.041] GetCurrentThreadId () returned 0x970 [0060.041] GetCurrentThreadId () returned 0x970 [0060.041] GetCurrentThreadId () returned 0x970 [0060.041] GetCurrentThreadId () returned 0x970 [0060.041] GetCurrentThreadId () returned 0x970 [0060.041] GetCurrentThreadId () returned 0x970 [0060.041] GetCurrentThreadId () returned 0x970 [0060.041] GetCurrentThreadId () returned 0x970 [0060.041] GetCurrentThreadId () returned 0x970 [0060.041] GetCurrentThreadId () returned 0x970 [0060.041] GetCurrentThreadId () returned 0x970 [0060.041] GetCurrentThreadId () returned 0x970 [0060.041] GetCurrentThreadId () returned 0x970 [0060.041] GetCurrentThreadId () returned 0x970 [0060.041] GetCurrentThreadId () returned 0x970 [0060.041] GetCurrentThreadId () returned 0x970 [0060.041] GetCurrentThreadId () returned 0x970 [0060.041] GetCurrentThreadId () returned 0x970 [0060.041] GetCurrentThreadId () returned 0x970 [0060.041] GetCurrentThreadId () returned 0x970 [0060.041] GetCurrentThreadId () returned 0x970 [0060.041] GetCurrentThreadId () returned 0x970 [0060.041] GetCurrentThreadId () returned 0x970 [0060.041] GetCurrentThreadId () returned 0x970 [0060.042] GetCurrentThreadId () returned 0x970 [0060.042] GetCurrentThreadId () returned 0x970 [0060.042] GetCurrentThreadId () returned 0x970 [0060.042] GetCurrentThreadId () returned 0x970 [0060.042] GetCurrentThreadId () returned 0x970 [0060.042] GetCurrentThreadId () returned 0x970 [0060.042] GetCurrentThreadId () returned 0x970 [0060.042] GetCurrentThreadId () returned 0x970 [0060.042] GetCurrentThreadId () returned 0x970 [0060.042] GetCurrentThreadId () returned 0x970 [0060.042] GetCurrentThreadId () returned 0x970 [0060.042] GetCurrentThreadId () returned 0x970 [0060.042] GetCurrentThreadId () returned 0x970 [0060.042] GetCurrentThreadId () returned 0x970 [0060.042] GetCurrentThreadId () returned 0x970 [0060.042] GetCurrentThreadId () returned 0x970 [0060.042] GetCurrentThreadId () returned 0x970 [0060.042] GetCurrentThreadId () returned 0x970 [0060.042] GetCurrentThreadId () returned 0x970 [0060.042] GetCurrentThreadId () returned 0x970 [0060.042] GetCurrentThreadId () returned 0x970 [0060.042] GetCurrentThreadId () returned 0x970 [0060.042] GetCurrentThreadId () returned 0x970 [0060.042] GetCurrentThreadId () returned 0x970 [0060.042] GetCurrentThreadId () returned 0x970 [0060.042] GetCurrentThreadId () returned 0x970 [0060.042] GetCurrentThreadId () returned 0x970 [0060.042] GetCurrentThreadId () returned 0x970 [0060.042] GetCurrentThreadId () returned 0x970 [0060.042] GetCurrentThreadId () returned 0x970 [0060.042] GetCurrentThreadId () returned 0x970 [0060.042] GetCurrentThreadId () returned 0x970 [0060.042] GetCurrentThreadId () returned 0x970 [0060.042] GetCurrentThreadId () returned 0x970 [0060.042] GetCurrentThreadId () returned 0x970 [0060.042] GetCurrentThreadId () returned 0x970 [0060.042] GetCurrentThreadId () returned 0x970 [0060.042] GetCurrentThreadId () returned 0x970 [0060.042] GetCurrentThreadId () returned 0x970 [0060.042] GetCurrentThreadId () returned 0x970 [0060.042] GetCurrentThreadId () returned 0x970 [0060.042] GetCurrentThreadId () returned 0x970 [0060.042] GetCurrentThreadId () returned 0x970 [0060.042] GetCurrentThreadId () returned 0x970 [0060.042] GetCurrentThreadId () returned 0x970 [0060.043] GetCurrentThreadId () returned 0x970 [0060.043] GetCurrentThreadId () returned 0x970 [0060.043] GetCurrentThreadId () returned 0x970 [0060.043] GetCurrentThreadId () returned 0x970 [0060.043] GetCurrentThreadId () returned 0x970 [0060.043] GetCurrentThreadId () returned 0x970 [0060.043] GetCurrentThreadId () returned 0x970 [0060.043] GetCurrentThreadId () returned 0x970 [0060.043] GetCurrentThreadId () returned 0x970 [0060.043] GetCurrentThreadId () returned 0x970 [0060.043] GetCurrentThreadId () returned 0x970 [0060.043] GetCurrentThreadId () returned 0x970 [0060.043] GetCurrentThreadId () returned 0x970 [0060.043] GetCurrentThreadId () returned 0x970 [0060.043] GetCurrentThreadId () returned 0x970 [0060.043] GetCurrentThreadId () returned 0x970 [0060.043] GetCurrentThreadId () returned 0x970 [0060.043] GetCurrentThreadId () returned 0x970 [0060.043] GetCurrentThreadId () returned 0x970 [0060.043] GetCurrentThreadId () returned 0x970 [0060.043] GetCurrentThreadId () returned 0x970 [0060.043] GetCurrentThreadId () returned 0x970 [0060.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0060.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0060.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fef330, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0060.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0060.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0060.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fef330, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0060.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0060.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0060.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0060.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0060.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0060.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0060.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0060.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0060.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fef390, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0060.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0060.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0060.044] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fef390, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0060.044] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0060.044] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0060.044] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fef390, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0060.044] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x7, wMilliseconds=0x132)) [0060.044] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WC$)Naod):WPx>3&1>+=gd%hr0q", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0060.044] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WC$)Naod):WPx>3&1>+=gd%hr0q", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0060.044] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WC$)Naod):WPx>3&1>+=gd%hr0q", cchWideChar=32, lpMultiByteStr=0x20024e8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WC$)Naod):WPx>3&1>+=gd%hr0q", lpUsedDefaultChar=0x0) returned 32 [0060.044] GetCurrentThreadId () returned 0x970 [0060.044] GetCurrentThreadId () returned 0x970 [0060.044] GetCurrentThreadId () returned 0x970 [0060.044] GetCurrentThreadId () returned 0x970 [0060.044] GetCurrentThreadId () returned 0x970 [0060.044] GetCurrentThreadId () returned 0x970 [0060.051] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0060.051] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0060.051] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x34f7fe8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0060.051] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0060.051] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAH0KObTxsf1KwdJg3QOEoFlHxWua1GdVv6KeJRQQtDilLcCXQ1CoN1AjxZbHWoK9gUScysmUs44O5b5ZDwqJsA/9iXlDYlxU84DYkrqrokdIzzX0mjHAdakkMc9+GSP4a4uEefYK3AS1MPx3K/Y/vLfyaEImP1eEuPB1G/rBMvKc3V3DfzbhwxYcAu3/Bq0nvpnMSe7caQBu/nPmv2t+mDWmhHxl7FMtUA==") returned 232 [0060.051] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x7, wMilliseconds=0x142)) [0060.051] GetCurrentThreadId () returned 0x970 [0060.051] GetCurrentThreadId () returned 0x970 [0060.051] GetCurrentThreadId () returned 0x970 [0060.051] GetCurrentThreadId () returned 0x970 [0060.052] GetCurrentThreadId () returned 0x970 [0060.052] GetCurrentThreadId () returned 0x970 [0060.052] GetCurrentThreadId () returned 0x970 [0060.052] GetCurrentThreadId () returned 0x970 [0060.052] GetCurrentThreadId () returned 0x970 [0060.052] GetCurrentThreadId () returned 0x970 [0060.052] GetCurrentThreadId () returned 0x970 [0060.052] GetCurrentThreadId () returned 0x970 [0060.052] GetCurrentThreadId () returned 0x970 [0060.052] GetCurrentThreadId () returned 0x970 [0060.052] GetCurrentThreadId () returned 0x970 [0060.052] GetCurrentThreadId () returned 0x970 [0060.052] GetCurrentThreadId () returned 0x970 [0060.052] GetCurrentThreadId () returned 0x970 [0060.052] GetCurrentThreadId () returned 0x970 [0060.052] GetCurrentThreadId () returned 0x970 [0060.052] GetCurrentThreadId () returned 0x970 [0060.052] GetCurrentThreadId () returned 0x970 [0060.052] GetCurrentThreadId () returned 0x970 [0060.052] GetCurrentThreadId () returned 0x970 [0060.052] GetCurrentThreadId () returned 0x970 [0060.052] GetCurrentThreadId () returned 0x970 [0060.052] GetCurrentThreadId () returned 0x970 [0060.052] GetCurrentThreadId () returned 0x970 [0060.052] GetCurrentThreadId () returned 0x970 [0060.052] GetCurrentThreadId () returned 0x970 [0060.052] GetCurrentThreadId () returned 0x970 [0060.052] GetCurrentThreadId () returned 0x970 [0060.052] GetCurrentThreadId () returned 0x970 [0060.052] GetCurrentThreadId () returned 0x970 [0060.052] GetCurrentThreadId () returned 0x970 [0060.052] GetCurrentThreadId () returned 0x970 [0060.052] GetCurrentThreadId () returned 0x970 [0060.052] GetCurrentThreadId () returned 0x970 [0060.052] GetCurrentThreadId () returned 0x970 [0060.052] GetCurrentThreadId () returned 0x970 [0060.052] GetCurrentThreadId () returned 0x970 [0060.052] GetCurrentThreadId () returned 0x970 [0060.052] GetCurrentThreadId () returned 0x970 [0060.052] GetCurrentThreadId () returned 0x970 [0060.052] GetCurrentThreadId () returned 0x970 [0060.052] GetCurrentThreadId () returned 0x970 [0060.052] GetCurrentThreadId () returned 0x970 [0060.052] GetCurrentThreadId () returned 0x970 [0060.052] GetCurrentThreadId () returned 0x970 [0060.052] GetCurrentThreadId () returned 0x970 [0060.052] GetCurrentThreadId () returned 0x970 [0060.052] GetCurrentThreadId () returned 0x970 [0060.053] GetCurrentThreadId () returned 0x970 [0060.053] GetCurrentThreadId () returned 0x970 [0060.053] GetCurrentThreadId () returned 0x970 [0060.053] GetCurrentThreadId () returned 0x970 [0060.053] GetCurrentThreadId () returned 0x970 [0060.053] GetCurrentThreadId () returned 0x970 [0060.053] GetCurrentThreadId () returned 0x970 [0060.053] GetCurrentThreadId () returned 0x970 [0060.053] GetCurrentThreadId () returned 0x970 [0060.053] GetCurrentThreadId () returned 0x970 [0060.053] GetCurrentThreadId () returned 0x970 [0060.053] GetCurrentThreadId () returned 0x970 [0060.053] GetCurrentThreadId () returned 0x970 [0060.053] GetCurrentThreadId () returned 0x970 [0060.053] GetCurrentThreadId () returned 0x970 [0060.053] GetCurrentThreadId () returned 0x970 [0060.053] GetCurrentThreadId () returned 0x970 [0060.053] GetCurrentThreadId () returned 0x970 [0060.053] GetCurrentThreadId () returned 0x970 [0060.053] GetCurrentThreadId () returned 0x970 [0060.053] GetCurrentThreadId () returned 0x970 [0060.053] GetCurrentThreadId () returned 0x970 [0060.053] GetCurrentThreadId () returned 0x970 [0060.053] GetCurrentThreadId () returned 0x970 [0060.053] GetCurrentThreadId () returned 0x970 [0060.053] GetCurrentThreadId () returned 0x970 [0060.053] GetCurrentThreadId () returned 0x970 [0060.053] GetCurrentThreadId () returned 0x970 [0060.053] GetCurrentThreadId () returned 0x970 [0060.053] GetCurrentThreadId () returned 0x970 [0060.053] GetCurrentThreadId () returned 0x970 [0060.053] GetCurrentThreadId () returned 0x970 [0060.053] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAH0KObTxsf1KwdJg3QOEoFlHxWua1GdVv6KeJRQQtDilLcCXQ1CoN1AjxZbHWoK9gUScysmUs44O5b5ZDwqJsA/9iXlDYlxU84DYkrqrokdIzzX0mjHAdakkMc9+GSP4a4uEefYK3AS1MPx3K/Y/vLfyaEImP1eEuPB1G/rBMvKc3V3DfzbhwxYcAu3/Bq0nvpnMSe7caQBu/nPmv2t+mDWmhHxl7FMtUA==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0060.053] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAH0KObTxsf1KwdJg3QOEoFlHxWua1GdVv6KeJRQQtDilLcCXQ1CoN1AjxZbHWoK9gUScysmUs44O5b5ZDwqJsA/9iXlDYlxU84DYkrqrokdIzzX0mjHAdakkMc9+GSP4a4uEefYK3AS1MPx3K/Y/vLfyaEImP1eEuPB1G/rBMvKc3V3DfzbhwxYcAu3/Bq0nvpnMSe7caQBu/nPmv2t+mDWmhHxl7FMtUA==", cchWideChar=245, lpMultiByteStr=0x353933c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAH0KObTxsf1KwdJg3QOEoFlHxWua1GdVv6KeJRQQtDilLcCXQ1CoN1AjxZbHWoK9gUScysmUs44O5b5ZDwqJsA/9iXlDYlxU84DYkrqrokdIzzX0mjHAdakkMc9+GSP4a4uEefYK3AS1MPx3K/Y/vLfyaEImP1eEuPB1G/rBMvKc3V3DfzbhwxYcAu3/Bq0nvpnMSe7caQBu/nPmv2t+mDWmhHxl7FMtUA==", lpUsedDefaultChar=0x0) returned 245 [0060.053] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0060.053] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0060.054] CloseHandle (hObject=0x158) returned 1 [0060.055] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif")) returned 1 [0060.056] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=18031906879) returned 1 [0060.056] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\Файл зашифрован [THMBNAIL.PNG].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\Файл зашифрован [thmbnail.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0060.056] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0060.056] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0060.056] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0060.056] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0060.056] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0060.056] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0060.056] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0060.056] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0060.057] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0060.057] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0060.057] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0060.057] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0060.057] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0060.057] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0060.057] SetEndOfFile (hFile=0x158) returned 1 [0060.057] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0060.057] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0060.057] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0060.057] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0060.057] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0060.058] WriteFile (in: hFile=0x158, lpBuffer=0x35f01dc*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f01dc*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0060.058] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u=}Wrp,WU^ri$5J0PrkR=)m}}@-P(cCE", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0060.058] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u=}Wrp,WU^ri$5J0PrkR=)m}}@-P(cCE", cchWideChar=32, lpMultiByteStr=0x2034eac, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="u=}Wrp,WU^ri$5J0PrkR=)m}}@-P(cCE", lpUsedDefaultChar=0x0) returned 32 [0060.058] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0060.058] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0060.058] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa90c, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0x295098 [0060.059] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0060.059] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0060.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png")) returned 0x20 [0060.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png")) returned 0x20 [0060.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png")) returned 0x20 [0060.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png")) returned 0x20 [0060.060] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa90c)) returned 1 [0060.060] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0060.060] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0060.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png")) returned 0x20 [0060.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png")) returned 0x20 [0060.060] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0060.060] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0060.060] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0060.060] SetEndOfFile (hFile=0x158) returned 1 [0060.061] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0060.061] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe36ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0060.061] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0060.061] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe378c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0060.061] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe378c, cbMultiByte=12, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="THMBNAIL.PNGer.gifg") returned 12 [0060.061] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0060.061] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe36ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0060.061] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0060.061] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0060.061] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0xa90c [0060.061] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0060.062] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0060.062] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0060.062] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0060.062] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe36ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0060.062] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0060.062] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe378c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0060.062] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe378c, cbMultiByte=12, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="THMBNAIL.PNGIL.PNGer.gifg") returned 12 [0060.062] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0060.062] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe36ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0060.062] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0060.063] CharToOemA (in: pSrc="THMBNAIL.PNG", pDst=0x1fe378c | out: pDst="THMBNAIL.PNG") returned 1 [0060.063] WriteFile (in: hFile=0x158, lpBuffer=0x1fe378c*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe378c*, lpNumberOfBytesWritten=0x18e048*=0xc, lpOverlapped=0x0) returned 1 [0060.063] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0060.063] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0060.063] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0060.063] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=18032664602) returned 1 [0060.063] ReadFile (in: hFile=0x11c, lpBuffer=0x37a9c40, nNumberOfBytesToRead=0xa90c, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37a9c40*, lpNumberOfBytesRead=0x18dd7c*=0xa90c, lpOverlapped=0x0) returned 1 [0060.081] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0060.081] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=18034436343) returned 1 [0060.089] WriteFile (in: hFile=0x158, lpBuffer=0x1fea1c8*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fea1c8*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0060.090] ReadFile (in: hFile=0x11c, lpBuffer=0x37a9c40, nNumberOfBytesToRead=0xa90c, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x37a9c40*, lpNumberOfBytesRead=0x18de38*=0xa90c, lpOverlapped=0x0) returned 1 [0060.091] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x47 [0060.091] WriteFile (in: hFile=0x158, lpBuffer=0x37f5d60*, nNumberOfBytesToWrite=0xa90c, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x37f5d60*, lpNumberOfBytesWritten=0x18de10*=0xa90c, lpOverlapped=0x0) returned 1 [0060.092] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0xa953 [0060.092] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0060.092] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0060.092] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0060.092] SetFilePointer (in: hFile=0x158, lDistanceToMove=12, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2a [0060.092] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0xa95d [0060.092] CloseHandle (hObject=0x11c) returned 1 [0060.092] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xa95d [0060.092] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xa95d [0060.092] SetFilePointer (in: hFile=0x158, lDistanceToMove=43357, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xa95d [0060.092] SetFilePointer (in: hFile=0x158, lDistanceToMove=43357, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0xa95d [0060.092] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xa95d [0060.092] SetFilePointer (in: hFile=0x158, lDistanceToMove=43357, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0xa95d [0060.093] SetEndOfFile (hFile=0x158) returned 1 [0060.093] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xa95d [0060.093] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xa95d [0060.093] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0060.093] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe36ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0060.093] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0060.093] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe37ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0060.093] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe37ec, cbMultiByte=12, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="THMBNAIL.PNGꞗ@涤(\x18믉`믑`") returned 12 [0060.093] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0060.093] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe36ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0060.093] WriteFile (in: hFile=0x158, lpBuffer=0x378d718*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x378d718*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0060.093] CharToOemA (in: pSrc="THMBNAIL.PNG", pDst=0x1fe37ec | out: pDst="THMBNAIL.PNG") returned 1 [0060.093] WriteFile (in: hFile=0x158, lpBuffer=0x1fe37ec*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe37ec*, lpNumberOfBytesWritten=0x18efcc*=0xc, lpOverlapped=0x0) returned 1 [0060.093] WriteFile (in: hFile=0x158, lpBuffer=0x1fea2d8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea2d8*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0060.093] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0060.093] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0060.094] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xa9a2 [0060.094] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xa9a2 [0060.094] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0060.094] WriteFile (in: hFile=0x158, lpBuffer=0x35f01dc*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f01dc*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0060.094] DeleteFileW (lpFileName="") returned 0 [0060.094] GetLastError () returned 0x3 [0060.094] GetFileAttributesW (lpFileName="") returned 0xffffffff [0060.094] SetLastError (dwErrCode=0x3) [0060.094] FlushFileBuffers (hFile=0x158) returned 1 [0060.096] GetCurrentThreadId () returned 0x970 [0060.096] GetCurrentThreadId () returned 0x970 [0060.096] GetCurrentThreadId () returned 0x970 [0060.097] GetCurrentThreadId () returned 0x970 [0060.097] GetCurrentThreadId () returned 0x970 [0060.097] GetCurrentThreadId () returned 0x970 [0060.097] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xaa59 [0060.097] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xaa59 [0060.097] SetFilePointer (in: hFile=0x158, lDistanceToMove=43609, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xaa59 [0060.097] CloseHandle (hObject=0x158) returned 1 [0060.098] GetCurrentThreadId () returned 0x970 [0060.098] GetCurrentThreadId () returned 0x970 [0060.098] GetCurrentThreadId () returned 0x970 [0060.098] GetCurrentThreadId () returned 0x970 [0060.098] GetCurrentThreadId () returned 0x970 [0060.098] GetCurrentThreadId () returned 0x970 [0060.098] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\Файл зашифрован [THMBNAIL.PNG].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\Файл зашифрован [thmbnail.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0060.098] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xaa59 [0060.098] SetFilePointer (in: hFile=0x158, lDistanceToMove=43481, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa9d9 [0060.098] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0060.098] GetFileType (hFile=0x158) returned 0x1 [0060.098] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x7, wMilliseconds=0x170)) [0060.098] GetCurrentThreadId () returned 0x970 [0060.099] GetCurrentThreadId () returned 0x970 [0060.099] GetCurrentThreadId () returned 0x970 [0060.099] GetCurrentThreadId () returned 0x970 [0060.099] GetCurrentThreadId () returned 0x970 [0060.099] GetCurrentThreadId () returned 0x970 [0060.099] GetCurrentThreadId () returned 0x970 [0060.099] GetCurrentThreadId () returned 0x970 [0060.099] GetCurrentThreadId () returned 0x970 [0060.099] GetCurrentThreadId () returned 0x970 [0060.099] GetCurrentThreadId () returned 0x970 [0060.099] GetCurrentThreadId () returned 0x970 [0060.099] GetCurrentThreadId () returned 0x970 [0060.099] GetCurrentThreadId () returned 0x970 [0060.099] GetCurrentThreadId () returned 0x970 [0060.099] GetCurrentThreadId () returned 0x970 [0060.099] GetCurrentThreadId () returned 0x970 [0060.099] GetCurrentThreadId () returned 0x970 [0060.099] GetCurrentThreadId () returned 0x970 [0060.099] GetCurrentThreadId () returned 0x970 [0060.099] GetCurrentThreadId () returned 0x970 [0060.099] GetCurrentThreadId () returned 0x970 [0060.099] GetCurrentThreadId () returned 0x970 [0060.099] GetCurrentThreadId () returned 0x970 [0060.099] GetCurrentThreadId () returned 0x970 [0060.099] GetCurrentThreadId () returned 0x970 [0060.099] GetCurrentThreadId () returned 0x970 [0060.099] GetCurrentThreadId () returned 0x970 [0060.099] GetCurrentThreadId () returned 0x970 [0060.099] GetCurrentThreadId () returned 0x970 [0060.099] GetCurrentThreadId () returned 0x970 [0060.099] GetCurrentThreadId () returned 0x970 [0060.099] GetCurrentThreadId () returned 0x970 [0060.099] GetCurrentThreadId () returned 0x970 [0060.099] GetCurrentThreadId () returned 0x970 [0060.099] GetCurrentThreadId () returned 0x970 [0060.099] GetCurrentThreadId () returned 0x970 [0060.099] GetCurrentThreadId () returned 0x970 [0060.099] GetCurrentThreadId () returned 0x970 [0060.099] GetCurrentThreadId () returned 0x970 [0060.099] GetCurrentThreadId () returned 0x970 [0060.099] GetCurrentThreadId () returned 0x970 [0060.099] GetCurrentThreadId () returned 0x970 [0060.099] GetCurrentThreadId () returned 0x970 [0060.099] GetCurrentThreadId () returned 0x970 [0060.099] GetCurrentThreadId () returned 0x970 [0060.099] GetCurrentThreadId () returned 0x970 [0060.099] GetCurrentThreadId () returned 0x970 [0060.100] GetCurrentThreadId () returned 0x970 [0060.100] GetCurrentThreadId () returned 0x970 [0060.100] GetCurrentThreadId () returned 0x970 [0060.100] GetCurrentThreadId () returned 0x970 [0060.100] GetCurrentThreadId () returned 0x970 [0060.100] GetCurrentThreadId () returned 0x970 [0060.100] GetCurrentThreadId () returned 0x970 [0060.100] GetCurrentThreadId () returned 0x970 [0060.100] GetCurrentThreadId () returned 0x970 [0060.100] GetCurrentThreadId () returned 0x970 [0060.100] GetCurrentThreadId () returned 0x970 [0060.100] GetCurrentThreadId () returned 0x970 [0060.100] GetCurrentThreadId () returned 0x970 [0060.100] GetCurrentThreadId () returned 0x970 [0060.100] GetCurrentThreadId () returned 0x970 [0060.100] GetCurrentThreadId () returned 0x970 [0060.100] GetCurrentThreadId () returned 0x970 [0060.100] GetCurrentThreadId () returned 0x970 [0060.100] GetCurrentThreadId () returned 0x970 [0060.100] GetCurrentThreadId () returned 0x970 [0060.100] GetCurrentThreadId () returned 0x970 [0060.100] GetCurrentThreadId () returned 0x970 [0060.100] GetCurrentThreadId () returned 0x970 [0060.100] GetCurrentThreadId () returned 0x970 [0060.100] GetCurrentThreadId () returned 0x970 [0060.100] GetCurrentThreadId () returned 0x970 [0060.100] GetCurrentThreadId () returned 0x970 [0060.100] GetCurrentThreadId () returned 0x970 [0060.100] GetCurrentThreadId () returned 0x970 [0060.100] GetCurrentThreadId () returned 0x970 [0060.100] GetCurrentThreadId () returned 0x970 [0060.100] GetCurrentThreadId () returned 0x970 [0060.100] GetCurrentThreadId () returned 0x970 [0060.100] GetCurrentThreadId () returned 0x970 [0060.100] GetCurrentThreadId () returned 0x970 [0060.100] GetCurrentThreadId () returned 0x970 [0060.100] GetCurrentThreadId () returned 0x970 [0060.100] GetCurrentThreadId () returned 0x970 [0060.100] GetCurrentThreadId () returned 0x970 [0060.100] GetCurrentThreadId () returned 0x970 [0060.100] GetCurrentThreadId () returned 0x970 [0060.100] GetCurrentThreadId () returned 0x970 [0060.100] GetCurrentThreadId () returned 0x970 [0060.100] GetCurrentThreadId () returned 0x970 [0060.100] GetCurrentThreadId () returned 0x970 [0060.100] GetCurrentThreadId () returned 0x970 [0060.100] GetCurrentThreadId () returned 0x970 [0060.101] GetCurrentThreadId () returned 0x970 [0060.101] GetCurrentThreadId () returned 0x970 [0060.101] GetCurrentThreadId () returned 0x970 [0060.101] GetCurrentThreadId () returned 0x970 [0060.101] GetCurrentThreadId () returned 0x970 [0060.101] GetCurrentThreadId () returned 0x970 [0060.101] GetCurrentThreadId () returned 0x970 [0060.101] GetCurrentThreadId () returned 0x970 [0060.101] GetCurrentThreadId () returned 0x970 [0060.101] GetCurrentThreadId () returned 0x970 [0060.101] GetCurrentThreadId () returned 0x970 [0060.101] GetCurrentThreadId () returned 0x970 [0060.101] GetCurrentThreadId () returned 0x970 [0060.101] GetCurrentThreadId () returned 0x970 [0060.101] GetCurrentThreadId () returned 0x970 [0060.101] GetCurrentThreadId () returned 0x970 [0060.101] GetCurrentThreadId () returned 0x970 [0060.101] GetCurrentThreadId () returned 0x970 [0060.101] GetCurrentThreadId () returned 0x970 [0060.101] GetCurrentThreadId () returned 0x970 [0060.101] GetCurrentThreadId () returned 0x970 [0060.101] GetCurrentThreadId () returned 0x970 [0060.101] GetCurrentThreadId () returned 0x970 [0060.101] GetCurrentThreadId () returned 0x970 [0060.101] GetCurrentThreadId () returned 0x970 [0060.101] GetCurrentThreadId () returned 0x970 [0060.101] GetCurrentThreadId () returned 0x970 [0060.101] GetCurrentThreadId () returned 0x970 [0060.101] GetCurrentThreadId () returned 0x970 [0060.101] GetCurrentThreadId () returned 0x970 [0060.101] GetCurrentThreadId () returned 0x970 [0060.101] GetCurrentThreadId () returned 0x970 [0060.101] GetCurrentThreadId () returned 0x970 [0060.101] GetCurrentThreadId () returned 0x970 [0060.101] GetCurrentThreadId () returned 0x970 [0060.101] GetCurrentThreadId () returned 0x970 [0060.101] GetCurrentThreadId () returned 0x970 [0060.101] GetCurrentThreadId () returned 0x970 [0060.101] GetCurrentThreadId () returned 0x970 [0060.101] GetCurrentThreadId () returned 0x970 [0060.101] GetCurrentThreadId () returned 0x970 [0060.101] GetCurrentThreadId () returned 0x970 [0060.101] GetCurrentThreadId () returned 0x970 [0060.101] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0060.102] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0060.102] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fef390, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0060.102] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0060.102] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0060.102] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fef390, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0060.102] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0060.102] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0060.102] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0060.102] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0060.102] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0060.102] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0060.102] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0060.102] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0060.102] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fef3f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0060.102] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0060.102] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0060.102] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fef3f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0060.102] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0060.102] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0060.102] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fef3f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0060.102] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x7, wMilliseconds=0x170)) [0060.102] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="u=}Wrp,WU^ri$5J0PrkR=)m}}@-P(cCE", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0060.102] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="u=}Wrp,WU^ri$5J0PrkR=)m}}@-P(cCE", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0060.102] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="u=}Wrp,WU^ri$5J0PrkR=)m}}@-P(cCE", cchWideChar=32, lpMultiByteStr=0x2002818, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="u=}Wrp,WU^ri$5J0PrkR=)m}}@-P(cCE", lpUsedDefaultChar=0x0) returned 32 [0060.102] GetCurrentThreadId () returned 0x970 [0060.102] GetCurrentThreadId () returned 0x970 [0060.102] GetCurrentThreadId () returned 0x970 [0060.102] GetCurrentThreadId () returned 0x970 [0060.102] GetCurrentThreadId () returned 0x970 [0060.102] GetCurrentThreadId () returned 0x970 [0060.110] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0060.110] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0060.110] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x34f80d8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0060.110] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0060.110] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAAN5nTJzk9TGYuuKIy2NhpnQN88ctx//oB1sRL0Ud2jqQshpKGknm0czhZQcsCa8boNwAloN1wI/z++rzPwNUy8Xv4QWfrNVzjHe/sycVbAb5ZnwCi9A/MLTqfJQfDjGAhqwcZUAkxGawRke8B+lf9RvLvgdCEpcE5HbPOgafs8rQkPolVW3GA0iZS1wbWJTOCrHkljnBlUKv2NzFTPf06Gpd0t7LZjnow==") returned 232 [0060.110] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x7, wMilliseconds=0x180)) [0060.110] GetCurrentThreadId () returned 0x970 [0060.110] GetCurrentThreadId () returned 0x970 [0060.110] GetCurrentThreadId () returned 0x970 [0060.110] GetCurrentThreadId () returned 0x970 [0060.110] GetCurrentThreadId () returned 0x970 [0060.110] GetCurrentThreadId () returned 0x970 [0060.110] GetCurrentThreadId () returned 0x970 [0060.110] GetCurrentThreadId () returned 0x970 [0060.110] GetCurrentThreadId () returned 0x970 [0060.110] GetCurrentThreadId () returned 0x970 [0060.110] GetCurrentThreadId () returned 0x970 [0060.110] GetCurrentThreadId () returned 0x970 [0060.110] GetCurrentThreadId () returned 0x970 [0060.110] GetCurrentThreadId () returned 0x970 [0060.110] GetCurrentThreadId () returned 0x970 [0060.110] GetCurrentThreadId () returned 0x970 [0060.110] GetCurrentThreadId () returned 0x970 [0060.110] GetCurrentThreadId () returned 0x970 [0060.110] GetCurrentThreadId () returned 0x970 [0060.110] GetCurrentThreadId () returned 0x970 [0060.110] GetCurrentThreadId () returned 0x970 [0060.111] GetCurrentThreadId () returned 0x970 [0060.111] GetCurrentThreadId () returned 0x970 [0060.111] GetCurrentThreadId () returned 0x970 [0060.111] GetCurrentThreadId () returned 0x970 [0060.111] GetCurrentThreadId () returned 0x970 [0060.111] GetCurrentThreadId () returned 0x970 [0060.111] GetCurrentThreadId () returned 0x970 [0060.111] GetCurrentThreadId () returned 0x970 [0060.111] GetCurrentThreadId () returned 0x970 [0060.111] GetCurrentThreadId () returned 0x970 [0060.111] GetCurrentThreadId () returned 0x970 [0060.111] GetCurrentThreadId () returned 0x970 [0060.111] GetCurrentThreadId () returned 0x970 [0060.111] GetCurrentThreadId () returned 0x970 [0060.111] GetCurrentThreadId () returned 0x970 [0060.111] GetCurrentThreadId () returned 0x970 [0060.111] GetCurrentThreadId () returned 0x970 [0060.111] GetCurrentThreadId () returned 0x970 [0060.111] GetCurrentThreadId () returned 0x970 [0060.111] GetCurrentThreadId () returned 0x970 [0060.111] GetCurrentThreadId () returned 0x970 [0060.111] GetCurrentThreadId () returned 0x970 [0060.111] GetCurrentThreadId () returned 0x970 [0060.111] GetCurrentThreadId () returned 0x970 [0060.111] GetCurrentThreadId () returned 0x970 [0060.111] GetCurrentThreadId () returned 0x970 [0060.111] GetCurrentThreadId () returned 0x970 [0060.111] GetCurrentThreadId () returned 0x970 [0060.111] GetCurrentThreadId () returned 0x970 [0060.111] GetCurrentThreadId () returned 0x970 [0060.111] GetCurrentThreadId () returned 0x970 [0060.111] GetCurrentThreadId () returned 0x970 [0060.111] GetCurrentThreadId () returned 0x970 [0060.111] GetCurrentThreadId () returned 0x970 [0060.111] GetCurrentThreadId () returned 0x970 [0060.111] GetCurrentThreadId () returned 0x970 [0060.111] GetCurrentThreadId () returned 0x970 [0060.111] GetCurrentThreadId () returned 0x970 [0060.111] GetCurrentThreadId () returned 0x970 [0060.111] GetCurrentThreadId () returned 0x970 [0060.111] GetCurrentThreadId () returned 0x970 [0060.111] GetCurrentThreadId () returned 0x970 [0060.111] GetCurrentThreadId () returned 0x970 [0060.111] GetCurrentThreadId () returned 0x970 [0060.111] GetCurrentThreadId () returned 0x970 [0060.111] GetCurrentThreadId () returned 0x970 [0060.111] GetCurrentThreadId () returned 0x970 [0060.111] GetCurrentThreadId () returned 0x970 [0060.111] GetCurrentThreadId () returned 0x970 [0060.112] GetCurrentThreadId () returned 0x970 [0060.112] GetCurrentThreadId () returned 0x970 [0060.112] GetCurrentThreadId () returned 0x970 [0060.112] GetCurrentThreadId () returned 0x970 [0060.112] GetCurrentThreadId () returned 0x970 [0060.112] GetCurrentThreadId () returned 0x970 [0060.112] GetCurrentThreadId () returned 0x970 [0060.112] GetCurrentThreadId () returned 0x970 [0060.112] GetCurrentThreadId () returned 0x970 [0060.112] GetCurrentThreadId () returned 0x970 [0060.112] GetCurrentThreadId () returned 0x970 [0060.112] GetCurrentThreadId () returned 0x970 [0060.112] GetCurrentThreadId () returned 0x970 [0060.112] GetCurrentThreadId () returned 0x970 [0060.112] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAAN5nTJzk9TGYuuKIy2NhpnQN88ctx//oB1sRL0Ud2jqQshpKGknm0czhZQcsCa8boNwAloN1wI/z++rzPwNUy8Xv4QWfrNVzjHe/sycVbAb5ZnwCi9A/MLTqfJQfDjGAhqwcZUAkxGawRke8B+lf9RvLvgdCEpcE5HbPOgafs8rQkPolVW3GA0iZS1wbWJTOCrHkljnBlUKv2NzFTPf06Gpd0t7LZjnow==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0060.112] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAAN5nTJzk9TGYuuKIy2NhpnQN88ctx//oB1sRL0Ud2jqQshpKGknm0czhZQcsCa8boNwAloN1wI/z++rzPwNUy8Xv4QWfrNVzjHe/sycVbAb5ZnwCi9A/MLTqfJQfDjGAhqwcZUAkxGawRke8B+lf9RvLvgdCEpcE5HbPOgafs8rQkPolVW3GA0iZS1wbWJTOCrHkljnBlUKv2NzFTPf06Gpd0t7LZjnow==", cchWideChar=245, lpMultiByteStr=0x353933c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAAN5nTJzk9TGYuuKIy2NhpnQN88ctx//oB1sRL0Ud2jqQshpKGknm0czhZQcsCa8boNwAloN1wI/z++rzPwNUy8Xv4QWfrNVzjHe/sycVbAb5ZnwCi9A/MLTqfJQfDjGAhqwcZUAkxGawRke8B+lf9RvLvgdCEpcE5HbPOgafs8rQkPolVW3GA0iZS1wbWJTOCrHkljnBlUKv2NzFTPf06Gpd0t7LZjnow==", lpUsedDefaultChar=0x0) returned 245 [0060.112] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0060.112] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0060.112] CloseHandle (hObject=0x158) returned 1 [0060.113] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png")) returned 1 [0060.114] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=18037773756) returned 1 [0060.114] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\Файл зашифрован [PREVIEW.GIF].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\Файл зашифрован [preview.gif].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0060.117] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0060.117] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0060.117] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0060.117] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0060.117] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0060.118] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0060.118] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0060.118] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0060.118] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0060.118] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0060.118] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0060.118] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0060.118] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0060.118] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0060.118] SetEndOfFile (hFile=0x158) returned 1 [0060.118] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0060.118] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0060.118] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0060.118] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0060.118] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0060.119] WriteFile (in: hFile=0x158, lpBuffer=0x35f011c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f011c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0060.119] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M$$Rns3", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0061.833] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bjzBJ26T7(Fn3\"nzf@VkkKRw#-tX4>s3", cchWideChar=32, lpMultiByteStr=0x20355e4, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bjzBJ26T7(Fn3\"nzf@VkkKRw#-tX4>s3", lpUsedDefaultChar=0x0) returned 32 [0061.833] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0061.833] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0061.833] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 0x295098 [0061.833] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0061.833] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0061.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif")) returned 0x20 [0061.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif")) returned 0x20 [0061.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif")) returned 0x20 [0061.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif")) returned 0x20 [0061.833] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x563)) returned 1 [0061.833] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0061.833] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0061.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif")) returned 0x20 [0061.834] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif")) returned 0x20 [0061.834] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0061.834] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0061.834] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0061.834] SetEndOfFile (hFile=0x158) returned 1 [0061.835] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0061.835] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe410c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0061.835] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0061.835] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe488c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0061.835] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe488c, cbMultiByte=11, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="PREVIEW.GIFGer.gifg") returned 11 [0061.835] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0061.835] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe410c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0061.835] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0061.835] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0061.835] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x563 [0061.835] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0061.835] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0061.835] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0061.835] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0061.835] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe410c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0061.835] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0061.836] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe488c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0061.836] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe488c, cbMultiByte=11, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="PREVIEW.GIFEW.GIFGer.gifg") returned 11 [0061.836] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0061.836] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe410c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0061.836] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0061.837] CharToOemA (in: pSrc="PREVIEW.GIF", pDst=0x1fe488c | out: pDst="PREVIEW.GIF") returned 1 [0061.837] WriteFile (in: hFile=0x158, lpBuffer=0x1fe488c*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe488c*, lpNumberOfBytesWritten=0x18e048*=0xb, lpOverlapped=0x0) returned 1 [0061.837] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0061.837] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0061.837] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0061.837] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=18210036103) returned 1 [0061.837] ReadFile (in: hFile=0x11c, lpBuffer=0x37b81c0, nNumberOfBytesToRead=0x563, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37b81c0*, lpNumberOfBytesRead=0x18dd7c*=0x563, lpOverlapped=0x0) returned 1 [0061.838] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0061.838] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=18210193711) returned 1 [0061.847] WriteFile (in: hFile=0x158, lpBuffer=0x1fea1e0*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fea1e0*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0061.847] ReadFile (in: hFile=0x11c, lpBuffer=0x37b81c0, nNumberOfBytesToRead=0x563, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x37b81c0*, lpNumberOfBytesRead=0x18de38*=0x563, lpOverlapped=0x0) returned 1 [0061.847] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x46 [0061.847] WriteFile (in: hFile=0x158, lpBuffer=0x37b87a0*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x37b87a0*, lpNumberOfBytesWritten=0x18de10*=0x563, lpOverlapped=0x0) returned 1 [0061.847] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x5a9 [0061.847] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0061.848] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0061.848] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0061.848] SetFilePointer (in: hFile=0x158, lDistanceToMove=11, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x29 [0061.848] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x5b3 [0061.848] CloseHandle (hObject=0x11c) returned 1 [0061.848] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x5b3 [0061.848] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x5b3 [0061.848] SetFilePointer (in: hFile=0x158, lDistanceToMove=1459, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x5b3 [0061.848] SetFilePointer (in: hFile=0x158, lDistanceToMove=1459, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x5b3 [0061.848] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x5b3 [0061.848] SetFilePointer (in: hFile=0x158, lDistanceToMove=1459, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x5b3 [0061.848] SetEndOfFile (hFile=0x158) returned 1 [0061.848] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x5b3 [0061.848] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x5b3 [0061.849] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0061.849] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe410c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0061.849] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0061.849] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe41ac, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0061.849] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe41ac, cbMultiByte=11, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="PREVIEW.GIF\x18ꞗ@涤(\x18믉`믑`") returned 11 [0061.849] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0061.849] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe410c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0061.849] WriteFile (in: hFile=0x158, lpBuffer=0x379bc78*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x379bc78*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0061.849] CharToOemA (in: pSrc="PREVIEW.GIF", pDst=0x1fe41ac | out: pDst="PREVIEW.GIF") returned 1 [0061.849] WriteFile (in: hFile=0x158, lpBuffer=0x1fe41ac*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe41ac*, lpNumberOfBytesWritten=0x18efcc*=0xb, lpOverlapped=0x0) returned 1 [0061.849] WriteFile (in: hFile=0x158, lpBuffer=0x1fea2d8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea2d8*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0061.849] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0061.849] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0061.849] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x5f7 [0061.849] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x5f7 [0061.849] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0061.850] WriteFile (in: hFile=0x158, lpBuffer=0x35f011c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f011c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0061.850] DeleteFileW (lpFileName="") returned 0 [0061.850] GetLastError () returned 0x3 [0061.850] GetFileAttributesW (lpFileName="") returned 0xffffffff [0061.850] SetLastError (dwErrCode=0x3) [0061.850] FlushFileBuffers (hFile=0x158) returned 1 [0061.863] GetCurrentThreadId () returned 0x970 [0061.863] GetCurrentThreadId () returned 0x970 [0061.863] GetCurrentThreadId () returned 0x970 [0061.863] GetCurrentThreadId () returned 0x970 [0061.863] GetCurrentThreadId () returned 0x970 [0061.863] GetCurrentThreadId () returned 0x970 [0061.863] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x6ae [0061.863] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x6ae [0061.863] SetFilePointer (in: hFile=0x158, lDistanceToMove=1710, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x6ae [0061.863] CloseHandle (hObject=0x158) returned 1 [0061.864] GetCurrentThreadId () returned 0x970 [0061.864] GetCurrentThreadId () returned 0x970 [0061.864] GetCurrentThreadId () returned 0x970 [0061.864] GetCurrentThreadId () returned 0x970 [0061.864] GetCurrentThreadId () returned 0x970 [0061.864] GetCurrentThreadId () returned 0x970 [0061.864] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\Файл зашифрован [PREVIEW.GIF].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\Файл зашифрован [preview.gif].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0061.865] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6ae [0061.865] SetFilePointer (in: hFile=0x158, lDistanceToMove=1582, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x62e [0061.865] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0061.865] GetFileType (hFile=0x158) returned 0x1 [0061.865] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x9, wMilliseconds=0x83)) [0061.865] GetCurrentThreadId () returned 0x970 [0061.865] GetCurrentThreadId () returned 0x970 [0061.865] GetCurrentThreadId () returned 0x970 [0061.865] GetCurrentThreadId () returned 0x970 [0061.865] GetCurrentThreadId () returned 0x970 [0061.865] GetCurrentThreadId () returned 0x970 [0061.865] GetCurrentThreadId () returned 0x970 [0061.865] GetCurrentThreadId () returned 0x970 [0061.865] GetCurrentThreadId () returned 0x970 [0061.865] GetCurrentThreadId () returned 0x970 [0061.865] GetCurrentThreadId () returned 0x970 [0061.865] GetCurrentThreadId () returned 0x970 [0061.865] GetCurrentThreadId () returned 0x970 [0061.865] GetCurrentThreadId () returned 0x970 [0061.865] GetCurrentThreadId () returned 0x970 [0061.865] GetCurrentThreadId () returned 0x970 [0061.865] GetCurrentThreadId () returned 0x970 [0061.865] GetCurrentThreadId () returned 0x970 [0061.865] GetCurrentThreadId () returned 0x970 [0061.865] GetCurrentThreadId () returned 0x970 [0061.865] GetCurrentThreadId () returned 0x970 [0061.865] GetCurrentThreadId () returned 0x970 [0061.865] GetCurrentThreadId () returned 0x970 [0061.865] GetCurrentThreadId () returned 0x970 [0061.865] GetCurrentThreadId () returned 0x970 [0061.865] GetCurrentThreadId () returned 0x970 [0061.865] GetCurrentThreadId () returned 0x970 [0061.865] GetCurrentThreadId () returned 0x970 [0061.865] GetCurrentThreadId () returned 0x970 [0061.865] GetCurrentThreadId () returned 0x970 [0061.865] GetCurrentThreadId () returned 0x970 [0061.865] GetCurrentThreadId () returned 0x970 [0061.866] GetCurrentThreadId () returned 0x970 [0061.866] GetCurrentThreadId () returned 0x970 [0061.866] GetCurrentThreadId () returned 0x970 [0061.866] GetCurrentThreadId () returned 0x970 [0061.866] GetCurrentThreadId () returned 0x970 [0061.866] GetCurrentThreadId () returned 0x970 [0061.866] GetCurrentThreadId () returned 0x970 [0061.866] GetCurrentThreadId () returned 0x970 [0061.866] GetCurrentThreadId () returned 0x970 [0061.866] GetCurrentThreadId () returned 0x970 [0061.866] GetCurrentThreadId () returned 0x970 [0061.866] GetCurrentThreadId () returned 0x970 [0061.866] GetCurrentThreadId () returned 0x970 [0061.866] GetCurrentThreadId () returned 0x970 [0061.866] GetCurrentThreadId () returned 0x970 [0061.866] GetCurrentThreadId () returned 0x970 [0061.866] GetCurrentThreadId () returned 0x970 [0061.866] GetCurrentThreadId () returned 0x970 [0061.866] GetCurrentThreadId () returned 0x970 [0061.866] GetCurrentThreadId () returned 0x970 [0061.866] GetCurrentThreadId () returned 0x970 [0061.866] GetCurrentThreadId () returned 0x970 [0061.866] GetCurrentThreadId () returned 0x970 [0061.866] GetCurrentThreadId () returned 0x970 [0061.866] GetCurrentThreadId () returned 0x970 [0061.866] GetCurrentThreadId () returned 0x970 [0061.866] GetCurrentThreadId () returned 0x970 [0061.866] GetCurrentThreadId () returned 0x970 [0061.866] GetCurrentThreadId () returned 0x970 [0061.866] GetCurrentThreadId () returned 0x970 [0061.866] GetCurrentThreadId () returned 0x970 [0061.866] GetCurrentThreadId () returned 0x970 [0061.866] GetCurrentThreadId () returned 0x970 [0061.866] GetCurrentThreadId () returned 0x970 [0061.866] GetCurrentThreadId () returned 0x970 [0061.866] GetCurrentThreadId () returned 0x970 [0061.866] GetCurrentThreadId () returned 0x970 [0061.866] GetCurrentThreadId () returned 0x970 [0061.866] GetCurrentThreadId () returned 0x970 [0061.866] GetCurrentThreadId () returned 0x970 [0061.866] GetCurrentThreadId () returned 0x970 [0061.866] GetCurrentThreadId () returned 0x970 [0061.866] GetCurrentThreadId () returned 0x970 [0061.866] GetCurrentThreadId () returned 0x970 [0061.866] GetCurrentThreadId () returned 0x970 [0061.867] GetCurrentThreadId () returned 0x970 [0061.867] GetCurrentThreadId () returned 0x970 [0061.867] GetCurrentThreadId () returned 0x970 [0061.867] GetCurrentThreadId () returned 0x970 [0061.867] GetCurrentThreadId () returned 0x970 [0061.867] GetCurrentThreadId () returned 0x970 [0061.867] GetCurrentThreadId () returned 0x970 [0061.867] GetCurrentThreadId () returned 0x970 [0061.867] GetCurrentThreadId () returned 0x970 [0061.867] GetCurrentThreadId () returned 0x970 [0061.867] GetCurrentThreadId () returned 0x970 [0061.867] GetCurrentThreadId () returned 0x970 [0061.867] GetCurrentThreadId () returned 0x970 [0061.867] GetCurrentThreadId () returned 0x970 [0061.867] GetCurrentThreadId () returned 0x970 [0061.867] GetCurrentThreadId () returned 0x970 [0061.867] GetCurrentThreadId () returned 0x970 [0061.867] GetCurrentThreadId () returned 0x970 [0061.867] GetCurrentThreadId () returned 0x970 [0061.867] GetCurrentThreadId () returned 0x970 [0061.867] GetCurrentThreadId () returned 0x970 [0061.867] GetCurrentThreadId () returned 0x970 [0061.867] GetCurrentThreadId () returned 0x970 [0061.867] GetCurrentThreadId () returned 0x970 [0061.867] GetCurrentThreadId () returned 0x970 [0061.867] GetCurrentThreadId () returned 0x970 [0061.867] GetCurrentThreadId () returned 0x970 [0061.867] GetCurrentThreadId () returned 0x970 [0061.867] GetCurrentThreadId () returned 0x970 [0061.867] GetCurrentThreadId () returned 0x970 [0061.867] GetCurrentThreadId () returned 0x970 [0061.867] GetCurrentThreadId () returned 0x970 [0061.867] GetCurrentThreadId () returned 0x970 [0061.867] GetCurrentThreadId () returned 0x970 [0061.867] GetCurrentThreadId () returned 0x970 [0061.867] GetCurrentThreadId () returned 0x970 [0061.867] GetCurrentThreadId () returned 0x970 [0061.867] GetCurrentThreadId () returned 0x970 [0061.867] GetCurrentThreadId () returned 0x970 [0061.867] GetCurrentThreadId () returned 0x970 [0061.867] GetCurrentThreadId () returned 0x970 [0061.867] GetCurrentThreadId () returned 0x970 [0061.867] GetCurrentThreadId () returned 0x970 [0061.867] GetCurrentThreadId () returned 0x970 [0061.868] GetCurrentThreadId () returned 0x970 [0061.868] GetCurrentThreadId () returned 0x970 [0061.868] GetCurrentThreadId () returned 0x970 [0061.868] GetCurrentThreadId () returned 0x970 [0061.868] GetCurrentThreadId () returned 0x970 [0061.868] GetCurrentThreadId () returned 0x970 [0061.868] GetCurrentThreadId () returned 0x970 [0061.868] GetCurrentThreadId () returned 0x970 [0061.868] GetCurrentThreadId () returned 0x970 [0061.868] GetCurrentThreadId () returned 0x970 [0061.868] GetCurrentThreadId () returned 0x970 [0061.868] GetCurrentThreadId () returned 0x970 [0061.868] GetCurrentThreadId () returned 0x970 [0061.868] GetCurrentThreadId () returned 0x970 [0061.868] GetCurrentThreadId () returned 0x970 [0061.868] GetCurrentThreadId () returned 0x970 [0061.868] GetCurrentThreadId () returned 0x970 [0061.868] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0061.868] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0061.868] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fefff0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0061.868] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0061.868] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0061.868] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fefff0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0061.868] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0061.868] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0061.868] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0061.868] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0061.868] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0061.868] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0061.868] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0061.868] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0061.868] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff0050, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0061.868] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0061.868] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0061.868] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff0050, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0061.869] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0061.869] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0061.869] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff0050, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0061.869] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x9, wMilliseconds=0x93)) [0061.869] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bjzBJ26T7(Fn3\"nzf@VkkKRw#-tX4>s3", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0061.869] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bjzBJ26T7(Fn3\"nzf@VkkKRw#-tX4>s3", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0061.869] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bjzBJ26T7(Fn3\"nzf@VkkKRw#-tX4>s3", cchWideChar=32, lpMultiByteStr=0x20024e8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bjzBJ26T7(Fn3\"nzf@VkkKRw#-tX4>s3", lpUsedDefaultChar=0x0) returned 32 [0061.869] GetCurrentThreadId () returned 0x970 [0061.869] GetCurrentThreadId () returned 0x970 [0061.869] GetCurrentThreadId () returned 0x970 [0061.869] GetCurrentThreadId () returned 0x970 [0061.869] GetCurrentThreadId () returned 0x970 [0061.869] GetCurrentThreadId () returned 0x970 [0061.876] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0061.876] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0061.876] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3794388, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0061.876] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0061.876] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAFCHWL/jp4129WFJeQA2wS+G49CDU3Wlclb/GyhhyNTBR2TiFMhJ+TMI/mnC9+sr8YkQQmJFrMUxQ1kVmOEiUEv7BT84fA4AQ3qhHEf6U25qr7lVJckGGht2iIEK5QeXmPL+pF1xlLAH7vo5ia4uKbc8bcH+iDBbwk7KTUJi9kAQzPlQ9S6cl+cXgqh9HtkyoRKZpLF0Kri3DTgFgj9W91sFScyrOC8gWQ==") returned 232 [0061.876] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x9, wMilliseconds=0x93)) [0061.876] GetCurrentThreadId () returned 0x970 [0061.876] GetCurrentThreadId () returned 0x970 [0061.876] GetCurrentThreadId () returned 0x970 [0061.876] GetCurrentThreadId () returned 0x970 [0061.877] GetCurrentThreadId () returned 0x970 [0061.877] GetCurrentThreadId () returned 0x970 [0061.877] GetCurrentThreadId () returned 0x970 [0061.877] GetCurrentThreadId () returned 0x970 [0061.877] GetCurrentThreadId () returned 0x970 [0061.877] GetCurrentThreadId () returned 0x970 [0061.877] GetCurrentThreadId () returned 0x970 [0061.877] GetCurrentThreadId () returned 0x970 [0061.877] GetCurrentThreadId () returned 0x970 [0061.877] GetCurrentThreadId () returned 0x970 [0061.877] GetCurrentThreadId () returned 0x970 [0061.877] GetCurrentThreadId () returned 0x970 [0061.877] GetCurrentThreadId () returned 0x970 [0061.877] GetCurrentThreadId () returned 0x970 [0061.877] GetCurrentThreadId () returned 0x970 [0061.877] GetCurrentThreadId () returned 0x970 [0061.877] GetCurrentThreadId () returned 0x970 [0061.877] GetCurrentThreadId () returned 0x970 [0061.877] GetCurrentThreadId () returned 0x970 [0061.877] GetCurrentThreadId () returned 0x970 [0061.877] GetCurrentThreadId () returned 0x970 [0061.877] GetCurrentThreadId () returned 0x970 [0061.877] GetCurrentThreadId () returned 0x970 [0061.877] GetCurrentThreadId () returned 0x970 [0061.877] GetCurrentThreadId () returned 0x970 [0061.877] GetCurrentThreadId () returned 0x970 [0061.877] GetCurrentThreadId () returned 0x970 [0061.877] GetCurrentThreadId () returned 0x970 [0061.877] GetCurrentThreadId () returned 0x970 [0061.877] GetCurrentThreadId () returned 0x970 [0061.877] GetCurrentThreadId () returned 0x970 [0061.877] GetCurrentThreadId () returned 0x970 [0061.877] GetCurrentThreadId () returned 0x970 [0061.877] GetCurrentThreadId () returned 0x970 [0061.877] GetCurrentThreadId () returned 0x970 [0061.877] GetCurrentThreadId () returned 0x970 [0061.877] GetCurrentThreadId () returned 0x970 [0061.877] GetCurrentThreadId () returned 0x970 [0061.877] GetCurrentThreadId () returned 0x970 [0061.877] GetCurrentThreadId () returned 0x970 [0061.877] GetCurrentThreadId () returned 0x970 [0061.877] GetCurrentThreadId () returned 0x970 [0061.877] GetCurrentThreadId () returned 0x970 [0061.877] GetCurrentThreadId () returned 0x970 [0061.877] GetCurrentThreadId () returned 0x970 [0061.878] GetCurrentThreadId () returned 0x970 [0061.878] GetCurrentThreadId () returned 0x970 [0061.878] GetCurrentThreadId () returned 0x970 [0061.878] GetCurrentThreadId () returned 0x970 [0061.878] GetCurrentThreadId () returned 0x970 [0061.878] GetCurrentThreadId () returned 0x970 [0061.878] GetCurrentThreadId () returned 0x970 [0061.878] GetCurrentThreadId () returned 0x970 [0061.878] GetCurrentThreadId () returned 0x970 [0061.878] GetCurrentThreadId () returned 0x970 [0061.878] GetCurrentThreadId () returned 0x970 [0061.878] GetCurrentThreadId () returned 0x970 [0061.878] GetCurrentThreadId () returned 0x970 [0061.878] GetCurrentThreadId () returned 0x970 [0061.878] GetCurrentThreadId () returned 0x970 [0061.878] GetCurrentThreadId () returned 0x970 [0061.878] GetCurrentThreadId () returned 0x970 [0061.878] GetCurrentThreadId () returned 0x970 [0061.878] GetCurrentThreadId () returned 0x970 [0061.878] GetCurrentThreadId () returned 0x970 [0061.878] GetCurrentThreadId () returned 0x970 [0061.878] GetCurrentThreadId () returned 0x970 [0061.878] GetCurrentThreadId () returned 0x970 [0061.878] GetCurrentThreadId () returned 0x970 [0061.878] GetCurrentThreadId () returned 0x970 [0061.878] GetCurrentThreadId () returned 0x970 [0061.878] GetCurrentThreadId () returned 0x970 [0061.878] GetCurrentThreadId () returned 0x970 [0061.878] GetCurrentThreadId () returned 0x970 [0061.878] GetCurrentThreadId () returned 0x970 [0061.878] GetCurrentThreadId () returned 0x970 [0061.878] GetCurrentThreadId () returned 0x970 [0061.878] GetCurrentThreadId () returned 0x970 [0061.878] GetCurrentThreadId () returned 0x970 [0061.878] GetCurrentThreadId () returned 0x970 [0061.878] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAFCHWL/jp4129WFJeQA2wS+G49CDU3Wlclb/GyhhyNTBR2TiFMhJ+TMI/mnC9+sr8YkQQmJFrMUxQ1kVmOEiUEv7BT84fA4AQ3qhHEf6U25qr7lVJckGGht2iIEK5QeXmPL+pF1xlLAH7vo5ia4uKbc8bcH+iDBbwk7KTUJi9kAQzPlQ9S6cl+cXgqh9HtkyoRKZpLF0Kri3DTgFgj9W91sFScyrOC8gWQ==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0061.878] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAFCHWL/jp4129WFJeQA2wS+G49CDU3Wlclb/GyhhyNTBR2TiFMhJ+TMI/mnC9+sr8YkQQmJFrMUxQ1kVmOEiUEv7BT84fA4AQ3qhHEf6U25qr7lVJckGGht2iIEK5QeXmPL+pF1xlLAH7vo5ia4uKbc8bcH+iDBbwk7KTUJi9kAQzPlQ9S6cl+cXgqh9HtkyoRKZpLF0Kri3DTgFgj9W91sFScyrOC8gWQ==", cchWideChar=245, lpMultiByteStr=0x353933c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAFCHWL/jp4129WFJeQA2wS+G49CDU3Wlclb/GyhhyNTBR2TiFMhJ+TMI/mnC9+sr8YkQQmJFrMUxQ1kVmOEiUEv7BT84fA4AQ3qhHEf6U25qr7lVJckGGht2iIEK5QeXmPL+pF1xlLAH7vo5ia4uKbc8bcH+iDBbwk7KTUJi9kAQzPlQ9S6cl+cXgqh9HtkyoRKZpLF0Kri3DTgFgj9W91sFScyrOC8gWQ==", lpUsedDefaultChar=0x0) returned 245 [0061.878] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0061.878] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0061.879] CloseHandle (hObject=0x158) returned 1 [0061.879] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif")) returned 1 [0061.880] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=18214373663) returned 1 [0061.880] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\Файл зашифрован [THMBNAIL.PNG].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\Файл зашифрован [thmbnail.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0061.881] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0061.881] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0061.881] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0061.881] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0061.881] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0061.881] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0061.881] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0061.881] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0061.881] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0061.881] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0061.881] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0061.881] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0061.881] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0061.881] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0061.882] SetEndOfFile (hFile=0x158) returned 1 [0061.882] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0061.882] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0061.882] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0061.882] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0061.882] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0061.883] WriteFile (in: hFile=0x158, lpBuffer=0x35f01dc*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f01dc*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0061.883] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="9o4fwqyw5:f(qC@8wcKybmUtUO4}j*yF", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0061.883] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="9o4fwqyw5:f(qC@8wcKybmUtUO4}j*yF", cchWideChar=32, lpMultiByteStr=0x203561c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="9o4fwqyw5:f(qC@8wcKybmUtUO4}j*yF", lpUsedDefaultChar=0x0) returned 32 [0061.883] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0061.883] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0061.883] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xbbf3, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0x295098 [0061.883] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0061.883] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0061.883] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png")) returned 0x20 [0061.883] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png")) returned 0x20 [0061.884] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png")) returned 0x20 [0061.884] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png")) returned 0x20 [0061.884] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xbbf3)) returned 1 [0061.884] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0061.884] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0061.884] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png")) returned 0x20 [0061.884] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png")) returned 0x20 [0061.884] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0061.884] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0061.884] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0061.884] SetEndOfFile (hFile=0x158) returned 1 [0061.885] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0061.885] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe370c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0061.885] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0061.885] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe378c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0061.885] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe378c, cbMultiByte=12, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="THMBNAIL.PNGer.gifg") returned 12 [0061.885] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0061.885] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe370c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0061.885] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0061.885] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0061.885] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0xbbf3 [0061.886] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0061.886] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0061.886] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0061.886] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0061.886] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe370c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0061.886] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0061.886] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe378c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0061.886] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe378c, cbMultiByte=12, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="THMBNAIL.PNGIL.PNGer.gifg") returned 12 [0061.886] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0061.886] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe370c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0061.886] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0061.887] CharToOemA (in: pSrc="THMBNAIL.PNG", pDst=0x1fe378c | out: pDst="THMBNAIL.PNG") returned 1 [0061.887] WriteFile (in: hFile=0x158, lpBuffer=0x1fe378c*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe378c*, lpNumberOfBytesWritten=0x18e048*=0xc, lpOverlapped=0x0) returned 1 [0061.887] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0061.887] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0061.887] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0061.887] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=18215079020) returned 1 [0061.887] ReadFile (in: hFile=0x11c, lpBuffer=0x37b81a0, nNumberOfBytesToRead=0xbbf3, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37b81a0*, lpNumberOfBytesRead=0x18dd7c*=0xbbf3, lpOverlapped=0x0) returned 1 [0061.889] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0061.889] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=18215284107) returned 1 [0061.898] WriteFile (in: hFile=0x158, lpBuffer=0x1fea3d8*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fea3d8*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0061.898] ReadFile (in: hFile=0x11c, lpBuffer=0x37b81a0, nNumberOfBytesToRead=0xbbf3, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x37b81a0*, lpNumberOfBytesRead=0x18de38*=0xbbf3, lpOverlapped=0x0) returned 1 [0061.900] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x47 [0061.900] WriteFile (in: hFile=0x158, lpBuffer=0x38055c0*, nNumberOfBytesToWrite=0xbbf3, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x38055c0*, lpNumberOfBytesWritten=0x18de10*=0xbbf3, lpOverlapped=0x0) returned 1 [0061.901] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0xbc3a [0061.901] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0061.901] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0061.901] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0061.901] SetFilePointer (in: hFile=0x158, lDistanceToMove=12, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2a [0061.901] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0xbc44 [0061.901] CloseHandle (hObject=0x11c) returned 1 [0061.901] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xbc44 [0061.901] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xbc44 [0061.901] SetFilePointer (in: hFile=0x158, lDistanceToMove=48196, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xbc44 [0061.901] SetFilePointer (in: hFile=0x158, lDistanceToMove=48196, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0xbc44 [0061.901] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xbc44 [0061.902] SetFilePointer (in: hFile=0x158, lDistanceToMove=48196, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0xbc44 [0061.902] SetEndOfFile (hFile=0x158) returned 1 [0061.902] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xbc44 [0061.902] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xbc44 [0061.902] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0061.902] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe370c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0061.902] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0061.902] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe37ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0061.902] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe37ec, cbMultiByte=12, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="THMBNAIL.PNGꞗ@涤(\x18믉`믑`") returned 12 [0061.902] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0061.902] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe370c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0061.902] WriteFile (in: hFile=0x158, lpBuffer=0x379bc78*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x379bc78*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0061.902] CharToOemA (in: pSrc="THMBNAIL.PNG", pDst=0x1fe37ec | out: pDst="THMBNAIL.PNG") returned 1 [0061.902] WriteFile (in: hFile=0x158, lpBuffer=0x1fe37ec*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe37ec*, lpNumberOfBytesWritten=0x18efcc*=0xc, lpOverlapped=0x0) returned 1 [0061.902] WriteFile (in: hFile=0x158, lpBuffer=0x1fea170*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea170*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0061.903] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0061.903] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0061.903] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xbc89 [0061.903] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xbc89 [0061.903] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0061.903] WriteFile (in: hFile=0x158, lpBuffer=0x35f01dc*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f01dc*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0061.903] DeleteFileW (lpFileName="") returned 0 [0061.903] GetLastError () returned 0x3 [0061.903] GetFileAttributesW (lpFileName="") returned 0xffffffff [0061.903] SetLastError (dwErrCode=0x3) [0061.903] FlushFileBuffers (hFile=0x158) returned 1 [0061.906] GetCurrentThreadId () returned 0x970 [0061.906] GetCurrentThreadId () returned 0x970 [0061.906] GetCurrentThreadId () returned 0x970 [0061.906] GetCurrentThreadId () returned 0x970 [0061.906] GetCurrentThreadId () returned 0x970 [0061.906] GetCurrentThreadId () returned 0x970 [0061.906] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xbd40 [0061.906] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xbd40 [0061.906] SetFilePointer (in: hFile=0x158, lDistanceToMove=48448, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xbd40 [0061.906] CloseHandle (hObject=0x158) returned 1 [0061.908] GetCurrentThreadId () returned 0x970 [0061.908] GetCurrentThreadId () returned 0x970 [0061.908] GetCurrentThreadId () returned 0x970 [0061.908] GetCurrentThreadId () returned 0x970 [0061.908] GetCurrentThreadId () returned 0x970 [0061.908] GetCurrentThreadId () returned 0x970 [0061.908] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\Файл зашифрован [THMBNAIL.PNG].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\Файл зашифрован [thmbnail.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0061.908] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbd40 [0061.908] SetFilePointer (in: hFile=0x158, lDistanceToMove=48320, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbcc0 [0061.908] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0061.908] GetFileType (hFile=0x158) returned 0x1 [0061.908] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x9, wMilliseconds=0xb2)) [0061.908] GetCurrentThreadId () returned 0x970 [0061.909] GetCurrentThreadId () returned 0x970 [0061.909] GetCurrentThreadId () returned 0x970 [0061.909] GetCurrentThreadId () returned 0x970 [0061.909] GetCurrentThreadId () returned 0x970 [0061.909] GetCurrentThreadId () returned 0x970 [0061.909] GetCurrentThreadId () returned 0x970 [0061.909] GetCurrentThreadId () returned 0x970 [0061.909] GetCurrentThreadId () returned 0x970 [0061.909] GetCurrentThreadId () returned 0x970 [0061.909] GetCurrentThreadId () returned 0x970 [0061.909] GetCurrentThreadId () returned 0x970 [0061.909] GetCurrentThreadId () returned 0x970 [0061.909] GetCurrentThreadId () returned 0x970 [0061.909] GetCurrentThreadId () returned 0x970 [0061.909] GetCurrentThreadId () returned 0x970 [0061.909] GetCurrentThreadId () returned 0x970 [0061.909] GetCurrentThreadId () returned 0x970 [0061.909] GetCurrentThreadId () returned 0x970 [0061.909] GetCurrentThreadId () returned 0x970 [0061.909] GetCurrentThreadId () returned 0x970 [0061.909] GetCurrentThreadId () returned 0x970 [0061.909] GetCurrentThreadId () returned 0x970 [0061.909] GetCurrentThreadId () returned 0x970 [0061.909] GetCurrentThreadId () returned 0x970 [0061.909] GetCurrentThreadId () returned 0x970 [0061.909] GetCurrentThreadId () returned 0x970 [0061.909] GetCurrentThreadId () returned 0x970 [0061.909] GetCurrentThreadId () returned 0x970 [0061.909] GetCurrentThreadId () returned 0x970 [0061.909] GetCurrentThreadId () returned 0x970 [0061.909] GetCurrentThreadId () returned 0x970 [0061.909] GetCurrentThreadId () returned 0x970 [0061.909] GetCurrentThreadId () returned 0x970 [0061.909] GetCurrentThreadId () returned 0x970 [0061.909] GetCurrentThreadId () returned 0x970 [0061.909] GetCurrentThreadId () returned 0x970 [0061.909] GetCurrentThreadId () returned 0x970 [0061.909] GetCurrentThreadId () returned 0x970 [0061.909] GetCurrentThreadId () returned 0x970 [0061.909] GetCurrentThreadId () returned 0x970 [0061.909] GetCurrentThreadId () returned 0x970 [0061.909] GetCurrentThreadId () returned 0x970 [0061.909] GetCurrentThreadId () returned 0x970 [0061.910] GetCurrentThreadId () returned 0x970 [0061.910] GetCurrentThreadId () returned 0x970 [0061.910] GetCurrentThreadId () returned 0x970 [0061.910] GetCurrentThreadId () returned 0x970 [0061.910] GetCurrentThreadId () returned 0x970 [0061.910] GetCurrentThreadId () returned 0x970 [0061.910] GetCurrentThreadId () returned 0x970 [0061.910] GetCurrentThreadId () returned 0x970 [0061.910] GetCurrentThreadId () returned 0x970 [0061.910] GetCurrentThreadId () returned 0x970 [0061.910] GetCurrentThreadId () returned 0x970 [0061.910] GetCurrentThreadId () returned 0x970 [0061.910] GetCurrentThreadId () returned 0x970 [0061.910] GetCurrentThreadId () returned 0x970 [0061.910] GetCurrentThreadId () returned 0x970 [0061.910] GetCurrentThreadId () returned 0x970 [0061.910] GetCurrentThreadId () returned 0x970 [0061.910] GetCurrentThreadId () returned 0x970 [0061.910] GetCurrentThreadId () returned 0x970 [0061.910] GetCurrentThreadId () returned 0x970 [0061.910] GetCurrentThreadId () returned 0x970 [0061.910] GetCurrentThreadId () returned 0x970 [0061.910] GetCurrentThreadId () returned 0x970 [0061.910] GetCurrentThreadId () returned 0x970 [0061.910] GetCurrentThreadId () returned 0x970 [0061.910] GetCurrentThreadId () returned 0x970 [0061.910] GetCurrentThreadId () returned 0x970 [0061.910] GetCurrentThreadId () returned 0x970 [0061.910] GetCurrentThreadId () returned 0x970 [0061.910] GetCurrentThreadId () returned 0x970 [0061.910] GetCurrentThreadId () returned 0x970 [0061.910] GetCurrentThreadId () returned 0x970 [0061.910] GetCurrentThreadId () returned 0x970 [0061.910] GetCurrentThreadId () returned 0x970 [0061.910] GetCurrentThreadId () returned 0x970 [0061.910] GetCurrentThreadId () returned 0x970 [0061.910] GetCurrentThreadId () returned 0x970 [0061.910] GetCurrentThreadId () returned 0x970 [0061.910] GetCurrentThreadId () returned 0x970 [0061.910] GetCurrentThreadId () returned 0x970 [0061.910] GetCurrentThreadId () returned 0x970 [0061.910] GetCurrentThreadId () returned 0x970 [0061.910] GetCurrentThreadId () returned 0x970 [0061.910] GetCurrentThreadId () returned 0x970 [0061.910] GetCurrentThreadId () returned 0x970 [0061.911] GetCurrentThreadId () returned 0x970 [0061.911] GetCurrentThreadId () returned 0x970 [0061.911] GetCurrentThreadId () returned 0x970 [0061.911] GetCurrentThreadId () returned 0x970 [0061.911] GetCurrentThreadId () returned 0x970 [0061.911] GetCurrentThreadId () returned 0x970 [0061.911] GetCurrentThreadId () returned 0x970 [0061.911] GetCurrentThreadId () returned 0x970 [0061.911] GetCurrentThreadId () returned 0x970 [0061.911] GetCurrentThreadId () returned 0x970 [0061.911] GetCurrentThreadId () returned 0x970 [0061.911] GetCurrentThreadId () returned 0x970 [0061.911] GetCurrentThreadId () returned 0x970 [0061.911] GetCurrentThreadId () returned 0x970 [0061.911] GetCurrentThreadId () returned 0x970 [0061.911] GetCurrentThreadId () returned 0x970 [0061.911] GetCurrentThreadId () returned 0x970 [0061.911] GetCurrentThreadId () returned 0x970 [0061.911] GetCurrentThreadId () returned 0x970 [0061.911] GetCurrentThreadId () returned 0x970 [0061.911] GetCurrentThreadId () returned 0x970 [0061.911] GetCurrentThreadId () returned 0x970 [0061.911] GetCurrentThreadId () returned 0x970 [0061.911] GetCurrentThreadId () returned 0x970 [0061.911] GetCurrentThreadId () returned 0x970 [0061.911] GetCurrentThreadId () returned 0x970 [0061.911] GetCurrentThreadId () returned 0x970 [0061.911] GetCurrentThreadId () returned 0x970 [0061.911] GetCurrentThreadId () returned 0x970 [0061.911] GetCurrentThreadId () returned 0x970 [0061.911] GetCurrentThreadId () returned 0x970 [0061.911] GetCurrentThreadId () returned 0x970 [0061.911] GetCurrentThreadId () returned 0x970 [0061.911] GetCurrentThreadId () returned 0x970 [0061.911] GetCurrentThreadId () returned 0x970 [0061.911] GetCurrentThreadId () returned 0x970 [0061.911] GetCurrentThreadId () returned 0x970 [0061.911] GetCurrentThreadId () returned 0x970 [0061.911] GetCurrentThreadId () returned 0x970 [0061.911] GetCurrentThreadId () returned 0x970 [0061.911] GetCurrentThreadId () returned 0x970 [0061.911] GetCurrentThreadId () returned 0x970 [0061.911] GetCurrentThreadId () returned 0x970 [0061.911] GetCurrentThreadId () returned 0x970 [0061.911] GetCurrentThreadId () returned 0x970 [0061.912] GetCurrentThreadId () returned 0x970 [0061.912] GetCurrentThreadId () returned 0x970 [0061.912] GetCurrentThreadId () returned 0x970 [0061.912] GetCurrentThreadId () returned 0x970 [0061.912] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0061.912] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0061.912] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff0050, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0061.912] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0061.912] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0061.912] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff0050, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0061.912] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0061.912] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0061.912] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0061.912] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0061.912] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0061.912] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0061.912] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0061.912] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0061.912] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff00b0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0061.912] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0061.912] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0061.912] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff00b0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0061.912] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0061.912] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0061.912] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff00b0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0061.912] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x9, wMilliseconds=0xb2)) [0061.912] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="9o4fwqyw5:f(qC@8wcKybmUtUO4}j*yF", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0061.912] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="9o4fwqyw5:f(qC@8wcKybmUtUO4}j*yF", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0061.912] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="9o4fwqyw5:f(qC@8wcKybmUtUO4}j*yF", cchWideChar=32, lpMultiByteStr=0x2002e78, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="9o4fwqyw5:f(qC@8wcKybmUtUO4}j*yF", lpUsedDefaultChar=0x0) returned 32 [0061.912] GetCurrentThreadId () returned 0x970 [0061.912] GetCurrentThreadId () returned 0x970 [0061.912] GetCurrentThreadId () returned 0x970 [0061.913] GetCurrentThreadId () returned 0x970 [0061.913] GetCurrentThreadId () returned 0x970 [0061.913] GetCurrentThreadId () returned 0x970 [0061.920] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0061.920] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0061.920] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3794478, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0061.920] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0061.920] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAABxh3tG82BGVZY2uD1OivBpyfrL5mMJy5M6oJVGtVsdmhk3A349GKiyS/8V7/b6vtDUS1Fp4jJTnm6zmLobh1e+m603i/jXFoyYbzBKGNrUk/i67CvCXkeicHJ0RHHvQ5mZdB7RbHIvpfSFRUwDFjmeMCqIXk/omSs0XPsfWbISF5QqDviTEMNIZl3b1ZWNA2rZII8GyDcnx5dYzx9PFISRzoQgLESQ31w==") returned 232 [0061.920] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x9, wMilliseconds=0xc2)) [0061.920] GetCurrentThreadId () returned 0x970 [0061.920] GetCurrentThreadId () returned 0x970 [0061.920] GetCurrentThreadId () returned 0x970 [0061.921] GetCurrentThreadId () returned 0x970 [0061.921] GetCurrentThreadId () returned 0x970 [0061.921] GetCurrentThreadId () returned 0x970 [0061.921] GetCurrentThreadId () returned 0x970 [0061.921] GetCurrentThreadId () returned 0x970 [0061.921] GetCurrentThreadId () returned 0x970 [0061.921] GetCurrentThreadId () returned 0x970 [0061.921] GetCurrentThreadId () returned 0x970 [0061.921] GetCurrentThreadId () returned 0x970 [0061.921] GetCurrentThreadId () returned 0x970 [0061.921] GetCurrentThreadId () returned 0x970 [0061.921] GetCurrentThreadId () returned 0x970 [0061.921] GetCurrentThreadId () returned 0x970 [0061.921] GetCurrentThreadId () returned 0x970 [0061.921] GetCurrentThreadId () returned 0x970 [0061.921] GetCurrentThreadId () returned 0x970 [0061.921] GetCurrentThreadId () returned 0x970 [0061.921] GetCurrentThreadId () returned 0x970 [0061.921] GetCurrentThreadId () returned 0x970 [0061.921] GetCurrentThreadId () returned 0x970 [0061.921] GetCurrentThreadId () returned 0x970 [0061.921] GetCurrentThreadId () returned 0x970 [0061.921] GetCurrentThreadId () returned 0x970 [0061.921] GetCurrentThreadId () returned 0x970 [0061.921] GetCurrentThreadId () returned 0x970 [0061.921] GetCurrentThreadId () returned 0x970 [0061.921] GetCurrentThreadId () returned 0x970 [0061.921] GetCurrentThreadId () returned 0x970 [0061.921] GetCurrentThreadId () returned 0x970 [0061.921] GetCurrentThreadId () returned 0x970 [0061.921] GetCurrentThreadId () returned 0x970 [0061.921] GetCurrentThreadId () returned 0x970 [0061.921] GetCurrentThreadId () returned 0x970 [0061.921] GetCurrentThreadId () returned 0x970 [0061.921] GetCurrentThreadId () returned 0x970 [0061.921] GetCurrentThreadId () returned 0x970 [0061.921] GetCurrentThreadId () returned 0x970 [0061.921] GetCurrentThreadId () returned 0x970 [0061.921] GetCurrentThreadId () returned 0x970 [0061.921] GetCurrentThreadId () returned 0x970 [0061.921] GetCurrentThreadId () returned 0x970 [0061.921] GetCurrentThreadId () returned 0x970 [0061.921] GetCurrentThreadId () returned 0x970 [0061.921] GetCurrentThreadId () returned 0x970 [0061.921] GetCurrentThreadId () returned 0x970 [0061.922] GetCurrentThreadId () returned 0x970 [0061.922] GetCurrentThreadId () returned 0x970 [0061.922] GetCurrentThreadId () returned 0x970 [0061.922] GetCurrentThreadId () returned 0x970 [0061.922] GetCurrentThreadId () returned 0x970 [0061.922] GetCurrentThreadId () returned 0x970 [0061.922] GetCurrentThreadId () returned 0x970 [0061.922] GetCurrentThreadId () returned 0x970 [0061.922] GetCurrentThreadId () returned 0x970 [0061.922] GetCurrentThreadId () returned 0x970 [0061.922] GetCurrentThreadId () returned 0x970 [0061.922] GetCurrentThreadId () returned 0x970 [0061.922] GetCurrentThreadId () returned 0x970 [0061.922] GetCurrentThreadId () returned 0x970 [0061.922] GetCurrentThreadId () returned 0x970 [0061.922] GetCurrentThreadId () returned 0x970 [0061.922] GetCurrentThreadId () returned 0x970 [0061.922] GetCurrentThreadId () returned 0x970 [0061.922] GetCurrentThreadId () returned 0x970 [0061.922] GetCurrentThreadId () returned 0x970 [0061.922] GetCurrentThreadId () returned 0x970 [0061.922] GetCurrentThreadId () returned 0x970 [0061.922] GetCurrentThreadId () returned 0x970 [0061.922] GetCurrentThreadId () returned 0x970 [0061.922] GetCurrentThreadId () returned 0x970 [0061.922] GetCurrentThreadId () returned 0x970 [0061.922] GetCurrentThreadId () returned 0x970 [0061.922] GetCurrentThreadId () returned 0x970 [0061.922] GetCurrentThreadId () returned 0x970 [0061.922] GetCurrentThreadId () returned 0x970 [0061.922] GetCurrentThreadId () returned 0x970 [0061.922] GetCurrentThreadId () returned 0x970 [0061.922] GetCurrentThreadId () returned 0x970 [0061.922] GetCurrentThreadId () returned 0x970 [0061.922] GetCurrentThreadId () returned 0x970 [0061.922] GetCurrentThreadId () returned 0x970 [0061.922] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAABxh3tG82BGVZY2uD1OivBpyfrL5mMJy5M6oJVGtVsdmhk3A349GKiyS/8V7/b6vtDUS1Fp4jJTnm6zmLobh1e+m603i/jXFoyYbzBKGNrUk/i67CvCXkeicHJ0RHHvQ5mZdB7RbHIvpfSFRUwDFjmeMCqIXk/omSs0XPsfWbISF5QqDviTEMNIZl3b1ZWNA2rZII8GyDcnx5dYzx9PFISRzoQgLESQ31w==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0061.922] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAABxh3tG82BGVZY2uD1OivBpyfrL5mMJy5M6oJVGtVsdmhk3A349GKiyS/8V7/b6vtDUS1Fp4jJTnm6zmLobh1e+m603i/jXFoyYbzBKGNrUk/i67CvCXkeicHJ0RHHvQ5mZdB7RbHIvpfSFRUwDFjmeMCqIXk/omSs0XPsfWbISF5QqDviTEMNIZl3b1ZWNA2rZII8GyDcnx5dYzx9PFISRzoQgLESQ31w==", cchWideChar=245, lpMultiByteStr=0x353933c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAABxh3tG82BGVZY2uD1OivBpyfrL5mMJy5M6oJVGtVsdmhk3A349GKiyS/8V7/b6vtDUS1Fp4jJTnm6zmLobh1e+m603i/jXFoyYbzBKGNrUk/i67CvCXkeicHJ0RHHvQ5mZdB7RbHIvpfSFRUwDFjmeMCqIXk/omSs0XPsfWbISF5QqDviTEMNIZl3b1ZWNA2rZII8GyDcnx5dYzx9PFISRzoQgLESQ31w==", lpUsedDefaultChar=0x0) returned 245 [0061.922] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0061.923] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0061.923] CloseHandle (hObject=0x158) returned 1 [0061.924] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png")) returned 1 [0061.925] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=18218826490) returned 1 [0061.925] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\Файл зашифрован [PREVIEW.GIF].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\Файл зашифрован [preview.gif].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0061.927] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0061.927] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0061.927] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0061.927] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0061.927] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0061.927] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0061.927] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0061.927] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0061.927] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0061.927] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0061.927] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0061.927] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0061.927] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0061.928] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0061.928] SetEndOfFile (hFile=0x158) returned 1 [0061.928] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0061.928] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0061.928] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0061.928] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0061.928] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0061.929] WriteFile (in: hFile=0x158, lpBuffer=0x35f011c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f011c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0061.929] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bG!tb+t2h#JkeWBsB:l2T>QTJkgc@CmZ", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0061.929] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bG!tb+t2h#JkeWBsB:l2T>QTJkgc@CmZ", cchWideChar=32, lpMultiByteStr=0x2035654, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bG!tb+t2h#JkeWBsB:l2T>QTJkgc@CmZ", lpUsedDefaultChar=0x0) returned 32 [0061.929] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0061.929] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0061.929] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x554, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 0x295098 [0061.929] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0061.929] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0061.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif")) returned 0x20 [0061.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif")) returned 0x20 [0061.930] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif")) returned 0x20 [0061.930] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif")) returned 0x20 [0061.930] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x554)) returned 1 [0061.930] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0061.930] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0061.930] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif")) returned 0x20 [0061.930] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif")) returned 0x20 [0061.930] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0061.930] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0061.930] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0061.930] SetEndOfFile (hFile=0x158) returned 1 [0061.931] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0061.931] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe35cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0061.931] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0061.931] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe398c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0061.931] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe398c, cbMultiByte=11, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="PREVIEW.GIFGer.gifg") returned 11 [0061.931] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0061.931] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe35cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0061.931] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0061.931] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0061.932] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x554 [0061.932] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0061.932] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0061.932] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0061.932] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0061.932] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe35cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0061.932] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0061.932] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe398c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0061.932] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe398c, cbMultiByte=11, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="PREVIEW.GIFEW.GIFGer.gifg") returned 11 [0061.932] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0061.932] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe35cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0061.932] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0061.933] CharToOemA (in: pSrc="PREVIEW.GIF", pDst=0x1fe398c | out: pDst="PREVIEW.GIF") returned 1 [0061.933] WriteFile (in: hFile=0x158, lpBuffer=0x1fe398c*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe398c*, lpNumberOfBytesWritten=0x18e048*=0xb, lpOverlapped=0x0) returned 1 [0061.933] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0061.933] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0061.933] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0061.933] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=18219683405) returned 1 [0061.933] ReadFile (in: hFile=0x11c, lpBuffer=0x37b81c0, nNumberOfBytesToRead=0x554, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37b81c0*, lpNumberOfBytesRead=0x18dd7c*=0x554, lpOverlapped=0x0) returned 1 [0061.935] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0061.935] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=18219824781) returned 1 [0061.944] WriteFile (in: hFile=0x158, lpBuffer=0x1fea120*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fea120*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0061.944] ReadFile (in: hFile=0x11c, lpBuffer=0x37b81c0, nNumberOfBytesToRead=0x554, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x37b81c0*, lpNumberOfBytesRead=0x18de38*=0x554, lpOverlapped=0x0) returned 1 [0061.945] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x46 [0061.945] WriteFile (in: hFile=0x158, lpBuffer=0x37b8720*, nNumberOfBytesToWrite=0x554, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x37b8720*, lpNumberOfBytesWritten=0x18de10*=0x554, lpOverlapped=0x0) returned 1 [0061.945] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x59a [0061.945] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0061.945] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0061.945] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0061.945] SetFilePointer (in: hFile=0x158, lDistanceToMove=11, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x29 [0061.945] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x5a4 [0061.945] CloseHandle (hObject=0x11c) returned 1 [0061.945] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x5a4 [0061.946] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x5a4 [0061.946] SetFilePointer (in: hFile=0x158, lDistanceToMove=1444, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x5a4 [0061.946] SetFilePointer (in: hFile=0x158, lDistanceToMove=1444, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x5a4 [0061.946] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x5a4 [0061.946] SetFilePointer (in: hFile=0x158, lDistanceToMove=1444, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x5a4 [0061.946] SetEndOfFile (hFile=0x158) returned 1 [0061.946] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x5a4 [0061.946] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x5a4 [0061.946] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0061.946] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe35cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0061.946] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0061.946] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe41ac, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0061.946] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe41ac, cbMultiByte=11, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="PREVIEW.GIF\x18ꞗ@涤(\x18믉`믑`") returned 11 [0061.946] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0061.946] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe35cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0061.947] WriteFile (in: hFile=0x158, lpBuffer=0x379bc78*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x379bc78*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0061.947] CharToOemA (in: pSrc="PREVIEW.GIF", pDst=0x1fe41ac | out: pDst="PREVIEW.GIF") returned 1 [0061.947] WriteFile (in: hFile=0x158, lpBuffer=0x1fe41ac*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe41ac*, lpNumberOfBytesWritten=0x18efcc*=0xb, lpOverlapped=0x0) returned 1 [0061.947] WriteFile (in: hFile=0x158, lpBuffer=0x1fea110*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea110*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0061.947] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0061.947] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0061.947] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x5e8 [0061.947] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x5e8 [0061.947] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0061.947] WriteFile (in: hFile=0x158, lpBuffer=0x35f011c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f011c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0061.947] DeleteFileW (lpFileName="") returned 0 [0061.947] GetLastError () returned 0x3 [0061.947] GetFileAttributesW (lpFileName="") returned 0xffffffff [0061.947] SetLastError (dwErrCode=0x3) [0061.947] FlushFileBuffers (hFile=0x158) returned 1 [0061.950] GetCurrentThreadId () returned 0x970 [0061.950] GetCurrentThreadId () returned 0x970 [0061.950] GetCurrentThreadId () returned 0x970 [0061.950] GetCurrentThreadId () returned 0x970 [0061.950] GetCurrentThreadId () returned 0x970 [0061.950] GetCurrentThreadId () returned 0x970 [0061.950] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x69f [0061.950] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x69f [0061.950] SetFilePointer (in: hFile=0x158, lDistanceToMove=1695, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x69f [0061.950] CloseHandle (hObject=0x158) returned 1 [0061.951] GetCurrentThreadId () returned 0x970 [0061.951] GetCurrentThreadId () returned 0x970 [0061.951] GetCurrentThreadId () returned 0x970 [0061.951] GetCurrentThreadId () returned 0x970 [0061.951] GetCurrentThreadId () returned 0x970 [0061.951] GetCurrentThreadId () returned 0x970 [0061.951] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\Файл зашифрован [PREVIEW.GIF].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\Файл зашифрован [preview.gif].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0061.951] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x69f [0061.951] SetFilePointer (in: hFile=0x158, lDistanceToMove=1567, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x61f [0061.951] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0061.952] GetFileType (hFile=0x158) returned 0x1 [0061.952] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x9, wMilliseconds=0xe1)) [0061.952] GetCurrentThreadId () returned 0x970 [0061.952] GetCurrentThreadId () returned 0x970 [0061.952] GetCurrentThreadId () returned 0x970 [0061.952] GetCurrentThreadId () returned 0x970 [0061.952] GetCurrentThreadId () returned 0x970 [0061.952] GetCurrentThreadId () returned 0x970 [0061.952] GetCurrentThreadId () returned 0x970 [0061.952] GetCurrentThreadId () returned 0x970 [0061.952] GetCurrentThreadId () returned 0x970 [0061.952] GetCurrentThreadId () returned 0x970 [0061.952] GetCurrentThreadId () returned 0x970 [0061.952] GetCurrentThreadId () returned 0x970 [0061.952] GetCurrentThreadId () returned 0x970 [0061.952] GetCurrentThreadId () returned 0x970 [0061.952] GetCurrentThreadId () returned 0x970 [0061.952] GetCurrentThreadId () returned 0x970 [0061.952] GetCurrentThreadId () returned 0x970 [0061.952] GetCurrentThreadId () returned 0x970 [0061.952] GetCurrentThreadId () returned 0x970 [0061.952] GetCurrentThreadId () returned 0x970 [0061.952] GetCurrentThreadId () returned 0x970 [0061.952] GetCurrentThreadId () returned 0x970 [0061.952] GetCurrentThreadId () returned 0x970 [0061.952] GetCurrentThreadId () returned 0x970 [0061.952] GetCurrentThreadId () returned 0x970 [0061.952] GetCurrentThreadId () returned 0x970 [0061.952] GetCurrentThreadId () returned 0x970 [0061.952] GetCurrentThreadId () returned 0x970 [0061.952] GetCurrentThreadId () returned 0x970 [0061.952] GetCurrentThreadId () returned 0x970 [0061.952] GetCurrentThreadId () returned 0x970 [0061.952] GetCurrentThreadId () returned 0x970 [0061.952] GetCurrentThreadId () returned 0x970 [0061.952] GetCurrentThreadId () returned 0x970 [0061.952] GetCurrentThreadId () returned 0x970 [0061.952] GetCurrentThreadId () returned 0x970 [0061.952] GetCurrentThreadId () returned 0x970 [0061.952] GetCurrentThreadId () returned 0x970 [0061.952] GetCurrentThreadId () returned 0x970 [0061.953] GetCurrentThreadId () returned 0x970 [0061.953] GetCurrentThreadId () returned 0x970 [0061.953] GetCurrentThreadId () returned 0x970 [0061.953] GetCurrentThreadId () returned 0x970 [0061.953] GetCurrentThreadId () returned 0x970 [0061.953] GetCurrentThreadId () returned 0x970 [0061.953] GetCurrentThreadId () returned 0x970 [0061.953] GetCurrentThreadId () returned 0x970 [0061.953] GetCurrentThreadId () returned 0x970 [0061.953] GetCurrentThreadId () returned 0x970 [0061.953] GetCurrentThreadId () returned 0x970 [0061.953] GetCurrentThreadId () returned 0x970 [0061.953] GetCurrentThreadId () returned 0x970 [0061.953] GetCurrentThreadId () returned 0x970 [0061.953] GetCurrentThreadId () returned 0x970 [0061.953] GetCurrentThreadId () returned 0x970 [0061.953] GetCurrentThreadId () returned 0x970 [0061.953] GetCurrentThreadId () returned 0x970 [0061.953] GetCurrentThreadId () returned 0x970 [0061.953] GetCurrentThreadId () returned 0x970 [0061.953] GetCurrentThreadId () returned 0x970 [0061.953] GetCurrentThreadId () returned 0x970 [0061.953] GetCurrentThreadId () returned 0x970 [0061.953] GetCurrentThreadId () returned 0x970 [0061.953] GetCurrentThreadId () returned 0x970 [0061.953] GetCurrentThreadId () returned 0x970 [0061.953] GetCurrentThreadId () returned 0x970 [0061.953] GetCurrentThreadId () returned 0x970 [0061.953] GetCurrentThreadId () returned 0x970 [0061.953] GetCurrentThreadId () returned 0x970 [0061.953] GetCurrentThreadId () returned 0x970 [0061.953] GetCurrentThreadId () returned 0x970 [0061.953] GetCurrentThreadId () returned 0x970 [0061.953] GetCurrentThreadId () returned 0x970 [0061.953] GetCurrentThreadId () returned 0x970 [0061.953] GetCurrentThreadId () returned 0x970 [0061.953] GetCurrentThreadId () returned 0x970 [0061.953] GetCurrentThreadId () returned 0x970 [0061.953] GetCurrentThreadId () returned 0x970 [0061.954] GetCurrentThreadId () returned 0x970 [0061.954] GetCurrentThreadId () returned 0x970 [0061.954] GetCurrentThreadId () returned 0x970 [0061.954] GetCurrentThreadId () returned 0x970 [0061.954] GetCurrentThreadId () returned 0x970 [0061.954] GetCurrentThreadId () returned 0x970 [0061.954] GetCurrentThreadId () returned 0x970 [0061.954] GetCurrentThreadId () returned 0x970 [0061.954] GetCurrentThreadId () returned 0x970 [0061.954] GetCurrentThreadId () returned 0x970 [0061.954] GetCurrentThreadId () returned 0x970 [0061.954] GetCurrentThreadId () returned 0x970 [0061.954] GetCurrentThreadId () returned 0x970 [0061.954] GetCurrentThreadId () returned 0x970 [0061.954] GetCurrentThreadId () returned 0x970 [0061.954] GetCurrentThreadId () returned 0x970 [0061.954] GetCurrentThreadId () returned 0x970 [0061.954] GetCurrentThreadId () returned 0x970 [0061.954] GetCurrentThreadId () returned 0x970 [0061.954] GetCurrentThreadId () returned 0x970 [0061.954] GetCurrentThreadId () returned 0x970 [0061.954] GetCurrentThreadId () returned 0x970 [0061.954] GetCurrentThreadId () returned 0x970 [0061.954] GetCurrentThreadId () returned 0x970 [0061.954] GetCurrentThreadId () returned 0x970 [0061.954] GetCurrentThreadId () returned 0x970 [0061.954] GetCurrentThreadId () returned 0x970 [0061.954] GetCurrentThreadId () returned 0x970 [0061.954] GetCurrentThreadId () returned 0x970 [0061.954] GetCurrentThreadId () returned 0x970 [0061.954] GetCurrentThreadId () returned 0x970 [0061.954] GetCurrentThreadId () returned 0x970 [0061.954] GetCurrentThreadId () returned 0x970 [0061.954] GetCurrentThreadId () returned 0x970 [0061.954] GetCurrentThreadId () returned 0x970 [0061.954] GetCurrentThreadId () returned 0x970 [0061.954] GetCurrentThreadId () returned 0x970 [0061.954] GetCurrentThreadId () returned 0x970 [0061.954] GetCurrentThreadId () returned 0x970 [0061.954] GetCurrentThreadId () returned 0x970 [0061.954] GetCurrentThreadId () returned 0x970 [0061.954] GetCurrentThreadId () returned 0x970 [0061.955] GetCurrentThreadId () returned 0x970 [0061.955] GetCurrentThreadId () returned 0x970 [0061.955] GetCurrentThreadId () returned 0x970 [0061.955] GetCurrentThreadId () returned 0x970 [0061.955] GetCurrentThreadId () returned 0x970 [0061.955] GetCurrentThreadId () returned 0x970 [0061.955] GetCurrentThreadId () returned 0x970 [0061.955] GetCurrentThreadId () returned 0x970 [0061.955] GetCurrentThreadId () returned 0x970 [0061.955] GetCurrentThreadId () returned 0x970 [0061.955] GetCurrentThreadId () returned 0x970 [0061.955] GetCurrentThreadId () returned 0x970 [0061.955] GetCurrentThreadId () returned 0x970 [0061.955] GetCurrentThreadId () returned 0x970 [0061.955] GetCurrentThreadId () returned 0x970 [0061.955] GetCurrentThreadId () returned 0x970 [0061.955] GetCurrentThreadId () returned 0x970 [0061.955] GetCurrentThreadId () returned 0x970 [0061.955] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0061.955] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0061.955] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff00b0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0061.955] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0061.955] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0061.955] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff00b0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0061.955] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0061.955] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0061.955] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0061.955] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0061.955] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0061.955] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0061.955] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0061.955] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0061.955] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff0110, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0061.955] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0061.955] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0061.955] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff0110, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0061.956] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0061.956] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0061.956] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff0110, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0061.956] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x9, wMilliseconds=0xe1)) [0061.956] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bG!tb+t2h#JkeWBsB:l2T>QTJkgc@CmZ", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0061.956] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bG!tb+t2h#JkeWBsB:l2T>QTJkgc@CmZ", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0061.956] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bG!tb+t2h#JkeWBsB:l2T>QTJkgc@CmZ", cchWideChar=32, lpMultiByteStr=0x20024e8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bG!tb+t2h#JkeWBsB:l2T>QTJkgc@CmZ", lpUsedDefaultChar=0x0) returned 32 [0061.956] GetCurrentThreadId () returned 0x970 [0061.956] GetCurrentThreadId () returned 0x970 [0061.956] GetCurrentThreadId () returned 0x970 [0061.956] GetCurrentThreadId () returned 0x970 [0061.956] GetCurrentThreadId () returned 0x970 [0061.956] GetCurrentThreadId () returned 0x970 [0061.964] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0061.964] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0061.965] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3794568, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0061.965] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0061.965] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAGO2QT9SYN8pmaypJtSQYtF4XMT5OG4UwFq5hZ2Rh3L2BtpbVhQ2+3eErS6gPTJXKVDwEWxtinTWBIOlwF6tVPrR/3oK1qAfGXd2KFb/7/dH3hebSqvf6L9C7F+5NGaI8DULNuaB28nPu2N6HNl3UPfZgsO26P9aZ1EXmYg0XH5rRzwkid19o/vZm7KA/HwB+6pFqMBgoD5K+BJsJhJ5iP4021iltTY4lQ==") returned 232 [0061.965] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x9, wMilliseconds=0xf0)) [0061.965] GetCurrentThreadId () returned 0x970 [0061.965] GetCurrentThreadId () returned 0x970 [0061.965] GetCurrentThreadId () returned 0x970 [0061.965] GetCurrentThreadId () returned 0x970 [0061.965] GetCurrentThreadId () returned 0x970 [0061.965] GetCurrentThreadId () returned 0x970 [0061.965] GetCurrentThreadId () returned 0x970 [0061.965] GetCurrentThreadId () returned 0x970 [0061.965] GetCurrentThreadId () returned 0x970 [0061.965] GetCurrentThreadId () returned 0x970 [0061.965] GetCurrentThreadId () returned 0x970 [0061.965] GetCurrentThreadId () returned 0x970 [0061.965] GetCurrentThreadId () returned 0x970 [0061.965] GetCurrentThreadId () returned 0x970 [0061.965] GetCurrentThreadId () returned 0x970 [0061.965] GetCurrentThreadId () returned 0x970 [0061.965] GetCurrentThreadId () returned 0x970 [0061.965] GetCurrentThreadId () returned 0x970 [0061.965] GetCurrentThreadId () returned 0x970 [0061.965] GetCurrentThreadId () returned 0x970 [0061.965] GetCurrentThreadId () returned 0x970 [0061.965] GetCurrentThreadId () returned 0x970 [0061.965] GetCurrentThreadId () returned 0x970 [0061.965] GetCurrentThreadId () returned 0x970 [0061.965] GetCurrentThreadId () returned 0x970 [0061.965] GetCurrentThreadId () returned 0x970 [0061.965] GetCurrentThreadId () returned 0x970 [0061.965] GetCurrentThreadId () returned 0x970 [0061.965] GetCurrentThreadId () returned 0x970 [0061.965] GetCurrentThreadId () returned 0x970 [0061.965] GetCurrentThreadId () returned 0x970 [0061.965] GetCurrentThreadId () returned 0x970 [0061.965] GetCurrentThreadId () returned 0x970 [0061.965] GetCurrentThreadId () returned 0x970 [0061.965] GetCurrentThreadId () returned 0x970 [0061.965] GetCurrentThreadId () returned 0x970 [0061.965] GetCurrentThreadId () returned 0x970 [0061.966] GetCurrentThreadId () returned 0x970 [0061.966] GetCurrentThreadId () returned 0x970 [0061.966] GetCurrentThreadId () returned 0x970 [0061.966] GetCurrentThreadId () returned 0x970 [0061.966] GetCurrentThreadId () returned 0x970 [0061.966] GetCurrentThreadId () returned 0x970 [0061.966] GetCurrentThreadId () returned 0x970 [0061.966] GetCurrentThreadId () returned 0x970 [0061.966] GetCurrentThreadId () returned 0x970 [0061.966] GetCurrentThreadId () returned 0x970 [0061.966] GetCurrentThreadId () returned 0x970 [0061.966] GetCurrentThreadId () returned 0x970 [0061.966] GetCurrentThreadId () returned 0x970 [0061.966] GetCurrentThreadId () returned 0x970 [0061.966] GetCurrentThreadId () returned 0x970 [0061.966] GetCurrentThreadId () returned 0x970 [0061.966] GetCurrentThreadId () returned 0x970 [0061.966] GetCurrentThreadId () returned 0x970 [0061.966] GetCurrentThreadId () returned 0x970 [0061.966] GetCurrentThreadId () returned 0x970 [0061.966] GetCurrentThreadId () returned 0x970 [0061.966] GetCurrentThreadId () returned 0x970 [0061.966] GetCurrentThreadId () returned 0x970 [0061.966] GetCurrentThreadId () returned 0x970 [0061.966] GetCurrentThreadId () returned 0x970 [0061.966] GetCurrentThreadId () returned 0x970 [0061.966] GetCurrentThreadId () returned 0x970 [0061.966] GetCurrentThreadId () returned 0x970 [0061.966] GetCurrentThreadId () returned 0x970 [0061.966] GetCurrentThreadId () returned 0x970 [0061.966] GetCurrentThreadId () returned 0x970 [0061.966] GetCurrentThreadId () returned 0x970 [0061.966] GetCurrentThreadId () returned 0x970 [0061.966] GetCurrentThreadId () returned 0x970 [0061.966] GetCurrentThreadId () returned 0x970 [0061.966] GetCurrentThreadId () returned 0x970 [0061.966] GetCurrentThreadId () returned 0x970 [0061.966] GetCurrentThreadId () returned 0x970 [0061.966] GetCurrentThreadId () returned 0x970 [0061.966] GetCurrentThreadId () returned 0x970 [0061.966] GetCurrentThreadId () returned 0x970 [0061.966] GetCurrentThreadId () returned 0x970 [0061.966] GetCurrentThreadId () returned 0x970 [0061.966] GetCurrentThreadId () returned 0x970 [0061.966] GetCurrentThreadId () returned 0x970 [0061.967] GetCurrentThreadId () returned 0x970 [0061.967] GetCurrentThreadId () returned 0x970 [0061.967] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAGO2QT9SYN8pmaypJtSQYtF4XMT5OG4UwFq5hZ2Rh3L2BtpbVhQ2+3eErS6gPTJXKVDwEWxtinTWBIOlwF6tVPrR/3oK1qAfGXd2KFb/7/dH3hebSqvf6L9C7F+5NGaI8DULNuaB28nPu2N6HNl3UPfZgsO26P9aZ1EXmYg0XH5rRzwkid19o/vZm7KA/HwB+6pFqMBgoD5K+BJsJhJ5iP4021iltTY4lQ==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0061.967] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAGO2QT9SYN8pmaypJtSQYtF4XMT5OG4UwFq5hZ2Rh3L2BtpbVhQ2+3eErS6gPTJXKVDwEWxtinTWBIOlwF6tVPrR/3oK1qAfGXd2KFb/7/dH3hebSqvf6L9C7F+5NGaI8DULNuaB28nPu2N6HNl3UPfZgsO26P9aZ1EXmYg0XH5rRzwkid19o/vZm7KA/HwB+6pFqMBgoD5K+BJsJhJ5iP4021iltTY4lQ==", cchWideChar=245, lpMultiByteStr=0x353933c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAGO2QT9SYN8pmaypJtSQYtF4XMT5OG4UwFq5hZ2Rh3L2BtpbVhQ2+3eErS6gPTJXKVDwEWxtinTWBIOlwF6tVPrR/3oK1qAfGXd2KFb/7/dH3hebSqvf6L9C7F+5NGaI8DULNuaB28nPu2N6HNl3UPfZgsO26P9aZ1EXmYg0XH5rRzwkid19o/vZm7KA/HwB+6pFqMBgoD5K+BJsJhJ5iP4021iltTY4lQ==", lpUsedDefaultChar=0x0) returned 245 [0061.967] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0061.967] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0061.967] CloseHandle (hObject=0x158) returned 1 [0061.968] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif")) returned 1 [0061.969] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=18223223186) returned 1 [0061.969] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\Файл зашифрован [THMBNAIL.PNG].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\Файл зашифрован [thmbnail.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0061.969] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0061.969] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0061.969] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0061.969] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0061.970] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0061.970] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0061.970] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0061.970] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0061.970] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0061.970] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0061.970] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0061.970] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0061.970] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0061.970] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0061.970] SetEndOfFile (hFile=0x158) returned 1 [0061.970] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0061.970] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0061.970] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0061.970] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0061.970] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0061.971] WriteFile (in: hFile=0x158, lpBuffer=0x35f01dc*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f01dc*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0061.971] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="gc7^u^cMDq!yV*HXS\"O=~^cub$HO3(b&", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0061.971] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="gc7^u^cMDq!yV*HXS\"O=~^cub$HO3(b&", cchWideChar=32, lpMultiByteStr=0x203568c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gc7^u^cMDq!yV*HXS\"O=~^cub$HO3(b&", lpUsedDefaultChar=0x0) returned 32 [0061.972] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0061.972] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0061.972] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x2d35, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0x295098 [0061.972] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0061.972] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0061.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png")) returned 0x20 [0061.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png")) returned 0x20 [0061.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png")) returned 0x20 [0061.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png")) returned 0x20 [0061.972] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x2d35)) returned 1 [0061.972] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0061.972] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0061.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png")) returned 0x20 [0061.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png")) returned 0x20 [0061.972] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0061.973] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0061.973] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0061.973] SetEndOfFile (hFile=0x158) returned 1 [0061.973] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0061.973] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe36ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0061.974] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0061.974] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe3bac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0061.974] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe3bac, cbMultiByte=12, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="THMBNAIL.PNGer.gifg") returned 12 [0061.974] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0061.974] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe36ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0061.974] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0061.974] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0061.974] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2d35 [0061.974] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0061.974] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0061.974] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0061.974] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0061.974] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe36ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0061.974] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0061.974] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe3bac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0061.975] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe3bac, cbMultiByte=12, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="THMBNAIL.PNGIL.PNGer.gifg") returned 12 [0061.975] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0061.975] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe36ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0061.975] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0061.976] CharToOemA (in: pSrc="THMBNAIL.PNG", pDst=0x1fe3bac | out: pDst="THMBNAIL.PNG") returned 1 [0061.976] WriteFile (in: hFile=0x158, lpBuffer=0x1fe3bac*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe3bac*, lpNumberOfBytesWritten=0x18e048*=0xc, lpOverlapped=0x0) returned 1 [0061.976] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0061.976] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0061.976] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0061.976] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=18223947461) returned 1 [0061.976] ReadFile (in: hFile=0x11c, lpBuffer=0x37b81a0, nNumberOfBytesToRead=0x2d35, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37b81a0*, lpNumberOfBytesRead=0x18dd7c*=0x2d35, lpOverlapped=0x0) returned 1 [0061.978] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0061.978] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=18224112487) returned 1 [0061.987] WriteFile (in: hFile=0x158, lpBuffer=0x1fea150*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fea150*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0061.987] ReadFile (in: hFile=0x11c, lpBuffer=0x37b81a0, nNumberOfBytesToRead=0x2d35, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x37b81a0*, lpNumberOfBytesRead=0x18de38*=0x2d35, lpOverlapped=0x0) returned 1 [0061.988] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x47 [0061.988] WriteFile (in: hFile=0x158, lpBuffer=0x37fc7c0*, nNumberOfBytesToWrite=0x2d35, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x37fc7c0*, lpNumberOfBytesWritten=0x18de10*=0x2d35, lpOverlapped=0x0) returned 1 [0061.988] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x2d7c [0061.988] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0061.988] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0061.988] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0061.989] SetFilePointer (in: hFile=0x158, lDistanceToMove=12, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2a [0061.989] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x2d86 [0061.989] CloseHandle (hObject=0x11c) returned 1 [0061.989] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x2d86 [0061.989] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x2d86 [0061.989] SetFilePointer (in: hFile=0x158, lDistanceToMove=11654, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x2d86 [0061.989] SetFilePointer (in: hFile=0x158, lDistanceToMove=11654, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x2d86 [0061.989] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x2d86 [0061.989] SetFilePointer (in: hFile=0x158, lDistanceToMove=11654, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x2d86 [0061.989] SetEndOfFile (hFile=0x158) returned 1 [0061.989] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x2d86 [0061.989] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x2d86 [0061.989] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0061.989] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe36ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0061.990] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0061.990] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe37ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0061.990] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe37ec, cbMultiByte=12, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="THMBNAIL.PNGꞗ@涤(\x18믉`믑`") returned 12 [0061.990] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0061.990] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe36ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0061.990] WriteFile (in: hFile=0x158, lpBuffer=0x379bc78*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x379bc78*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0061.990] CharToOemA (in: pSrc="THMBNAIL.PNG", pDst=0x1fe37ec | out: pDst="THMBNAIL.PNG") returned 1 [0061.990] WriteFile (in: hFile=0x158, lpBuffer=0x1fe37ec*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe37ec*, lpNumberOfBytesWritten=0x18efcc*=0xc, lpOverlapped=0x0) returned 1 [0061.990] WriteFile (in: hFile=0x158, lpBuffer=0x1fea2d8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea2d8*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0061.990] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0061.990] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0061.990] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x2dcb [0061.990] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x2dcb [0061.990] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0061.990] WriteFile (in: hFile=0x158, lpBuffer=0x35f01dc*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f01dc*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0061.991] DeleteFileW (lpFileName="") returned 0 [0061.991] GetLastError () returned 0x3 [0061.991] GetFileAttributesW (lpFileName="") returned 0xffffffff [0061.991] SetLastError (dwErrCode=0x3) [0061.991] FlushFileBuffers (hFile=0x158) returned 1 [0061.994] GetCurrentThreadId () returned 0x970 [0061.994] GetCurrentThreadId () returned 0x970 [0061.994] GetCurrentThreadId () returned 0x970 [0061.994] GetCurrentThreadId () returned 0x970 [0061.994] GetCurrentThreadId () returned 0x970 [0061.994] GetCurrentThreadId () returned 0x970 [0061.994] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x2e82 [0061.994] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x2e82 [0061.994] SetFilePointer (in: hFile=0x158, lDistanceToMove=11906, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x2e82 [0061.994] CloseHandle (hObject=0x158) returned 1 [0061.995] GetCurrentThreadId () returned 0x970 [0061.995] GetCurrentThreadId () returned 0x970 [0061.996] GetCurrentThreadId () returned 0x970 [0061.996] GetCurrentThreadId () returned 0x970 [0061.996] GetCurrentThreadId () returned 0x970 [0061.996] GetCurrentThreadId () returned 0x970 [0061.996] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\Файл зашифрован [THMBNAIL.PNG].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\Файл зашифрован [thmbnail.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0061.996] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2e82 [0061.996] SetFilePointer (in: hFile=0x158, lDistanceToMove=11778, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2e02 [0061.996] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0061.996] GetFileType (hFile=0x158) returned 0x1 [0061.996] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x9, wMilliseconds=0x110)) [0061.996] GetCurrentThreadId () returned 0x970 [0061.996] GetCurrentThreadId () returned 0x970 [0061.996] GetCurrentThreadId () returned 0x970 [0061.996] GetCurrentThreadId () returned 0x970 [0061.996] GetCurrentThreadId () returned 0x970 [0061.996] GetCurrentThreadId () returned 0x970 [0061.996] GetCurrentThreadId () returned 0x970 [0061.996] GetCurrentThreadId () returned 0x970 [0061.996] GetCurrentThreadId () returned 0x970 [0061.996] GetCurrentThreadId () returned 0x970 [0061.996] GetCurrentThreadId () returned 0x970 [0061.996] GetCurrentThreadId () returned 0x970 [0061.996] GetCurrentThreadId () returned 0x970 [0061.996] GetCurrentThreadId () returned 0x970 [0061.996] GetCurrentThreadId () returned 0x970 [0061.996] GetCurrentThreadId () returned 0x970 [0061.996] GetCurrentThreadId () returned 0x970 [0061.996] GetCurrentThreadId () returned 0x970 [0061.996] GetCurrentThreadId () returned 0x970 [0061.996] GetCurrentThreadId () returned 0x970 [0061.997] GetCurrentThreadId () returned 0x970 [0061.997] GetCurrentThreadId () returned 0x970 [0061.997] GetCurrentThreadId () returned 0x970 [0061.997] GetCurrentThreadId () returned 0x970 [0061.997] GetCurrentThreadId () returned 0x970 [0061.997] GetCurrentThreadId () returned 0x970 [0061.997] GetCurrentThreadId () returned 0x970 [0061.997] GetCurrentThreadId () returned 0x970 [0061.997] GetCurrentThreadId () returned 0x970 [0061.997] GetCurrentThreadId () returned 0x970 [0061.997] GetCurrentThreadId () returned 0x970 [0061.997] GetCurrentThreadId () returned 0x970 [0061.997] GetCurrentThreadId () returned 0x970 [0061.997] GetCurrentThreadId () returned 0x970 [0061.997] GetCurrentThreadId () returned 0x970 [0061.997] GetCurrentThreadId () returned 0x970 [0061.997] GetCurrentThreadId () returned 0x970 [0061.997] GetCurrentThreadId () returned 0x970 [0061.997] GetCurrentThreadId () returned 0x970 [0061.997] GetCurrentThreadId () returned 0x970 [0061.997] GetCurrentThreadId () returned 0x970 [0061.997] GetCurrentThreadId () returned 0x970 [0061.997] GetCurrentThreadId () returned 0x970 [0061.997] GetCurrentThreadId () returned 0x970 [0061.997] GetCurrentThreadId () returned 0x970 [0061.997] GetCurrentThreadId () returned 0x970 [0061.997] GetCurrentThreadId () returned 0x970 [0061.997] GetCurrentThreadId () returned 0x970 [0061.997] GetCurrentThreadId () returned 0x970 [0061.997] GetCurrentThreadId () returned 0x970 [0061.997] GetCurrentThreadId () returned 0x970 [0061.997] GetCurrentThreadId () returned 0x970 [0061.997] GetCurrentThreadId () returned 0x970 [0061.997] GetCurrentThreadId () returned 0x970 [0061.997] GetCurrentThreadId () returned 0x970 [0061.997] GetCurrentThreadId () returned 0x970 [0061.997] GetCurrentThreadId () returned 0x970 [0061.997] GetCurrentThreadId () returned 0x970 [0061.997] GetCurrentThreadId () returned 0x970 [0061.997] GetCurrentThreadId () returned 0x970 [0061.997] GetCurrentThreadId () returned 0x970 [0061.997] GetCurrentThreadId () returned 0x970 [0061.997] GetCurrentThreadId () returned 0x970 [0061.997] GetCurrentThreadId () returned 0x970 [0061.998] GetCurrentThreadId () returned 0x970 [0061.998] GetCurrentThreadId () returned 0x970 [0061.998] GetCurrentThreadId () returned 0x970 [0061.998] GetCurrentThreadId () returned 0x970 [0061.998] GetCurrentThreadId () returned 0x970 [0061.998] GetCurrentThreadId () returned 0x970 [0061.998] GetCurrentThreadId () returned 0x970 [0061.998] GetCurrentThreadId () returned 0x970 [0061.998] GetCurrentThreadId () returned 0x970 [0061.998] GetCurrentThreadId () returned 0x970 [0061.998] GetCurrentThreadId () returned 0x970 [0061.998] GetCurrentThreadId () returned 0x970 [0061.998] GetCurrentThreadId () returned 0x970 [0061.998] GetCurrentThreadId () returned 0x970 [0061.998] GetCurrentThreadId () returned 0x970 [0061.998] GetCurrentThreadId () returned 0x970 [0061.998] GetCurrentThreadId () returned 0x970 [0061.998] GetCurrentThreadId () returned 0x970 [0061.998] GetCurrentThreadId () returned 0x970 [0061.998] GetCurrentThreadId () returned 0x970 [0061.998] GetCurrentThreadId () returned 0x970 [0061.998] GetCurrentThreadId () returned 0x970 [0061.998] GetCurrentThreadId () returned 0x970 [0061.998] GetCurrentThreadId () returned 0x970 [0061.998] GetCurrentThreadId () returned 0x970 [0061.998] GetCurrentThreadId () returned 0x970 [0061.998] GetCurrentThreadId () returned 0x970 [0061.998] GetCurrentThreadId () returned 0x970 [0061.998] GetCurrentThreadId () returned 0x970 [0061.998] GetCurrentThreadId () returned 0x970 [0061.998] GetCurrentThreadId () returned 0x970 [0061.998] GetCurrentThreadId () returned 0x970 [0061.998] GetCurrentThreadId () returned 0x970 [0061.998] GetCurrentThreadId () returned 0x970 [0061.998] GetCurrentThreadId () returned 0x970 [0061.998] GetCurrentThreadId () returned 0x970 [0061.998] GetCurrentThreadId () returned 0x970 [0061.998] GetCurrentThreadId () returned 0x970 [0061.998] GetCurrentThreadId () returned 0x970 [0061.998] GetCurrentThreadId () returned 0x970 [0061.998] GetCurrentThreadId () returned 0x970 [0061.998] GetCurrentThreadId () returned 0x970 [0061.998] GetCurrentThreadId () returned 0x970 [0061.998] GetCurrentThreadId () returned 0x970 [0061.998] GetCurrentThreadId () returned 0x970 [0061.999] GetCurrentThreadId () returned 0x970 [0061.999] GetCurrentThreadId () returned 0x970 [0061.999] GetCurrentThreadId () returned 0x970 [0061.999] GetCurrentThreadId () returned 0x970 [0061.999] GetCurrentThreadId () returned 0x970 [0061.999] GetCurrentThreadId () returned 0x970 [0061.999] GetCurrentThreadId () returned 0x970 [0061.999] GetCurrentThreadId () returned 0x970 [0061.999] GetCurrentThreadId () returned 0x970 [0061.999] GetCurrentThreadId () returned 0x970 [0061.999] GetCurrentThreadId () returned 0x970 [0061.999] GetCurrentThreadId () returned 0x970 [0061.999] GetCurrentThreadId () returned 0x970 [0061.999] GetCurrentThreadId () returned 0x970 [0061.999] GetCurrentThreadId () returned 0x970 [0061.999] GetCurrentThreadId () returned 0x970 [0061.999] GetCurrentThreadId () returned 0x970 [0061.999] GetCurrentThreadId () returned 0x970 [0061.999] GetCurrentThreadId () returned 0x970 [0061.999] GetCurrentThreadId () returned 0x970 [0061.999] GetCurrentThreadId () returned 0x970 [0061.999] GetCurrentThreadId () returned 0x970 [0061.999] GetCurrentThreadId () returned 0x970 [0061.999] GetCurrentThreadId () returned 0x970 [0061.999] GetCurrentThreadId () returned 0x970 [0061.999] GetCurrentThreadId () returned 0x970 [0061.999] GetCurrentThreadId () returned 0x970 [0061.999] GetCurrentThreadId () returned 0x970 [0061.999] GetCurrentThreadId () returned 0x970 [0061.999] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0061.999] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0061.999] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff0110, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0061.999] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0061.999] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0061.999] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff0110, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0061.999] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0061.999] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0061.999] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0061.999] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.000] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.000] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.000] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.000] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.000] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff0170, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.000] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.000] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.000] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff0170, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.000] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.000] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.000] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff0170, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.000] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x9, wMilliseconds=0x110)) [0062.000] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gc7^u^cMDq!yV*HXS\"O=~^cub$HO3(b&", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0062.000] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gc7^u^cMDq!yV*HXS\"O=~^cub$HO3(b&", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0062.000] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gc7^u^cMDq!yV*HXS\"O=~^cub$HO3(b&", cchWideChar=32, lpMultiByteStr=0x2002ed8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gc7^u^cMDq!yV*HXS\"O=~^cub$HO3(b&", lpUsedDefaultChar=0x0) returned 32 [0062.000] GetCurrentThreadId () returned 0x970 [0062.000] GetCurrentThreadId () returned 0x970 [0062.000] GetCurrentThreadId () returned 0x970 [0062.000] GetCurrentThreadId () returned 0x970 [0062.000] GetCurrentThreadId () returned 0x970 [0062.000] GetCurrentThreadId () returned 0x970 [0062.009] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0062.009] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0062.009] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3794658, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0062.009] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0062.009] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAACEPNWuEJ1l62WxFfjv7xCix/V/tGqrAsRriOl9CMH7Cg8+LgWBreH8DSCsjRXL6+bDjbBWmuQqZOrdOTSdBmo54odkYlo4pjbMqwWWa3mKc5mvcNqgLvxaMcDphqO7mJyB0N61T/F7owiQcwEK5jmTTvU4PxjyY7IkWGmgTrbEuPk2xVv+kfgDmdvZUVJdqKukyWCre63oj+Cyyd9HcNjynZ8/6G1DIoQ==") returned 232 [0062.009] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x9, wMilliseconds=0x11f)) [0062.009] GetCurrentThreadId () returned 0x970 [0062.009] GetCurrentThreadId () returned 0x970 [0062.009] GetCurrentThreadId () returned 0x970 [0062.009] GetCurrentThreadId () returned 0x970 [0062.009] GetCurrentThreadId () returned 0x970 [0062.009] GetCurrentThreadId () returned 0x970 [0062.009] GetCurrentThreadId () returned 0x970 [0062.009] GetCurrentThreadId () returned 0x970 [0062.009] GetCurrentThreadId () returned 0x970 [0062.009] GetCurrentThreadId () returned 0x970 [0062.009] GetCurrentThreadId () returned 0x970 [0062.009] GetCurrentThreadId () returned 0x970 [0062.009] GetCurrentThreadId () returned 0x970 [0062.009] GetCurrentThreadId () returned 0x970 [0062.009] GetCurrentThreadId () returned 0x970 [0062.009] GetCurrentThreadId () returned 0x970 [0062.009] GetCurrentThreadId () returned 0x970 [0062.009] GetCurrentThreadId () returned 0x970 [0062.009] GetCurrentThreadId () returned 0x970 [0062.009] GetCurrentThreadId () returned 0x970 [0062.009] GetCurrentThreadId () returned 0x970 [0062.009] GetCurrentThreadId () returned 0x970 [0062.009] GetCurrentThreadId () returned 0x970 [0062.009] GetCurrentThreadId () returned 0x970 [0062.009] GetCurrentThreadId () returned 0x970 [0062.009] GetCurrentThreadId () returned 0x970 [0062.009] GetCurrentThreadId () returned 0x970 [0062.009] GetCurrentThreadId () returned 0x970 [0062.009] GetCurrentThreadId () returned 0x970 [0062.009] GetCurrentThreadId () returned 0x970 [0062.010] GetCurrentThreadId () returned 0x970 [0062.010] GetCurrentThreadId () returned 0x970 [0062.010] GetCurrentThreadId () returned 0x970 [0062.010] GetCurrentThreadId () returned 0x970 [0062.010] GetCurrentThreadId () returned 0x970 [0062.010] GetCurrentThreadId () returned 0x970 [0062.010] GetCurrentThreadId () returned 0x970 [0062.010] GetCurrentThreadId () returned 0x970 [0062.010] GetCurrentThreadId () returned 0x970 [0062.010] GetCurrentThreadId () returned 0x970 [0062.010] GetCurrentThreadId () returned 0x970 [0062.010] GetCurrentThreadId () returned 0x970 [0062.010] GetCurrentThreadId () returned 0x970 [0062.010] GetCurrentThreadId () returned 0x970 [0062.010] GetCurrentThreadId () returned 0x970 [0062.010] GetCurrentThreadId () returned 0x970 [0062.010] GetCurrentThreadId () returned 0x970 [0062.010] GetCurrentThreadId () returned 0x970 [0062.010] GetCurrentThreadId () returned 0x970 [0062.010] GetCurrentThreadId () returned 0x970 [0062.010] GetCurrentThreadId () returned 0x970 [0062.010] GetCurrentThreadId () returned 0x970 [0062.010] GetCurrentThreadId () returned 0x970 [0062.010] GetCurrentThreadId () returned 0x970 [0062.010] GetCurrentThreadId () returned 0x970 [0062.010] GetCurrentThreadId () returned 0x970 [0062.010] GetCurrentThreadId () returned 0x970 [0062.010] GetCurrentThreadId () returned 0x970 [0062.010] GetCurrentThreadId () returned 0x970 [0062.010] GetCurrentThreadId () returned 0x970 [0062.010] GetCurrentThreadId () returned 0x970 [0062.010] GetCurrentThreadId () returned 0x970 [0062.010] GetCurrentThreadId () returned 0x970 [0062.010] GetCurrentThreadId () returned 0x970 [0062.010] GetCurrentThreadId () returned 0x970 [0062.010] GetCurrentThreadId () returned 0x970 [0062.010] GetCurrentThreadId () returned 0x970 [0062.010] GetCurrentThreadId () returned 0x970 [0062.010] GetCurrentThreadId () returned 0x970 [0062.010] GetCurrentThreadId () returned 0x970 [0062.010] GetCurrentThreadId () returned 0x970 [0062.010] GetCurrentThreadId () returned 0x970 [0062.010] GetCurrentThreadId () returned 0x970 [0062.011] GetCurrentThreadId () returned 0x970 [0062.011] GetCurrentThreadId () returned 0x970 [0062.011] GetCurrentThreadId () returned 0x970 [0062.011] GetCurrentThreadId () returned 0x970 [0062.011] GetCurrentThreadId () returned 0x970 [0062.011] GetCurrentThreadId () returned 0x970 [0062.011] GetCurrentThreadId () returned 0x970 [0062.011] GetCurrentThreadId () returned 0x970 [0062.011] GetCurrentThreadId () returned 0x970 [0062.011] GetCurrentThreadId () returned 0x970 [0062.011] GetCurrentThreadId () returned 0x970 [0062.011] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAACEPNWuEJ1l62WxFfjv7xCix/V/tGqrAsRriOl9CMH7Cg8+LgWBreH8DSCsjRXL6+bDjbBWmuQqZOrdOTSdBmo54odkYlo4pjbMqwWWa3mKc5mvcNqgLvxaMcDphqO7mJyB0N61T/F7owiQcwEK5jmTTvU4PxjyY7IkWGmgTrbEuPk2xVv+kfgDmdvZUVJdqKukyWCre63oj+Cyyd9HcNjynZ8/6G1DIoQ==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0062.011] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAACEPNWuEJ1l62WxFfjv7xCix/V/tGqrAsRriOl9CMH7Cg8+LgWBreH8DSCsjRXL6+bDjbBWmuQqZOrdOTSdBmo54odkYlo4pjbMqwWWa3mKc5mvcNqgLvxaMcDphqO7mJyB0N61T/F7owiQcwEK5jmTTvU4PxjyY7IkWGmgTrbEuPk2xVv+kfgDmdvZUVJdqKukyWCre63oj+Cyyd9HcNjynZ8/6G1DIoQ==", cchWideChar=245, lpMultiByteStr=0x353933c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAACEPNWuEJ1l62WxFfjv7xCix/V/tGqrAsRriOl9CMH7Cg8+LgWBreH8DSCsjRXL6+bDjbBWmuQqZOrdOTSdBmo54odkYlo4pjbMqwWWa3mKc5mvcNqgLvxaMcDphqO7mJyB0N61T/F7owiQcwEK5jmTTvU4PxjyY7IkWGmgTrbEuPk2xVv+kfgDmdvZUVJdqKukyWCre63oj+Cyyd9HcNjynZ8/6G1DIoQ==", lpUsedDefaultChar=0x0) returned 245 [0062.011] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0062.011] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0062.011] CloseHandle (hObject=0x158) returned 1 [0062.012] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png")) returned 1 [0062.014] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=18227711340) returned 1 [0062.014] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\Файл зашифрован [PREVIEW.GIF].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\Файл зашифрован [preview.gif].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0062.015] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0062.016] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0062.016] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0062.016] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0062.016] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0062.016] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0062.016] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0062.016] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0062.016] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0062.016] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0062.016] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0062.016] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0062.016] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0062.016] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0062.016] SetEndOfFile (hFile=0x158) returned 1 [0062.016] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0062.016] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0062.017] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0062.017] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0062.017] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0062.018] WriteFile (in: hFile=0x158, lpBuffer=0x35f011c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f011c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0062.018] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o%X6\\kVSIW~1ft!x!q1Ba{M!rgzy}rp{", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0062.018] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o%X6\\kVSIW~1ft!x!q1Ba{M!rgzy}rp{", cchWideChar=32, lpMultiByteStr=0x20356c4, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="o%X6\\kVSIW~1ft!x!q1Ba{M!rgzy}rp{", lpUsedDefaultChar=0x0) returned 32 [0062.018] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0062.018] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0062.018] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 0x295098 [0062.018] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0062.018] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0062.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif")) returned 0x20 [0062.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif")) returned 0x20 [0062.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif")) returned 0x20 [0062.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif")) returned 0x20 [0062.018] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa0e)) returned 1 [0062.018] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0062.019] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0062.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif")) returned 0x20 [0062.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif")) returned 0x20 [0062.019] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0062.019] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0062.019] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0062.019] SetEndOfFile (hFile=0x158) returned 1 [0062.020] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0062.020] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe410c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0062.020] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0062.020] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe42ac, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0062.020] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe42ac, cbMultiByte=11, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="PREVIEW.GIFGer.gifg") returned 11 [0062.020] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0062.020] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe410c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0062.020] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0062.020] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0062.020] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0xa0e [0062.020] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0062.020] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0062.020] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0062.021] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0062.021] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe410c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0062.021] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0062.021] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe42ac, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0062.021] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe42ac, cbMultiByte=11, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="PREVIEW.GIFEW.GIFGer.gifg") returned 11 [0062.021] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0062.021] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe410c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0062.021] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0062.022] CharToOemA (in: pSrc="PREVIEW.GIF", pDst=0x1fe42ac | out: pDst="PREVIEW.GIF") returned 1 [0062.022] WriteFile (in: hFile=0x158, lpBuffer=0x1fe42ac*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe42ac*, lpNumberOfBytesWritten=0x18e048*=0xb, lpOverlapped=0x0) returned 1 [0062.022] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0062.022] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0062.022] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0062.022] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=18228564291) returned 1 [0062.022] ReadFile (in: hFile=0x11c, lpBuffer=0x37b81c0, nNumberOfBytesToRead=0xa0e, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37b81c0*, lpNumberOfBytesRead=0x18dd7c*=0xa0e, lpOverlapped=0x0) returned 1 [0062.024] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0062.024] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=18228771947) returned 1 [0062.035] WriteFile (in: hFile=0x158, lpBuffer=0x1fea210*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fea210*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0062.036] ReadFile (in: hFile=0x11c, lpBuffer=0x37b81c0, nNumberOfBytesToRead=0xa0e, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x37b81c0*, lpNumberOfBytesRead=0x18de38*=0xa0e, lpOverlapped=0x0) returned 1 [0062.036] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x46 [0062.036] WriteFile (in: hFile=0x158, lpBuffer=0x37b8bf0*, nNumberOfBytesToWrite=0xa0e, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x37b8bf0*, lpNumberOfBytesWritten=0x18de10*=0xa0e, lpOverlapped=0x0) returned 1 [0062.036] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0xa54 [0062.036] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0062.036] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0062.036] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0062.037] SetFilePointer (in: hFile=0x158, lDistanceToMove=11, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x29 [0062.037] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0xa5e [0062.037] CloseHandle (hObject=0x11c) returned 1 [0062.037] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xa5e [0062.037] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xa5e [0062.037] SetFilePointer (in: hFile=0x158, lDistanceToMove=2654, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xa5e [0062.037] SetFilePointer (in: hFile=0x158, lDistanceToMove=2654, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0xa5e [0062.037] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xa5e [0062.037] SetFilePointer (in: hFile=0x158, lDistanceToMove=2654, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0xa5e [0062.037] SetEndOfFile (hFile=0x158) returned 1 [0062.038] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xa5e [0062.038] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xa5e [0062.038] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0062.038] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe410c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0062.038] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0062.038] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe41ac, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0062.038] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe41ac, cbMultiByte=11, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="PREVIEW.GIF\x18ꞗ@涤(\x18믉`믑`") returned 11 [0062.038] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0062.038] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe410c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0062.038] WriteFile (in: hFile=0x158, lpBuffer=0x379bc78*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x379bc78*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0062.038] CharToOemA (in: pSrc="PREVIEW.GIF", pDst=0x1fe41ac | out: pDst="PREVIEW.GIF") returned 1 [0062.038] WriteFile (in: hFile=0x158, lpBuffer=0x1fe41ac*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe41ac*, lpNumberOfBytesWritten=0x18efcc*=0xb, lpOverlapped=0x0) returned 1 [0062.039] WriteFile (in: hFile=0x158, lpBuffer=0x1fea170*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea170*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0062.039] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0062.039] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0062.039] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xaa2 [0062.039] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xaa2 [0062.039] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0062.039] WriteFile (in: hFile=0x158, lpBuffer=0x35f011c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f011c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0062.040] DeleteFileW (lpFileName="") returned 0 [0062.040] GetLastError () returned 0x3 [0062.040] GetFileAttributesW (lpFileName="") returned 0xffffffff [0062.040] SetLastError (dwErrCode=0x3) [0062.040] FlushFileBuffers (hFile=0x158) returned 1 [0062.045] GetCurrentThreadId () returned 0x970 [0062.045] GetCurrentThreadId () returned 0x970 [0062.045] GetCurrentThreadId () returned 0x970 [0062.045] GetCurrentThreadId () returned 0x970 [0062.045] GetCurrentThreadId () returned 0x970 [0062.045] GetCurrentThreadId () returned 0x970 [0062.045] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xb59 [0062.045] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xb59 [0062.045] SetFilePointer (in: hFile=0x158, lDistanceToMove=2905, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xb59 [0062.045] CloseHandle (hObject=0x158) returned 1 [0062.046] GetCurrentThreadId () returned 0x970 [0062.046] GetCurrentThreadId () returned 0x970 [0062.046] GetCurrentThreadId () returned 0x970 [0062.046] GetCurrentThreadId () returned 0x970 [0062.046] GetCurrentThreadId () returned 0x970 [0062.046] GetCurrentThreadId () returned 0x970 [0062.046] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\Файл зашифрован [PREVIEW.GIF].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\Файл зашифрован [preview.gif].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0062.046] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb59 [0062.046] SetFilePointer (in: hFile=0x158, lDistanceToMove=2777, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xad9 [0062.046] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0062.046] GetFileType (hFile=0x158) returned 0x1 [0062.047] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x9, wMilliseconds=0x13e)) [0062.047] GetCurrentThreadId () returned 0x970 [0062.047] GetCurrentThreadId () returned 0x970 [0062.047] GetCurrentThreadId () returned 0x970 [0062.047] GetCurrentThreadId () returned 0x970 [0062.047] GetCurrentThreadId () returned 0x970 [0062.047] GetCurrentThreadId () returned 0x970 [0062.047] GetCurrentThreadId () returned 0x970 [0062.047] GetCurrentThreadId () returned 0x970 [0062.047] GetCurrentThreadId () returned 0x970 [0062.047] GetCurrentThreadId () returned 0x970 [0062.047] GetCurrentThreadId () returned 0x970 [0062.047] GetCurrentThreadId () returned 0x970 [0062.047] GetCurrentThreadId () returned 0x970 [0062.047] GetCurrentThreadId () returned 0x970 [0062.047] GetCurrentThreadId () returned 0x970 [0062.047] GetCurrentThreadId () returned 0x970 [0062.047] GetCurrentThreadId () returned 0x970 [0062.047] GetCurrentThreadId () returned 0x970 [0062.047] GetCurrentThreadId () returned 0x970 [0062.047] GetCurrentThreadId () returned 0x970 [0062.047] GetCurrentThreadId () returned 0x970 [0062.047] GetCurrentThreadId () returned 0x970 [0062.047] GetCurrentThreadId () returned 0x970 [0062.047] GetCurrentThreadId () returned 0x970 [0062.047] GetCurrentThreadId () returned 0x970 [0062.047] GetCurrentThreadId () returned 0x970 [0062.047] GetCurrentThreadId () returned 0x970 [0062.047] GetCurrentThreadId () returned 0x970 [0062.047] GetCurrentThreadId () returned 0x970 [0062.047] GetCurrentThreadId () returned 0x970 [0062.047] GetCurrentThreadId () returned 0x970 [0062.047] GetCurrentThreadId () returned 0x970 [0062.047] GetCurrentThreadId () returned 0x970 [0062.047] GetCurrentThreadId () returned 0x970 [0062.047] GetCurrentThreadId () returned 0x970 [0062.047] GetCurrentThreadId () returned 0x970 [0062.047] GetCurrentThreadId () returned 0x970 [0062.047] GetCurrentThreadId () returned 0x970 [0062.047] GetCurrentThreadId () returned 0x970 [0062.047] GetCurrentThreadId () returned 0x970 [0062.047] GetCurrentThreadId () returned 0x970 [0062.048] GetCurrentThreadId () returned 0x970 [0062.048] GetCurrentThreadId () returned 0x970 [0062.048] GetCurrentThreadId () returned 0x970 [0062.048] GetCurrentThreadId () returned 0x970 [0062.048] GetCurrentThreadId () returned 0x970 [0062.048] GetCurrentThreadId () returned 0x970 [0062.048] GetCurrentThreadId () returned 0x970 [0062.048] GetCurrentThreadId () returned 0x970 [0062.048] GetCurrentThreadId () returned 0x970 [0062.048] GetCurrentThreadId () returned 0x970 [0062.048] GetCurrentThreadId () returned 0x970 [0062.048] GetCurrentThreadId () returned 0x970 [0062.048] GetCurrentThreadId () returned 0x970 [0062.048] GetCurrentThreadId () returned 0x970 [0062.048] GetCurrentThreadId () returned 0x970 [0062.048] GetCurrentThreadId () returned 0x970 [0062.048] GetCurrentThreadId () returned 0x970 [0062.048] GetCurrentThreadId () returned 0x970 [0062.048] GetCurrentThreadId () returned 0x970 [0062.048] GetCurrentThreadId () returned 0x970 [0062.048] GetCurrentThreadId () returned 0x970 [0062.048] GetCurrentThreadId () returned 0x970 [0062.048] GetCurrentThreadId () returned 0x970 [0062.048] GetCurrentThreadId () returned 0x970 [0062.048] GetCurrentThreadId () returned 0x970 [0062.048] GetCurrentThreadId () returned 0x970 [0062.048] GetCurrentThreadId () returned 0x970 [0062.048] GetCurrentThreadId () returned 0x970 [0062.048] GetCurrentThreadId () returned 0x970 [0062.048] GetCurrentThreadId () returned 0x970 [0062.048] GetCurrentThreadId () returned 0x970 [0062.048] GetCurrentThreadId () returned 0x970 [0062.048] GetCurrentThreadId () returned 0x970 [0062.048] GetCurrentThreadId () returned 0x970 [0062.048] GetCurrentThreadId () returned 0x970 [0062.048] GetCurrentThreadId () returned 0x970 [0062.048] GetCurrentThreadId () returned 0x970 [0062.048] GetCurrentThreadId () returned 0x970 [0062.048] GetCurrentThreadId () returned 0x970 [0062.048] GetCurrentThreadId () returned 0x970 [0062.048] GetCurrentThreadId () returned 0x970 [0062.048] GetCurrentThreadId () returned 0x970 [0062.048] GetCurrentThreadId () returned 0x970 [0062.048] GetCurrentThreadId () returned 0x970 [0062.048] GetCurrentThreadId () returned 0x970 [0062.048] GetCurrentThreadId () returned 0x970 [0062.049] GetCurrentThreadId () returned 0x970 [0062.049] GetCurrentThreadId () returned 0x970 [0062.049] GetCurrentThreadId () returned 0x970 [0062.049] GetCurrentThreadId () returned 0x970 [0062.049] GetCurrentThreadId () returned 0x970 [0062.049] GetCurrentThreadId () returned 0x970 [0062.049] GetCurrentThreadId () returned 0x970 [0062.049] GetCurrentThreadId () returned 0x970 [0062.049] GetCurrentThreadId () returned 0x970 [0062.049] GetCurrentThreadId () returned 0x970 [0062.049] GetCurrentThreadId () returned 0x970 [0062.049] GetCurrentThreadId () returned 0x970 [0062.049] GetCurrentThreadId () returned 0x970 [0062.049] GetCurrentThreadId () returned 0x970 [0062.049] GetCurrentThreadId () returned 0x970 [0062.049] GetCurrentThreadId () returned 0x970 [0062.049] GetCurrentThreadId () returned 0x970 [0062.049] GetCurrentThreadId () returned 0x970 [0062.049] GetCurrentThreadId () returned 0x970 [0062.049] GetCurrentThreadId () returned 0x970 [0062.049] GetCurrentThreadId () returned 0x970 [0062.049] GetCurrentThreadId () returned 0x970 [0062.049] GetCurrentThreadId () returned 0x970 [0062.049] GetCurrentThreadId () returned 0x970 [0062.049] GetCurrentThreadId () returned 0x970 [0062.049] GetCurrentThreadId () returned 0x970 [0062.049] GetCurrentThreadId () returned 0x970 [0062.049] GetCurrentThreadId () returned 0x970 [0062.049] GetCurrentThreadId () returned 0x970 [0062.049] GetCurrentThreadId () returned 0x970 [0062.049] GetCurrentThreadId () returned 0x970 [0062.049] GetCurrentThreadId () returned 0x970 [0062.049] GetCurrentThreadId () returned 0x970 [0062.049] GetCurrentThreadId () returned 0x970 [0062.049] GetCurrentThreadId () returned 0x970 [0062.049] GetCurrentThreadId () returned 0x970 [0062.049] GetCurrentThreadId () returned 0x970 [0062.049] GetCurrentThreadId () returned 0x970 [0062.049] GetCurrentThreadId () returned 0x970 [0062.049] GetCurrentThreadId () returned 0x970 [0062.049] GetCurrentThreadId () returned 0x970 [0062.049] GetCurrentThreadId () returned 0x970 [0062.049] GetCurrentThreadId () returned 0x970 [0062.049] GetCurrentThreadId () returned 0x970 [0062.050] GetCurrentThreadId () returned 0x970 [0062.050] GetCurrentThreadId () returned 0x970 [0062.050] GetCurrentThreadId () returned 0x970 [0062.050] GetCurrentThreadId () returned 0x970 [0062.050] GetCurrentThreadId () returned 0x970 [0062.050] GetCurrentThreadId () returned 0x970 [0062.050] GetCurrentThreadId () returned 0x970 [0062.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff0170, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff0170, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff01d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff01d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff01d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.050] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x9, wMilliseconds=0x13e)) [0062.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="o%X6\\kVSIW~1ft!x!q1Ba{M!rgzy}rp{", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0062.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="o%X6\\kVSIW~1ft!x!q1Ba{M!rgzy}rp{", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0062.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="o%X6\\kVSIW~1ft!x!q1Ba{M!rgzy}rp{", cchWideChar=32, lpMultiByteStr=0x20024e8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="o%X6\\kVSIW~1ft!x!q1Ba{M!rgzy}rp{", lpUsedDefaultChar=0x0) returned 32 [0062.051] GetCurrentThreadId () returned 0x970 [0062.051] GetCurrentThreadId () returned 0x970 [0062.051] GetCurrentThreadId () returned 0x970 [0062.051] GetCurrentThreadId () returned 0x970 [0062.051] GetCurrentThreadId () returned 0x970 [0062.051] GetCurrentThreadId () returned 0x970 [0062.058] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0062.058] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0062.058] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3794748, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0062.058] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0062.058] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAA5Ffyolxoopre+5rzpZF8MHaPgjYITXzd0D+7GIW4HGhRwcn9p1rHTt9/saCfSpNp7no2y4xpBt8ixeErpjzX1dvbBN/AJc3Y8UQDcDG9b9fZw1Wicj5qlUP58NXcw7qpoHFTCKoLOVQHrmJZRJDsCSMIjdoOsg+cAzrn4ALlxwTlEoL1dt3z2Y2/VJkNLo4Apktc5VXWolsEeIn9ahNX8Qz8Gi77b2ZA==") returned 232 [0062.058] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x9, wMilliseconds=0x14e)) [0062.058] GetCurrentThreadId () returned 0x970 [0062.058] GetCurrentThreadId () returned 0x970 [0062.058] GetCurrentThreadId () returned 0x970 [0062.058] GetCurrentThreadId () returned 0x970 [0062.058] GetCurrentThreadId () returned 0x970 [0062.058] GetCurrentThreadId () returned 0x970 [0062.058] GetCurrentThreadId () returned 0x970 [0062.059] GetCurrentThreadId () returned 0x970 [0062.059] GetCurrentThreadId () returned 0x970 [0062.059] GetCurrentThreadId () returned 0x970 [0062.059] GetCurrentThreadId () returned 0x970 [0062.059] GetCurrentThreadId () returned 0x970 [0062.059] GetCurrentThreadId () returned 0x970 [0062.059] GetCurrentThreadId () returned 0x970 [0062.059] GetCurrentThreadId () returned 0x970 [0062.059] GetCurrentThreadId () returned 0x970 [0062.059] GetCurrentThreadId () returned 0x970 [0062.059] GetCurrentThreadId () returned 0x970 [0062.059] GetCurrentThreadId () returned 0x970 [0062.059] GetCurrentThreadId () returned 0x970 [0062.059] GetCurrentThreadId () returned 0x970 [0062.059] GetCurrentThreadId () returned 0x970 [0062.059] GetCurrentThreadId () returned 0x970 [0062.059] GetCurrentThreadId () returned 0x970 [0062.059] GetCurrentThreadId () returned 0x970 [0062.059] GetCurrentThreadId () returned 0x970 [0062.059] GetCurrentThreadId () returned 0x970 [0062.059] GetCurrentThreadId () returned 0x970 [0062.059] GetCurrentThreadId () returned 0x970 [0062.059] GetCurrentThreadId () returned 0x970 [0062.059] GetCurrentThreadId () returned 0x970 [0062.059] GetCurrentThreadId () returned 0x970 [0062.059] GetCurrentThreadId () returned 0x970 [0062.059] GetCurrentThreadId () returned 0x970 [0062.059] GetCurrentThreadId () returned 0x970 [0062.059] GetCurrentThreadId () returned 0x970 [0062.059] GetCurrentThreadId () returned 0x970 [0062.059] GetCurrentThreadId () returned 0x970 [0062.059] GetCurrentThreadId () returned 0x970 [0062.059] GetCurrentThreadId () returned 0x970 [0062.059] GetCurrentThreadId () returned 0x970 [0062.059] GetCurrentThreadId () returned 0x970 [0062.059] GetCurrentThreadId () returned 0x970 [0062.059] GetCurrentThreadId () returned 0x970 [0062.059] GetCurrentThreadId () returned 0x970 [0062.059] GetCurrentThreadId () returned 0x970 [0062.059] GetCurrentThreadId () returned 0x970 [0062.059] GetCurrentThreadId () returned 0x970 [0062.059] GetCurrentThreadId () returned 0x970 [0062.059] GetCurrentThreadId () returned 0x970 [0062.059] GetCurrentThreadId () returned 0x970 [0062.060] GetCurrentThreadId () returned 0x970 [0062.060] GetCurrentThreadId () returned 0x970 [0062.060] GetCurrentThreadId () returned 0x970 [0062.060] GetCurrentThreadId () returned 0x970 [0062.060] GetCurrentThreadId () returned 0x970 [0062.060] GetCurrentThreadId () returned 0x970 [0062.060] GetCurrentThreadId () returned 0x970 [0062.060] GetCurrentThreadId () returned 0x970 [0062.060] GetCurrentThreadId () returned 0x970 [0062.060] GetCurrentThreadId () returned 0x970 [0062.060] GetCurrentThreadId () returned 0x970 [0062.060] GetCurrentThreadId () returned 0x970 [0062.060] GetCurrentThreadId () returned 0x970 [0062.060] GetCurrentThreadId () returned 0x970 [0062.060] GetCurrentThreadId () returned 0x970 [0062.060] GetCurrentThreadId () returned 0x970 [0062.060] GetCurrentThreadId () returned 0x970 [0062.060] GetCurrentThreadId () returned 0x970 [0062.060] GetCurrentThreadId () returned 0x970 [0062.060] GetCurrentThreadId () returned 0x970 [0062.060] GetCurrentThreadId () returned 0x970 [0062.060] GetCurrentThreadId () returned 0x970 [0062.061] GetCurrentThreadId () returned 0x970 [0062.061] GetCurrentThreadId () returned 0x970 [0062.061] GetCurrentThreadId () returned 0x970 [0062.061] GetCurrentThreadId () returned 0x970 [0062.061] GetCurrentThreadId () returned 0x970 [0062.061] GetCurrentThreadId () returned 0x970 [0062.061] GetCurrentThreadId () returned 0x970 [0062.061] GetCurrentThreadId () returned 0x970 [0062.061] GetCurrentThreadId () returned 0x970 [0062.061] GetCurrentThreadId () returned 0x970 [0062.061] GetCurrentThreadId () returned 0x970 [0062.061] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAA5Ffyolxoopre+5rzpZF8MHaPgjYITXzd0D+7GIW4HGhRwcn9p1rHTt9/saCfSpNp7no2y4xpBt8ixeErpjzX1dvbBN/AJc3Y8UQDcDG9b9fZw1Wicj5qlUP58NXcw7qpoHFTCKoLOVQHrmJZRJDsCSMIjdoOsg+cAzrn4ALlxwTlEoL1dt3z2Y2/VJkNLo4Apktc5VXWolsEeIn9ahNX8Qz8Gi77b2ZA==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0062.061] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAA5Ffyolxoopre+5rzpZF8MHaPgjYITXzd0D+7GIW4HGhRwcn9p1rHTt9/saCfSpNp7no2y4xpBt8ixeErpjzX1dvbBN/AJc3Y8UQDcDG9b9fZw1Wicj5qlUP58NXcw7qpoHFTCKoLOVQHrmJZRJDsCSMIjdoOsg+cAzrn4ALlxwTlEoL1dt3z2Y2/VJkNLo4Apktc5VXWolsEeIn9ahNX8Qz8Gi77b2ZA==", cchWideChar=245, lpMultiByteStr=0x353933c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAA5Ffyolxoopre+5rzpZF8MHaPgjYITXzd0D+7GIW4HGhRwcn9p1rHTt9/saCfSpNp7no2y4xpBt8ixeErpjzX1dvbBN/AJc3Y8UQDcDG9b9fZw1Wicj5qlUP58NXcw7qpoHFTCKoLOVQHrmJZRJDsCSMIjdoOsg+cAzrn4ALlxwTlEoL1dt3z2Y2/VJkNLo4Apktc5VXWolsEeIn9ahNX8Qz8Gi77b2ZA==", lpUsedDefaultChar=0x0) returned 245 [0062.061] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0062.061] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0062.061] CloseHandle (hObject=0x158) returned 1 [0062.062] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif")) returned 1 [0062.063] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=18232633233) returned 1 [0062.063] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\Файл зашифрован [THMBNAIL.PNG].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\Файл зашифрован [thmbnail.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0062.063] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0062.063] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0062.063] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0062.064] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0062.064] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0062.064] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0062.064] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0062.064] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0062.064] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0062.064] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0062.064] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0062.064] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0062.064] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0062.064] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0062.064] SetEndOfFile (hFile=0x158) returned 1 [0062.064] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0062.064] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0062.064] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0062.064] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0062.064] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0062.066] WriteFile (in: hFile=0x158, lpBuffer=0x35f01dc*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f01dc*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0062.066] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c:7Ld.Z89^xij44pz!/+ezg@^sCa9zq\"", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0062.066] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c:7Ld.Z89^xij44pz!/+ezg@^sCa9zq\"", cchWideChar=32, lpMultiByteStr=0x20356fc, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:7Ld.Z89^xij44pz!/+ezg@^sCa9zq\"", lpUsedDefaultChar=0x0) returned 32 [0062.066] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0062.066] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0062.066] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9240, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0x295098 [0062.066] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0062.066] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0062.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png")) returned 0x20 [0062.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png")) returned 0x20 [0062.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png")) returned 0x20 [0062.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png")) returned 0x20 [0062.067] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9240)) returned 1 [0062.067] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0062.067] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0062.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png")) returned 0x20 [0062.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png")) returned 0x20 [0062.067] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0062.067] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0062.067] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0062.067] SetEndOfFile (hFile=0x158) returned 1 [0062.068] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0062.068] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe370c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0062.068] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0062.068] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe472c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0062.068] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe472c, cbMultiByte=12, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="THMBNAIL.PNGer.gifg") returned 12 [0062.068] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0062.068] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe370c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0062.068] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0062.068] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0062.068] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x9240 [0062.069] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0062.069] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0062.069] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0062.069] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0062.069] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe370c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0062.069] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0062.069] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe472c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0062.069] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe472c, cbMultiByte=12, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="THMBNAIL.PNGIL.PNGer.gifg") returned 12 [0062.069] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0062.069] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe370c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0062.069] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0062.070] CharToOemA (in: pSrc="THMBNAIL.PNG", pDst=0x1fe472c | out: pDst="THMBNAIL.PNG") returned 1 [0062.070] WriteFile (in: hFile=0x158, lpBuffer=0x1fe472c*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe472c*, lpNumberOfBytesWritten=0x18e048*=0xc, lpOverlapped=0x0) returned 1 [0062.071] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0062.071] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0062.071] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0062.071] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=18233425275) returned 1 [0062.071] ReadFile (in: hFile=0x11c, lpBuffer=0x37b81a0, nNumberOfBytesToRead=0x9240, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37b81a0*, lpNumberOfBytesRead=0x18dd7c*=0x9240, lpOverlapped=0x0) returned 1 [0062.073] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0062.073] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=18233628175) returned 1 [0062.082] WriteFile (in: hFile=0x158, lpBuffer=0x1fea2a0*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fea2a0*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0062.082] ReadFile (in: hFile=0x11c, lpBuffer=0x37b81a0, nNumberOfBytesToRead=0x9240, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x37b81a0*, lpNumberOfBytesRead=0x18de38*=0x9240, lpOverlapped=0x0) returned 1 [0062.083] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x47 [0062.083] WriteFile (in: hFile=0x158, lpBuffer=0x3802cc0*, nNumberOfBytesToWrite=0x9240, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3802cc0*, lpNumberOfBytesWritten=0x18de10*=0x9240, lpOverlapped=0x0) returned 1 [0062.084] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x9287 [0062.084] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0062.084] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0062.084] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0062.084] SetFilePointer (in: hFile=0x158, lDistanceToMove=12, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2a [0062.084] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x9291 [0062.084] CloseHandle (hObject=0x11c) returned 1 [0062.084] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x9291 [0062.085] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x9291 [0062.085] SetFilePointer (in: hFile=0x158, lDistanceToMove=37521, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x9291 [0062.085] SetFilePointer (in: hFile=0x158, lDistanceToMove=37521, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x9291 [0062.085] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x9291 [0062.085] SetFilePointer (in: hFile=0x158, lDistanceToMove=37521, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x9291 [0062.085] SetEndOfFile (hFile=0x158) returned 1 [0062.085] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x9291 [0062.085] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x9291 [0062.085] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0062.085] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe370c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0062.085] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0062.085] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe37ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0062.085] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe37ec, cbMultiByte=12, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="THMBNAIL.PNGꞗ@涤(\x18믉`믑`") returned 12 [0062.085] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0062.085] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe370c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0062.085] WriteFile (in: hFile=0x158, lpBuffer=0x379bc78*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x379bc78*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0062.086] CharToOemA (in: pSrc="THMBNAIL.PNG", pDst=0x1fe37ec | out: pDst="THMBNAIL.PNG") returned 1 [0062.086] WriteFile (in: hFile=0x158, lpBuffer=0x1fe37ec*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe37ec*, lpNumberOfBytesWritten=0x18efcc*=0xc, lpOverlapped=0x0) returned 1 [0062.086] WriteFile (in: hFile=0x158, lpBuffer=0x1fea110*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea110*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0062.086] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0062.086] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0062.086] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x92d6 [0062.086] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x92d6 [0062.086] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0062.087] WriteFile (in: hFile=0x158, lpBuffer=0x35f01dc*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f01dc*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0062.087] DeleteFileW (lpFileName="") returned 0 [0062.087] GetLastError () returned 0x3 [0062.087] GetFileAttributesW (lpFileName="") returned 0xffffffff [0062.087] SetLastError (dwErrCode=0x3) [0062.087] FlushFileBuffers (hFile=0x158) returned 1 [0062.090] GetCurrentThreadId () returned 0x970 [0062.090] GetCurrentThreadId () returned 0x970 [0062.090] GetCurrentThreadId () returned 0x970 [0062.090] GetCurrentThreadId () returned 0x970 [0062.090] GetCurrentThreadId () returned 0x970 [0062.090] GetCurrentThreadId () returned 0x970 [0062.090] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x938d [0062.090] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x938d [0062.090] SetFilePointer (in: hFile=0x158, lDistanceToMove=37773, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x938d [0062.090] CloseHandle (hObject=0x158) returned 1 [0062.091] GetCurrentThreadId () returned 0x970 [0062.091] GetCurrentThreadId () returned 0x970 [0062.091] GetCurrentThreadId () returned 0x970 [0062.091] GetCurrentThreadId () returned 0x970 [0062.091] GetCurrentThreadId () returned 0x970 [0062.092] GetCurrentThreadId () returned 0x970 [0062.092] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\Файл зашифрован [THMBNAIL.PNG].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\Файл зашифрован [thmbnail.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0062.092] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x938d [0062.092] SetFilePointer (in: hFile=0x158, lDistanceToMove=37645, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x930d [0062.092] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0062.092] GetFileType (hFile=0x158) returned 0x1 [0062.092] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x9, wMilliseconds=0x16d)) [0062.092] GetCurrentThreadId () returned 0x970 [0062.092] GetCurrentThreadId () returned 0x970 [0062.092] GetCurrentThreadId () returned 0x970 [0062.092] GetCurrentThreadId () returned 0x970 [0062.092] GetCurrentThreadId () returned 0x970 [0062.092] GetCurrentThreadId () returned 0x970 [0062.092] GetCurrentThreadId () returned 0x970 [0062.092] GetCurrentThreadId () returned 0x970 [0062.092] GetCurrentThreadId () returned 0x970 [0062.092] GetCurrentThreadId () returned 0x970 [0062.092] GetCurrentThreadId () returned 0x970 [0062.092] GetCurrentThreadId () returned 0x970 [0062.092] GetCurrentThreadId () returned 0x970 [0062.092] GetCurrentThreadId () returned 0x970 [0062.092] GetCurrentThreadId () returned 0x970 [0062.092] GetCurrentThreadId () returned 0x970 [0062.092] GetCurrentThreadId () returned 0x970 [0062.092] GetCurrentThreadId () returned 0x970 [0062.092] GetCurrentThreadId () returned 0x970 [0062.092] GetCurrentThreadId () returned 0x970 [0062.092] GetCurrentThreadId () returned 0x970 [0062.092] GetCurrentThreadId () returned 0x970 [0062.092] GetCurrentThreadId () returned 0x970 [0062.092] GetCurrentThreadId () returned 0x970 [0062.092] GetCurrentThreadId () returned 0x970 [0062.092] GetCurrentThreadId () returned 0x970 [0062.092] GetCurrentThreadId () returned 0x970 [0062.093] GetCurrentThreadId () returned 0x970 [0062.093] GetCurrentThreadId () returned 0x970 [0062.093] GetCurrentThreadId () returned 0x970 [0062.093] GetCurrentThreadId () returned 0x970 [0062.093] GetCurrentThreadId () returned 0x970 [0062.093] GetCurrentThreadId () returned 0x970 [0062.093] GetCurrentThreadId () returned 0x970 [0062.093] GetCurrentThreadId () returned 0x970 [0062.093] GetCurrentThreadId () returned 0x970 [0062.093] GetCurrentThreadId () returned 0x970 [0062.093] GetCurrentThreadId () returned 0x970 [0062.093] GetCurrentThreadId () returned 0x970 [0062.093] GetCurrentThreadId () returned 0x970 [0062.093] GetCurrentThreadId () returned 0x970 [0062.093] GetCurrentThreadId () returned 0x970 [0062.093] GetCurrentThreadId () returned 0x970 [0062.093] GetCurrentThreadId () returned 0x970 [0062.093] GetCurrentThreadId () returned 0x970 [0062.093] GetCurrentThreadId () returned 0x970 [0062.093] GetCurrentThreadId () returned 0x970 [0062.093] GetCurrentThreadId () returned 0x970 [0062.093] GetCurrentThreadId () returned 0x970 [0062.093] GetCurrentThreadId () returned 0x970 [0062.093] GetCurrentThreadId () returned 0x970 [0062.093] GetCurrentThreadId () returned 0x970 [0062.093] GetCurrentThreadId () returned 0x970 [0062.093] GetCurrentThreadId () returned 0x970 [0062.093] GetCurrentThreadId () returned 0x970 [0062.093] GetCurrentThreadId () returned 0x970 [0062.093] GetCurrentThreadId () returned 0x970 [0062.093] GetCurrentThreadId () returned 0x970 [0062.093] GetCurrentThreadId () returned 0x970 [0062.093] GetCurrentThreadId () returned 0x970 [0062.093] GetCurrentThreadId () returned 0x970 [0062.093] GetCurrentThreadId () returned 0x970 [0062.093] GetCurrentThreadId () returned 0x970 [0062.093] GetCurrentThreadId () returned 0x970 [0062.093] GetCurrentThreadId () returned 0x970 [0062.093] GetCurrentThreadId () returned 0x970 [0062.093] GetCurrentThreadId () returned 0x970 [0062.093] GetCurrentThreadId () returned 0x970 [0062.093] GetCurrentThreadId () returned 0x970 [0062.093] GetCurrentThreadId () returned 0x970 [0062.093] GetCurrentThreadId () returned 0x970 [0062.094] GetCurrentThreadId () returned 0x970 [0062.094] GetCurrentThreadId () returned 0x970 [0062.094] GetCurrentThreadId () returned 0x970 [0062.094] GetCurrentThreadId () returned 0x970 [0062.094] GetCurrentThreadId () returned 0x970 [0062.094] GetCurrentThreadId () returned 0x970 [0062.094] GetCurrentThreadId () returned 0x970 [0062.094] GetCurrentThreadId () returned 0x970 [0062.094] GetCurrentThreadId () returned 0x970 [0062.094] GetCurrentThreadId () returned 0x970 [0062.094] GetCurrentThreadId () returned 0x970 [0062.094] GetCurrentThreadId () returned 0x970 [0062.094] GetCurrentThreadId () returned 0x970 [0062.094] GetCurrentThreadId () returned 0x970 [0062.094] GetCurrentThreadId () returned 0x970 [0062.094] GetCurrentThreadId () returned 0x970 [0062.094] GetCurrentThreadId () returned 0x970 [0062.094] GetCurrentThreadId () returned 0x970 [0062.094] GetCurrentThreadId () returned 0x970 [0062.094] GetCurrentThreadId () returned 0x970 [0062.094] GetCurrentThreadId () returned 0x970 [0062.094] GetCurrentThreadId () returned 0x970 [0062.094] GetCurrentThreadId () returned 0x970 [0062.094] GetCurrentThreadId () returned 0x970 [0062.094] GetCurrentThreadId () returned 0x970 [0062.094] GetCurrentThreadId () returned 0x970 [0062.094] GetCurrentThreadId () returned 0x970 [0062.094] GetCurrentThreadId () returned 0x970 [0062.094] GetCurrentThreadId () returned 0x970 [0062.094] GetCurrentThreadId () returned 0x970 [0062.094] GetCurrentThreadId () returned 0x970 [0062.094] GetCurrentThreadId () returned 0x970 [0062.094] GetCurrentThreadId () returned 0x970 [0062.094] GetCurrentThreadId () returned 0x970 [0062.094] GetCurrentThreadId () returned 0x970 [0062.094] GetCurrentThreadId () returned 0x970 [0062.094] GetCurrentThreadId () returned 0x970 [0062.094] GetCurrentThreadId () returned 0x970 [0062.094] GetCurrentThreadId () returned 0x970 [0062.094] GetCurrentThreadId () returned 0x970 [0062.094] GetCurrentThreadId () returned 0x970 [0062.094] GetCurrentThreadId () returned 0x970 [0062.094] GetCurrentThreadId () returned 0x970 [0062.094] GetCurrentThreadId () returned 0x970 [0062.095] GetCurrentThreadId () returned 0x970 [0062.095] GetCurrentThreadId () returned 0x970 [0062.095] GetCurrentThreadId () returned 0x970 [0062.095] GetCurrentThreadId () returned 0x970 [0062.095] GetCurrentThreadId () returned 0x970 [0062.095] GetCurrentThreadId () returned 0x970 [0062.095] GetCurrentThreadId () returned 0x970 [0062.095] GetCurrentThreadId () returned 0x970 [0062.095] GetCurrentThreadId () returned 0x970 [0062.095] GetCurrentThreadId () returned 0x970 [0062.095] GetCurrentThreadId () returned 0x970 [0062.095] GetCurrentThreadId () returned 0x970 [0062.095] GetCurrentThreadId () returned 0x970 [0062.095] GetCurrentThreadId () returned 0x970 [0062.095] GetCurrentThreadId () returned 0x970 [0062.095] GetCurrentThreadId () returned 0x970 [0062.095] GetCurrentThreadId () returned 0x970 [0062.095] GetCurrentThreadId () returned 0x970 [0062.095] GetCurrentThreadId () returned 0x970 [0062.095] GetCurrentThreadId () returned 0x970 [0062.095] GetCurrentThreadId () returned 0x970 [0062.095] GetCurrentThreadId () returned 0x970 [0062.095] GetCurrentThreadId () returned 0x970 [0062.095] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.095] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.095] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff01d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.095] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.095] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.095] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff01d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.095] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.095] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.095] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.095] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.095] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.095] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.095] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.095] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.095] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff0230, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.095] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.095] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.096] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff0230, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.096] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.096] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.096] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff0230, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.096] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x9, wMilliseconds=0x16d)) [0062.096] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:7Ld.Z89^xij44pz!/+ezg@^sCa9zq\"", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0062.096] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:7Ld.Z89^xij44pz!/+ezg@^sCa9zq\"", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0062.096] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:7Ld.Z89^xij44pz!/+ezg@^sCa9zq\"", cchWideChar=32, lpMultiByteStr=0x2002f38, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:7Ld.Z89^xij44pz!/+ezg@^sCa9zq\"", lpUsedDefaultChar=0x0) returned 32 [0062.096] GetCurrentThreadId () returned 0x970 [0062.096] GetCurrentThreadId () returned 0x970 [0062.096] GetCurrentThreadId () returned 0x970 [0062.096] GetCurrentThreadId () returned 0x970 [0062.096] GetCurrentThreadId () returned 0x970 [0062.096] GetCurrentThreadId () returned 0x970 [0062.103] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0062.103] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0062.103] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3794838, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0062.103] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0062.103] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAAmHrU2fYJAhARu4uGes+57AS1qDq3D/CyJhybZtB0ZjiKgofzwyVNfqSXmgXq1Kw/um8rKW/SjuDg21E/8r9ERV60iDJOEjhxsnyVlpteuhPJ2+Fqirkcqk5u0BsyLLRlxerUwgtomx+To/9NzK867/FKrmF39RNcS50FftBUZXegripuYFzz5oCvPCgu4YPFYP4hIjLqP6/1mGFttDqsHIUMyL+aewuA==") returned 232 [0062.103] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x9, wMilliseconds=0x17d)) [0062.103] GetCurrentThreadId () returned 0x970 [0062.103] GetCurrentThreadId () returned 0x970 [0062.104] GetCurrentThreadId () returned 0x970 [0062.104] GetCurrentThreadId () returned 0x970 [0062.104] GetCurrentThreadId () returned 0x970 [0062.104] GetCurrentThreadId () returned 0x970 [0062.104] GetCurrentThreadId () returned 0x970 [0062.104] GetCurrentThreadId () returned 0x970 [0062.104] GetCurrentThreadId () returned 0x970 [0062.104] GetCurrentThreadId () returned 0x970 [0062.104] GetCurrentThreadId () returned 0x970 [0062.104] GetCurrentThreadId () returned 0x970 [0062.104] GetCurrentThreadId () returned 0x970 [0062.104] GetCurrentThreadId () returned 0x970 [0062.104] GetCurrentThreadId () returned 0x970 [0062.104] GetCurrentThreadId () returned 0x970 [0062.104] GetCurrentThreadId () returned 0x970 [0062.104] GetCurrentThreadId () returned 0x970 [0062.104] GetCurrentThreadId () returned 0x970 [0062.104] GetCurrentThreadId () returned 0x970 [0062.104] GetCurrentThreadId () returned 0x970 [0062.104] GetCurrentThreadId () returned 0x970 [0062.104] GetCurrentThreadId () returned 0x970 [0062.104] GetCurrentThreadId () returned 0x970 [0062.104] GetCurrentThreadId () returned 0x970 [0062.104] GetCurrentThreadId () returned 0x970 [0062.104] GetCurrentThreadId () returned 0x970 [0062.104] GetCurrentThreadId () returned 0x970 [0062.104] GetCurrentThreadId () returned 0x970 [0062.104] GetCurrentThreadId () returned 0x970 [0062.104] GetCurrentThreadId () returned 0x970 [0062.104] GetCurrentThreadId () returned 0x970 [0062.104] GetCurrentThreadId () returned 0x970 [0062.104] GetCurrentThreadId () returned 0x970 [0062.104] GetCurrentThreadId () returned 0x970 [0062.104] GetCurrentThreadId () returned 0x970 [0062.104] GetCurrentThreadId () returned 0x970 [0062.104] GetCurrentThreadId () returned 0x970 [0062.104] GetCurrentThreadId () returned 0x970 [0062.104] GetCurrentThreadId () returned 0x970 [0062.104] GetCurrentThreadId () returned 0x970 [0062.104] GetCurrentThreadId () returned 0x970 [0062.104] GetCurrentThreadId () returned 0x970 [0062.104] GetCurrentThreadId () returned 0x970 [0062.104] GetCurrentThreadId () returned 0x970 [0062.104] GetCurrentThreadId () returned 0x970 [0062.104] GetCurrentThreadId () returned 0x970 [0062.104] GetCurrentThreadId () returned 0x970 [0062.105] GetCurrentThreadId () returned 0x970 [0062.105] GetCurrentThreadId () returned 0x970 [0062.105] GetCurrentThreadId () returned 0x970 [0062.105] GetCurrentThreadId () returned 0x970 [0062.105] GetCurrentThreadId () returned 0x970 [0062.105] GetCurrentThreadId () returned 0x970 [0062.105] GetCurrentThreadId () returned 0x970 [0062.105] GetCurrentThreadId () returned 0x970 [0062.105] GetCurrentThreadId () returned 0x970 [0062.105] GetCurrentThreadId () returned 0x970 [0062.105] GetCurrentThreadId () returned 0x970 [0062.105] GetCurrentThreadId () returned 0x970 [0062.105] GetCurrentThreadId () returned 0x970 [0062.105] GetCurrentThreadId () returned 0x970 [0062.105] GetCurrentThreadId () returned 0x970 [0062.105] GetCurrentThreadId () returned 0x970 [0062.105] GetCurrentThreadId () returned 0x970 [0062.105] GetCurrentThreadId () returned 0x970 [0062.105] GetCurrentThreadId () returned 0x970 [0062.105] GetCurrentThreadId () returned 0x970 [0062.105] GetCurrentThreadId () returned 0x970 [0062.105] GetCurrentThreadId () returned 0x970 [0062.105] GetCurrentThreadId () returned 0x970 [0062.105] GetCurrentThreadId () returned 0x970 [0062.105] GetCurrentThreadId () returned 0x970 [0062.105] GetCurrentThreadId () returned 0x970 [0062.105] GetCurrentThreadId () returned 0x970 [0062.105] GetCurrentThreadId () returned 0x970 [0062.105] GetCurrentThreadId () returned 0x970 [0062.105] GetCurrentThreadId () returned 0x970 [0062.105] GetCurrentThreadId () returned 0x970 [0062.105] GetCurrentThreadId () returned 0x970 [0062.105] GetCurrentThreadId () returned 0x970 [0062.105] GetCurrentThreadId () returned 0x970 [0062.105] GetCurrentThreadId () returned 0x970 [0062.105] GetCurrentThreadId () returned 0x970 [0062.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAAmHrU2fYJAhARu4uGes+57AS1qDq3D/CyJhybZtB0ZjiKgofzwyVNfqSXmgXq1Kw/um8rKW/SjuDg21E/8r9ERV60iDJOEjhxsnyVlpteuhPJ2+Fqirkcqk5u0BsyLLRlxerUwgtomx+To/9NzK867/FKrmF39RNcS50FftBUZXegripuYFzz5oCvPCgu4YPFYP4hIjLqP6/1mGFttDqsHIUMyL+aewuA==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0062.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAAmHrU2fYJAhARu4uGes+57AS1qDq3D/CyJhybZtB0ZjiKgofzwyVNfqSXmgXq1Kw/um8rKW/SjuDg21E/8r9ERV60iDJOEjhxsnyVlpteuhPJ2+Fqirkcqk5u0BsyLLRlxerUwgtomx+To/9NzK867/FKrmF39RNcS50FftBUZXegripuYFzz5oCvPCgu4YPFYP4hIjLqP6/1mGFttDqsHIUMyL+aewuA==", cchWideChar=245, lpMultiByteStr=0x353933c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAAmHrU2fYJAhARu4uGes+57AS1qDq3D/CyJhybZtB0ZjiKgofzwyVNfqSXmgXq1Kw/um8rKW/SjuDg21E/8r9ERV60iDJOEjhxsnyVlpteuhPJ2+Fqirkcqk5u0BsyLLRlxerUwgtomx+To/9NzK867/FKrmF39RNcS50FftBUZXegripuYFzz5oCvPCgu4YPFYP4hIjLqP6/1mGFttDqsHIUMyL+aewuA==", lpUsedDefaultChar=0x0) returned 245 [0062.105] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0062.106] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0062.106] CloseHandle (hObject=0x158) returned 1 [0062.107] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png")) returned 1 [0062.108] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=18237115302) returned 1 [0062.108] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\Файл зашифрован [PREVIEW.GIF].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\Файл зашифрован [preview.gif].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0062.110] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0062.110] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0062.110] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0062.110] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0062.110] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0062.110] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0062.110] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0062.110] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0062.110] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0062.110] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0062.110] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0062.111] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0062.111] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0062.111] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0062.111] SetEndOfFile (hFile=0x158) returned 1 [0062.111] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0062.111] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0062.111] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0062.111] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0062.111] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0062.112] WriteFile (in: hFile=0x158, lpBuffer=0x35f011c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f011c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0062.112] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6diYNsJ,>-VTyiS{\\XKi=vP,%7FFH$*7", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0062.112] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6diYNsJ,>-VTyiS{\\XKi=vP,%7FFH$*7", cchWideChar=32, lpMultiByteStr=0x2035734, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6diYNsJ,>-VTyiS{\\XKi=vP,%7FFH$*7", lpUsedDefaultChar=0x0) returned 32 [0062.112] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0062.112] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0062.112] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x639, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 0x295098 [0062.112] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0062.112] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0062.112] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif")) returned 0x20 [0062.113] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif")) returned 0x20 [0062.113] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif")) returned 0x20 [0062.113] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif")) returned 0x20 [0062.113] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x639)) returned 1 [0062.113] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0062.113] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0062.113] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif")) returned 0x20 [0062.113] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif")) returned 0x20 [0062.113] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0062.113] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0062.113] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0062.113] SetEndOfFile (hFile=0x158) returned 1 [0062.114] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0062.114] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe35cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0062.114] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0062.114] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe44ac, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0062.114] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe44ac, cbMultiByte=11, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="PREVIEW.GIFGer.gifg") returned 11 [0062.114] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0062.114] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe35cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0062.115] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0062.115] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0062.115] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x639 [0062.115] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0062.115] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0062.115] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0062.115] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0062.115] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe35cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0062.115] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0062.115] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe44ac, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0062.115] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe44ac, cbMultiByte=11, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="PREVIEW.GIFEW.GIFGer.gifg") returned 11 [0062.115] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0062.115] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe35cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0062.115] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0062.116] CharToOemA (in: pSrc="PREVIEW.GIF", pDst=0x1fe44ac | out: pDst="PREVIEW.GIF") returned 1 [0062.116] WriteFile (in: hFile=0x158, lpBuffer=0x1fe44ac*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe44ac*, lpNumberOfBytesWritten=0x18e048*=0xb, lpOverlapped=0x0) returned 1 [0062.116] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0062.116] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0062.116] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0062.117] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=18238000741) returned 1 [0062.117] ReadFile (in: hFile=0x11c, lpBuffer=0x37b81c0, nNumberOfBytesToRead=0x639, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37b81c0*, lpNumberOfBytesRead=0x18dd7c*=0x639, lpOverlapped=0x0) returned 1 [0062.118] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0062.118] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=18238146583) returned 1 [0062.127] WriteFile (in: hFile=0x158, lpBuffer=0x1fea378*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fea378*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0062.127] ReadFile (in: hFile=0x11c, lpBuffer=0x37b81c0, nNumberOfBytesToRead=0x639, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x37b81c0*, lpNumberOfBytesRead=0x18de38*=0x639, lpOverlapped=0x0) returned 1 [0062.127] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x46 [0062.127] WriteFile (in: hFile=0x158, lpBuffer=0x37b8830*, nNumberOfBytesToWrite=0x639, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x37b8830*, lpNumberOfBytesWritten=0x18de10*=0x639, lpOverlapped=0x0) returned 1 [0062.127] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x67f [0062.127] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0062.127] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0062.127] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0062.127] SetFilePointer (in: hFile=0x158, lDistanceToMove=11, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x29 [0062.127] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x689 [0062.127] CloseHandle (hObject=0x11c) returned 1 [0062.127] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x689 [0062.128] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x689 [0062.128] SetFilePointer (in: hFile=0x158, lDistanceToMove=1673, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x689 [0062.128] SetFilePointer (in: hFile=0x158, lDistanceToMove=1673, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x689 [0062.128] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x689 [0062.128] SetFilePointer (in: hFile=0x158, lDistanceToMove=1673, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x689 [0062.128] SetEndOfFile (hFile=0x158) returned 1 [0062.128] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x689 [0062.128] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x689 [0062.128] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0062.128] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe35cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0062.128] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0062.128] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe41ac, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0062.128] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe41ac, cbMultiByte=11, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="PREVIEW.GIF\x18ꞗ@涤(\x18믉`믑`") returned 11 [0062.128] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0062.128] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe35cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0062.128] WriteFile (in: hFile=0x158, lpBuffer=0x379bc78*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x379bc78*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0062.128] CharToOemA (in: pSrc="PREVIEW.GIF", pDst=0x1fe41ac | out: pDst="PREVIEW.GIF") returned 1 [0062.129] WriteFile (in: hFile=0x158, lpBuffer=0x1fe41ac*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe41ac*, lpNumberOfBytesWritten=0x18efcc*=0xb, lpOverlapped=0x0) returned 1 [0062.129] WriteFile (in: hFile=0x158, lpBuffer=0x1fea2d8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea2d8*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0062.129] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0062.129] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0062.129] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x6cd [0062.129] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x6cd [0062.129] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0062.129] WriteFile (in: hFile=0x158, lpBuffer=0x35f011c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f011c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0062.129] DeleteFileW (lpFileName="") returned 0 [0062.129] GetLastError () returned 0x3 [0062.129] GetFileAttributesW (lpFileName="") returned 0xffffffff [0062.129] SetLastError (dwErrCode=0x3) [0062.129] FlushFileBuffers (hFile=0x158) returned 1 [0062.131] GetCurrentThreadId () returned 0x970 [0062.131] GetCurrentThreadId () returned 0x970 [0062.131] GetCurrentThreadId () returned 0x970 [0062.131] GetCurrentThreadId () returned 0x970 [0062.131] GetCurrentThreadId () returned 0x970 [0062.132] GetCurrentThreadId () returned 0x970 [0062.132] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x784 [0062.132] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x784 [0062.132] SetFilePointer (in: hFile=0x158, lDistanceToMove=1924, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x784 [0062.132] CloseHandle (hObject=0x158) returned 1 [0062.133] GetCurrentThreadId () returned 0x970 [0062.133] GetCurrentThreadId () returned 0x970 [0062.133] GetCurrentThreadId () returned 0x970 [0062.133] GetCurrentThreadId () returned 0x970 [0062.133] GetCurrentThreadId () returned 0x970 [0062.133] GetCurrentThreadId () returned 0x970 [0062.133] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\Файл зашифрован [PREVIEW.GIF].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\Файл зашифрован [preview.gif].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0062.133] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x784 [0062.133] SetFilePointer (in: hFile=0x158, lDistanceToMove=1796, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x704 [0062.133] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0062.133] GetFileType (hFile=0x158) returned 0x1 [0062.133] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x9, wMilliseconds=0x19c)) [0062.133] GetCurrentThreadId () returned 0x970 [0062.133] GetCurrentThreadId () returned 0x970 [0062.133] GetCurrentThreadId () returned 0x970 [0062.134] GetCurrentThreadId () returned 0x970 [0062.134] GetCurrentThreadId () returned 0x970 [0062.134] GetCurrentThreadId () returned 0x970 [0062.134] GetCurrentThreadId () returned 0x970 [0062.134] GetCurrentThreadId () returned 0x970 [0062.134] GetCurrentThreadId () returned 0x970 [0062.134] GetCurrentThreadId () returned 0x970 [0062.134] GetCurrentThreadId () returned 0x970 [0062.134] GetCurrentThreadId () returned 0x970 [0062.134] GetCurrentThreadId () returned 0x970 [0062.134] GetCurrentThreadId () returned 0x970 [0062.134] GetCurrentThreadId () returned 0x970 [0062.134] GetCurrentThreadId () returned 0x970 [0062.134] GetCurrentThreadId () returned 0x970 [0062.134] GetCurrentThreadId () returned 0x970 [0062.134] GetCurrentThreadId () returned 0x970 [0062.134] GetCurrentThreadId () returned 0x970 [0062.134] GetCurrentThreadId () returned 0x970 [0062.134] GetCurrentThreadId () returned 0x970 [0062.134] GetCurrentThreadId () returned 0x970 [0062.134] GetCurrentThreadId () returned 0x970 [0062.134] GetCurrentThreadId () returned 0x970 [0062.134] GetCurrentThreadId () returned 0x970 [0062.134] GetCurrentThreadId () returned 0x970 [0062.134] GetCurrentThreadId () returned 0x970 [0062.134] GetCurrentThreadId () returned 0x970 [0062.134] GetCurrentThreadId () returned 0x970 [0062.134] GetCurrentThreadId () returned 0x970 [0062.134] GetCurrentThreadId () returned 0x970 [0062.134] GetCurrentThreadId () returned 0x970 [0062.134] GetCurrentThreadId () returned 0x970 [0062.134] GetCurrentThreadId () returned 0x970 [0062.134] GetCurrentThreadId () returned 0x970 [0062.134] GetCurrentThreadId () returned 0x970 [0062.134] GetCurrentThreadId () returned 0x970 [0062.134] GetCurrentThreadId () returned 0x970 [0062.134] GetCurrentThreadId () returned 0x970 [0062.134] GetCurrentThreadId () returned 0x970 [0062.134] GetCurrentThreadId () returned 0x970 [0062.134] GetCurrentThreadId () returned 0x970 [0062.134] GetCurrentThreadId () returned 0x970 [0062.134] GetCurrentThreadId () returned 0x970 [0062.134] GetCurrentThreadId () returned 0x970 [0062.134] GetCurrentThreadId () returned 0x970 [0062.134] GetCurrentThreadId () returned 0x970 [0062.135] GetCurrentThreadId () returned 0x970 [0062.135] GetCurrentThreadId () returned 0x970 [0062.135] GetCurrentThreadId () returned 0x970 [0062.135] GetCurrentThreadId () returned 0x970 [0062.135] GetCurrentThreadId () returned 0x970 [0062.135] GetCurrentThreadId () returned 0x970 [0062.135] GetCurrentThreadId () returned 0x970 [0062.135] GetCurrentThreadId () returned 0x970 [0062.135] GetCurrentThreadId () returned 0x970 [0062.135] GetCurrentThreadId () returned 0x970 [0062.135] GetCurrentThreadId () returned 0x970 [0062.135] GetCurrentThreadId () returned 0x970 [0062.135] GetCurrentThreadId () returned 0x970 [0062.135] GetCurrentThreadId () returned 0x970 [0062.135] GetCurrentThreadId () returned 0x970 [0062.135] GetCurrentThreadId () returned 0x970 [0062.135] GetCurrentThreadId () returned 0x970 [0062.135] GetCurrentThreadId () returned 0x970 [0062.135] GetCurrentThreadId () returned 0x970 [0062.135] GetCurrentThreadId () returned 0x970 [0062.135] GetCurrentThreadId () returned 0x970 [0062.135] GetCurrentThreadId () returned 0x970 [0062.135] GetCurrentThreadId () returned 0x970 [0062.135] GetCurrentThreadId () returned 0x970 [0062.135] GetCurrentThreadId () returned 0x970 [0062.135] GetCurrentThreadId () returned 0x970 [0062.135] GetCurrentThreadId () returned 0x970 [0062.135] GetCurrentThreadId () returned 0x970 [0062.135] GetCurrentThreadId () returned 0x970 [0062.135] GetCurrentThreadId () returned 0x970 [0062.135] GetCurrentThreadId () returned 0x970 [0062.135] GetCurrentThreadId () returned 0x970 [0062.135] GetCurrentThreadId () returned 0x970 [0062.135] GetCurrentThreadId () returned 0x970 [0062.135] GetCurrentThreadId () returned 0x970 [0062.135] GetCurrentThreadId () returned 0x970 [0062.135] GetCurrentThreadId () returned 0x970 [0062.135] GetCurrentThreadId () returned 0x970 [0062.135] GetCurrentThreadId () returned 0x970 [0062.135] GetCurrentThreadId () returned 0x970 [0062.135] GetCurrentThreadId () returned 0x970 [0062.135] GetCurrentThreadId () returned 0x970 [0062.135] GetCurrentThreadId () returned 0x970 [0062.135] GetCurrentThreadId () returned 0x970 [0062.135] GetCurrentThreadId () returned 0x970 [0062.135] GetCurrentThreadId () returned 0x970 [0062.136] GetCurrentThreadId () returned 0x970 [0062.136] GetCurrentThreadId () returned 0x970 [0062.136] GetCurrentThreadId () returned 0x970 [0062.136] GetCurrentThreadId () returned 0x970 [0062.136] GetCurrentThreadId () returned 0x970 [0062.136] GetCurrentThreadId () returned 0x970 [0062.136] GetCurrentThreadId () returned 0x970 [0062.136] GetCurrentThreadId () returned 0x970 [0062.136] GetCurrentThreadId () returned 0x970 [0062.136] GetCurrentThreadId () returned 0x970 [0062.136] GetCurrentThreadId () returned 0x970 [0062.136] GetCurrentThreadId () returned 0x970 [0062.136] GetCurrentThreadId () returned 0x970 [0062.136] GetCurrentThreadId () returned 0x970 [0062.136] GetCurrentThreadId () returned 0x970 [0062.136] GetCurrentThreadId () returned 0x970 [0062.136] GetCurrentThreadId () returned 0x970 [0062.136] GetCurrentThreadId () returned 0x970 [0062.136] GetCurrentThreadId () returned 0x970 [0062.136] GetCurrentThreadId () returned 0x970 [0062.136] GetCurrentThreadId () returned 0x970 [0062.136] GetCurrentThreadId () returned 0x970 [0062.136] GetCurrentThreadId () returned 0x970 [0062.136] GetCurrentThreadId () returned 0x970 [0062.136] GetCurrentThreadId () returned 0x970 [0062.136] GetCurrentThreadId () returned 0x970 [0062.136] GetCurrentThreadId () returned 0x970 [0062.136] GetCurrentThreadId () returned 0x970 [0062.136] GetCurrentThreadId () returned 0x970 [0062.136] GetCurrentThreadId () returned 0x970 [0062.136] GetCurrentThreadId () returned 0x970 [0062.136] GetCurrentThreadId () returned 0x970 [0062.136] GetCurrentThreadId () returned 0x970 [0062.136] GetCurrentThreadId () returned 0x970 [0062.136] GetCurrentThreadId () returned 0x970 [0062.136] GetCurrentThreadId () returned 0x970 [0062.136] GetCurrentThreadId () returned 0x970 [0062.136] GetCurrentThreadId () returned 0x970 [0062.136] GetCurrentThreadId () returned 0x970 [0062.136] GetCurrentThreadId () returned 0x970 [0062.136] GetCurrentThreadId () returned 0x970 [0062.136] GetCurrentThreadId () returned 0x970 [0062.136] GetCurrentThreadId () returned 0x970 [0062.136] GetCurrentThreadId () returned 0x970 [0062.136] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.136] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.137] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff0230, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.137] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.137] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.137] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff0230, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.137] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.137] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.137] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.137] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.137] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.137] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.137] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.137] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.137] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff0290, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.137] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.137] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.137] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff0290, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.137] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.137] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.137] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff0290, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.137] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x9, wMilliseconds=0x19c)) [0062.137] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="6diYNsJ,>-VTyiS{\\XKi=vP,%7FFH$*7", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0062.137] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="6diYNsJ,>-VTyiS{\\XKi=vP,%7FFH$*7", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0062.137] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="6diYNsJ,>-VTyiS{\\XKi=vP,%7FFH$*7", cchWideChar=32, lpMultiByteStr=0x20024e8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6diYNsJ,>-VTyiS{\\XKi=vP,%7FFH$*7", lpUsedDefaultChar=0x0) returned 32 [0062.137] GetCurrentThreadId () returned 0x970 [0062.137] GetCurrentThreadId () returned 0x970 [0062.137] GetCurrentThreadId () returned 0x970 [0062.137] GetCurrentThreadId () returned 0x970 [0062.137] GetCurrentThreadId () returned 0x970 [0062.137] GetCurrentThreadId () returned 0x970 [0062.145] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0062.145] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0062.145] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3794928, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0062.145] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0062.145] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAGGJVTqyLu/GeP+ERnVTgTO+/inPZkIw7H6dJ5n7u+k40UGFib/q9fRNbXoiQJJIYK9V1REu5JhcD785tnIBYdOcAnx6AdqJCVabHJcivnDHzh71T3baWUvaa/5rBMtGUx4jO8pnrg4yZzBxmXwdhuZAVNfJh+3Wutlwq2D92eGlkZFziC6k+XuUuWlzUUq3tZ1TlDNlDT7i+h8rAN2au21jterLe3AQhA==") returned 232 [0062.145] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x9, wMilliseconds=0x19c)) [0062.145] GetCurrentThreadId () returned 0x970 [0062.145] GetCurrentThreadId () returned 0x970 [0062.145] GetCurrentThreadId () returned 0x970 [0062.145] GetCurrentThreadId () returned 0x970 [0062.145] GetCurrentThreadId () returned 0x970 [0062.145] GetCurrentThreadId () returned 0x970 [0062.145] GetCurrentThreadId () returned 0x970 [0062.145] GetCurrentThreadId () returned 0x970 [0062.145] GetCurrentThreadId () returned 0x970 [0062.145] GetCurrentThreadId () returned 0x970 [0062.145] GetCurrentThreadId () returned 0x970 [0062.145] GetCurrentThreadId () returned 0x970 [0062.145] GetCurrentThreadId () returned 0x970 [0062.145] GetCurrentThreadId () returned 0x970 [0062.145] GetCurrentThreadId () returned 0x970 [0062.145] GetCurrentThreadId () returned 0x970 [0062.145] GetCurrentThreadId () returned 0x970 [0062.145] GetCurrentThreadId () returned 0x970 [0062.145] GetCurrentThreadId () returned 0x970 [0062.145] GetCurrentThreadId () returned 0x970 [0062.145] GetCurrentThreadId () returned 0x970 [0062.145] GetCurrentThreadId () returned 0x970 [0062.145] GetCurrentThreadId () returned 0x970 [0062.145] GetCurrentThreadId () returned 0x970 [0062.145] GetCurrentThreadId () returned 0x970 [0062.146] GetCurrentThreadId () returned 0x970 [0062.146] GetCurrentThreadId () returned 0x970 [0062.146] GetCurrentThreadId () returned 0x970 [0062.146] GetCurrentThreadId () returned 0x970 [0062.146] GetCurrentThreadId () returned 0x970 [0062.146] GetCurrentThreadId () returned 0x970 [0062.146] GetCurrentThreadId () returned 0x970 [0062.146] GetCurrentThreadId () returned 0x970 [0062.146] GetCurrentThreadId () returned 0x970 [0062.146] GetCurrentThreadId () returned 0x970 [0062.146] GetCurrentThreadId () returned 0x970 [0062.146] GetCurrentThreadId () returned 0x970 [0062.146] GetCurrentThreadId () returned 0x970 [0062.146] GetCurrentThreadId () returned 0x970 [0062.146] GetCurrentThreadId () returned 0x970 [0062.146] GetCurrentThreadId () returned 0x970 [0062.146] GetCurrentThreadId () returned 0x970 [0062.146] GetCurrentThreadId () returned 0x970 [0062.146] GetCurrentThreadId () returned 0x970 [0062.146] GetCurrentThreadId () returned 0x970 [0062.146] GetCurrentThreadId () returned 0x970 [0062.146] GetCurrentThreadId () returned 0x970 [0062.146] GetCurrentThreadId () returned 0x970 [0062.146] GetCurrentThreadId () returned 0x970 [0062.146] GetCurrentThreadId () returned 0x970 [0062.146] GetCurrentThreadId () returned 0x970 [0062.146] GetCurrentThreadId () returned 0x970 [0062.146] GetCurrentThreadId () returned 0x970 [0062.146] GetCurrentThreadId () returned 0x970 [0062.146] GetCurrentThreadId () returned 0x970 [0062.146] GetCurrentThreadId () returned 0x970 [0062.146] GetCurrentThreadId () returned 0x970 [0062.146] GetCurrentThreadId () returned 0x970 [0062.146] GetCurrentThreadId () returned 0x970 [0062.146] GetCurrentThreadId () returned 0x970 [0062.146] GetCurrentThreadId () returned 0x970 [0062.146] GetCurrentThreadId () returned 0x970 [0062.146] GetCurrentThreadId () returned 0x970 [0062.146] GetCurrentThreadId () returned 0x970 [0062.146] GetCurrentThreadId () returned 0x970 [0062.146] GetCurrentThreadId () returned 0x970 [0062.146] GetCurrentThreadId () returned 0x970 [0062.146] GetCurrentThreadId () returned 0x970 [0062.146] GetCurrentThreadId () returned 0x970 [0062.146] GetCurrentThreadId () returned 0x970 [0062.147] GetCurrentThreadId () returned 0x970 [0062.147] GetCurrentThreadId () returned 0x970 [0062.147] GetCurrentThreadId () returned 0x970 [0062.147] GetCurrentThreadId () returned 0x970 [0062.147] GetCurrentThreadId () returned 0x970 [0062.147] GetCurrentThreadId () returned 0x970 [0062.147] GetCurrentThreadId () returned 0x970 [0062.147] GetCurrentThreadId () returned 0x970 [0062.147] GetCurrentThreadId () returned 0x970 [0062.147] GetCurrentThreadId () returned 0x970 [0062.147] GetCurrentThreadId () returned 0x970 [0062.147] GetCurrentThreadId () returned 0x970 [0062.147] GetCurrentThreadId () returned 0x970 [0062.147] GetCurrentThreadId () returned 0x970 [0062.147] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAGGJVTqyLu/GeP+ERnVTgTO+/inPZkIw7H6dJ5n7u+k40UGFib/q9fRNbXoiQJJIYK9V1REu5JhcD785tnIBYdOcAnx6AdqJCVabHJcivnDHzh71T3baWUvaa/5rBMtGUx4jO8pnrg4yZzBxmXwdhuZAVNfJh+3Wutlwq2D92eGlkZFziC6k+XuUuWlzUUq3tZ1TlDNlDT7i+h8rAN2au21jterLe3AQhA==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0062.147] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAGGJVTqyLu/GeP+ERnVTgTO+/inPZkIw7H6dJ5n7u+k40UGFib/q9fRNbXoiQJJIYK9V1REu5JhcD785tnIBYdOcAnx6AdqJCVabHJcivnDHzh71T3baWUvaa/5rBMtGUx4jO8pnrg4yZzBxmXwdhuZAVNfJh+3Wutlwq2D92eGlkZFziC6k+XuUuWlzUUq3tZ1TlDNlDT7i+h8rAN2au21jterLe3AQhA==", cchWideChar=245, lpMultiByteStr=0x353933c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAGGJVTqyLu/GeP+ERnVTgTO+/inPZkIw7H6dJ5n7u+k40UGFib/q9fRNbXoiQJJIYK9V1REu5JhcD785tnIBYdOcAnx6AdqJCVabHJcivnDHzh71T3baWUvaa/5rBMtGUx4jO8pnrg4yZzBxmXwdhuZAVNfJh+3Wutlwq2D92eGlkZFziC6k+XuUuWlzUUq3tZ1TlDNlDT7i+h8rAN2au21jterLe3AQhA==", lpUsedDefaultChar=0x0) returned 245 [0062.147] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0062.147] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0062.147] CloseHandle (hObject=0x158) returned 1 [0062.148] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif")) returned 1 [0062.149] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=18241243057) returned 1 [0062.149] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\Файл зашифрован [THMBNAIL.PNG].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\Файл зашифрован [thmbnail.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0062.149] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0062.150] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0062.150] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0062.150] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0062.150] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0062.150] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0062.150] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0062.150] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0062.150] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0062.150] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0062.150] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0062.150] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0062.150] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0062.150] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0062.150] SetEndOfFile (hFile=0x158) returned 1 [0062.150] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0062.150] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0062.150] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0062.151] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0062.151] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0062.151] WriteFile (in: hFile=0x158, lpBuffer=0x35f01dc*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f01dc*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0062.152] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="JS$M#a-M,)U\\!J\"dfC\\@B^.R/Ad$or@9", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0062.152] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="JS$M#a-M,)U\\!J\"dfC\\@B^.R/Ad$or@9", cchWideChar=32, lpMultiByteStr=0x203576c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="JS$M#a-M,)U\\!J\"dfC\\@B^.R/Ad$or@9", lpUsedDefaultChar=0x0) returned 32 [0062.152] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0062.152] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0062.152] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x54f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0x295098 [0062.152] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0062.152] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0062.152] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png")) returned 0x20 [0062.153] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png")) returned 0x20 [0062.153] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png")) returned 0x20 [0062.153] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png")) returned 0x20 [0062.153] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x54f1)) returned 1 [0062.153] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0062.153] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0062.153] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png")) returned 0x20 [0062.153] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png")) returned 0x20 [0062.153] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0062.153] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0062.153] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0062.153] SetEndOfFile (hFile=0x158) returned 1 [0062.154] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0062.154] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe36ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0062.154] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0062.154] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe42ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0062.154] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe42ec, cbMultiByte=12, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="THMBNAIL.PNGer.gifg") returned 12 [0062.154] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0062.154] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe36ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0062.155] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0062.155] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0062.155] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x54f1 [0062.155] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0062.155] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0062.155] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0062.155] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0062.155] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe36ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0062.155] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0062.155] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe42ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0062.155] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe42ec, cbMultiByte=12, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="THMBNAIL.PNGIL.PNGer.gifg") returned 12 [0062.155] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0062.155] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe36ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0062.155] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0062.156] CharToOemA (in: pSrc="THMBNAIL.PNG", pDst=0x1fe42ec | out: pDst="THMBNAIL.PNG") returned 1 [0062.156] WriteFile (in: hFile=0x158, lpBuffer=0x1fe42ec*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe42ec*, lpNumberOfBytesWritten=0x18e048*=0xc, lpOverlapped=0x0) returned 1 [0062.156] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0062.156] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0062.156] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0062.157] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=18242001190) returned 1 [0062.157] ReadFile (in: hFile=0x11c, lpBuffer=0x37b81a0, nNumberOfBytesToRead=0x54f1, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37b81a0*, lpNumberOfBytesRead=0x18dd7c*=0x54f1, lpOverlapped=0x0) returned 1 [0062.158] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0062.158] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=18242162259) returned 1 [0062.167] WriteFile (in: hFile=0x158, lpBuffer=0x1fea258*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fea258*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0062.167] ReadFile (in: hFile=0x11c, lpBuffer=0x37b81a0, nNumberOfBytesToRead=0x54f1, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x37b81a0*, lpNumberOfBytesRead=0x18de38*=0x54f1, lpOverlapped=0x0) returned 1 [0062.168] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x47 [0062.168] WriteFile (in: hFile=0x158, lpBuffer=0x37feec0*, nNumberOfBytesToWrite=0x54f1, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x37feec0*, lpNumberOfBytesWritten=0x18de10*=0x54f1, lpOverlapped=0x0) returned 1 [0062.168] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x5538 [0062.168] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0062.168] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0062.168] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0062.169] SetFilePointer (in: hFile=0x158, lDistanceToMove=12, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2a [0062.169] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x5542 [0062.169] CloseHandle (hObject=0x11c) returned 1 [0062.169] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x5542 [0062.169] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x5542 [0062.169] SetFilePointer (in: hFile=0x158, lDistanceToMove=21826, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x5542 [0062.169] SetFilePointer (in: hFile=0x158, lDistanceToMove=21826, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x5542 [0062.169] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x5542 [0062.169] SetFilePointer (in: hFile=0x158, lDistanceToMove=21826, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x5542 [0062.169] SetEndOfFile (hFile=0x158) returned 1 [0062.169] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x5542 [0062.169] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x5542 [0062.169] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0062.169] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe36ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0062.170] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0062.170] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe37ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0062.170] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe37ec, cbMultiByte=12, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="THMBNAIL.PNGꞗ@涤(\x18믉`믑`") returned 12 [0062.170] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0062.170] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe36ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0062.170] WriteFile (in: hFile=0x158, lpBuffer=0x379bc78*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x379bc78*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0062.170] CharToOemA (in: pSrc="THMBNAIL.PNG", pDst=0x1fe37ec | out: pDst="THMBNAIL.PNG") returned 1 [0062.170] WriteFile (in: hFile=0x158, lpBuffer=0x1fe37ec*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe37ec*, lpNumberOfBytesWritten=0x18efcc*=0xc, lpOverlapped=0x0) returned 1 [0062.170] WriteFile (in: hFile=0x158, lpBuffer=0x1fea170*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea170*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0062.170] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0062.170] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0062.170] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x5587 [0062.170] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x5587 [0062.170] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0062.170] WriteFile (in: hFile=0x158, lpBuffer=0x35f01dc*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f01dc*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0062.170] DeleteFileW (lpFileName="") returned 0 [0062.171] GetLastError () returned 0x3 [0062.171] GetFileAttributesW (lpFileName="") returned 0xffffffff [0062.171] SetLastError (dwErrCode=0x3) [0062.171] FlushFileBuffers (hFile=0x158) returned 1 [0062.174] GetCurrentThreadId () returned 0x970 [0062.174] GetCurrentThreadId () returned 0x970 [0062.174] GetCurrentThreadId () returned 0x970 [0062.174] GetCurrentThreadId () returned 0x970 [0062.174] GetCurrentThreadId () returned 0x970 [0062.174] GetCurrentThreadId () returned 0x970 [0062.174] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x563e [0062.174] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x563e [0062.174] SetFilePointer (in: hFile=0x158, lDistanceToMove=22078, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x563e [0062.174] CloseHandle (hObject=0x158) returned 1 [0062.176] GetCurrentThreadId () returned 0x970 [0062.176] GetCurrentThreadId () returned 0x970 [0062.176] GetCurrentThreadId () returned 0x970 [0062.176] GetCurrentThreadId () returned 0x970 [0062.176] GetCurrentThreadId () returned 0x970 [0062.176] GetCurrentThreadId () returned 0x970 [0062.176] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\Файл зашифрован [THMBNAIL.PNG].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\Файл зашифрован [thmbnail.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0062.176] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x563e [0062.176] SetFilePointer (in: hFile=0x158, lDistanceToMove=21950, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x55be [0062.176] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0062.176] GetFileType (hFile=0x158) returned 0x1 [0062.176] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x9, wMilliseconds=0x1bb)) [0062.176] GetCurrentThreadId () returned 0x970 [0062.176] GetCurrentThreadId () returned 0x970 [0062.176] GetCurrentThreadId () returned 0x970 [0062.176] GetCurrentThreadId () returned 0x970 [0062.176] GetCurrentThreadId () returned 0x970 [0062.176] GetCurrentThreadId () returned 0x970 [0062.176] GetCurrentThreadId () returned 0x970 [0062.176] GetCurrentThreadId () returned 0x970 [0062.176] GetCurrentThreadId () returned 0x970 [0062.176] GetCurrentThreadId () returned 0x970 [0062.176] GetCurrentThreadId () returned 0x970 [0062.176] GetCurrentThreadId () returned 0x970 [0062.176] GetCurrentThreadId () returned 0x970 [0062.176] GetCurrentThreadId () returned 0x970 [0062.176] GetCurrentThreadId () returned 0x970 [0062.176] GetCurrentThreadId () returned 0x970 [0062.176] GetCurrentThreadId () returned 0x970 [0062.176] GetCurrentThreadId () returned 0x970 [0062.176] GetCurrentThreadId () returned 0x970 [0062.177] GetCurrentThreadId () returned 0x970 [0062.177] GetCurrentThreadId () returned 0x970 [0062.177] GetCurrentThreadId () returned 0x970 [0062.177] GetCurrentThreadId () returned 0x970 [0062.177] GetCurrentThreadId () returned 0x970 [0062.177] GetCurrentThreadId () returned 0x970 [0062.177] GetCurrentThreadId () returned 0x970 [0062.177] GetCurrentThreadId () returned 0x970 [0062.177] GetCurrentThreadId () returned 0x970 [0062.177] GetCurrentThreadId () returned 0x970 [0062.177] GetCurrentThreadId () returned 0x970 [0062.177] GetCurrentThreadId () returned 0x970 [0062.177] GetCurrentThreadId () returned 0x970 [0062.177] GetCurrentThreadId () returned 0x970 [0062.177] GetCurrentThreadId () returned 0x970 [0062.177] GetCurrentThreadId () returned 0x970 [0062.177] GetCurrentThreadId () returned 0x970 [0062.177] GetCurrentThreadId () returned 0x970 [0062.177] GetCurrentThreadId () returned 0x970 [0062.177] GetCurrentThreadId () returned 0x970 [0062.177] GetCurrentThreadId () returned 0x970 [0062.177] GetCurrentThreadId () returned 0x970 [0062.177] GetCurrentThreadId () returned 0x970 [0062.177] GetCurrentThreadId () returned 0x970 [0062.177] GetCurrentThreadId () returned 0x970 [0062.177] GetCurrentThreadId () returned 0x970 [0062.177] GetCurrentThreadId () returned 0x970 [0062.177] GetCurrentThreadId () returned 0x970 [0062.177] GetCurrentThreadId () returned 0x970 [0062.177] GetCurrentThreadId () returned 0x970 [0062.177] GetCurrentThreadId () returned 0x970 [0062.177] GetCurrentThreadId () returned 0x970 [0062.177] GetCurrentThreadId () returned 0x970 [0062.177] GetCurrentThreadId () returned 0x970 [0062.177] GetCurrentThreadId () returned 0x970 [0062.177] GetCurrentThreadId () returned 0x970 [0062.177] GetCurrentThreadId () returned 0x970 [0062.177] GetCurrentThreadId () returned 0x970 [0062.177] GetCurrentThreadId () returned 0x970 [0062.177] GetCurrentThreadId () returned 0x970 [0062.177] GetCurrentThreadId () returned 0x970 [0062.177] GetCurrentThreadId () returned 0x970 [0062.177] GetCurrentThreadId () returned 0x970 [0062.177] GetCurrentThreadId () returned 0x970 [0062.178] GetCurrentThreadId () returned 0x970 [0062.178] GetCurrentThreadId () returned 0x970 [0062.178] GetCurrentThreadId () returned 0x970 [0062.178] GetCurrentThreadId () returned 0x970 [0062.178] GetCurrentThreadId () returned 0x970 [0062.178] GetCurrentThreadId () returned 0x970 [0062.178] GetCurrentThreadId () returned 0x970 [0062.178] GetCurrentThreadId () returned 0x970 [0062.178] GetCurrentThreadId () returned 0x970 [0062.178] GetCurrentThreadId () returned 0x970 [0062.178] GetCurrentThreadId () returned 0x970 [0062.178] GetCurrentThreadId () returned 0x970 [0062.178] GetCurrentThreadId () returned 0x970 [0062.178] GetCurrentThreadId () returned 0x970 [0062.178] GetCurrentThreadId () returned 0x970 [0062.178] GetCurrentThreadId () returned 0x970 [0062.178] GetCurrentThreadId () returned 0x970 [0062.178] GetCurrentThreadId () returned 0x970 [0062.178] GetCurrentThreadId () returned 0x970 [0062.178] GetCurrentThreadId () returned 0x970 [0062.178] GetCurrentThreadId () returned 0x970 [0062.178] GetCurrentThreadId () returned 0x970 [0062.178] GetCurrentThreadId () returned 0x970 [0062.178] GetCurrentThreadId () returned 0x970 [0062.178] GetCurrentThreadId () returned 0x970 [0062.178] GetCurrentThreadId () returned 0x970 [0062.178] GetCurrentThreadId () returned 0x970 [0062.178] GetCurrentThreadId () returned 0x970 [0062.178] GetCurrentThreadId () returned 0x970 [0062.178] GetCurrentThreadId () returned 0x970 [0062.178] GetCurrentThreadId () returned 0x970 [0062.178] GetCurrentThreadId () returned 0x970 [0062.178] GetCurrentThreadId () returned 0x970 [0062.178] GetCurrentThreadId () returned 0x970 [0062.178] GetCurrentThreadId () returned 0x970 [0062.178] GetCurrentThreadId () returned 0x970 [0062.178] GetCurrentThreadId () returned 0x970 [0062.178] GetCurrentThreadId () returned 0x970 [0062.178] GetCurrentThreadId () returned 0x970 [0062.178] GetCurrentThreadId () returned 0x970 [0062.178] GetCurrentThreadId () returned 0x970 [0062.178] GetCurrentThreadId () returned 0x970 [0062.178] GetCurrentThreadId () returned 0x970 [0062.178] GetCurrentThreadId () returned 0x970 [0062.179] GetCurrentThreadId () returned 0x970 [0062.179] GetCurrentThreadId () returned 0x970 [0062.179] GetCurrentThreadId () returned 0x970 [0062.179] GetCurrentThreadId () returned 0x970 [0062.179] GetCurrentThreadId () returned 0x970 [0062.179] GetCurrentThreadId () returned 0x970 [0062.179] GetCurrentThreadId () returned 0x970 [0062.179] GetCurrentThreadId () returned 0x970 [0062.179] GetCurrentThreadId () returned 0x970 [0062.179] GetCurrentThreadId () returned 0x970 [0062.179] GetCurrentThreadId () returned 0x970 [0062.179] GetCurrentThreadId () returned 0x970 [0062.179] GetCurrentThreadId () returned 0x970 [0062.179] GetCurrentThreadId () returned 0x970 [0062.179] GetCurrentThreadId () returned 0x970 [0062.179] GetCurrentThreadId () returned 0x970 [0062.179] GetCurrentThreadId () returned 0x970 [0062.179] GetCurrentThreadId () returned 0x970 [0062.179] GetCurrentThreadId () returned 0x970 [0062.179] GetCurrentThreadId () returned 0x970 [0062.179] GetCurrentThreadId () returned 0x970 [0062.179] GetCurrentThreadId () returned 0x970 [0062.179] GetCurrentThreadId () returned 0x970 [0062.179] GetCurrentThreadId () returned 0x970 [0062.179] GetCurrentThreadId () returned 0x970 [0062.179] GetCurrentThreadId () returned 0x970 [0062.179] GetCurrentThreadId () returned 0x970 [0062.179] GetCurrentThreadId () returned 0x970 [0062.179] GetCurrentThreadId () returned 0x970 [0062.179] GetCurrentThreadId () returned 0x970 [0062.179] GetCurrentThreadId () returned 0x970 [0062.179] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.179] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.179] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff0290, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.179] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.179] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.179] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff0290, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.179] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.179] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.179] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.180] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.180] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.180] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.180] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.180] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.180] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff02f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.180] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.180] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.180] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff02f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.180] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.180] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.180] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff02f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.180] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x9, wMilliseconds=0x1cb)) [0062.180] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JS$M#a-M,)U\\!J\"dfC\\@B^.R/Ad$or@9", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0062.180] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JS$M#a-M,)U\\!J\"dfC\\@B^.R/Ad$or@9", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0062.180] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JS$M#a-M,)U\\!J\"dfC\\@B^.R/Ad$or@9", cchWideChar=32, lpMultiByteStr=0x2002f98, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="JS$M#a-M,)U\\!J\"dfC\\@B^.R/Ad$or@9", lpUsedDefaultChar=0x0) returned 32 [0062.180] GetCurrentThreadId () returned 0x970 [0062.180] GetCurrentThreadId () returned 0x970 [0062.180] GetCurrentThreadId () returned 0x970 [0062.180] GetCurrentThreadId () returned 0x970 [0062.180] GetCurrentThreadId () returned 0x970 [0062.180] GetCurrentThreadId () returned 0x970 [0062.188] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0062.188] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0062.188] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3794a18, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0062.188] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0062.188] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAHrhL3pcs8defU0oacdoRmyOW/+rbU2NO53UnPoNVn0dS7bFXbSFCM01N396gEmAYXK4GRmewKp7G99qcNDkuKatBK0pN16nl+YHyqhp8Pr9CPIwyPe7tDEjrm4pxsvcHn1F4vrSXKs6CvxzOgLzwF4pKVrgIPcnUqWv2mBRUl813QCr+YlF1aj9TaZqnwJL3hdjPHdtGX3ZOj5GClMgek/041mD51RxcA==") returned 232 [0062.188] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x9, wMilliseconds=0x1cb)) [0062.188] GetCurrentThreadId () returned 0x970 [0062.188] GetCurrentThreadId () returned 0x970 [0062.188] GetCurrentThreadId () returned 0x970 [0062.188] GetCurrentThreadId () returned 0x970 [0062.188] GetCurrentThreadId () returned 0x970 [0062.188] GetCurrentThreadId () returned 0x970 [0062.188] GetCurrentThreadId () returned 0x970 [0062.188] GetCurrentThreadId () returned 0x970 [0062.188] GetCurrentThreadId () returned 0x970 [0062.188] GetCurrentThreadId () returned 0x970 [0062.188] GetCurrentThreadId () returned 0x970 [0062.188] GetCurrentThreadId () returned 0x970 [0062.188] GetCurrentThreadId () returned 0x970 [0062.188] GetCurrentThreadId () returned 0x970 [0062.188] GetCurrentThreadId () returned 0x970 [0062.188] GetCurrentThreadId () returned 0x970 [0062.188] GetCurrentThreadId () returned 0x970 [0062.188] GetCurrentThreadId () returned 0x970 [0062.188] GetCurrentThreadId () returned 0x970 [0062.188] GetCurrentThreadId () returned 0x970 [0062.188] GetCurrentThreadId () returned 0x970 [0062.188] GetCurrentThreadId () returned 0x970 [0062.188] GetCurrentThreadId () returned 0x970 [0062.188] GetCurrentThreadId () returned 0x970 [0062.188] GetCurrentThreadId () returned 0x970 [0062.188] GetCurrentThreadId () returned 0x970 [0062.188] GetCurrentThreadId () returned 0x970 [0062.188] GetCurrentThreadId () returned 0x970 [0062.188] GetCurrentThreadId () returned 0x970 [0062.188] GetCurrentThreadId () returned 0x970 [0062.188] GetCurrentThreadId () returned 0x970 [0062.188] GetCurrentThreadId () returned 0x970 [0062.188] GetCurrentThreadId () returned 0x970 [0062.188] GetCurrentThreadId () returned 0x970 [0062.188] GetCurrentThreadId () returned 0x970 [0062.188] GetCurrentThreadId () returned 0x970 [0062.189] GetCurrentThreadId () returned 0x970 [0062.189] GetCurrentThreadId () returned 0x970 [0062.189] GetCurrentThreadId () returned 0x970 [0062.189] GetCurrentThreadId () returned 0x970 [0062.189] GetCurrentThreadId () returned 0x970 [0062.189] GetCurrentThreadId () returned 0x970 [0062.189] GetCurrentThreadId () returned 0x970 [0062.189] GetCurrentThreadId () returned 0x970 [0062.189] GetCurrentThreadId () returned 0x970 [0062.189] GetCurrentThreadId () returned 0x970 [0062.189] GetCurrentThreadId () returned 0x970 [0062.189] GetCurrentThreadId () returned 0x970 [0062.189] GetCurrentThreadId () returned 0x970 [0062.189] GetCurrentThreadId () returned 0x970 [0062.189] GetCurrentThreadId () returned 0x970 [0062.189] GetCurrentThreadId () returned 0x970 [0062.189] GetCurrentThreadId () returned 0x970 [0062.189] GetCurrentThreadId () returned 0x970 [0062.189] GetCurrentThreadId () returned 0x970 [0062.189] GetCurrentThreadId () returned 0x970 [0062.189] GetCurrentThreadId () returned 0x970 [0062.189] GetCurrentThreadId () returned 0x970 [0062.189] GetCurrentThreadId () returned 0x970 [0062.189] GetCurrentThreadId () returned 0x970 [0062.189] GetCurrentThreadId () returned 0x970 [0062.189] GetCurrentThreadId () returned 0x970 [0062.189] GetCurrentThreadId () returned 0x970 [0062.189] GetCurrentThreadId () returned 0x970 [0062.189] GetCurrentThreadId () returned 0x970 [0062.189] GetCurrentThreadId () returned 0x970 [0062.189] GetCurrentThreadId () returned 0x970 [0062.189] GetCurrentThreadId () returned 0x970 [0062.189] GetCurrentThreadId () returned 0x970 [0062.189] GetCurrentThreadId () returned 0x970 [0062.189] GetCurrentThreadId () returned 0x970 [0062.189] GetCurrentThreadId () returned 0x970 [0062.189] GetCurrentThreadId () returned 0x970 [0062.189] GetCurrentThreadId () returned 0x970 [0062.189] GetCurrentThreadId () returned 0x970 [0062.189] GetCurrentThreadId () returned 0x970 [0062.189] GetCurrentThreadId () returned 0x970 [0062.189] GetCurrentThreadId () returned 0x970 [0062.189] GetCurrentThreadId () returned 0x970 [0062.189] GetCurrentThreadId () returned 0x970 [0062.190] GetCurrentThreadId () returned 0x970 [0062.190] GetCurrentThreadId () returned 0x970 [0062.190] GetCurrentThreadId () returned 0x970 [0062.190] GetCurrentThreadId () returned 0x970 [0062.190] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAHrhL3pcs8defU0oacdoRmyOW/+rbU2NO53UnPoNVn0dS7bFXbSFCM01N396gEmAYXK4GRmewKp7G99qcNDkuKatBK0pN16nl+YHyqhp8Pr9CPIwyPe7tDEjrm4pxsvcHn1F4vrSXKs6CvxzOgLzwF4pKVrgIPcnUqWv2mBRUl813QCr+YlF1aj9TaZqnwJL3hdjPHdtGX3ZOj5GClMgek/041mD51RxcA==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0062.190] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAHrhL3pcs8defU0oacdoRmyOW/+rbU2NO53UnPoNVn0dS7bFXbSFCM01N396gEmAYXK4GRmewKp7G99qcNDkuKatBK0pN16nl+YHyqhp8Pr9CPIwyPe7tDEjrm4pxsvcHn1F4vrSXKs6CvxzOgLzwF4pKVrgIPcnUqWv2mBRUl813QCr+YlF1aj9TaZqnwJL3hdjPHdtGX3ZOj5GClMgek/041mD51RxcA==", cchWideChar=245, lpMultiByteStr=0x353933c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAHrhL3pcs8defU0oacdoRmyOW/+rbU2NO53UnPoNVn0dS7bFXbSFCM01N396gEmAYXK4GRmewKp7G99qcNDkuKatBK0pN16nl+YHyqhp8Pr9CPIwyPe7tDEjrm4pxsvcHn1F4vrSXKs6CvxzOgLzwF4pKVrgIPcnUqWv2mBRUl813QCr+YlF1aj9TaZqnwJL3hdjPHdtGX3ZOj5GClMgek/041mD51RxcA==", lpUsedDefaultChar=0x0) returned 245 [0062.190] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0062.190] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0062.190] CloseHandle (hObject=0x158) returned 1 [0062.191] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png")) returned 1 [0062.192] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=18245526439) returned 1 [0062.192] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\Файл зашифрован [PREVIEW.GIF].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\Файл зашифрован [preview.gif].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0062.194] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0062.194] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0062.194] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0062.194] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0062.194] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0062.194] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0062.194] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0062.194] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0062.194] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0062.194] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0062.194] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0062.194] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0062.194] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0062.194] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0062.194] SetEndOfFile (hFile=0x158) returned 1 [0062.195] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0062.195] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0062.195] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0062.195] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0062.195] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0062.196] WriteFile (in: hFile=0x158, lpBuffer=0x35f011c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f011c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0062.196] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Ri+qcs0p\"pCfRC-\\oj8{&8A8FF\\Yy%@E", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0062.196] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Ri+qcs0p\"pCfRC-\\oj8{&8A8FF\\Yy%@E", cchWideChar=32, lpMultiByteStr=0x20357a4, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Ri+qcs0p\"pCfRC-\\oj8{&8A8FF\\Yy%@E", lpUsedDefaultChar=0x0) returned 32 [0062.196] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0062.196] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0062.196] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x53b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 0x295098 [0062.196] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0062.196] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0062.196] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif")) returned 0x20 [0062.197] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif")) returned 0x20 [0062.197] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif")) returned 0x20 [0062.197] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif")) returned 0x20 [0062.197] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x53b)) returned 1 [0062.197] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0062.197] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0062.197] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif")) returned 0x20 [0062.197] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif")) returned 0x20 [0062.197] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0062.197] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0062.197] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0062.197] SetEndOfFile (hFile=0x158) returned 1 [0062.198] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0062.198] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe410c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0062.198] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0062.198] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe354c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0062.198] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe354c, cbMultiByte=11, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="PREVIEW.GIFGer.gifg") returned 11 [0062.198] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0062.198] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe410c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0062.198] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0062.199] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0062.199] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x53b [0062.199] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0062.199] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0062.199] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0062.199] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0062.199] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe410c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0062.199] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0062.199] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe354c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0062.199] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe354c, cbMultiByte=11, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="PREVIEW.GIFEW.GIFGer.gifg") returned 11 [0062.199] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0062.199] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe410c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0062.199] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0062.200] CharToOemA (in: pSrc="PREVIEW.GIF", pDst=0x1fe354c | out: pDst="PREVIEW.GIF") returned 1 [0062.200] WriteFile (in: hFile=0x158, lpBuffer=0x1fe354c*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe354c*, lpNumberOfBytesWritten=0x18e048*=0xb, lpOverlapped=0x0) returned 1 [0062.200] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0062.200] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0062.200] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0062.200] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=18246386940) returned 1 [0062.200] ReadFile (in: hFile=0x11c, lpBuffer=0x37b81c0, nNumberOfBytesToRead=0x53b, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37b81c0*, lpNumberOfBytesRead=0x18dd7c*=0x53b, lpOverlapped=0x0) returned 1 [0062.202] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0062.202] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=18246552960) returned 1 [0062.211] WriteFile (in: hFile=0x158, lpBuffer=0x1fea1c8*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fea1c8*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0062.211] ReadFile (in: hFile=0x11c, lpBuffer=0x37b81c0, nNumberOfBytesToRead=0x53b, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x37b81c0*, lpNumberOfBytesRead=0x18de38*=0x53b, lpOverlapped=0x0) returned 1 [0062.211] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x46 [0062.211] WriteFile (in: hFile=0x158, lpBuffer=0x37b8720*, nNumberOfBytesToWrite=0x53b, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x37b8720*, lpNumberOfBytesWritten=0x18de10*=0x53b, lpOverlapped=0x0) returned 1 [0062.211] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x581 [0062.211] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0062.211] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0062.211] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0062.211] SetFilePointer (in: hFile=0x158, lDistanceToMove=11, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x29 [0062.211] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x58b [0062.211] CloseHandle (hObject=0x11c) returned 1 [0062.212] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x58b [0062.212] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x58b [0062.212] SetFilePointer (in: hFile=0x158, lDistanceToMove=1419, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x58b [0062.212] SetFilePointer (in: hFile=0x158, lDistanceToMove=1419, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x58b [0062.212] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x58b [0062.212] SetFilePointer (in: hFile=0x158, lDistanceToMove=1419, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x58b [0062.212] SetEndOfFile (hFile=0x158) returned 1 [0062.212] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x58b [0062.212] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x58b [0062.212] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0062.212] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe410c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0062.212] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0062.212] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe41ac, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0062.212] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe41ac, cbMultiByte=11, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="PREVIEW.GIF\x18ꞗ@涤(\x18믉`믑`") returned 11 [0062.212] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0062.212] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe410c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0062.213] WriteFile (in: hFile=0x158, lpBuffer=0x379bc78*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x379bc78*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0062.213] CharToOemA (in: pSrc="PREVIEW.GIF", pDst=0x1fe41ac | out: pDst="PREVIEW.GIF") returned 1 [0062.213] WriteFile (in: hFile=0x158, lpBuffer=0x1fe41ac*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe41ac*, lpNumberOfBytesWritten=0x18efcc*=0xb, lpOverlapped=0x0) returned 1 [0062.213] WriteFile (in: hFile=0x158, lpBuffer=0x1fea110*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea110*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0062.213] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0062.213] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0062.213] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x5cf [0062.213] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x5cf [0062.213] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0062.213] WriteFile (in: hFile=0x158, lpBuffer=0x35f011c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f011c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0062.213] DeleteFileW (lpFileName="") returned 0 [0062.213] GetLastError () returned 0x3 [0062.213] GetFileAttributesW (lpFileName="") returned 0xffffffff [0062.213] SetLastError (dwErrCode=0x3) [0062.213] FlushFileBuffers (hFile=0x158) returned 1 [0062.216] GetCurrentThreadId () returned 0x970 [0062.216] GetCurrentThreadId () returned 0x970 [0062.216] GetCurrentThreadId () returned 0x970 [0062.216] GetCurrentThreadId () returned 0x970 [0062.216] GetCurrentThreadId () returned 0x970 [0062.216] GetCurrentThreadId () returned 0x970 [0062.216] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x686 [0062.216] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x686 [0062.216] SetFilePointer (in: hFile=0x158, lDistanceToMove=1670, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x686 [0062.216] CloseHandle (hObject=0x158) returned 1 [0062.217] GetCurrentThreadId () returned 0x970 [0062.217] GetCurrentThreadId () returned 0x970 [0062.217] GetCurrentThreadId () returned 0x970 [0062.217] GetCurrentThreadId () returned 0x970 [0062.217] GetCurrentThreadId () returned 0x970 [0062.217] GetCurrentThreadId () returned 0x970 [0062.217] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\Файл зашифрован [PREVIEW.GIF].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\Файл зашифрован [preview.gif].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0062.217] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x686 [0062.217] SetFilePointer (in: hFile=0x158, lDistanceToMove=1542, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x606 [0062.217] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0062.217] GetFileType (hFile=0x158) returned 0x1 [0062.217] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x9, wMilliseconds=0x1ea)) [0062.218] GetCurrentThreadId () returned 0x970 [0062.218] GetCurrentThreadId () returned 0x970 [0062.218] GetCurrentThreadId () returned 0x970 [0062.218] GetCurrentThreadId () returned 0x970 [0062.218] GetCurrentThreadId () returned 0x970 [0062.218] GetCurrentThreadId () returned 0x970 [0062.218] GetCurrentThreadId () returned 0x970 [0062.218] GetCurrentThreadId () returned 0x970 [0062.218] GetCurrentThreadId () returned 0x970 [0062.218] GetCurrentThreadId () returned 0x970 [0062.218] GetCurrentThreadId () returned 0x970 [0062.218] GetCurrentThreadId () returned 0x970 [0062.218] GetCurrentThreadId () returned 0x970 [0062.218] GetCurrentThreadId () returned 0x970 [0062.218] GetCurrentThreadId () returned 0x970 [0062.218] GetCurrentThreadId () returned 0x970 [0062.218] GetCurrentThreadId () returned 0x970 [0062.218] GetCurrentThreadId () returned 0x970 [0062.218] GetCurrentThreadId () returned 0x970 [0062.218] GetCurrentThreadId () returned 0x970 [0062.218] GetCurrentThreadId () returned 0x970 [0062.218] GetCurrentThreadId () returned 0x970 [0062.218] GetCurrentThreadId () returned 0x970 [0062.218] GetCurrentThreadId () returned 0x970 [0062.218] GetCurrentThreadId () returned 0x970 [0062.218] GetCurrentThreadId () returned 0x970 [0062.218] GetCurrentThreadId () returned 0x970 [0062.218] GetCurrentThreadId () returned 0x970 [0062.218] GetCurrentThreadId () returned 0x970 [0062.218] GetCurrentThreadId () returned 0x970 [0062.218] GetCurrentThreadId () returned 0x970 [0062.218] GetCurrentThreadId () returned 0x970 [0062.218] GetCurrentThreadId () returned 0x970 [0062.218] GetCurrentThreadId () returned 0x970 [0062.218] GetCurrentThreadId () returned 0x970 [0062.218] GetCurrentThreadId () returned 0x970 [0062.218] GetCurrentThreadId () returned 0x970 [0062.218] GetCurrentThreadId () returned 0x970 [0062.218] GetCurrentThreadId () returned 0x970 [0062.218] GetCurrentThreadId () returned 0x970 [0062.218] GetCurrentThreadId () returned 0x970 [0062.218] GetCurrentThreadId () returned 0x970 [0062.218] GetCurrentThreadId () returned 0x970 [0062.218] GetCurrentThreadId () returned 0x970 [0062.219] GetCurrentThreadId () returned 0x970 [0062.219] GetCurrentThreadId () returned 0x970 [0062.219] GetCurrentThreadId () returned 0x970 [0062.219] GetCurrentThreadId () returned 0x970 [0062.219] GetCurrentThreadId () returned 0x970 [0062.219] GetCurrentThreadId () returned 0x970 [0062.219] GetCurrentThreadId () returned 0x970 [0062.219] GetCurrentThreadId () returned 0x970 [0062.219] GetCurrentThreadId () returned 0x970 [0062.219] GetCurrentThreadId () returned 0x970 [0062.219] GetCurrentThreadId () returned 0x970 [0062.219] GetCurrentThreadId () returned 0x970 [0062.219] GetCurrentThreadId () returned 0x970 [0062.219] GetCurrentThreadId () returned 0x970 [0062.219] GetCurrentThreadId () returned 0x970 [0062.219] GetCurrentThreadId () returned 0x970 [0062.219] GetCurrentThreadId () returned 0x970 [0062.219] GetCurrentThreadId () returned 0x970 [0062.219] GetCurrentThreadId () returned 0x970 [0062.219] GetCurrentThreadId () returned 0x970 [0062.219] GetCurrentThreadId () returned 0x970 [0062.219] GetCurrentThreadId () returned 0x970 [0062.219] GetCurrentThreadId () returned 0x970 [0062.219] GetCurrentThreadId () returned 0x970 [0062.219] GetCurrentThreadId () returned 0x970 [0062.219] GetCurrentThreadId () returned 0x970 [0062.219] GetCurrentThreadId () returned 0x970 [0062.219] GetCurrentThreadId () returned 0x970 [0062.219] GetCurrentThreadId () returned 0x970 [0062.219] GetCurrentThreadId () returned 0x970 [0062.219] GetCurrentThreadId () returned 0x970 [0062.219] GetCurrentThreadId () returned 0x970 [0062.219] GetCurrentThreadId () returned 0x970 [0062.219] GetCurrentThreadId () returned 0x970 [0062.219] GetCurrentThreadId () returned 0x970 [0062.219] GetCurrentThreadId () returned 0x970 [0062.219] GetCurrentThreadId () returned 0x970 [0062.219] GetCurrentThreadId () returned 0x970 [0062.219] GetCurrentThreadId () returned 0x970 [0062.219] GetCurrentThreadId () returned 0x970 [0062.219] GetCurrentThreadId () returned 0x970 [0062.219] GetCurrentThreadId () returned 0x970 [0062.219] GetCurrentThreadId () returned 0x970 [0062.219] GetCurrentThreadId () returned 0x970 [0062.219] GetCurrentThreadId () returned 0x970 [0062.220] GetCurrentThreadId () returned 0x970 [0062.220] GetCurrentThreadId () returned 0x970 [0062.220] GetCurrentThreadId () returned 0x970 [0062.220] GetCurrentThreadId () returned 0x970 [0062.220] GetCurrentThreadId () returned 0x970 [0062.220] GetCurrentThreadId () returned 0x970 [0062.220] GetCurrentThreadId () returned 0x970 [0062.220] GetCurrentThreadId () returned 0x970 [0062.220] GetCurrentThreadId () returned 0x970 [0062.220] GetCurrentThreadId () returned 0x970 [0062.220] GetCurrentThreadId () returned 0x970 [0062.220] GetCurrentThreadId () returned 0x970 [0062.220] GetCurrentThreadId () returned 0x970 [0062.220] GetCurrentThreadId () returned 0x970 [0062.220] GetCurrentThreadId () returned 0x970 [0062.220] GetCurrentThreadId () returned 0x970 [0062.220] GetCurrentThreadId () returned 0x970 [0062.220] GetCurrentThreadId () returned 0x970 [0062.220] GetCurrentThreadId () returned 0x970 [0062.220] GetCurrentThreadId () returned 0x970 [0062.220] GetCurrentThreadId () returned 0x970 [0062.220] GetCurrentThreadId () returned 0x970 [0062.220] GetCurrentThreadId () returned 0x970 [0062.220] GetCurrentThreadId () returned 0x970 [0062.220] GetCurrentThreadId () returned 0x970 [0062.220] GetCurrentThreadId () returned 0x970 [0062.220] GetCurrentThreadId () returned 0x970 [0062.220] GetCurrentThreadId () returned 0x970 [0062.220] GetCurrentThreadId () returned 0x970 [0062.220] GetCurrentThreadId () returned 0x970 [0062.220] GetCurrentThreadId () returned 0x970 [0062.220] GetCurrentThreadId () returned 0x970 [0062.220] GetCurrentThreadId () returned 0x970 [0062.220] GetCurrentThreadId () returned 0x970 [0062.220] GetCurrentThreadId () returned 0x970 [0062.220] GetCurrentThreadId () returned 0x970 [0062.220] GetCurrentThreadId () returned 0x970 [0062.220] GetCurrentThreadId () returned 0x970 [0062.220] GetCurrentThreadId () returned 0x970 [0062.220] GetCurrentThreadId () returned 0x970 [0062.220] GetCurrentThreadId () returned 0x970 [0062.220] GetCurrentThreadId () returned 0x970 [0062.220] GetCurrentThreadId () returned 0x970 [0062.220] GetCurrentThreadId () returned 0x970 [0062.221] GetCurrentThreadId () returned 0x970 [0062.221] GetCurrentThreadId () returned 0x970 [0062.221] GetCurrentThreadId () returned 0x970 [0062.221] GetCurrentThreadId () returned 0x970 [0062.221] GetCurrentThreadId () returned 0x970 [0062.221] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.221] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.221] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff02f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.221] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.221] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.221] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff02f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.221] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.221] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.221] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.221] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.221] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.221] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.221] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.221] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.221] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff0350, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.221] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.221] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.221] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff0350, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.221] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.221] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.221] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff0350, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.221] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x9, wMilliseconds=0x1ea)) [0062.221] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Ri+qcs0p\"pCfRC-\\oj8{&8A8FF\\Yy%@E", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0062.221] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Ri+qcs0p\"pCfRC-\\oj8{&8A8FF\\Yy%@E", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0062.221] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Ri+qcs0p\"pCfRC-\\oj8{&8A8FF\\Yy%@E", cchWideChar=32, lpMultiByteStr=0x20024e8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Ri+qcs0p\"pCfRC-\\oj8{&8A8FF\\Yy%@E", lpUsedDefaultChar=0x0) returned 32 [0062.221] GetCurrentThreadId () returned 0x970 [0062.222] GetCurrentThreadId () returned 0x970 [0062.222] GetCurrentThreadId () returned 0x970 [0062.222] GetCurrentThreadId () returned 0x970 [0062.222] GetCurrentThreadId () returned 0x970 [0062.222] GetCurrentThreadId () returned 0x970 [0062.229] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0062.229] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0062.229] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3794b08, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0062.229] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0062.229] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAGCCRAt1Uq1FO78Q+mLOnRHi7XbsyJuMBmNHjxx+rwoSzqLLIEsA5pHLivKtYtOK8iLLaiP6Zniv7Vj2b62NR7mDBCftd/eb8gXYZzfNnLQebbGqR2X30nGXkszRFPlXQikmrvWYHzWsYKVdp1srPIvKYnFtI9q4fG1xGVC/GS0JgCK0NsSDyRGVARzIjbavUk2IAgumXFP5mFBFZHwOner5sMqkOG2M7Q==") returned 232 [0062.229] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x9, wMilliseconds=0x1fa)) [0062.229] GetCurrentThreadId () returned 0x970 [0062.229] GetCurrentThreadId () returned 0x970 [0062.229] GetCurrentThreadId () returned 0x970 [0062.229] GetCurrentThreadId () returned 0x970 [0062.229] GetCurrentThreadId () returned 0x970 [0062.229] GetCurrentThreadId () returned 0x970 [0062.229] GetCurrentThreadId () returned 0x970 [0062.229] GetCurrentThreadId () returned 0x970 [0062.230] GetCurrentThreadId () returned 0x970 [0062.230] GetCurrentThreadId () returned 0x970 [0062.230] GetCurrentThreadId () returned 0x970 [0062.230] GetCurrentThreadId () returned 0x970 [0062.230] GetCurrentThreadId () returned 0x970 [0062.230] GetCurrentThreadId () returned 0x970 [0062.230] GetCurrentThreadId () returned 0x970 [0062.230] GetCurrentThreadId () returned 0x970 [0062.230] GetCurrentThreadId () returned 0x970 [0062.230] GetCurrentThreadId () returned 0x970 [0062.230] GetCurrentThreadId () returned 0x970 [0062.230] GetCurrentThreadId () returned 0x970 [0062.230] GetCurrentThreadId () returned 0x970 [0062.230] GetCurrentThreadId () returned 0x970 [0062.230] GetCurrentThreadId () returned 0x970 [0062.230] GetCurrentThreadId () returned 0x970 [0062.230] GetCurrentThreadId () returned 0x970 [0062.230] GetCurrentThreadId () returned 0x970 [0062.230] GetCurrentThreadId () returned 0x970 [0062.230] GetCurrentThreadId () returned 0x970 [0062.230] GetCurrentThreadId () returned 0x970 [0062.230] GetCurrentThreadId () returned 0x970 [0062.230] GetCurrentThreadId () returned 0x970 [0062.230] GetCurrentThreadId () returned 0x970 [0062.230] GetCurrentThreadId () returned 0x970 [0062.230] GetCurrentThreadId () returned 0x970 [0062.230] GetCurrentThreadId () returned 0x970 [0062.230] GetCurrentThreadId () returned 0x970 [0062.230] GetCurrentThreadId () returned 0x970 [0062.230] GetCurrentThreadId () returned 0x970 [0062.230] GetCurrentThreadId () returned 0x970 [0062.230] GetCurrentThreadId () returned 0x970 [0062.230] GetCurrentThreadId () returned 0x970 [0062.230] GetCurrentThreadId () returned 0x970 [0062.230] GetCurrentThreadId () returned 0x970 [0062.230] GetCurrentThreadId () returned 0x970 [0062.230] GetCurrentThreadId () returned 0x970 [0062.230] GetCurrentThreadId () returned 0x970 [0062.230] GetCurrentThreadId () returned 0x970 [0062.230] GetCurrentThreadId () returned 0x970 [0062.230] GetCurrentThreadId () returned 0x970 [0062.230] GetCurrentThreadId () returned 0x970 [0062.230] GetCurrentThreadId () returned 0x970 [0062.230] GetCurrentThreadId () returned 0x970 [0062.230] GetCurrentThreadId () returned 0x970 [0062.231] GetCurrentThreadId () returned 0x970 [0062.231] GetCurrentThreadId () returned 0x970 [0062.231] GetCurrentThreadId () returned 0x970 [0062.231] GetCurrentThreadId () returned 0x970 [0062.231] GetCurrentThreadId () returned 0x970 [0062.231] GetCurrentThreadId () returned 0x970 [0062.231] GetCurrentThreadId () returned 0x970 [0062.231] GetCurrentThreadId () returned 0x970 [0062.231] GetCurrentThreadId () returned 0x970 [0062.231] GetCurrentThreadId () returned 0x970 [0062.231] GetCurrentThreadId () returned 0x970 [0062.231] GetCurrentThreadId () returned 0x970 [0062.231] GetCurrentThreadId () returned 0x970 [0062.231] GetCurrentThreadId () returned 0x970 [0062.231] GetCurrentThreadId () returned 0x970 [0062.231] GetCurrentThreadId () returned 0x970 [0062.231] GetCurrentThreadId () returned 0x970 [0062.231] GetCurrentThreadId () returned 0x970 [0062.231] GetCurrentThreadId () returned 0x970 [0062.231] GetCurrentThreadId () returned 0x970 [0062.231] GetCurrentThreadId () returned 0x970 [0062.231] GetCurrentThreadId () returned 0x970 [0062.231] GetCurrentThreadId () returned 0x970 [0062.231] GetCurrentThreadId () returned 0x970 [0062.231] GetCurrentThreadId () returned 0x970 [0062.231] GetCurrentThreadId () returned 0x970 [0062.231] GetCurrentThreadId () returned 0x970 [0062.231] GetCurrentThreadId () returned 0x970 [0062.231] GetCurrentThreadId () returned 0x970 [0062.231] GetCurrentThreadId () returned 0x970 [0062.231] GetCurrentThreadId () returned 0x970 [0062.231] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAGCCRAt1Uq1FO78Q+mLOnRHi7XbsyJuMBmNHjxx+rwoSzqLLIEsA5pHLivKtYtOK8iLLaiP6Zniv7Vj2b62NR7mDBCftd/eb8gXYZzfNnLQebbGqR2X30nGXkszRFPlXQikmrvWYHzWsYKVdp1srPIvKYnFtI9q4fG1xGVC/GS0JgCK0NsSDyRGVARzIjbavUk2IAgumXFP5mFBFZHwOner5sMqkOG2M7Q==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0062.231] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAGCCRAt1Uq1FO78Q+mLOnRHi7XbsyJuMBmNHjxx+rwoSzqLLIEsA5pHLivKtYtOK8iLLaiP6Zniv7Vj2b62NR7mDBCftd/eb8gXYZzfNnLQebbGqR2X30nGXkszRFPlXQikmrvWYHzWsYKVdp1srPIvKYnFtI9q4fG1xGVC/GS0JgCK0NsSDyRGVARzIjbavUk2IAgumXFP5mFBFZHwOner5sMqkOG2M7Q==", cchWideChar=245, lpMultiByteStr=0x353933c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAGCCRAt1Uq1FO78Q+mLOnRHi7XbsyJuMBmNHjxx+rwoSzqLLIEsA5pHLivKtYtOK8iLLaiP6Zniv7Vj2b62NR7mDBCftd/eb8gXYZzfNnLQebbGqR2X30nGXkszRFPlXQikmrvWYHzWsYKVdp1srPIvKYnFtI9q4fG1xGVC/GS0JgCK0NsSDyRGVARzIjbavUk2IAgumXFP5mFBFZHwOner5sMqkOG2M7Q==", lpUsedDefaultChar=0x0) returned 245 [0062.231] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0062.231] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0062.232] CloseHandle (hObject=0x158) returned 1 [0062.232] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif")) returned 1 [0062.233] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=18249664680) returned 1 [0062.233] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\Файл зашифрован [THMBNAIL.PNG].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\Файл зашифрован [thmbnail.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0062.234] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0062.234] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0062.234] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0062.234] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0062.234] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0062.234] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0062.234] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0062.234] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0062.234] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0062.234] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0062.234] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0062.234] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0062.234] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0062.234] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0062.234] SetEndOfFile (hFile=0x158) returned 1 [0062.235] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0062.235] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0062.235] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0062.235] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0062.235] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0062.236] WriteFile (in: hFile=0x158, lpBuffer=0x35f01dc*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f01dc*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0062.236] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v?N3b^&j+8zs$qy/bccr0END)(Y&^)2", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0062.421] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M\"v/N>^&j+8zs$qy/bccr0END)(Y&^)2", cchWideChar=32, lpMultiByteStr=0x2035884, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M\"v/N>^&j+8zs$qy/bccr0END)(Y&^)2", lpUsedDefaultChar=0x0) returned 32 [0062.421] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0062.421] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0062.421] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x682, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 0x295098 [0062.421] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0062.421] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0062.421] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif")) returned 0x20 [0062.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif")) returned 0x20 [0062.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif")) returned 0x20 [0062.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif")) returned 0x20 [0062.430] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x682)) returned 1 [0062.430] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0062.430] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0062.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif")) returned 0x20 [0062.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif")) returned 0x20 [0062.430] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0062.430] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0062.431] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0062.431] SetEndOfFile (hFile=0x158) returned 1 [0062.431] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0062.431] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe410c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0062.431] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0062.431] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe484c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0062.431] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe484c, cbMultiByte=11, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="PREVIEW.GIFGer.gifg") returned 11 [0062.432] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0062.432] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe410c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0062.432] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0062.432] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0062.432] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x682 [0062.432] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0062.432] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0062.432] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0062.432] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0062.432] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe410c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0062.432] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0062.432] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe484c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0062.432] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe484c, cbMultiByte=11, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="PREVIEW.GIFEW.GIFGer.gifg") returned 11 [0062.432] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0062.432] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe410c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0062.433] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0062.433] CharToOemA (in: pSrc="PREVIEW.GIF", pDst=0x1fe484c | out: pDst="PREVIEW.GIF") returned 1 [0062.433] WriteFile (in: hFile=0x158, lpBuffer=0x1fe484c*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe484c*, lpNumberOfBytesWritten=0x18e048*=0xb, lpOverlapped=0x0) returned 1 [0062.434] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0062.434] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0062.434] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0062.434] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=18269725857) returned 1 [0062.434] ReadFile (in: hFile=0x11c, lpBuffer=0x37b81c0, nNumberOfBytesToRead=0x682, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37b81c0*, lpNumberOfBytesRead=0x18dd7c*=0x682, lpOverlapped=0x0) returned 1 [0062.435] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0062.435] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=18269875846) returned 1 [0062.446] WriteFile (in: hFile=0x158, lpBuffer=0x1fea180*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fea180*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0062.446] ReadFile (in: hFile=0x11c, lpBuffer=0x37b81c0, nNumberOfBytesToRead=0x682, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x37b81c0*, lpNumberOfBytesRead=0x18de38*=0x682, lpOverlapped=0x0) returned 1 [0062.446] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x46 [0062.447] WriteFile (in: hFile=0x158, lpBuffer=0x37b88d0*, nNumberOfBytesToWrite=0x682, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x37b88d0*, lpNumberOfBytesWritten=0x18de10*=0x682, lpOverlapped=0x0) returned 1 [0062.447] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x6c8 [0062.447] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0062.447] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0062.447] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0062.447] SetFilePointer (in: hFile=0x158, lDistanceToMove=11, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x29 [0062.447] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x6d2 [0062.447] CloseHandle (hObject=0x11c) returned 1 [0062.447] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x6d2 [0062.447] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x6d2 [0062.447] SetFilePointer (in: hFile=0x158, lDistanceToMove=1746, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x6d2 [0062.447] SetFilePointer (in: hFile=0x158, lDistanceToMove=1746, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x6d2 [0062.448] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x6d2 [0062.448] SetFilePointer (in: hFile=0x158, lDistanceToMove=1746, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x6d2 [0062.448] SetEndOfFile (hFile=0x158) returned 1 [0062.448] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x6d2 [0062.448] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x6d2 [0062.448] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0062.448] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe410c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0062.448] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0062.448] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe41ac, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0062.448] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe41ac, cbMultiByte=11, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="PREVIEW.GIF\x18ꞗ@涤(\x18믉`믑`") returned 11 [0062.449] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0062.449] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe410c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0062.449] WriteFile (in: hFile=0x158, lpBuffer=0x379bc78*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x379bc78*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0062.449] CharToOemA (in: pSrc="PREVIEW.GIF", pDst=0x1fe41ac | out: pDst="PREVIEW.GIF") returned 1 [0062.449] WriteFile (in: hFile=0x158, lpBuffer=0x1fe41ac*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe41ac*, lpNumberOfBytesWritten=0x18efcc*=0xb, lpOverlapped=0x0) returned 1 [0062.449] WriteFile (in: hFile=0x158, lpBuffer=0x1fea2d8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea2d8*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0062.449] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0062.449] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0062.449] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x716 [0062.449] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x716 [0062.449] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0062.449] WriteFile (in: hFile=0x158, lpBuffer=0x35f011c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f011c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0062.449] DeleteFileW (lpFileName="") returned 0 [0062.449] GetLastError () returned 0x3 [0062.449] GetFileAttributesW (lpFileName="") returned 0xffffffff [0062.449] SetLastError (dwErrCode=0x3) [0062.449] FlushFileBuffers (hFile=0x158) returned 1 [0062.452] GetCurrentThreadId () returned 0x970 [0062.452] GetCurrentThreadId () returned 0x970 [0062.452] GetCurrentThreadId () returned 0x970 [0062.452] GetCurrentThreadId () returned 0x970 [0062.452] GetCurrentThreadId () returned 0x970 [0062.452] GetCurrentThreadId () returned 0x970 [0062.452] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x7cd [0062.452] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x7cd [0062.452] SetFilePointer (in: hFile=0x158, lDistanceToMove=1997, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x7cd [0062.452] CloseHandle (hObject=0x158) returned 1 [0062.452] GetCurrentThreadId () returned 0x970 [0062.452] GetCurrentThreadId () returned 0x970 [0062.452] GetCurrentThreadId () returned 0x970 [0062.453] GetCurrentThreadId () returned 0x970 [0062.453] GetCurrentThreadId () returned 0x970 [0062.453] GetCurrentThreadId () returned 0x970 [0062.453] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\Файл зашифрован [PREVIEW.GIF].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\Файл зашифрован [preview.gif].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0062.453] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7cd [0062.453] SetFilePointer (in: hFile=0x158, lDistanceToMove=1869, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x74d [0062.453] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0062.453] GetFileType (hFile=0x158) returned 0x1 [0062.453] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x9, wMilliseconds=0x2d4)) [0062.453] GetCurrentThreadId () returned 0x970 [0062.453] GetCurrentThreadId () returned 0x970 [0062.453] GetCurrentThreadId () returned 0x970 [0062.453] GetCurrentThreadId () returned 0x970 [0062.453] GetCurrentThreadId () returned 0x970 [0062.453] GetCurrentThreadId () returned 0x970 [0062.453] GetCurrentThreadId () returned 0x970 [0062.453] GetCurrentThreadId () returned 0x970 [0062.453] GetCurrentThreadId () returned 0x970 [0062.453] GetCurrentThreadId () returned 0x970 [0062.453] GetCurrentThreadId () returned 0x970 [0062.453] GetCurrentThreadId () returned 0x970 [0062.453] GetCurrentThreadId () returned 0x970 [0062.453] GetCurrentThreadId () returned 0x970 [0062.453] GetCurrentThreadId () returned 0x970 [0062.453] GetCurrentThreadId () returned 0x970 [0062.453] GetCurrentThreadId () returned 0x970 [0062.453] GetCurrentThreadId () returned 0x970 [0062.453] GetCurrentThreadId () returned 0x970 [0062.453] GetCurrentThreadId () returned 0x970 [0062.454] GetCurrentThreadId () returned 0x970 [0062.454] GetCurrentThreadId () returned 0x970 [0062.454] GetCurrentThreadId () returned 0x970 [0062.454] GetCurrentThreadId () returned 0x970 [0062.454] GetCurrentThreadId () returned 0x970 [0062.454] GetCurrentThreadId () returned 0x970 [0062.454] GetCurrentThreadId () returned 0x970 [0062.454] GetCurrentThreadId () returned 0x970 [0062.454] GetCurrentThreadId () returned 0x970 [0062.454] GetCurrentThreadId () returned 0x970 [0062.454] GetCurrentThreadId () returned 0x970 [0062.454] GetCurrentThreadId () returned 0x970 [0062.454] GetCurrentThreadId () returned 0x970 [0062.454] GetCurrentThreadId () returned 0x970 [0062.454] GetCurrentThreadId () returned 0x970 [0062.454] GetCurrentThreadId () returned 0x970 [0062.454] GetCurrentThreadId () returned 0x970 [0062.454] GetCurrentThreadId () returned 0x970 [0062.454] GetCurrentThreadId () returned 0x970 [0062.454] GetCurrentThreadId () returned 0x970 [0062.454] GetCurrentThreadId () returned 0x970 [0062.454] GetCurrentThreadId () returned 0x970 [0062.454] GetCurrentThreadId () returned 0x970 [0062.454] GetCurrentThreadId () returned 0x970 [0062.454] GetCurrentThreadId () returned 0x970 [0062.454] GetCurrentThreadId () returned 0x970 [0062.454] GetCurrentThreadId () returned 0x970 [0062.454] GetCurrentThreadId () returned 0x970 [0062.454] GetCurrentThreadId () returned 0x970 [0062.454] GetCurrentThreadId () returned 0x970 [0062.454] GetCurrentThreadId () returned 0x970 [0062.454] GetCurrentThreadId () returned 0x970 [0062.454] GetCurrentThreadId () returned 0x970 [0062.454] GetCurrentThreadId () returned 0x970 [0062.454] GetCurrentThreadId () returned 0x970 [0062.454] GetCurrentThreadId () returned 0x970 [0062.454] GetCurrentThreadId () returned 0x970 [0062.454] GetCurrentThreadId () returned 0x970 [0062.454] GetCurrentThreadId () returned 0x970 [0062.454] GetCurrentThreadId () returned 0x970 [0062.454] GetCurrentThreadId () returned 0x970 [0062.454] GetCurrentThreadId () returned 0x970 [0062.454] GetCurrentThreadId () returned 0x970 [0062.454] GetCurrentThreadId () returned 0x970 [0062.454] GetCurrentThreadId () returned 0x970 [0062.455] GetCurrentThreadId () returned 0x970 [0062.455] GetCurrentThreadId () returned 0x970 [0062.455] GetCurrentThreadId () returned 0x970 [0062.455] GetCurrentThreadId () returned 0x970 [0062.455] GetCurrentThreadId () returned 0x970 [0062.456] GetCurrentThreadId () returned 0x970 [0062.456] GetCurrentThreadId () returned 0x970 [0062.456] GetCurrentThreadId () returned 0x970 [0062.456] GetCurrentThreadId () returned 0x970 [0062.456] GetCurrentThreadId () returned 0x970 [0062.456] GetCurrentThreadId () returned 0x970 [0062.456] GetCurrentThreadId () returned 0x970 [0062.456] GetCurrentThreadId () returned 0x970 [0062.456] GetCurrentThreadId () returned 0x970 [0062.456] GetCurrentThreadId () returned 0x970 [0062.456] GetCurrentThreadId () returned 0x970 [0062.456] GetCurrentThreadId () returned 0x970 [0062.456] GetCurrentThreadId () returned 0x970 [0062.456] GetCurrentThreadId () returned 0x970 [0062.456] GetCurrentThreadId () returned 0x970 [0062.456] GetCurrentThreadId () returned 0x970 [0062.456] GetCurrentThreadId () returned 0x970 [0062.456] GetCurrentThreadId () returned 0x970 [0062.456] GetCurrentThreadId () returned 0x970 [0062.456] GetCurrentThreadId () returned 0x970 [0062.456] GetCurrentThreadId () returned 0x970 [0062.456] GetCurrentThreadId () returned 0x970 [0062.456] GetCurrentThreadId () returned 0x970 [0062.456] GetCurrentThreadId () returned 0x970 [0062.456] GetCurrentThreadId () returned 0x970 [0062.456] GetCurrentThreadId () returned 0x970 [0062.456] GetCurrentThreadId () returned 0x970 [0062.456] GetCurrentThreadId () returned 0x970 [0062.456] GetCurrentThreadId () returned 0x970 [0062.456] GetCurrentThreadId () returned 0x970 [0062.456] GetCurrentThreadId () returned 0x970 [0062.456] GetCurrentThreadId () returned 0x970 [0062.456] GetCurrentThreadId () returned 0x970 [0062.456] GetCurrentThreadId () returned 0x970 [0062.456] GetCurrentThreadId () returned 0x970 [0062.456] GetCurrentThreadId () returned 0x970 [0062.456] GetCurrentThreadId () returned 0x970 [0062.456] GetCurrentThreadId () returned 0x970 [0062.456] GetCurrentThreadId () returned 0x970 [0062.457] GetCurrentThreadId () returned 0x970 [0062.457] GetCurrentThreadId () returned 0x970 [0062.457] GetCurrentThreadId () returned 0x970 [0062.457] GetCurrentThreadId () returned 0x970 [0062.457] GetCurrentThreadId () returned 0x970 [0062.457] GetCurrentThreadId () returned 0x970 [0062.457] GetCurrentThreadId () returned 0x970 [0062.457] GetCurrentThreadId () returned 0x970 [0062.457] GetCurrentThreadId () returned 0x970 [0062.457] GetCurrentThreadId () returned 0x970 [0062.457] GetCurrentThreadId () returned 0x970 [0062.457] GetCurrentThreadId () returned 0x970 [0062.457] GetCurrentThreadId () returned 0x970 [0062.457] GetCurrentThreadId () returned 0x970 [0062.457] GetCurrentThreadId () returned 0x970 [0062.457] GetCurrentThreadId () returned 0x970 [0062.457] GetCurrentThreadId () returned 0x970 [0062.457] GetCurrentThreadId () returned 0x970 [0062.457] GetCurrentThreadId () returned 0x970 [0062.457] GetCurrentThreadId () returned 0x970 [0062.457] GetCurrentThreadId () returned 0x970 [0062.457] GetCurrentThreadId () returned 0x970 [0062.457] GetCurrentThreadId () returned 0x970 [0062.457] GetCurrentThreadId () returned 0x970 [0062.457] GetCurrentThreadId () returned 0x970 [0062.457] GetCurrentThreadId () returned 0x970 [0062.457] GetCurrentThreadId () returned 0x970 [0062.457] GetCurrentThreadId () returned 0x970 [0062.457] GetCurrentThreadId () returned 0x970 [0062.457] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.457] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.457] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff0470, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.457] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.457] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.457] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff0470, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.457] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.457] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.457] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.457] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.457] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.457] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff04d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff04d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff04d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.458] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x9, wMilliseconds=0x2d4)) [0062.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="M\"v/N>^&j+8zs$qy/bccr0END)(Y&^)2", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0062.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="M\"v/N>^&j+8zs$qy/bccr0END)(Y&^)2", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0062.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="M\"v/N>^&j+8zs$qy/bccr0END)(Y&^)2", cchWideChar=32, lpMultiByteStr=0x20024e8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M\"v/N>^&j+8zs$qy/bccr0END)(Y&^)2", lpUsedDefaultChar=0x0) returned 32 [0062.458] GetCurrentThreadId () returned 0x970 [0062.458] GetCurrentThreadId () returned 0x970 [0062.458] GetCurrentThreadId () returned 0x970 [0062.458] GetCurrentThreadId () returned 0x970 [0062.458] GetCurrentThreadId () returned 0x970 [0062.458] GetCurrentThreadId () returned 0x970 [0062.467] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0062.467] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0062.467] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3794ec8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0062.467] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0062.467] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAFsIbpjDEP0EsB8isO4oWENBwe34QXRbH7QYEaI5O1l/a4eQo3LlRzVYbwBVDU8d2ufpUKio6C0Lk8YbnnieONoagKYxZozpWTzx+UX1+6aIEsTzZgaHruQtuQ9twoSzC1QKi1/8uCmg7hqkZqqD/3ezOnyFqt+DSQ/fztjMO3194nn9XHu7bd5kCJOQcqbRBGrq5XRAie0ohK04eGzEwuL1U881HsnEyw==") returned 232 [0062.467] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x9, wMilliseconds=0x2e4)) [0062.467] GetCurrentThreadId () returned 0x970 [0062.467] GetCurrentThreadId () returned 0x970 [0062.467] GetCurrentThreadId () returned 0x970 [0062.467] GetCurrentThreadId () returned 0x970 [0062.467] GetCurrentThreadId () returned 0x970 [0062.467] GetCurrentThreadId () returned 0x970 [0062.467] GetCurrentThreadId () returned 0x970 [0062.467] GetCurrentThreadId () returned 0x970 [0062.467] GetCurrentThreadId () returned 0x970 [0062.467] GetCurrentThreadId () returned 0x970 [0062.467] GetCurrentThreadId () returned 0x970 [0062.467] GetCurrentThreadId () returned 0x970 [0062.467] GetCurrentThreadId () returned 0x970 [0062.467] GetCurrentThreadId () returned 0x970 [0062.467] GetCurrentThreadId () returned 0x970 [0062.467] GetCurrentThreadId () returned 0x970 [0062.467] GetCurrentThreadId () returned 0x970 [0062.467] GetCurrentThreadId () returned 0x970 [0062.468] GetCurrentThreadId () returned 0x970 [0062.468] GetCurrentThreadId () returned 0x970 [0062.468] GetCurrentThreadId () returned 0x970 [0062.468] GetCurrentThreadId () returned 0x970 [0062.468] GetCurrentThreadId () returned 0x970 [0062.468] GetCurrentThreadId () returned 0x970 [0062.468] GetCurrentThreadId () returned 0x970 [0062.468] GetCurrentThreadId () returned 0x970 [0062.468] GetCurrentThreadId () returned 0x970 [0062.468] GetCurrentThreadId () returned 0x970 [0062.468] GetCurrentThreadId () returned 0x970 [0062.468] GetCurrentThreadId () returned 0x970 [0062.468] GetCurrentThreadId () returned 0x970 [0062.468] GetCurrentThreadId () returned 0x970 [0062.468] GetCurrentThreadId () returned 0x970 [0062.468] GetCurrentThreadId () returned 0x970 [0062.468] GetCurrentThreadId () returned 0x970 [0062.468] GetCurrentThreadId () returned 0x970 [0062.468] GetCurrentThreadId () returned 0x970 [0062.468] GetCurrentThreadId () returned 0x970 [0062.468] GetCurrentThreadId () returned 0x970 [0062.468] GetCurrentThreadId () returned 0x970 [0062.468] GetCurrentThreadId () returned 0x970 [0062.468] GetCurrentThreadId () returned 0x970 [0062.468] GetCurrentThreadId () returned 0x970 [0062.468] GetCurrentThreadId () returned 0x970 [0062.468] GetCurrentThreadId () returned 0x970 [0062.468] GetCurrentThreadId () returned 0x970 [0062.468] GetCurrentThreadId () returned 0x970 [0062.468] GetCurrentThreadId () returned 0x970 [0062.468] GetCurrentThreadId () returned 0x970 [0062.468] GetCurrentThreadId () returned 0x970 [0062.468] GetCurrentThreadId () returned 0x970 [0062.468] GetCurrentThreadId () returned 0x970 [0062.469] GetCurrentThreadId () returned 0x970 [0062.469] GetCurrentThreadId () returned 0x970 [0062.469] GetCurrentThreadId () returned 0x970 [0062.469] GetCurrentThreadId () returned 0x970 [0062.469] GetCurrentThreadId () returned 0x970 [0062.469] GetCurrentThreadId () returned 0x970 [0062.469] GetCurrentThreadId () returned 0x970 [0062.469] GetCurrentThreadId () returned 0x970 [0062.469] GetCurrentThreadId () returned 0x970 [0062.469] GetCurrentThreadId () returned 0x970 [0062.469] GetCurrentThreadId () returned 0x970 [0062.469] GetCurrentThreadId () returned 0x970 [0062.469] GetCurrentThreadId () returned 0x970 [0062.469] GetCurrentThreadId () returned 0x970 [0062.469] GetCurrentThreadId () returned 0x970 [0062.469] GetCurrentThreadId () returned 0x970 [0062.469] GetCurrentThreadId () returned 0x970 [0062.469] GetCurrentThreadId () returned 0x970 [0062.469] GetCurrentThreadId () returned 0x970 [0062.469] GetCurrentThreadId () returned 0x970 [0062.469] GetCurrentThreadId () returned 0x970 [0062.469] GetCurrentThreadId () returned 0x970 [0062.469] GetCurrentThreadId () returned 0x970 [0062.469] GetCurrentThreadId () returned 0x970 [0062.469] GetCurrentThreadId () returned 0x970 [0062.469] GetCurrentThreadId () returned 0x970 [0062.469] GetCurrentThreadId () returned 0x970 [0062.469] GetCurrentThreadId () returned 0x970 [0062.469] GetCurrentThreadId () returned 0x970 [0062.469] GetCurrentThreadId () returned 0x970 [0062.469] GetCurrentThreadId () returned 0x970 [0062.469] GetCurrentThreadId () returned 0x970 [0062.469] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAFsIbpjDEP0EsB8isO4oWENBwe34QXRbH7QYEaI5O1l/a4eQo3LlRzVYbwBVDU8d2ufpUKio6C0Lk8YbnnieONoagKYxZozpWTzx+UX1+6aIEsTzZgaHruQtuQ9twoSzC1QKi1/8uCmg7hqkZqqD/3ezOnyFqt+DSQ/fztjMO3194nn9XHu7bd5kCJOQcqbRBGrq5XRAie0ohK04eGzEwuL1U881HsnEyw==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0062.469] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAFsIbpjDEP0EsB8isO4oWENBwe34QXRbH7QYEaI5O1l/a4eQo3LlRzVYbwBVDU8d2ufpUKio6C0Lk8YbnnieONoagKYxZozpWTzx+UX1+6aIEsTzZgaHruQtuQ9twoSzC1QKi1/8uCmg7hqkZqqD/3ezOnyFqt+DSQ/fztjMO3194nn9XHu7bd5kCJOQcqbRBGrq5XRAie0ohK04eGzEwuL1U881HsnEyw==", cchWideChar=245, lpMultiByteStr=0x353933c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAFsIbpjDEP0EsB8isO4oWENBwe34QXRbH7QYEaI5O1l/a4eQo3LlRzVYbwBVDU8d2ufpUKio6C0Lk8YbnnieONoagKYxZozpWTzx+UX1+6aIEsTzZgaHruQtuQ9twoSzC1QKi1/8uCmg7hqkZqqD/3ezOnyFqt+DSQ/fztjMO3194nn9XHu7bd5kCJOQcqbRBGrq5XRAie0ohK04eGzEwuL1U881HsnEyw==", lpUsedDefaultChar=0x0) returned 245 [0062.469] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0062.470] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0062.470] CloseHandle (hObject=0x158) returned 1 [0062.470] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif")) returned 1 [0062.471] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=18273409773) returned 1 [0062.471] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\Файл зашифрован [THMBNAIL.PNG].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\Файл зашифрован [thmbnail.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0062.471] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0062.471] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0062.471] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0062.471] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0062.472] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0062.472] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0062.472] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0062.472] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0062.472] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0062.472] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0062.472] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0062.472] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0062.472] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0062.472] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0062.472] SetEndOfFile (hFile=0x158) returned 1 [0062.472] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0062.472] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0062.472] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0062.472] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0062.472] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0062.473] WriteFile (in: hFile=0x158, lpBuffer=0x35f01dc*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f01dc*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0062.473] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J4I5nx&b6Cnt:&scMQ7CBePb\"#7v9tkZ", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0062.474] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J4I5nx&b6Cnt:&scMQ7CBePb\"#7v9tkZ", cchWideChar=32, lpMultiByteStr=0x20358bc, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J4I5nx&b6Cnt:&scMQ7CBePb\"#7v9tkZ", lpUsedDefaultChar=0x0) returned 32 [0062.474] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0062.474] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0062.474] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c6b, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0x295098 [0062.474] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0062.474] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0062.474] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png")) returned 0x20 [0062.475] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png")) returned 0x20 [0062.475] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png")) returned 0x20 [0062.475] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png")) returned 0x20 [0062.475] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c6b)) returned 1 [0062.475] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0062.475] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0062.475] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png")) returned 0x20 [0062.475] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png")) returned 0x20 [0062.475] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0062.475] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0062.475] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0062.475] SetEndOfFile (hFile=0x158) returned 1 [0062.476] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0062.476] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe370c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0062.476] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0062.476] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe35ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0062.476] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe35ac, cbMultiByte=12, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="THMBNAIL.PNGer.gifg") returned 12 [0062.476] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0062.476] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe370c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0062.477] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0062.477] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0062.477] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x4c6b [0062.477] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0062.477] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0062.477] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0062.477] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0062.477] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe370c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0062.477] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0062.477] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe35ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0062.477] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe35ac, cbMultiByte=12, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="THMBNAIL.PNGIL.PNGer.gifg") returned 12 [0062.477] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0062.477] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe370c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0062.477] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0062.479] CharToOemA (in: pSrc="THMBNAIL.PNG", pDst=0x1fe35ac | out: pDst="THMBNAIL.PNG") returned 1 [0062.479] WriteFile (in: hFile=0x158, lpBuffer=0x1fe35ac*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe35ac*, lpNumberOfBytesWritten=0x18e048*=0xc, lpOverlapped=0x0) returned 1 [0062.479] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0062.479] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0062.479] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0062.479] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=18274246408) returned 1 [0062.479] ReadFile (in: hFile=0x11c, lpBuffer=0x37b81a0, nNumberOfBytesToRead=0x4c6b, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37b81a0*, lpNumberOfBytesRead=0x18dd7c*=0x4c6b, lpOverlapped=0x0) returned 1 [0062.481] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0062.481] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=18274435247) returned 1 [0062.490] WriteFile (in: hFile=0x158, lpBuffer=0x1fea210*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fea210*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0062.490] ReadFile (in: hFile=0x11c, lpBuffer=0x37b81a0, nNumberOfBytesToRead=0x4c6b, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x37b81a0*, lpNumberOfBytesRead=0x18de38*=0x4c6b, lpOverlapped=0x0) returned 1 [0062.491] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x47 [0062.491] WriteFile (in: hFile=0x158, lpBuffer=0x37fe6c0*, nNumberOfBytesToWrite=0x4c6b, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x37fe6c0*, lpNumberOfBytesWritten=0x18de10*=0x4c6b, lpOverlapped=0x0) returned 1 [0062.492] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x4cb2 [0062.492] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0062.492] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0062.492] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0062.492] SetFilePointer (in: hFile=0x158, lDistanceToMove=12, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2a [0062.492] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x4cbc [0062.492] CloseHandle (hObject=0x11c) returned 1 [0062.492] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x4cbc [0062.492] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x4cbc [0062.492] SetFilePointer (in: hFile=0x158, lDistanceToMove=19644, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x4cbc [0062.492] SetFilePointer (in: hFile=0x158, lDistanceToMove=19644, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x4cbc [0062.492] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x4cbc [0062.493] SetFilePointer (in: hFile=0x158, lDistanceToMove=19644, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x4cbc [0062.493] SetEndOfFile (hFile=0x158) returned 1 [0062.493] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x4cbc [0062.493] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x4cbc [0062.493] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0062.493] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe370c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0062.493] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0062.493] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe37ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0062.493] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe37ec, cbMultiByte=12, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="THMBNAIL.PNGꞗ@涤(\x18믉`믑`") returned 12 [0062.493] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0062.493] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe370c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0062.493] WriteFile (in: hFile=0x158, lpBuffer=0x379bc78*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x379bc78*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0062.493] CharToOemA (in: pSrc="THMBNAIL.PNG", pDst=0x1fe37ec | out: pDst="THMBNAIL.PNG") returned 1 [0062.493] WriteFile (in: hFile=0x158, lpBuffer=0x1fe37ec*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe37ec*, lpNumberOfBytesWritten=0x18efcc*=0xc, lpOverlapped=0x0) returned 1 [0062.493] WriteFile (in: hFile=0x158, lpBuffer=0x1fea170*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea170*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0062.493] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0062.494] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0062.494] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x4d01 [0062.494] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x4d01 [0062.494] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0062.494] WriteFile (in: hFile=0x158, lpBuffer=0x35f01dc*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f01dc*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0062.494] DeleteFileW (lpFileName="") returned 0 [0062.494] GetLastError () returned 0x3 [0062.494] GetFileAttributesW (lpFileName="") returned 0xffffffff [0062.494] SetLastError (dwErrCode=0x3) [0062.494] FlushFileBuffers (hFile=0x158) returned 1 [0062.497] GetCurrentThreadId () returned 0x970 [0062.497] GetCurrentThreadId () returned 0x970 [0062.497] GetCurrentThreadId () returned 0x970 [0062.497] GetCurrentThreadId () returned 0x970 [0062.497] GetCurrentThreadId () returned 0x970 [0062.497] GetCurrentThreadId () returned 0x970 [0062.497] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x4db8 [0062.497] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x4db8 [0062.497] SetFilePointer (in: hFile=0x158, lDistanceToMove=19896, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x4db8 [0062.497] CloseHandle (hObject=0x158) returned 1 [0062.497] GetCurrentThreadId () returned 0x970 [0062.498] GetCurrentThreadId () returned 0x970 [0062.498] GetCurrentThreadId () returned 0x970 [0062.498] GetCurrentThreadId () returned 0x970 [0062.498] GetCurrentThreadId () returned 0x970 [0062.498] GetCurrentThreadId () returned 0x970 [0062.498] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\Файл зашифрован [THMBNAIL.PNG].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\Файл зашифрован [thmbnail.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0062.498] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4db8 [0062.498] SetFilePointer (in: hFile=0x158, lDistanceToMove=19768, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4d38 [0062.498] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0062.498] GetFileType (hFile=0x158) returned 0x1 [0062.498] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x9, wMilliseconds=0x303)) [0062.498] GetCurrentThreadId () returned 0x970 [0062.498] GetCurrentThreadId () returned 0x970 [0062.498] GetCurrentThreadId () returned 0x970 [0062.498] GetCurrentThreadId () returned 0x970 [0062.498] GetCurrentThreadId () returned 0x970 [0062.498] GetCurrentThreadId () returned 0x970 [0062.498] GetCurrentThreadId () returned 0x970 [0062.498] GetCurrentThreadId () returned 0x970 [0062.498] GetCurrentThreadId () returned 0x970 [0062.498] GetCurrentThreadId () returned 0x970 [0062.498] GetCurrentThreadId () returned 0x970 [0062.498] GetCurrentThreadId () returned 0x970 [0062.498] GetCurrentThreadId () returned 0x970 [0062.498] GetCurrentThreadId () returned 0x970 [0062.498] GetCurrentThreadId () returned 0x970 [0062.498] GetCurrentThreadId () returned 0x970 [0062.498] GetCurrentThreadId () returned 0x970 [0062.498] GetCurrentThreadId () returned 0x970 [0062.499] GetCurrentThreadId () returned 0x970 [0062.499] GetCurrentThreadId () returned 0x970 [0062.499] GetCurrentThreadId () returned 0x970 [0062.499] GetCurrentThreadId () returned 0x970 [0062.499] GetCurrentThreadId () returned 0x970 [0062.499] GetCurrentThreadId () returned 0x970 [0062.499] GetCurrentThreadId () returned 0x970 [0062.499] GetCurrentThreadId () returned 0x970 [0062.499] GetCurrentThreadId () returned 0x970 [0062.499] GetCurrentThreadId () returned 0x970 [0062.499] GetCurrentThreadId () returned 0x970 [0062.499] GetCurrentThreadId () returned 0x970 [0062.499] GetCurrentThreadId () returned 0x970 [0062.499] GetCurrentThreadId () returned 0x970 [0062.499] GetCurrentThreadId () returned 0x970 [0062.499] GetCurrentThreadId () returned 0x970 [0062.499] GetCurrentThreadId () returned 0x970 [0062.499] GetCurrentThreadId () returned 0x970 [0062.499] GetCurrentThreadId () returned 0x970 [0062.499] GetCurrentThreadId () returned 0x970 [0062.499] GetCurrentThreadId () returned 0x970 [0062.499] GetCurrentThreadId () returned 0x970 [0062.499] GetCurrentThreadId () returned 0x970 [0062.499] GetCurrentThreadId () returned 0x970 [0062.499] GetCurrentThreadId () returned 0x970 [0062.499] GetCurrentThreadId () returned 0x970 [0062.499] GetCurrentThreadId () returned 0x970 [0062.499] GetCurrentThreadId () returned 0x970 [0062.499] GetCurrentThreadId () returned 0x970 [0062.499] GetCurrentThreadId () returned 0x970 [0062.499] GetCurrentThreadId () returned 0x970 [0062.499] GetCurrentThreadId () returned 0x970 [0062.499] GetCurrentThreadId () returned 0x970 [0062.499] GetCurrentThreadId () returned 0x970 [0062.499] GetCurrentThreadId () returned 0x970 [0062.499] GetCurrentThreadId () returned 0x970 [0062.499] GetCurrentThreadId () returned 0x970 [0062.499] GetCurrentThreadId () returned 0x970 [0062.499] GetCurrentThreadId () returned 0x970 [0062.499] GetCurrentThreadId () returned 0x970 [0062.499] GetCurrentThreadId () returned 0x970 [0062.499] GetCurrentThreadId () returned 0x970 [0062.499] GetCurrentThreadId () returned 0x970 [0062.499] GetCurrentThreadId () returned 0x970 [0062.499] GetCurrentThreadId () returned 0x970 [0062.500] GetCurrentThreadId () returned 0x970 [0062.500] GetCurrentThreadId () returned 0x970 [0062.500] GetCurrentThreadId () returned 0x970 [0062.500] GetCurrentThreadId () returned 0x970 [0062.500] GetCurrentThreadId () returned 0x970 [0062.500] GetCurrentThreadId () returned 0x970 [0062.500] GetCurrentThreadId () returned 0x970 [0062.500] GetCurrentThreadId () returned 0x970 [0062.500] GetCurrentThreadId () returned 0x970 [0062.500] GetCurrentThreadId () returned 0x970 [0062.500] GetCurrentThreadId () returned 0x970 [0062.500] GetCurrentThreadId () returned 0x970 [0062.500] GetCurrentThreadId () returned 0x970 [0062.500] GetCurrentThreadId () returned 0x970 [0062.500] GetCurrentThreadId () returned 0x970 [0062.500] GetCurrentThreadId () returned 0x970 [0062.500] GetCurrentThreadId () returned 0x970 [0062.500] GetCurrentThreadId () returned 0x970 [0062.500] GetCurrentThreadId () returned 0x970 [0062.500] GetCurrentThreadId () returned 0x970 [0062.500] GetCurrentThreadId () returned 0x970 [0062.500] GetCurrentThreadId () returned 0x970 [0062.500] GetCurrentThreadId () returned 0x970 [0062.500] GetCurrentThreadId () returned 0x970 [0062.500] GetCurrentThreadId () returned 0x970 [0062.500] GetCurrentThreadId () returned 0x970 [0062.500] GetCurrentThreadId () returned 0x970 [0062.500] GetCurrentThreadId () returned 0x970 [0062.500] GetCurrentThreadId () returned 0x970 [0062.500] GetCurrentThreadId () returned 0x970 [0062.500] GetCurrentThreadId () returned 0x970 [0062.500] GetCurrentThreadId () returned 0x970 [0062.500] GetCurrentThreadId () returned 0x970 [0062.500] GetCurrentThreadId () returned 0x970 [0062.500] GetCurrentThreadId () returned 0x970 [0062.500] GetCurrentThreadId () returned 0x970 [0062.500] GetCurrentThreadId () returned 0x970 [0062.500] GetCurrentThreadId () returned 0x970 [0062.500] GetCurrentThreadId () returned 0x970 [0062.500] GetCurrentThreadId () returned 0x970 [0062.500] GetCurrentThreadId () returned 0x970 [0062.500] GetCurrentThreadId () returned 0x970 [0062.500] GetCurrentThreadId () returned 0x970 [0062.500] GetCurrentThreadId () returned 0x970 [0062.500] GetCurrentThreadId () returned 0x970 [0062.501] GetCurrentThreadId () returned 0x970 [0062.501] GetCurrentThreadId () returned 0x970 [0062.501] GetCurrentThreadId () returned 0x970 [0062.501] GetCurrentThreadId () returned 0x970 [0062.501] GetCurrentThreadId () returned 0x970 [0062.501] GetCurrentThreadId () returned 0x970 [0062.501] GetCurrentThreadId () returned 0x970 [0062.501] GetCurrentThreadId () returned 0x970 [0062.501] GetCurrentThreadId () returned 0x970 [0062.501] GetCurrentThreadId () returned 0x970 [0062.501] GetCurrentThreadId () returned 0x970 [0062.501] GetCurrentThreadId () returned 0x970 [0062.501] GetCurrentThreadId () returned 0x970 [0062.501] GetCurrentThreadId () returned 0x970 [0062.501] GetCurrentThreadId () returned 0x970 [0062.501] GetCurrentThreadId () returned 0x970 [0062.501] GetCurrentThreadId () returned 0x970 [0062.501] GetCurrentThreadId () returned 0x970 [0062.501] GetCurrentThreadId () returned 0x970 [0062.501] GetCurrentThreadId () returned 0x970 [0062.501] GetCurrentThreadId () returned 0x970 [0062.501] GetCurrentThreadId () returned 0x970 [0062.501] GetCurrentThreadId () returned 0x970 [0062.501] GetCurrentThreadId () returned 0x970 [0062.501] GetCurrentThreadId () returned 0x970 [0062.501] GetCurrentThreadId () returned 0x970 [0062.501] GetCurrentThreadId () returned 0x970 [0062.501] GetCurrentThreadId () returned 0x970 [0062.501] GetCurrentThreadId () returned 0x970 [0062.501] GetCurrentThreadId () returned 0x970 [0062.501] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.501] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.501] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff04d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.501] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.501] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.501] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff04d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.501] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.501] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.501] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.501] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.502] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.502] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.502] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.502] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.502] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff0530, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.502] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.502] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.502] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff0530, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.502] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.502] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.502] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff0530, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.502] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x9, wMilliseconds=0x303)) [0062.502] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="J4I5nx&b6Cnt:&scMQ7CBePb\"#7v9tkZ", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0062.502] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="J4I5nx&b6Cnt:&scMQ7CBePb\"#7v9tkZ", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0062.502] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="J4I5nx&b6Cnt:&scMQ7CBePb\"#7v9tkZ", cchWideChar=32, lpMultiByteStr=0x20030b8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J4I5nx&b6Cnt:&scMQ7CBePb\"#7v9tkZ", lpUsedDefaultChar=0x0) returned 32 [0062.502] GetCurrentThreadId () returned 0x970 [0062.502] GetCurrentThreadId () returned 0x970 [0062.502] GetCurrentThreadId () returned 0x970 [0062.502] GetCurrentThreadId () returned 0x970 [0062.502] GetCurrentThreadId () returned 0x970 [0062.502] GetCurrentThreadId () returned 0x970 [0062.510] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0062.510] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0062.510] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3794fb8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0062.510] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0062.510] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAA+XBVCDzrh9h1K5GyscGarNApsja8yk2DAvKoa41jZaW6s4r8P7IGcFbe3CUsviED4INfxRWOfj2VacSV7VRs5C0HfZrrpcW/lLrjKf12A2Vb6IXoREdhpmcf9nh3XD4QCzNpMNBBwCUcWC0WKhB3JIssp+XhMXei6YYESnJVB31O16wfqEiJ+IeVA+ARLWgnhZBK0gKxXoaMIW+5m/+80PGhYy7D62mA==") returned 232 [0062.510] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x9, wMilliseconds=0x312)) [0062.510] GetCurrentThreadId () returned 0x970 [0062.510] GetCurrentThreadId () returned 0x970 [0062.510] GetCurrentThreadId () returned 0x970 [0062.510] GetCurrentThreadId () returned 0x970 [0062.510] GetCurrentThreadId () returned 0x970 [0062.510] GetCurrentThreadId () returned 0x970 [0062.510] GetCurrentThreadId () returned 0x970 [0062.510] GetCurrentThreadId () returned 0x970 [0062.510] GetCurrentThreadId () returned 0x970 [0062.510] GetCurrentThreadId () returned 0x970 [0062.510] GetCurrentThreadId () returned 0x970 [0062.510] GetCurrentThreadId () returned 0x970 [0062.510] GetCurrentThreadId () returned 0x970 [0062.510] GetCurrentThreadId () returned 0x970 [0062.510] GetCurrentThreadId () returned 0x970 [0062.510] GetCurrentThreadId () returned 0x970 [0062.510] GetCurrentThreadId () returned 0x970 [0062.510] GetCurrentThreadId () returned 0x970 [0062.510] GetCurrentThreadId () returned 0x970 [0062.510] GetCurrentThreadId () returned 0x970 [0062.510] GetCurrentThreadId () returned 0x970 [0062.510] GetCurrentThreadId () returned 0x970 [0062.510] GetCurrentThreadId () returned 0x970 [0062.510] GetCurrentThreadId () returned 0x970 [0062.510] GetCurrentThreadId () returned 0x970 [0062.510] GetCurrentThreadId () returned 0x970 [0062.511] GetCurrentThreadId () returned 0x970 [0062.511] GetCurrentThreadId () returned 0x970 [0062.511] GetCurrentThreadId () returned 0x970 [0062.511] GetCurrentThreadId () returned 0x970 [0062.511] GetCurrentThreadId () returned 0x970 [0062.511] GetCurrentThreadId () returned 0x970 [0062.511] GetCurrentThreadId () returned 0x970 [0062.511] GetCurrentThreadId () returned 0x970 [0062.511] GetCurrentThreadId () returned 0x970 [0062.511] GetCurrentThreadId () returned 0x970 [0062.511] GetCurrentThreadId () returned 0x970 [0062.511] GetCurrentThreadId () returned 0x970 [0062.511] GetCurrentThreadId () returned 0x970 [0062.511] GetCurrentThreadId () returned 0x970 [0062.511] GetCurrentThreadId () returned 0x970 [0062.511] GetCurrentThreadId () returned 0x970 [0062.511] GetCurrentThreadId () returned 0x970 [0062.511] GetCurrentThreadId () returned 0x970 [0062.511] GetCurrentThreadId () returned 0x970 [0062.511] GetCurrentThreadId () returned 0x970 [0062.511] GetCurrentThreadId () returned 0x970 [0062.511] GetCurrentThreadId () returned 0x970 [0062.511] GetCurrentThreadId () returned 0x970 [0062.511] GetCurrentThreadId () returned 0x970 [0062.511] GetCurrentThreadId () returned 0x970 [0062.511] GetCurrentThreadId () returned 0x970 [0062.511] GetCurrentThreadId () returned 0x970 [0062.511] GetCurrentThreadId () returned 0x970 [0062.511] GetCurrentThreadId () returned 0x970 [0062.511] GetCurrentThreadId () returned 0x970 [0062.511] GetCurrentThreadId () returned 0x970 [0062.511] GetCurrentThreadId () returned 0x970 [0062.511] GetCurrentThreadId () returned 0x970 [0062.511] GetCurrentThreadId () returned 0x970 [0062.511] GetCurrentThreadId () returned 0x970 [0062.511] GetCurrentThreadId () returned 0x970 [0062.511] GetCurrentThreadId () returned 0x970 [0062.511] GetCurrentThreadId () returned 0x970 [0062.511] GetCurrentThreadId () returned 0x970 [0062.511] GetCurrentThreadId () returned 0x970 [0062.511] GetCurrentThreadId () returned 0x970 [0062.511] GetCurrentThreadId () returned 0x970 [0062.511] GetCurrentThreadId () returned 0x970 [0062.511] GetCurrentThreadId () returned 0x970 [0062.511] GetCurrentThreadId () returned 0x970 [0062.512] GetCurrentThreadId () returned 0x970 [0062.512] GetCurrentThreadId () returned 0x970 [0062.512] GetCurrentThreadId () returned 0x970 [0062.512] GetCurrentThreadId () returned 0x970 [0062.512] GetCurrentThreadId () returned 0x970 [0062.512] GetCurrentThreadId () returned 0x970 [0062.512] GetCurrentThreadId () returned 0x970 [0062.512] GetCurrentThreadId () returned 0x970 [0062.512] GetCurrentThreadId () returned 0x970 [0062.512] GetCurrentThreadId () returned 0x970 [0062.512] GetCurrentThreadId () returned 0x970 [0062.512] GetCurrentThreadId () returned 0x970 [0062.512] GetCurrentThreadId () returned 0x970 [0062.512] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAA+XBVCDzrh9h1K5GyscGarNApsja8yk2DAvKoa41jZaW6s4r8P7IGcFbe3CUsviED4INfxRWOfj2VacSV7VRs5C0HfZrrpcW/lLrjKf12A2Vb6IXoREdhpmcf9nh3XD4QCzNpMNBBwCUcWC0WKhB3JIssp+XhMXei6YYESnJVB31O16wfqEiJ+IeVA+ARLWgnhZBK0gKxXoaMIW+5m/+80PGhYy7D62mA==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0062.512] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAA+XBVCDzrh9h1K5GyscGarNApsja8yk2DAvKoa41jZaW6s4r8P7IGcFbe3CUsviED4INfxRWOfj2VacSV7VRs5C0HfZrrpcW/lLrjKf12A2Vb6IXoREdhpmcf9nh3XD4QCzNpMNBBwCUcWC0WKhB3JIssp+XhMXei6YYESnJVB31O16wfqEiJ+IeVA+ARLWgnhZBK0gKxXoaMIW+5m/+80PGhYy7D62mA==", cchWideChar=245, lpMultiByteStr=0x353933c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAA+XBVCDzrh9h1K5GyscGarNApsja8yk2DAvKoa41jZaW6s4r8P7IGcFbe3CUsviED4INfxRWOfj2VacSV7VRs5C0HfZrrpcW/lLrjKf12A2Vb6IXoREdhpmcf9nh3XD4QCzNpMNBBwCUcWC0WKhB3JIssp+XhMXei6YYESnJVB31O16wfqEiJ+IeVA+ARLWgnhZBK0gKxXoaMIW+5m/+80PGhYy7D62mA==", lpUsedDefaultChar=0x0) returned 245 [0062.512] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0062.512] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0062.512] CloseHandle (hObject=0x158) returned 1 [0062.512] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png")) returned 1 [0062.513] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=18277670251) returned 1 [0062.513] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\Файл зашифрован [PREVIEW.GIF].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\Файл зашифрован [preview.gif].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0062.516] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0062.516] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0062.516] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0062.516] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0062.516] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0062.516] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0062.516] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0062.516] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0062.516] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0062.516] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0062.516] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0062.516] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0062.516] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0062.516] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0062.516] SetEndOfFile (hFile=0x158) returned 1 [0062.516] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0062.517] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0062.517] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0062.517] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0062.517] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0062.518] WriteFile (in: hFile=0x158, lpBuffer=0x35f011c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f011c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0062.518] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2\\ID/zn)zf0j\\W=NKnk.wG^UmUV.(\\AQ#RHKH\"$NS2r2@f4R07", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0062.556] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Tn.9P4VY\"YP>AQ#RHKH\"$NS2r2@f4R07", cchWideChar=32, lpMultiByteStr=0x203592c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Tn.9P4VY\"YP>AQ#RHKH\"$NS2r2@f4R07", lpUsedDefaultChar=0x0) returned 32 [0062.556] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0062.556] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0062.556] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3d79, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0x295098 [0062.556] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0062.556] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0062.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png")) returned 0x20 [0062.557] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png")) returned 0x20 [0062.557] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png")) returned 0x20 [0062.557] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png")) returned 0x20 [0062.557] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3d79)) returned 1 [0062.557] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0062.557] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0062.557] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png")) returned 0x20 [0062.557] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png")) returned 0x20 [0062.557] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0062.557] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0062.557] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0062.557] SetEndOfFile (hFile=0x158) returned 1 [0062.558] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0062.558] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe36ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0062.558] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0062.558] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe47cc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0062.558] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe47cc, cbMultiByte=12, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="THMBNAIL.PNGer.gifg") returned 12 [0062.558] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0062.558] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe36ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0062.558] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0062.558] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0062.559] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x3d79 [0062.559] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0062.559] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0062.559] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0062.559] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0062.559] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe36ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0062.559] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0062.559] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe47cc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0062.559] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe47cc, cbMultiByte=12, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="THMBNAIL.PNGIL.PNGer.gifg") returned 12 [0062.559] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0062.559] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe36ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0062.559] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0062.560] CharToOemA (in: pSrc="THMBNAIL.PNG", pDst=0x1fe47cc | out: pDst="THMBNAIL.PNG") returned 1 [0062.560] WriteFile (in: hFile=0x158, lpBuffer=0x1fe47cc*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe47cc*, lpNumberOfBytesWritten=0x18e048*=0xc, lpOverlapped=0x0) returned 1 [0062.560] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0062.560] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0062.560] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0062.560] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=18282376950) returned 1 [0062.560] ReadFile (in: hFile=0x11c, lpBuffer=0x37b81a0, nNumberOfBytesToRead=0x3d79, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37b81a0*, lpNumberOfBytesRead=0x18dd7c*=0x3d79, lpOverlapped=0x0) returned 1 [0062.562] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0062.562] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=18282563504) returned 1 [0062.571] WriteFile (in: hFile=0x158, lpBuffer=0x1fea120*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fea120*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0062.571] ReadFile (in: hFile=0x11c, lpBuffer=0x37b81a0, nNumberOfBytesToRead=0x3d79, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x37b81a0*, lpNumberOfBytesRead=0x18de38*=0x3d79, lpOverlapped=0x0) returned 1 [0062.571] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x47 [0062.572] WriteFile (in: hFile=0x158, lpBuffer=0x37fd7c0*, nNumberOfBytesToWrite=0x3d79, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x37fd7c0*, lpNumberOfBytesWritten=0x18de10*=0x3d79, lpOverlapped=0x0) returned 1 [0062.572] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x3dc0 [0062.572] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0062.572] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0062.572] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0062.572] SetFilePointer (in: hFile=0x158, lDistanceToMove=12, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2a [0062.572] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x3dca [0062.572] CloseHandle (hObject=0x11c) returned 1 [0062.572] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x3dca [0062.573] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x3dca [0062.573] SetFilePointer (in: hFile=0x158, lDistanceToMove=15818, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x3dca [0062.573] SetFilePointer (in: hFile=0x158, lDistanceToMove=15818, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x3dca [0062.573] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x3dca [0062.573] SetFilePointer (in: hFile=0x158, lDistanceToMove=15818, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x3dca [0062.573] SetEndOfFile (hFile=0x158) returned 1 [0062.573] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x3dca [0062.573] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x3dca [0062.573] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0062.573] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe36ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0062.573] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0062.573] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe37ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0062.573] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe37ec, cbMultiByte=12, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="THMBNAIL.PNGꞗ@涤(\x18믉`믑`") returned 12 [0062.573] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0062.573] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe36ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0062.573] WriteFile (in: hFile=0x158, lpBuffer=0x379bc78*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x379bc78*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0062.574] CharToOemA (in: pSrc="THMBNAIL.PNG", pDst=0x1fe37ec | out: pDst="THMBNAIL.PNG") returned 1 [0062.574] WriteFile (in: hFile=0x158, lpBuffer=0x1fe37ec*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe37ec*, lpNumberOfBytesWritten=0x18efcc*=0xc, lpOverlapped=0x0) returned 1 [0062.574] WriteFile (in: hFile=0x158, lpBuffer=0x1fea2d8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea2d8*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0062.574] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0062.574] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0062.574] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x3e0f [0062.574] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x3e0f [0062.574] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0062.574] WriteFile (in: hFile=0x158, lpBuffer=0x35f01dc*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f01dc*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0062.574] DeleteFileW (lpFileName="") returned 0 [0062.574] GetLastError () returned 0x3 [0062.574] GetFileAttributesW (lpFileName="") returned 0xffffffff [0062.574] SetLastError (dwErrCode=0x3) [0062.574] FlushFileBuffers (hFile=0x158) returned 1 [0062.577] GetCurrentThreadId () returned 0x970 [0062.577] GetCurrentThreadId () returned 0x970 [0062.577] GetCurrentThreadId () returned 0x970 [0062.577] GetCurrentThreadId () returned 0x970 [0062.577] GetCurrentThreadId () returned 0x970 [0062.577] GetCurrentThreadId () returned 0x970 [0062.577] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x3ec6 [0062.577] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x3ec6 [0062.577] SetFilePointer (in: hFile=0x158, lDistanceToMove=16070, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x3ec6 [0062.578] CloseHandle (hObject=0x158) returned 1 [0062.578] GetCurrentThreadId () returned 0x970 [0062.578] GetCurrentThreadId () returned 0x970 [0062.578] GetCurrentThreadId () returned 0x970 [0062.578] GetCurrentThreadId () returned 0x970 [0062.578] GetCurrentThreadId () returned 0x970 [0062.578] GetCurrentThreadId () returned 0x970 [0062.578] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\Файл зашифрован [THMBNAIL.PNG].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\Файл зашифрован [thmbnail.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0062.578] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3ec6 [0062.578] SetFilePointer (in: hFile=0x158, lDistanceToMove=15942, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3e46 [0062.578] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0062.578] GetFileType (hFile=0x158) returned 0x1 [0062.578] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x9, wMilliseconds=0x351)) [0062.578] GetCurrentThreadId () returned 0x970 [0062.578] GetCurrentThreadId () returned 0x970 [0062.578] GetCurrentThreadId () returned 0x970 [0062.578] GetCurrentThreadId () returned 0x970 [0062.578] GetCurrentThreadId () returned 0x970 [0062.578] GetCurrentThreadId () returned 0x970 [0062.578] GetCurrentThreadId () returned 0x970 [0062.578] GetCurrentThreadId () returned 0x970 [0062.578] GetCurrentThreadId () returned 0x970 [0062.578] GetCurrentThreadId () returned 0x970 [0062.578] GetCurrentThreadId () returned 0x970 [0062.578] GetCurrentThreadId () returned 0x970 [0062.578] GetCurrentThreadId () returned 0x970 [0062.578] GetCurrentThreadId () returned 0x970 [0062.578] GetCurrentThreadId () returned 0x970 [0062.578] GetCurrentThreadId () returned 0x970 [0062.578] GetCurrentThreadId () returned 0x970 [0062.579] GetCurrentThreadId () returned 0x970 [0062.579] GetCurrentThreadId () returned 0x970 [0062.579] GetCurrentThreadId () returned 0x970 [0062.579] GetCurrentThreadId () returned 0x970 [0062.579] GetCurrentThreadId () returned 0x970 [0062.579] GetCurrentThreadId () returned 0x970 [0062.579] GetCurrentThreadId () returned 0x970 [0062.579] GetCurrentThreadId () returned 0x970 [0062.579] GetCurrentThreadId () returned 0x970 [0062.579] GetCurrentThreadId () returned 0x970 [0062.579] GetCurrentThreadId () returned 0x970 [0062.579] GetCurrentThreadId () returned 0x970 [0062.579] GetCurrentThreadId () returned 0x970 [0062.579] GetCurrentThreadId () returned 0x970 [0062.579] GetCurrentThreadId () returned 0x970 [0062.579] GetCurrentThreadId () returned 0x970 [0062.579] GetCurrentThreadId () returned 0x970 [0062.579] GetCurrentThreadId () returned 0x970 [0062.579] GetCurrentThreadId () returned 0x970 [0062.579] GetCurrentThreadId () returned 0x970 [0062.579] GetCurrentThreadId () returned 0x970 [0062.579] GetCurrentThreadId () returned 0x970 [0062.579] GetCurrentThreadId () returned 0x970 [0062.579] GetCurrentThreadId () returned 0x970 [0062.579] GetCurrentThreadId () returned 0x970 [0062.579] GetCurrentThreadId () returned 0x970 [0062.579] GetCurrentThreadId () returned 0x970 [0062.579] GetCurrentThreadId () returned 0x970 [0062.579] GetCurrentThreadId () returned 0x970 [0062.579] GetCurrentThreadId () returned 0x970 [0062.579] GetCurrentThreadId () returned 0x970 [0062.579] GetCurrentThreadId () returned 0x970 [0062.579] GetCurrentThreadId () returned 0x970 [0062.579] GetCurrentThreadId () returned 0x970 [0062.579] GetCurrentThreadId () returned 0x970 [0062.579] GetCurrentThreadId () returned 0x970 [0062.579] GetCurrentThreadId () returned 0x970 [0062.579] GetCurrentThreadId () returned 0x970 [0062.579] GetCurrentThreadId () returned 0x970 [0062.579] GetCurrentThreadId () returned 0x970 [0062.579] GetCurrentThreadId () returned 0x970 [0062.579] GetCurrentThreadId () returned 0x970 [0062.579] GetCurrentThreadId () returned 0x970 [0062.579] GetCurrentThreadId () returned 0x970 [0062.579] GetCurrentThreadId () returned 0x970 [0062.579] GetCurrentThreadId () returned 0x970 [0062.579] GetCurrentThreadId () returned 0x970 [0062.580] GetCurrentThreadId () returned 0x970 [0062.580] GetCurrentThreadId () returned 0x970 [0062.580] GetCurrentThreadId () returned 0x970 [0062.580] GetCurrentThreadId () returned 0x970 [0062.580] GetCurrentThreadId () returned 0x970 [0062.580] GetCurrentThreadId () returned 0x970 [0062.580] GetCurrentThreadId () returned 0x970 [0062.580] GetCurrentThreadId () returned 0x970 [0062.580] GetCurrentThreadId () returned 0x970 [0062.580] GetCurrentThreadId () returned 0x970 [0062.580] GetCurrentThreadId () returned 0x970 [0062.580] GetCurrentThreadId () returned 0x970 [0062.580] GetCurrentThreadId () returned 0x970 [0062.580] GetCurrentThreadId () returned 0x970 [0062.580] GetCurrentThreadId () returned 0x970 [0062.580] GetCurrentThreadId () returned 0x970 [0062.580] GetCurrentThreadId () returned 0x970 [0062.580] GetCurrentThreadId () returned 0x970 [0062.580] GetCurrentThreadId () returned 0x970 [0062.580] GetCurrentThreadId () returned 0x970 [0062.580] GetCurrentThreadId () returned 0x970 [0062.580] GetCurrentThreadId () returned 0x970 [0062.580] GetCurrentThreadId () returned 0x970 [0062.580] GetCurrentThreadId () returned 0x970 [0062.580] GetCurrentThreadId () returned 0x970 [0062.580] GetCurrentThreadId () returned 0x970 [0062.580] GetCurrentThreadId () returned 0x970 [0062.580] GetCurrentThreadId () returned 0x970 [0062.580] GetCurrentThreadId () returned 0x970 [0062.580] GetCurrentThreadId () returned 0x970 [0062.580] GetCurrentThreadId () returned 0x970 [0062.580] GetCurrentThreadId () returned 0x970 [0062.580] GetCurrentThreadId () returned 0x970 [0062.580] GetCurrentThreadId () returned 0x970 [0062.580] GetCurrentThreadId () returned 0x970 [0062.580] GetCurrentThreadId () returned 0x970 [0062.580] GetCurrentThreadId () returned 0x970 [0062.580] GetCurrentThreadId () returned 0x970 [0062.580] GetCurrentThreadId () returned 0x970 [0062.580] GetCurrentThreadId () returned 0x970 [0062.580] GetCurrentThreadId () returned 0x970 [0062.580] GetCurrentThreadId () returned 0x970 [0062.580] GetCurrentThreadId () returned 0x970 [0062.580] GetCurrentThreadId () returned 0x970 [0062.580] GetCurrentThreadId () returned 0x970 [0062.580] GetCurrentThreadId () returned 0x970 [0062.581] GetCurrentThreadId () returned 0x970 [0062.581] GetCurrentThreadId () returned 0x970 [0062.581] GetCurrentThreadId () returned 0x970 [0062.581] GetCurrentThreadId () returned 0x970 [0062.581] GetCurrentThreadId () returned 0x970 [0062.581] GetCurrentThreadId () returned 0x970 [0062.581] GetCurrentThreadId () returned 0x970 [0062.581] GetCurrentThreadId () returned 0x970 [0062.581] GetCurrentThreadId () returned 0x970 [0062.581] GetCurrentThreadId () returned 0x970 [0062.581] GetCurrentThreadId () returned 0x970 [0062.581] GetCurrentThreadId () returned 0x970 [0062.581] GetCurrentThreadId () returned 0x970 [0062.581] GetCurrentThreadId () returned 0x970 [0062.581] GetCurrentThreadId () returned 0x970 [0062.581] GetCurrentThreadId () returned 0x970 [0062.581] GetCurrentThreadId () returned 0x970 [0062.581] GetCurrentThreadId () returned 0x970 [0062.581] GetCurrentThreadId () returned 0x970 [0062.581] GetCurrentThreadId () returned 0x970 [0062.581] GetCurrentThreadId () returned 0x970 [0062.581] GetCurrentThreadId () returned 0x970 [0062.581] GetCurrentThreadId () returned 0x970 [0062.581] GetCurrentThreadId () returned 0x970 [0062.581] GetCurrentThreadId () returned 0x970 [0062.581] GetCurrentThreadId () returned 0x970 [0062.581] GetCurrentThreadId () returned 0x970 [0062.581] GetCurrentThreadId () returned 0x970 [0062.581] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.581] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.581] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff0590, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.581] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.581] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.581] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff0590, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.581] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.581] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.581] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.581] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.581] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.582] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.582] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.582] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.582] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff05f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.582] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.582] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.582] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff05f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.582] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.582] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.582] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff05f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.582] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x9, wMilliseconds=0x351)) [0062.582] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Tn.9P4VY\"YP>AQ#RHKH\"$NS2r2@f4R07", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0062.582] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Tn.9P4VY\"YP>AQ#RHKH\"$NS2r2@f4R07", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0062.582] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Tn.9P4VY\"YP>AQ#RHKH\"$NS2r2@f4R07", cchWideChar=32, lpMultiByteStr=0x2003118, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Tn.9P4VY\"YP>AQ#RHKH\"$NS2r2@f4R07", lpUsedDefaultChar=0x0) returned 32 [0062.582] GetCurrentThreadId () returned 0x970 [0062.582] GetCurrentThreadId () returned 0x970 [0062.582] GetCurrentThreadId () returned 0x970 [0062.582] GetCurrentThreadId () returned 0x970 [0062.582] GetCurrentThreadId () returned 0x970 [0062.582] GetCurrentThreadId () returned 0x970 [0062.590] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0062.590] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0062.590] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3795198, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0062.590] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0062.590] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAFm/UyMKDZIG1C5MgzG3SjQTw97dX1Xu96yqHMDk66DKtZzpGUXy1WHQ+s2tKsgO0io/8M0LUV/9DIqR+u2xixgt0YN5DcYAzE2dKQeffWGmeKl73D+YzksIBh+UyYl6/3N2OZQWkylEptJB2dylcG6ZYm6OAkQRIddoh0FOuhAp5A0MPW1+HI8Q7WnQ+IzakRYWObCH/iYhkjQXLHCwAtJVYq+XVmaEew==") returned 232 [0062.590] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x9, wMilliseconds=0x360)) [0062.590] GetCurrentThreadId () returned 0x970 [0062.590] GetCurrentThreadId () returned 0x970 [0062.590] GetCurrentThreadId () returned 0x970 [0062.590] GetCurrentThreadId () returned 0x970 [0062.590] GetCurrentThreadId () returned 0x970 [0062.590] GetCurrentThreadId () returned 0x970 [0062.590] GetCurrentThreadId () returned 0x970 [0062.590] GetCurrentThreadId () returned 0x970 [0062.590] GetCurrentThreadId () returned 0x970 [0062.590] GetCurrentThreadId () returned 0x970 [0062.590] GetCurrentThreadId () returned 0x970 [0062.590] GetCurrentThreadId () returned 0x970 [0062.590] GetCurrentThreadId () returned 0x970 [0062.590] GetCurrentThreadId () returned 0x970 [0062.590] GetCurrentThreadId () returned 0x970 [0062.590] GetCurrentThreadId () returned 0x970 [0062.590] GetCurrentThreadId () returned 0x970 [0062.590] GetCurrentThreadId () returned 0x970 [0062.590] GetCurrentThreadId () returned 0x970 [0062.590] GetCurrentThreadId () returned 0x970 [0062.590] GetCurrentThreadId () returned 0x970 [0062.590] GetCurrentThreadId () returned 0x970 [0062.590] GetCurrentThreadId () returned 0x970 [0062.590] GetCurrentThreadId () returned 0x970 [0062.590] GetCurrentThreadId () returned 0x970 [0062.590] GetCurrentThreadId () returned 0x970 [0062.590] GetCurrentThreadId () returned 0x970 [0062.590] GetCurrentThreadId () returned 0x970 [0062.590] GetCurrentThreadId () returned 0x970 [0062.590] GetCurrentThreadId () returned 0x970 [0062.590] GetCurrentThreadId () returned 0x970 [0062.590] GetCurrentThreadId () returned 0x970 [0062.590] GetCurrentThreadId () returned 0x970 [0062.591] GetCurrentThreadId () returned 0x970 [0062.591] GetCurrentThreadId () returned 0x970 [0062.591] GetCurrentThreadId () returned 0x970 [0062.591] GetCurrentThreadId () returned 0x970 [0062.591] GetCurrentThreadId () returned 0x970 [0062.591] GetCurrentThreadId () returned 0x970 [0062.591] GetCurrentThreadId () returned 0x970 [0062.591] GetCurrentThreadId () returned 0x970 [0062.591] GetCurrentThreadId () returned 0x970 [0062.591] GetCurrentThreadId () returned 0x970 [0062.591] GetCurrentThreadId () returned 0x970 [0062.591] GetCurrentThreadId () returned 0x970 [0062.591] GetCurrentThreadId () returned 0x970 [0062.591] GetCurrentThreadId () returned 0x970 [0062.591] GetCurrentThreadId () returned 0x970 [0062.591] GetCurrentThreadId () returned 0x970 [0062.591] GetCurrentThreadId () returned 0x970 [0062.591] GetCurrentThreadId () returned 0x970 [0062.591] GetCurrentThreadId () returned 0x970 [0062.591] GetCurrentThreadId () returned 0x970 [0062.591] GetCurrentThreadId () returned 0x970 [0062.591] GetCurrentThreadId () returned 0x970 [0062.591] GetCurrentThreadId () returned 0x970 [0062.591] GetCurrentThreadId () returned 0x970 [0062.591] GetCurrentThreadId () returned 0x970 [0062.591] GetCurrentThreadId () returned 0x970 [0062.591] GetCurrentThreadId () returned 0x970 [0062.591] GetCurrentThreadId () returned 0x970 [0062.591] GetCurrentThreadId () returned 0x970 [0062.591] GetCurrentThreadId () returned 0x970 [0062.591] GetCurrentThreadId () returned 0x970 [0062.591] GetCurrentThreadId () returned 0x970 [0062.591] GetCurrentThreadId () returned 0x970 [0062.591] GetCurrentThreadId () returned 0x970 [0062.591] GetCurrentThreadId () returned 0x970 [0062.591] GetCurrentThreadId () returned 0x970 [0062.591] GetCurrentThreadId () returned 0x970 [0062.591] GetCurrentThreadId () returned 0x970 [0062.591] GetCurrentThreadId () returned 0x970 [0062.591] GetCurrentThreadId () returned 0x970 [0062.591] GetCurrentThreadId () returned 0x970 [0062.591] GetCurrentThreadId () returned 0x970 [0062.591] GetCurrentThreadId () returned 0x970 [0062.591] GetCurrentThreadId () returned 0x970 [0062.591] GetCurrentThreadId () returned 0x970 [0062.591] GetCurrentThreadId () returned 0x970 [0062.592] GetCurrentThreadId () returned 0x970 [0062.592] GetCurrentThreadId () returned 0x970 [0062.592] GetCurrentThreadId () returned 0x970 [0062.592] GetCurrentThreadId () returned 0x970 [0062.592] GetCurrentThreadId () returned 0x970 [0062.592] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAFm/UyMKDZIG1C5MgzG3SjQTw97dX1Xu96yqHMDk66DKtZzpGUXy1WHQ+s2tKsgO0io/8M0LUV/9DIqR+u2xixgt0YN5DcYAzE2dKQeffWGmeKl73D+YzksIBh+UyYl6/3N2OZQWkylEptJB2dylcG6ZYm6OAkQRIddoh0FOuhAp5A0MPW1+HI8Q7WnQ+IzakRYWObCH/iYhkjQXLHCwAtJVYq+XVmaEew==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0062.592] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAFm/UyMKDZIG1C5MgzG3SjQTw97dX1Xu96yqHMDk66DKtZzpGUXy1WHQ+s2tKsgO0io/8M0LUV/9DIqR+u2xixgt0YN5DcYAzE2dKQeffWGmeKl73D+YzksIBh+UyYl6/3N2OZQWkylEptJB2dylcG6ZYm6OAkQRIddoh0FOuhAp5A0MPW1+HI8Q7WnQ+IzakRYWObCH/iYhkjQXLHCwAtJVYq+XVmaEew==", cchWideChar=245, lpMultiByteStr=0x353933c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAFm/UyMKDZIG1C5MgzG3SjQTw97dX1Xu96yqHMDk66DKtZzpGUXy1WHQ+s2tKsgO0io/8M0LUV/9DIqR+u2xixgt0YN5DcYAzE2dKQeffWGmeKl73D+YzksIBh+UyYl6/3N2OZQWkylEptJB2dylcG6ZYm6OAkQRIddoh0FOuhAp5A0MPW1+HI8Q7WnQ+IzakRYWObCH/iYhkjQXLHCwAtJVYq+XVmaEew==", lpUsedDefaultChar=0x0) returned 245 [0062.592] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0062.592] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0062.592] CloseHandle (hObject=0x158) returned 1 [0062.592] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png")) returned 1 [0062.593] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=18285645345) returned 1 [0062.593] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\Файл зашифрован [PREVIEW.GIF].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\Файл зашифрован [preview.gif].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0062.595] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0062.595] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0062.595] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0062.595] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0062.595] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0062.595] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0062.596] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0062.596] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0062.596] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0062.596] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0062.596] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0062.596] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0062.596] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0062.596] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0062.596] SetEndOfFile (hFile=0x158) returned 1 [0062.596] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0062.596] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0062.596] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0062.596] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0062.596] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0062.597] WriteFile (in: hFile=0x158, lpBuffer=0x35f011c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f011c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0062.597] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N30.tmP~T:R!2$oCXG*ToH(ieWlRvij.", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0062.597] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N30.tmP~T:R!2$oCXG*ToH(ieWlRvij.", cchWideChar=32, lpMultiByteStr=0x2035964, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N30.tmP~T:R!2$oCXG*ToH(ieWlRvij.", lpUsedDefaultChar=0x0) returned 32 [0062.597] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0062.597] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0062.597] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xf82, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 0x295098 [0062.598] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0062.598] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0062.598] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif")) returned 0x20 [0062.598] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif")) returned 0x20 [0062.598] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif")) returned 0x20 [0062.598] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif")) returned 0x20 [0062.598] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xf82)) returned 1 [0062.598] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0062.598] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0062.598] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif")) returned 0x20 [0062.598] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif")) returned 0x20 [0062.598] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0062.598] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0062.598] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0062.598] SetEndOfFile (hFile=0x158) returned 1 [0062.599] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0062.599] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe410c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0062.599] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0062.599] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe394c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0062.599] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe394c, cbMultiByte=11, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="PREVIEW.GIFGer.gifg") returned 11 [0062.599] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0062.600] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe410c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0062.600] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0062.600] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0062.600] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0xf82 [0062.600] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0062.600] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0062.600] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0062.600] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0062.600] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe410c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0062.600] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0062.600] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe394c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0062.600] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe394c, cbMultiByte=11, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="PREVIEW.GIFEW.GIFGer.gifg") returned 11 [0062.600] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0062.600] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe410c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0062.600] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0062.601] CharToOemA (in: pSrc="PREVIEW.GIF", pDst=0x1fe394c | out: pDst="PREVIEW.GIF") returned 1 [0062.601] WriteFile (in: hFile=0x158, lpBuffer=0x1fe394c*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe394c*, lpNumberOfBytesWritten=0x18e048*=0xb, lpOverlapped=0x0) returned 1 [0062.601] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0062.602] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0062.602] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0062.602] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=18286513987) returned 1 [0062.602] ReadFile (in: hFile=0x11c, lpBuffer=0x37b81a0, nNumberOfBytesToRead=0xf82, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37b81a0*, lpNumberOfBytesRead=0x18dd7c*=0xf82, lpOverlapped=0x0) returned 1 [0062.603] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0062.603] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=18286656718) returned 1 [0062.612] WriteFile (in: hFile=0x158, lpBuffer=0x1fea1e0*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fea1e0*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0062.612] ReadFile (in: hFile=0x11c, lpBuffer=0x37b81a0, nNumberOfBytesToRead=0xf82, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x37b81a0*, lpNumberOfBytesRead=0x18de38*=0xf82, lpOverlapped=0x0) returned 1 [0062.612] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x46 [0062.612] WriteFile (in: hFile=0x158, lpBuffer=0x37fa9c0*, nNumberOfBytesToWrite=0xf82, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x37fa9c0*, lpNumberOfBytesWritten=0x18de10*=0xf82, lpOverlapped=0x0) returned 1 [0062.612] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0xfc8 [0062.612] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0062.612] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0062.612] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0062.613] SetFilePointer (in: hFile=0x158, lDistanceToMove=11, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x29 [0062.613] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0xfd2 [0062.613] CloseHandle (hObject=0x11c) returned 1 [0062.613] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xfd2 [0062.613] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xfd2 [0062.613] SetFilePointer (in: hFile=0x158, lDistanceToMove=4050, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xfd2 [0062.613] SetFilePointer (in: hFile=0x158, lDistanceToMove=4050, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0xfd2 [0062.613] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xfd2 [0062.613] SetFilePointer (in: hFile=0x158, lDistanceToMove=4050, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0xfd2 [0062.613] SetEndOfFile (hFile=0x158) returned 1 [0062.613] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xfd2 [0062.613] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xfd2 [0062.613] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0062.613] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe410c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0062.614] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0062.614] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe41ac, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0062.614] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe41ac, cbMultiByte=11, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="PREVIEW.GIF\x18ꞗ@涤(\x18믉`믑`") returned 11 [0062.614] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0062.614] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe410c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0062.614] WriteFile (in: hFile=0x158, lpBuffer=0x379bc78*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x379bc78*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0062.614] CharToOemA (in: pSrc="PREVIEW.GIF", pDst=0x1fe41ac | out: pDst="PREVIEW.GIF") returned 1 [0062.614] WriteFile (in: hFile=0x158, lpBuffer=0x1fe41ac*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe41ac*, lpNumberOfBytesWritten=0x18efcc*=0xb, lpOverlapped=0x0) returned 1 [0062.614] WriteFile (in: hFile=0x158, lpBuffer=0x1fea170*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea170*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0062.614] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0062.614] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0062.614] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1016 [0062.614] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1016 [0062.614] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0062.614] WriteFile (in: hFile=0x158, lpBuffer=0x35f011c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f011c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0062.615] DeleteFileW (lpFileName="") returned 0 [0062.615] GetLastError () returned 0x3 [0062.615] GetFileAttributesW (lpFileName="") returned 0xffffffff [0062.615] SetLastError (dwErrCode=0x3) [0062.615] FlushFileBuffers (hFile=0x158) returned 1 [0062.617] GetCurrentThreadId () returned 0x970 [0062.617] GetCurrentThreadId () returned 0x970 [0062.617] GetCurrentThreadId () returned 0x970 [0062.617] GetCurrentThreadId () returned 0x970 [0062.617] GetCurrentThreadId () returned 0x970 [0062.617] GetCurrentThreadId () returned 0x970 [0062.617] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x10cd [0062.617] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x10cd [0062.617] SetFilePointer (in: hFile=0x158, lDistanceToMove=4301, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x10cd [0062.617] CloseHandle (hObject=0x158) returned 1 [0062.617] GetCurrentThreadId () returned 0x970 [0062.617] GetCurrentThreadId () returned 0x970 [0062.617] GetCurrentThreadId () returned 0x970 [0062.618] GetCurrentThreadId () returned 0x970 [0062.618] GetCurrentThreadId () returned 0x970 [0062.618] GetCurrentThreadId () returned 0x970 [0062.618] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\Файл зашифрован [PREVIEW.GIF].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\Файл зашифрован [preview.gif].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0062.618] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10cd [0062.618] SetFilePointer (in: hFile=0x158, lDistanceToMove=4173, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x104d [0062.618] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0062.618] GetFileType (hFile=0x158) returned 0x1 [0062.618] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x9, wMilliseconds=0x380)) [0062.618] GetCurrentThreadId () returned 0x970 [0062.618] GetCurrentThreadId () returned 0x970 [0062.618] GetCurrentThreadId () returned 0x970 [0062.618] GetCurrentThreadId () returned 0x970 [0062.618] GetCurrentThreadId () returned 0x970 [0062.618] GetCurrentThreadId () returned 0x970 [0062.618] GetCurrentThreadId () returned 0x970 [0062.618] GetCurrentThreadId () returned 0x970 [0062.618] GetCurrentThreadId () returned 0x970 [0062.618] GetCurrentThreadId () returned 0x970 [0062.618] GetCurrentThreadId () returned 0x970 [0062.618] GetCurrentThreadId () returned 0x970 [0062.618] GetCurrentThreadId () returned 0x970 [0062.618] GetCurrentThreadId () returned 0x970 [0062.618] GetCurrentThreadId () returned 0x970 [0062.618] GetCurrentThreadId () returned 0x970 [0062.618] GetCurrentThreadId () returned 0x970 [0062.618] GetCurrentThreadId () returned 0x970 [0062.618] GetCurrentThreadId () returned 0x970 [0062.618] GetCurrentThreadId () returned 0x970 [0062.618] GetCurrentThreadId () returned 0x970 [0062.618] GetCurrentThreadId () returned 0x970 [0062.618] GetCurrentThreadId () returned 0x970 [0062.618] GetCurrentThreadId () returned 0x970 [0062.618] GetCurrentThreadId () returned 0x970 [0062.619] GetCurrentThreadId () returned 0x970 [0062.619] GetCurrentThreadId () returned 0x970 [0062.619] GetCurrentThreadId () returned 0x970 [0062.619] GetCurrentThreadId () returned 0x970 [0062.619] GetCurrentThreadId () returned 0x970 [0062.619] GetCurrentThreadId () returned 0x970 [0062.619] GetCurrentThreadId () returned 0x970 [0062.619] GetCurrentThreadId () returned 0x970 [0062.619] GetCurrentThreadId () returned 0x970 [0062.619] GetCurrentThreadId () returned 0x970 [0062.619] GetCurrentThreadId () returned 0x970 [0062.619] GetCurrentThreadId () returned 0x970 [0062.619] GetCurrentThreadId () returned 0x970 [0062.619] GetCurrentThreadId () returned 0x970 [0062.619] GetCurrentThreadId () returned 0x970 [0062.619] GetCurrentThreadId () returned 0x970 [0062.619] GetCurrentThreadId () returned 0x970 [0062.619] GetCurrentThreadId () returned 0x970 [0062.619] GetCurrentThreadId () returned 0x970 [0062.619] GetCurrentThreadId () returned 0x970 [0062.619] GetCurrentThreadId () returned 0x970 [0062.619] GetCurrentThreadId () returned 0x970 [0062.619] GetCurrentThreadId () returned 0x970 [0062.619] GetCurrentThreadId () returned 0x970 [0062.619] GetCurrentThreadId () returned 0x970 [0062.619] GetCurrentThreadId () returned 0x970 [0062.619] GetCurrentThreadId () returned 0x970 [0062.619] GetCurrentThreadId () returned 0x970 [0062.619] GetCurrentThreadId () returned 0x970 [0062.619] GetCurrentThreadId () returned 0x970 [0062.619] GetCurrentThreadId () returned 0x970 [0062.619] GetCurrentThreadId () returned 0x970 [0062.619] GetCurrentThreadId () returned 0x970 [0062.619] GetCurrentThreadId () returned 0x970 [0062.619] GetCurrentThreadId () returned 0x970 [0062.619] GetCurrentThreadId () returned 0x970 [0062.619] GetCurrentThreadId () returned 0x970 [0062.619] GetCurrentThreadId () returned 0x970 [0062.619] GetCurrentThreadId () returned 0x970 [0062.619] GetCurrentThreadId () returned 0x970 [0062.619] GetCurrentThreadId () returned 0x970 [0062.619] GetCurrentThreadId () returned 0x970 [0062.619] GetCurrentThreadId () returned 0x970 [0062.619] GetCurrentThreadId () returned 0x970 [0062.619] GetCurrentThreadId () returned 0x970 [0062.619] GetCurrentThreadId () returned 0x970 [0062.620] GetCurrentThreadId () returned 0x970 [0062.620] GetCurrentThreadId () returned 0x970 [0062.620] GetCurrentThreadId () returned 0x970 [0062.620] GetCurrentThreadId () returned 0x970 [0062.620] GetCurrentThreadId () returned 0x970 [0062.620] GetCurrentThreadId () returned 0x970 [0062.620] GetCurrentThreadId () returned 0x970 [0062.620] GetCurrentThreadId () returned 0x970 [0062.620] GetCurrentThreadId () returned 0x970 [0062.620] GetCurrentThreadId () returned 0x970 [0062.620] GetCurrentThreadId () returned 0x970 [0062.620] GetCurrentThreadId () returned 0x970 [0062.620] GetCurrentThreadId () returned 0x970 [0062.620] GetCurrentThreadId () returned 0x970 [0062.620] GetCurrentThreadId () returned 0x970 [0062.620] GetCurrentThreadId () returned 0x970 [0062.620] GetCurrentThreadId () returned 0x970 [0062.620] GetCurrentThreadId () returned 0x970 [0062.620] GetCurrentThreadId () returned 0x970 [0062.620] GetCurrentThreadId () returned 0x970 [0062.620] GetCurrentThreadId () returned 0x970 [0062.620] GetCurrentThreadId () returned 0x970 [0062.620] GetCurrentThreadId () returned 0x970 [0062.620] GetCurrentThreadId () returned 0x970 [0062.620] GetCurrentThreadId () returned 0x970 [0062.620] GetCurrentThreadId () returned 0x970 [0062.620] GetCurrentThreadId () returned 0x970 [0062.620] GetCurrentThreadId () returned 0x970 [0062.620] GetCurrentThreadId () returned 0x970 [0062.620] GetCurrentThreadId () returned 0x970 [0062.620] GetCurrentThreadId () returned 0x970 [0062.620] GetCurrentThreadId () returned 0x970 [0062.620] GetCurrentThreadId () returned 0x970 [0062.620] GetCurrentThreadId () returned 0x970 [0062.620] GetCurrentThreadId () returned 0x970 [0062.620] GetCurrentThreadId () returned 0x970 [0062.620] GetCurrentThreadId () returned 0x970 [0062.620] GetCurrentThreadId () returned 0x970 [0062.620] GetCurrentThreadId () returned 0x970 [0062.620] GetCurrentThreadId () returned 0x970 [0062.620] GetCurrentThreadId () returned 0x970 [0062.620] GetCurrentThreadId () returned 0x970 [0062.620] GetCurrentThreadId () returned 0x970 [0062.620] GetCurrentThreadId () returned 0x970 [0062.620] GetCurrentThreadId () returned 0x970 [0062.620] GetCurrentThreadId () returned 0x970 [0062.621] GetCurrentThreadId () returned 0x970 [0062.621] GetCurrentThreadId () returned 0x970 [0062.621] GetCurrentThreadId () returned 0x970 [0062.621] GetCurrentThreadId () returned 0x970 [0062.621] GetCurrentThreadId () returned 0x970 [0062.621] GetCurrentThreadId () returned 0x970 [0062.621] GetCurrentThreadId () returned 0x970 [0062.621] GetCurrentThreadId () returned 0x970 [0062.621] GetCurrentThreadId () returned 0x970 [0062.621] GetCurrentThreadId () returned 0x970 [0062.621] GetCurrentThreadId () returned 0x970 [0062.621] GetCurrentThreadId () returned 0x970 [0062.621] GetCurrentThreadId () returned 0x970 [0062.621] GetCurrentThreadId () returned 0x970 [0062.621] GetCurrentThreadId () returned 0x970 [0062.621] GetCurrentThreadId () returned 0x970 [0062.621] GetCurrentThreadId () returned 0x970 [0062.621] GetCurrentThreadId () returned 0x970 [0062.621] GetCurrentThreadId () returned 0x970 [0062.621] GetCurrentThreadId () returned 0x970 [0062.621] GetCurrentThreadId () returned 0x970 [0062.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff05f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff05f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff0650, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.622] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff0650, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.622] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.622] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.622] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff0650, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.622] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x9, wMilliseconds=0x380)) [0062.622] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N30.tmP~T:R!2$oCXG*ToH(ieWlRvij.", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0062.622] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N30.tmP~T:R!2$oCXG*ToH(ieWlRvij.", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0062.622] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N30.tmP~T:R!2$oCXG*ToH(ieWlRvij.", cchWideChar=32, lpMultiByteStr=0x20024e8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N30.tmP~T:R!2$oCXG*ToH(ieWlRvij.", lpUsedDefaultChar=0x0) returned 32 [0062.622] GetCurrentThreadId () returned 0x970 [0062.622] GetCurrentThreadId () returned 0x970 [0062.622] GetCurrentThreadId () returned 0x970 [0062.622] GetCurrentThreadId () returned 0x970 [0062.622] GetCurrentThreadId () returned 0x970 [0062.622] GetCurrentThreadId () returned 0x970 [0062.629] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0062.629] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0062.629] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3795288, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0062.629] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0062.629] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAABS95G3ov3eyH0xdvYstr5jbtL/3F/75DPUMEuCKO6Qow9yDXAATZNSJO+k6YIsqIfsnGCLreHJOhwr0vDKbmS8nNHgxIwp6lliX54o048O7JJnsjVPEpJNWE9b+M+l2+8IZ0gH1Ou9GnFJr2Kh3z6Gx/DO1eaSMVpMGPuEqLhpF9O9wScXLP2zqO70Yi4SFpYGjbphQHfwg4A48MkkfoWdwFRMJi9+2Gg==") returned 232 [0062.629] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x9, wMilliseconds=0x380)) [0062.629] GetCurrentThreadId () returned 0x970 [0062.629] GetCurrentThreadId () returned 0x970 [0062.629] GetCurrentThreadId () returned 0x970 [0062.629] GetCurrentThreadId () returned 0x970 [0062.629] GetCurrentThreadId () returned 0x970 [0062.630] GetCurrentThreadId () returned 0x970 [0062.630] GetCurrentThreadId () returned 0x970 [0062.630] GetCurrentThreadId () returned 0x970 [0062.630] GetCurrentThreadId () returned 0x970 [0062.630] GetCurrentThreadId () returned 0x970 [0062.630] GetCurrentThreadId () returned 0x970 [0062.630] GetCurrentThreadId () returned 0x970 [0062.630] GetCurrentThreadId () returned 0x970 [0062.630] GetCurrentThreadId () returned 0x970 [0062.630] GetCurrentThreadId () returned 0x970 [0062.630] GetCurrentThreadId () returned 0x970 [0062.630] GetCurrentThreadId () returned 0x970 [0062.630] GetCurrentThreadId () returned 0x970 [0062.630] GetCurrentThreadId () returned 0x970 [0062.630] GetCurrentThreadId () returned 0x970 [0062.630] GetCurrentThreadId () returned 0x970 [0062.630] GetCurrentThreadId () returned 0x970 [0062.630] GetCurrentThreadId () returned 0x970 [0062.630] GetCurrentThreadId () returned 0x970 [0062.630] GetCurrentThreadId () returned 0x970 [0062.630] GetCurrentThreadId () returned 0x970 [0062.630] GetCurrentThreadId () returned 0x970 [0062.630] GetCurrentThreadId () returned 0x970 [0062.630] GetCurrentThreadId () returned 0x970 [0062.630] GetCurrentThreadId () returned 0x970 [0062.630] GetCurrentThreadId () returned 0x970 [0062.630] GetCurrentThreadId () returned 0x970 [0062.630] GetCurrentThreadId () returned 0x970 [0062.630] GetCurrentThreadId () returned 0x970 [0062.630] GetCurrentThreadId () returned 0x970 [0062.630] GetCurrentThreadId () returned 0x970 [0062.630] GetCurrentThreadId () returned 0x970 [0062.630] GetCurrentThreadId () returned 0x970 [0062.630] GetCurrentThreadId () returned 0x970 [0062.630] GetCurrentThreadId () returned 0x970 [0062.630] GetCurrentThreadId () returned 0x970 [0062.630] GetCurrentThreadId () returned 0x970 [0062.630] GetCurrentThreadId () returned 0x970 [0062.630] GetCurrentThreadId () returned 0x970 [0062.630] GetCurrentThreadId () returned 0x970 [0062.630] GetCurrentThreadId () returned 0x970 [0062.630] GetCurrentThreadId () returned 0x970 [0062.630] GetCurrentThreadId () returned 0x970 [0062.630] GetCurrentThreadId () returned 0x970 [0062.630] GetCurrentThreadId () returned 0x970 [0062.630] GetCurrentThreadId () returned 0x970 [0062.631] GetCurrentThreadId () returned 0x970 [0062.631] GetCurrentThreadId () returned 0x970 [0062.631] GetCurrentThreadId () returned 0x970 [0062.631] GetCurrentThreadId () returned 0x970 [0062.631] GetCurrentThreadId () returned 0x970 [0062.631] GetCurrentThreadId () returned 0x970 [0062.631] GetCurrentThreadId () returned 0x970 [0062.631] GetCurrentThreadId () returned 0x970 [0062.631] GetCurrentThreadId () returned 0x970 [0062.631] GetCurrentThreadId () returned 0x970 [0062.631] GetCurrentThreadId () returned 0x970 [0062.631] GetCurrentThreadId () returned 0x970 [0062.631] GetCurrentThreadId () returned 0x970 [0062.631] GetCurrentThreadId () returned 0x970 [0062.631] GetCurrentThreadId () returned 0x970 [0062.631] GetCurrentThreadId () returned 0x970 [0062.631] GetCurrentThreadId () returned 0x970 [0062.631] GetCurrentThreadId () returned 0x970 [0062.631] GetCurrentThreadId () returned 0x970 [0062.631] GetCurrentThreadId () returned 0x970 [0062.631] GetCurrentThreadId () returned 0x970 [0062.631] GetCurrentThreadId () returned 0x970 [0062.631] GetCurrentThreadId () returned 0x970 [0062.631] GetCurrentThreadId () returned 0x970 [0062.631] GetCurrentThreadId () returned 0x970 [0062.631] GetCurrentThreadId () returned 0x970 [0062.631] GetCurrentThreadId () returned 0x970 [0062.631] GetCurrentThreadId () returned 0x970 [0062.631] GetCurrentThreadId () returned 0x970 [0062.631] GetCurrentThreadId () returned 0x970 [0062.631] GetCurrentThreadId () returned 0x970 [0062.631] GetCurrentThreadId () returned 0x970 [0062.631] GetCurrentThreadId () returned 0x970 [0062.631] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAABS95G3ov3eyH0xdvYstr5jbtL/3F/75DPUMEuCKO6Qow9yDXAATZNSJO+k6YIsqIfsnGCLreHJOhwr0vDKbmS8nNHgxIwp6lliX54o048O7JJnsjVPEpJNWE9b+M+l2+8IZ0gH1Ou9GnFJr2Kh3z6Gx/DO1eaSMVpMGPuEqLhpF9O9wScXLP2zqO70Yi4SFpYGjbphQHfwg4A48MkkfoWdwFRMJi9+2Gg==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0062.631] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAABS95G3ov3eyH0xdvYstr5jbtL/3F/75DPUMEuCKO6Qow9yDXAATZNSJO+k6YIsqIfsnGCLreHJOhwr0vDKbmS8nNHgxIwp6lliX54o048O7JJnsjVPEpJNWE9b+M+l2+8IZ0gH1Ou9GnFJr2Kh3z6Gx/DO1eaSMVpMGPuEqLhpF9O9wScXLP2zqO70Yi4SFpYGjbphQHfwg4A48MkkfoWdwFRMJi9+2Gg==", cchWideChar=245, lpMultiByteStr=0x353933c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAABS95G3ov3eyH0xdvYstr5jbtL/3F/75DPUMEuCKO6Qow9yDXAATZNSJO+k6YIsqIfsnGCLreHJOhwr0vDKbmS8nNHgxIwp6lliX54o048O7JJnsjVPEpJNWE9b+M+l2+8IZ0gH1Ou9GnFJr2Kh3z6Gx/DO1eaSMVpMGPuEqLhpF9O9wScXLP2zqO70Yi4SFpYGjbphQHfwg4A48MkkfoWdwFRMJi9+2Gg==", lpUsedDefaultChar=0x0) returned 245 [0062.631] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0062.631] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0062.632] CloseHandle (hObject=0x158) returned 1 [0062.632] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif")) returned 1 [0062.633] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=18289640077) returned 1 [0062.633] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\Файл зашифрован [THMBNAIL.PNG].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\Файл зашифрован [thmbnail.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0062.633] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0062.633] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0062.634] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0062.634] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0062.634] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0062.634] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0062.634] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0062.634] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0062.634] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0062.634] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0062.634] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0062.634] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0062.634] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0062.634] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0062.634] SetEndOfFile (hFile=0x158) returned 1 [0062.634] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0062.634] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0062.634] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0062.634] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0062.635] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0062.635] WriteFile (in: hFile=0x158, lpBuffer=0x35f01dc*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f01dc*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0062.635] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="KA^t7?o-58U2{koO*0Tm2ofODcH8Ml1h", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0062.636] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="KA^t7?o-58U2{koO*0Tm2ofODcH8Ml1h", cchWideChar=32, lpMultiByteStr=0x203599c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="KA^t7?o-58U2{koO*0Tm2ofODcH8Ml1h", lpUsedDefaultChar=0x0) returned 32 [0062.636] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0062.636] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0062.636] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xcf7b, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0x295098 [0062.636] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0062.636] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0062.636] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png")) returned 0x20 [0062.636] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png")) returned 0x20 [0062.636] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png")) returned 0x20 [0062.636] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png")) returned 0x20 [0062.636] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xcf7b)) returned 1 [0062.636] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0062.636] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0062.636] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png")) returned 0x20 [0062.636] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png")) returned 0x20 [0062.636] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0062.637] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0062.637] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0062.637] SetEndOfFile (hFile=0x158) returned 1 [0062.637] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0062.637] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe370c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0062.638] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0062.638] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe39ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0062.638] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe39ec, cbMultiByte=12, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="THMBNAIL.PNGer.gifg") returned 12 [0062.638] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0062.638] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe370c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0062.638] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0062.638] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0062.638] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0xcf7b [0062.638] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0062.638] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0062.638] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0062.638] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0062.638] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe370c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0062.638] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0062.638] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe39ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0062.638] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe39ec, cbMultiByte=12, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="THMBNAIL.PNGIL.PNGer.gifg") returned 12 [0062.639] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0062.639] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe370c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0062.639] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0062.639] CharToOemA (in: pSrc="THMBNAIL.PNG", pDst=0x1fe39ec | out: pDst="THMBNAIL.PNG") returned 1 [0062.639] WriteFile (in: hFile=0x158, lpBuffer=0x1fe39ec*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe39ec*, lpNumberOfBytesWritten=0x18e048*=0xc, lpOverlapped=0x0) returned 1 [0062.640] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0062.640] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0062.640] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0062.640] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=18290325525) returned 1 [0062.640] ReadFile (in: hFile=0x11c, lpBuffer=0x37b81a0, nNumberOfBytesToRead=0xcf7b, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37b81a0*, lpNumberOfBytesRead=0x18dd7c*=0xcf7b, lpOverlapped=0x0) returned 1 [0062.642] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0062.642] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=18290548311) returned 1 [0062.651] WriteFile (in: hFile=0x158, lpBuffer=0x1fea180*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fea180*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0062.651] ReadFile (in: hFile=0x11c, lpBuffer=0x37b81a0, nNumberOfBytesToRead=0xcf7b, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x37b81a0*, lpNumberOfBytesRead=0x18de38*=0xcf7b, lpOverlapped=0x0) returned 1 [0062.652] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x47 [0062.652] WriteFile (in: hFile=0x158, lpBuffer=0x38069c0*, nNumberOfBytesToWrite=0xcf7b, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x38069c0*, lpNumberOfBytesWritten=0x18de10*=0xcf7b, lpOverlapped=0x0) returned 1 [0062.653] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0xcfc2 [0062.653] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0062.653] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0062.653] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0062.654] SetFilePointer (in: hFile=0x158, lDistanceToMove=12, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2a [0062.654] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0xcfcc [0062.654] CloseHandle (hObject=0x11c) returned 1 [0062.654] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xcfcc [0062.654] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xcfcc [0062.654] SetFilePointer (in: hFile=0x158, lDistanceToMove=53196, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xcfcc [0062.654] SetFilePointer (in: hFile=0x158, lDistanceToMove=53196, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0xcfcc [0062.654] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xcfcc [0062.654] SetFilePointer (in: hFile=0x158, lDistanceToMove=53196, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0xcfcc [0062.654] SetEndOfFile (hFile=0x158) returned 1 [0062.654] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xcfcc [0062.654] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xcfcc [0062.654] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0062.654] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe370c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0062.654] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0062.655] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe37ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0062.655] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe37ec, cbMultiByte=12, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="THMBNAIL.PNGꞗ@涤(\x18믉`믑`") returned 12 [0062.655] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0062.655] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe370c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0062.655] WriteFile (in: hFile=0x158, lpBuffer=0x379bc78*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x379bc78*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0062.655] CharToOemA (in: pSrc="THMBNAIL.PNG", pDst=0x1fe37ec | out: pDst="THMBNAIL.PNG") returned 1 [0062.655] WriteFile (in: hFile=0x158, lpBuffer=0x1fe37ec*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe37ec*, lpNumberOfBytesWritten=0x18efcc*=0xc, lpOverlapped=0x0) returned 1 [0062.655] WriteFile (in: hFile=0x158, lpBuffer=0x1fea110*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea110*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0062.655] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0062.655] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0062.655] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xd011 [0062.655] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xd011 [0062.655] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0062.655] WriteFile (in: hFile=0x158, lpBuffer=0x35f01dc*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f01dc*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0062.656] DeleteFileW (lpFileName="") returned 0 [0062.656] GetLastError () returned 0x3 [0062.656] GetFileAttributesW (lpFileName="") returned 0xffffffff [0062.656] SetLastError (dwErrCode=0x3) [0062.656] FlushFileBuffers (hFile=0x158) returned 1 [0062.658] GetCurrentThreadId () returned 0x970 [0062.658] GetCurrentThreadId () returned 0x970 [0062.658] GetCurrentThreadId () returned 0x970 [0062.658] GetCurrentThreadId () returned 0x970 [0062.658] GetCurrentThreadId () returned 0x970 [0062.658] GetCurrentThreadId () returned 0x970 [0062.658] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xd0c8 [0062.659] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xd0c8 [0062.659] SetFilePointer (in: hFile=0x158, lDistanceToMove=53448, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xd0c8 [0062.659] CloseHandle (hObject=0x158) returned 1 [0062.659] GetCurrentThreadId () returned 0x970 [0062.659] GetCurrentThreadId () returned 0x970 [0062.659] GetCurrentThreadId () returned 0x970 [0062.659] GetCurrentThreadId () returned 0x970 [0062.659] GetCurrentThreadId () returned 0x970 [0062.659] GetCurrentThreadId () returned 0x970 [0062.659] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\Файл зашифрован [THMBNAIL.PNG].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\Файл зашифрован [thmbnail.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0062.659] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd0c8 [0062.659] SetFilePointer (in: hFile=0x158, lDistanceToMove=53320, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd048 [0062.659] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0062.659] GetFileType (hFile=0x158) returned 0x1 [0062.659] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x9, wMilliseconds=0x39f)) [0062.659] GetCurrentThreadId () returned 0x970 [0062.659] GetCurrentThreadId () returned 0x970 [0062.659] GetCurrentThreadId () returned 0x970 [0062.659] GetCurrentThreadId () returned 0x970 [0062.659] GetCurrentThreadId () returned 0x970 [0062.659] GetCurrentThreadId () returned 0x970 [0062.659] GetCurrentThreadId () returned 0x970 [0062.659] GetCurrentThreadId () returned 0x970 [0062.659] GetCurrentThreadId () returned 0x970 [0062.659] GetCurrentThreadId () returned 0x970 [0062.659] GetCurrentThreadId () returned 0x970 [0062.659] GetCurrentThreadId () returned 0x970 [0062.659] GetCurrentThreadId () returned 0x970 [0062.660] GetCurrentThreadId () returned 0x970 [0062.660] GetCurrentThreadId () returned 0x970 [0062.660] GetCurrentThreadId () returned 0x970 [0062.660] GetCurrentThreadId () returned 0x970 [0062.660] GetCurrentThreadId () returned 0x970 [0062.660] GetCurrentThreadId () returned 0x970 [0062.660] GetCurrentThreadId () returned 0x970 [0062.660] GetCurrentThreadId () returned 0x970 [0062.660] GetCurrentThreadId () returned 0x970 [0062.660] GetCurrentThreadId () returned 0x970 [0062.660] GetCurrentThreadId () returned 0x970 [0062.660] GetCurrentThreadId () returned 0x970 [0062.660] GetCurrentThreadId () returned 0x970 [0062.660] GetCurrentThreadId () returned 0x970 [0062.660] GetCurrentThreadId () returned 0x970 [0062.660] GetCurrentThreadId () returned 0x970 [0062.660] GetCurrentThreadId () returned 0x970 [0062.660] GetCurrentThreadId () returned 0x970 [0062.660] GetCurrentThreadId () returned 0x970 [0062.660] GetCurrentThreadId () returned 0x970 [0062.660] GetCurrentThreadId () returned 0x970 [0062.660] GetCurrentThreadId () returned 0x970 [0062.660] GetCurrentThreadId () returned 0x970 [0062.660] GetCurrentThreadId () returned 0x970 [0062.660] GetCurrentThreadId () returned 0x970 [0062.660] GetCurrentThreadId () returned 0x970 [0062.660] GetCurrentThreadId () returned 0x970 [0062.660] GetCurrentThreadId () returned 0x970 [0062.660] GetCurrentThreadId () returned 0x970 [0062.660] GetCurrentThreadId () returned 0x970 [0062.660] GetCurrentThreadId () returned 0x970 [0062.660] GetCurrentThreadId () returned 0x970 [0062.660] GetCurrentThreadId () returned 0x970 [0062.660] GetCurrentThreadId () returned 0x970 [0062.660] GetCurrentThreadId () returned 0x970 [0062.660] GetCurrentThreadId () returned 0x970 [0062.660] GetCurrentThreadId () returned 0x970 [0062.660] GetCurrentThreadId () returned 0x970 [0062.660] GetCurrentThreadId () returned 0x970 [0062.660] GetCurrentThreadId () returned 0x970 [0062.660] GetCurrentThreadId () returned 0x970 [0062.660] GetCurrentThreadId () returned 0x970 [0062.660] GetCurrentThreadId () returned 0x970 [0062.660] GetCurrentThreadId () returned 0x970 [0062.660] GetCurrentThreadId () returned 0x970 [0062.661] GetCurrentThreadId () returned 0x970 [0062.661] GetCurrentThreadId () returned 0x970 [0062.661] GetCurrentThreadId () returned 0x970 [0062.661] GetCurrentThreadId () returned 0x970 [0062.661] GetCurrentThreadId () returned 0x970 [0062.661] GetCurrentThreadId () returned 0x970 [0062.661] GetCurrentThreadId () returned 0x970 [0062.661] GetCurrentThreadId () returned 0x970 [0062.661] GetCurrentThreadId () returned 0x970 [0062.661] GetCurrentThreadId () returned 0x970 [0062.661] GetCurrentThreadId () returned 0x970 [0062.661] GetCurrentThreadId () returned 0x970 [0062.661] GetCurrentThreadId () returned 0x970 [0062.661] GetCurrentThreadId () returned 0x970 [0062.661] GetCurrentThreadId () returned 0x970 [0062.661] GetCurrentThreadId () returned 0x970 [0062.661] GetCurrentThreadId () returned 0x970 [0062.661] GetCurrentThreadId () returned 0x970 [0062.661] GetCurrentThreadId () returned 0x970 [0062.661] GetCurrentThreadId () returned 0x970 [0062.661] GetCurrentThreadId () returned 0x970 [0062.661] GetCurrentThreadId () returned 0x970 [0062.661] GetCurrentThreadId () returned 0x970 [0062.661] GetCurrentThreadId () returned 0x970 [0062.661] GetCurrentThreadId () returned 0x970 [0062.661] GetCurrentThreadId () returned 0x970 [0062.661] GetCurrentThreadId () returned 0x970 [0062.661] GetCurrentThreadId () returned 0x970 [0062.661] GetCurrentThreadId () returned 0x970 [0062.661] GetCurrentThreadId () returned 0x970 [0062.661] GetCurrentThreadId () returned 0x970 [0062.661] GetCurrentThreadId () returned 0x970 [0062.661] GetCurrentThreadId () returned 0x970 [0062.661] GetCurrentThreadId () returned 0x970 [0062.661] GetCurrentThreadId () returned 0x970 [0062.661] GetCurrentThreadId () returned 0x970 [0062.661] GetCurrentThreadId () returned 0x970 [0062.661] GetCurrentThreadId () returned 0x970 [0062.661] GetCurrentThreadId () returned 0x970 [0062.661] GetCurrentThreadId () returned 0x970 [0062.661] GetCurrentThreadId () returned 0x970 [0062.661] GetCurrentThreadId () returned 0x970 [0062.661] GetCurrentThreadId () returned 0x970 [0062.661] GetCurrentThreadId () returned 0x970 [0062.661] GetCurrentThreadId () returned 0x970 [0062.662] GetCurrentThreadId () returned 0x970 [0062.662] GetCurrentThreadId () returned 0x970 [0062.662] GetCurrentThreadId () returned 0x970 [0062.662] GetCurrentThreadId () returned 0x970 [0062.662] GetCurrentThreadId () returned 0x970 [0062.662] GetCurrentThreadId () returned 0x970 [0062.662] GetCurrentThreadId () returned 0x970 [0062.662] GetCurrentThreadId () returned 0x970 [0062.662] GetCurrentThreadId () returned 0x970 [0062.662] GetCurrentThreadId () returned 0x970 [0062.662] GetCurrentThreadId () returned 0x970 [0062.662] GetCurrentThreadId () returned 0x970 [0062.662] GetCurrentThreadId () returned 0x970 [0062.662] GetCurrentThreadId () returned 0x970 [0062.662] GetCurrentThreadId () returned 0x970 [0062.662] GetCurrentThreadId () returned 0x970 [0062.662] GetCurrentThreadId () returned 0x970 [0062.662] GetCurrentThreadId () returned 0x970 [0062.662] GetCurrentThreadId () returned 0x970 [0062.662] GetCurrentThreadId () returned 0x970 [0062.662] GetCurrentThreadId () returned 0x970 [0062.662] GetCurrentThreadId () returned 0x970 [0062.662] GetCurrentThreadId () returned 0x970 [0062.662] GetCurrentThreadId () returned 0x970 [0062.662] GetCurrentThreadId () returned 0x970 [0062.662] GetCurrentThreadId () returned 0x970 [0062.662] GetCurrentThreadId () returned 0x970 [0062.662] GetCurrentThreadId () returned 0x970 [0062.662] GetCurrentThreadId () returned 0x970 [0062.662] GetCurrentThreadId () returned 0x970 [0062.662] GetCurrentThreadId () returned 0x970 [0062.662] GetCurrentThreadId () returned 0x970 [0062.662] GetCurrentThreadId () returned 0x970 [0062.662] GetCurrentThreadId () returned 0x970 [0062.662] GetCurrentThreadId () returned 0x970 [0062.662] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.662] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.662] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff0650, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.662] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.662] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.662] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff0650, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.663] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.663] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.663] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.663] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.663] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.663] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.663] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.663] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.663] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff06b0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.663] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.663] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.663] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff06b0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.663] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.663] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.663] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff06b0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.663] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x9, wMilliseconds=0x39f)) [0062.663] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KA^t7?o-58U2{koO*0Tm2ofODcH8Ml1h", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0062.663] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KA^t7?o-58U2{koO*0Tm2ofODcH8Ml1h", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0062.663] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KA^t7?o-58U2{koO*0Tm2ofODcH8Ml1h", cchWideChar=32, lpMultiByteStr=0x2003178, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="KA^t7?o-58U2{koO*0Tm2ofODcH8Ml1h", lpUsedDefaultChar=0x0) returned 32 [0062.663] GetCurrentThreadId () returned 0x970 [0062.663] GetCurrentThreadId () returned 0x970 [0062.663] GetCurrentThreadId () returned 0x970 [0062.663] GetCurrentThreadId () returned 0x970 [0062.663] GetCurrentThreadId () returned 0x970 [0062.663] GetCurrentThreadId () returned 0x970 [0062.671] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0062.671] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0062.671] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3795378, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0062.671] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0062.671] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAEzqZrkHVdXc1S550OafVN2jXlP/eTY6LUBLi0L7Qql2NmumEktenkSvCQVvOXMohNFIzEHA//ZdAY4Rnn/UKtzRCfXW2f8IE8rrVGJ3bSGP0HhWx+kEeHHao7Vwdw93J5G+9Pk6GFuXQBNmixkir5fnu/X+h4pmoSzKmEdfo+njbeTrC0wHH4jhRsuNin8cGMMy6xwONsJhCJ7qPQeGwlnP3Fce6kk0+g==") returned 232 [0062.671] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x9, wMilliseconds=0x3ae)) [0062.671] GetCurrentThreadId () returned 0x970 [0062.671] GetCurrentThreadId () returned 0x970 [0062.671] GetCurrentThreadId () returned 0x970 [0062.671] GetCurrentThreadId () returned 0x970 [0062.671] GetCurrentThreadId () returned 0x970 [0062.671] GetCurrentThreadId () returned 0x970 [0062.671] GetCurrentThreadId () returned 0x970 [0062.671] GetCurrentThreadId () returned 0x970 [0062.671] GetCurrentThreadId () returned 0x970 [0062.671] GetCurrentThreadId () returned 0x970 [0062.671] GetCurrentThreadId () returned 0x970 [0062.671] GetCurrentThreadId () returned 0x970 [0062.671] GetCurrentThreadId () returned 0x970 [0062.672] GetCurrentThreadId () returned 0x970 [0062.672] GetCurrentThreadId () returned 0x970 [0062.672] GetCurrentThreadId () returned 0x970 [0062.672] GetCurrentThreadId () returned 0x970 [0062.672] GetCurrentThreadId () returned 0x970 [0062.672] GetCurrentThreadId () returned 0x970 [0062.672] GetCurrentThreadId () returned 0x970 [0062.672] GetCurrentThreadId () returned 0x970 [0062.672] GetCurrentThreadId () returned 0x970 [0062.672] GetCurrentThreadId () returned 0x970 [0062.672] GetCurrentThreadId () returned 0x970 [0062.672] GetCurrentThreadId () returned 0x970 [0062.672] GetCurrentThreadId () returned 0x970 [0062.672] GetCurrentThreadId () returned 0x970 [0062.672] GetCurrentThreadId () returned 0x970 [0062.672] GetCurrentThreadId () returned 0x970 [0062.672] GetCurrentThreadId () returned 0x970 [0062.672] GetCurrentThreadId () returned 0x970 [0062.672] GetCurrentThreadId () returned 0x970 [0062.672] GetCurrentThreadId () returned 0x970 [0062.672] GetCurrentThreadId () returned 0x970 [0062.672] GetCurrentThreadId () returned 0x970 [0062.672] GetCurrentThreadId () returned 0x970 [0062.672] GetCurrentThreadId () returned 0x970 [0062.672] GetCurrentThreadId () returned 0x970 [0062.672] GetCurrentThreadId () returned 0x970 [0062.672] GetCurrentThreadId () returned 0x970 [0062.672] GetCurrentThreadId () returned 0x970 [0062.672] GetCurrentThreadId () returned 0x970 [0062.672] GetCurrentThreadId () returned 0x970 [0062.672] GetCurrentThreadId () returned 0x970 [0062.672] GetCurrentThreadId () returned 0x970 [0062.672] GetCurrentThreadId () returned 0x970 [0062.672] GetCurrentThreadId () returned 0x970 [0062.672] GetCurrentThreadId () returned 0x970 [0062.672] GetCurrentThreadId () returned 0x970 [0062.672] GetCurrentThreadId () returned 0x970 [0062.672] GetCurrentThreadId () returned 0x970 [0062.672] GetCurrentThreadId () returned 0x970 [0062.672] GetCurrentThreadId () returned 0x970 [0062.672] GetCurrentThreadId () returned 0x970 [0062.672] GetCurrentThreadId () returned 0x970 [0062.672] GetCurrentThreadId () returned 0x970 [0062.672] GetCurrentThreadId () returned 0x970 [0062.673] GetCurrentThreadId () returned 0x970 [0062.673] GetCurrentThreadId () returned 0x970 [0062.673] GetCurrentThreadId () returned 0x970 [0062.673] GetCurrentThreadId () returned 0x970 [0062.673] GetCurrentThreadId () returned 0x970 [0062.673] GetCurrentThreadId () returned 0x970 [0062.673] GetCurrentThreadId () returned 0x970 [0062.673] GetCurrentThreadId () returned 0x970 [0062.673] GetCurrentThreadId () returned 0x970 [0062.673] GetCurrentThreadId () returned 0x970 [0062.673] GetCurrentThreadId () returned 0x970 [0062.673] GetCurrentThreadId () returned 0x970 [0062.673] GetCurrentThreadId () returned 0x970 [0062.673] GetCurrentThreadId () returned 0x970 [0062.673] GetCurrentThreadId () returned 0x970 [0062.673] GetCurrentThreadId () returned 0x970 [0062.673] GetCurrentThreadId () returned 0x970 [0062.673] GetCurrentThreadId () returned 0x970 [0062.673] GetCurrentThreadId () returned 0x970 [0062.673] GetCurrentThreadId () returned 0x970 [0062.673] GetCurrentThreadId () returned 0x970 [0062.673] GetCurrentThreadId () returned 0x970 [0062.673] GetCurrentThreadId () returned 0x970 [0062.673] GetCurrentThreadId () returned 0x970 [0062.673] GetCurrentThreadId () returned 0x970 [0062.673] GetCurrentThreadId () returned 0x970 [0062.673] GetCurrentThreadId () returned 0x970 [0062.673] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAEzqZrkHVdXc1S550OafVN2jXlP/eTY6LUBLi0L7Qql2NmumEktenkSvCQVvOXMohNFIzEHA//ZdAY4Rnn/UKtzRCfXW2f8IE8rrVGJ3bSGP0HhWx+kEeHHao7Vwdw93J5G+9Pk6GFuXQBNmixkir5fnu/X+h4pmoSzKmEdfo+njbeTrC0wHH4jhRsuNin8cGMMy6xwONsJhCJ7qPQeGwlnP3Fce6kk0+g==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0062.673] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAEzqZrkHVdXc1S550OafVN2jXlP/eTY6LUBLi0L7Qql2NmumEktenkSvCQVvOXMohNFIzEHA//ZdAY4Rnn/UKtzRCfXW2f8IE8rrVGJ3bSGP0HhWx+kEeHHao7Vwdw93J5G+9Pk6GFuXQBNmixkir5fnu/X+h4pmoSzKmEdfo+njbeTrC0wHH4jhRsuNin8cGMMy6xwONsJhCJ7qPQeGwlnP3Fce6kk0+g==", cchWideChar=245, lpMultiByteStr=0x353933c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAEzqZrkHVdXc1S550OafVN2jXlP/eTY6LUBLi0L7Qql2NmumEktenkSvCQVvOXMohNFIzEHA//ZdAY4Rnn/UKtzRCfXW2f8IE8rrVGJ3bSGP0HhWx+kEeHHao7Vwdw93J5G+9Pk6GFuXQBNmixkir5fnu/X+h4pmoSzKmEdfo+njbeTrC0wHH4jhRsuNin8cGMMy6xwONsJhCJ7qPQeGwlnP3Fce6kk0+g==", lpUsedDefaultChar=0x0) returned 245 [0062.673] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0062.673] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0062.673] CloseHandle (hObject=0x158) returned 1 [0062.674] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png")) returned 1 [0062.675] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=18293811833) returned 1 [0062.675] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\Файл зашифрован [PREVIEW.GIF].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\Файл зашифрован [preview.gif].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0062.676] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0062.677] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0062.677] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0062.677] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0062.677] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0062.677] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0062.677] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0062.677] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0062.677] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0062.677] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0062.677] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0062.677] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0062.677] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0062.677] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0062.677] SetEndOfFile (hFile=0x158) returned 1 [0062.677] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0062.677] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0062.678] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0062.678] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0062.678] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0062.679] WriteFile (in: hFile=0x158, lpBuffer=0x35f011c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f011c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0062.679] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="zKgkU+5H8^=YGNIbA)elxZ&!M!m%&gJ9", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0062.679] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="zKgkU+5H8^=YGNIbA)elxZ&!M!m%&gJ9", cchWideChar=32, lpMultiByteStr=0x20359d4, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="zKgkU+5H8^=YGNIbA)elxZ&!M!m%&gJ9", lpUsedDefaultChar=0x0) returned 32 [0062.679] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0062.679] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0062.679] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 0x295098 [0062.679] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0062.679] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0062.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif")) returned 0x20 [0062.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif")) returned 0x20 [0062.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif")) returned 0x20 [0062.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif")) returned 0x20 [0062.679] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0062.680] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0062.680] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0062.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif")) returned 0x20 [0062.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif")) returned 0x20 [0062.680] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0062.680] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0062.680] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0062.680] SetEndOfFile (hFile=0x158) returned 1 [0062.681] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0062.681] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe35cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0062.681] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0062.681] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe470c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0062.681] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe470c, cbMultiByte=11, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="PREVIEW.GIFGer.gifg") returned 11 [0062.681] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0062.681] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe35cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0062.681] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0062.681] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0062.681] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0xa2c [0062.681] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0062.681] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0062.681] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0062.682] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0062.682] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe35cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0062.682] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0062.682] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe470c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0062.682] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe470c, cbMultiByte=11, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="PREVIEW.GIFEW.GIFGer.gifg") returned 11 [0062.682] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0062.682] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe35cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0062.682] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0062.683] CharToOemA (in: pSrc="PREVIEW.GIF", pDst=0x1fe470c | out: pDst="PREVIEW.GIF") returned 1 [0062.683] WriteFile (in: hFile=0x158, lpBuffer=0x1fe470c*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe470c*, lpNumberOfBytesWritten=0x18e048*=0xb, lpOverlapped=0x0) returned 1 [0062.683] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0062.683] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0062.683] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0062.683] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=18294655278) returned 1 [0062.683] ReadFile (in: hFile=0x11c, lpBuffer=0x37b81c0, nNumberOfBytesToRead=0xa2c, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37b81c0*, lpNumberOfBytesRead=0x18dd7c*=0xa2c, lpOverlapped=0x0) returned 1 [0062.688] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0062.688] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=18295122929) returned 1 [0062.700] WriteFile (in: hFile=0x158, lpBuffer=0x1fea3d8*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fea3d8*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0062.700] ReadFile (in: hFile=0x11c, lpBuffer=0x37b81c0, nNumberOfBytesToRead=0xa2c, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x37b81c0*, lpNumberOfBytesRead=0x18de38*=0xa2c, lpOverlapped=0x0) returned 1 [0062.700] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x46 [0062.700] WriteFile (in: hFile=0x158, lpBuffer=0x37b8bf0*, nNumberOfBytesToWrite=0xa2c, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x37b8bf0*, lpNumberOfBytesWritten=0x18de10*=0xa2c, lpOverlapped=0x0) returned 1 [0062.700] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0xa72 [0062.700] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0062.700] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0062.700] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0062.701] SetFilePointer (in: hFile=0x158, lDistanceToMove=11, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x29 [0062.701] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0xa7c [0062.701] CloseHandle (hObject=0x11c) returned 1 [0062.701] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xa7c [0062.701] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xa7c [0062.701] SetFilePointer (in: hFile=0x158, lDistanceToMove=2684, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xa7c [0062.701] SetFilePointer (in: hFile=0x158, lDistanceToMove=2684, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0xa7c [0062.701] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xa7c [0062.701] SetFilePointer (in: hFile=0x158, lDistanceToMove=2684, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0xa7c [0062.701] SetEndOfFile (hFile=0x158) returned 1 [0062.701] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xa7c [0062.701] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xa7c [0062.701] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0062.701] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe35cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0062.702] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0062.702] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe41ac, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0062.702] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe41ac, cbMultiByte=11, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="PREVIEW.GIF\x18ꞗ@涤(\x18믉`믑`") returned 11 [0062.702] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0062.702] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe35cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0062.702] WriteFile (in: hFile=0x158, lpBuffer=0x379bc78*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x379bc78*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0062.702] CharToOemA (in: pSrc="PREVIEW.GIF", pDst=0x1fe41ac | out: pDst="PREVIEW.GIF") returned 1 [0062.702] WriteFile (in: hFile=0x158, lpBuffer=0x1fe41ac*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe41ac*, lpNumberOfBytesWritten=0x18efcc*=0xb, lpOverlapped=0x0) returned 1 [0062.702] WriteFile (in: hFile=0x158, lpBuffer=0x1fea2d8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea2d8*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0062.702] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0062.702] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0062.702] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xac0 [0062.702] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xac0 [0062.702] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0062.702] WriteFile (in: hFile=0x158, lpBuffer=0x35f011c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f011c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0062.703] DeleteFileW (lpFileName="") returned 0 [0062.703] GetLastError () returned 0x3 [0062.703] GetFileAttributesW (lpFileName="") returned 0xffffffff [0062.703] SetLastError (dwErrCode=0x3) [0062.703] FlushFileBuffers (hFile=0x158) returned 1 [0062.705] GetCurrentThreadId () returned 0x970 [0062.705] GetCurrentThreadId () returned 0x970 [0062.705] GetCurrentThreadId () returned 0x970 [0062.705] GetCurrentThreadId () returned 0x970 [0062.705] GetCurrentThreadId () returned 0x970 [0062.705] GetCurrentThreadId () returned 0x970 [0062.705] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xb77 [0062.705] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xb77 [0062.705] SetFilePointer (in: hFile=0x158, lDistanceToMove=2935, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xb77 [0062.706] CloseHandle (hObject=0x158) returned 1 [0062.706] GetCurrentThreadId () returned 0x970 [0062.706] GetCurrentThreadId () returned 0x970 [0062.706] GetCurrentThreadId () returned 0x970 [0062.706] GetCurrentThreadId () returned 0x970 [0062.706] GetCurrentThreadId () returned 0x970 [0062.706] GetCurrentThreadId () returned 0x970 [0062.706] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\Файл зашифрован [PREVIEW.GIF].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\Файл зашифрован [preview.gif].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0062.706] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb77 [0062.706] SetFilePointer (in: hFile=0x158, lDistanceToMove=2807, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xaf7 [0062.706] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0062.706] GetFileType (hFile=0x158) returned 0x1 [0062.706] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x9, wMilliseconds=0x3ce)) [0062.706] GetCurrentThreadId () returned 0x970 [0062.706] GetCurrentThreadId () returned 0x970 [0062.706] GetCurrentThreadId () returned 0x970 [0062.706] GetCurrentThreadId () returned 0x970 [0062.706] GetCurrentThreadId () returned 0x970 [0062.706] GetCurrentThreadId () returned 0x970 [0062.706] GetCurrentThreadId () returned 0x970 [0062.706] GetCurrentThreadId () returned 0x970 [0062.706] GetCurrentThreadId () returned 0x970 [0062.706] GetCurrentThreadId () returned 0x970 [0062.706] GetCurrentThreadId () returned 0x970 [0062.706] GetCurrentThreadId () returned 0x970 [0062.706] GetCurrentThreadId () returned 0x970 [0062.706] GetCurrentThreadId () returned 0x970 [0062.706] GetCurrentThreadId () returned 0x970 [0062.706] GetCurrentThreadId () returned 0x970 [0062.707] GetCurrentThreadId () returned 0x970 [0062.707] GetCurrentThreadId () returned 0x970 [0062.707] GetCurrentThreadId () returned 0x970 [0062.707] GetCurrentThreadId () returned 0x970 [0062.707] GetCurrentThreadId () returned 0x970 [0062.707] GetCurrentThreadId () returned 0x970 [0062.707] GetCurrentThreadId () returned 0x970 [0062.707] GetCurrentThreadId () returned 0x970 [0062.707] GetCurrentThreadId () returned 0x970 [0062.707] GetCurrentThreadId () returned 0x970 [0062.707] GetCurrentThreadId () returned 0x970 [0062.707] GetCurrentThreadId () returned 0x970 [0062.707] GetCurrentThreadId () returned 0x970 [0062.707] GetCurrentThreadId () returned 0x970 [0062.707] GetCurrentThreadId () returned 0x970 [0062.707] GetCurrentThreadId () returned 0x970 [0062.707] GetCurrentThreadId () returned 0x970 [0062.707] GetCurrentThreadId () returned 0x970 [0062.707] GetCurrentThreadId () returned 0x970 [0062.707] GetCurrentThreadId () returned 0x970 [0062.707] GetCurrentThreadId () returned 0x970 [0062.707] GetCurrentThreadId () returned 0x970 [0062.707] GetCurrentThreadId () returned 0x970 [0062.707] GetCurrentThreadId () returned 0x970 [0062.707] GetCurrentThreadId () returned 0x970 [0062.707] GetCurrentThreadId () returned 0x970 [0062.707] GetCurrentThreadId () returned 0x970 [0062.707] GetCurrentThreadId () returned 0x970 [0062.707] GetCurrentThreadId () returned 0x970 [0062.707] GetCurrentThreadId () returned 0x970 [0062.707] GetCurrentThreadId () returned 0x970 [0062.707] GetCurrentThreadId () returned 0x970 [0062.707] GetCurrentThreadId () returned 0x970 [0062.707] GetCurrentThreadId () returned 0x970 [0062.707] GetCurrentThreadId () returned 0x970 [0062.707] GetCurrentThreadId () returned 0x970 [0062.707] GetCurrentThreadId () returned 0x970 [0062.707] GetCurrentThreadId () returned 0x970 [0062.707] GetCurrentThreadId () returned 0x970 [0062.707] GetCurrentThreadId () returned 0x970 [0062.707] GetCurrentThreadId () returned 0x970 [0062.707] GetCurrentThreadId () returned 0x970 [0062.707] GetCurrentThreadId () returned 0x970 [0062.707] GetCurrentThreadId () returned 0x970 [0062.707] GetCurrentThreadId () returned 0x970 [0062.708] GetCurrentThreadId () returned 0x970 [0062.708] GetCurrentThreadId () returned 0x970 [0062.708] GetCurrentThreadId () returned 0x970 [0062.708] GetCurrentThreadId () returned 0x970 [0062.708] GetCurrentThreadId () returned 0x970 [0062.708] GetCurrentThreadId () returned 0x970 [0062.708] GetCurrentThreadId () returned 0x970 [0062.708] GetCurrentThreadId () returned 0x970 [0062.708] GetCurrentThreadId () returned 0x970 [0062.708] GetCurrentThreadId () returned 0x970 [0062.708] GetCurrentThreadId () returned 0x970 [0062.708] GetCurrentThreadId () returned 0x970 [0062.708] GetCurrentThreadId () returned 0x970 [0062.708] GetCurrentThreadId () returned 0x970 [0062.708] GetCurrentThreadId () returned 0x970 [0062.708] GetCurrentThreadId () returned 0x970 [0062.708] GetCurrentThreadId () returned 0x970 [0062.708] GetCurrentThreadId () returned 0x970 [0062.708] GetCurrentThreadId () returned 0x970 [0062.708] GetCurrentThreadId () returned 0x970 [0062.708] GetCurrentThreadId () returned 0x970 [0062.708] GetCurrentThreadId () returned 0x970 [0062.708] GetCurrentThreadId () returned 0x970 [0062.708] GetCurrentThreadId () returned 0x970 [0062.708] GetCurrentThreadId () returned 0x970 [0062.708] GetCurrentThreadId () returned 0x970 [0062.708] GetCurrentThreadId () returned 0x970 [0062.708] GetCurrentThreadId () returned 0x970 [0062.708] GetCurrentThreadId () returned 0x970 [0062.708] GetCurrentThreadId () returned 0x970 [0062.708] GetCurrentThreadId () returned 0x970 [0062.708] GetCurrentThreadId () returned 0x970 [0062.709] GetCurrentThreadId () returned 0x970 [0062.709] GetCurrentThreadId () returned 0x970 [0062.709] GetCurrentThreadId () returned 0x970 [0062.709] GetCurrentThreadId () returned 0x970 [0062.709] GetCurrentThreadId () returned 0x970 [0062.709] GetCurrentThreadId () returned 0x970 [0062.709] GetCurrentThreadId () returned 0x970 [0062.709] GetCurrentThreadId () returned 0x970 [0062.709] GetCurrentThreadId () returned 0x970 [0062.709] GetCurrentThreadId () returned 0x970 [0062.709] GetCurrentThreadId () returned 0x970 [0062.709] GetCurrentThreadId () returned 0x970 [0062.709] GetCurrentThreadId () returned 0x970 [0062.709] GetCurrentThreadId () returned 0x970 [0062.709] GetCurrentThreadId () returned 0x970 [0062.709] GetCurrentThreadId () returned 0x970 [0062.709] GetCurrentThreadId () returned 0x970 [0062.709] GetCurrentThreadId () returned 0x970 [0062.709] GetCurrentThreadId () returned 0x970 [0062.709] GetCurrentThreadId () returned 0x970 [0062.709] GetCurrentThreadId () returned 0x970 [0062.709] GetCurrentThreadId () returned 0x970 [0062.709] GetCurrentThreadId () returned 0x970 [0062.709] GetCurrentThreadId () returned 0x970 [0062.709] GetCurrentThreadId () returned 0x970 [0062.709] GetCurrentThreadId () returned 0x970 [0062.709] GetCurrentThreadId () returned 0x970 [0062.709] GetCurrentThreadId () returned 0x970 [0062.709] GetCurrentThreadId () returned 0x970 [0062.709] GetCurrentThreadId () returned 0x970 [0062.709] GetCurrentThreadId () returned 0x970 [0062.709] GetCurrentThreadId () returned 0x970 [0062.709] GetCurrentThreadId () returned 0x970 [0062.709] GetCurrentThreadId () returned 0x970 [0062.709] GetCurrentThreadId () returned 0x970 [0062.709] GetCurrentThreadId () returned 0x970 [0062.709] GetCurrentThreadId () returned 0x970 [0062.709] GetCurrentThreadId () returned 0x970 [0062.709] GetCurrentThreadId () returned 0x970 [0062.709] GetCurrentThreadId () returned 0x970 [0062.709] GetCurrentThreadId () returned 0x970 [0062.709] GetCurrentThreadId () returned 0x970 [0062.709] GetCurrentThreadId () returned 0x970 [0062.709] GetCurrentThreadId () returned 0x970 [0062.710] GetCurrentThreadId () returned 0x970 [0062.710] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.710] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.710] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff06b0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.710] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.710] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.710] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff06b0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.710] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.710] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.710] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.710] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.710] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.710] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.710] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.710] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.710] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff0710, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.710] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.710] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.710] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff0710, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.710] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.710] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.710] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff0710, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.710] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x9, wMilliseconds=0x3dd)) [0062.710] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="zKgkU+5H8^=YGNIbA)elxZ&!M!m%&gJ9", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0062.710] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="zKgkU+5H8^=YGNIbA)elxZ&!M!m%&gJ9", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0062.710] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="zKgkU+5H8^=YGNIbA)elxZ&!M!m%&gJ9", cchWideChar=32, lpMultiByteStr=0x20024e8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="zKgkU+5H8^=YGNIbA)elxZ&!M!m%&gJ9", lpUsedDefaultChar=0x0) returned 32 [0062.711] GetCurrentThreadId () returned 0x970 [0062.711] GetCurrentThreadId () returned 0x970 [0062.711] GetCurrentThreadId () returned 0x970 [0062.711] GetCurrentThreadId () returned 0x970 [0062.711] GetCurrentThreadId () returned 0x970 [0062.711] GetCurrentThreadId () returned 0x970 [0062.718] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0062.718] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0062.718] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3795468, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0062.718] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0062.718] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAHOf7FHN8opAqm6NOkfRLvyOwB8PNmDqBxfgCFW6TlfFFqLpErreRmqogd7dR/ochHx/8eBINUBvQC6UTFtSMDsFtOES5q398IwCZ8J/Lciz1fUjpytAGaCLUvpX3feViDbGcwz9UtoBKBFe+qZzQh8cgauZiiBXYbR60q20Wp3pD4Y0X9OInGwoxMtL3ORSOYETyk4zeCt0yEKnBMLiLycJmhtBStugTg==") returned 232 [0062.718] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x9, wMilliseconds=0x3dd)) [0062.718] GetCurrentThreadId () returned 0x970 [0062.718] GetCurrentThreadId () returned 0x970 [0062.718] GetCurrentThreadId () returned 0x970 [0062.718] GetCurrentThreadId () returned 0x970 [0062.718] GetCurrentThreadId () returned 0x970 [0062.718] GetCurrentThreadId () returned 0x970 [0062.718] GetCurrentThreadId () returned 0x970 [0062.718] GetCurrentThreadId () returned 0x970 [0062.718] GetCurrentThreadId () returned 0x970 [0062.718] GetCurrentThreadId () returned 0x970 [0062.718] GetCurrentThreadId () returned 0x970 [0062.718] GetCurrentThreadId () returned 0x970 [0062.718] GetCurrentThreadId () returned 0x970 [0062.719] GetCurrentThreadId () returned 0x970 [0062.719] GetCurrentThreadId () returned 0x970 [0062.719] GetCurrentThreadId () returned 0x970 [0062.719] GetCurrentThreadId () returned 0x970 [0062.719] GetCurrentThreadId () returned 0x970 [0062.719] GetCurrentThreadId () returned 0x970 [0062.719] GetCurrentThreadId () returned 0x970 [0062.719] GetCurrentThreadId () returned 0x970 [0062.719] GetCurrentThreadId () returned 0x970 [0062.719] GetCurrentThreadId () returned 0x970 [0062.719] GetCurrentThreadId () returned 0x970 [0062.719] GetCurrentThreadId () returned 0x970 [0062.719] GetCurrentThreadId () returned 0x970 [0062.719] GetCurrentThreadId () returned 0x970 [0062.719] GetCurrentThreadId () returned 0x970 [0062.719] GetCurrentThreadId () returned 0x970 [0062.719] GetCurrentThreadId () returned 0x970 [0062.719] GetCurrentThreadId () returned 0x970 [0062.719] GetCurrentThreadId () returned 0x970 [0062.719] GetCurrentThreadId () returned 0x970 [0062.719] GetCurrentThreadId () returned 0x970 [0062.719] GetCurrentThreadId () returned 0x970 [0062.719] GetCurrentThreadId () returned 0x970 [0062.719] GetCurrentThreadId () returned 0x970 [0062.719] GetCurrentThreadId () returned 0x970 [0062.719] GetCurrentThreadId () returned 0x970 [0062.719] GetCurrentThreadId () returned 0x970 [0062.719] GetCurrentThreadId () returned 0x970 [0062.719] GetCurrentThreadId () returned 0x970 [0062.719] GetCurrentThreadId () returned 0x970 [0062.719] GetCurrentThreadId () returned 0x970 [0062.719] GetCurrentThreadId () returned 0x970 [0062.719] GetCurrentThreadId () returned 0x970 [0062.719] GetCurrentThreadId () returned 0x970 [0062.719] GetCurrentThreadId () returned 0x970 [0062.719] GetCurrentThreadId () returned 0x970 [0062.719] GetCurrentThreadId () returned 0x970 [0062.719] GetCurrentThreadId () returned 0x970 [0062.719] GetCurrentThreadId () returned 0x970 [0062.719] GetCurrentThreadId () returned 0x970 [0062.719] GetCurrentThreadId () returned 0x970 [0062.719] GetCurrentThreadId () returned 0x970 [0062.719] GetCurrentThreadId () returned 0x970 [0062.719] GetCurrentThreadId () returned 0x970 [0062.719] GetCurrentThreadId () returned 0x970 [0062.720] GetCurrentThreadId () returned 0x970 [0062.720] GetCurrentThreadId () returned 0x970 [0062.720] GetCurrentThreadId () returned 0x970 [0062.720] GetCurrentThreadId () returned 0x970 [0062.720] GetCurrentThreadId () returned 0x970 [0062.720] GetCurrentThreadId () returned 0x970 [0062.720] GetCurrentThreadId () returned 0x970 [0062.720] GetCurrentThreadId () returned 0x970 [0062.720] GetCurrentThreadId () returned 0x970 [0062.720] GetCurrentThreadId () returned 0x970 [0062.720] GetCurrentThreadId () returned 0x970 [0062.720] GetCurrentThreadId () returned 0x970 [0062.720] GetCurrentThreadId () returned 0x970 [0062.720] GetCurrentThreadId () returned 0x970 [0062.720] GetCurrentThreadId () returned 0x970 [0062.720] GetCurrentThreadId () returned 0x970 [0062.720] GetCurrentThreadId () returned 0x970 [0062.720] GetCurrentThreadId () returned 0x970 [0062.720] GetCurrentThreadId () returned 0x970 [0062.720] GetCurrentThreadId () returned 0x970 [0062.720] GetCurrentThreadId () returned 0x970 [0062.720] GetCurrentThreadId () returned 0x970 [0062.720] GetCurrentThreadId () returned 0x970 [0062.720] GetCurrentThreadId () returned 0x970 [0062.720] GetCurrentThreadId () returned 0x970 [0062.720] GetCurrentThreadId () returned 0x970 [0062.720] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAHOf7FHN8opAqm6NOkfRLvyOwB8PNmDqBxfgCFW6TlfFFqLpErreRmqogd7dR/ochHx/8eBINUBvQC6UTFtSMDsFtOES5q398IwCZ8J/Lciz1fUjpytAGaCLUvpX3feViDbGcwz9UtoBKBFe+qZzQh8cgauZiiBXYbR60q20Wp3pD4Y0X9OInGwoxMtL3ORSOYETyk4zeCt0yEKnBMLiLycJmhtBStugTg==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0062.720] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAHOf7FHN8opAqm6NOkfRLvyOwB8PNmDqBxfgCFW6TlfFFqLpErreRmqogd7dR/ochHx/8eBINUBvQC6UTFtSMDsFtOES5q398IwCZ8J/Lciz1fUjpytAGaCLUvpX3feViDbGcwz9UtoBKBFe+qZzQh8cgauZiiBXYbR60q20Wp3pD4Y0X9OInGwoxMtL3ORSOYETyk4zeCt0yEKnBMLiLycJmhtBStugTg==", cchWideChar=245, lpMultiByteStr=0x353933c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAHOf7FHN8opAqm6NOkfRLvyOwB8PNmDqBxfgCFW6TlfFFqLpErreRmqogd7dR/ochHx/8eBINUBvQC6UTFtSMDsFtOES5q398IwCZ8J/Lciz1fUjpytAGaCLUvpX3feViDbGcwz9UtoBKBFe+qZzQh8cgauZiiBXYbR60q20Wp3pD4Y0X9OInGwoxMtL3ORSOYETyk4zeCt0yEKnBMLiLycJmhtBStugTg==", lpUsedDefaultChar=0x0) returned 245 [0062.720] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0062.720] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0062.720] CloseHandle (hObject=0x158) returned 1 [0062.721] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif")) returned 1 [0062.721] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=18298487824) returned 1 [0062.722] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\Файл зашифрован [THMBNAIL.PNG].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\Файл зашифрован [thmbnail.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0062.722] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0062.722] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0062.722] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0062.722] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0062.722] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0062.722] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0062.722] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0062.722] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0062.722] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0062.722] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0062.722] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0062.723] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0062.723] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0062.723] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0062.723] SetEndOfFile (hFile=0x158) returned 1 [0062.723] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0062.723] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0062.723] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0062.723] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0062.723] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0062.724] WriteFile (in: hFile=0x158, lpBuffer=0x35f01dc*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f01dc*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0062.724] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VG11JFi7V#uqS*kM.EGU}eui.UT)$\\zD", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0062.724] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VG11JFi7V#uqS*kM.EGU}eui.UT)$\\zD", cchWideChar=32, lpMultiByteStr=0x2035a0c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VG11JFi7V#uqS*kM.EGU}eui.UT)$\\zD", lpUsedDefaultChar=0x0) returned 32 [0062.724] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0062.724] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0062.724] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7ce7, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0x295098 [0062.724] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0062.724] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0062.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png")) returned 0x20 [0062.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png")) returned 0x20 [0062.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png")) returned 0x20 [0062.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png")) returned 0x20 [0062.725] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7ce7)) returned 1 [0062.725] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0062.725] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0062.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png")) returned 0x20 [0062.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png")) returned 0x20 [0062.726] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0062.726] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0062.726] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0062.726] SetEndOfFile (hFile=0x158) returned 1 [0062.727] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0062.727] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe36ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0062.727] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0062.727] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe43ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0062.727] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe43ac, cbMultiByte=12, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="THMBNAIL.PNGer.gifg") returned 12 [0062.727] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0062.727] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe36ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0062.727] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0062.727] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0062.727] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x7ce7 [0062.727] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0062.727] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0062.727] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0062.727] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0062.727] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe36ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0062.727] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0062.728] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe43ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0062.728] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe43ac, cbMultiByte=12, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="THMBNAIL.PNGIL.PNGer.gifg") returned 12 [0062.728] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0062.728] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe36ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0062.728] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0062.729] CharToOemA (in: pSrc="THMBNAIL.PNG", pDst=0x1fe43ac | out: pDst="THMBNAIL.PNG") returned 1 [0062.729] WriteFile (in: hFile=0x158, lpBuffer=0x1fe43ac*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe43ac*, lpNumberOfBytesWritten=0x18e048*=0xc, lpOverlapped=0x0) returned 1 [0062.729] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0062.729] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0062.729] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0062.729] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=18299239964) returned 1 [0062.729] ReadFile (in: hFile=0x11c, lpBuffer=0x37b81a0, nNumberOfBytesToRead=0x7ce7, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37b81a0*, lpNumberOfBytesRead=0x18dd7c*=0x7ce7, lpOverlapped=0x0) returned 1 [0062.731] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0062.731] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=18299443261) returned 1 [0062.740] WriteFile (in: hFile=0x158, lpBuffer=0x1fea2e8*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fea2e8*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0062.740] ReadFile (in: hFile=0x11c, lpBuffer=0x37b81a0, nNumberOfBytesToRead=0x7ce7, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x37b81a0*, lpNumberOfBytesRead=0x18de38*=0x7ce7, lpOverlapped=0x0) returned 1 [0062.741] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x47 [0062.741] WriteFile (in: hFile=0x158, lpBuffer=0x38016c0*, nNumberOfBytesToWrite=0x7ce7, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x38016c0*, lpNumberOfBytesWritten=0x18de10*=0x7ce7, lpOverlapped=0x0) returned 1 [0062.741] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x7d2e [0062.741] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0062.741] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0062.742] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0062.742] SetFilePointer (in: hFile=0x158, lDistanceToMove=12, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2a [0062.742] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x7d38 [0062.742] CloseHandle (hObject=0x11c) returned 1 [0062.742] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x7d38 [0062.742] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x7d38 [0062.742] SetFilePointer (in: hFile=0x158, lDistanceToMove=32056, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x7d38 [0062.742] SetFilePointer (in: hFile=0x158, lDistanceToMove=32056, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x7d38 [0062.742] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x7d38 [0062.742] SetFilePointer (in: hFile=0x158, lDistanceToMove=32056, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x7d38 [0062.742] SetEndOfFile (hFile=0x158) returned 1 [0062.742] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x7d38 [0062.742] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x7d38 [0062.742] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0062.743] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe36ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0062.743] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0062.743] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe37ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0062.743] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe37ec, cbMultiByte=12, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="THMBNAIL.PNGꞗ@涤(\x18믉`믑`") returned 12 [0062.743] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0062.743] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe36ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0062.743] WriteFile (in: hFile=0x158, lpBuffer=0x379bc78*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x379bc78*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0062.743] CharToOemA (in: pSrc="THMBNAIL.PNG", pDst=0x1fe37ec | out: pDst="THMBNAIL.PNG") returned 1 [0062.743] WriteFile (in: hFile=0x158, lpBuffer=0x1fe37ec*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe37ec*, lpNumberOfBytesWritten=0x18efcc*=0xc, lpOverlapped=0x0) returned 1 [0062.743] WriteFile (in: hFile=0x158, lpBuffer=0x1fea170*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea170*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0062.743] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0062.743] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0062.743] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x7d7d [0062.743] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x7d7d [0062.743] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0062.744] WriteFile (in: hFile=0x158, lpBuffer=0x35f01dc*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f01dc*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0062.744] DeleteFileW (lpFileName="") returned 0 [0062.744] GetLastError () returned 0x3 [0062.744] GetFileAttributesW (lpFileName="") returned 0xffffffff [0062.744] SetLastError (dwErrCode=0x3) [0062.744] FlushFileBuffers (hFile=0x158) returned 1 [0062.748] GetCurrentThreadId () returned 0x970 [0062.748] GetCurrentThreadId () returned 0x970 [0062.748] GetCurrentThreadId () returned 0x970 [0062.748] GetCurrentThreadId () returned 0x970 [0062.748] GetCurrentThreadId () returned 0x970 [0062.748] GetCurrentThreadId () returned 0x970 [0062.748] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x7e34 [0062.748] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x7e34 [0062.748] SetFilePointer (in: hFile=0x158, lDistanceToMove=32308, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x7e34 [0062.748] CloseHandle (hObject=0x158) returned 1 [0062.748] GetCurrentThreadId () returned 0x970 [0062.749] GetCurrentThreadId () returned 0x970 [0062.749] GetCurrentThreadId () returned 0x970 [0062.749] GetCurrentThreadId () returned 0x970 [0062.749] GetCurrentThreadId () returned 0x970 [0062.749] GetCurrentThreadId () returned 0x970 [0062.749] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\Файл зашифрован [THMBNAIL.PNG].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\Файл зашифрован [thmbnail.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0062.749] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7e34 [0062.749] SetFilePointer (in: hFile=0x158, lDistanceToMove=32180, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7db4 [0062.749] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0062.749] GetFileType (hFile=0x158) returned 0x1 [0062.749] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xa, wMilliseconds=0x14)) [0062.749] GetCurrentThreadId () returned 0x970 [0062.749] GetCurrentThreadId () returned 0x970 [0062.749] GetCurrentThreadId () returned 0x970 [0062.749] GetCurrentThreadId () returned 0x970 [0062.749] GetCurrentThreadId () returned 0x970 [0062.749] GetCurrentThreadId () returned 0x970 [0062.749] GetCurrentThreadId () returned 0x970 [0062.749] GetCurrentThreadId () returned 0x970 [0062.749] GetCurrentThreadId () returned 0x970 [0062.749] GetCurrentThreadId () returned 0x970 [0062.749] GetCurrentThreadId () returned 0x970 [0062.749] GetCurrentThreadId () returned 0x970 [0062.749] GetCurrentThreadId () returned 0x970 [0062.749] GetCurrentThreadId () returned 0x970 [0062.749] GetCurrentThreadId () returned 0x970 [0062.749] GetCurrentThreadId () returned 0x970 [0062.749] GetCurrentThreadId () returned 0x970 [0062.749] GetCurrentThreadId () returned 0x970 [0062.749] GetCurrentThreadId () returned 0x970 [0062.749] GetCurrentThreadId () returned 0x970 [0062.750] GetCurrentThreadId () returned 0x970 [0062.750] GetCurrentThreadId () returned 0x970 [0062.750] GetCurrentThreadId () returned 0x970 [0062.750] GetCurrentThreadId () returned 0x970 [0062.750] GetCurrentThreadId () returned 0x970 [0062.750] GetCurrentThreadId () returned 0x970 [0062.750] GetCurrentThreadId () returned 0x970 [0062.750] GetCurrentThreadId () returned 0x970 [0062.750] GetCurrentThreadId () returned 0x970 [0062.750] GetCurrentThreadId () returned 0x970 [0062.750] GetCurrentThreadId () returned 0x970 [0062.750] GetCurrentThreadId () returned 0x970 [0062.750] GetCurrentThreadId () returned 0x970 [0062.750] GetCurrentThreadId () returned 0x970 [0062.750] GetCurrentThreadId () returned 0x970 [0062.750] GetCurrentThreadId () returned 0x970 [0062.750] GetCurrentThreadId () returned 0x970 [0062.750] GetCurrentThreadId () returned 0x970 [0062.750] GetCurrentThreadId () returned 0x970 [0062.750] GetCurrentThreadId () returned 0x970 [0062.750] GetCurrentThreadId () returned 0x970 [0062.750] GetCurrentThreadId () returned 0x970 [0062.750] GetCurrentThreadId () returned 0x970 [0062.750] GetCurrentThreadId () returned 0x970 [0062.750] GetCurrentThreadId () returned 0x970 [0062.750] GetCurrentThreadId () returned 0x970 [0062.750] GetCurrentThreadId () returned 0x970 [0062.750] GetCurrentThreadId () returned 0x970 [0062.750] GetCurrentThreadId () returned 0x970 [0062.750] GetCurrentThreadId () returned 0x970 [0062.750] GetCurrentThreadId () returned 0x970 [0062.750] GetCurrentThreadId () returned 0x970 [0062.750] GetCurrentThreadId () returned 0x970 [0062.750] GetCurrentThreadId () returned 0x970 [0062.750] GetCurrentThreadId () returned 0x970 [0062.750] GetCurrentThreadId () returned 0x970 [0062.750] GetCurrentThreadId () returned 0x970 [0062.750] GetCurrentThreadId () returned 0x970 [0062.750] GetCurrentThreadId () returned 0x970 [0062.750] GetCurrentThreadId () returned 0x970 [0062.750] GetCurrentThreadId () returned 0x970 [0062.750] GetCurrentThreadId () returned 0x970 [0062.750] GetCurrentThreadId () returned 0x970 [0062.750] GetCurrentThreadId () returned 0x970 [0062.750] GetCurrentThreadId () returned 0x970 [0062.750] GetCurrentThreadId () returned 0x970 [0062.751] GetCurrentThreadId () returned 0x970 [0062.751] GetCurrentThreadId () returned 0x970 [0062.753] GetCurrentThreadId () returned 0x970 [0062.753] GetCurrentThreadId () returned 0x970 [0062.753] GetCurrentThreadId () returned 0x970 [0062.753] GetCurrentThreadId () returned 0x970 [0062.753] GetCurrentThreadId () returned 0x970 [0062.753] GetCurrentThreadId () returned 0x970 [0062.753] GetCurrentThreadId () returned 0x970 [0062.753] GetCurrentThreadId () returned 0x970 [0062.753] GetCurrentThreadId () returned 0x970 [0062.753] GetCurrentThreadId () returned 0x970 [0062.753] GetCurrentThreadId () returned 0x970 [0062.753] GetCurrentThreadId () returned 0x970 [0062.753] GetCurrentThreadId () returned 0x970 [0062.753] GetCurrentThreadId () returned 0x970 [0062.753] GetCurrentThreadId () returned 0x970 [0062.753] GetCurrentThreadId () returned 0x970 [0062.753] GetCurrentThreadId () returned 0x970 [0062.753] GetCurrentThreadId () returned 0x970 [0062.753] GetCurrentThreadId () returned 0x970 [0062.753] GetCurrentThreadId () returned 0x970 [0062.753] GetCurrentThreadId () returned 0x970 [0062.753] GetCurrentThreadId () returned 0x970 [0062.753] GetCurrentThreadId () returned 0x970 [0062.753] GetCurrentThreadId () returned 0x970 [0062.753] GetCurrentThreadId () returned 0x970 [0062.753] GetCurrentThreadId () returned 0x970 [0062.753] GetCurrentThreadId () returned 0x970 [0062.753] GetCurrentThreadId () returned 0x970 [0062.753] GetCurrentThreadId () returned 0x970 [0062.753] GetCurrentThreadId () returned 0x970 [0062.753] GetCurrentThreadId () returned 0x970 [0062.753] GetCurrentThreadId () returned 0x970 [0062.753] GetCurrentThreadId () returned 0x970 [0062.753] GetCurrentThreadId () returned 0x970 [0062.753] GetCurrentThreadId () returned 0x970 [0062.753] GetCurrentThreadId () returned 0x970 [0062.754] GetCurrentThreadId () returned 0x970 [0062.754] GetCurrentThreadId () returned 0x970 [0062.754] GetCurrentThreadId () returned 0x970 [0062.754] GetCurrentThreadId () returned 0x970 [0062.754] GetCurrentThreadId () returned 0x970 [0062.754] GetCurrentThreadId () returned 0x970 [0062.754] GetCurrentThreadId () returned 0x970 [0062.754] GetCurrentThreadId () returned 0x970 [0062.754] GetCurrentThreadId () returned 0x970 [0062.754] GetCurrentThreadId () returned 0x970 [0062.754] GetCurrentThreadId () returned 0x970 [0062.754] GetCurrentThreadId () returned 0x970 [0062.754] GetCurrentThreadId () returned 0x970 [0062.754] GetCurrentThreadId () returned 0x970 [0062.754] GetCurrentThreadId () returned 0x970 [0062.754] GetCurrentThreadId () returned 0x970 [0062.754] GetCurrentThreadId () returned 0x970 [0062.754] GetCurrentThreadId () returned 0x970 [0062.754] GetCurrentThreadId () returned 0x970 [0062.754] GetCurrentThreadId () returned 0x970 [0062.754] GetCurrentThreadId () returned 0x970 [0062.754] GetCurrentThreadId () returned 0x970 [0062.754] GetCurrentThreadId () returned 0x970 [0062.754] GetCurrentThreadId () returned 0x970 [0062.754] GetCurrentThreadId () returned 0x970 [0062.754] GetCurrentThreadId () returned 0x970 [0062.754] GetCurrentThreadId () returned 0x970 [0062.754] GetCurrentThreadId () returned 0x970 [0062.754] GetCurrentThreadId () returned 0x970 [0062.754] GetCurrentThreadId () returned 0x970 [0062.754] GetCurrentThreadId () returned 0x970 [0062.754] GetCurrentThreadId () returned 0x970 [0062.754] GetCurrentThreadId () returned 0x970 [0062.754] GetCurrentThreadId () returned 0x970 [0062.754] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.754] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.754] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff0710, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.754] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.754] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.754] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff0710, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.754] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.754] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.755] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.755] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.755] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.755] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.755] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.755] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.755] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff0770, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.755] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.755] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.755] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff0770, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.755] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.755] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.755] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff0770, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.755] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xa, wMilliseconds=0x14)) [0062.755] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="VG11JFi7V#uqS*kM.EGU}eui.UT)$\\zD", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0062.755] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="VG11JFi7V#uqS*kM.EGU}eui.UT)$\\zD", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0062.755] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="VG11JFi7V#uqS*kM.EGU}eui.UT)$\\zD", cchWideChar=32, lpMultiByteStr=0x20031d8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VG11JFi7V#uqS*kM.EGU}eui.UT)$\\zD", lpUsedDefaultChar=0x0) returned 32 [0062.755] GetCurrentThreadId () returned 0x970 [0062.755] GetCurrentThreadId () returned 0x970 [0062.755] GetCurrentThreadId () returned 0x970 [0062.755] GetCurrentThreadId () returned 0x970 [0062.755] GetCurrentThreadId () returned 0x970 [0062.755] GetCurrentThreadId () returned 0x970 [0062.763] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0062.763] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0062.763] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3795558, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0062.763] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0062.763] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAAELCxkssAqoK9unNhC6eGXtfCg63wE/uIr820Nv690RC5QWBcJPLV5tiZa9r8HUHnPvZ583tqqt27GReYBtcqqCkIoqic/g4he0QFcDs84mFXncOVeewWR3mSKQLIQ/MwjGhnz2BFo+yF33WJZuEqedMVL79m0RHNSOLAApKMOD6Ir2o8fP9PUWTwOR4a0qE0rqARkaV+USC9Tm/jWbxYD2wIj4iO7bJw==") returned 232 [0062.763] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xa, wMilliseconds=0x24)) [0062.763] GetCurrentThreadId () returned 0x970 [0062.763] GetCurrentThreadId () returned 0x970 [0062.763] GetCurrentThreadId () returned 0x970 [0062.763] GetCurrentThreadId () returned 0x970 [0062.763] GetCurrentThreadId () returned 0x970 [0062.763] GetCurrentThreadId () returned 0x970 [0062.763] GetCurrentThreadId () returned 0x970 [0062.763] GetCurrentThreadId () returned 0x970 [0062.763] GetCurrentThreadId () returned 0x970 [0062.763] GetCurrentThreadId () returned 0x970 [0062.763] GetCurrentThreadId () returned 0x970 [0062.763] GetCurrentThreadId () returned 0x970 [0062.763] GetCurrentThreadId () returned 0x970 [0062.763] GetCurrentThreadId () returned 0x970 [0062.763] GetCurrentThreadId () returned 0x970 [0062.763] GetCurrentThreadId () returned 0x970 [0062.763] GetCurrentThreadId () returned 0x970 [0062.763] GetCurrentThreadId () returned 0x970 [0062.763] GetCurrentThreadId () returned 0x970 [0062.763] GetCurrentThreadId () returned 0x970 [0062.763] GetCurrentThreadId () returned 0x970 [0062.764] GetCurrentThreadId () returned 0x970 [0062.764] GetCurrentThreadId () returned 0x970 [0062.764] GetCurrentThreadId () returned 0x970 [0062.764] GetCurrentThreadId () returned 0x970 [0062.764] GetCurrentThreadId () returned 0x970 [0062.764] GetCurrentThreadId () returned 0x970 [0062.764] GetCurrentThreadId () returned 0x970 [0062.764] GetCurrentThreadId () returned 0x970 [0062.764] GetCurrentThreadId () returned 0x970 [0062.764] GetCurrentThreadId () returned 0x970 [0062.764] GetCurrentThreadId () returned 0x970 [0062.764] GetCurrentThreadId () returned 0x970 [0062.764] GetCurrentThreadId () returned 0x970 [0062.764] GetCurrentThreadId () returned 0x970 [0062.764] GetCurrentThreadId () returned 0x970 [0062.764] GetCurrentThreadId () returned 0x970 [0062.764] GetCurrentThreadId () returned 0x970 [0062.764] GetCurrentThreadId () returned 0x970 [0062.764] GetCurrentThreadId () returned 0x970 [0062.764] GetCurrentThreadId () returned 0x970 [0062.764] GetCurrentThreadId () returned 0x970 [0062.764] GetCurrentThreadId () returned 0x970 [0062.764] GetCurrentThreadId () returned 0x970 [0062.764] GetCurrentThreadId () returned 0x970 [0062.764] GetCurrentThreadId () returned 0x970 [0062.764] GetCurrentThreadId () returned 0x970 [0062.764] GetCurrentThreadId () returned 0x970 [0062.764] GetCurrentThreadId () returned 0x970 [0062.764] GetCurrentThreadId () returned 0x970 [0062.764] GetCurrentThreadId () returned 0x970 [0062.764] GetCurrentThreadId () returned 0x970 [0062.764] GetCurrentThreadId () returned 0x970 [0062.764] GetCurrentThreadId () returned 0x970 [0062.764] GetCurrentThreadId () returned 0x970 [0062.764] GetCurrentThreadId () returned 0x970 [0062.764] GetCurrentThreadId () returned 0x970 [0062.764] GetCurrentThreadId () returned 0x970 [0062.764] GetCurrentThreadId () returned 0x970 [0062.764] GetCurrentThreadId () returned 0x970 [0062.764] GetCurrentThreadId () returned 0x970 [0062.764] GetCurrentThreadId () returned 0x970 [0062.764] GetCurrentThreadId () returned 0x970 [0062.764] GetCurrentThreadId () returned 0x970 [0062.764] GetCurrentThreadId () returned 0x970 [0062.764] GetCurrentThreadId () returned 0x970 [0062.764] GetCurrentThreadId () returned 0x970 [0062.765] GetCurrentThreadId () returned 0x970 [0062.765] GetCurrentThreadId () returned 0x970 [0062.765] GetCurrentThreadId () returned 0x970 [0062.765] GetCurrentThreadId () returned 0x970 [0062.765] GetCurrentThreadId () returned 0x970 [0062.765] GetCurrentThreadId () returned 0x970 [0062.765] GetCurrentThreadId () returned 0x970 [0062.765] GetCurrentThreadId () returned 0x970 [0062.765] GetCurrentThreadId () returned 0x970 [0062.765] GetCurrentThreadId () returned 0x970 [0062.765] GetCurrentThreadId () returned 0x970 [0062.765] GetCurrentThreadId () returned 0x970 [0062.765] GetCurrentThreadId () returned 0x970 [0062.765] GetCurrentThreadId () returned 0x970 [0062.765] GetCurrentThreadId () returned 0x970 [0062.765] GetCurrentThreadId () returned 0x970 [0062.765] GetCurrentThreadId () returned 0x970 [0062.765] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAAELCxkssAqoK9unNhC6eGXtfCg63wE/uIr820Nv690RC5QWBcJPLV5tiZa9r8HUHnPvZ583tqqt27GReYBtcqqCkIoqic/g4he0QFcDs84mFXncOVeewWR3mSKQLIQ/MwjGhnz2BFo+yF33WJZuEqedMVL79m0RHNSOLAApKMOD6Ir2o8fP9PUWTwOR4a0qE0rqARkaV+USC9Tm/jWbxYD2wIj4iO7bJw==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0062.765] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAAELCxkssAqoK9unNhC6eGXtfCg63wE/uIr820Nv690RC5QWBcJPLV5tiZa9r8HUHnPvZ583tqqt27GReYBtcqqCkIoqic/g4he0QFcDs84mFXncOVeewWR3mSKQLIQ/MwjGhnz2BFo+yF33WJZuEqedMVL79m0RHNSOLAApKMOD6Ir2o8fP9PUWTwOR4a0qE0rqARkaV+USC9Tm/jWbxYD2wIj4iO7bJw==", cchWideChar=245, lpMultiByteStr=0x353933c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAAELCxkssAqoK9unNhC6eGXtfCg63wE/uIr820Nv690RC5QWBcJPLV5tiZa9r8HUHnPvZ583tqqt27GReYBtcqqCkIoqic/g4he0QFcDs84mFXncOVeewWR3mSKQLIQ/MwjGhnz2BFo+yF33WJZuEqedMVL79m0RHNSOLAApKMOD6Ir2o8fP9PUWTwOR4a0qE0rqARkaV+USC9Tm/jWbxYD2wIj4iO7bJw==", lpUsedDefaultChar=0x0) returned 245 [0062.765] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0062.765] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0062.765] CloseHandle (hObject=0x158) returned 1 [0062.765] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png")) returned 1 [0062.766] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=18302994354) returned 1 [0062.767] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\Файл зашифрован [PREVIEW.GIF].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\Файл зашифрован [preview.gif].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0062.768] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0062.768] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0062.768] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0062.769] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0062.769] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0062.769] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0062.769] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0062.769] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0062.769] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0062.769] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0062.769] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0062.769] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0062.769] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0062.769] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0062.769] SetEndOfFile (hFile=0x158) returned 1 [0062.769] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0062.769] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0062.769] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0062.770] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0062.770] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0062.770] WriteFile (in: hFile=0x158, lpBuffer=0x35f011c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f011c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0062.771] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t\"@ZJD^baQ\"\\8R84vjj\"}rJ0J9", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0062.907] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="5$,4R\"IWsI/Pm\"L)6>8R84vjj\"}rJ0J9", cchWideChar=32, lpMultiByteStr=0x2035aec, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5$,4R\"IWsI/Pm\"L)6>8R84vjj\"}rJ0J9", lpUsedDefaultChar=0x0) returned 32 [0062.907] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0062.907] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0062.907] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8573, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0x295098 [0062.907] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0062.907] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0062.907] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png")) returned 0x20 [0062.907] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png")) returned 0x20 [0062.907] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png")) returned 0x20 [0062.907] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png")) returned 0x20 [0062.907] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8573)) returned 1 [0062.908] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0062.908] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0062.908] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png")) returned 0x20 [0062.908] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png")) returned 0x20 [0062.908] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0062.908] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0062.908] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0062.908] SetEndOfFile (hFile=0x158) returned 1 [0062.909] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0062.909] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe36ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0062.909] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0062.909] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe434c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0062.909] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe434c, cbMultiByte=12, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="THMBNAIL.PNGer.gifg") returned 12 [0062.909] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0062.909] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe36ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0062.909] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0062.909] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0062.909] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x8573 [0062.909] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0062.909] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0062.909] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0062.910] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0062.910] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe36ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0062.910] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0062.910] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe434c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0062.910] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe434c, cbMultiByte=12, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="THMBNAIL.PNGIL.PNGer.gifg") returned 12 [0062.910] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0062.910] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe36ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0062.910] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0062.911] CharToOemA (in: pSrc="THMBNAIL.PNG", pDst=0x1fe434c | out: pDst="THMBNAIL.PNG") returned 1 [0062.911] WriteFile (in: hFile=0x158, lpBuffer=0x1fe434c*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe434c*, lpNumberOfBytesWritten=0x18e048*=0xc, lpOverlapped=0x0) returned 1 [0062.911] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0062.911] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0062.911] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0062.911] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=18317454775) returned 1 [0062.911] ReadFile (in: hFile=0x11c, lpBuffer=0x37b81a0, nNumberOfBytesToRead=0x8573, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37b81a0*, lpNumberOfBytesRead=0x18dd7c*=0x8573, lpOverlapped=0x0) returned 1 [0062.913] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0062.913] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=18317675994) returned 1 [0062.922] WriteFile (in: hFile=0x158, lpBuffer=0x1fea3d8*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fea3d8*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0062.922] ReadFile (in: hFile=0x11c, lpBuffer=0x37b81a0, nNumberOfBytesToRead=0x8573, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x37b81a0*, lpNumberOfBytesRead=0x18de38*=0x8573, lpOverlapped=0x0) returned 1 [0062.923] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x47 [0062.923] WriteFile (in: hFile=0x158, lpBuffer=0x3801fc0*, nNumberOfBytesToWrite=0x8573, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3801fc0*, lpNumberOfBytesWritten=0x18de10*=0x8573, lpOverlapped=0x0) returned 1 [0062.924] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x85ba [0062.924] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0062.924] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0062.924] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0062.924] SetFilePointer (in: hFile=0x158, lDistanceToMove=12, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2a [0062.924] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x85c4 [0062.924] CloseHandle (hObject=0x11c) returned 1 [0062.924] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x85c4 [0062.924] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x85c4 [0062.924] SetFilePointer (in: hFile=0x158, lDistanceToMove=34244, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x85c4 [0062.924] SetFilePointer (in: hFile=0x158, lDistanceToMove=34244, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x85c4 [0062.924] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x85c4 [0062.925] SetFilePointer (in: hFile=0x158, lDistanceToMove=34244, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x85c4 [0062.925] SetEndOfFile (hFile=0x158) returned 1 [0062.925] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x85c4 [0062.925] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x85c4 [0062.925] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0062.925] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe36ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0062.925] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0062.925] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe37ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0062.925] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe37ec, cbMultiByte=12, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="THMBNAIL.PNGꞗ@涤(\x18믉`믑`") returned 12 [0062.925] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0062.925] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe36ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0062.925] WriteFile (in: hFile=0x158, lpBuffer=0x379bc78*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x379bc78*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0062.925] CharToOemA (in: pSrc="THMBNAIL.PNG", pDst=0x1fe37ec | out: pDst="THMBNAIL.PNG") returned 1 [0062.925] WriteFile (in: hFile=0x158, lpBuffer=0x1fe37ec*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe37ec*, lpNumberOfBytesWritten=0x18efcc*=0xc, lpOverlapped=0x0) returned 1 [0062.925] WriteFile (in: hFile=0x158, lpBuffer=0x1fea110*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea110*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0062.926] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0062.926] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0062.926] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x8609 [0062.926] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x8609 [0062.926] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0062.926] WriteFile (in: hFile=0x158, lpBuffer=0x35f01dc*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f01dc*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0062.926] DeleteFileW (lpFileName="") returned 0 [0062.926] GetLastError () returned 0x3 [0062.926] GetFileAttributesW (lpFileName="") returned 0xffffffff [0062.926] SetLastError (dwErrCode=0x3) [0062.926] FlushFileBuffers (hFile=0x158) returned 1 [0062.929] GetCurrentThreadId () returned 0x970 [0062.929] GetCurrentThreadId () returned 0x970 [0062.929] GetCurrentThreadId () returned 0x970 [0062.929] GetCurrentThreadId () returned 0x970 [0062.929] GetCurrentThreadId () returned 0x970 [0062.930] GetCurrentThreadId () returned 0x970 [0062.930] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x86c0 [0062.930] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x86c0 [0062.930] SetFilePointer (in: hFile=0x158, lDistanceToMove=34496, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x86c0 [0062.930] CloseHandle (hObject=0x158) returned 1 [0062.930] GetCurrentThreadId () returned 0x970 [0062.930] GetCurrentThreadId () returned 0x970 [0062.930] GetCurrentThreadId () returned 0x970 [0062.930] GetCurrentThreadId () returned 0x970 [0062.930] GetCurrentThreadId () returned 0x970 [0062.930] GetCurrentThreadId () returned 0x970 [0062.930] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\Файл зашифрован [THMBNAIL.PNG].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\Файл зашифрован [thmbnail.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0062.930] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x86c0 [0062.930] SetFilePointer (in: hFile=0x158, lDistanceToMove=34368, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8640 [0062.930] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0062.930] GetFileType (hFile=0x158) returned 0x1 [0062.930] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xa, wMilliseconds=0xd0)) [0062.930] GetCurrentThreadId () returned 0x970 [0062.930] GetCurrentThreadId () returned 0x970 [0062.930] GetCurrentThreadId () returned 0x970 [0062.930] GetCurrentThreadId () returned 0x970 [0062.930] GetCurrentThreadId () returned 0x970 [0062.930] GetCurrentThreadId () returned 0x970 [0062.931] GetCurrentThreadId () returned 0x970 [0062.931] GetCurrentThreadId () returned 0x970 [0062.931] GetCurrentThreadId () returned 0x970 [0062.931] GetCurrentThreadId () returned 0x970 [0062.931] GetCurrentThreadId () returned 0x970 [0062.931] GetCurrentThreadId () returned 0x970 [0062.931] GetCurrentThreadId () returned 0x970 [0062.931] GetCurrentThreadId () returned 0x970 [0062.931] GetCurrentThreadId () returned 0x970 [0062.931] GetCurrentThreadId () returned 0x970 [0062.931] GetCurrentThreadId () returned 0x970 [0062.931] GetCurrentThreadId () returned 0x970 [0062.931] GetCurrentThreadId () returned 0x970 [0062.931] GetCurrentThreadId () returned 0x970 [0062.931] GetCurrentThreadId () returned 0x970 [0062.931] GetCurrentThreadId () returned 0x970 [0062.931] GetCurrentThreadId () returned 0x970 [0062.931] GetCurrentThreadId () returned 0x970 [0062.931] GetCurrentThreadId () returned 0x970 [0062.931] GetCurrentThreadId () returned 0x970 [0062.931] GetCurrentThreadId () returned 0x970 [0062.931] GetCurrentThreadId () returned 0x970 [0062.931] GetCurrentThreadId () returned 0x970 [0062.931] GetCurrentThreadId () returned 0x970 [0062.931] GetCurrentThreadId () returned 0x970 [0062.931] GetCurrentThreadId () returned 0x970 [0062.931] GetCurrentThreadId () returned 0x970 [0062.931] GetCurrentThreadId () returned 0x970 [0062.931] GetCurrentThreadId () returned 0x970 [0062.931] GetCurrentThreadId () returned 0x970 [0062.931] GetCurrentThreadId () returned 0x970 [0062.931] GetCurrentThreadId () returned 0x970 [0062.931] GetCurrentThreadId () returned 0x970 [0062.931] GetCurrentThreadId () returned 0x970 [0062.931] GetCurrentThreadId () returned 0x970 [0062.931] GetCurrentThreadId () returned 0x970 [0062.931] GetCurrentThreadId () returned 0x970 [0062.931] GetCurrentThreadId () returned 0x970 [0062.931] GetCurrentThreadId () returned 0x970 [0062.931] GetCurrentThreadId () returned 0x970 [0062.931] GetCurrentThreadId () returned 0x970 [0062.931] GetCurrentThreadId () returned 0x970 [0062.931] GetCurrentThreadId () returned 0x970 [0062.931] GetCurrentThreadId () returned 0x970 [0062.931] GetCurrentThreadId () returned 0x970 [0062.931] GetCurrentThreadId () returned 0x970 [0062.932] GetCurrentThreadId () returned 0x970 [0062.932] GetCurrentThreadId () returned 0x970 [0062.932] GetCurrentThreadId () returned 0x970 [0062.932] GetCurrentThreadId () returned 0x970 [0062.932] GetCurrentThreadId () returned 0x970 [0062.932] GetCurrentThreadId () returned 0x970 [0062.932] GetCurrentThreadId () returned 0x970 [0062.932] GetCurrentThreadId () returned 0x970 [0062.932] GetCurrentThreadId () returned 0x970 [0062.932] GetCurrentThreadId () returned 0x970 [0062.932] GetCurrentThreadId () returned 0x970 [0062.932] GetCurrentThreadId () returned 0x970 [0062.932] GetCurrentThreadId () returned 0x970 [0062.932] GetCurrentThreadId () returned 0x970 [0062.932] GetCurrentThreadId () returned 0x970 [0062.932] GetCurrentThreadId () returned 0x970 [0062.932] GetCurrentThreadId () returned 0x970 [0062.932] GetCurrentThreadId () returned 0x970 [0062.932] GetCurrentThreadId () returned 0x970 [0062.932] GetCurrentThreadId () returned 0x970 [0062.932] GetCurrentThreadId () returned 0x970 [0062.932] GetCurrentThreadId () returned 0x970 [0062.932] GetCurrentThreadId () returned 0x970 [0062.932] GetCurrentThreadId () returned 0x970 [0062.932] GetCurrentThreadId () returned 0x970 [0062.932] GetCurrentThreadId () returned 0x970 [0062.932] GetCurrentThreadId () returned 0x970 [0062.932] GetCurrentThreadId () returned 0x970 [0062.932] GetCurrentThreadId () returned 0x970 [0062.932] GetCurrentThreadId () returned 0x970 [0062.932] GetCurrentThreadId () returned 0x970 [0062.932] GetCurrentThreadId () returned 0x970 [0062.932] GetCurrentThreadId () returned 0x970 [0062.932] GetCurrentThreadId () returned 0x970 [0062.932] GetCurrentThreadId () returned 0x970 [0062.932] GetCurrentThreadId () returned 0x970 [0062.932] GetCurrentThreadId () returned 0x970 [0062.932] GetCurrentThreadId () returned 0x970 [0062.932] GetCurrentThreadId () returned 0x970 [0062.932] GetCurrentThreadId () returned 0x970 [0062.932] GetCurrentThreadId () returned 0x970 [0062.932] GetCurrentThreadId () returned 0x970 [0062.932] GetCurrentThreadId () returned 0x970 [0062.932] GetCurrentThreadId () returned 0x970 [0062.932] GetCurrentThreadId () returned 0x970 [0062.932] GetCurrentThreadId () returned 0x970 [0062.933] GetCurrentThreadId () returned 0x970 [0062.933] GetCurrentThreadId () returned 0x970 [0062.933] GetCurrentThreadId () returned 0x970 [0062.933] GetCurrentThreadId () returned 0x970 [0062.933] GetCurrentThreadId () returned 0x970 [0062.933] GetCurrentThreadId () returned 0x970 [0062.933] GetCurrentThreadId () returned 0x970 [0062.933] GetCurrentThreadId () returned 0x970 [0062.933] GetCurrentThreadId () returned 0x970 [0062.933] GetCurrentThreadId () returned 0x970 [0062.933] GetCurrentThreadId () returned 0x970 [0062.933] GetCurrentThreadId () returned 0x970 [0062.933] GetCurrentThreadId () returned 0x970 [0062.933] GetCurrentThreadId () returned 0x970 [0062.933] GetCurrentThreadId () returned 0x970 [0062.933] GetCurrentThreadId () returned 0x970 [0062.933] GetCurrentThreadId () returned 0x970 [0062.933] GetCurrentThreadId () returned 0x970 [0062.933] GetCurrentThreadId () returned 0x970 [0062.933] GetCurrentThreadId () returned 0x970 [0062.933] GetCurrentThreadId () returned 0x970 [0062.933] GetCurrentThreadId () returned 0x970 [0062.933] GetCurrentThreadId () returned 0x970 [0062.933] GetCurrentThreadId () returned 0x970 [0062.933] GetCurrentThreadId () returned 0x970 [0062.933] GetCurrentThreadId () returned 0x970 [0062.933] GetCurrentThreadId () returned 0x970 [0062.933] GetCurrentThreadId () returned 0x970 [0062.933] GetCurrentThreadId () returned 0x970 [0062.933] GetCurrentThreadId () returned 0x970 [0062.933] GetCurrentThreadId () returned 0x970 [0062.933] GetCurrentThreadId () returned 0x970 [0062.933] GetCurrentThreadId () returned 0x970 [0062.933] GetCurrentThreadId () returned 0x970 [0062.933] GetCurrentThreadId () returned 0x970 [0062.933] GetCurrentThreadId () returned 0x970 [0062.933] GetCurrentThreadId () returned 0x970 [0062.933] GetCurrentThreadId () returned 0x970 [0062.933] GetCurrentThreadId () returned 0x970 [0062.933] GetCurrentThreadId () returned 0x970 [0062.933] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.933] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.933] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff0890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.934] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.934] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.934] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff0890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.934] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.934] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.934] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.934] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.934] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.934] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea4d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.934] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.934] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.934] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff08f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.934] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.934] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.934] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff08f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.934] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.934] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.934] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff08f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.934] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xa, wMilliseconds=0xd0)) [0062.934] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="5$,4R\"IWsI/Pm\"L)6>8R84vjj\"}rJ0J9", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0062.934] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="5$,4R\"IWsI/Pm\"L)6>8R84vjj\"}rJ0J9", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0062.934] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="5$,4R\"IWsI/Pm\"L)6>8R84vjj\"}rJ0J9", cchWideChar=32, lpMultiByteStr=0x2003298, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5$,4R\"IWsI/Pm\"L)6>8R84vjj\"}rJ0J9", lpUsedDefaultChar=0x0) returned 32 [0062.934] GetCurrentThreadId () returned 0x970 [0062.934] GetCurrentThreadId () returned 0x970 [0062.934] GetCurrentThreadId () returned 0x970 [0062.934] GetCurrentThreadId () returned 0x970 [0062.934] GetCurrentThreadId () returned 0x970 [0062.934] GetCurrentThreadId () returned 0x970 [0062.942] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0062.942] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0062.942] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3795918, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0062.942] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0062.942] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAGIXrCPq0pwl1zSMpDG0oVXKmJsRZlvwXLIves+2xDisQv03D6vO/dLiprZNIm6ExkBXZsfS8Pdyup0KivswCNhF9N2js/yG0Fq25qSx6oKPSDW4U98PxBHfImFV1fMIF93g/mGb/pwJd/n9t8Y2kq+OVqzJQnKsQh1eXyGYhGowVWQLshGZv3MYHojnr34sGvjdAXrqWMzCwoIWPzg9s9/yZgDstF6iLw==") returned 232 [0062.942] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xa, wMilliseconds=0xd0)) [0062.942] GetCurrentThreadId () returned 0x970 [0062.942] GetCurrentThreadId () returned 0x970 [0062.942] GetCurrentThreadId () returned 0x970 [0062.942] GetCurrentThreadId () returned 0x970 [0062.942] GetCurrentThreadId () returned 0x970 [0062.942] GetCurrentThreadId () returned 0x970 [0062.942] GetCurrentThreadId () returned 0x970 [0062.942] GetCurrentThreadId () returned 0x970 [0062.942] GetCurrentThreadId () returned 0x970 [0062.942] GetCurrentThreadId () returned 0x970 [0062.942] GetCurrentThreadId () returned 0x970 [0062.942] GetCurrentThreadId () returned 0x970 [0062.942] GetCurrentThreadId () returned 0x970 [0062.942] GetCurrentThreadId () returned 0x970 [0062.942] GetCurrentThreadId () returned 0x970 [0062.942] GetCurrentThreadId () returned 0x970 [0062.942] GetCurrentThreadId () returned 0x970 [0062.942] GetCurrentThreadId () returned 0x970 [0062.942] GetCurrentThreadId () returned 0x970 [0062.942] GetCurrentThreadId () returned 0x970 [0062.942] GetCurrentThreadId () returned 0x970 [0062.942] GetCurrentThreadId () returned 0x970 [0062.942] GetCurrentThreadId () returned 0x970 [0062.942] GetCurrentThreadId () returned 0x970 [0062.942] GetCurrentThreadId () returned 0x970 [0062.942] GetCurrentThreadId () returned 0x970 [0062.943] GetCurrentThreadId () returned 0x970 [0062.943] GetCurrentThreadId () returned 0x970 [0062.943] GetCurrentThreadId () returned 0x970 [0062.943] GetCurrentThreadId () returned 0x970 [0062.943] GetCurrentThreadId () returned 0x970 [0062.943] GetCurrentThreadId () returned 0x970 [0062.943] GetCurrentThreadId () returned 0x970 [0062.943] GetCurrentThreadId () returned 0x970 [0062.943] GetCurrentThreadId () returned 0x970 [0062.943] GetCurrentThreadId () returned 0x970 [0062.943] GetCurrentThreadId () returned 0x970 [0062.943] GetCurrentThreadId () returned 0x970 [0062.943] GetCurrentThreadId () returned 0x970 [0062.943] GetCurrentThreadId () returned 0x970 [0062.943] GetCurrentThreadId () returned 0x970 [0062.943] GetCurrentThreadId () returned 0x970 [0062.943] GetCurrentThreadId () returned 0x970 [0062.943] GetCurrentThreadId () returned 0x970 [0062.943] GetCurrentThreadId () returned 0x970 [0062.943] GetCurrentThreadId () returned 0x970 [0062.943] GetCurrentThreadId () returned 0x970 [0062.943] GetCurrentThreadId () returned 0x970 [0062.943] GetCurrentThreadId () returned 0x970 [0062.943] GetCurrentThreadId () returned 0x970 [0062.943] GetCurrentThreadId () returned 0x970 [0062.943] GetCurrentThreadId () returned 0x970 [0062.943] GetCurrentThreadId () returned 0x970 [0062.943] GetCurrentThreadId () returned 0x970 [0062.943] GetCurrentThreadId () returned 0x970 [0062.943] GetCurrentThreadId () returned 0x970 [0062.943] GetCurrentThreadId () returned 0x970 [0062.943] GetCurrentThreadId () returned 0x970 [0062.943] GetCurrentThreadId () returned 0x970 [0062.943] GetCurrentThreadId () returned 0x970 [0062.943] GetCurrentThreadId () returned 0x970 [0062.943] GetCurrentThreadId () returned 0x970 [0062.943] GetCurrentThreadId () returned 0x970 [0062.943] GetCurrentThreadId () returned 0x970 [0062.943] GetCurrentThreadId () returned 0x970 [0062.943] GetCurrentThreadId () returned 0x970 [0062.943] GetCurrentThreadId () returned 0x970 [0062.943] GetCurrentThreadId () returned 0x970 [0062.943] GetCurrentThreadId () returned 0x970 [0062.943] GetCurrentThreadId () returned 0x970 [0062.943] GetCurrentThreadId () returned 0x970 [0062.944] GetCurrentThreadId () returned 0x970 [0062.944] GetCurrentThreadId () returned 0x970 [0062.944] GetCurrentThreadId () returned 0x970 [0062.944] GetCurrentThreadId () returned 0x970 [0062.944] GetCurrentThreadId () returned 0x970 [0062.944] GetCurrentThreadId () returned 0x970 [0062.944] GetCurrentThreadId () returned 0x970 [0062.944] GetCurrentThreadId () returned 0x970 [0062.944] GetCurrentThreadId () returned 0x970 [0062.944] GetCurrentThreadId () returned 0x970 [0062.944] GetCurrentThreadId () returned 0x970 [0062.944] GetCurrentThreadId () returned 0x970 [0062.944] GetCurrentThreadId () returned 0x970 [0062.944] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAGIXrCPq0pwl1zSMpDG0oVXKmJsRZlvwXLIves+2xDisQv03D6vO/dLiprZNIm6ExkBXZsfS8Pdyup0KivswCNhF9N2js/yG0Fq25qSx6oKPSDW4U98PxBHfImFV1fMIF93g/mGb/pwJd/n9t8Y2kq+OVqzJQnKsQh1eXyGYhGowVWQLshGZv3MYHojnr34sGvjdAXrqWMzCwoIWPzg9s9/yZgDstF6iLw==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0062.944] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAGIXrCPq0pwl1zSMpDG0oVXKmJsRZlvwXLIves+2xDisQv03D6vO/dLiprZNIm6ExkBXZsfS8Pdyup0KivswCNhF9N2js/yG0Fq25qSx6oKPSDW4U98PxBHfImFV1fMIF93g/mGb/pwJd/n9t8Y2kq+OVqzJQnKsQh1eXyGYhGowVWQLshGZv3MYHojnr34sGvjdAXrqWMzCwoIWPzg9s9/yZgDstF6iLw==", cchWideChar=245, lpMultiByteStr=0x353933c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAGIXrCPq0pwl1zSMpDG0oVXKmJsRZlvwXLIves+2xDisQv03D6vO/dLiprZNIm6ExkBXZsfS8Pdyup0KivswCNhF9N2js/yG0Fq25qSx6oKPSDW4U98PxBHfImFV1fMIF93g/mGb/pwJd/n9t8Y2kq+OVqzJQnKsQh1eXyGYhGowVWQLshGZv3MYHojnr34sGvjdAXrqWMzCwoIWPzg9s9/yZgDstF6iLw==", lpUsedDefaultChar=0x0) returned 245 [0062.944] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0062.944] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0062.944] CloseHandle (hObject=0x158) returned 1 [0062.944] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png")) returned 1 [0062.946] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=18320907051) returned 1 [0062.946] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\Файл зашифрован [PREVIEW.GIF].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\Файл зашифрован [preview.gif].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0062.950] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0062.950] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0062.950] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0062.950] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0062.950] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0062.950] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0062.950] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0062.950] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0062.950] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0062.950] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0062.951] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0062.951] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0062.951] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0062.951] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0062.951] SetEndOfFile (hFile=0x158) returned 1 [0062.951] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0062.951] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0062.951] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0062.951] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0062.951] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0062.952] WriteFile (in: hFile=0x158, lpBuffer=0x35f011c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f011c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0062.952] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-BUj3hbiIo5Z!Rb\",~x$$>er+OgEmRHq", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0062.952] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-BUj3hbiIo5Z!Rb\",~x$$>er+OgEmRHq", cchWideChar=32, lpMultiByteStr=0x2035b24, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-BUj3hbiIo5Z!Rb\",~x$$>er+OgEmRHq", lpUsedDefaultChar=0x0) returned 32 [0062.952] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0062.952] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0062.952] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 0x295098 [0062.952] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0062.953] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0062.953] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif")) returned 0x20 [0062.953] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif")) returned 0x20 [0062.953] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif")) returned 0x20 [0062.953] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif")) returned 0x20 [0062.953] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3a9)) returned 1 [0062.953] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0062.953] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0062.953] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif")) returned 0x20 [0062.953] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif")) returned 0x20 [0062.953] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0062.953] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0062.953] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0062.953] SetEndOfFile (hFile=0x158) returned 1 [0062.954] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0062.954] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe410c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0062.954] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0062.954] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe374c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0062.954] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe374c, cbMultiByte=11, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="PREVIEW.GIFGer.gifg") returned 11 [0062.954] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0062.954] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe410c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0062.954] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0062.955] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0062.955] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x3a9 [0062.955] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0062.955] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0062.955] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0062.955] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0062.955] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe410c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0062.955] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0062.955] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe374c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0062.955] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe374c, cbMultiByte=11, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="PREVIEW.GIFEW.GIFGer.gifg") returned 11 [0062.955] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0062.955] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe410c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0062.955] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0062.956] CharToOemA (in: pSrc="PREVIEW.GIF", pDst=0x1fe374c | out: pDst="PREVIEW.GIF") returned 1 [0062.956] WriteFile (in: hFile=0x158, lpBuffer=0x1fe374c*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe374c*, lpNumberOfBytesWritten=0x18e048*=0xb, lpOverlapped=0x0) returned 1 [0062.956] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0062.957] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0062.957] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0062.957] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=18322016225) returned 1 [0062.957] ReadFile (in: hFile=0x11c, lpBuffer=0x37b81c0, nNumberOfBytesToRead=0x3a9, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37b81c0*, lpNumberOfBytesRead=0x18dd7c*=0x3a9, lpOverlapped=0x0) returned 1 [0062.958] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0062.958] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=18322173670) returned 1 [0062.967] WriteFile (in: hFile=0x158, lpBuffer=0x1fea258*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fea258*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0062.967] ReadFile (in: hFile=0x11c, lpBuffer=0x37b81c0, nNumberOfBytesToRead=0x3a9, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x37b81c0*, lpNumberOfBytesRead=0x18de38*=0x3a9, lpOverlapped=0x0) returned 1 [0062.967] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x46 [0062.967] WriteFile (in: hFile=0x158, lpBuffer=0x37b8580*, nNumberOfBytesToWrite=0x3a9, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x37b8580*, lpNumberOfBytesWritten=0x18de10*=0x3a9, lpOverlapped=0x0) returned 1 [0062.968] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x3ef [0062.968] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0062.968] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0062.968] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0062.968] SetFilePointer (in: hFile=0x158, lDistanceToMove=11, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x29 [0062.968] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x3f9 [0062.968] CloseHandle (hObject=0x11c) returned 1 [0062.968] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x3f9 [0062.968] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x3f9 [0062.968] SetFilePointer (in: hFile=0x158, lDistanceToMove=1017, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x3f9 [0062.968] SetFilePointer (in: hFile=0x158, lDistanceToMove=1017, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x3f9 [0062.968] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x3f9 [0062.968] SetFilePointer (in: hFile=0x158, lDistanceToMove=1017, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x3f9 [0062.968] SetEndOfFile (hFile=0x158) returned 1 [0062.969] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x3f9 [0062.969] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x3f9 [0062.969] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0062.969] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe410c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0062.969] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0062.969] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe41ac, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0062.969] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe41ac, cbMultiByte=11, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="PREVIEW.GIF\x18ꞗ@涤(\x18믉`믑`") returned 11 [0062.969] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0062.969] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe410c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0062.969] WriteFile (in: hFile=0x158, lpBuffer=0x379bc78*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x379bc78*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0062.969] CharToOemA (in: pSrc="PREVIEW.GIF", pDst=0x1fe41ac | out: pDst="PREVIEW.GIF") returned 1 [0062.969] WriteFile (in: hFile=0x158, lpBuffer=0x1fe41ac*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe41ac*, lpNumberOfBytesWritten=0x18efcc*=0xb, lpOverlapped=0x0) returned 1 [0062.969] WriteFile (in: hFile=0x158, lpBuffer=0x1fea2d8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea2d8*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0062.969] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0062.969] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0062.970] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x43d [0062.970] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x43d [0062.970] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0062.970] WriteFile (in: hFile=0x158, lpBuffer=0x35f011c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f011c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0062.970] DeleteFileW (lpFileName="") returned 0 [0062.970] GetLastError () returned 0x3 [0062.970] GetFileAttributesW (lpFileName="") returned 0xffffffff [0062.970] SetLastError (dwErrCode=0x3) [0062.970] FlushFileBuffers (hFile=0x158) returned 1 [0062.973] GetCurrentThreadId () returned 0x970 [0062.973] GetCurrentThreadId () returned 0x970 [0062.973] GetCurrentThreadId () returned 0x970 [0062.973] GetCurrentThreadId () returned 0x970 [0062.973] GetCurrentThreadId () returned 0x970 [0062.973] GetCurrentThreadId () returned 0x970 [0062.973] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x4f4 [0062.973] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x4f4 [0062.973] SetFilePointer (in: hFile=0x158, lDistanceToMove=1268, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x4f4 [0062.973] CloseHandle (hObject=0x158) returned 1 [0062.973] GetCurrentThreadId () returned 0x970 [0062.973] GetCurrentThreadId () returned 0x970 [0062.973] GetCurrentThreadId () returned 0x970 [0062.973] GetCurrentThreadId () returned 0x970 [0062.973] GetCurrentThreadId () returned 0x970 [0062.973] GetCurrentThreadId () returned 0x970 [0062.973] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\Файл зашифрован [PREVIEW.GIF].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\Файл зашифрован [preview.gif].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0062.973] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4f4 [0062.973] SetFilePointer (in: hFile=0x158, lDistanceToMove=1140, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x474 [0062.973] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0062.973] GetFileType (hFile=0x158) returned 0x1 [0062.973] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xa, wMilliseconds=0xef)) [0062.974] GetCurrentThreadId () returned 0x970 [0062.974] GetCurrentThreadId () returned 0x970 [0062.974] GetCurrentThreadId () returned 0x970 [0062.974] GetCurrentThreadId () returned 0x970 [0062.974] GetCurrentThreadId () returned 0x970 [0062.974] GetCurrentThreadId () returned 0x970 [0062.974] GetCurrentThreadId () returned 0x970 [0062.974] GetCurrentThreadId () returned 0x970 [0062.974] GetCurrentThreadId () returned 0x970 [0062.974] GetCurrentThreadId () returned 0x970 [0062.974] GetCurrentThreadId () returned 0x970 [0062.974] GetCurrentThreadId () returned 0x970 [0062.974] GetCurrentThreadId () returned 0x970 [0062.974] GetCurrentThreadId () returned 0x970 [0062.974] GetCurrentThreadId () returned 0x970 [0062.974] GetCurrentThreadId () returned 0x970 [0062.974] GetCurrentThreadId () returned 0x970 [0062.974] GetCurrentThreadId () returned 0x970 [0062.974] GetCurrentThreadId () returned 0x970 [0062.974] GetCurrentThreadId () returned 0x970 [0062.974] GetCurrentThreadId () returned 0x970 [0062.974] GetCurrentThreadId () returned 0x970 [0062.974] GetCurrentThreadId () returned 0x970 [0062.974] GetCurrentThreadId () returned 0x970 [0062.974] GetCurrentThreadId () returned 0x970 [0062.974] GetCurrentThreadId () returned 0x970 [0062.974] GetCurrentThreadId () returned 0x970 [0062.974] GetCurrentThreadId () returned 0x970 [0062.974] GetCurrentThreadId () returned 0x970 [0062.974] GetCurrentThreadId () returned 0x970 [0062.974] GetCurrentThreadId () returned 0x970 [0062.974] GetCurrentThreadId () returned 0x970 [0062.974] GetCurrentThreadId () returned 0x970 [0062.974] GetCurrentThreadId () returned 0x970 [0062.974] GetCurrentThreadId () returned 0x970 [0062.974] GetCurrentThreadId () returned 0x970 [0062.974] GetCurrentThreadId () returned 0x970 [0062.974] GetCurrentThreadId () returned 0x970 [0062.974] GetCurrentThreadId () returned 0x970 [0062.974] GetCurrentThreadId () returned 0x970 [0062.974] GetCurrentThreadId () returned 0x970 [0062.974] GetCurrentThreadId () returned 0x970 [0062.974] GetCurrentThreadId () returned 0x970 [0062.974] GetCurrentThreadId () returned 0x970 [0062.974] GetCurrentThreadId () returned 0x970 [0062.975] GetCurrentThreadId () returned 0x970 [0062.975] GetCurrentThreadId () returned 0x970 [0062.975] GetCurrentThreadId () returned 0x970 [0062.975] GetCurrentThreadId () returned 0x970 [0062.975] GetCurrentThreadId () returned 0x970 [0062.975] GetCurrentThreadId () returned 0x970 [0062.975] GetCurrentThreadId () returned 0x970 [0062.975] GetCurrentThreadId () returned 0x970 [0062.975] GetCurrentThreadId () returned 0x970 [0062.975] GetCurrentThreadId () returned 0x970 [0062.975] GetCurrentThreadId () returned 0x970 [0062.975] GetCurrentThreadId () returned 0x970 [0062.975] GetCurrentThreadId () returned 0x970 [0062.975] GetCurrentThreadId () returned 0x970 [0062.975] GetCurrentThreadId () returned 0x970 [0062.975] GetCurrentThreadId () returned 0x970 [0062.975] GetCurrentThreadId () returned 0x970 [0062.975] GetCurrentThreadId () returned 0x970 [0062.975] GetCurrentThreadId () returned 0x970 [0062.975] GetCurrentThreadId () returned 0x970 [0062.975] GetCurrentThreadId () returned 0x970 [0062.975] GetCurrentThreadId () returned 0x970 [0062.975] GetCurrentThreadId () returned 0x970 [0062.975] GetCurrentThreadId () returned 0x970 [0062.975] GetCurrentThreadId () returned 0x970 [0062.975] GetCurrentThreadId () returned 0x970 [0062.975] GetCurrentThreadId () returned 0x970 [0062.975] GetCurrentThreadId () returned 0x970 [0062.975] GetCurrentThreadId () returned 0x970 [0062.975] GetCurrentThreadId () returned 0x970 [0062.975] GetCurrentThreadId () returned 0x970 [0062.975] GetCurrentThreadId () returned 0x970 [0062.975] GetCurrentThreadId () returned 0x970 [0062.975] GetCurrentThreadId () returned 0x970 [0062.975] GetCurrentThreadId () returned 0x970 [0062.975] GetCurrentThreadId () returned 0x970 [0062.975] GetCurrentThreadId () returned 0x970 [0062.975] GetCurrentThreadId () returned 0x970 [0062.975] GetCurrentThreadId () returned 0x970 [0062.975] GetCurrentThreadId () returned 0x970 [0062.975] GetCurrentThreadId () returned 0x970 [0062.976] GetCurrentThreadId () returned 0x970 [0062.976] GetCurrentThreadId () returned 0x970 [0062.976] GetCurrentThreadId () returned 0x970 [0062.976] GetCurrentThreadId () returned 0x970 [0062.976] GetCurrentThreadId () returned 0x970 [0062.976] GetCurrentThreadId () returned 0x970 [0062.976] GetCurrentThreadId () returned 0x970 [0062.976] GetCurrentThreadId () returned 0x970 [0062.976] GetCurrentThreadId () returned 0x970 [0062.976] GetCurrentThreadId () returned 0x970 [0062.976] GetCurrentThreadId () returned 0x970 [0062.976] GetCurrentThreadId () returned 0x970 [0062.976] GetCurrentThreadId () returned 0x970 [0062.976] GetCurrentThreadId () returned 0x970 [0062.976] GetCurrentThreadId () returned 0x970 [0062.976] GetCurrentThreadId () returned 0x970 [0062.976] GetCurrentThreadId () returned 0x970 [0062.976] GetCurrentThreadId () returned 0x970 [0062.976] GetCurrentThreadId () returned 0x970 [0062.976] GetCurrentThreadId () returned 0x970 [0062.976] GetCurrentThreadId () returned 0x970 [0062.976] GetCurrentThreadId () returned 0x970 [0062.976] GetCurrentThreadId () returned 0x970 [0062.976] GetCurrentThreadId () returned 0x970 [0062.976] GetCurrentThreadId () returned 0x970 [0062.976] GetCurrentThreadId () returned 0x970 [0062.976] GetCurrentThreadId () returned 0x970 [0062.976] GetCurrentThreadId () returned 0x970 [0062.976] GetCurrentThreadId () returned 0x970 [0062.976] GetCurrentThreadId () returned 0x970 [0062.976] GetCurrentThreadId () returned 0x970 [0062.976] GetCurrentThreadId () returned 0x970 [0062.976] GetCurrentThreadId () returned 0x970 [0062.976] GetCurrentThreadId () returned 0x970 [0062.976] GetCurrentThreadId () returned 0x970 [0062.976] GetCurrentThreadId () returned 0x970 [0062.976] GetCurrentThreadId () returned 0x970 [0062.976] GetCurrentThreadId () returned 0x970 [0062.976] GetCurrentThreadId () returned 0x970 [0062.976] GetCurrentThreadId () returned 0x970 [0062.976] GetCurrentThreadId () returned 0x970 [0062.976] GetCurrentThreadId () returned 0x970 [0062.976] GetCurrentThreadId () returned 0x970 [0062.976] GetCurrentThreadId () returned 0x970 [0062.976] GetCurrentThreadId () returned 0x970 [0062.976] GetCurrentThreadId () returned 0x970 [0062.977] GetCurrentThreadId () returned 0x970 [0062.977] GetCurrentThreadId () returned 0x970 [0062.977] GetCurrentThreadId () returned 0x970 [0062.977] GetCurrentThreadId () returned 0x970 [0062.977] GetCurrentThreadId () returned 0x970 [0062.977] GetCurrentThreadId () returned 0x970 [0062.977] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.977] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.977] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff08f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.977] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.977] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.977] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff08f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.977] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.977] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.977] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.977] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.977] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.977] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1fea458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.977] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.977] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.977] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff0950, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.977] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.977] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.977] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff0950, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.977] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.977] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.977] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x1ff0950, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0062.977] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xa, wMilliseconds=0xfe)) [0062.977] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="-BUj3hbiIo5Z!Rb\",~x$$>er+OgEmRHq", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0062.977] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="-BUj3hbiIo5Z!Rb\",~x$$>er+OgEmRHq", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0062.977] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="-BUj3hbiIo5Z!Rb\",~x$$>er+OgEmRHq", cchWideChar=32, lpMultiByteStr=0x20024e8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-BUj3hbiIo5Z!Rb\",~x$$>er+OgEmRHq", lpUsedDefaultChar=0x0) returned 32 [0062.977] GetCurrentThreadId () returned 0x970 [0062.978] GetCurrentThreadId () returned 0x970 [0062.978] GetCurrentThreadId () returned 0x970 [0062.978] GetCurrentThreadId () returned 0x970 [0062.978] GetCurrentThreadId () returned 0x970 [0062.978] GetCurrentThreadId () returned 0x970 [0062.985] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0062.985] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0062.985] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3795a08, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0062.985] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0062.985] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAC6msgJEADUk0/3H+QSD1OzOq3Zcqu+FbHHyN87KTH/HcrJKgYmFYCS53Sve4T64ikFL4JcJVBCA7Zv2uZmrwiaARiB0/3z3qeUOl2XNpdYIY4VB0JvyeETAHS+2jBBdeJF7jwEETdxmTxzNIIe8ZTrG46FhZGW24fCjav8si7CkKBZq8jjrWTRar4gMTkuuJPOt/rKRXRXZf0rrJ8dMUHJLHgK53oOr2A==") returned 232 [0062.985] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xa, wMilliseconds=0xfe)) [0062.985] GetCurrentThreadId () returned 0x970 [0062.985] GetCurrentThreadId () returned 0x970 [0062.985] GetCurrentThreadId () returned 0x970 [0062.985] GetCurrentThreadId () returned 0x970 [0062.986] GetCurrentThreadId () returned 0x970 [0062.986] GetCurrentThreadId () returned 0x970 [0062.986] GetCurrentThreadId () returned 0x970 [0062.986] GetCurrentThreadId () returned 0x970 [0062.986] GetCurrentThreadId () returned 0x970 [0062.986] GetCurrentThreadId () returned 0x970 [0062.986] GetCurrentThreadId () returned 0x970 [0062.986] GetCurrentThreadId () returned 0x970 [0062.986] GetCurrentThreadId () returned 0x970 [0062.986] GetCurrentThreadId () returned 0x970 [0062.986] GetCurrentThreadId () returned 0x970 [0062.986] GetCurrentThreadId () returned 0x970 [0062.986] GetCurrentThreadId () returned 0x970 [0062.986] GetCurrentThreadId () returned 0x970 [0062.986] GetCurrentThreadId () returned 0x970 [0062.986] GetCurrentThreadId () returned 0x970 [0062.986] GetCurrentThreadId () returned 0x970 [0062.986] GetCurrentThreadId () returned 0x970 [0062.986] GetCurrentThreadId () returned 0x970 [0062.986] GetCurrentThreadId () returned 0x970 [0062.986] GetCurrentThreadId () returned 0x970 [0062.986] GetCurrentThreadId () returned 0x970 [0062.986] GetCurrentThreadId () returned 0x970 [0062.986] GetCurrentThreadId () returned 0x970 [0062.986] GetCurrentThreadId () returned 0x970 [0062.986] GetCurrentThreadId () returned 0x970 [0062.986] GetCurrentThreadId () returned 0x970 [0062.986] GetCurrentThreadId () returned 0x970 [0062.986] GetCurrentThreadId () returned 0x970 [0062.986] GetCurrentThreadId () returned 0x970 [0062.986] GetCurrentThreadId () returned 0x970 [0062.986] GetCurrentThreadId () returned 0x970 [0062.986] GetCurrentThreadId () returned 0x970 [0062.986] GetCurrentThreadId () returned 0x970 [0062.986] GetCurrentThreadId () returned 0x970 [0062.986] GetCurrentThreadId () returned 0x970 [0062.986] GetCurrentThreadId () returned 0x970 [0062.986] GetCurrentThreadId () returned 0x970 [0062.986] GetCurrentThreadId () returned 0x970 [0062.986] GetCurrentThreadId () returned 0x970 [0062.986] GetCurrentThreadId () returned 0x970 [0062.986] GetCurrentThreadId () returned 0x970 [0062.986] GetCurrentThreadId () returned 0x970 [0062.986] GetCurrentThreadId () returned 0x970 [0062.986] GetCurrentThreadId () returned 0x970 [0062.986] GetCurrentThreadId () returned 0x970 [0062.987] GetCurrentThreadId () returned 0x970 [0062.987] GetCurrentThreadId () returned 0x970 [0062.987] GetCurrentThreadId () returned 0x970 [0062.987] GetCurrentThreadId () returned 0x970 [0062.987] GetCurrentThreadId () returned 0x970 [0062.987] GetCurrentThreadId () returned 0x970 [0062.987] GetCurrentThreadId () returned 0x970 [0062.987] GetCurrentThreadId () returned 0x970 [0062.987] GetCurrentThreadId () returned 0x970 [0062.987] GetCurrentThreadId () returned 0x970 [0062.987] GetCurrentThreadId () returned 0x970 [0062.987] GetCurrentThreadId () returned 0x970 [0062.987] GetCurrentThreadId () returned 0x970 [0062.987] GetCurrentThreadId () returned 0x970 [0062.987] GetCurrentThreadId () returned 0x970 [0062.987] GetCurrentThreadId () returned 0x970 [0062.987] GetCurrentThreadId () returned 0x970 [0062.987] GetCurrentThreadId () returned 0x970 [0062.987] GetCurrentThreadId () returned 0x970 [0062.987] GetCurrentThreadId () returned 0x970 [0062.987] GetCurrentThreadId () returned 0x970 [0062.987] GetCurrentThreadId () returned 0x970 [0062.987] GetCurrentThreadId () returned 0x970 [0062.987] GetCurrentThreadId () returned 0x970 [0062.987] GetCurrentThreadId () returned 0x970 [0062.987] GetCurrentThreadId () returned 0x970 [0062.987] GetCurrentThreadId () returned 0x970 [0062.987] GetCurrentThreadId () returned 0x970 [0062.987] GetCurrentThreadId () returned 0x970 [0062.987] GetCurrentThreadId () returned 0x970 [0062.987] GetCurrentThreadId () returned 0x970 [0062.987] GetCurrentThreadId () returned 0x970 [0062.987] GetCurrentThreadId () returned 0x970 [0062.987] GetCurrentThreadId () returned 0x970 [0062.987] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAC6msgJEADUk0/3H+QSD1OzOq3Zcqu+FbHHyN87KTH/HcrJKgYmFYCS53Sve4T64ikFL4JcJVBCA7Zv2uZmrwiaARiB0/3z3qeUOl2XNpdYIY4VB0JvyeETAHS+2jBBdeJF7jwEETdxmTxzNIIe8ZTrG46FhZGW24fCjav8si7CkKBZq8jjrWTRar4gMTkuuJPOt/rKRXRXZf0rrJ8dMUHJLHgK53oOr2A==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0062.987] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAC6msgJEADUk0/3H+QSD1OzOq3Zcqu+FbHHyN87KTH/HcrJKgYmFYCS53Sve4T64ikFL4JcJVBCA7Zv2uZmrwiaARiB0/3z3qeUOl2XNpdYIY4VB0JvyeETAHS+2jBBdeJF7jwEETdxmTxzNIIe8ZTrG46FhZGW24fCjav8si7CkKBZq8jjrWTRar4gMTkuuJPOt/rKRXRXZf0rrJ8dMUHJLHgK53oOr2A==", cchWideChar=245, lpMultiByteStr=0x353933c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAC6msgJEADUk0/3H+QSD1OzOq3Zcqu+FbHHyN87KTH/HcrJKgYmFYCS53Sve4T64ikFL4JcJVBCA7Zv2uZmrwiaARiB0/3z3qeUOl2XNpdYIY4VB0JvyeETAHS+2jBBdeJF7jwEETdxmTxzNIIe8ZTrG46FhZGW24fCjav8si7CkKBZq8jjrWTRar4gMTkuuJPOt/rKRXRXZf0rrJ8dMUHJLHgK53oOr2A==", lpUsedDefaultChar=0x0) returned 245 [0062.987] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0062.987] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0062.988] CloseHandle (hObject=0x158) returned 1 [0062.988] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif")) returned 1 [0062.989] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=18325196545) returned 1 [0062.989] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\Файл зашифрован [THMBNAIL.PNG].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\Файл зашифрован [thmbnail.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0062.989] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0062.989] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0062.989] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0062.989] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0062.989] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0062.989] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0062.989] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0062.989] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0062.989] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0062.989] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0062.990] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0062.990] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0062.990] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0062.990] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0062.990] SetEndOfFile (hFile=0x158) returned 1 [0062.990] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0062.990] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0062.990] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0062.990] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0062.990] WriteFile (in: hFile=0x158, lpBuffer=0x3777058*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777058*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0062.991] WriteFile (in: hFile=0x158, lpBuffer=0x35f01dc*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f01dc*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0062.991] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="I$9(wsGLbIZJfWSd>oZo-$!{js", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0063.538] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Ae}\"$mzWZ80.lW^w8*2WcTt$S}i7}#>s", cchWideChar=32, lpMultiByteStr=0x2035dc4, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Ae}\"$mzWZ80.lW^w8*2WcTt$S}i7}#>s", lpUsedDefaultChar=0x0) returned 32 [0063.538] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0063.538] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0063.538] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x137f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 0x295098 [0063.538] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0063.538] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0063.538] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif")) returned 0x20 [0063.538] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif")) returned 0x20 [0063.538] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif")) returned 0x20 [0063.538] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif")) returned 0x20 [0063.539] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x137f)) returned 1 [0063.539] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0063.539] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0063.539] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif")) returned 0x20 [0063.539] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif")) returned 0x20 [0063.539] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0063.539] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0063.539] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0063.539] SetEndOfFile (hFile=0x158) returned 1 [0063.540] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0063.540] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe410c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0063.540] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0063.540] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe398c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0063.540] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe398c, cbMultiByte=11, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="PREVIEW.GIFGer.gifg") returned 11 [0063.540] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0063.540] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe410c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0063.540] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0063.540] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0063.540] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x137f [0063.540] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0063.541] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0063.541] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0063.541] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0063.541] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe410c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0063.541] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0063.541] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe398c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0063.541] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe398c, cbMultiByte=11, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="PREVIEW.GIFEW.GIFGer.gifg") returned 11 [0063.541] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0063.541] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe410c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0063.541] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0063.542] CharToOemA (in: pSrc="PREVIEW.GIF", pDst=0x1fe398c | out: pDst="PREVIEW.GIF") returned 1 [0063.542] WriteFile (in: hFile=0x158, lpBuffer=0x1fe398c*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe398c*, lpNumberOfBytesWritten=0x18e048*=0xb, lpOverlapped=0x0) returned 1 [0063.542] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0063.542] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0063.542] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0063.542] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=18380572023) returned 1 [0063.542] ReadFile (in: hFile=0x11c, lpBuffer=0x37b81a0, nNumberOfBytesToRead=0x137f, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37b81a0*, lpNumberOfBytesRead=0x18dd7c*=0x137f, lpOverlapped=0x0) returned 1 [0063.544] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0063.544] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=18380749520) returned 1 [0063.553] WriteFile (in: hFile=0x158, lpBuffer=0x1fea420*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fea420*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0063.553] ReadFile (in: hFile=0x11c, lpBuffer=0x37b81a0, nNumberOfBytesToRead=0x137f, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x37b81a0*, lpNumberOfBytesRead=0x18de38*=0x137f, lpOverlapped=0x0) returned 1 [0063.553] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x46 [0063.553] WriteFile (in: hFile=0x158, lpBuffer=0x37fadc0*, nNumberOfBytesToWrite=0x137f, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x37fadc0*, lpNumberOfBytesWritten=0x18de10*=0x137f, lpOverlapped=0x0) returned 1 [0063.553] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x13c5 [0063.554] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0063.554] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0063.554] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0063.554] SetFilePointer (in: hFile=0x158, lDistanceToMove=11, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x29 [0063.554] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x13cf [0063.554] CloseHandle (hObject=0x11c) returned 1 [0063.554] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x13cf [0063.554] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x13cf [0063.554] SetFilePointer (in: hFile=0x158, lDistanceToMove=5071, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x13cf [0063.554] SetFilePointer (in: hFile=0x158, lDistanceToMove=5071, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x13cf [0063.554] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x13cf [0063.554] SetFilePointer (in: hFile=0x158, lDistanceToMove=5071, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x13cf [0063.554] SetEndOfFile (hFile=0x158) returned 1 [0063.554] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x13cf [0063.555] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x13cf [0063.555] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0063.555] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe410c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0063.555] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0063.555] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe41ac, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0063.555] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe41ac, cbMultiByte=11, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="PREVIEW.GIF\x18ꞗ@涤(\x18믉`믑`") returned 11 [0063.555] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0063.555] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe410c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0063.555] WriteFile (in: hFile=0x158, lpBuffer=0x379bc78*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x379bc78*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0063.555] CharToOemA (in: pSrc="PREVIEW.GIF", pDst=0x1fe41ac | out: pDst="PREVIEW.GIF") returned 1 [0063.555] WriteFile (in: hFile=0x158, lpBuffer=0x1fe41ac*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe41ac*, lpNumberOfBytesWritten=0x18efcc*=0xb, lpOverlapped=0x0) returned 1 [0063.555] WriteFile (in: hFile=0x158, lpBuffer=0x1fea260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea260*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0063.555] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0063.555] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0063.555] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1413 [0063.555] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1413 [0063.556] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0063.556] WriteFile (in: hFile=0x158, lpBuffer=0x35f011c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f011c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0063.556] DeleteFileW (lpFileName="") returned 0 [0063.556] GetLastError () returned 0x3 [0063.556] GetFileAttributesW (lpFileName="") returned 0xffffffff [0063.556] SetLastError (dwErrCode=0x3) [0063.556] FlushFileBuffers (hFile=0x158) returned 1 [0063.559] GetCurrentThreadId () returned 0x970 [0063.559] GetCurrentThreadId () returned 0x970 [0063.559] GetCurrentThreadId () returned 0x970 [0063.559] GetCurrentThreadId () returned 0x970 [0063.559] GetCurrentThreadId () returned 0x970 [0063.559] GetCurrentThreadId () returned 0x970 [0063.559] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x14ca [0063.559] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x14ca [0063.559] SetFilePointer (in: hFile=0x158, lDistanceToMove=5322, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x14ca [0063.559] CloseHandle (hObject=0x158) returned 1 [0063.559] GetCurrentThreadId () returned 0x970 [0063.559] GetCurrentThreadId () returned 0x970 [0063.559] GetCurrentThreadId () returned 0x970 [0063.559] GetCurrentThreadId () returned 0x970 [0063.559] GetCurrentThreadId () returned 0x970 [0063.559] GetCurrentThreadId () returned 0x970 [0063.559] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\Файл зашифрован [PREVIEW.GIF].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\Файл зашифрован [preview.gif].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0063.560] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14ca [0063.560] SetFilePointer (in: hFile=0x158, lDistanceToMove=5194, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x144a [0063.560] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0063.560] GetFileType (hFile=0x158) returned 0x1 [0063.560] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xa, wMilliseconds=0x340)) [0063.560] GetCurrentThreadId () returned 0x970 [0063.560] GetCurrentThreadId () returned 0x970 [0063.560] GetCurrentThreadId () returned 0x970 [0063.560] GetCurrentThreadId () returned 0x970 [0063.560] GetCurrentThreadId () returned 0x970 [0063.560] GetCurrentThreadId () returned 0x970 [0063.560] GetCurrentThreadId () returned 0x970 [0063.560] GetCurrentThreadId () returned 0x970 [0063.560] GetCurrentThreadId () returned 0x970 [0063.560] GetCurrentThreadId () returned 0x970 [0063.560] GetCurrentThreadId () returned 0x970 [0063.560] GetCurrentThreadId () returned 0x970 [0063.560] GetCurrentThreadId () returned 0x970 [0063.560] GetCurrentThreadId () returned 0x970 [0063.560] GetCurrentThreadId () returned 0x970 [0063.560] GetCurrentThreadId () returned 0x970 [0063.560] GetCurrentThreadId () returned 0x970 [0063.560] GetCurrentThreadId () returned 0x970 [0063.560] GetCurrentThreadId () returned 0x970 [0063.560] GetCurrentThreadId () returned 0x970 [0063.560] GetCurrentThreadId () returned 0x970 [0063.560] GetCurrentThreadId () returned 0x970 [0063.560] GetCurrentThreadId () returned 0x970 [0063.560] GetCurrentThreadId () returned 0x970 [0063.560] GetCurrentThreadId () returned 0x970 [0063.560] GetCurrentThreadId () returned 0x970 [0063.560] GetCurrentThreadId () returned 0x970 [0063.560] GetCurrentThreadId () returned 0x970 [0063.560] GetCurrentThreadId () returned 0x970 [0063.560] GetCurrentThreadId () returned 0x970 [0063.560] GetCurrentThreadId () returned 0x970 [0063.560] GetCurrentThreadId () returned 0x970 [0063.560] GetCurrentThreadId () returned 0x970 [0063.561] GetCurrentThreadId () returned 0x970 [0063.561] GetCurrentThreadId () returned 0x970 [0063.561] GetCurrentThreadId () returned 0x970 [0063.561] GetCurrentThreadId () returned 0x970 [0063.561] GetCurrentThreadId () returned 0x970 [0063.561] GetCurrentThreadId () returned 0x970 [0063.561] GetCurrentThreadId () returned 0x970 [0063.561] GetCurrentThreadId () returned 0x970 [0063.561] GetCurrentThreadId () returned 0x970 [0063.561] GetCurrentThreadId () returned 0x970 [0063.561] GetCurrentThreadId () returned 0x970 [0063.561] GetCurrentThreadId () returned 0x970 [0063.561] GetCurrentThreadId () returned 0x970 [0063.561] GetCurrentThreadId () returned 0x970 [0063.561] GetCurrentThreadId () returned 0x970 [0063.561] GetCurrentThreadId () returned 0x970 [0063.561] GetCurrentThreadId () returned 0x970 [0063.561] GetCurrentThreadId () returned 0x970 [0063.561] GetCurrentThreadId () returned 0x970 [0063.561] GetCurrentThreadId () returned 0x970 [0063.561] GetCurrentThreadId () returned 0x970 [0063.561] GetCurrentThreadId () returned 0x970 [0063.561] GetCurrentThreadId () returned 0x970 [0063.561] GetCurrentThreadId () returned 0x970 [0063.561] GetCurrentThreadId () returned 0x970 [0063.561] GetCurrentThreadId () returned 0x970 [0063.561] GetCurrentThreadId () returned 0x970 [0063.561] GetCurrentThreadId () returned 0x970 [0063.561] GetCurrentThreadId () returned 0x970 [0063.561] GetCurrentThreadId () returned 0x970 [0063.561] GetCurrentThreadId () returned 0x970 [0063.561] GetCurrentThreadId () returned 0x970 [0063.561] GetCurrentThreadId () returned 0x970 [0063.561] GetCurrentThreadId () returned 0x970 [0063.561] GetCurrentThreadId () returned 0x970 [0063.561] GetCurrentThreadId () returned 0x970 [0063.561] GetCurrentThreadId () returned 0x970 [0063.561] GetCurrentThreadId () returned 0x970 [0063.561] GetCurrentThreadId () returned 0x970 [0063.561] GetCurrentThreadId () returned 0x970 [0063.561] GetCurrentThreadId () returned 0x970 [0063.561] GetCurrentThreadId () returned 0x970 [0063.561] GetCurrentThreadId () returned 0x970 [0063.561] GetCurrentThreadId () returned 0x970 [0063.562] GetCurrentThreadId () returned 0x970 [0063.562] GetCurrentThreadId () returned 0x970 [0063.562] GetCurrentThreadId () returned 0x970 [0063.562] GetCurrentThreadId () returned 0x970 [0063.562] GetCurrentThreadId () returned 0x970 [0063.562] GetCurrentThreadId () returned 0x970 [0063.562] GetCurrentThreadId () returned 0x970 [0063.562] GetCurrentThreadId () returned 0x970 [0063.562] GetCurrentThreadId () returned 0x970 [0063.562] GetCurrentThreadId () returned 0x970 [0063.562] GetCurrentThreadId () returned 0x970 [0063.562] GetCurrentThreadId () returned 0x970 [0063.562] GetCurrentThreadId () returned 0x970 [0063.562] GetCurrentThreadId () returned 0x970 [0063.562] GetCurrentThreadId () returned 0x970 [0063.562] GetCurrentThreadId () returned 0x970 [0063.562] GetCurrentThreadId () returned 0x970 [0063.562] GetCurrentThreadId () returned 0x970 [0063.562] GetCurrentThreadId () returned 0x970 [0063.562] GetCurrentThreadId () returned 0x970 [0063.562] GetCurrentThreadId () returned 0x970 [0063.562] GetCurrentThreadId () returned 0x970 [0063.562] GetCurrentThreadId () returned 0x970 [0063.562] GetCurrentThreadId () returned 0x970 [0063.562] GetCurrentThreadId () returned 0x970 [0063.562] GetCurrentThreadId () returned 0x970 [0063.562] GetCurrentThreadId () returned 0x970 [0063.562] GetCurrentThreadId () returned 0x970 [0063.562] GetCurrentThreadId () returned 0x970 [0063.562] GetCurrentThreadId () returned 0x970 [0063.562] GetCurrentThreadId () returned 0x970 [0063.562] GetCurrentThreadId () returned 0x970 [0063.562] GetCurrentThreadId () returned 0x970 [0063.562] GetCurrentThreadId () returned 0x970 [0063.562] GetCurrentThreadId () returned 0x970 [0063.562] GetCurrentThreadId () returned 0x970 [0063.562] GetCurrentThreadId () returned 0x970 [0063.562] GetCurrentThreadId () returned 0x970 [0063.562] GetCurrentThreadId () returned 0x970 [0063.562] GetCurrentThreadId () returned 0x970 [0063.562] GetCurrentThreadId () returned 0x970 [0063.562] GetCurrentThreadId () returned 0x970 [0063.562] GetCurrentThreadId () returned 0x970 [0063.562] GetCurrentThreadId () returned 0x970 [0063.562] GetCurrentThreadId () returned 0x970 [0063.563] GetCurrentThreadId () returned 0x970 [0063.563] GetCurrentThreadId () returned 0x970 [0063.563] GetCurrentThreadId () returned 0x970 [0063.563] GetCurrentThreadId () returned 0x970 [0063.563] GetCurrentThreadId () returned 0x970 [0063.563] GetCurrentThreadId () returned 0x970 [0063.563] GetCurrentThreadId () returned 0x970 [0063.563] GetCurrentThreadId () returned 0x970 [0063.563] GetCurrentThreadId () returned 0x970 [0063.563] GetCurrentThreadId () returned 0x970 [0063.563] GetCurrentThreadId () returned 0x970 [0063.563] GetCurrentThreadId () returned 0x970 [0063.563] GetCurrentThreadId () returned 0x970 [0063.563] GetCurrentThreadId () returned 0x970 [0063.563] GetCurrentThreadId () returned 0x970 [0063.563] GetCurrentThreadId () returned 0x970 [0063.563] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.563] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.563] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379ed28, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0063.563] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.563] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.563] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379ed28, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0063.563] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.563] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.563] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379ed58, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0063.563] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.563] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.563] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379ed58, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0063.563] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.563] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.563] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379ed88, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0063.563] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.563] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.563] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379ed88, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0063.563] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.563] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.563] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379ed88, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0063.564] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xa, wMilliseconds=0x340)) [0063.564] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Ae}\"$mzWZ80.lW^w8*2WcTt$S}i7}#>s", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0063.564] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Ae}\"$mzWZ80.lW^w8*2WcTt$S}i7}#>s", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0063.564] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Ae}\"$mzWZ80.lW^w8*2WcTt$S}i7}#>s", cchWideChar=32, lpMultiByteStr=0x20024e8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Ae}\"$mzWZ80.lW^w8*2WcTt$S}i7}#>s", lpUsedDefaultChar=0x0) returned 32 [0063.564] GetCurrentThreadId () returned 0x970 [0063.564] GetCurrentThreadId () returned 0x970 [0063.564] GetCurrentThreadId () returned 0x970 [0063.564] GetCurrentThreadId () returned 0x970 [0063.564] GetCurrentThreadId () returned 0x970 [0063.564] GetCurrentThreadId () returned 0x970 [0063.572] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0063.572] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0063.572] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3796548, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0063.572] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0063.572] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAGDd5CAMhk8cvbPP4H7l5WZqVVLyyOwpCSXglKEOCJyzZxCLySxi/tK6w8ICUGFLc/+uF193sesQ8PbMPKdVFAQ/nQIvOxh27DYYF5xFVO+x/+I7f7usHD1/VZmkAaqSOHXkHMrA9cApJWdoWHOwiGJRwJJ3sTuUTIpQUhpL0dYXHuyaBFRM8AB9OPl31+2aCnDy+ijCsjuWZqZ8XpqWu04r/OkKef8/GA==") returned 232 [0063.572] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xa, wMilliseconds=0x34f)) [0063.572] GetCurrentThreadId () returned 0x970 [0063.572] GetCurrentThreadId () returned 0x970 [0063.572] GetCurrentThreadId () returned 0x970 [0063.572] GetCurrentThreadId () returned 0x970 [0063.572] GetCurrentThreadId () returned 0x970 [0063.572] GetCurrentThreadId () returned 0x970 [0063.572] GetCurrentThreadId () returned 0x970 [0063.572] GetCurrentThreadId () returned 0x970 [0063.572] GetCurrentThreadId () returned 0x970 [0063.572] GetCurrentThreadId () returned 0x970 [0063.572] GetCurrentThreadId () returned 0x970 [0063.572] GetCurrentThreadId () returned 0x970 [0063.572] GetCurrentThreadId () returned 0x970 [0063.572] GetCurrentThreadId () returned 0x970 [0063.572] GetCurrentThreadId () returned 0x970 [0063.572] GetCurrentThreadId () returned 0x970 [0063.572] GetCurrentThreadId () returned 0x970 [0063.572] GetCurrentThreadId () returned 0x970 [0063.572] GetCurrentThreadId () returned 0x970 [0063.572] GetCurrentThreadId () returned 0x970 [0063.572] GetCurrentThreadId () returned 0x970 [0063.572] GetCurrentThreadId () returned 0x970 [0063.572] GetCurrentThreadId () returned 0x970 [0063.572] GetCurrentThreadId () returned 0x970 [0063.572] GetCurrentThreadId () returned 0x970 [0063.572] GetCurrentThreadId () returned 0x970 [0063.572] GetCurrentThreadId () returned 0x970 [0063.572] GetCurrentThreadId () returned 0x970 [0063.572] GetCurrentThreadId () returned 0x970 [0063.572] GetCurrentThreadId () returned 0x970 [0063.572] GetCurrentThreadId () returned 0x970 [0063.572] GetCurrentThreadId () returned 0x970 [0063.572] GetCurrentThreadId () returned 0x970 [0063.572] GetCurrentThreadId () returned 0x970 [0063.572] GetCurrentThreadId () returned 0x970 [0063.572] GetCurrentThreadId () returned 0x970 [0063.572] GetCurrentThreadId () returned 0x970 [0063.573] GetCurrentThreadId () returned 0x970 [0063.573] GetCurrentThreadId () returned 0x970 [0063.573] GetCurrentThreadId () returned 0x970 [0063.573] GetCurrentThreadId () returned 0x970 [0063.573] GetCurrentThreadId () returned 0x970 [0063.573] GetCurrentThreadId () returned 0x970 [0063.573] GetCurrentThreadId () returned 0x970 [0063.573] GetCurrentThreadId () returned 0x970 [0063.573] GetCurrentThreadId () returned 0x970 [0063.573] GetCurrentThreadId () returned 0x970 [0063.573] GetCurrentThreadId () returned 0x970 [0063.573] GetCurrentThreadId () returned 0x970 [0063.573] GetCurrentThreadId () returned 0x970 [0063.573] GetCurrentThreadId () returned 0x970 [0063.573] GetCurrentThreadId () returned 0x970 [0063.573] GetCurrentThreadId () returned 0x970 [0063.573] GetCurrentThreadId () returned 0x970 [0063.573] GetCurrentThreadId () returned 0x970 [0063.573] GetCurrentThreadId () returned 0x970 [0063.573] GetCurrentThreadId () returned 0x970 [0063.573] GetCurrentThreadId () returned 0x970 [0063.573] GetCurrentThreadId () returned 0x970 [0063.573] GetCurrentThreadId () returned 0x970 [0063.573] GetCurrentThreadId () returned 0x970 [0063.573] GetCurrentThreadId () returned 0x970 [0063.573] GetCurrentThreadId () returned 0x970 [0063.573] GetCurrentThreadId () returned 0x970 [0063.573] GetCurrentThreadId () returned 0x970 [0063.573] GetCurrentThreadId () returned 0x970 [0063.573] GetCurrentThreadId () returned 0x970 [0063.573] GetCurrentThreadId () returned 0x970 [0063.573] GetCurrentThreadId () returned 0x970 [0063.573] GetCurrentThreadId () returned 0x970 [0063.573] GetCurrentThreadId () returned 0x970 [0063.573] GetCurrentThreadId () returned 0x970 [0063.573] GetCurrentThreadId () returned 0x970 [0063.573] GetCurrentThreadId () returned 0x970 [0063.573] GetCurrentThreadId () returned 0x970 [0063.573] GetCurrentThreadId () returned 0x970 [0063.573] GetCurrentThreadId () returned 0x970 [0063.573] GetCurrentThreadId () returned 0x970 [0063.573] GetCurrentThreadId () returned 0x970 [0063.573] GetCurrentThreadId () returned 0x970 [0063.573] GetCurrentThreadId () returned 0x970 [0063.574] GetCurrentThreadId () returned 0x970 [0063.574] GetCurrentThreadId () returned 0x970 [0063.574] GetCurrentThreadId () returned 0x970 [0063.574] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAGDd5CAMhk8cvbPP4H7l5WZqVVLyyOwpCSXglKEOCJyzZxCLySxi/tK6w8ICUGFLc/+uF193sesQ8PbMPKdVFAQ/nQIvOxh27DYYF5xFVO+x/+I7f7usHD1/VZmkAaqSOHXkHMrA9cApJWdoWHOwiGJRwJJ3sTuUTIpQUhpL0dYXHuyaBFRM8AB9OPl31+2aCnDy+ijCsjuWZqZ8XpqWu04r/OkKef8/GA==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0063.574] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAGDd5CAMhk8cvbPP4H7l5WZqVVLyyOwpCSXglKEOCJyzZxCLySxi/tK6w8ICUGFLc/+uF193sesQ8PbMPKdVFAQ/nQIvOxh27DYYF5xFVO+x/+I7f7usHD1/VZmkAaqSOHXkHMrA9cApJWdoWHOwiGJRwJJ3sTuUTIpQUhpL0dYXHuyaBFRM8AB9OPl31+2aCnDy+ijCsjuWZqZ8XpqWu04r/OkKef8/GA==", cchWideChar=245, lpMultiByteStr=0x353933c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAGDd5CAMhk8cvbPP4H7l5WZqVVLyyOwpCSXglKEOCJyzZxCLySxi/tK6w8ICUGFLc/+uF193sesQ8PbMPKdVFAQ/nQIvOxh27DYYF5xFVO+x/+I7f7usHD1/VZmkAaqSOHXkHMrA9cApJWdoWHOwiGJRwJJ3sTuUTIpQUhpL0dYXHuyaBFRM8AB9OPl31+2aCnDy+ijCsjuWZqZ8XpqWu04r/OkKef8/GA==", lpUsedDefaultChar=0x0) returned 245 [0063.574] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0063.574] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0063.574] CloseHandle (hObject=0x158) returned 1 [0063.574] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif")) returned 1 [0063.575] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=18383839214) returned 1 [0063.575] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\Файл зашифрован [THMBNAIL.PNG].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\Файл зашифрован [thmbnail.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0063.575] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0063.575] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0063.576] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0063.576] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0063.576] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0063.576] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0063.576] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0063.576] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0063.576] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0063.576] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0063.576] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0063.576] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0063.576] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0063.576] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0063.576] SetEndOfFile (hFile=0x158) returned 1 [0063.576] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0063.576] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0063.576] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0063.577] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0063.577] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0063.578] WriteFile (in: hFile=0x158, lpBuffer=0x35f01dc*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f01dc*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0063.578] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="^o{**yEw\\4K.)ypo&$\\Kw#M\\^&=O^d6?", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0063.578] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="^o{**yEw\\4K.)ypo&$\\Kw#M\\^&=O^d6?", cchWideChar=32, lpMultiByteStr=0x2035dfc, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="^o{**yEw\\4K.)ypo&$\\Kw#M\\^&=O^d6?", lpUsedDefaultChar=0x0) returned 32 [0063.578] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0063.578] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0063.578] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xad0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0x295098 [0063.578] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0063.578] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0063.578] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png")) returned 0x20 [0063.578] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png")) returned 0x20 [0063.578] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png")) returned 0x20 [0063.578] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png")) returned 0x20 [0063.578] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xad0e)) returned 1 [0063.579] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0063.579] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0063.579] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png")) returned 0x20 [0063.579] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png")) returned 0x20 [0063.579] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0063.579] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0063.579] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0063.579] SetEndOfFile (hFile=0x158) returned 1 [0063.580] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0063.580] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe370c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0063.580] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0063.580] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe3bac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0063.580] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe3bac, cbMultiByte=12, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="THMBNAIL.PNGer.gifg") returned 12 [0063.580] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0063.580] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe370c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0063.580] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0063.580] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0063.580] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0xad0e [0063.580] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0063.580] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0063.580] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0063.581] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0063.581] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe370c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0063.581] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0063.581] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe3bac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0063.581] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe3bac, cbMultiByte=12, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="THMBNAIL.PNGIL.PNGer.gifg") returned 12 [0063.581] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0063.581] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe370c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0063.581] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0063.582] CharToOemA (in: pSrc="THMBNAIL.PNG", pDst=0x1fe3bac | out: pDst="THMBNAIL.PNG") returned 1 [0063.582] WriteFile (in: hFile=0x158, lpBuffer=0x1fe3bac*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe3bac*, lpNumberOfBytesWritten=0x18e048*=0xc, lpOverlapped=0x0) returned 1 [0063.582] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0063.582] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0063.582] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0063.582] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=18384561249) returned 1 [0063.582] ReadFile (in: hFile=0x11c, lpBuffer=0x37b81a0, nNumberOfBytesToRead=0xad0e, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37b81a0*, lpNumberOfBytesRead=0x18dd7c*=0xad0e, lpOverlapped=0x0) returned 1 [0063.584] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0063.584] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=18384764884) returned 1 [0063.593] WriteFile (in: hFile=0x158, lpBuffer=0x38046f8*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x38046f8*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0063.593] ReadFile (in: hFile=0x11c, lpBuffer=0x37b81a0, nNumberOfBytesToRead=0xad0e, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x37b81a0*, lpNumberOfBytesRead=0x18de38*=0xad0e, lpOverlapped=0x0) returned 1 [0063.594] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x47 [0063.594] WriteFile (in: hFile=0x158, lpBuffer=0x380b9f0*, nNumberOfBytesToWrite=0xad0e, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x380b9f0*, lpNumberOfBytesWritten=0x18de10*=0xad0e, lpOverlapped=0x0) returned 1 [0063.596] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0xad55 [0063.596] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0063.596] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0063.596] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0063.596] SetFilePointer (in: hFile=0x158, lDistanceToMove=12, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2a [0063.596] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0xad5f [0063.596] CloseHandle (hObject=0x11c) returned 1 [0063.596] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xad5f [0063.596] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xad5f [0063.596] SetFilePointer (in: hFile=0x158, lDistanceToMove=44383, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xad5f [0063.596] SetFilePointer (in: hFile=0x158, lDistanceToMove=44383, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0xad5f [0063.596] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xad5f [0063.596] SetFilePointer (in: hFile=0x158, lDistanceToMove=44383, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0xad5f [0063.597] SetEndOfFile (hFile=0x158) returned 1 [0063.597] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xad5f [0063.597] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xad5f [0063.597] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0063.597] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe370c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0063.597] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0063.597] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe37ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0063.597] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe37ec, cbMultiByte=12, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="THMBNAIL.PNGꞗ@涤(\x18믉`믑`") returned 12 [0063.597] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0063.597] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe370c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0063.597] WriteFile (in: hFile=0x158, lpBuffer=0x379bc78*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x379bc78*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0063.597] CharToOemA (in: pSrc="THMBNAIL.PNG", pDst=0x1fe37ec | out: pDst="THMBNAIL.PNG") returned 1 [0063.597] WriteFile (in: hFile=0x158, lpBuffer=0x1fe37ec*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe37ec*, lpNumberOfBytesWritten=0x18efcc*=0xc, lpOverlapped=0x0) returned 1 [0063.597] WriteFile (in: hFile=0x158, lpBuffer=0x1fea218*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea218*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0063.597] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0063.598] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0063.598] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xada4 [0063.598] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xada4 [0063.598] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0063.598] WriteFile (in: hFile=0x158, lpBuffer=0x35f01dc*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f01dc*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0063.598] DeleteFileW (lpFileName="") returned 0 [0063.598] GetLastError () returned 0x3 [0063.598] GetFileAttributesW (lpFileName="") returned 0xffffffff [0063.598] SetLastError (dwErrCode=0x3) [0063.598] FlushFileBuffers (hFile=0x158) returned 1 [0063.602] GetCurrentThreadId () returned 0x970 [0063.602] GetCurrentThreadId () returned 0x970 [0063.602] GetCurrentThreadId () returned 0x970 [0063.602] GetCurrentThreadId () returned 0x970 [0063.602] GetCurrentThreadId () returned 0x970 [0063.602] GetCurrentThreadId () returned 0x970 [0063.602] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xae5b [0063.602] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xae5b [0063.602] SetFilePointer (in: hFile=0x158, lDistanceToMove=44635, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xae5b [0063.602] CloseHandle (hObject=0x158) returned 1 [0063.602] GetCurrentThreadId () returned 0x970 [0063.602] GetCurrentThreadId () returned 0x970 [0063.602] GetCurrentThreadId () returned 0x970 [0063.602] GetCurrentThreadId () returned 0x970 [0063.602] GetCurrentThreadId () returned 0x970 [0063.602] GetCurrentThreadId () returned 0x970 [0063.602] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\Файл зашифрован [THMBNAIL.PNG].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\Файл зашифрован [thmbnail.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0063.602] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xae5b [0063.602] SetFilePointer (in: hFile=0x158, lDistanceToMove=44507, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xaddb [0063.602] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0063.602] GetFileType (hFile=0x158) returned 0x1 [0063.602] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xa, wMilliseconds=0x36e)) [0063.603] GetCurrentThreadId () returned 0x970 [0063.603] GetCurrentThreadId () returned 0x970 [0063.603] GetCurrentThreadId () returned 0x970 [0063.603] GetCurrentThreadId () returned 0x970 [0063.603] GetCurrentThreadId () returned 0x970 [0063.603] GetCurrentThreadId () returned 0x970 [0063.603] GetCurrentThreadId () returned 0x970 [0063.603] GetCurrentThreadId () returned 0x970 [0063.603] GetCurrentThreadId () returned 0x970 [0063.603] GetCurrentThreadId () returned 0x970 [0063.603] GetCurrentThreadId () returned 0x970 [0063.603] GetCurrentThreadId () returned 0x970 [0063.603] GetCurrentThreadId () returned 0x970 [0063.603] GetCurrentThreadId () returned 0x970 [0063.603] GetCurrentThreadId () returned 0x970 [0063.603] GetCurrentThreadId () returned 0x970 [0063.603] GetCurrentThreadId () returned 0x970 [0063.603] GetCurrentThreadId () returned 0x970 [0063.603] GetCurrentThreadId () returned 0x970 [0063.603] GetCurrentThreadId () returned 0x970 [0063.603] GetCurrentThreadId () returned 0x970 [0063.603] GetCurrentThreadId () returned 0x970 [0063.603] GetCurrentThreadId () returned 0x970 [0063.603] GetCurrentThreadId () returned 0x970 [0063.603] GetCurrentThreadId () returned 0x970 [0063.603] GetCurrentThreadId () returned 0x970 [0063.603] GetCurrentThreadId () returned 0x970 [0063.603] GetCurrentThreadId () returned 0x970 [0063.603] GetCurrentThreadId () returned 0x970 [0063.603] GetCurrentThreadId () returned 0x970 [0063.603] GetCurrentThreadId () returned 0x970 [0063.603] GetCurrentThreadId () returned 0x970 [0063.603] GetCurrentThreadId () returned 0x970 [0063.603] GetCurrentThreadId () returned 0x970 [0063.603] GetCurrentThreadId () returned 0x970 [0063.603] GetCurrentThreadId () returned 0x970 [0063.603] GetCurrentThreadId () returned 0x970 [0063.603] GetCurrentThreadId () returned 0x970 [0063.603] GetCurrentThreadId () returned 0x970 [0063.603] GetCurrentThreadId () returned 0x970 [0063.603] GetCurrentThreadId () returned 0x970 [0063.603] GetCurrentThreadId () returned 0x970 [0063.603] GetCurrentThreadId () returned 0x970 [0063.603] GetCurrentThreadId () returned 0x970 [0063.603] GetCurrentThreadId () returned 0x970 [0063.603] GetCurrentThreadId () returned 0x970 [0063.604] GetCurrentThreadId () returned 0x970 [0063.604] GetCurrentThreadId () returned 0x970 [0063.604] GetCurrentThreadId () returned 0x970 [0063.604] GetCurrentThreadId () returned 0x970 [0063.604] GetCurrentThreadId () returned 0x970 [0063.604] GetCurrentThreadId () returned 0x970 [0063.604] GetCurrentThreadId () returned 0x970 [0063.604] GetCurrentThreadId () returned 0x970 [0063.604] GetCurrentThreadId () returned 0x970 [0063.604] GetCurrentThreadId () returned 0x970 [0063.604] GetCurrentThreadId () returned 0x970 [0063.604] GetCurrentThreadId () returned 0x970 [0063.604] GetCurrentThreadId () returned 0x970 [0063.604] GetCurrentThreadId () returned 0x970 [0063.604] GetCurrentThreadId () returned 0x970 [0063.604] GetCurrentThreadId () returned 0x970 [0063.604] GetCurrentThreadId () returned 0x970 [0063.604] GetCurrentThreadId () returned 0x970 [0063.604] GetCurrentThreadId () returned 0x970 [0063.604] GetCurrentThreadId () returned 0x970 [0063.604] GetCurrentThreadId () returned 0x970 [0063.604] GetCurrentThreadId () returned 0x970 [0063.604] GetCurrentThreadId () returned 0x970 [0063.604] GetCurrentThreadId () returned 0x970 [0063.604] GetCurrentThreadId () returned 0x970 [0063.604] GetCurrentThreadId () returned 0x970 [0063.604] GetCurrentThreadId () returned 0x970 [0063.604] GetCurrentThreadId () returned 0x970 [0063.604] GetCurrentThreadId () returned 0x970 [0063.604] GetCurrentThreadId () returned 0x970 [0063.604] GetCurrentThreadId () returned 0x970 [0063.604] GetCurrentThreadId () returned 0x970 [0063.604] GetCurrentThreadId () returned 0x970 [0063.604] GetCurrentThreadId () returned 0x970 [0063.604] GetCurrentThreadId () returned 0x970 [0063.604] GetCurrentThreadId () returned 0x970 [0063.604] GetCurrentThreadId () returned 0x970 [0063.604] GetCurrentThreadId () returned 0x970 [0063.604] GetCurrentThreadId () returned 0x970 [0063.604] GetCurrentThreadId () returned 0x970 [0063.604] GetCurrentThreadId () returned 0x970 [0063.604] GetCurrentThreadId () returned 0x970 [0063.604] GetCurrentThreadId () returned 0x970 [0063.604] GetCurrentThreadId () returned 0x970 [0063.604] GetCurrentThreadId () returned 0x970 [0063.604] GetCurrentThreadId () returned 0x970 [0063.604] GetCurrentThreadId () returned 0x970 [0063.605] GetCurrentThreadId () returned 0x970 [0063.605] GetCurrentThreadId () returned 0x970 [0063.605] GetCurrentThreadId () returned 0x970 [0063.605] GetCurrentThreadId () returned 0x970 [0063.605] GetCurrentThreadId () returned 0x970 [0063.605] GetCurrentThreadId () returned 0x970 [0063.605] GetCurrentThreadId () returned 0x970 [0063.605] GetCurrentThreadId () returned 0x970 [0063.605] GetCurrentThreadId () returned 0x970 [0063.605] GetCurrentThreadId () returned 0x970 [0063.605] GetCurrentThreadId () returned 0x970 [0063.605] GetCurrentThreadId () returned 0x970 [0063.605] GetCurrentThreadId () returned 0x970 [0063.605] GetCurrentThreadId () returned 0x970 [0063.605] GetCurrentThreadId () returned 0x970 [0063.605] GetCurrentThreadId () returned 0x970 [0063.605] GetCurrentThreadId () returned 0x970 [0063.605] GetCurrentThreadId () returned 0x970 [0063.605] GetCurrentThreadId () returned 0x970 [0063.605] GetCurrentThreadId () returned 0x970 [0063.605] GetCurrentThreadId () returned 0x970 [0063.605] GetCurrentThreadId () returned 0x970 [0063.605] GetCurrentThreadId () returned 0x970 [0063.605] GetCurrentThreadId () returned 0x970 [0063.605] GetCurrentThreadId () returned 0x970 [0063.605] GetCurrentThreadId () returned 0x970 [0063.605] GetCurrentThreadId () returned 0x970 [0063.605] GetCurrentThreadId () returned 0x970 [0063.605] GetCurrentThreadId () returned 0x970 [0063.605] GetCurrentThreadId () returned 0x970 [0063.605] GetCurrentThreadId () returned 0x970 [0063.605] GetCurrentThreadId () returned 0x970 [0063.605] GetCurrentThreadId () returned 0x970 [0063.605] GetCurrentThreadId () returned 0x970 [0063.605] GetCurrentThreadId () returned 0x970 [0063.605] GetCurrentThreadId () returned 0x970 [0063.605] GetCurrentThreadId () returned 0x970 [0063.605] GetCurrentThreadId () returned 0x970 [0063.605] GetCurrentThreadId () returned 0x970 [0063.605] GetCurrentThreadId () returned 0x970 [0063.605] GetCurrentThreadId () returned 0x970 [0063.605] GetCurrentThreadId () returned 0x970 [0063.605] GetCurrentThreadId () returned 0x970 [0063.605] GetCurrentThreadId () returned 0x970 [0063.605] GetCurrentThreadId () returned 0x970 [0063.605] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.606] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.606] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379ed88, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0063.606] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.606] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.606] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379ed88, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0063.606] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.606] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.606] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379edb8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0063.606] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.606] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.606] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379edb8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0063.606] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.606] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.606] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379ede8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0063.606] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.606] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.606] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379ede8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0063.606] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.606] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.606] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379ede8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0063.606] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xa, wMilliseconds=0x36e)) [0063.606] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="^o{**yEw\\4K.)ypo&$\\Kw#M\\^&=O^d6?", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0063.606] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="^o{**yEw\\4K.)ypo&$\\Kw#M\\^&=O^d6?", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0063.606] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="^o{**yEw\\4K.)ypo&$\\Kw#M\\^&=O^d6?", cchWideChar=32, lpMultiByteStr=0x2003538, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="^o{**yEw\\4K.)ypo&$\\Kw#M\\^&=O^d6?", lpUsedDefaultChar=0x0) returned 32 [0063.606] GetCurrentThreadId () returned 0x970 [0063.606] GetCurrentThreadId () returned 0x970 [0063.606] GetCurrentThreadId () returned 0x970 [0063.606] GetCurrentThreadId () returned 0x970 [0063.606] GetCurrentThreadId () returned 0x970 [0063.606] GetCurrentThreadId () returned 0x970 [0063.614] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0063.614] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0063.614] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3796638, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0063.614] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0063.614] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAENVuVOJRVMV9lFojUmfELnIqQLPb4tbdakAK483DS9jf+unYUfOP5Ckso8Ug6U/E4H2KIHaCL08qoegkxUd9+VHW+9TksvzKQkjCTp2IcZUgTpVP/FmR+ZoG947eIN78q3tE3dbR23+rCrnKoxFNB1V/H+q0kjX69mgghqrUTey/9m1JbaKSODRUHU0mQcBDA5SFrhYAUwLIbBfaVtaRnR0/mHPAI+gvg==") returned 232 [0063.614] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xa, wMilliseconds=0x36e)) [0063.614] GetCurrentThreadId () returned 0x970 [0063.614] GetCurrentThreadId () returned 0x970 [0063.614] GetCurrentThreadId () returned 0x970 [0063.614] GetCurrentThreadId () returned 0x970 [0063.614] GetCurrentThreadId () returned 0x970 [0063.614] GetCurrentThreadId () returned 0x970 [0063.614] GetCurrentThreadId () returned 0x970 [0063.614] GetCurrentThreadId () returned 0x970 [0063.614] GetCurrentThreadId () returned 0x970 [0063.614] GetCurrentThreadId () returned 0x970 [0063.614] GetCurrentThreadId () returned 0x970 [0063.614] GetCurrentThreadId () returned 0x970 [0063.614] GetCurrentThreadId () returned 0x970 [0063.614] GetCurrentThreadId () returned 0x970 [0063.614] GetCurrentThreadId () returned 0x970 [0063.614] GetCurrentThreadId () returned 0x970 [0063.614] GetCurrentThreadId () returned 0x970 [0063.614] GetCurrentThreadId () returned 0x970 [0063.614] GetCurrentThreadId () returned 0x970 [0063.614] GetCurrentThreadId () returned 0x970 [0063.614] GetCurrentThreadId () returned 0x970 [0063.614] GetCurrentThreadId () returned 0x970 [0063.614] GetCurrentThreadId () returned 0x970 [0063.614] GetCurrentThreadId () returned 0x970 [0063.614] GetCurrentThreadId () returned 0x970 [0063.614] GetCurrentThreadId () returned 0x970 [0063.615] GetCurrentThreadId () returned 0x970 [0063.615] GetCurrentThreadId () returned 0x970 [0063.615] GetCurrentThreadId () returned 0x970 [0063.615] GetCurrentThreadId () returned 0x970 [0063.615] GetCurrentThreadId () returned 0x970 [0063.615] GetCurrentThreadId () returned 0x970 [0063.615] GetCurrentThreadId () returned 0x970 [0063.615] GetCurrentThreadId () returned 0x970 [0063.615] GetCurrentThreadId () returned 0x970 [0063.615] GetCurrentThreadId () returned 0x970 [0063.615] GetCurrentThreadId () returned 0x970 [0063.615] GetCurrentThreadId () returned 0x970 [0063.615] GetCurrentThreadId () returned 0x970 [0063.615] GetCurrentThreadId () returned 0x970 [0063.615] GetCurrentThreadId () returned 0x970 [0063.615] GetCurrentThreadId () returned 0x970 [0063.615] GetCurrentThreadId () returned 0x970 [0063.615] GetCurrentThreadId () returned 0x970 [0063.615] GetCurrentThreadId () returned 0x970 [0063.615] GetCurrentThreadId () returned 0x970 [0063.615] GetCurrentThreadId () returned 0x970 [0063.615] GetCurrentThreadId () returned 0x970 [0063.615] GetCurrentThreadId () returned 0x970 [0063.615] GetCurrentThreadId () returned 0x970 [0063.615] GetCurrentThreadId () returned 0x970 [0063.615] GetCurrentThreadId () returned 0x970 [0063.615] GetCurrentThreadId () returned 0x970 [0063.615] GetCurrentThreadId () returned 0x970 [0063.615] GetCurrentThreadId () returned 0x970 [0063.615] GetCurrentThreadId () returned 0x970 [0063.615] GetCurrentThreadId () returned 0x970 [0063.615] GetCurrentThreadId () returned 0x970 [0063.615] GetCurrentThreadId () returned 0x970 [0063.615] GetCurrentThreadId () returned 0x970 [0063.615] GetCurrentThreadId () returned 0x970 [0063.615] GetCurrentThreadId () returned 0x970 [0063.615] GetCurrentThreadId () returned 0x970 [0063.615] GetCurrentThreadId () returned 0x970 [0063.615] GetCurrentThreadId () returned 0x970 [0063.615] GetCurrentThreadId () returned 0x970 [0063.615] GetCurrentThreadId () returned 0x970 [0063.615] GetCurrentThreadId () returned 0x970 [0063.616] GetCurrentThreadId () returned 0x970 [0063.616] GetCurrentThreadId () returned 0x970 [0063.616] GetCurrentThreadId () returned 0x970 [0063.616] GetCurrentThreadId () returned 0x970 [0063.616] GetCurrentThreadId () returned 0x970 [0063.616] GetCurrentThreadId () returned 0x970 [0063.616] GetCurrentThreadId () returned 0x970 [0063.616] GetCurrentThreadId () returned 0x970 [0063.616] GetCurrentThreadId () returned 0x970 [0063.616] GetCurrentThreadId () returned 0x970 [0063.616] GetCurrentThreadId () returned 0x970 [0063.616] GetCurrentThreadId () returned 0x970 [0063.616] GetCurrentThreadId () returned 0x970 [0063.616] GetCurrentThreadId () returned 0x970 [0063.616] GetCurrentThreadId () returned 0x970 [0063.616] GetCurrentThreadId () returned 0x970 [0063.616] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAENVuVOJRVMV9lFojUmfELnIqQLPb4tbdakAK483DS9jf+unYUfOP5Ckso8Ug6U/E4H2KIHaCL08qoegkxUd9+VHW+9TksvzKQkjCTp2IcZUgTpVP/FmR+ZoG947eIN78q3tE3dbR23+rCrnKoxFNB1V/H+q0kjX69mgghqrUTey/9m1JbaKSODRUHU0mQcBDA5SFrhYAUwLIbBfaVtaRnR0/mHPAI+gvg==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0063.616] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAENVuVOJRVMV9lFojUmfELnIqQLPb4tbdakAK483DS9jf+unYUfOP5Ckso8Ug6U/E4H2KIHaCL08qoegkxUd9+VHW+9TksvzKQkjCTp2IcZUgTpVP/FmR+ZoG947eIN78q3tE3dbR23+rCrnKoxFNB1V/H+q0kjX69mgghqrUTey/9m1JbaKSODRUHU0mQcBDA5SFrhYAUwLIbBfaVtaRnR0/mHPAI+gvg==", cchWideChar=245, lpMultiByteStr=0x353933c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAENVuVOJRVMV9lFojUmfELnIqQLPb4tbdakAK483DS9jf+unYUfOP5Ckso8Ug6U/E4H2KIHaCL08qoegkxUd9+VHW+9TksvzKQkjCTp2IcZUgTpVP/FmR+ZoG947eIN78q3tE3dbR23+rCrnKoxFNB1V/H+q0kjX69mgghqrUTey/9m1JbaKSODRUHU0mQcBDA5SFrhYAUwLIbBfaVtaRnR0/mHPAI+gvg==", lpUsedDefaultChar=0x0) returned 245 [0063.616] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0063.616] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0063.616] CloseHandle (hObject=0x158) returned 1 [0063.616] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png")) returned 1 [0063.618] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=18388102751) returned 1 [0063.618] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\Файл зашифрован [PREVIEW.GIF].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\Файл зашифрован [preview.gif].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0063.619] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0063.620] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0063.620] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0063.620] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0063.620] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0063.620] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0063.620] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0063.620] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0063.620] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0063.620] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0063.620] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0063.620] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0063.620] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0063.620] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0063.620] SetEndOfFile (hFile=0x158) returned 1 [0063.620] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0063.620] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0063.620] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0063.621] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0063.621] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0063.622] WriteFile (in: hFile=0x158, lpBuffer=0x35f011c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f011c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0063.622] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="wFd,7!groacW~2yM(:uLpobiM3^0u~br", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0063.622] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="wFd,7!groacW~2yM(:uLpobiM3^0u~br", cchWideChar=32, lpMultiByteStr=0x2035e34, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wFd,7!groacW~2yM(:uLpobiM3^0u~br", lpUsedDefaultChar=0x0) returned 32 [0063.622] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0063.622] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0063.622] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 0x295098 [0063.622] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0063.622] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0063.622] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif")) returned 0x20 [0063.622] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif")) returned 0x20 [0063.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif")) returned 0x20 [0063.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif")) returned 0x20 [0063.623] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa6c)) returned 1 [0063.623] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0063.623] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0063.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif")) returned 0x20 [0063.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif")) returned 0x20 [0063.623] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0063.623] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0063.623] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0063.623] SetEndOfFile (hFile=0x158) returned 1 [0063.624] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0063.624] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe35cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0063.624] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0063.624] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe42ac, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0063.624] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe42ac, cbMultiByte=11, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="PREVIEW.GIFGer.gifg") returned 11 [0063.624] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0063.624] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe35cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0063.624] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0063.624] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0063.625] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0xa6c [0063.625] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0063.625] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0063.625] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0063.625] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0063.625] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe35cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0063.625] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0063.625] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe42ac, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0063.625] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe42ac, cbMultiByte=11, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="PREVIEW.GIFEW.GIFGer.gifg") returned 11 [0063.625] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0063.625] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe35cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0063.625] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0063.626] CharToOemA (in: pSrc="PREVIEW.GIF", pDst=0x1fe42ac | out: pDst="PREVIEW.GIF") returned 1 [0063.626] WriteFile (in: hFile=0x158, lpBuffer=0x1fe42ac*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe42ac*, lpNumberOfBytesWritten=0x18e048*=0xb, lpOverlapped=0x0) returned 1 [0063.626] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0063.626] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0063.627] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0063.627] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=18389008084) returned 1 [0063.627] ReadFile (in: hFile=0x11c, lpBuffer=0x37b81a0, nNumberOfBytesToRead=0xa6c, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37b81a0*, lpNumberOfBytesRead=0x18dd7c*=0xa6c, lpOverlapped=0x0) returned 1 [0063.628] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0063.628] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=18389155723) returned 1 [0063.637] WriteFile (in: hFile=0x158, lpBuffer=0x37fa558*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37fa558*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0063.637] ReadFile (in: hFile=0x11c, lpBuffer=0x37b81a0, nNumberOfBytesToRead=0xa6c, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x37b81a0*, lpNumberOfBytesRead=0x18de38*=0xa6c, lpOverlapped=0x0) returned 1 [0063.637] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x46 [0063.637] WriteFile (in: hFile=0x158, lpBuffer=0x38017f0*, nNumberOfBytesToWrite=0xa6c, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x38017f0*, lpNumberOfBytesWritten=0x18de10*=0xa6c, lpOverlapped=0x0) returned 1 [0063.637] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0xab2 [0063.637] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0063.638] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0063.638] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0063.638] SetFilePointer (in: hFile=0x158, lDistanceToMove=11, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x29 [0063.638] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0xabc [0063.638] CloseHandle (hObject=0x11c) returned 1 [0063.638] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xabc [0063.638] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xabc [0063.638] SetFilePointer (in: hFile=0x158, lDistanceToMove=2748, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xabc [0063.638] SetFilePointer (in: hFile=0x158, lDistanceToMove=2748, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0xabc [0063.638] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xabc [0063.638] SetFilePointer (in: hFile=0x158, lDistanceToMove=2748, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0xabc [0063.638] SetEndOfFile (hFile=0x158) returned 1 [0063.638] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xabc [0063.638] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xabc [0063.639] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0063.639] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe35cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0063.639] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0063.639] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe41ac, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0063.639] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe41ac, cbMultiByte=11, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="PREVIEW.GIF\x18ꞗ@涤(\x18믉`믑`") returned 11 [0063.639] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0063.639] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe35cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0063.639] WriteFile (in: hFile=0x158, lpBuffer=0x379bc78*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x379bc78*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0063.639] CharToOemA (in: pSrc="PREVIEW.GIF", pDst=0x1fe41ac | out: pDst="PREVIEW.GIF") returned 1 [0063.639] WriteFile (in: hFile=0x158, lpBuffer=0x1fe41ac*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe41ac*, lpNumberOfBytesWritten=0x18efcc*=0xb, lpOverlapped=0x0) returned 1 [0063.639] WriteFile (in: hFile=0x158, lpBuffer=0x1fea188*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1fea188*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0063.639] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0063.639] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0063.639] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xb00 [0063.639] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xb00 [0063.639] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0063.640] WriteFile (in: hFile=0x158, lpBuffer=0x35f011c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f011c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0063.640] DeleteFileW (lpFileName="") returned 0 [0063.640] GetLastError () returned 0x3 [0063.640] GetFileAttributesW (lpFileName="") returned 0xffffffff [0063.640] SetLastError (dwErrCode=0x3) [0063.640] FlushFileBuffers (hFile=0x158) returned 1 [0063.642] GetCurrentThreadId () returned 0x970 [0063.642] GetCurrentThreadId () returned 0x970 [0063.642] GetCurrentThreadId () returned 0x970 [0063.642] GetCurrentThreadId () returned 0x970 [0063.642] GetCurrentThreadId () returned 0x970 [0063.642] GetCurrentThreadId () returned 0x970 [0063.642] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xbb7 [0063.642] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xbb7 [0063.642] SetFilePointer (in: hFile=0x158, lDistanceToMove=2999, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xbb7 [0063.642] CloseHandle (hObject=0x158) returned 1 [0063.642] GetCurrentThreadId () returned 0x970 [0063.642] GetCurrentThreadId () returned 0x970 [0063.642] GetCurrentThreadId () returned 0x970 [0063.642] GetCurrentThreadId () returned 0x970 [0063.642] GetCurrentThreadId () returned 0x970 [0063.642] GetCurrentThreadId () returned 0x970 [0063.643] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\Файл зашифрован [PREVIEW.GIF].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\Файл зашифрован [preview.gif].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0063.643] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbb7 [0063.643] SetFilePointer (in: hFile=0x158, lDistanceToMove=2871, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb37 [0063.643] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0063.643] GetFileType (hFile=0x158) returned 0x1 [0063.643] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xa, wMilliseconds=0x38e)) [0063.643] GetCurrentThreadId () returned 0x970 [0063.643] GetCurrentThreadId () returned 0x970 [0063.643] GetCurrentThreadId () returned 0x970 [0063.643] GetCurrentThreadId () returned 0x970 [0063.643] GetCurrentThreadId () returned 0x970 [0063.643] GetCurrentThreadId () returned 0x970 [0063.643] GetCurrentThreadId () returned 0x970 [0063.643] GetCurrentThreadId () returned 0x970 [0063.643] GetCurrentThreadId () returned 0x970 [0063.643] GetCurrentThreadId () returned 0x970 [0063.643] GetCurrentThreadId () returned 0x970 [0063.643] GetCurrentThreadId () returned 0x970 [0063.643] GetCurrentThreadId () returned 0x970 [0063.643] GetCurrentThreadId () returned 0x970 [0063.643] GetCurrentThreadId () returned 0x970 [0063.643] GetCurrentThreadId () returned 0x970 [0063.643] GetCurrentThreadId () returned 0x970 [0063.643] GetCurrentThreadId () returned 0x970 [0063.643] GetCurrentThreadId () returned 0x970 [0063.643] GetCurrentThreadId () returned 0x970 [0063.643] GetCurrentThreadId () returned 0x970 [0063.643] GetCurrentThreadId () returned 0x970 [0063.643] GetCurrentThreadId () returned 0x970 [0063.643] GetCurrentThreadId () returned 0x970 [0063.643] GetCurrentThreadId () returned 0x970 [0063.643] GetCurrentThreadId () returned 0x970 [0063.643] GetCurrentThreadId () returned 0x970 [0063.643] GetCurrentThreadId () returned 0x970 [0063.643] GetCurrentThreadId () returned 0x970 [0063.644] GetCurrentThreadId () returned 0x970 [0063.644] GetCurrentThreadId () returned 0x970 [0063.644] GetCurrentThreadId () returned 0x970 [0063.644] GetCurrentThreadId () returned 0x970 [0063.644] GetCurrentThreadId () returned 0x970 [0063.644] GetCurrentThreadId () returned 0x970 [0063.644] GetCurrentThreadId () returned 0x970 [0063.644] GetCurrentThreadId () returned 0x970 [0063.644] GetCurrentThreadId () returned 0x970 [0063.644] GetCurrentThreadId () returned 0x970 [0063.644] GetCurrentThreadId () returned 0x970 [0063.644] GetCurrentThreadId () returned 0x970 [0063.644] GetCurrentThreadId () returned 0x970 [0063.644] GetCurrentThreadId () returned 0x970 [0063.644] GetCurrentThreadId () returned 0x970 [0063.644] GetCurrentThreadId () returned 0x970 [0063.644] GetCurrentThreadId () returned 0x970 [0063.644] GetCurrentThreadId () returned 0x970 [0063.644] GetCurrentThreadId () returned 0x970 [0063.644] GetCurrentThreadId () returned 0x970 [0063.644] GetCurrentThreadId () returned 0x970 [0063.644] GetCurrentThreadId () returned 0x970 [0063.644] GetCurrentThreadId () returned 0x970 [0063.644] GetCurrentThreadId () returned 0x970 [0063.644] GetCurrentThreadId () returned 0x970 [0063.644] GetCurrentThreadId () returned 0x970 [0063.644] GetCurrentThreadId () returned 0x970 [0063.644] GetCurrentThreadId () returned 0x970 [0063.644] GetCurrentThreadId () returned 0x970 [0063.644] GetCurrentThreadId () returned 0x970 [0063.644] GetCurrentThreadId () returned 0x970 [0063.644] GetCurrentThreadId () returned 0x970 [0063.644] GetCurrentThreadId () returned 0x970 [0063.644] GetCurrentThreadId () returned 0x970 [0063.644] GetCurrentThreadId () returned 0x970 [0063.644] GetCurrentThreadId () returned 0x970 [0063.644] GetCurrentThreadId () returned 0x970 [0063.644] GetCurrentThreadId () returned 0x970 [0063.644] GetCurrentThreadId () returned 0x970 [0063.644] GetCurrentThreadId () returned 0x970 [0063.644] GetCurrentThreadId () returned 0x970 [0063.644] GetCurrentThreadId () returned 0x970 [0063.644] GetCurrentThreadId () returned 0x970 [0063.644] GetCurrentThreadId () returned 0x970 [0063.644] GetCurrentThreadId () returned 0x970 [0063.645] GetCurrentThreadId () returned 0x970 [0063.645] GetCurrentThreadId () returned 0x970 [0063.645] GetCurrentThreadId () returned 0x970 [0063.645] GetCurrentThreadId () returned 0x970 [0063.645] GetCurrentThreadId () returned 0x970 [0063.645] GetCurrentThreadId () returned 0x970 [0063.645] GetCurrentThreadId () returned 0x970 [0063.645] GetCurrentThreadId () returned 0x970 [0063.645] GetCurrentThreadId () returned 0x970 [0063.645] GetCurrentThreadId () returned 0x970 [0063.645] GetCurrentThreadId () returned 0x970 [0063.645] GetCurrentThreadId () returned 0x970 [0063.645] GetCurrentThreadId () returned 0x970 [0063.645] GetCurrentThreadId () returned 0x970 [0063.645] GetCurrentThreadId () returned 0x970 [0063.645] GetCurrentThreadId () returned 0x970 [0063.645] GetCurrentThreadId () returned 0x970 [0063.645] GetCurrentThreadId () returned 0x970 [0063.645] GetCurrentThreadId () returned 0x970 [0063.645] GetCurrentThreadId () returned 0x970 [0063.645] GetCurrentThreadId () returned 0x970 [0063.645] GetCurrentThreadId () returned 0x970 [0063.645] GetCurrentThreadId () returned 0x970 [0063.645] GetCurrentThreadId () returned 0x970 [0063.645] GetCurrentThreadId () returned 0x970 [0063.645] GetCurrentThreadId () returned 0x970 [0063.645] GetCurrentThreadId () returned 0x970 [0063.645] GetCurrentThreadId () returned 0x970 [0063.645] GetCurrentThreadId () returned 0x970 [0063.645] GetCurrentThreadId () returned 0x970 [0063.645] GetCurrentThreadId () returned 0x970 [0063.645] GetCurrentThreadId () returned 0x970 [0063.645] GetCurrentThreadId () returned 0x970 [0063.645] GetCurrentThreadId () returned 0x970 [0063.645] GetCurrentThreadId () returned 0x970 [0063.645] GetCurrentThreadId () returned 0x970 [0063.645] GetCurrentThreadId () returned 0x970 [0063.645] GetCurrentThreadId () returned 0x970 [0063.645] GetCurrentThreadId () returned 0x970 [0063.645] GetCurrentThreadId () returned 0x970 [0063.645] GetCurrentThreadId () returned 0x970 [0063.645] GetCurrentThreadId () returned 0x970 [0063.645] GetCurrentThreadId () returned 0x970 [0063.645] GetCurrentThreadId () returned 0x970 [0063.646] GetCurrentThreadId () returned 0x970 [0063.646] GetCurrentThreadId () returned 0x970 [0063.646] GetCurrentThreadId () returned 0x970 [0063.646] GetCurrentThreadId () returned 0x970 [0063.646] GetCurrentThreadId () returned 0x970 [0063.646] GetCurrentThreadId () returned 0x970 [0063.646] GetCurrentThreadId () returned 0x970 [0063.646] GetCurrentThreadId () returned 0x970 [0063.646] GetCurrentThreadId () returned 0x970 [0063.646] GetCurrentThreadId () returned 0x970 [0063.646] GetCurrentThreadId () returned 0x970 [0063.646] GetCurrentThreadId () returned 0x970 [0063.646] GetCurrentThreadId () returned 0x970 [0063.646] GetCurrentThreadId () returned 0x970 [0063.646] GetCurrentThreadId () returned 0x970 [0063.646] GetCurrentThreadId () returned 0x970 [0063.646] GetCurrentThreadId () returned 0x970 [0063.646] GetCurrentThreadId () returned 0x970 [0063.646] GetCurrentThreadId () returned 0x970 [0063.646] GetCurrentThreadId () returned 0x970 [0063.646] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.646] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.646] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379ede8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0063.646] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.646] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.646] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379ede8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0063.646] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.646] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.646] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379ee18, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0063.646] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.646] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.646] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379ee18, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0063.646] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.646] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.646] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379ee48, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0063.646] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.647] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.647] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379ee48, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0063.647] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.647] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.647] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379ee48, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0063.647] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xa, wMilliseconds=0x39d)) [0063.647] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wFd,7!groacW~2yM(:uLpobiM3^0u~br", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0063.647] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wFd,7!groacW~2yM(:uLpobiM3^0u~br", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0063.647] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wFd,7!groacW~2yM(:uLpobiM3^0u~br", cchWideChar=32, lpMultiByteStr=0x20024e8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wFd,7!groacW~2yM(:uLpobiM3^0u~br", lpUsedDefaultChar=0x0) returned 32 [0063.647] GetCurrentThreadId () returned 0x970 [0063.647] GetCurrentThreadId () returned 0x970 [0063.647] GetCurrentThreadId () returned 0x970 [0063.647] GetCurrentThreadId () returned 0x970 [0063.647] GetCurrentThreadId () returned 0x970 [0063.647] GetCurrentThreadId () returned 0x970 [0063.654] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0063.654] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0063.654] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3796728, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0063.654] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0063.654] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAHBwnIH6aseQTFvmzqRjs5NgP8DgfUFGcAIQXxGHTjF5aho2K62gqqTEkqWfxbnZMQyXZ+kZ7fTS31RrK+otmnMnNLcZIaDD5rVgpmmHS1X0l/CERkNq5W8uQlWKzRHcwOmr6Lk+UMuPd6kTcuX2xDwWKFTaAf9GShMh98vhDP9Bob2Pyml8Ow4TRUQxtGCQK6HucsWoi3bMBcOl8FCAA03gGNQZoS2yiA==") returned 232 [0063.654] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xa, wMilliseconds=0x39d)) [0063.655] GetCurrentThreadId () returned 0x970 [0063.655] GetCurrentThreadId () returned 0x970 [0063.655] GetCurrentThreadId () returned 0x970 [0063.655] GetCurrentThreadId () returned 0x970 [0063.655] GetCurrentThreadId () returned 0x970 [0063.655] GetCurrentThreadId () returned 0x970 [0063.655] GetCurrentThreadId () returned 0x970 [0063.655] GetCurrentThreadId () returned 0x970 [0063.655] GetCurrentThreadId () returned 0x970 [0063.655] GetCurrentThreadId () returned 0x970 [0063.655] GetCurrentThreadId () returned 0x970 [0063.655] GetCurrentThreadId () returned 0x970 [0063.655] GetCurrentThreadId () returned 0x970 [0063.655] GetCurrentThreadId () returned 0x970 [0063.655] GetCurrentThreadId () returned 0x970 [0063.655] GetCurrentThreadId () returned 0x970 [0063.655] GetCurrentThreadId () returned 0x970 [0063.655] GetCurrentThreadId () returned 0x970 [0063.655] GetCurrentThreadId () returned 0x970 [0063.655] GetCurrentThreadId () returned 0x970 [0063.655] GetCurrentThreadId () returned 0x970 [0063.655] GetCurrentThreadId () returned 0x970 [0063.655] GetCurrentThreadId () returned 0x970 [0063.655] GetCurrentThreadId () returned 0x970 [0063.655] GetCurrentThreadId () returned 0x970 [0063.655] GetCurrentThreadId () returned 0x970 [0063.655] GetCurrentThreadId () returned 0x970 [0063.655] GetCurrentThreadId () returned 0x970 [0063.655] GetCurrentThreadId () returned 0x970 [0063.655] GetCurrentThreadId () returned 0x970 [0063.655] GetCurrentThreadId () returned 0x970 [0063.655] GetCurrentThreadId () returned 0x970 [0063.655] GetCurrentThreadId () returned 0x970 [0063.655] GetCurrentThreadId () returned 0x970 [0063.655] GetCurrentThreadId () returned 0x970 [0063.655] GetCurrentThreadId () returned 0x970 [0063.655] GetCurrentThreadId () returned 0x970 [0063.655] GetCurrentThreadId () returned 0x970 [0063.655] GetCurrentThreadId () returned 0x970 [0063.655] GetCurrentThreadId () returned 0x970 [0063.655] GetCurrentThreadId () returned 0x970 [0063.655] GetCurrentThreadId () returned 0x970 [0063.655] GetCurrentThreadId () returned 0x970 [0063.655] GetCurrentThreadId () returned 0x970 [0063.655] GetCurrentThreadId () returned 0x970 [0063.655] GetCurrentThreadId () returned 0x970 [0063.656] GetCurrentThreadId () returned 0x970 [0063.656] GetCurrentThreadId () returned 0x970 [0063.656] GetCurrentThreadId () returned 0x970 [0063.656] GetCurrentThreadId () returned 0x970 [0063.656] GetCurrentThreadId () returned 0x970 [0063.656] GetCurrentThreadId () returned 0x970 [0063.656] GetCurrentThreadId () returned 0x970 [0063.656] GetCurrentThreadId () returned 0x970 [0063.656] GetCurrentThreadId () returned 0x970 [0063.656] GetCurrentThreadId () returned 0x970 [0063.656] GetCurrentThreadId () returned 0x970 [0063.656] GetCurrentThreadId () returned 0x970 [0063.656] GetCurrentThreadId () returned 0x970 [0063.656] GetCurrentThreadId () returned 0x970 [0063.656] GetCurrentThreadId () returned 0x970 [0063.656] GetCurrentThreadId () returned 0x970 [0063.656] GetCurrentThreadId () returned 0x970 [0063.656] GetCurrentThreadId () returned 0x970 [0063.656] GetCurrentThreadId () returned 0x970 [0063.656] GetCurrentThreadId () returned 0x970 [0063.656] GetCurrentThreadId () returned 0x970 [0063.656] GetCurrentThreadId () returned 0x970 [0063.656] GetCurrentThreadId () returned 0x970 [0063.656] GetCurrentThreadId () returned 0x970 [0063.656] GetCurrentThreadId () returned 0x970 [0063.656] GetCurrentThreadId () returned 0x970 [0063.656] GetCurrentThreadId () returned 0x970 [0063.656] GetCurrentThreadId () returned 0x970 [0063.656] GetCurrentThreadId () returned 0x970 [0063.656] GetCurrentThreadId () returned 0x970 [0063.656] GetCurrentThreadId () returned 0x970 [0063.656] GetCurrentThreadId () returned 0x970 [0063.656] GetCurrentThreadId () returned 0x970 [0063.656] GetCurrentThreadId () returned 0x970 [0063.656] GetCurrentThreadId () returned 0x970 [0063.656] GetCurrentThreadId () returned 0x970 [0063.656] GetCurrentThreadId () returned 0x970 [0063.656] GetCurrentThreadId () returned 0x970 [0063.656] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAHBwnIH6aseQTFvmzqRjs5NgP8DgfUFGcAIQXxGHTjF5aho2K62gqqTEkqWfxbnZMQyXZ+kZ7fTS31RrK+otmnMnNLcZIaDD5rVgpmmHS1X0l/CERkNq5W8uQlWKzRHcwOmr6Lk+UMuPd6kTcuX2xDwWKFTaAf9GShMh98vhDP9Bob2Pyml8Ow4TRUQxtGCQK6HucsWoi3bMBcOl8FCAA03gGNQZoS2yiA==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0063.656] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAHBwnIH6aseQTFvmzqRjs5NgP8DgfUFGcAIQXxGHTjF5aho2K62gqqTEkqWfxbnZMQyXZ+kZ7fTS31RrK+otmnMnNLcZIaDD5rVgpmmHS1X0l/CERkNq5W8uQlWKzRHcwOmr6Lk+UMuPd6kTcuX2xDwWKFTaAf9GShMh98vhDP9Bob2Pyml8Ow4TRUQxtGCQK6HucsWoi3bMBcOl8FCAA03gGNQZoS2yiA==", cchWideChar=245, lpMultiByteStr=0x353933c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAHBwnIH6aseQTFvmzqRjs5NgP8DgfUFGcAIQXxGHTjF5aho2K62gqqTEkqWfxbnZMQyXZ+kZ7fTS31RrK+otmnMnNLcZIaDD5rVgpmmHS1X0l/CERkNq5W8uQlWKzRHcwOmr6Lk+UMuPd6kTcuX2xDwWKFTaAf9GShMh98vhDP9Bob2Pyml8Ow4TRUQxtGCQK6HucsWoi3bMBcOl8FCAA03gGNQZoS2yiA==", lpUsedDefaultChar=0x0) returned 245 [0063.656] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0063.657] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0063.657] CloseHandle (hObject=0x158) returned 1 [0063.657] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif")) returned 1 [0063.658] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=18392108775) returned 1 [0063.658] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\Файл зашифрован [THMBNAIL.PNG].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\Файл зашифрован [thmbnail.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0063.658] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0063.658] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0063.658] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0063.658] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0063.658] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0063.658] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0063.658] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0063.659] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0063.659] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0063.659] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0063.659] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0063.659] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0063.659] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0063.659] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0063.659] SetEndOfFile (hFile=0x158) returned 1 [0063.659] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0063.659] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0063.659] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0063.659] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0063.659] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0063.660] WriteFile (in: hFile=0x158, lpBuffer=0x35f01dc*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f01dc*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0063.660] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="/GK\\xEV%)z}\"%~^+6ACT1DuA~m#<%L3a", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0063.660] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="/GK\\xEV%)z}\"%~^+6ACT1DuA~m#<%L3a", cchWideChar=32, lpMultiByteStr=0x2035e6c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="/GK\\xEV%)z}\"%~^+6ACT1DuA~m#<%L3a", lpUsedDefaultChar=0x0) returned 32 [0063.660] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0063.660] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0063.660] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa5d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0x295098 [0063.660] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0063.661] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0063.661] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png")) returned 0x20 [0063.661] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png")) returned 0x20 [0063.661] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png")) returned 0x20 [0063.661] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png")) returned 0x20 [0063.661] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa5d5)) returned 1 [0063.661] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0063.661] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0063.661] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png")) returned 0x20 [0063.661] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png")) returned 0x20 [0063.661] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0063.661] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0063.661] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0063.661] SetEndOfFile (hFile=0x158) returned 1 [0063.662] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0063.662] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe36ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0063.662] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0063.662] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe472c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0063.662] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe472c, cbMultiByte=12, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="THMBNAIL.PNGer.gifg") returned 12 [0063.662] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0063.662] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe36ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0063.663] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0063.663] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0063.663] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0xa5d5 [0063.663] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0063.663] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0063.663] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0063.663] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0063.663] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe36ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0063.663] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0063.663] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe472c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0063.663] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe472c, cbMultiByte=12, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="THMBNAIL.PNGIL.PNGer.gifg") returned 12 [0063.663] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0063.663] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe36ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0063.663] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0063.664] CharToOemA (in: pSrc="THMBNAIL.PNG", pDst=0x1fe472c | out: pDst="THMBNAIL.PNG") returned 1 [0063.664] WriteFile (in: hFile=0x158, lpBuffer=0x1fe472c*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe472c*, lpNumberOfBytesWritten=0x18e048*=0xc, lpOverlapped=0x0) returned 1 [0063.664] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0063.664] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0063.665] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0063.665] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=18392807847) returned 1 [0063.665] ReadFile (in: hFile=0x11c, lpBuffer=0x37bf4d0, nNumberOfBytesToRead=0xa5d5, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37bf4d0*, lpNumberOfBytesRead=0x18dd7c*=0xa5d5, lpOverlapped=0x0) returned 1 [0063.667] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0063.667] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=18393017545) returned 1 [0063.675] WriteFile (in: hFile=0x158, lpBuffer=0x37b8298*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37b8298*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0063.675] ReadFile (in: hFile=0x11c, lpBuffer=0x37bf4d0, nNumberOfBytesToRead=0xa5d5, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x37bf4d0*, lpNumberOfBytesRead=0x18de38*=0xa5d5, lpOverlapped=0x0) returned 1 [0063.677] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x47 [0063.677] WriteFile (in: hFile=0x158, lpBuffer=0x380b2f0*, nNumberOfBytesToWrite=0xa5d5, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x380b2f0*, lpNumberOfBytesWritten=0x18de10*=0xa5d5, lpOverlapped=0x0) returned 1 [0063.678] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0xa61c [0063.678] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0063.678] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0063.678] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0063.678] SetFilePointer (in: hFile=0x158, lDistanceToMove=12, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2a [0063.678] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0xa626 [0063.678] CloseHandle (hObject=0x11c) returned 1 [0063.678] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xa626 [0063.678] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xa626 [0063.678] SetFilePointer (in: hFile=0x158, lDistanceToMove=42534, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xa626 [0063.678] SetFilePointer (in: hFile=0x158, lDistanceToMove=42534, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0xa626 [0063.678] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xa626 [0063.678] SetFilePointer (in: hFile=0x158, lDistanceToMove=42534, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0xa626 [0063.678] SetEndOfFile (hFile=0x158) returned 1 [0063.679] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xa626 [0063.679] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xa626 [0063.679] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0063.679] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe36ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0063.679] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0063.679] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe37ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0063.679] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe37ec, cbMultiByte=12, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="THMBNAIL.PNGꞗ@涤(\x18믉`믑`") returned 12 [0063.679] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0063.679] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe36ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0063.679] WriteFile (in: hFile=0x158, lpBuffer=0x379bc78*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x379bc78*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0063.679] CharToOemA (in: pSrc="THMBNAIL.PNG", pDst=0x1fe37ec | out: pDst="THMBNAIL.PNG") returned 1 [0063.679] WriteFile (in: hFile=0x158, lpBuffer=0x1fe37ec*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe37ec*, lpNumberOfBytesWritten=0x18efcc*=0xc, lpOverlapped=0x0) returned 1 [0063.679] WriteFile (in: hFile=0x158, lpBuffer=0x37b81f8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x37b81f8*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0063.679] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0063.679] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0063.680] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xa66b [0063.680] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xa66b [0063.680] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0063.680] WriteFile (in: hFile=0x158, lpBuffer=0x35f01dc*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f01dc*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0063.680] DeleteFileW (lpFileName="") returned 0 [0063.680] GetLastError () returned 0x3 [0063.680] GetFileAttributesW (lpFileName="") returned 0xffffffff [0063.680] SetLastError (dwErrCode=0x3) [0063.680] FlushFileBuffers (hFile=0x158) returned 1 [0063.683] GetCurrentThreadId () returned 0x970 [0063.683] GetCurrentThreadId () returned 0x970 [0063.683] GetCurrentThreadId () returned 0x970 [0063.683] GetCurrentThreadId () returned 0x970 [0063.683] GetCurrentThreadId () returned 0x970 [0063.683] GetCurrentThreadId () returned 0x970 [0063.683] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xa722 [0063.683] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xa722 [0063.683] SetFilePointer (in: hFile=0x158, lDistanceToMove=42786, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xa722 [0063.683] CloseHandle (hObject=0x158) returned 1 [0063.684] GetCurrentThreadId () returned 0x970 [0063.684] GetCurrentThreadId () returned 0x970 [0063.684] GetCurrentThreadId () returned 0x970 [0063.684] GetCurrentThreadId () returned 0x970 [0063.684] GetCurrentThreadId () returned 0x970 [0063.684] GetCurrentThreadId () returned 0x970 [0063.684] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\Файл зашифрован [THMBNAIL.PNG].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\Файл зашифрован [thmbnail.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0063.684] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa722 [0063.684] SetFilePointer (in: hFile=0x158, lDistanceToMove=42658, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa6a2 [0063.684] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0063.684] GetFileType (hFile=0x158) returned 0x1 [0063.684] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xa, wMilliseconds=0x3bc)) [0063.684] GetCurrentThreadId () returned 0x970 [0063.684] GetCurrentThreadId () returned 0x970 [0063.684] GetCurrentThreadId () returned 0x970 [0063.684] GetCurrentThreadId () returned 0x970 [0063.684] GetCurrentThreadId () returned 0x970 [0063.684] GetCurrentThreadId () returned 0x970 [0063.684] GetCurrentThreadId () returned 0x970 [0063.684] GetCurrentThreadId () returned 0x970 [0063.684] GetCurrentThreadId () returned 0x970 [0063.684] GetCurrentThreadId () returned 0x970 [0063.684] GetCurrentThreadId () returned 0x970 [0063.684] GetCurrentThreadId () returned 0x970 [0063.684] GetCurrentThreadId () returned 0x970 [0063.684] GetCurrentThreadId () returned 0x970 [0063.684] GetCurrentThreadId () returned 0x970 [0063.684] GetCurrentThreadId () returned 0x970 [0063.684] GetCurrentThreadId () returned 0x970 [0063.685] GetCurrentThreadId () returned 0x970 [0063.685] GetCurrentThreadId () returned 0x970 [0063.685] GetCurrentThreadId () returned 0x970 [0063.685] GetCurrentThreadId () returned 0x970 [0063.685] GetCurrentThreadId () returned 0x970 [0063.685] GetCurrentThreadId () returned 0x970 [0063.685] GetCurrentThreadId () returned 0x970 [0063.685] GetCurrentThreadId () returned 0x970 [0063.685] GetCurrentThreadId () returned 0x970 [0063.685] GetCurrentThreadId () returned 0x970 [0063.685] GetCurrentThreadId () returned 0x970 [0063.685] GetCurrentThreadId () returned 0x970 [0063.685] GetCurrentThreadId () returned 0x970 [0063.685] GetCurrentThreadId () returned 0x970 [0063.685] GetCurrentThreadId () returned 0x970 [0063.685] GetCurrentThreadId () returned 0x970 [0063.685] GetCurrentThreadId () returned 0x970 [0063.685] GetCurrentThreadId () returned 0x970 [0063.685] GetCurrentThreadId () returned 0x970 [0063.685] GetCurrentThreadId () returned 0x970 [0063.685] GetCurrentThreadId () returned 0x970 [0063.685] GetCurrentThreadId () returned 0x970 [0063.685] GetCurrentThreadId () returned 0x970 [0063.685] GetCurrentThreadId () returned 0x970 [0063.685] GetCurrentThreadId () returned 0x970 [0063.685] GetCurrentThreadId () returned 0x970 [0063.685] GetCurrentThreadId () returned 0x970 [0063.685] GetCurrentThreadId () returned 0x970 [0063.685] GetCurrentThreadId () returned 0x970 [0063.685] GetCurrentThreadId () returned 0x970 [0063.685] GetCurrentThreadId () returned 0x970 [0063.685] GetCurrentThreadId () returned 0x970 [0063.685] GetCurrentThreadId () returned 0x970 [0063.685] GetCurrentThreadId () returned 0x970 [0063.685] GetCurrentThreadId () returned 0x970 [0063.685] GetCurrentThreadId () returned 0x970 [0063.685] GetCurrentThreadId () returned 0x970 [0063.685] GetCurrentThreadId () returned 0x970 [0063.685] GetCurrentThreadId () returned 0x970 [0063.685] GetCurrentThreadId () returned 0x970 [0063.685] GetCurrentThreadId () returned 0x970 [0063.685] GetCurrentThreadId () returned 0x970 [0063.685] GetCurrentThreadId () returned 0x970 [0063.685] GetCurrentThreadId () returned 0x970 [0063.686] GetCurrentThreadId () returned 0x970 [0063.686] GetCurrentThreadId () returned 0x970 [0063.686] GetCurrentThreadId () returned 0x970 [0063.686] GetCurrentThreadId () returned 0x970 [0063.686] GetCurrentThreadId () returned 0x970 [0063.686] GetCurrentThreadId () returned 0x970 [0063.686] GetCurrentThreadId () returned 0x970 [0063.686] GetCurrentThreadId () returned 0x970 [0063.686] GetCurrentThreadId () returned 0x970 [0063.686] GetCurrentThreadId () returned 0x970 [0063.686] GetCurrentThreadId () returned 0x970 [0063.686] GetCurrentThreadId () returned 0x970 [0063.686] GetCurrentThreadId () returned 0x970 [0063.686] GetCurrentThreadId () returned 0x970 [0063.686] GetCurrentThreadId () returned 0x970 [0063.686] GetCurrentThreadId () returned 0x970 [0063.686] GetCurrentThreadId () returned 0x970 [0063.686] GetCurrentThreadId () returned 0x970 [0063.686] GetCurrentThreadId () returned 0x970 [0063.686] GetCurrentThreadId () returned 0x970 [0063.686] GetCurrentThreadId () returned 0x970 [0063.686] GetCurrentThreadId () returned 0x970 [0063.686] GetCurrentThreadId () returned 0x970 [0063.686] GetCurrentThreadId () returned 0x970 [0063.686] GetCurrentThreadId () returned 0x970 [0063.686] GetCurrentThreadId () returned 0x970 [0063.686] GetCurrentThreadId () returned 0x970 [0063.686] GetCurrentThreadId () returned 0x970 [0063.686] GetCurrentThreadId () returned 0x970 [0063.686] GetCurrentThreadId () returned 0x970 [0063.686] GetCurrentThreadId () returned 0x970 [0063.686] GetCurrentThreadId () returned 0x970 [0063.686] GetCurrentThreadId () returned 0x970 [0063.686] GetCurrentThreadId () returned 0x970 [0063.686] GetCurrentThreadId () returned 0x970 [0063.686] GetCurrentThreadId () returned 0x970 [0063.686] GetCurrentThreadId () returned 0x970 [0063.686] GetCurrentThreadId () returned 0x970 [0063.686] GetCurrentThreadId () returned 0x970 [0063.686] GetCurrentThreadId () returned 0x970 [0063.686] GetCurrentThreadId () returned 0x970 [0063.686] GetCurrentThreadId () returned 0x970 [0063.686] GetCurrentThreadId () returned 0x970 [0063.686] GetCurrentThreadId () returned 0x970 [0063.686] GetCurrentThreadId () returned 0x970 [0063.687] GetCurrentThreadId () returned 0x970 [0063.687] GetCurrentThreadId () returned 0x970 [0063.687] GetCurrentThreadId () returned 0x970 [0063.687] GetCurrentThreadId () returned 0x970 [0063.687] GetCurrentThreadId () returned 0x970 [0063.687] GetCurrentThreadId () returned 0x970 [0063.687] GetCurrentThreadId () returned 0x970 [0063.687] GetCurrentThreadId () returned 0x970 [0063.687] GetCurrentThreadId () returned 0x970 [0063.687] GetCurrentThreadId () returned 0x970 [0063.687] GetCurrentThreadId () returned 0x970 [0063.687] GetCurrentThreadId () returned 0x970 [0063.687] GetCurrentThreadId () returned 0x970 [0063.687] GetCurrentThreadId () returned 0x970 [0063.687] GetCurrentThreadId () returned 0x970 [0063.687] GetCurrentThreadId () returned 0x970 [0063.687] GetCurrentThreadId () returned 0x970 [0063.687] GetCurrentThreadId () returned 0x970 [0063.687] GetCurrentThreadId () returned 0x970 [0063.687] GetCurrentThreadId () returned 0x970 [0063.687] GetCurrentThreadId () returned 0x970 [0063.687] GetCurrentThreadId () returned 0x970 [0063.687] GetCurrentThreadId () returned 0x970 [0063.687] GetCurrentThreadId () returned 0x970 [0063.687] GetCurrentThreadId () returned 0x970 [0063.687] GetCurrentThreadId () returned 0x970 [0063.687] GetCurrentThreadId () returned 0x970 [0063.687] GetCurrentThreadId () returned 0x970 [0063.687] GetCurrentThreadId () returned 0x970 [0063.687] GetCurrentThreadId () returned 0x970 [0063.687] GetCurrentThreadId () returned 0x970 [0063.687] GetCurrentThreadId () returned 0x970 [0063.687] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.687] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.687] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379ee48, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0063.687] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.687] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.687] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379ee48, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0063.687] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.687] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.687] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379ee78, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0063.687] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.688] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.688] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379ee78, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0063.688] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.688] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.688] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379eea8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0063.688] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.688] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.688] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379eea8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0063.688] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.688] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.688] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379eea8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0063.688] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xa, wMilliseconds=0x3bc)) [0063.688] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="/GK\\xEV%)z}\"%~^+6ACT1DuA~m#<%L3a", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0063.688] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="/GK\\xEV%)z}\"%~^+6ACT1DuA~m#<%L3a", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0063.688] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="/GK\\xEV%)z}\"%~^+6ACT1DuA~m#<%L3a", cchWideChar=32, lpMultiByteStr=0x2003598, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="/GK\\xEV%)z}\"%~^+6ACT1DuA~m#<%L3a", lpUsedDefaultChar=0x0) returned 32 [0063.688] GetCurrentThreadId () returned 0x970 [0063.688] GetCurrentThreadId () returned 0x970 [0063.688] GetCurrentThreadId () returned 0x970 [0063.688] GetCurrentThreadId () returned 0x970 [0063.688] GetCurrentThreadId () returned 0x970 [0063.688] GetCurrentThreadId () returned 0x970 [0063.696] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0063.696] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0063.696] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3796818, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0063.696] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0063.696] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAACrbCBNDYMWW4Te1OYDxLS0PMYvChcTWt6nwvJk1T4PNP/3JuxWp0ivV4qtl/70gk3g1lJvwnrSfnJAVxG4DJnLkHtFyzjx+QQBJ1PWI+0LA/5zdiuPB838dIROI1SLmWzXQCc2W11LblchPef5pfa9kQpmH1dQO88npfZhIkOWyTjy3mpnDBpXchFNXJcV6M5CS6TX2dE8P97qq61UVHR3b3KY5j7sPkQ==") returned 232 [0063.696] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xa, wMilliseconds=0x3cc)) [0063.696] GetCurrentThreadId () returned 0x970 [0063.696] GetCurrentThreadId () returned 0x970 [0063.696] GetCurrentThreadId () returned 0x970 [0063.696] GetCurrentThreadId () returned 0x970 [0063.696] GetCurrentThreadId () returned 0x970 [0063.696] GetCurrentThreadId () returned 0x970 [0063.696] GetCurrentThreadId () returned 0x970 [0063.696] GetCurrentThreadId () returned 0x970 [0063.696] GetCurrentThreadId () returned 0x970 [0063.696] GetCurrentThreadId () returned 0x970 [0063.696] GetCurrentThreadId () returned 0x970 [0063.696] GetCurrentThreadId () returned 0x970 [0063.696] GetCurrentThreadId () returned 0x970 [0063.696] GetCurrentThreadId () returned 0x970 [0063.696] GetCurrentThreadId () returned 0x970 [0063.696] GetCurrentThreadId () returned 0x970 [0063.696] GetCurrentThreadId () returned 0x970 [0063.696] GetCurrentThreadId () returned 0x970 [0063.696] GetCurrentThreadId () returned 0x970 [0063.696] GetCurrentThreadId () returned 0x970 [0063.696] GetCurrentThreadId () returned 0x970 [0063.696] GetCurrentThreadId () returned 0x970 [0063.696] GetCurrentThreadId () returned 0x970 [0063.696] GetCurrentThreadId () returned 0x970 [0063.696] GetCurrentThreadId () returned 0x970 [0063.697] GetCurrentThreadId () returned 0x970 [0063.697] GetCurrentThreadId () returned 0x970 [0063.697] GetCurrentThreadId () returned 0x970 [0063.697] GetCurrentThreadId () returned 0x970 [0063.697] GetCurrentThreadId () returned 0x970 [0063.697] GetCurrentThreadId () returned 0x970 [0063.697] GetCurrentThreadId () returned 0x970 [0063.697] GetCurrentThreadId () returned 0x970 [0063.697] GetCurrentThreadId () returned 0x970 [0063.697] GetCurrentThreadId () returned 0x970 [0063.697] GetCurrentThreadId () returned 0x970 [0063.697] GetCurrentThreadId () returned 0x970 [0063.697] GetCurrentThreadId () returned 0x970 [0063.697] GetCurrentThreadId () returned 0x970 [0063.697] GetCurrentThreadId () returned 0x970 [0063.697] GetCurrentThreadId () returned 0x970 [0063.697] GetCurrentThreadId () returned 0x970 [0063.697] GetCurrentThreadId () returned 0x970 [0063.697] GetCurrentThreadId () returned 0x970 [0063.697] GetCurrentThreadId () returned 0x970 [0063.697] GetCurrentThreadId () returned 0x970 [0063.697] GetCurrentThreadId () returned 0x970 [0063.697] GetCurrentThreadId () returned 0x970 [0063.697] GetCurrentThreadId () returned 0x970 [0063.697] GetCurrentThreadId () returned 0x970 [0063.697] GetCurrentThreadId () returned 0x970 [0063.697] GetCurrentThreadId () returned 0x970 [0063.697] GetCurrentThreadId () returned 0x970 [0063.697] GetCurrentThreadId () returned 0x970 [0063.697] GetCurrentThreadId () returned 0x970 [0063.697] GetCurrentThreadId () returned 0x970 [0063.697] GetCurrentThreadId () returned 0x970 [0063.697] GetCurrentThreadId () returned 0x970 [0063.697] GetCurrentThreadId () returned 0x970 [0063.697] GetCurrentThreadId () returned 0x970 [0063.697] GetCurrentThreadId () returned 0x970 [0063.697] GetCurrentThreadId () returned 0x970 [0063.697] GetCurrentThreadId () returned 0x970 [0063.697] GetCurrentThreadId () returned 0x970 [0063.697] GetCurrentThreadId () returned 0x970 [0063.697] GetCurrentThreadId () returned 0x970 [0063.697] GetCurrentThreadId () returned 0x970 [0063.697] GetCurrentThreadId () returned 0x970 [0063.697] GetCurrentThreadId () returned 0x970 [0063.698] GetCurrentThreadId () returned 0x970 [0063.698] GetCurrentThreadId () returned 0x970 [0063.698] GetCurrentThreadId () returned 0x970 [0063.698] GetCurrentThreadId () returned 0x970 [0063.698] GetCurrentThreadId () returned 0x970 [0063.698] GetCurrentThreadId () returned 0x970 [0063.698] GetCurrentThreadId () returned 0x970 [0063.698] GetCurrentThreadId () returned 0x970 [0063.698] GetCurrentThreadId () returned 0x970 [0063.698] GetCurrentThreadId () returned 0x970 [0063.698] GetCurrentThreadId () returned 0x970 [0063.698] GetCurrentThreadId () returned 0x970 [0063.698] GetCurrentThreadId () returned 0x970 [0063.698] GetCurrentThreadId () returned 0x970 [0063.698] GetCurrentThreadId () returned 0x970 [0063.698] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAACrbCBNDYMWW4Te1OYDxLS0PMYvChcTWt6nwvJk1T4PNP/3JuxWp0ivV4qtl/70gk3g1lJvwnrSfnJAVxG4DJnLkHtFyzjx+QQBJ1PWI+0LA/5zdiuPB838dIROI1SLmWzXQCc2W11LblchPef5pfa9kQpmH1dQO88npfZhIkOWyTjy3mpnDBpXchFNXJcV6M5CS6TX2dE8P97qq61UVHR3b3KY5j7sPkQ==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0063.698] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAACrbCBNDYMWW4Te1OYDxLS0PMYvChcTWt6nwvJk1T4PNP/3JuxWp0ivV4qtl/70gk3g1lJvwnrSfnJAVxG4DJnLkHtFyzjx+QQBJ1PWI+0LA/5zdiuPB838dIROI1SLmWzXQCc2W11LblchPef5pfa9kQpmH1dQO88npfZhIkOWyTjy3mpnDBpXchFNXJcV6M5CS6TX2dE8P97qq61UVHR3b3KY5j7sPkQ==", cchWideChar=245, lpMultiByteStr=0x353933c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAACrbCBNDYMWW4Te1OYDxLS0PMYvChcTWt6nwvJk1T4PNP/3JuxWp0ivV4qtl/70gk3g1lJvwnrSfnJAVxG4DJnLkHtFyzjx+QQBJ1PWI+0LA/5zdiuPB838dIROI1SLmWzXQCc2W11LblchPef5pfa9kQpmH1dQO88npfZhIkOWyTjy3mpnDBpXchFNXJcV6M5CS6TX2dE8P97qq61UVHR3b3KY5j7sPkQ==", lpUsedDefaultChar=0x0) returned 245 [0063.698] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0063.698] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0063.698] CloseHandle (hObject=0x158) returned 1 [0063.698] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png")) returned 1 [0063.699] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=18396287156) returned 1 [0063.700] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\Файл зашифрован [PREVIEW.GIF].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\Файл зашифрован [preview.gif].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0063.702] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0063.702] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0063.702] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0063.702] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0063.702] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0063.702] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0063.702] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0063.702] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0063.702] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0063.702] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0063.702] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0063.702] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0063.702] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0063.702] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0063.703] SetEndOfFile (hFile=0x158) returned 1 [0063.703] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0063.703] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0063.703] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0063.703] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0063.703] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0063.704] WriteFile (in: hFile=0x158, lpBuffer=0x35f011c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f011c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0063.704] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=")UVSr\"NBNdz6oxcbZ6>%U3LZnt.p2B:o", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0063.704] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=")UVSr\"NBNdz6oxcbZ6>%U3LZnt.p2B:o", cchWideChar=32, lpMultiByteStr=0x2035ea4, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=")UVSr\"NBNdz6oxcbZ6>%U3LZnt.p2B:o", lpUsedDefaultChar=0x0) returned 32 [0063.704] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0063.704] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0063.704] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x623, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 0x295098 [0063.704] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0063.704] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0063.704] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif")) returned 0x20 [0063.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif")) returned 0x20 [0063.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif")) returned 0x20 [0063.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif")) returned 0x20 [0063.705] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x623)) returned 1 [0063.705] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0063.705] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0063.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif")) returned 0x20 [0063.706] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif")) returned 0x20 [0063.706] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0063.706] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0063.706] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0063.706] SetEndOfFile (hFile=0x158) returned 1 [0063.707] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0063.707] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe410c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0063.707] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0063.707] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe44ac, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0063.707] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe44ac, cbMultiByte=11, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="PREVIEW.GIFGer.gifg") returned 11 [0063.707] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0063.707] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe410c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0063.707] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0063.707] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0063.707] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x623 [0063.707] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0063.707] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0063.707] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0063.707] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0063.707] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe410c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0063.708] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0063.708] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe44ac, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0063.708] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe44ac, cbMultiByte=11, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="PREVIEW.GIFEW.GIFGer.gifg") returned 11 [0063.708] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0063.708] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe410c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0063.708] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0063.709] CharToOemA (in: pSrc="PREVIEW.GIF", pDst=0x1fe44ac | out: pDst="PREVIEW.GIF") returned 1 [0063.709] WriteFile (in: hFile=0x158, lpBuffer=0x1fe44ac*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe44ac*, lpNumberOfBytesWritten=0x18e048*=0xb, lpOverlapped=0x0) returned 1 [0063.709] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0063.709] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0063.709] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0063.709] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=18398375689) returned 1 [0063.720] ReadFile (in: hFile=0x11c, lpBuffer=0x37bf4f0, nNumberOfBytesToRead=0x623, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37bf4f0*, lpNumberOfBytesRead=0x18dd7c*=0x623, lpOverlapped=0x0) returned 1 [0063.722] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0063.722] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=18398569533) returned 1 [0063.731] WriteFile (in: hFile=0x158, lpBuffer=0x379ad98*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379ad98*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0063.731] ReadFile (in: hFile=0x11c, lpBuffer=0x37bf4f0, nNumberOfBytesToRead=0x623, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x37bf4f0*, lpNumberOfBytesRead=0x18de38*=0x623, lpOverlapped=0x0) returned 1 [0063.731] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x46 [0063.731] WriteFile (in: hFile=0x158, lpBuffer=0x37bfb60*, nNumberOfBytesToWrite=0x623, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x37bfb60*, lpNumberOfBytesWritten=0x18de10*=0x623, lpOverlapped=0x0) returned 1 [0063.731] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x669 [0063.731] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0063.732] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0063.732] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0063.732] SetFilePointer (in: hFile=0x158, lDistanceToMove=11, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x29 [0063.732] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x673 [0063.732] CloseHandle (hObject=0x11c) returned 1 [0063.732] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x673 [0063.732] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x673 [0063.732] SetFilePointer (in: hFile=0x158, lDistanceToMove=1651, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x673 [0063.732] SetFilePointer (in: hFile=0x158, lDistanceToMove=1651, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x673 [0063.732] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x673 [0063.732] SetFilePointer (in: hFile=0x158, lDistanceToMove=1651, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x673 [0063.732] SetEndOfFile (hFile=0x158) returned 1 [0063.732] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x673 [0063.732] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x673 [0063.733] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0063.733] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe410c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0063.733] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0063.733] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe41ac, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0063.733] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe41ac, cbMultiByte=11, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="PREVIEW.GIF\x18ꞗ@涤(\x18믉`믑`") returned 11 [0063.733] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0063.733] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x1fe410c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x0) returned 11 [0063.733] WriteFile (in: hFile=0x158, lpBuffer=0x37a2fa8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x37a2fa8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0063.733] CharToOemA (in: pSrc="PREVIEW.GIF", pDst=0x1fe41ac | out: pDst="PREVIEW.GIF") returned 1 [0063.733] WriteFile (in: hFile=0x158, lpBuffer=0x1fe41ac*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe41ac*, lpNumberOfBytesWritten=0x18efcc*=0xb, lpOverlapped=0x0) returned 1 [0063.733] WriteFile (in: hFile=0x158, lpBuffer=0x379acf8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379acf8*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0063.733] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0063.733] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0063.733] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x6b7 [0063.733] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x6b7 [0063.734] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0063.734] WriteFile (in: hFile=0x158, lpBuffer=0x35f011c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f011c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0063.734] DeleteFileW (lpFileName="") returned 0 [0063.734] GetLastError () returned 0x3 [0063.734] GetFileAttributesW (lpFileName="") returned 0xffffffff [0063.734] SetLastError (dwErrCode=0x3) [0063.734] FlushFileBuffers (hFile=0x158) returned 1 [0063.736] GetCurrentThreadId () returned 0x970 [0063.736] GetCurrentThreadId () returned 0x970 [0063.736] GetCurrentThreadId () returned 0x970 [0063.736] GetCurrentThreadId () returned 0x970 [0063.736] GetCurrentThreadId () returned 0x970 [0063.736] GetCurrentThreadId () returned 0x970 [0063.736] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x76e [0063.736] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x76e [0063.736] SetFilePointer (in: hFile=0x158, lDistanceToMove=1902, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x76e [0063.736] CloseHandle (hObject=0x158) returned 1 [0063.736] GetCurrentThreadId () returned 0x970 [0063.736] GetCurrentThreadId () returned 0x970 [0063.736] GetCurrentThreadId () returned 0x970 [0063.737] GetCurrentThreadId () returned 0x970 [0063.737] GetCurrentThreadId () returned 0x970 [0063.737] GetCurrentThreadId () returned 0x970 [0063.737] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\Файл зашифрован [PREVIEW.GIF].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\Файл зашифрован [preview.gif].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0063.737] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x76e [0063.737] SetFilePointer (in: hFile=0x158, lDistanceToMove=1774, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6ee [0063.737] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0063.737] GetFileType (hFile=0x158) returned 0x1 [0063.737] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xb, wMilliseconds=0x3)) [0063.737] GetCurrentThreadId () returned 0x970 [0063.737] GetCurrentThreadId () returned 0x970 [0063.737] GetCurrentThreadId () returned 0x970 [0063.737] GetCurrentThreadId () returned 0x970 [0063.737] GetCurrentThreadId () returned 0x970 [0063.737] GetCurrentThreadId () returned 0x970 [0063.737] GetCurrentThreadId () returned 0x970 [0063.737] GetCurrentThreadId () returned 0x970 [0063.737] GetCurrentThreadId () returned 0x970 [0063.737] GetCurrentThreadId () returned 0x970 [0063.737] GetCurrentThreadId () returned 0x970 [0063.737] GetCurrentThreadId () returned 0x970 [0063.737] GetCurrentThreadId () returned 0x970 [0063.737] GetCurrentThreadId () returned 0x970 [0063.737] GetCurrentThreadId () returned 0x970 [0063.737] GetCurrentThreadId () returned 0x970 [0063.737] GetCurrentThreadId () returned 0x970 [0063.738] GetCurrentThreadId () returned 0x970 [0063.738] GetCurrentThreadId () returned 0x970 [0063.738] GetCurrentThreadId () returned 0x970 [0063.738] GetCurrentThreadId () returned 0x970 [0063.738] GetCurrentThreadId () returned 0x970 [0063.738] GetCurrentThreadId () returned 0x970 [0063.738] GetCurrentThreadId () returned 0x970 [0063.738] GetCurrentThreadId () returned 0x970 [0063.738] GetCurrentThreadId () returned 0x970 [0063.738] GetCurrentThreadId () returned 0x970 [0063.738] GetCurrentThreadId () returned 0x970 [0063.738] GetCurrentThreadId () returned 0x970 [0063.738] GetCurrentThreadId () returned 0x970 [0063.738] GetCurrentThreadId () returned 0x970 [0063.738] GetCurrentThreadId () returned 0x970 [0063.738] GetCurrentThreadId () returned 0x970 [0063.738] GetCurrentThreadId () returned 0x970 [0063.738] GetCurrentThreadId () returned 0x970 [0063.738] GetCurrentThreadId () returned 0x970 [0063.738] GetCurrentThreadId () returned 0x970 [0063.738] GetCurrentThreadId () returned 0x970 [0063.738] GetCurrentThreadId () returned 0x970 [0063.738] GetCurrentThreadId () returned 0x970 [0063.738] GetCurrentThreadId () returned 0x970 [0063.738] GetCurrentThreadId () returned 0x970 [0063.738] GetCurrentThreadId () returned 0x970 [0063.738] GetCurrentThreadId () returned 0x970 [0063.738] GetCurrentThreadId () returned 0x970 [0063.738] GetCurrentThreadId () returned 0x970 [0063.738] GetCurrentThreadId () returned 0x970 [0063.738] GetCurrentThreadId () returned 0x970 [0063.738] GetCurrentThreadId () returned 0x970 [0063.738] GetCurrentThreadId () returned 0x970 [0063.738] GetCurrentThreadId () returned 0x970 [0063.738] GetCurrentThreadId () returned 0x970 [0063.738] GetCurrentThreadId () returned 0x970 [0063.738] GetCurrentThreadId () returned 0x970 [0063.738] GetCurrentThreadId () returned 0x970 [0063.738] GetCurrentThreadId () returned 0x970 [0063.738] GetCurrentThreadId () returned 0x970 [0063.738] GetCurrentThreadId () returned 0x970 [0063.738] GetCurrentThreadId () returned 0x970 [0063.738] GetCurrentThreadId () returned 0x970 [0063.738] GetCurrentThreadId () returned 0x970 [0063.738] GetCurrentThreadId () returned 0x970 [0063.738] GetCurrentThreadId () returned 0x970 [0063.738] GetCurrentThreadId () returned 0x970 [0063.739] GetCurrentThreadId () returned 0x970 [0063.739] GetCurrentThreadId () returned 0x970 [0063.739] GetCurrentThreadId () returned 0x970 [0063.739] GetCurrentThreadId () returned 0x970 [0063.739] GetCurrentThreadId () returned 0x970 [0063.739] GetCurrentThreadId () returned 0x970 [0063.739] GetCurrentThreadId () returned 0x970 [0063.739] GetCurrentThreadId () returned 0x970 [0063.739] GetCurrentThreadId () returned 0x970 [0063.739] GetCurrentThreadId () returned 0x970 [0063.739] GetCurrentThreadId () returned 0x970 [0063.739] GetCurrentThreadId () returned 0x970 [0063.739] GetCurrentThreadId () returned 0x970 [0063.739] GetCurrentThreadId () returned 0x970 [0063.739] GetCurrentThreadId () returned 0x970 [0063.739] GetCurrentThreadId () returned 0x970 [0063.739] GetCurrentThreadId () returned 0x970 [0063.739] GetCurrentThreadId () returned 0x970 [0063.739] GetCurrentThreadId () returned 0x970 [0063.739] GetCurrentThreadId () returned 0x970 [0063.739] GetCurrentThreadId () returned 0x970 [0063.739] GetCurrentThreadId () returned 0x970 [0063.739] GetCurrentThreadId () returned 0x970 [0063.739] GetCurrentThreadId () returned 0x970 [0063.739] GetCurrentThreadId () returned 0x970 [0063.739] GetCurrentThreadId () returned 0x970 [0063.739] GetCurrentThreadId () returned 0x970 [0063.739] GetCurrentThreadId () returned 0x970 [0063.739] GetCurrentThreadId () returned 0x970 [0063.739] GetCurrentThreadId () returned 0x970 [0063.739] GetCurrentThreadId () returned 0x970 [0063.739] GetCurrentThreadId () returned 0x970 [0063.739] GetCurrentThreadId () returned 0x970 [0063.739] GetCurrentThreadId () returned 0x970 [0063.739] GetCurrentThreadId () returned 0x970 [0063.739] GetCurrentThreadId () returned 0x970 [0063.739] GetCurrentThreadId () returned 0x970 [0063.739] GetCurrentThreadId () returned 0x970 [0063.739] GetCurrentThreadId () returned 0x970 [0063.739] GetCurrentThreadId () returned 0x970 [0063.739] GetCurrentThreadId () returned 0x970 [0063.739] GetCurrentThreadId () returned 0x970 [0063.739] GetCurrentThreadId () returned 0x970 [0063.739] GetCurrentThreadId () returned 0x970 [0063.740] GetCurrentThreadId () returned 0x970 [0063.740] GetCurrentThreadId () returned 0x970 [0063.740] GetCurrentThreadId () returned 0x970 [0063.740] GetCurrentThreadId () returned 0x970 [0063.740] GetCurrentThreadId () returned 0x970 [0063.740] GetCurrentThreadId () returned 0x970 [0063.740] GetCurrentThreadId () returned 0x970 [0063.740] GetCurrentThreadId () returned 0x970 [0063.740] GetCurrentThreadId () returned 0x970 [0063.740] GetCurrentThreadId () returned 0x970 [0063.740] GetCurrentThreadId () returned 0x970 [0063.740] GetCurrentThreadId () returned 0x970 [0063.740] GetCurrentThreadId () returned 0x970 [0063.740] GetCurrentThreadId () returned 0x970 [0063.740] GetCurrentThreadId () returned 0x970 [0063.740] GetCurrentThreadId () returned 0x970 [0063.740] GetCurrentThreadId () returned 0x970 [0063.740] GetCurrentThreadId () returned 0x970 [0063.740] GetCurrentThreadId () returned 0x970 [0063.740] GetCurrentThreadId () returned 0x970 [0063.740] GetCurrentThreadId () returned 0x970 [0063.740] GetCurrentThreadId () returned 0x970 [0063.740] GetCurrentThreadId () returned 0x970 [0063.740] GetCurrentThreadId () returned 0x970 [0063.740] GetCurrentThreadId () returned 0x970 [0063.740] GetCurrentThreadId () returned 0x970 [0063.740] GetCurrentThreadId () returned 0x970 [0063.740] GetCurrentThreadId () returned 0x970 [0063.740] GetCurrentThreadId () returned 0x970 [0063.740] GetCurrentThreadId () returned 0x970 [0063.740] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.740] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.740] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379eea8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0063.740] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.740] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.740] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379eea8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0063.740] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.740] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.740] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379eed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0063.740] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.740] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.741] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379eed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0063.741] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.741] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.741] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379ef08, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0063.741] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.741] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.741] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379ef08, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0063.741] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.741] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.741] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379ef08, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0063.741] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xb, wMilliseconds=0x13)) [0063.741] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr=")UVSr\"NBNdz6oxcbZ6>%U3LZnt.p2B:o", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0063.741] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr=")UVSr\"NBNdz6oxcbZ6>%U3LZnt.p2B:o", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0063.741] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr=")UVSr\"NBNdz6oxcbZ6>%U3LZnt.p2B:o", cchWideChar=32, lpMultiByteStr=0x20024e8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=")UVSr\"NBNdz6oxcbZ6>%U3LZnt.p2B:o", lpUsedDefaultChar=0x0) returned 32 [0063.741] GetCurrentThreadId () returned 0x970 [0063.741] GetCurrentThreadId () returned 0x970 [0063.741] GetCurrentThreadId () returned 0x970 [0063.741] GetCurrentThreadId () returned 0x970 [0063.741] GetCurrentThreadId () returned 0x970 [0063.741] GetCurrentThreadId () returned 0x970 [0063.748] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0063.749] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0063.749] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3796908, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0063.749] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0063.749] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAExBLInZ+TCQYX+LzlCFl9ZngZH4TUw6Y6rpf7g/2h3/9avXPnvf9bdq5FN7eXH411UQpXi3Y15kii1BmrI4Q1Tly8ofdMDMBUZY3zR07is0/k4DimoTXzcsoQ8obTySVNeG1hIWKWQSsRd7rjbGE3GqjKJjA72OSAIDycO2hyZz0Pxn5Wk/BwUwTvS1PqbRhXixJiKrEAFdxCKctJRDLhoTWJ3yiW5mRg==") returned 232 [0063.749] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xb, wMilliseconds=0x13)) [0063.749] GetCurrentThreadId () returned 0x970 [0063.749] GetCurrentThreadId () returned 0x970 [0063.749] GetCurrentThreadId () returned 0x970 [0063.749] GetCurrentThreadId () returned 0x970 [0063.749] GetCurrentThreadId () returned 0x970 [0063.749] GetCurrentThreadId () returned 0x970 [0063.749] GetCurrentThreadId () returned 0x970 [0063.749] GetCurrentThreadId () returned 0x970 [0063.749] GetCurrentThreadId () returned 0x970 [0063.749] GetCurrentThreadId () returned 0x970 [0063.749] GetCurrentThreadId () returned 0x970 [0063.749] GetCurrentThreadId () returned 0x970 [0063.749] GetCurrentThreadId () returned 0x970 [0063.749] GetCurrentThreadId () returned 0x970 [0063.749] GetCurrentThreadId () returned 0x970 [0063.749] GetCurrentThreadId () returned 0x970 [0063.749] GetCurrentThreadId () returned 0x970 [0063.749] GetCurrentThreadId () returned 0x970 [0063.749] GetCurrentThreadId () returned 0x970 [0063.749] GetCurrentThreadId () returned 0x970 [0063.749] GetCurrentThreadId () returned 0x970 [0063.749] GetCurrentThreadId () returned 0x970 [0063.749] GetCurrentThreadId () returned 0x970 [0063.749] GetCurrentThreadId () returned 0x970 [0063.749] GetCurrentThreadId () returned 0x970 [0063.749] GetCurrentThreadId () returned 0x970 [0063.749] GetCurrentThreadId () returned 0x970 [0063.749] GetCurrentThreadId () returned 0x970 [0063.749] GetCurrentThreadId () returned 0x970 [0063.749] GetCurrentThreadId () returned 0x970 [0063.749] GetCurrentThreadId () returned 0x970 [0063.749] GetCurrentThreadId () returned 0x970 [0063.749] GetCurrentThreadId () returned 0x970 [0063.749] GetCurrentThreadId () returned 0x970 [0063.749] GetCurrentThreadId () returned 0x970 [0063.749] GetCurrentThreadId () returned 0x970 [0063.749] GetCurrentThreadId () returned 0x970 [0063.749] GetCurrentThreadId () returned 0x970 [0063.750] GetCurrentThreadId () returned 0x970 [0063.750] GetCurrentThreadId () returned 0x970 [0063.750] GetCurrentThreadId () returned 0x970 [0063.750] GetCurrentThreadId () returned 0x970 [0063.750] GetCurrentThreadId () returned 0x970 [0063.750] GetCurrentThreadId () returned 0x970 [0063.750] GetCurrentThreadId () returned 0x970 [0063.750] GetCurrentThreadId () returned 0x970 [0063.750] GetCurrentThreadId () returned 0x970 [0063.750] GetCurrentThreadId () returned 0x970 [0063.750] GetCurrentThreadId () returned 0x970 [0063.750] GetCurrentThreadId () returned 0x970 [0063.750] GetCurrentThreadId () returned 0x970 [0063.750] GetCurrentThreadId () returned 0x970 [0063.750] GetCurrentThreadId () returned 0x970 [0063.750] GetCurrentThreadId () returned 0x970 [0063.750] GetCurrentThreadId () returned 0x970 [0063.750] GetCurrentThreadId () returned 0x970 [0063.750] GetCurrentThreadId () returned 0x970 [0063.750] GetCurrentThreadId () returned 0x970 [0063.750] GetCurrentThreadId () returned 0x970 [0063.750] GetCurrentThreadId () returned 0x970 [0063.750] GetCurrentThreadId () returned 0x970 [0063.750] GetCurrentThreadId () returned 0x970 [0063.750] GetCurrentThreadId () returned 0x970 [0063.750] GetCurrentThreadId () returned 0x970 [0063.750] GetCurrentThreadId () returned 0x970 [0063.750] GetCurrentThreadId () returned 0x970 [0063.750] GetCurrentThreadId () returned 0x970 [0063.750] GetCurrentThreadId () returned 0x970 [0063.750] GetCurrentThreadId () returned 0x970 [0063.750] GetCurrentThreadId () returned 0x970 [0063.750] GetCurrentThreadId () returned 0x970 [0063.750] GetCurrentThreadId () returned 0x970 [0063.750] GetCurrentThreadId () returned 0x970 [0063.750] GetCurrentThreadId () returned 0x970 [0063.750] GetCurrentThreadId () returned 0x970 [0063.750] GetCurrentThreadId () returned 0x970 [0063.750] GetCurrentThreadId () returned 0x970 [0063.750] GetCurrentThreadId () returned 0x970 [0063.750] GetCurrentThreadId () returned 0x970 [0063.750] GetCurrentThreadId () returned 0x970 [0063.750] GetCurrentThreadId () returned 0x970 [0063.750] GetCurrentThreadId () returned 0x970 [0063.750] GetCurrentThreadId () returned 0x970 [0063.750] GetCurrentThreadId () returned 0x970 [0063.751] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAExBLInZ+TCQYX+LzlCFl9ZngZH4TUw6Y6rpf7g/2h3/9avXPnvf9bdq5FN7eXH411UQpXi3Y15kii1BmrI4Q1Tly8ofdMDMBUZY3zR07is0/k4DimoTXzcsoQ8obTySVNeG1hIWKWQSsRd7rjbGE3GqjKJjA72OSAIDycO2hyZz0Pxn5Wk/BwUwTvS1PqbRhXixJiKrEAFdxCKctJRDLhoTWJ3yiW5mRg==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0063.751] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAExBLInZ+TCQYX+LzlCFl9ZngZH4TUw6Y6rpf7g/2h3/9avXPnvf9bdq5FN7eXH411UQpXi3Y15kii1BmrI4Q1Tly8ofdMDMBUZY3zR07is0/k4DimoTXzcsoQ8obTySVNeG1hIWKWQSsRd7rjbGE3GqjKJjA72OSAIDycO2hyZz0Pxn5Wk/BwUwTvS1PqbRhXixJiKrEAFdxCKctJRDLhoTWJ3yiW5mRg==", cchWideChar=245, lpMultiByteStr=0x353933c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAExBLInZ+TCQYX+LzlCFl9ZngZH4TUw6Y6rpf7g/2h3/9avXPnvf9bdq5FN7eXH411UQpXi3Y15kii1BmrI4Q1Tly8ofdMDMBUZY3zR07is0/k4DimoTXzcsoQ8obTySVNeG1hIWKWQSsRd7rjbGE3GqjKJjA72OSAIDycO2hyZz0Pxn5Wk/BwUwTvS1PqbRhXixJiKrEAFdxCKctJRDLhoTWJ3yiW5mRg==", lpUsedDefaultChar=0x0) returned 245 [0063.751] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0063.751] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0063.751] CloseHandle (hObject=0x158) returned 1 [0063.751] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif")) returned 1 [0063.752] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=18401556845) returned 1 [0063.752] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\Файл зашифрован [THMBNAIL.PNG].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\Файл зашифрован [thmbnail.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0063.753] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0063.753] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0063.753] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0063.753] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0063.753] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0063.753] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0063.753] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0063.753] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0063.753] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0063.753] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0063.753] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0063.753] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0063.753] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0063.753] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0063.753] SetEndOfFile (hFile=0x158) returned 1 [0063.754] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0063.754] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0063.754] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0063.754] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0063.754] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0063.755] WriteFile (in: hFile=0x158, lpBuffer=0x35f01dc*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f01dc*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0063.755] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6Bb15(-Y)1T>Prt2T9~+$G0\\d}SUMmIm", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0063.755] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6Bb15(-Y)1T>Prt2T9~+$G0\\d}SUMmIm", cchWideChar=32, lpMultiByteStr=0x2035edc, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6Bb15(-Y)1T>Prt2T9~+$G0\\d}SUMmIm", lpUsedDefaultChar=0x0) returned 32 [0063.755] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0063.755] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0063.755] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x75da, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0x295098 [0063.755] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0063.755] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0063.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png")) returned 0x20 [0063.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png")) returned 0x20 [0063.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png")) returned 0x20 [0063.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png")) returned 0x20 [0063.757] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x75da)) returned 1 [0063.757] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0063.757] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0063.757] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png")) returned 0x20 [0063.757] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png")) returned 0x20 [0063.757] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0063.757] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0063.757] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0063.757] SetEndOfFile (hFile=0x158) returned 1 [0063.758] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0063.758] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe370c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0063.758] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0063.758] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe42ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0063.758] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe42ec, cbMultiByte=12, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="THMBNAIL.PNGer.gifg") returned 12 [0063.758] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0063.758] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe370c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0063.758] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0063.758] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0063.759] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x75da [0063.759] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0063.759] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0063.759] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0063.759] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0063.759] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe370c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0063.759] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0063.759] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe42ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0063.759] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe42ec, cbMultiByte=12, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="THMBNAIL.PNGIL.PNGer.gifg") returned 12 [0063.759] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0063.759] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe370c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0063.759] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0063.760] CharToOemA (in: pSrc="THMBNAIL.PNG", pDst=0x1fe42ec | out: pDst="THMBNAIL.PNG") returned 1 [0063.760] WriteFile (in: hFile=0x158, lpBuffer=0x1fe42ec*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe42ec*, lpNumberOfBytesWritten=0x18e048*=0xc, lpOverlapped=0x0) returned 1 [0063.760] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0063.760] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0063.760] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0063.760] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=18402380049) returned 1 [0063.760] ReadFile (in: hFile=0x11c, lpBuffer=0x37bf4d0, nNumberOfBytesToRead=0x75da, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37bf4d0*, lpNumberOfBytesRead=0x18dd7c*=0x75da, lpOverlapped=0x0) returned 1 [0063.762] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0063.762] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=18402581887) returned 1 [0063.771] WriteFile (in: hFile=0x158, lpBuffer=0x379adf8*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379adf8*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0063.771] ReadFile (in: hFile=0x11c, lpBuffer=0x37bf4d0, nNumberOfBytesToRead=0x75da, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x37bf4d0*, lpNumberOfBytesRead=0x18de38*=0x75da, lpOverlapped=0x0) returned 1 [0063.772] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x47 [0063.772] WriteFile (in: hFile=0x158, lpBuffer=0x38082f0*, nNumberOfBytesToWrite=0x75da, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x38082f0*, lpNumberOfBytesWritten=0x18de10*=0x75da, lpOverlapped=0x0) returned 1 [0063.773] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x7621 [0063.773] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0063.773] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0063.773] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0063.773] SetFilePointer (in: hFile=0x158, lDistanceToMove=12, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2a [0063.773] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x762b [0063.773] CloseHandle (hObject=0x11c) returned 1 [0063.773] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x762b [0063.773] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x762b [0063.773] SetFilePointer (in: hFile=0x158, lDistanceToMove=30251, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x762b [0063.773] SetFilePointer (in: hFile=0x158, lDistanceToMove=30251, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x762b [0063.773] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x762b [0063.773] SetFilePointer (in: hFile=0x158, lDistanceToMove=30251, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x762b [0063.774] SetEndOfFile (hFile=0x158) returned 1 [0063.774] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x762b [0063.774] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x762b [0063.774] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0063.774] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe370c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0063.774] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0063.774] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe37ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0063.774] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe37ec, cbMultiByte=12, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="THMBNAIL.PNGꞗ@涤(\x18믉`믑`") returned 12 [0063.774] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0063.774] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x1fe370c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x0) returned 12 [0063.774] WriteFile (in: hFile=0x158, lpBuffer=0x37a2fa8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x37a2fa8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0063.774] CharToOemA (in: pSrc="THMBNAIL.PNG", pDst=0x1fe37ec | out: pDst="THMBNAIL.PNG") returned 1 [0063.774] WriteFile (in: hFile=0x158, lpBuffer=0x1fe37ec*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe37ec*, lpNumberOfBytesWritten=0x18efcc*=0xc, lpOverlapped=0x0) returned 1 [0063.774] WriteFile (in: hFile=0x158, lpBuffer=0x379ad58*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379ad58*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0063.774] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0063.775] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0063.775] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x7670 [0063.775] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x7670 [0063.775] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0063.775] WriteFile (in: hFile=0x158, lpBuffer=0x35f01dc*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f01dc*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0063.775] DeleteFileW (lpFileName="") returned 0 [0063.775] GetLastError () returned 0x3 [0063.775] GetFileAttributesW (lpFileName="") returned 0xffffffff [0063.775] SetLastError (dwErrCode=0x3) [0063.775] FlushFileBuffers (hFile=0x158) returned 1 [0063.777] GetCurrentThreadId () returned 0x970 [0063.777] GetCurrentThreadId () returned 0x970 [0063.778] GetCurrentThreadId () returned 0x970 [0063.778] GetCurrentThreadId () returned 0x970 [0063.778] GetCurrentThreadId () returned 0x970 [0063.778] GetCurrentThreadId () returned 0x970 [0063.778] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x7727 [0063.778] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x7727 [0063.778] SetFilePointer (in: hFile=0x158, lDistanceToMove=30503, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x7727 [0063.778] CloseHandle (hObject=0x158) returned 1 [0063.778] GetCurrentThreadId () returned 0x970 [0063.778] GetCurrentThreadId () returned 0x970 [0063.778] GetCurrentThreadId () returned 0x970 [0063.778] GetCurrentThreadId () returned 0x970 [0063.778] GetCurrentThreadId () returned 0x970 [0063.778] GetCurrentThreadId () returned 0x970 [0063.778] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\Файл зашифрован [THMBNAIL.PNG].wannacash .zip" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\Файл зашифрован [thmbnail.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0063.778] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7727 [0063.778] SetFilePointer (in: hFile=0x158, lDistanceToMove=30375, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x76a7 [0063.778] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0063.778] GetFileType (hFile=0x158) returned 0x1 [0063.778] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xb, wMilliseconds=0x32)) [0063.778] GetCurrentThreadId () returned 0x970 [0063.778] GetCurrentThreadId () returned 0x970 [0063.779] GetCurrentThreadId () returned 0x970 [0063.779] GetCurrentThreadId () returned 0x970 [0063.779] GetCurrentThreadId () returned 0x970 [0063.779] GetCurrentThreadId () returned 0x970 [0063.779] GetCurrentThreadId () returned 0x970 [0063.779] GetCurrentThreadId () returned 0x970 [0063.779] GetCurrentThreadId () returned 0x970 [0063.779] GetCurrentThreadId () returned 0x970 [0063.779] GetCurrentThreadId () returned 0x970 [0063.779] GetCurrentThreadId () returned 0x970 [0063.779] GetCurrentThreadId () returned 0x970 [0063.779] GetCurrentThreadId () returned 0x970 [0063.779] GetCurrentThreadId () returned 0x970 [0063.779] GetCurrentThreadId () returned 0x970 [0063.779] GetCurrentThreadId () returned 0x970 [0063.779] GetCurrentThreadId () returned 0x970 [0063.779] GetCurrentThreadId () returned 0x970 [0063.779] GetCurrentThreadId () returned 0x970 [0063.779] GetCurrentThreadId () returned 0x970 [0063.779] GetCurrentThreadId () returned 0x970 [0063.779] GetCurrentThreadId () returned 0x970 [0063.779] GetCurrentThreadId () returned 0x970 [0063.779] GetCurrentThreadId () returned 0x970 [0063.779] GetCurrentThreadId () returned 0x970 [0063.779] GetCurrentThreadId () returned 0x970 [0063.779] GetCurrentThreadId () returned 0x970 [0063.779] GetCurrentThreadId () returned 0x970 [0063.779] GetCurrentThreadId () returned 0x970 [0063.779] GetCurrentThreadId () returned 0x970 [0063.779] GetCurrentThreadId () returned 0x970 [0063.779] GetCurrentThreadId () returned 0x970 [0063.779] GetCurrentThreadId () returned 0x970 [0063.779] GetCurrentThreadId () returned 0x970 [0063.779] GetCurrentThreadId () returned 0x970 [0063.779] GetCurrentThreadId () returned 0x970 [0063.779] GetCurrentThreadId () returned 0x970 [0063.779] GetCurrentThreadId () returned 0x970 [0063.779] GetCurrentThreadId () returned 0x970 [0063.779] GetCurrentThreadId () returned 0x970 [0063.779] GetCurrentThreadId () returned 0x970 [0063.779] GetCurrentThreadId () returned 0x970 [0063.779] GetCurrentThreadId () returned 0x970 [0063.779] GetCurrentThreadId () returned 0x970 [0063.779] GetCurrentThreadId () returned 0x970 [0063.779] GetCurrentThreadId () returned 0x970 [0063.779] GetCurrentThreadId () returned 0x970 [0063.780] GetCurrentThreadId () returned 0x970 [0063.780] GetCurrentThreadId () returned 0x970 [0063.780] GetCurrentThreadId () returned 0x970 [0063.780] GetCurrentThreadId () returned 0x970 [0063.780] GetCurrentThreadId () returned 0x970 [0063.780] GetCurrentThreadId () returned 0x970 [0063.780] GetCurrentThreadId () returned 0x970 [0063.780] GetCurrentThreadId () returned 0x970 [0063.780] GetCurrentThreadId () returned 0x970 [0063.780] GetCurrentThreadId () returned 0x970 [0063.780] GetCurrentThreadId () returned 0x970 [0063.780] GetCurrentThreadId () returned 0x970 [0063.780] GetCurrentThreadId () returned 0x970 [0063.780] GetCurrentThreadId () returned 0x970 [0063.780] GetCurrentThreadId () returned 0x970 [0063.780] GetCurrentThreadId () returned 0x970 [0063.780] GetCurrentThreadId () returned 0x970 [0063.780] GetCurrentThreadId () returned 0x970 [0063.780] GetCurrentThreadId () returned 0x970 [0063.780] GetCurrentThreadId () returned 0x970 [0063.780] GetCurrentThreadId () returned 0x970 [0063.780] GetCurrentThreadId () returned 0x970 [0063.780] GetCurrentThreadId () returned 0x970 [0063.780] GetCurrentThreadId () returned 0x970 [0063.780] GetCurrentThreadId () returned 0x970 [0063.780] GetCurrentThreadId () returned 0x970 [0063.780] GetCurrentThreadId () returned 0x970 [0063.780] GetCurrentThreadId () returned 0x970 [0063.780] GetCurrentThreadId () returned 0x970 [0063.780] GetCurrentThreadId () returned 0x970 [0063.780] GetCurrentThreadId () returned 0x970 [0063.780] GetCurrentThreadId () returned 0x970 [0063.780] GetCurrentThreadId () returned 0x970 [0063.780] GetCurrentThreadId () returned 0x970 [0063.780] GetCurrentThreadId () returned 0x970 [0063.780] GetCurrentThreadId () returned 0x970 [0063.780] GetCurrentThreadId () returned 0x970 [0063.780] GetCurrentThreadId () returned 0x970 [0063.780] GetCurrentThreadId () returned 0x970 [0063.780] GetCurrentThreadId () returned 0x970 [0063.780] GetCurrentThreadId () returned 0x970 [0063.780] GetCurrentThreadId () returned 0x970 [0063.780] GetCurrentThreadId () returned 0x970 [0063.780] GetCurrentThreadId () returned 0x970 [0063.780] GetCurrentThreadId () returned 0x970 [0063.780] GetCurrentThreadId () returned 0x970 [0063.781] GetCurrentThreadId () returned 0x970 [0063.781] GetCurrentThreadId () returned 0x970 [0063.781] GetCurrentThreadId () returned 0x970 [0063.781] GetCurrentThreadId () returned 0x970 [0063.781] GetCurrentThreadId () returned 0x970 [0063.781] GetCurrentThreadId () returned 0x970 [0063.781] GetCurrentThreadId () returned 0x970 [0063.781] GetCurrentThreadId () returned 0x970 [0063.781] GetCurrentThreadId () returned 0x970 [0063.781] GetCurrentThreadId () returned 0x970 [0063.781] GetCurrentThreadId () returned 0x970 [0063.781] GetCurrentThreadId () returned 0x970 [0063.781] GetCurrentThreadId () returned 0x970 [0063.781] GetCurrentThreadId () returned 0x970 [0063.781] GetCurrentThreadId () returned 0x970 [0063.781] GetCurrentThreadId () returned 0x970 [0063.781] GetCurrentThreadId () returned 0x970 [0063.781] GetCurrentThreadId () returned 0x970 [0063.781] GetCurrentThreadId () returned 0x970 [0063.781] GetCurrentThreadId () returned 0x970 [0063.781] GetCurrentThreadId () returned 0x970 [0063.781] GetCurrentThreadId () returned 0x970 [0063.781] GetCurrentThreadId () returned 0x970 [0063.781] GetCurrentThreadId () returned 0x970 [0063.781] GetCurrentThreadId () returned 0x970 [0063.781] GetCurrentThreadId () returned 0x970 [0063.781] GetCurrentThreadId () returned 0x970 [0063.781] GetCurrentThreadId () returned 0x970 [0063.781] GetCurrentThreadId () returned 0x970 [0063.781] GetCurrentThreadId () returned 0x970 [0063.781] GetCurrentThreadId () returned 0x970 [0063.781] GetCurrentThreadId () returned 0x970 [0063.781] GetCurrentThreadId () returned 0x970 [0063.781] GetCurrentThreadId () returned 0x970 [0063.781] GetCurrentThreadId () returned 0x970 [0063.781] GetCurrentThreadId () returned 0x970 [0063.781] GetCurrentThreadId () returned 0x970 [0063.781] GetCurrentThreadId () returned 0x970 [0063.781] GetCurrentThreadId () returned 0x970 [0063.781] GetCurrentThreadId () returned 0x970 [0063.781] GetCurrentThreadId () returned 0x970 [0063.781] GetCurrentThreadId () returned 0x970 [0063.781] GetCurrentThreadId () returned 0x970 [0063.781] GetCurrentThreadId () returned 0x970 [0063.782] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.782] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.782] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aea8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0063.782] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.782] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.782] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aea8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0063.782] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.782] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.782] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0063.782] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.782] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.782] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0063.782] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.782] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.782] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379af08, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0063.782] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.782] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.782] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379af08, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0063.782] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.782] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.782] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379af08, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0063.782] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xb, wMilliseconds=0x32)) [0063.782] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="6Bb15(-Y)1T>Prt2T9~+$G0\\d}SUMmIm", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0063.782] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="6Bb15(-Y)1T>Prt2T9~+$G0\\d}SUMmIm", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0063.782] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="6Bb15(-Y)1T>Prt2T9~+$G0\\d}SUMmIm", cchWideChar=32, lpMultiByteStr=0x20035f8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6Bb15(-Y)1T>Prt2T9~+$G0\\d}SUMmIm", lpUsedDefaultChar=0x0) returned 32 [0063.782] GetCurrentThreadId () returned 0x970 [0063.782] GetCurrentThreadId () returned 0x970 [0063.782] GetCurrentThreadId () returned 0x970 [0063.782] GetCurrentThreadId () returned 0x970 [0063.782] GetCurrentThreadId () returned 0x970 [0063.782] GetCurrentThreadId () returned 0x970 [0063.790] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0063.790] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0063.790] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x37969f8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0063.790] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0063.790] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAH59wMB8MhcYUMqEu0jOj9eq2e0zruFcec/pROAdtZYZ2q9+J8Oy3QClndxVxqTyC5+TamLf16DfZLFdV+pjAKUuhWauMXX43njnuwo6cUMbWsjGZ0myehE66K9CU6le3vz4HYdrLII0hus5jFCfHFMhi6oAIb1HcxcxgYqyT08ZGH9aDKgb5ORTupsV70TOqpAW2pgLI0dH/kroxD51w4PwBWNiFOvfxw==") returned 232 [0063.790] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xb, wMilliseconds=0x42)) [0063.790] GetCurrentThreadId () returned 0x970 [0063.790] GetCurrentThreadId () returned 0x970 [0063.790] GetCurrentThreadId () returned 0x970 [0063.790] GetCurrentThreadId () returned 0x970 [0063.790] GetCurrentThreadId () returned 0x970 [0063.790] GetCurrentThreadId () returned 0x970 [0063.790] GetCurrentThreadId () returned 0x970 [0063.790] GetCurrentThreadId () returned 0x970 [0063.790] GetCurrentThreadId () returned 0x970 [0063.790] GetCurrentThreadId () returned 0x970 [0063.790] GetCurrentThreadId () returned 0x970 [0063.790] GetCurrentThreadId () returned 0x970 [0063.790] GetCurrentThreadId () returned 0x970 [0063.790] GetCurrentThreadId () returned 0x970 [0063.790] GetCurrentThreadId () returned 0x970 [0063.790] GetCurrentThreadId () returned 0x970 [0063.790] GetCurrentThreadId () returned 0x970 [0063.790] GetCurrentThreadId () returned 0x970 [0063.790] GetCurrentThreadId () returned 0x970 [0063.790] GetCurrentThreadId () returned 0x970 [0063.790] GetCurrentThreadId () returned 0x970 [0063.791] GetCurrentThreadId () returned 0x970 [0063.791] GetCurrentThreadId () returned 0x970 [0063.791] GetCurrentThreadId () returned 0x970 [0063.791] GetCurrentThreadId () returned 0x970 [0063.791] GetCurrentThreadId () returned 0x970 [0063.791] GetCurrentThreadId () returned 0x970 [0063.791] GetCurrentThreadId () returned 0x970 [0063.791] GetCurrentThreadId () returned 0x970 [0063.791] GetCurrentThreadId () returned 0x970 [0063.791] GetCurrentThreadId () returned 0x970 [0063.791] GetCurrentThreadId () returned 0x970 [0063.791] GetCurrentThreadId () returned 0x970 [0063.791] GetCurrentThreadId () returned 0x970 [0063.791] GetCurrentThreadId () returned 0x970 [0063.791] GetCurrentThreadId () returned 0x970 [0063.791] GetCurrentThreadId () returned 0x970 [0063.791] GetCurrentThreadId () returned 0x970 [0063.791] GetCurrentThreadId () returned 0x970 [0063.791] GetCurrentThreadId () returned 0x970 [0063.791] GetCurrentThreadId () returned 0x970 [0063.791] GetCurrentThreadId () returned 0x970 [0063.791] GetCurrentThreadId () returned 0x970 [0063.791] GetCurrentThreadId () returned 0x970 [0063.791] GetCurrentThreadId () returned 0x970 [0063.791] GetCurrentThreadId () returned 0x970 [0063.791] GetCurrentThreadId () returned 0x970 [0063.791] GetCurrentThreadId () returned 0x970 [0063.791] GetCurrentThreadId () returned 0x970 [0063.791] GetCurrentThreadId () returned 0x970 [0063.791] GetCurrentThreadId () returned 0x970 [0063.791] GetCurrentThreadId () returned 0x970 [0063.791] GetCurrentThreadId () returned 0x970 [0063.791] GetCurrentThreadId () returned 0x970 [0063.791] GetCurrentThreadId () returned 0x970 [0063.791] GetCurrentThreadId () returned 0x970 [0063.791] GetCurrentThreadId () returned 0x970 [0063.791] GetCurrentThreadId () returned 0x970 [0063.791] GetCurrentThreadId () returned 0x970 [0063.791] GetCurrentThreadId () returned 0x970 [0063.791] GetCurrentThreadId () returned 0x970 [0063.791] GetCurrentThreadId () returned 0x970 [0063.791] GetCurrentThreadId () returned 0x970 [0063.791] GetCurrentThreadId () returned 0x970 [0063.791] GetCurrentThreadId () returned 0x970 [0063.794] GetCurrentThreadId () returned 0x970 [0063.794] GetCurrentThreadId () returned 0x970 [0063.794] GetCurrentThreadId () returned 0x970 [0063.794] GetCurrentThreadId () returned 0x970 [0063.794] GetCurrentThreadId () returned 0x970 [0063.794] GetCurrentThreadId () returned 0x970 [0063.794] GetCurrentThreadId () returned 0x970 [0063.794] GetCurrentThreadId () returned 0x970 [0063.794] GetCurrentThreadId () returned 0x970 [0063.794] GetCurrentThreadId () returned 0x970 [0063.794] GetCurrentThreadId () returned 0x970 [0063.794] GetCurrentThreadId () returned 0x970 [0063.794] GetCurrentThreadId () returned 0x970 [0063.794] GetCurrentThreadId () returned 0x970 [0063.794] GetCurrentThreadId () returned 0x970 [0063.794] GetCurrentThreadId () returned 0x970 [0063.794] GetCurrentThreadId () returned 0x970 [0063.794] GetCurrentThreadId () returned 0x970 [0063.794] GetCurrentThreadId () returned 0x970 [0063.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAH59wMB8MhcYUMqEu0jOj9eq2e0zruFcec/pROAdtZYZ2q9+J8Oy3QClndxVxqTyC5+TamLf16DfZLFdV+pjAKUuhWauMXX43njnuwo6cUMbWsjGZ0myehE66K9CU6le3vz4HYdrLII0hus5jFCfHFMhi6oAIb1HcxcxgYqyT08ZGH9aDKgb5ORTupsV70TOqpAW2pgLI0dH/kroxD51w4PwBWNiFOvfxw==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0063.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAH59wMB8MhcYUMqEu0jOj9eq2e0zruFcec/pROAdtZYZ2q9+J8Oy3QClndxVxqTyC5+TamLf16DfZLFdV+pjAKUuhWauMXX43njnuwo6cUMbWsjGZ0myehE66K9CU6le3vz4HYdrLII0hus5jFCfHFMhi6oAIb1HcxcxgYqyT08ZGH9aDKgb5ORTupsV70TOqpAW2pgLI0dH/kroxD51w4PwBWNiFOvfxw==", cchWideChar=245, lpMultiByteStr=0x353933c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAH59wMB8MhcYUMqEu0jOj9eq2e0zruFcec/pROAdtZYZ2q9+J8Oy3QClndxVxqTyC5+TamLf16DfZLFdV+pjAKUuhWauMXX43njnuwo6cUMbWsjGZ0myehE66K9CU6le3vz4HYdrLII0hus5jFCfHFMhi6oAIb1HcxcxgYqyT08ZGH9aDKgb5ORTupsV70TOqpAW2pgLI0dH/kroxD51w4PwBWNiFOvfxw==", lpUsedDefaultChar=0x0) returned 245 [0063.795] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0063.795] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0063.795] CloseHandle (hObject=0x158) returned 1 [0063.795] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png")) returned 1 [0063.796] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=18405957354) returned 1 [0063.796] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Services\\Файл зашифрован [verisign.bmp].wannacash .zip" (normalized: "c:\\program files\\common files\\services\\Файл зашифрован [verisign.bmp].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0063.797] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0063.797] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0063.797] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0063.797] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0063.797] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0063.797] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0063.797] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0063.797] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0063.797] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0063.797] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0063.797] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0063.797] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0063.798] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0063.798] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0063.798] SetEndOfFile (hFile=0x158) returned 1 [0063.798] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0063.798] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0063.798] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0063.798] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0063.798] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0063.799] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0063.799] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=":w$&z+E5CCHF:nhJ=~pL1\"ChgtWaW,(b", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0063.799] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=":w$&z+E5CCHF:nhJ=~pL1\"ChgtWaW,(b", cchWideChar=32, lpMultiByteStr=0x2035f14, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=":w$&z+E5CCHF:nhJ=~pL1\"ChgtWaW,(b", lpUsedDefaultChar=0x0) returned 32 [0063.799] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0063.799] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0063.799] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafbfd139, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0xafbfd139, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0xafbfd139, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="verisign.bmp", cAlternateFileName="")) returned 0x295098 [0063.799] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0063.799] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0063.799] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp")) returned 0x20 [0063.800] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp")) returned 0x20 [0063.801] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp")) returned 0x20 [0063.801] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp")) returned 0x20 [0063.801] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafbfd139, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0xafbfd139, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0xafbfd139, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa8e)) returned 1 [0063.801] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0063.801] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0063.801] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp")) returned 0x20 [0063.801] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp")) returned 0x20 [0063.801] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0063.801] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0063.801] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0063.801] SetEndOfFile (hFile=0x158) returned 1 [0063.804] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="verisign.bmp", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0063.804] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="verisign.bmp", cchWideChar=12, lpMultiByteStr=0x1fe35cc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="verisign.bmp", lpUsedDefaultChar=0x0) returned 12 [0063.804] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="verisign.bmp", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0063.804] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="verisign.bmp", cchWideChar=12, lpMultiByteStr=0x1fe354c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="verisign.bmp", lpUsedDefaultChar=0x0) returned 12 [0063.804] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe354c, cbMultiByte=12, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="verisign.bmper.gifg") returned 12 [0063.805] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="verisign.bmp", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0063.805] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="verisign.bmp", cchWideChar=12, lpMultiByteStr=0x1fe35cc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="verisign.bmp", lpUsedDefaultChar=0x0) returned 12 [0063.805] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0063.805] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0063.805] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0xa8e [0063.805] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0063.805] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0063.805] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0063.805] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="verisign.bmp", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0063.805] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="verisign.bmp", cchWideChar=12, lpMultiByteStr=0x1fe35cc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="verisign.bmp", lpUsedDefaultChar=0x0) returned 12 [0063.805] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="verisign.bmp", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0063.805] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="verisign.bmp", cchWideChar=12, lpMultiByteStr=0x1fe354c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="verisign.bmp", lpUsedDefaultChar=0x0) returned 12 [0063.805] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe354c, cbMultiByte=12, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="verisign.bmpgn.bmper.gifg") returned 12 [0063.805] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="verisign.bmp", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0063.805] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="verisign.bmp", cchWideChar=12, lpMultiByteStr=0x1fe35cc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="verisign.bmp", lpUsedDefaultChar=0x0) returned 12 [0063.806] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0063.806] CharToOemA (in: pSrc="verisign.bmp", pDst=0x1fe354c | out: pDst="verisign.bmp") returned 1 [0063.806] WriteFile (in: hFile=0x158, lpBuffer=0x1fe354c*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe354c*, lpNumberOfBytesWritten=0x18e048*=0xc, lpOverlapped=0x0) returned 1 [0063.807] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0063.807] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0063.807] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0063.807] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=18407027359) returned 1 [0063.807] ReadFile (in: hFile=0x11c, lpBuffer=0x37bf4d0, nNumberOfBytesToRead=0xa8e, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37bf4d0*, lpNumberOfBytesRead=0x18dd7c*=0xa8e, lpOverlapped=0x0) returned 1 [0063.808] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0063.808] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=18407190130) returned 1 [0063.817] WriteFile (in: hFile=0x158, lpBuffer=0x379ade0*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379ade0*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0063.817] ReadFile (in: hFile=0x11c, lpBuffer=0x37bf4d0, nNumberOfBytesToRead=0xa8e, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x37bf4d0*, lpNumberOfBytesRead=0x18de38*=0xa8e, lpOverlapped=0x0) returned 1 [0063.817] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x47 [0063.817] WriteFile (in: hFile=0x158, lpBuffer=0x38017f0*, nNumberOfBytesToWrite=0xa8e, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x38017f0*, lpNumberOfBytesWritten=0x18de10*=0xa8e, lpOverlapped=0x0) returned 1 [0063.818] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0xad5 [0063.818] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0063.818] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0063.818] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0063.818] SetFilePointer (in: hFile=0x158, lDistanceToMove=12, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2a [0063.818] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0xadf [0063.818] CloseHandle (hObject=0x11c) returned 1 [0063.819] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xadf [0063.819] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xadf [0063.819] SetFilePointer (in: hFile=0x158, lDistanceToMove=2783, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xadf [0063.819] SetFilePointer (in: hFile=0x158, lDistanceToMove=2783, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0xadf [0063.819] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xadf [0063.819] SetFilePointer (in: hFile=0x158, lDistanceToMove=2783, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0xadf [0063.819] SetEndOfFile (hFile=0x158) returned 1 [0063.819] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xadf [0063.819] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xadf [0063.819] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="verisign.bmp", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0063.819] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="verisign.bmp", cchWideChar=12, lpMultiByteStr=0x1fe35cc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="verisign.bmp", lpUsedDefaultChar=0x0) returned 12 [0063.819] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="verisign.bmp", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0063.819] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="verisign.bmp", cchWideChar=12, lpMultiByteStr=0x1fe41ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="verisign.bmp", lpUsedDefaultChar=0x0) returned 12 [0063.819] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe41ac, cbMultiByte=12, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="verisign.bmpꞗ@涤(\x18믉`믑`") returned 12 [0063.819] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="verisign.bmp", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0063.819] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="verisign.bmp", cchWideChar=12, lpMultiByteStr=0x1fe35cc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="verisign.bmp", lpUsedDefaultChar=0x0) returned 12 [0063.819] WriteFile (in: hFile=0x158, lpBuffer=0x37a2fa8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x37a2fa8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0063.820] CharToOemA (in: pSrc="verisign.bmp", pDst=0x1fe41ac | out: pDst="verisign.bmp") returned 1 [0063.820] WriteFile (in: hFile=0x158, lpBuffer=0x1fe41ac*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe41ac*, lpNumberOfBytesWritten=0x18efcc*=0xc, lpOverlapped=0x0) returned 1 [0063.820] WriteFile (in: hFile=0x158, lpBuffer=0x379ae18*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379ae18*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0063.820] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0063.820] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0063.820] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xb24 [0063.820] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xb24 [0063.820] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0063.820] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0063.820] DeleteFileW (lpFileName="") returned 0 [0063.820] GetLastError () returned 0x3 [0063.820] GetFileAttributesW (lpFileName="") returned 0xffffffff [0063.820] SetLastError (dwErrCode=0x3) [0063.820] FlushFileBuffers (hFile=0x158) returned 1 [0063.823] GetCurrentThreadId () returned 0x970 [0063.823] GetCurrentThreadId () returned 0x970 [0063.823] GetCurrentThreadId () returned 0x970 [0063.823] GetCurrentThreadId () returned 0x970 [0063.823] GetCurrentThreadId () returned 0x970 [0063.823] GetCurrentThreadId () returned 0x970 [0063.823] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xbdb [0063.824] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xbdb [0063.824] SetFilePointer (in: hFile=0x158, lDistanceToMove=3035, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xbdb [0063.824] CloseHandle (hObject=0x158) returned 1 [0063.824] GetCurrentThreadId () returned 0x970 [0063.824] GetCurrentThreadId () returned 0x970 [0063.824] GetCurrentThreadId () returned 0x970 [0063.824] GetCurrentThreadId () returned 0x970 [0063.824] GetCurrentThreadId () returned 0x970 [0063.824] GetCurrentThreadId () returned 0x970 [0063.824] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Services\\Файл зашифрован [verisign.bmp].wannacash .zip" (normalized: "c:\\program files\\common files\\services\\Файл зашифрован [verisign.bmp].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0063.824] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbdb [0063.824] SetFilePointer (in: hFile=0x158, lDistanceToMove=2907, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb5b [0063.824] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0063.824] GetFileType (hFile=0x158) returned 0x1 [0063.824] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xb, wMilliseconds=0x61)) [0063.824] GetCurrentThreadId () returned 0x970 [0063.824] GetCurrentThreadId () returned 0x970 [0063.824] GetCurrentThreadId () returned 0x970 [0063.824] GetCurrentThreadId () returned 0x970 [0063.824] GetCurrentThreadId () returned 0x970 [0063.824] GetCurrentThreadId () returned 0x970 [0063.824] GetCurrentThreadId () returned 0x970 [0063.824] GetCurrentThreadId () returned 0x970 [0063.824] GetCurrentThreadId () returned 0x970 [0063.824] GetCurrentThreadId () returned 0x970 [0063.825] GetCurrentThreadId () returned 0x970 [0063.825] GetCurrentThreadId () returned 0x970 [0063.825] GetCurrentThreadId () returned 0x970 [0063.825] GetCurrentThreadId () returned 0x970 [0063.825] GetCurrentThreadId () returned 0x970 [0063.825] GetCurrentThreadId () returned 0x970 [0063.825] GetCurrentThreadId () returned 0x970 [0063.825] GetCurrentThreadId () returned 0x970 [0063.825] GetCurrentThreadId () returned 0x970 [0063.825] GetCurrentThreadId () returned 0x970 [0063.825] GetCurrentThreadId () returned 0x970 [0063.825] GetCurrentThreadId () returned 0x970 [0063.825] GetCurrentThreadId () returned 0x970 [0063.825] GetCurrentThreadId () returned 0x970 [0063.825] GetCurrentThreadId () returned 0x970 [0063.825] GetCurrentThreadId () returned 0x970 [0063.825] GetCurrentThreadId () returned 0x970 [0063.825] GetCurrentThreadId () returned 0x970 [0063.825] GetCurrentThreadId () returned 0x970 [0063.825] GetCurrentThreadId () returned 0x970 [0063.825] GetCurrentThreadId () returned 0x970 [0063.825] GetCurrentThreadId () returned 0x970 [0063.825] GetCurrentThreadId () returned 0x970 [0063.825] GetCurrentThreadId () returned 0x970 [0063.825] GetCurrentThreadId () returned 0x970 [0063.825] GetCurrentThreadId () returned 0x970 [0063.825] GetCurrentThreadId () returned 0x970 [0063.825] GetCurrentThreadId () returned 0x970 [0063.825] GetCurrentThreadId () returned 0x970 [0063.825] GetCurrentThreadId () returned 0x970 [0063.825] GetCurrentThreadId () returned 0x970 [0063.825] GetCurrentThreadId () returned 0x970 [0063.825] GetCurrentThreadId () returned 0x970 [0063.825] GetCurrentThreadId () returned 0x970 [0063.825] GetCurrentThreadId () returned 0x970 [0063.825] GetCurrentThreadId () returned 0x970 [0063.825] GetCurrentThreadId () returned 0x970 [0063.825] GetCurrentThreadId () returned 0x970 [0063.825] GetCurrentThreadId () returned 0x970 [0063.825] GetCurrentThreadId () returned 0x970 [0063.825] GetCurrentThreadId () returned 0x970 [0063.825] GetCurrentThreadId () returned 0x970 [0063.825] GetCurrentThreadId () returned 0x970 [0063.825] GetCurrentThreadId () returned 0x970 [0063.825] GetCurrentThreadId () returned 0x970 [0063.825] GetCurrentThreadId () returned 0x970 [0063.826] GetCurrentThreadId () returned 0x970 [0063.826] GetCurrentThreadId () returned 0x970 [0063.826] GetCurrentThreadId () returned 0x970 [0063.826] GetCurrentThreadId () returned 0x970 [0063.826] GetCurrentThreadId () returned 0x970 [0063.826] GetCurrentThreadId () returned 0x970 [0063.826] GetCurrentThreadId () returned 0x970 [0063.826] GetCurrentThreadId () returned 0x970 [0063.826] GetCurrentThreadId () returned 0x970 [0063.826] GetCurrentThreadId () returned 0x970 [0063.826] GetCurrentThreadId () returned 0x970 [0063.826] GetCurrentThreadId () returned 0x970 [0063.826] GetCurrentThreadId () returned 0x970 [0063.826] GetCurrentThreadId () returned 0x970 [0063.826] GetCurrentThreadId () returned 0x970 [0063.826] GetCurrentThreadId () returned 0x970 [0063.826] GetCurrentThreadId () returned 0x970 [0063.826] GetCurrentThreadId () returned 0x970 [0063.826] GetCurrentThreadId () returned 0x970 [0063.826] GetCurrentThreadId () returned 0x970 [0063.826] GetCurrentThreadId () returned 0x970 [0063.826] GetCurrentThreadId () returned 0x970 [0063.826] GetCurrentThreadId () returned 0x970 [0063.826] GetCurrentThreadId () returned 0x970 [0063.826] GetCurrentThreadId () returned 0x970 [0063.826] GetCurrentThreadId () returned 0x970 [0063.826] GetCurrentThreadId () returned 0x970 [0063.826] GetCurrentThreadId () returned 0x970 [0063.826] GetCurrentThreadId () returned 0x970 [0063.826] GetCurrentThreadId () returned 0x970 [0063.826] GetCurrentThreadId () returned 0x970 [0063.826] GetCurrentThreadId () returned 0x970 [0063.826] GetCurrentThreadId () returned 0x970 [0063.826] GetCurrentThreadId () returned 0x970 [0063.826] GetCurrentThreadId () returned 0x970 [0063.826] GetCurrentThreadId () returned 0x970 [0063.826] GetCurrentThreadId () returned 0x970 [0063.826] GetCurrentThreadId () returned 0x970 [0063.826] GetCurrentThreadId () returned 0x970 [0063.826] GetCurrentThreadId () returned 0x970 [0063.826] GetCurrentThreadId () returned 0x970 [0063.826] GetCurrentThreadId () returned 0x970 [0063.826] GetCurrentThreadId () returned 0x970 [0063.826] GetCurrentThreadId () returned 0x970 [0063.826] GetCurrentThreadId () returned 0x970 [0063.826] GetCurrentThreadId () returned 0x970 [0063.827] GetCurrentThreadId () returned 0x970 [0063.827] GetCurrentThreadId () returned 0x970 [0063.827] GetCurrentThreadId () returned 0x970 [0063.827] GetCurrentThreadId () returned 0x970 [0063.827] GetCurrentThreadId () returned 0x970 [0063.827] GetCurrentThreadId () returned 0x970 [0063.827] GetCurrentThreadId () returned 0x970 [0063.827] GetCurrentThreadId () returned 0x970 [0063.827] GetCurrentThreadId () returned 0x970 [0063.827] GetCurrentThreadId () returned 0x970 [0063.827] GetCurrentThreadId () returned 0x970 [0063.827] GetCurrentThreadId () returned 0x970 [0063.827] GetCurrentThreadId () returned 0x970 [0063.827] GetCurrentThreadId () returned 0x970 [0063.827] GetCurrentThreadId () returned 0x970 [0063.827] GetCurrentThreadId () returned 0x970 [0063.827] GetCurrentThreadId () returned 0x970 [0063.827] GetCurrentThreadId () returned 0x970 [0063.827] GetCurrentThreadId () returned 0x970 [0063.827] GetCurrentThreadId () returned 0x970 [0063.827] GetCurrentThreadId () returned 0x970 [0063.827] GetCurrentThreadId () returned 0x970 [0063.827] GetCurrentThreadId () returned 0x970 [0063.827] GetCurrentThreadId () returned 0x970 [0063.827] GetCurrentThreadId () returned 0x970 [0063.827] GetCurrentThreadId () returned 0x970 [0063.827] GetCurrentThreadId () returned 0x970 [0063.827] GetCurrentThreadId () returned 0x970 [0063.827] GetCurrentThreadId () returned 0x970 [0063.827] GetCurrentThreadId () returned 0x970 [0063.827] GetCurrentThreadId () returned 0x970 [0063.827] GetCurrentThreadId () returned 0x970 [0063.827] GetCurrentThreadId () returned 0x970 [0063.827] GetCurrentThreadId () returned 0x970 [0063.827] GetCurrentThreadId () returned 0x970 [0063.827] GetCurrentThreadId () returned 0x970 [0063.827] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.827] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.827] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379af08, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0063.827] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.827] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.827] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379af08, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0063.827] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.828] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.828] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0063.828] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.828] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.828] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0063.828] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.828] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.828] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379af98, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0063.828] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.828] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.828] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379af98, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0063.828] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.828] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.828] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379af98, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0063.828] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xb, wMilliseconds=0x61)) [0063.828] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr=":w$&z+E5CCHF:nhJ=~pL1\"ChgtWaW,(b", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0063.828] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr=":w$&z+E5CCHF:nhJ=~pL1\"ChgtWaW,(b", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0063.828] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr=":w$&z+E5CCHF:nhJ=~pL1\"ChgtWaW,(b", cchWideChar=32, lpMultiByteStr=0x2003628, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=":w$&z+E5CCHF:nhJ=~pL1\"ChgtWaW,(b", lpUsedDefaultChar=0x0) returned 32 [0063.828] GetCurrentThreadId () returned 0x970 [0063.828] GetCurrentThreadId () returned 0x970 [0063.828] GetCurrentThreadId () returned 0x970 [0063.828] GetCurrentThreadId () returned 0x970 [0063.828] GetCurrentThreadId () returned 0x970 [0063.828] GetCurrentThreadId () returned 0x970 [0063.836] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0063.836] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0063.836] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3796ae8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0063.836] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0063.836] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAHCQvk73JeMQ0iFlvJ7vsLskdkjA5oa/Sz45tSo5N0YrPGaZWJEAQeAWeCE/WhL9DzXaTosAU9wbJLIcoUbZjBAaiHk5VL0HQBkzPI5+dc5NfQvCHAgqI1M8mV50b9EzE/FYa3Hl7oFgxbsyNSu5kZA9xGN/pteod0BM4ILiKBoi2wpiem1OqdtHed0UtVmst5f0OGacdRwUx7ln14Sv5kHj/YsmC63dew==") returned 232 [0063.836] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xb, wMilliseconds=0x70)) [0063.836] GetCurrentThreadId () returned 0x970 [0063.836] GetCurrentThreadId () returned 0x970 [0063.836] GetCurrentThreadId () returned 0x970 [0063.836] GetCurrentThreadId () returned 0x970 [0063.836] GetCurrentThreadId () returned 0x970 [0063.836] GetCurrentThreadId () returned 0x970 [0063.836] GetCurrentThreadId () returned 0x970 [0063.836] GetCurrentThreadId () returned 0x970 [0063.836] GetCurrentThreadId () returned 0x970 [0063.836] GetCurrentThreadId () returned 0x970 [0063.836] GetCurrentThreadId () returned 0x970 [0063.836] GetCurrentThreadId () returned 0x970 [0063.836] GetCurrentThreadId () returned 0x970 [0063.836] GetCurrentThreadId () returned 0x970 [0063.836] GetCurrentThreadId () returned 0x970 [0063.836] GetCurrentThreadId () returned 0x970 [0063.836] GetCurrentThreadId () returned 0x970 [0063.836] GetCurrentThreadId () returned 0x970 [0063.836] GetCurrentThreadId () returned 0x970 [0063.836] GetCurrentThreadId () returned 0x970 [0063.836] GetCurrentThreadId () returned 0x970 [0063.836] GetCurrentThreadId () returned 0x970 [0063.836] GetCurrentThreadId () returned 0x970 [0063.836] GetCurrentThreadId () returned 0x970 [0063.836] GetCurrentThreadId () returned 0x970 [0063.836] GetCurrentThreadId () returned 0x970 [0063.836] GetCurrentThreadId () returned 0x970 [0063.836] GetCurrentThreadId () returned 0x970 [0063.836] GetCurrentThreadId () returned 0x970 [0063.836] GetCurrentThreadId () returned 0x970 [0063.836] GetCurrentThreadId () returned 0x970 [0063.836] GetCurrentThreadId () returned 0x970 [0063.836] GetCurrentThreadId () returned 0x970 [0063.837] GetCurrentThreadId () returned 0x970 [0063.837] GetCurrentThreadId () returned 0x970 [0063.837] GetCurrentThreadId () returned 0x970 [0063.837] GetCurrentThreadId () returned 0x970 [0063.837] GetCurrentThreadId () returned 0x970 [0063.837] GetCurrentThreadId () returned 0x970 [0063.837] GetCurrentThreadId () returned 0x970 [0063.837] GetCurrentThreadId () returned 0x970 [0063.837] GetCurrentThreadId () returned 0x970 [0063.837] GetCurrentThreadId () returned 0x970 [0063.837] GetCurrentThreadId () returned 0x970 [0063.837] GetCurrentThreadId () returned 0x970 [0063.837] GetCurrentThreadId () returned 0x970 [0063.837] GetCurrentThreadId () returned 0x970 [0063.837] GetCurrentThreadId () returned 0x970 [0063.837] GetCurrentThreadId () returned 0x970 [0063.837] GetCurrentThreadId () returned 0x970 [0063.837] GetCurrentThreadId () returned 0x970 [0063.837] GetCurrentThreadId () returned 0x970 [0063.837] GetCurrentThreadId () returned 0x970 [0063.837] GetCurrentThreadId () returned 0x970 [0063.837] GetCurrentThreadId () returned 0x970 [0063.837] GetCurrentThreadId () returned 0x970 [0063.837] GetCurrentThreadId () returned 0x970 [0063.837] GetCurrentThreadId () returned 0x970 [0063.837] GetCurrentThreadId () returned 0x970 [0063.837] GetCurrentThreadId () returned 0x970 [0063.837] GetCurrentThreadId () returned 0x970 [0063.837] GetCurrentThreadId () returned 0x970 [0063.837] GetCurrentThreadId () returned 0x970 [0063.837] GetCurrentThreadId () returned 0x970 [0063.837] GetCurrentThreadId () returned 0x970 [0063.837] GetCurrentThreadId () returned 0x970 [0063.837] GetCurrentThreadId () returned 0x970 [0063.837] GetCurrentThreadId () returned 0x970 [0063.837] GetCurrentThreadId () returned 0x970 [0063.837] GetCurrentThreadId () returned 0x970 [0063.837] GetCurrentThreadId () returned 0x970 [0063.837] GetCurrentThreadId () returned 0x970 [0063.837] GetCurrentThreadId () returned 0x970 [0063.837] GetCurrentThreadId () returned 0x970 [0063.837] GetCurrentThreadId () returned 0x970 [0063.837] GetCurrentThreadId () returned 0x970 [0063.837] GetCurrentThreadId () returned 0x970 [0063.837] GetCurrentThreadId () returned 0x970 [0063.838] GetCurrentThreadId () returned 0x970 [0063.838] GetCurrentThreadId () returned 0x970 [0063.838] GetCurrentThreadId () returned 0x970 [0063.838] GetCurrentThreadId () returned 0x970 [0063.838] GetCurrentThreadId () returned 0x970 [0063.838] GetCurrentThreadId () returned 0x970 [0063.838] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAHCQvk73JeMQ0iFlvJ7vsLskdkjA5oa/Sz45tSo5N0YrPGaZWJEAQeAWeCE/WhL9DzXaTosAU9wbJLIcoUbZjBAaiHk5VL0HQBkzPI5+dc5NfQvCHAgqI1M8mV50b9EzE/FYa3Hl7oFgxbsyNSu5kZA9xGN/pteod0BM4ILiKBoi2wpiem1OqdtHed0UtVmst5f0OGacdRwUx7ln14Sv5kHj/YsmC63dew==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0063.838] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAHCQvk73JeMQ0iFlvJ7vsLskdkjA5oa/Sz45tSo5N0YrPGaZWJEAQeAWeCE/WhL9DzXaTosAU9wbJLIcoUbZjBAaiHk5VL0HQBkzPI5+dc5NfQvCHAgqI1M8mV50b9EzE/FYa3Hl7oFgxbsyNSu5kZA9xGN/pteod0BM4ILiKBoi2wpiem1OqdtHed0UtVmst5f0OGacdRwUx7ln14Sv5kHj/YsmC63dew==", cchWideChar=245, lpMultiByteStr=0x353933c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAHCQvk73JeMQ0iFlvJ7vsLskdkjA5oa/Sz45tSo5N0YrPGaZWJEAQeAWeCE/WhL9DzXaTosAU9wbJLIcoUbZjBAaiHk5VL0HQBkzPI5+dc5NfQvCHAgqI1M8mV50b9EzE/FYa3Hl7oFgxbsyNSu5kZA9xGN/pteod0BM4ILiKBoi2wpiem1OqdtHed0UtVmst5f0OGacdRwUx7ln14Sv5kHj/YsmC63dew==", lpUsedDefaultChar=0x0) returned 245 [0063.838] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0063.838] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0063.838] CloseHandle (hObject=0x158) returned 1 [0063.838] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp")) returned 1 [0063.838] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=18410181073) returned 1 [0063.838] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\Файл зашифрован [DissolveAnother.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\Файл зашифрован [dissolveanother.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0063.839] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0063.839] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0063.839] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0063.839] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0063.839] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0063.839] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0063.839] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0063.839] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0063.839] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0063.839] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0063.840] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0063.840] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0063.840] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0063.840] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0063.840] SetEndOfFile (hFile=0x158) returned 1 [0063.840] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0063.840] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0063.840] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0063.840] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0063.840] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0063.841] WriteFile (in: hFile=0x158, lpBuffer=0x35f035c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f035c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0063.841] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r\\0AZ}#GW7ZGxm*!9Q(K4(?gVuHnqdST", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0063.841] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r\\0AZ}#GW7ZGxm*!9Q(K4(?gVuHnqdST", cchWideChar=32, lpMultiByteStr=0x2035fbc, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="r\\0AZ}#GW7ZGxm*!9Q(K4(?gVuHnqdST", lpUsedDefaultChar=0x0) returned 32 [0063.841] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0063.841] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0063.841] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93d12cc5, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93d12cc5, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x6895ae5b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6d1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="DissolveAnother.png", cAlternateFileName="")) returned 0x295098 [0063.842] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0063.842] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0063.842] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png")) returned 0x20 [0063.842] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png")) returned 0x20 [0063.842] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png")) returned 0x20 [0063.843] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png")) returned 0x20 [0063.843] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93d12cc5, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93d12cc5, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x6895ae5b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6d1f)) returned 1 [0063.843] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0063.843] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0063.843] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png")) returned 0x20 [0063.843] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png")) returned 0x20 [0063.843] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0063.843] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0063.843] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0063.843] SetEndOfFile (hFile=0x158) returned 1 [0063.844] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DissolveAnother.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0063.844] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DissolveAnother.png", cchWideChar=19, lpMultiByteStr=0x1ff88fc, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DissolveAnother.png", lpUsedDefaultChar=0x0) returned 19 [0063.844] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DissolveAnother.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0063.844] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DissolveAnother.png", cchWideChar=19, lpMultiByteStr=0x1ff89ec, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DissolveAnother.png", lpUsedDefaultChar=0x0) returned 19 [0063.844] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff89ec, cbMultiByte=19, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="DissolveAnother.png") returned 19 [0063.844] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DissolveAnother.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0063.844] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DissolveAnother.png", cchWideChar=19, lpMultiByteStr=0x1ff88fc, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DissolveAnother.png", lpUsedDefaultChar=0x0) returned 19 [0063.844] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0063.844] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0063.844] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x6d1f [0063.845] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0063.845] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0063.845] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0063.845] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DissolveAnother.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0063.845] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DissolveAnother.png", cchWideChar=19, lpMultiByteStr=0x1ff88fc, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DissolveAnother.png", lpUsedDefaultChar=0x0) returned 19 [0063.845] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DissolveAnother.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0063.845] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DissolveAnother.png", cchWideChar=19, lpMultiByteStr=0x1ff89ec, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DissolveAnother.png", lpUsedDefaultChar=0x0) returned 19 [0063.845] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff89ec, cbMultiByte=19, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="DissolveAnother.pnger.png") returned 19 [0063.845] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DissolveAnother.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0063.845] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DissolveAnother.png", cchWideChar=19, lpMultiByteStr=0x1ff88fc, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DissolveAnother.png", lpUsedDefaultChar=0x0) returned 19 [0063.845] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0063.846] CharToOemA (in: pSrc="DissolveAnother.png", pDst=0x1ff89ec | out: pDst="DissolveAnother.png") returned 1 [0063.846] WriteFile (in: hFile=0x158, lpBuffer=0x1ff89ec*, nNumberOfBytesToWrite=0x13, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1ff89ec*, lpNumberOfBytesWritten=0x18e048*=0x13, lpOverlapped=0x0) returned 1 [0063.846] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0063.846] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0063.846] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0063.846] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=18410992621) returned 1 [0063.847] ReadFile (in: hFile=0x11c, lpBuffer=0x37bf4d0, nNumberOfBytesToRead=0x6d1f, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37bf4d0*, lpNumberOfBytesRead=0x18dd7c*=0x6d1f, lpOverlapped=0x0) returned 1 [0063.848] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0063.848] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=18411182843) returned 1 [0063.865] WriteFile (in: hFile=0x158, lpBuffer=0x379adc8*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379adc8*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0063.866] ReadFile (in: hFile=0x11c, lpBuffer=0x37bf4d0, nNumberOfBytesToRead=0x6d1f, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x37bf4d0*, lpNumberOfBytesRead=0x18de38*=0x6d1f, lpOverlapped=0x0) returned 1 [0063.866] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x4e [0063.867] WriteFile (in: hFile=0x158, lpBuffer=0x38079f0*, nNumberOfBytesToWrite=0x6d1f, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x38079f0*, lpNumberOfBytesWritten=0x18de10*=0x6d1f, lpOverlapped=0x0) returned 1 [0063.867] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x6d6d [0063.867] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0063.867] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0063.867] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0063.867] SetFilePointer (in: hFile=0x158, lDistanceToMove=19, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x31 [0063.867] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x6d77 [0063.868] CloseHandle (hObject=0x11c) returned 1 [0063.868] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x6d77 [0063.868] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x6d77 [0063.868] SetFilePointer (in: hFile=0x158, lDistanceToMove=28023, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x6d77 [0063.868] SetFilePointer (in: hFile=0x158, lDistanceToMove=28023, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x6d77 [0063.868] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x6d77 [0063.868] SetFilePointer (in: hFile=0x158, lDistanceToMove=28023, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x6d77 [0063.868] SetEndOfFile (hFile=0x158) returned 1 [0063.868] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x6d77 [0063.868] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x6d77 [0063.868] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DissolveAnother.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0063.868] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DissolveAnother.png", cchWideChar=19, lpMultiByteStr=0x1ff89ec, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DissolveAnother.png", lpUsedDefaultChar=0x0) returned 19 [0063.868] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DissolveAnother.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0063.868] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DissolveAnother.png", cchWideChar=19, lpMultiByteStr=0x1ff88fc, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DissolveAnother.png", lpUsedDefaultChar=0x0) returned 19 [0063.868] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff88fc, cbMultiByte=19, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="DissolveAnother.png`믑`") returned 19 [0063.868] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DissolveAnother.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0063.868] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DissolveAnother.png", cchWideChar=19, lpMultiByteStr=0x1ff89ec, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DissolveAnother.png", lpUsedDefaultChar=0x0) returned 19 [0063.869] WriteFile (in: hFile=0x158, lpBuffer=0x37a2fa8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x37a2fa8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0063.869] CharToOemA (in: pSrc="DissolveAnother.png", pDst=0x1ff88fc | out: pDst="DissolveAnother.png") returned 1 [0063.869] WriteFile (in: hFile=0x158, lpBuffer=0x1ff88fc*, nNumberOfBytesToWrite=0x13, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1ff88fc*, lpNumberOfBytesWritten=0x18efcc*=0x13, lpOverlapped=0x0) returned 1 [0063.869] WriteFile (in: hFile=0x158, lpBuffer=0x379acf8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379acf8*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0063.869] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0063.869] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0063.869] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x6dc3 [0063.869] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x6dc3 [0063.869] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0063.869] WriteFile (in: hFile=0x158, lpBuffer=0x35f035c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f035c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0063.869] DeleteFileW (lpFileName="") returned 0 [0063.869] GetLastError () returned 0x3 [0063.869] GetFileAttributesW (lpFileName="") returned 0xffffffff [0063.869] SetLastError (dwErrCode=0x3) [0063.869] FlushFileBuffers (hFile=0x158) returned 1 [0063.872] GetCurrentThreadId () returned 0x970 [0063.872] GetCurrentThreadId () returned 0x970 [0063.872] GetCurrentThreadId () returned 0x970 [0063.872] GetCurrentThreadId () returned 0x970 [0063.872] GetCurrentThreadId () returned 0x970 [0063.872] GetCurrentThreadId () returned 0x970 [0063.872] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x6e7a [0063.872] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x6e7a [0063.872] SetFilePointer (in: hFile=0x158, lDistanceToMove=28282, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x6e7a [0063.872] CloseHandle (hObject=0x158) returned 1 [0063.872] GetCurrentThreadId () returned 0x970 [0063.872] GetCurrentThreadId () returned 0x970 [0063.872] GetCurrentThreadId () returned 0x970 [0063.873] GetCurrentThreadId () returned 0x970 [0063.873] GetCurrentThreadId () returned 0x970 [0063.873] GetCurrentThreadId () returned 0x970 [0063.873] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\Файл зашифрован [DissolveAnother.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\Файл зашифрован [dissolveanother.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0063.873] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6e7a [0063.873] SetFilePointer (in: hFile=0x158, lDistanceToMove=28154, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6dfa [0063.873] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0063.873] GetFileType (hFile=0x158) returned 0x1 [0063.873] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xb, wMilliseconds=0x90)) [0063.873] GetCurrentThreadId () returned 0x970 [0063.873] GetCurrentThreadId () returned 0x970 [0063.873] GetCurrentThreadId () returned 0x970 [0063.873] GetCurrentThreadId () returned 0x970 [0063.873] GetCurrentThreadId () returned 0x970 [0063.873] GetCurrentThreadId () returned 0x970 [0063.873] GetCurrentThreadId () returned 0x970 [0063.873] GetCurrentThreadId () returned 0x970 [0063.873] GetCurrentThreadId () returned 0x970 [0063.873] GetCurrentThreadId () returned 0x970 [0063.873] GetCurrentThreadId () returned 0x970 [0063.873] GetCurrentThreadId () returned 0x970 [0063.873] GetCurrentThreadId () returned 0x970 [0063.873] GetCurrentThreadId () returned 0x970 [0063.873] GetCurrentThreadId () returned 0x970 [0063.873] GetCurrentThreadId () returned 0x970 [0063.873] GetCurrentThreadId () returned 0x970 [0063.873] GetCurrentThreadId () returned 0x970 [0063.873] GetCurrentThreadId () returned 0x970 [0063.873] GetCurrentThreadId () returned 0x970 [0063.873] GetCurrentThreadId () returned 0x970 [0063.874] GetCurrentThreadId () returned 0x970 [0063.874] GetCurrentThreadId () returned 0x970 [0063.874] GetCurrentThreadId () returned 0x970 [0063.874] GetCurrentThreadId () returned 0x970 [0063.874] GetCurrentThreadId () returned 0x970 [0063.874] GetCurrentThreadId () returned 0x970 [0063.874] GetCurrentThreadId () returned 0x970 [0063.874] GetCurrentThreadId () returned 0x970 [0063.874] GetCurrentThreadId () returned 0x970 [0063.874] GetCurrentThreadId () returned 0x970 [0063.874] GetCurrentThreadId () returned 0x970 [0063.874] GetCurrentThreadId () returned 0x970 [0063.874] GetCurrentThreadId () returned 0x970 [0063.874] GetCurrentThreadId () returned 0x970 [0063.874] GetCurrentThreadId () returned 0x970 [0063.874] GetCurrentThreadId () returned 0x970 [0063.874] GetCurrentThreadId () returned 0x970 [0063.874] GetCurrentThreadId () returned 0x970 [0063.874] GetCurrentThreadId () returned 0x970 [0063.874] GetCurrentThreadId () returned 0x970 [0063.874] GetCurrentThreadId () returned 0x970 [0063.874] GetCurrentThreadId () returned 0x970 [0063.874] GetCurrentThreadId () returned 0x970 [0063.874] GetCurrentThreadId () returned 0x970 [0063.874] GetCurrentThreadId () returned 0x970 [0063.874] GetCurrentThreadId () returned 0x970 [0063.874] GetCurrentThreadId () returned 0x970 [0063.874] GetCurrentThreadId () returned 0x970 [0063.874] GetCurrentThreadId () returned 0x970 [0063.874] GetCurrentThreadId () returned 0x970 [0063.874] GetCurrentThreadId () returned 0x970 [0063.874] GetCurrentThreadId () returned 0x970 [0063.874] GetCurrentThreadId () returned 0x970 [0063.874] GetCurrentThreadId () returned 0x970 [0063.874] GetCurrentThreadId () returned 0x970 [0063.874] GetCurrentThreadId () returned 0x970 [0063.874] GetCurrentThreadId () returned 0x970 [0063.874] GetCurrentThreadId () returned 0x970 [0063.874] GetCurrentThreadId () returned 0x970 [0063.874] GetCurrentThreadId () returned 0x970 [0063.874] GetCurrentThreadId () returned 0x970 [0063.874] GetCurrentThreadId () returned 0x970 [0063.874] GetCurrentThreadId () returned 0x970 [0063.874] GetCurrentThreadId () returned 0x970 [0063.874] GetCurrentThreadId () returned 0x970 [0063.874] GetCurrentThreadId () returned 0x970 [0063.875] GetCurrentThreadId () returned 0x970 [0063.875] GetCurrentThreadId () returned 0x970 [0063.875] GetCurrentThreadId () returned 0x970 [0063.875] GetCurrentThreadId () returned 0x970 [0063.875] GetCurrentThreadId () returned 0x970 [0063.875] GetCurrentThreadId () returned 0x970 [0063.875] GetCurrentThreadId () returned 0x970 [0063.875] GetCurrentThreadId () returned 0x970 [0063.875] GetCurrentThreadId () returned 0x970 [0063.875] GetCurrentThreadId () returned 0x970 [0063.875] GetCurrentThreadId () returned 0x970 [0063.875] GetCurrentThreadId () returned 0x970 [0063.875] GetCurrentThreadId () returned 0x970 [0063.875] GetCurrentThreadId () returned 0x970 [0063.875] GetCurrentThreadId () returned 0x970 [0063.875] GetCurrentThreadId () returned 0x970 [0063.875] GetCurrentThreadId () returned 0x970 [0063.875] GetCurrentThreadId () returned 0x970 [0063.875] GetCurrentThreadId () returned 0x970 [0063.875] GetCurrentThreadId () returned 0x970 [0063.875] GetCurrentThreadId () returned 0x970 [0063.875] GetCurrentThreadId () returned 0x970 [0063.875] GetCurrentThreadId () returned 0x970 [0063.875] GetCurrentThreadId () returned 0x970 [0063.875] GetCurrentThreadId () returned 0x970 [0063.875] GetCurrentThreadId () returned 0x970 [0063.875] GetCurrentThreadId () returned 0x970 [0063.875] GetCurrentThreadId () returned 0x970 [0063.875] GetCurrentThreadId () returned 0x970 [0063.875] GetCurrentThreadId () returned 0x970 [0063.875] GetCurrentThreadId () returned 0x970 [0063.875] GetCurrentThreadId () returned 0x970 [0063.875] GetCurrentThreadId () returned 0x970 [0063.875] GetCurrentThreadId () returned 0x970 [0063.875] GetCurrentThreadId () returned 0x970 [0063.875] GetCurrentThreadId () returned 0x970 [0063.875] GetCurrentThreadId () returned 0x970 [0063.875] GetCurrentThreadId () returned 0x970 [0063.875] GetCurrentThreadId () returned 0x970 [0063.875] GetCurrentThreadId () returned 0x970 [0063.875] GetCurrentThreadId () returned 0x970 [0063.875] GetCurrentThreadId () returned 0x970 [0063.875] GetCurrentThreadId () returned 0x970 [0063.875] GetCurrentThreadId () returned 0x970 [0063.875] GetCurrentThreadId () returned 0x970 [0063.876] GetCurrentThreadId () returned 0x970 [0063.876] GetCurrentThreadId () returned 0x970 [0063.876] GetCurrentThreadId () returned 0x970 [0063.876] GetCurrentThreadId () returned 0x970 [0063.876] GetCurrentThreadId () returned 0x970 [0063.876] GetCurrentThreadId () returned 0x970 [0063.876] GetCurrentThreadId () returned 0x970 [0063.876] GetCurrentThreadId () returned 0x970 [0063.876] GetCurrentThreadId () returned 0x970 [0063.876] GetCurrentThreadId () returned 0x970 [0063.876] GetCurrentThreadId () returned 0x970 [0063.876] GetCurrentThreadId () returned 0x970 [0063.876] GetCurrentThreadId () returned 0x970 [0063.876] GetCurrentThreadId () returned 0x970 [0063.876] GetCurrentThreadId () returned 0x970 [0063.876] GetCurrentThreadId () returned 0x970 [0063.876] GetCurrentThreadId () returned 0x970 [0063.876] GetCurrentThreadId () returned 0x970 [0063.876] GetCurrentThreadId () returned 0x970 [0063.876] GetCurrentThreadId () returned 0x970 [0063.876] GetCurrentThreadId () returned 0x970 [0063.876] GetCurrentThreadId () returned 0x970 [0063.876] GetCurrentThreadId () returned 0x970 [0063.876] GetCurrentThreadId () returned 0x970 [0063.876] GetCurrentThreadId () returned 0x970 [0063.876] GetCurrentThreadId () returned 0x970 [0063.876] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.876] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.876] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379af98, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0063.876] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.876] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.876] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379af98, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0063.876] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.876] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.876] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0063.876] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.876] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.876] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0063.876] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.876] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.877] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aff8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0063.877] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.877] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.877] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aff8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0063.877] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.877] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.877] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aff8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0063.877] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xb, wMilliseconds=0x90)) [0063.877] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="r\\0AZ}#GW7ZGxm*!9Q(K4(?gVuHnqdST", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0063.877] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="r\\0AZ}#GW7ZGxm*!9Q(K4(?gVuHnqdST", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0063.877] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="r\\0AZ}#GW7ZGxm*!9Q(K4(?gVuHnqdST", cchWideChar=32, lpMultiByteStr=0x2003568, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="r\\0AZ}#GW7ZGxm*!9Q(K4(?gVuHnqdST", lpUsedDefaultChar=0x0) returned 32 [0063.877] GetCurrentThreadId () returned 0x970 [0063.877] GetCurrentThreadId () returned 0x970 [0063.877] GetCurrentThreadId () returned 0x970 [0063.877] GetCurrentThreadId () returned 0x970 [0063.877] GetCurrentThreadId () returned 0x970 [0063.877] GetCurrentThreadId () returned 0x970 [0063.885] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0063.885] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0063.885] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3796bd8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0063.885] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0063.885] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAABsRCMAjeEVdQ4PWRv4PnFpmQam35yczwuW5+aNE8Ycu9j8gStHXlRgsOFSs9CwdEo1pHrStkcLb0mk9N7eyjs0nd0EdRz1s+H/ZW1SoubNkiE50IyFw7fg3RDH6g7sx/i9B2wNdZXSoFBoGjIvN/f+bFRJ7k1U/KMqpBhZc31p6G7+0yBOKQ6d/y0LJlZoPfanz14DNfAJ9sm6XtP/6uzDQCTV8/hSgpg==") returned 232 [0063.885] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xb, wMilliseconds=0x9f)) [0063.885] GetCurrentThreadId () returned 0x970 [0063.885] GetCurrentThreadId () returned 0x970 [0063.885] GetCurrentThreadId () returned 0x970 [0063.885] GetCurrentThreadId () returned 0x970 [0063.885] GetCurrentThreadId () returned 0x970 [0063.885] GetCurrentThreadId () returned 0x970 [0063.885] GetCurrentThreadId () returned 0x970 [0063.885] GetCurrentThreadId () returned 0x970 [0063.885] GetCurrentThreadId () returned 0x970 [0063.885] GetCurrentThreadId () returned 0x970 [0063.885] GetCurrentThreadId () returned 0x970 [0063.885] GetCurrentThreadId () returned 0x970 [0063.885] GetCurrentThreadId () returned 0x970 [0063.885] GetCurrentThreadId () returned 0x970 [0063.885] GetCurrentThreadId () returned 0x970 [0063.885] GetCurrentThreadId () returned 0x970 [0063.885] GetCurrentThreadId () returned 0x970 [0063.885] GetCurrentThreadId () returned 0x970 [0063.885] GetCurrentThreadId () returned 0x970 [0063.885] GetCurrentThreadId () returned 0x970 [0063.885] GetCurrentThreadId () returned 0x970 [0063.885] GetCurrentThreadId () returned 0x970 [0063.885] GetCurrentThreadId () returned 0x970 [0063.885] GetCurrentThreadId () returned 0x970 [0063.885] GetCurrentThreadId () returned 0x970 [0063.885] GetCurrentThreadId () returned 0x970 [0063.885] GetCurrentThreadId () returned 0x970 [0063.885] GetCurrentThreadId () returned 0x970 [0063.885] GetCurrentThreadId () returned 0x970 [0063.885] GetCurrentThreadId () returned 0x970 [0063.885] GetCurrentThreadId () returned 0x970 [0063.885] GetCurrentThreadId () returned 0x970 [0063.885] GetCurrentThreadId () returned 0x970 [0063.885] GetCurrentThreadId () returned 0x970 [0063.886] GetCurrentThreadId () returned 0x970 [0063.886] GetCurrentThreadId () returned 0x970 [0063.886] GetCurrentThreadId () returned 0x970 [0063.886] GetCurrentThreadId () returned 0x970 [0063.886] GetCurrentThreadId () returned 0x970 [0063.886] GetCurrentThreadId () returned 0x970 [0063.886] GetCurrentThreadId () returned 0x970 [0063.886] GetCurrentThreadId () returned 0x970 [0063.886] GetCurrentThreadId () returned 0x970 [0063.886] GetCurrentThreadId () returned 0x970 [0063.886] GetCurrentThreadId () returned 0x970 [0063.886] GetCurrentThreadId () returned 0x970 [0063.886] GetCurrentThreadId () returned 0x970 [0063.886] GetCurrentThreadId () returned 0x970 [0063.886] GetCurrentThreadId () returned 0x970 [0063.886] GetCurrentThreadId () returned 0x970 [0063.886] GetCurrentThreadId () returned 0x970 [0063.886] GetCurrentThreadId () returned 0x970 [0063.886] GetCurrentThreadId () returned 0x970 [0063.886] GetCurrentThreadId () returned 0x970 [0063.886] GetCurrentThreadId () returned 0x970 [0063.886] GetCurrentThreadId () returned 0x970 [0063.886] GetCurrentThreadId () returned 0x970 [0063.886] GetCurrentThreadId () returned 0x970 [0063.886] GetCurrentThreadId () returned 0x970 [0063.886] GetCurrentThreadId () returned 0x970 [0063.886] GetCurrentThreadId () returned 0x970 [0063.886] GetCurrentThreadId () returned 0x970 [0063.886] GetCurrentThreadId () returned 0x970 [0063.886] GetCurrentThreadId () returned 0x970 [0063.886] GetCurrentThreadId () returned 0x970 [0063.886] GetCurrentThreadId () returned 0x970 [0063.886] GetCurrentThreadId () returned 0x970 [0063.886] GetCurrentThreadId () returned 0x970 [0063.886] GetCurrentThreadId () returned 0x970 [0063.886] GetCurrentThreadId () returned 0x970 [0063.886] GetCurrentThreadId () returned 0x970 [0063.886] GetCurrentThreadId () returned 0x970 [0063.886] GetCurrentThreadId () returned 0x970 [0063.886] GetCurrentThreadId () returned 0x970 [0063.886] GetCurrentThreadId () returned 0x970 [0063.886] GetCurrentThreadId () returned 0x970 [0063.886] GetCurrentThreadId () returned 0x970 [0063.886] GetCurrentThreadId () returned 0x970 [0063.886] GetCurrentThreadId () returned 0x970 [0063.886] GetCurrentThreadId () returned 0x970 [0063.886] GetCurrentThreadId () returned 0x970 [0063.887] GetCurrentThreadId () returned 0x970 [0063.887] GetCurrentThreadId () returned 0x970 [0063.887] GetCurrentThreadId () returned 0x970 [0063.887] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAABsRCMAjeEVdQ4PWRv4PnFpmQam35yczwuW5+aNE8Ycu9j8gStHXlRgsOFSs9CwdEo1pHrStkcLb0mk9N7eyjs0nd0EdRz1s+H/ZW1SoubNkiE50IyFw7fg3RDH6g7sx/i9B2wNdZXSoFBoGjIvN/f+bFRJ7k1U/KMqpBhZc31p6G7+0yBOKQ6d/y0LJlZoPfanz14DNfAJ9sm6XtP/6uzDQCTV8/hSgpg==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0063.887] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAABsRCMAjeEVdQ4PWRv4PnFpmQam35yczwuW5+aNE8Ycu9j8gStHXlRgsOFSs9CwdEo1pHrStkcLb0mk9N7eyjs0nd0EdRz1s+H/ZW1SoubNkiE50IyFw7fg3RDH6g7sx/i9B2wNdZXSoFBoGjIvN/f+bFRJ7k1U/KMqpBhZc31p6G7+0yBOKQ6d/y0LJlZoPfanz14DNfAJ9sm6XtP/6uzDQCTV8/hSgpg==", cchWideChar=245, lpMultiByteStr=0x353933c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAABsRCMAjeEVdQ4PWRv4PnFpmQam35yczwuW5+aNE8Ycu9j8gStHXlRgsOFSs9CwdEo1pHrStkcLb0mk9N7eyjs0nd0EdRz1s+H/ZW1SoubNkiE50IyFw7fg3RDH6g7sx/i9B2wNdZXSoFBoGjIvN/f+bFRJ7k1U/KMqpBhZc31p6G7+0yBOKQ6d/y0LJlZoPfanz14DNfAJ9sm6XtP/6uzDQCTV8/hSgpg==", lpUsedDefaultChar=0x0) returned 245 [0063.887] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0063.887] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0063.887] CloseHandle (hObject=0x158) returned 1 [0063.887] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png")) returned 0 [0063.887] GetLastError () returned 0x5 [0063.887] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png")) returned 0x20 [0063.887] SetLastError (dwErrCode=0x5) [0063.887] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=18415071143) returned 1 [0063.887] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\Файл зашифрован [DissolveNoise.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\Файл зашифрован [dissolvenoise.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0063.888] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0063.888] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0063.888] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0063.888] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0063.888] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0063.888] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0063.888] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0063.888] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0063.888] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0063.888] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0063.888] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0063.888] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0063.888] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0063.888] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0063.888] SetEndOfFile (hFile=0x158) returned 1 [0063.889] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0063.889] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0063.889] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0063.889] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0063.889] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0063.890] WriteFile (in: hFile=0x158, lpBuffer=0x35f04dc*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f04dc*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0063.890] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="JYT48^IV=NGFAox)+GU{a7,cuVcX+cy%", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0063.890] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="JYT48^IV=NGFAox)+GU{a7,cuVcX+cy%", cchWideChar=32, lpMultiByteStr=0x2035f4c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="JYT48^IV=NGFAox)+GU{a7,cuVcX+cy%", lpUsedDefaultChar=0x0) returned 32 [0063.890] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0063.890] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0063.890] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93d38e22, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93d38e22, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x68980fb9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb7835, dwReserved0=0x0, dwReserved1=0x0, cFileName="DissolveNoise.png", cAlternateFileName="")) returned 0x295098 [0063.890] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0063.890] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0063.890] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png")) returned 0x20 [0063.890] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png")) returned 0x20 [0063.890] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png")) returned 0x20 [0063.890] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png")) returned 0x20 [0063.890] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93d38e22, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93d38e22, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x68980fb9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb7835)) returned 1 [0063.890] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0063.891] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0063.891] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png")) returned 0x20 [0063.891] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png")) returned 0x20 [0063.891] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0063.891] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0063.891] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0063.891] SetEndOfFile (hFile=0x158) returned 1 [0063.892] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DissolveNoise.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0063.892] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DissolveNoise.png", cchWideChar=17, lpMultiByteStr=0x1ff885c, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DissolveNoise.png", lpUsedDefaultChar=0x0) returned 17 [0063.892] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DissolveNoise.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0063.892] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DissolveNoise.png", cchWideChar=17, lpMultiByteStr=0x1ff8974, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DissolveNoise.png", lpUsedDefaultChar=0x0) returned 17 [0063.892] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff8974, cbMultiByte=17, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="DissolveNoise.pngng") returned 17 [0063.892] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DissolveNoise.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0063.892] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DissolveNoise.png", cchWideChar=17, lpMultiByteStr=0x1ff885c, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DissolveNoise.png", lpUsedDefaultChar=0x0) returned 17 [0063.892] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0063.892] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0063.892] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0xb7835 [0063.892] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0063.892] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0063.892] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0063.892] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DissolveNoise.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0063.892] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DissolveNoise.png", cchWideChar=17, lpMultiByteStr=0x1ff885c, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DissolveNoise.png", lpUsedDefaultChar=0x0) returned 17 [0063.893] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DissolveNoise.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0063.893] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DissolveNoise.png", cchWideChar=17, lpMultiByteStr=0x1ff8974, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DissolveNoise.png", lpUsedDefaultChar=0x0) returned 17 [0063.893] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff8974, cbMultiByte=17, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="DissolveNoise.pngse.pngng") returned 17 [0063.893] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DissolveNoise.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0063.893] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DissolveNoise.png", cchWideChar=17, lpMultiByteStr=0x1ff885c, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DissolveNoise.png", lpUsedDefaultChar=0x0) returned 17 [0063.893] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0063.894] CharToOemA (in: pSrc="DissolveNoise.png", pDst=0x1ff8974 | out: pDst="DissolveNoise.png") returned 1 [0063.894] WriteFile (in: hFile=0x158, lpBuffer=0x1ff8974*, nNumberOfBytesToWrite=0x11, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1ff8974*, lpNumberOfBytesWritten=0x18e048*=0x11, lpOverlapped=0x0) returned 1 [0063.894] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0063.894] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0063.894] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0063.894] VirtualAlloc (lpAddress=0x0, dwSize=0xc0000, flAllocationType=0x101000, flProtect=0x4) returned 0x7eee0000 [0063.894] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=18415774647) returned 1 [0063.894] ReadFile (in: hFile=0x11c, lpBuffer=0x7eee0010, nNumberOfBytesToRead=0xb7835, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x7eee0010*, lpNumberOfBytesRead=0x18dd7c*=0xb7835, lpOverlapped=0x0) returned 1 [0063.913] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0063.913] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=18417650916) returned 1 [0063.922] WriteFile (in: hFile=0x158, lpBuffer=0x379ad80*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379ad80*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0063.922] ReadFile (in: hFile=0x11c, lpBuffer=0x7eee0010, nNumberOfBytesToRead=0xb7835, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x7eee0010*, lpNumberOfBytesRead=0x18de38*=0xb7835, lpOverlapped=0x0) returned 1 [0063.922] VirtualAlloc (lpAddress=0x0, dwSize=0xc0000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ee20000 [0063.932] VirtualAlloc (lpAddress=0x0, dwSize=0xc0000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ed60000 [0063.963] VirtualFree (lpAddress=0x7ed60000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0063.967] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x4c [0063.967] WriteFile (in: hFile=0x158, lpBuffer=0x7ee20010*, nNumberOfBytesToWrite=0xb7835, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x7ee20010*, lpNumberOfBytesWritten=0x18de10*=0xb7835, lpOverlapped=0x0) returned 1 [0063.979] VirtualFree (lpAddress=0x7ee20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0063.982] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0xb7881 [0063.982] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0063.982] VirtualFree (lpAddress=0x7eee0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0063.986] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0063.986] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0063.986] SetFilePointer (in: hFile=0x158, lDistanceToMove=17, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2f [0063.986] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0xb788b [0063.986] CloseHandle (hObject=0x11c) returned 1 [0063.986] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xb788b [0063.986] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xb788b [0063.986] SetFilePointer (in: hFile=0x158, lDistanceToMove=751755, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xb788b [0063.986] SetFilePointer (in: hFile=0x158, lDistanceToMove=751755, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0xb788b [0063.987] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xb788b [0063.987] SetFilePointer (in: hFile=0x158, lDistanceToMove=751755, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0xb788b [0063.987] SetEndOfFile (hFile=0x158) returned 1 [0063.987] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xb788b [0063.987] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xb788b [0063.987] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DissolveNoise.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0063.987] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DissolveNoise.png", cchWideChar=17, lpMultiByteStr=0x1ff8974, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DissolveNoise.png", lpUsedDefaultChar=0x0) returned 17 [0063.987] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DissolveNoise.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0063.987] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DissolveNoise.png", cchWideChar=17, lpMultiByteStr=0x1ff885c, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DissolveNoise.png", lpUsedDefaultChar=0x0) returned 17 [0063.987] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff885c, cbMultiByte=17, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="DissolveNoise.png\x18믉`믑`") returned 17 [0063.987] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DissolveNoise.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0063.987] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DissolveNoise.png", cchWideChar=17, lpMultiByteStr=0x1ff8974, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DissolveNoise.png", lpUsedDefaultChar=0x0) returned 17 [0063.987] WriteFile (in: hFile=0x158, lpBuffer=0x37a2fa8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x37a2fa8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0063.987] CharToOemA (in: pSrc="DissolveNoise.png", pDst=0x1ff885c | out: pDst="DissolveNoise.png") returned 1 [0063.987] WriteFile (in: hFile=0x158, lpBuffer=0x1ff885c*, nNumberOfBytesToWrite=0x11, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1ff885c*, lpNumberOfBytesWritten=0x18efcc*=0x11, lpOverlapped=0x0) returned 1 [0063.987] WriteFile (in: hFile=0x158, lpBuffer=0x379ad58*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379ad58*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0063.988] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0063.988] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0063.988] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xb78d5 [0063.988] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xb78d5 [0063.988] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0063.988] WriteFile (in: hFile=0x158, lpBuffer=0x35f04dc*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f04dc*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0063.988] DeleteFileW (lpFileName="") returned 0 [0063.988] GetLastError () returned 0x3 [0063.988] GetFileAttributesW (lpFileName="") returned 0xffffffff [0063.988] SetLastError (dwErrCode=0x3) [0063.988] FlushFileBuffers (hFile=0x158) returned 1 [0063.993] GetCurrentThreadId () returned 0x970 [0063.993] GetCurrentThreadId () returned 0x970 [0063.993] GetCurrentThreadId () returned 0x970 [0063.993] GetCurrentThreadId () returned 0x970 [0063.993] GetCurrentThreadId () returned 0x970 [0063.993] GetCurrentThreadId () returned 0x970 [0063.993] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xb798c [0063.993] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xb798c [0063.993] SetFilePointer (in: hFile=0x158, lDistanceToMove=752012, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xb798c [0063.993] CloseHandle (hObject=0x158) returned 1 [0063.993] GetCurrentThreadId () returned 0x970 [0063.993] GetCurrentThreadId () returned 0x970 [0063.993] GetCurrentThreadId () returned 0x970 [0063.993] GetCurrentThreadId () returned 0x970 [0063.993] GetCurrentThreadId () returned 0x970 [0063.993] GetCurrentThreadId () returned 0x970 [0063.993] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\Файл зашифрован [DissolveNoise.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\Файл зашифрован [dissolvenoise.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0063.994] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb798c [0063.994] SetFilePointer (in: hFile=0x158, lDistanceToMove=751884, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb790c [0063.994] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0063.994] GetFileType (hFile=0x158) returned 0x1 [0063.994] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xb, wMilliseconds=0x10c)) [0063.994] GetCurrentThreadId () returned 0x970 [0063.994] GetCurrentThreadId () returned 0x970 [0063.994] GetCurrentThreadId () returned 0x970 [0063.994] GetCurrentThreadId () returned 0x970 [0063.994] GetCurrentThreadId () returned 0x970 [0063.994] GetCurrentThreadId () returned 0x970 [0063.994] GetCurrentThreadId () returned 0x970 [0063.994] GetCurrentThreadId () returned 0x970 [0063.994] GetCurrentThreadId () returned 0x970 [0063.994] GetCurrentThreadId () returned 0x970 [0063.994] GetCurrentThreadId () returned 0x970 [0063.994] GetCurrentThreadId () returned 0x970 [0063.994] GetCurrentThreadId () returned 0x970 [0063.994] GetCurrentThreadId () returned 0x970 [0063.994] GetCurrentThreadId () returned 0x970 [0063.994] GetCurrentThreadId () returned 0x970 [0063.994] GetCurrentThreadId () returned 0x970 [0063.994] GetCurrentThreadId () returned 0x970 [0063.994] GetCurrentThreadId () returned 0x970 [0063.994] GetCurrentThreadId () returned 0x970 [0063.994] GetCurrentThreadId () returned 0x970 [0063.994] GetCurrentThreadId () returned 0x970 [0063.994] GetCurrentThreadId () returned 0x970 [0063.994] GetCurrentThreadId () returned 0x970 [0063.994] GetCurrentThreadId () returned 0x970 [0063.994] GetCurrentThreadId () returned 0x970 [0063.994] GetCurrentThreadId () returned 0x970 [0063.994] GetCurrentThreadId () returned 0x970 [0063.994] GetCurrentThreadId () returned 0x970 [0063.994] GetCurrentThreadId () returned 0x970 [0063.994] GetCurrentThreadId () returned 0x970 [0063.994] GetCurrentThreadId () returned 0x970 [0063.994] GetCurrentThreadId () returned 0x970 [0063.994] GetCurrentThreadId () returned 0x970 [0063.994] GetCurrentThreadId () returned 0x970 [0063.995] GetCurrentThreadId () returned 0x970 [0063.995] GetCurrentThreadId () returned 0x970 [0063.995] GetCurrentThreadId () returned 0x970 [0063.995] GetCurrentThreadId () returned 0x970 [0063.995] GetCurrentThreadId () returned 0x970 [0063.995] GetCurrentThreadId () returned 0x970 [0063.995] GetCurrentThreadId () returned 0x970 [0063.995] GetCurrentThreadId () returned 0x970 [0063.995] GetCurrentThreadId () returned 0x970 [0063.995] GetCurrentThreadId () returned 0x970 [0063.995] GetCurrentThreadId () returned 0x970 [0063.995] GetCurrentThreadId () returned 0x970 [0063.995] GetCurrentThreadId () returned 0x970 [0063.995] GetCurrentThreadId () returned 0x970 [0063.995] GetCurrentThreadId () returned 0x970 [0063.995] GetCurrentThreadId () returned 0x970 [0063.995] GetCurrentThreadId () returned 0x970 [0063.995] GetCurrentThreadId () returned 0x970 [0063.995] GetCurrentThreadId () returned 0x970 [0063.995] GetCurrentThreadId () returned 0x970 [0063.995] GetCurrentThreadId () returned 0x970 [0063.995] GetCurrentThreadId () returned 0x970 [0063.995] GetCurrentThreadId () returned 0x970 [0063.995] GetCurrentThreadId () returned 0x970 [0063.995] GetCurrentThreadId () returned 0x970 [0063.995] GetCurrentThreadId () returned 0x970 [0063.995] GetCurrentThreadId () returned 0x970 [0063.995] GetCurrentThreadId () returned 0x970 [0063.995] GetCurrentThreadId () returned 0x970 [0063.995] GetCurrentThreadId () returned 0x970 [0063.995] GetCurrentThreadId () returned 0x970 [0063.995] GetCurrentThreadId () returned 0x970 [0063.995] GetCurrentThreadId () returned 0x970 [0063.995] GetCurrentThreadId () returned 0x970 [0063.995] GetCurrentThreadId () returned 0x970 [0063.995] GetCurrentThreadId () returned 0x970 [0063.995] GetCurrentThreadId () returned 0x970 [0063.995] GetCurrentThreadId () returned 0x970 [0063.995] GetCurrentThreadId () returned 0x970 [0063.995] GetCurrentThreadId () returned 0x970 [0063.995] GetCurrentThreadId () returned 0x970 [0063.995] GetCurrentThreadId () returned 0x970 [0063.995] GetCurrentThreadId () returned 0x970 [0063.995] GetCurrentThreadId () returned 0x970 [0063.995] GetCurrentThreadId () returned 0x970 [0063.995] GetCurrentThreadId () returned 0x970 [0063.996] GetCurrentThreadId () returned 0x970 [0063.996] GetCurrentThreadId () returned 0x970 [0063.996] GetCurrentThreadId () returned 0x970 [0063.996] GetCurrentThreadId () returned 0x970 [0063.996] GetCurrentThreadId () returned 0x970 [0063.996] GetCurrentThreadId () returned 0x970 [0063.996] GetCurrentThreadId () returned 0x970 [0063.996] GetCurrentThreadId () returned 0x970 [0063.996] GetCurrentThreadId () returned 0x970 [0063.996] GetCurrentThreadId () returned 0x970 [0063.996] GetCurrentThreadId () returned 0x970 [0063.996] GetCurrentThreadId () returned 0x970 [0063.996] GetCurrentThreadId () returned 0x970 [0063.996] GetCurrentThreadId () returned 0x970 [0063.996] GetCurrentThreadId () returned 0x970 [0063.996] GetCurrentThreadId () returned 0x970 [0063.996] GetCurrentThreadId () returned 0x970 [0063.996] GetCurrentThreadId () returned 0x970 [0063.996] GetCurrentThreadId () returned 0x970 [0063.996] GetCurrentThreadId () returned 0x970 [0063.996] GetCurrentThreadId () returned 0x970 [0063.996] GetCurrentThreadId () returned 0x970 [0063.996] GetCurrentThreadId () returned 0x970 [0063.996] GetCurrentThreadId () returned 0x970 [0063.996] GetCurrentThreadId () returned 0x970 [0063.996] GetCurrentThreadId () returned 0x970 [0063.996] GetCurrentThreadId () returned 0x970 [0063.996] GetCurrentThreadId () returned 0x970 [0063.996] GetCurrentThreadId () returned 0x970 [0063.996] GetCurrentThreadId () returned 0x970 [0063.996] GetCurrentThreadId () returned 0x970 [0063.996] GetCurrentThreadId () returned 0x970 [0063.996] GetCurrentThreadId () returned 0x970 [0063.996] GetCurrentThreadId () returned 0x970 [0063.996] GetCurrentThreadId () returned 0x970 [0063.996] GetCurrentThreadId () returned 0x970 [0063.996] GetCurrentThreadId () returned 0x970 [0063.996] GetCurrentThreadId () returned 0x970 [0063.996] GetCurrentThreadId () returned 0x970 [0063.996] GetCurrentThreadId () returned 0x970 [0063.996] GetCurrentThreadId () returned 0x970 [0063.996] GetCurrentThreadId () returned 0x970 [0063.996] GetCurrentThreadId () returned 0x970 [0063.996] GetCurrentThreadId () returned 0x970 [0063.996] GetCurrentThreadId () returned 0x970 [0063.997] GetCurrentThreadId () returned 0x970 [0063.997] GetCurrentThreadId () returned 0x970 [0063.997] GetCurrentThreadId () returned 0x970 [0063.997] GetCurrentThreadId () returned 0x970 [0063.997] GetCurrentThreadId () returned 0x970 [0063.997] GetCurrentThreadId () returned 0x970 [0063.997] GetCurrentThreadId () returned 0x970 [0063.997] GetCurrentThreadId () returned 0x970 [0063.997] GetCurrentThreadId () returned 0x970 [0063.997] GetCurrentThreadId () returned 0x970 [0063.997] GetCurrentThreadId () returned 0x970 [0063.997] GetCurrentThreadId () returned 0x970 [0063.997] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.997] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.997] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aff8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0063.997] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.997] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.997] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aff8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0063.997] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.997] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.997] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0063.997] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.997] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.997] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0063.997] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.997] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.997] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379b058, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0063.997] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.997] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.997] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379b058, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0063.997] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.997] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.997] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379b058, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0063.997] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xb, wMilliseconds=0x10c)) [0063.997] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JYT48^IV=NGFAox)+GU{a7,cuVcX+cy%", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0063.997] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JYT48^IV=NGFAox)+GU{a7,cuVcX+cy%", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0063.998] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JYT48^IV=NGFAox)+GU{a7,cuVcX+cy%", cchWideChar=32, lpMultiByteStr=0x2003628, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="JYT48^IV=NGFAox)+GU{a7,cuVcX+cy%", lpUsedDefaultChar=0x0) returned 32 [0063.998] GetCurrentThreadId () returned 0x970 [0063.998] GetCurrentThreadId () returned 0x970 [0063.998] GetCurrentThreadId () returned 0x970 [0063.998] GetCurrentThreadId () returned 0x970 [0063.998] GetCurrentThreadId () returned 0x970 [0063.998] GetCurrentThreadId () returned 0x970 [0064.006] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0064.006] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0064.006] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3796cc8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0064.006] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0064.006] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAACUb7q05u9RGJUdLYQwfPiYcxs8G/fZ5NRwNLx3m262tFk+vMapaa0t7IgHkRKRp6AL9L3G1rr8SN19gZg4gEMJ1OF3iv6VKxUGAIbsUjocaiuVXJ0n2+eggqYXI9jVPPvLYfY8ALP6JUsndoh9JAvTPLIZymW0D+LSg/AxJ2drZsieXy4joM0CMyIs5ElwkJ+kEjOEFfjpHvFpGJlaiMG+cYlP8yus9/w==") returned 232 [0064.006] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xb, wMilliseconds=0x11c)) [0064.006] GetCurrentThreadId () returned 0x970 [0064.006] GetCurrentThreadId () returned 0x970 [0064.006] GetCurrentThreadId () returned 0x970 [0064.006] GetCurrentThreadId () returned 0x970 [0064.006] GetCurrentThreadId () returned 0x970 [0064.006] GetCurrentThreadId () returned 0x970 [0064.006] GetCurrentThreadId () returned 0x970 [0064.006] GetCurrentThreadId () returned 0x970 [0064.006] GetCurrentThreadId () returned 0x970 [0064.006] GetCurrentThreadId () returned 0x970 [0064.006] GetCurrentThreadId () returned 0x970 [0064.006] GetCurrentThreadId () returned 0x970 [0064.006] GetCurrentThreadId () returned 0x970 [0064.006] GetCurrentThreadId () returned 0x970 [0064.006] GetCurrentThreadId () returned 0x970 [0064.006] GetCurrentThreadId () returned 0x970 [0064.006] GetCurrentThreadId () returned 0x970 [0064.006] GetCurrentThreadId () returned 0x970 [0064.006] GetCurrentThreadId () returned 0x970 [0064.006] GetCurrentThreadId () returned 0x970 [0064.006] GetCurrentThreadId () returned 0x970 [0064.006] GetCurrentThreadId () returned 0x970 [0064.006] GetCurrentThreadId () returned 0x970 [0064.006] GetCurrentThreadId () returned 0x970 [0064.006] GetCurrentThreadId () returned 0x970 [0064.006] GetCurrentThreadId () returned 0x970 [0064.006] GetCurrentThreadId () returned 0x970 [0064.006] GetCurrentThreadId () returned 0x970 [0064.006] GetCurrentThreadId () returned 0x970 [0064.006] GetCurrentThreadId () returned 0x970 [0064.007] GetCurrentThreadId () returned 0x970 [0064.007] GetCurrentThreadId () returned 0x970 [0064.007] GetCurrentThreadId () returned 0x970 [0064.007] GetCurrentThreadId () returned 0x970 [0064.007] GetCurrentThreadId () returned 0x970 [0064.007] GetCurrentThreadId () returned 0x970 [0064.007] GetCurrentThreadId () returned 0x970 [0064.007] GetCurrentThreadId () returned 0x970 [0064.007] GetCurrentThreadId () returned 0x970 [0064.007] GetCurrentThreadId () returned 0x970 [0064.007] GetCurrentThreadId () returned 0x970 [0064.007] GetCurrentThreadId () returned 0x970 [0064.007] GetCurrentThreadId () returned 0x970 [0064.007] GetCurrentThreadId () returned 0x970 [0064.007] GetCurrentThreadId () returned 0x970 [0064.007] GetCurrentThreadId () returned 0x970 [0064.007] GetCurrentThreadId () returned 0x970 [0064.007] GetCurrentThreadId () returned 0x970 [0064.007] GetCurrentThreadId () returned 0x970 [0064.007] GetCurrentThreadId () returned 0x970 [0064.007] GetCurrentThreadId () returned 0x970 [0064.007] GetCurrentThreadId () returned 0x970 [0064.007] GetCurrentThreadId () returned 0x970 [0064.007] GetCurrentThreadId () returned 0x970 [0064.007] GetCurrentThreadId () returned 0x970 [0064.007] GetCurrentThreadId () returned 0x970 [0064.007] GetCurrentThreadId () returned 0x970 [0064.007] GetCurrentThreadId () returned 0x970 [0064.007] GetCurrentThreadId () returned 0x970 [0064.007] GetCurrentThreadId () returned 0x970 [0064.007] GetCurrentThreadId () returned 0x970 [0064.007] GetCurrentThreadId () returned 0x970 [0064.007] GetCurrentThreadId () returned 0x970 [0064.007] GetCurrentThreadId () returned 0x970 [0064.007] GetCurrentThreadId () returned 0x970 [0064.007] GetCurrentThreadId () returned 0x970 [0064.007] GetCurrentThreadId () returned 0x970 [0064.007] GetCurrentThreadId () returned 0x970 [0064.007] GetCurrentThreadId () returned 0x970 [0064.007] GetCurrentThreadId () returned 0x970 [0064.007] GetCurrentThreadId () returned 0x970 [0064.007] GetCurrentThreadId () returned 0x970 [0064.007] GetCurrentThreadId () returned 0x970 [0064.007] GetCurrentThreadId () returned 0x970 [0064.007] GetCurrentThreadId () returned 0x970 [0064.008] GetCurrentThreadId () returned 0x970 [0064.008] GetCurrentThreadId () returned 0x970 [0064.008] GetCurrentThreadId () returned 0x970 [0064.008] GetCurrentThreadId () returned 0x970 [0064.008] GetCurrentThreadId () returned 0x970 [0064.008] GetCurrentThreadId () returned 0x970 [0064.008] GetCurrentThreadId () returned 0x970 [0064.008] GetCurrentThreadId () returned 0x970 [0064.008] GetCurrentThreadId () returned 0x970 [0064.008] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAACUb7q05u9RGJUdLYQwfPiYcxs8G/fZ5NRwNLx3m262tFk+vMapaa0t7IgHkRKRp6AL9L3G1rr8SN19gZg4gEMJ1OF3iv6VKxUGAIbsUjocaiuVXJ0n2+eggqYXI9jVPPvLYfY8ALP6JUsndoh9JAvTPLIZymW0D+LSg/AxJ2drZsieXy4joM0CMyIs5ElwkJ+kEjOEFfjpHvFpGJlaiMG+cYlP8yus9/w==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0064.008] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAACUb7q05u9RGJUdLYQwfPiYcxs8G/fZ5NRwNLx3m262tFk+vMapaa0t7IgHkRKRp6AL9L3G1rr8SN19gZg4gEMJ1OF3iv6VKxUGAIbsUjocaiuVXJ0n2+eggqYXI9jVPPvLYfY8ALP6JUsndoh9JAvTPLIZymW0D+LSg/AxJ2drZsieXy4joM0CMyIs5ElwkJ+kEjOEFfjpHvFpGJlaiMG+cYlP8yus9/w==", cchWideChar=245, lpMultiByteStr=0x353933c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAACUb7q05u9RGJUdLYQwfPiYcxs8G/fZ5NRwNLx3m262tFk+vMapaa0t7IgHkRKRp6AL9L3G1rr8SN19gZg4gEMJ1OF3iv6VKxUGAIbsUjocaiuVXJ0n2+eggqYXI9jVPPvLYfY8ALP6JUsndoh9JAvTPLIZymW0D+LSg/AxJ2drZsieXy4joM0CMyIs5ElwkJ+kEjOEFfjpHvFpGJlaiMG+cYlP8yus9/w==", lpUsedDefaultChar=0x0) returned 245 [0064.008] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0064.008] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0064.008] CloseHandle (hObject=0x158) returned 1 [0064.008] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png")) returned 0 [0064.008] GetLastError () returned 0x5 [0064.008] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png")) returned 0x20 [0064.009] SetLastError (dwErrCode=0x5) [0064.009] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=18427199308) returned 1 [0064.009] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Файл зашифрован [16to9Squareframe_Buttongraphic.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\Файл зашифрован [16to9squareframe_buttongraphic.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0064.009] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0064.009] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0064.009] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0064.009] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0064.009] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0064.009] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0064.009] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0064.010] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0064.010] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0064.010] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0064.010] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0064.010] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0064.010] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0064.010] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0064.010] SetEndOfFile (hFile=0x158) returned 1 [0064.010] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0064.010] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0064.010] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0064.010] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0064.010] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0064.011] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0064.012] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c5^O(w))QV3t>AQv(!=.Sb=2FgO+QmXg", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0064.012] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c5^O(w))QV3t>AQv(!=.Sb=2FgO+QmXg", cchWideChar=32, lpMultiByteStr=0x2036064, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c5^O(w))QV3t>AQv(!=.Sb=2FgO+QmXg", lpUsedDefaultChar=0x0) returned 32 [0064.012] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0064.012] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0064.012] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec183f4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec183f4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49c9fe3b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x278b, dwReserved0=0x0, dwReserved1=0x0, cFileName="16to9Squareframe_Buttongraphic.png", cAlternateFileName="")) returned 0x295098 [0064.012] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0064.012] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0064.012] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png")) returned 0x20 [0064.013] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png")) returned 0x20 [0064.013] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png")) returned 0x20 [0064.014] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png")) returned 0x20 [0064.014] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec183f4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec183f4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49c9fe3b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x278b)) returned 1 [0064.014] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0064.014] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0064.014] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png")) returned 0x20 [0064.014] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png")) returned 0x20 [0064.014] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0064.014] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0064.014] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0064.014] SetEndOfFile (hFile=0x158) returned 1 [0064.015] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="16to9Squareframe_Buttongraphic.png", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0064.015] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="16to9Squareframe_Buttongraphic.png", cchWideChar=34, lpMultiByteStr=0x20349a4, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="16to9Squareframe_Buttongraphic.png", lpUsedDefaultChar=0x0) returned 34 [0064.015] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="16to9Squareframe_Buttongraphic.png", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0064.015] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="16to9Squareframe_Buttongraphic.png", cchWideChar=34, lpMultiByteStr=0x20360d4, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="16to9Squareframe_Buttongraphic.png", lpUsedDefaultChar=0x0) returned 34 [0064.015] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x20360d4, cbMultiByte=34, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="16to9Squareframe_Buttongraphic.pngNN㔴Ǿ") returned 34 [0064.015] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="16to9Squareframe_Buttongraphic.png", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0064.015] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="16to9Squareframe_Buttongraphic.png", cchWideChar=34, lpMultiByteStr=0x20349a4, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="16to9Squareframe_Buttongraphic.png", lpUsedDefaultChar=0x0) returned 34 [0064.015] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0064.015] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0064.015] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x278b [0064.016] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0064.016] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0064.016] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0064.016] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="16to9Squareframe_Buttongraphic.png", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0064.016] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="16to9Squareframe_Buttongraphic.png", cchWideChar=34, lpMultiByteStr=0x20349a4, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="16to9Squareframe_Buttongraphic.png", lpUsedDefaultChar=0x0) returned 34 [0064.016] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="16to9Squareframe_Buttongraphic.png", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0064.016] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="16to9Squareframe_Buttongraphic.png", cchWideChar=34, lpMultiByteStr=0x20360d4, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="16to9Squareframe_Buttongraphic.png", lpUsedDefaultChar=0x0) returned 34 [0064.016] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x20360d4, cbMultiByte=34, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="16to9Squareframe_Buttongraphic.pngic.pngNN㔴Ǿ") returned 34 [0064.016] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="16to9Squareframe_Buttongraphic.png", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0064.016] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="16to9Squareframe_Buttongraphic.png", cchWideChar=34, lpMultiByteStr=0x20349a4, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="16to9Squareframe_Buttongraphic.png", lpUsedDefaultChar=0x0) returned 34 [0064.016] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0064.017] CharToOemA (in: pSrc="16to9Squareframe_Buttongraphic.png", pDst=0x20360d4 | out: pDst="16to9Squareframe_Buttongraphic.png") returned 1 [0064.017] WriteFile (in: hFile=0x158, lpBuffer=0x20360d4*, nNumberOfBytesToWrite=0x22, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x20360d4*, lpNumberOfBytesWritten=0x18e048*=0x22, lpOverlapped=0x0) returned 1 [0064.017] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0064.017] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0064.017] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0064.017] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=18428073528) returned 1 [0064.017] ReadFile (in: hFile=0x11c, lpBuffer=0x37bf4d0, nNumberOfBytesToRead=0x278b, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37bf4d0*, lpNumberOfBytesRead=0x18dd7c*=0x278b, lpOverlapped=0x0) returned 1 [0064.019] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0064.019] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=18428248526) returned 1 [0064.028] WriteFile (in: hFile=0x158, lpBuffer=0x379ad08*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379ad08*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0064.028] ReadFile (in: hFile=0x11c, lpBuffer=0x37bf4d0, nNumberOfBytesToRead=0x278b, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x37bf4d0*, lpNumberOfBytesRead=0x18de38*=0x278b, lpOverlapped=0x0) returned 1 [0064.028] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x5d [0064.028] WriteFile (in: hFile=0x158, lpBuffer=0x38034f0*, nNumberOfBytesToWrite=0x278b, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x38034f0*, lpNumberOfBytesWritten=0x18de10*=0x278b, lpOverlapped=0x0) returned 1 [0064.029] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x27e8 [0064.029] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0064.029] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0064.029] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0064.029] SetFilePointer (in: hFile=0x158, lDistanceToMove=34, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x40 [0064.029] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x27f2 [0064.029] CloseHandle (hObject=0x11c) returned 1 [0064.029] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x27f2 [0064.029] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x27f2 [0064.029] SetFilePointer (in: hFile=0x158, lDistanceToMove=10226, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x27f2 [0064.029] SetFilePointer (in: hFile=0x158, lDistanceToMove=10226, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x27f2 [0064.029] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x27f2 [0064.030] SetFilePointer (in: hFile=0x158, lDistanceToMove=10226, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x27f2 [0064.030] SetEndOfFile (hFile=0x158) returned 1 [0064.030] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x27f2 [0064.030] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x27f2 [0064.030] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="16to9Squareframe_Buttongraphic.png", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0064.030] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="16to9Squareframe_Buttongraphic.png", cchWideChar=34, lpMultiByteStr=0x20360d4, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="16to9Squareframe_Buttongraphic.png", lpUsedDefaultChar=0x0) returned 34 [0064.030] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="16to9Squareframe_Buttongraphic.png", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0064.030] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="16to9Squareframe_Buttongraphic.png", cchWideChar=34, lpMultiByteStr=0x20349a4, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="16to9Squareframe_Buttongraphic.png", lpUsedDefaultChar=0x0) returned 34 [0064.030] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x20349a4, cbMultiByte=34, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="16to9Squareframe_Buttongraphic.png➧") returned 34 [0064.030] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="16to9Squareframe_Buttongraphic.png", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0064.030] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="16to9Squareframe_Buttongraphic.png", cchWideChar=34, lpMultiByteStr=0x20360d4, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="16to9Squareframe_Buttongraphic.png", lpUsedDefaultChar=0x0) returned 34 [0064.030] WriteFile (in: hFile=0x158, lpBuffer=0x37a2fa8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x37a2fa8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0064.030] CharToOemA (in: pSrc="16to9Squareframe_Buttongraphic.png", pDst=0x20349a4 | out: pDst="16to9Squareframe_Buttongraphic.png") returned 1 [0064.030] WriteFile (in: hFile=0x158, lpBuffer=0x20349a4*, nNumberOfBytesToWrite=0x22, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x20349a4*, lpNumberOfBytesWritten=0x18efcc*=0x22, lpOverlapped=0x0) returned 1 [0064.030] WriteFile (in: hFile=0x158, lpBuffer=0x379ae18*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379ae18*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0064.031] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0064.031] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0064.031] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x284d [0064.031] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x284d [0064.031] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0064.031] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0064.031] DeleteFileW (lpFileName="") returned 0 [0064.031] GetLastError () returned 0x3 [0064.031] GetFileAttributesW (lpFileName="") returned 0xffffffff [0064.031] SetLastError (dwErrCode=0x3) [0064.031] FlushFileBuffers (hFile=0x158) returned 1 [0064.034] GetCurrentThreadId () returned 0x970 [0064.034] GetCurrentThreadId () returned 0x970 [0064.034] GetCurrentThreadId () returned 0x970 [0064.034] GetCurrentThreadId () returned 0x970 [0064.034] GetCurrentThreadId () returned 0x970 [0064.034] GetCurrentThreadId () returned 0x970 [0064.034] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x2904 [0064.034] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x2904 [0064.034] SetFilePointer (in: hFile=0x158, lDistanceToMove=10500, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x2904 [0064.034] CloseHandle (hObject=0x158) returned 1 [0064.034] GetCurrentThreadId () returned 0x970 [0064.034] GetCurrentThreadId () returned 0x970 [0064.034] GetCurrentThreadId () returned 0x970 [0064.034] GetCurrentThreadId () returned 0x970 [0064.034] GetCurrentThreadId () returned 0x970 [0064.034] GetCurrentThreadId () returned 0x970 [0064.034] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Файл зашифрован [16to9Squareframe_Buttongraphic.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\Файл зашифрован [16to9squareframe_buttongraphic.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0064.035] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2904 [0064.035] SetFilePointer (in: hFile=0x158, lDistanceToMove=10372, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2884 [0064.035] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0064.035] GetFileType (hFile=0x158) returned 0x1 [0064.035] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xb, wMilliseconds=0x12c)) [0064.035] GetCurrentThreadId () returned 0x970 [0064.035] GetCurrentThreadId () returned 0x970 [0064.035] GetCurrentThreadId () returned 0x970 [0064.035] GetCurrentThreadId () returned 0x970 [0064.035] GetCurrentThreadId () returned 0x970 [0064.035] GetCurrentThreadId () returned 0x970 [0064.035] GetCurrentThreadId () returned 0x970 [0064.035] GetCurrentThreadId () returned 0x970 [0064.035] GetCurrentThreadId () returned 0x970 [0064.035] GetCurrentThreadId () returned 0x970 [0064.035] GetCurrentThreadId () returned 0x970 [0064.035] GetCurrentThreadId () returned 0x970 [0064.035] GetCurrentThreadId () returned 0x970 [0064.035] GetCurrentThreadId () returned 0x970 [0064.035] GetCurrentThreadId () returned 0x970 [0064.035] GetCurrentThreadId () returned 0x970 [0064.035] GetCurrentThreadId () returned 0x970 [0064.035] GetCurrentThreadId () returned 0x970 [0064.035] GetCurrentThreadId () returned 0x970 [0064.035] GetCurrentThreadId () returned 0x970 [0064.035] GetCurrentThreadId () returned 0x970 [0064.035] GetCurrentThreadId () returned 0x970 [0064.035] GetCurrentThreadId () returned 0x970 [0064.035] GetCurrentThreadId () returned 0x970 [0064.035] GetCurrentThreadId () returned 0x970 [0064.035] GetCurrentThreadId () returned 0x970 [0064.035] GetCurrentThreadId () returned 0x970 [0064.035] GetCurrentThreadId () returned 0x970 [0064.035] GetCurrentThreadId () returned 0x970 [0064.035] GetCurrentThreadId () returned 0x970 [0064.035] GetCurrentThreadId () returned 0x970 [0064.035] GetCurrentThreadId () returned 0x970 [0064.036] GetCurrentThreadId () returned 0x970 [0064.036] GetCurrentThreadId () returned 0x970 [0064.036] GetCurrentThreadId () returned 0x970 [0064.036] GetCurrentThreadId () returned 0x970 [0064.036] GetCurrentThreadId () returned 0x970 [0064.036] GetCurrentThreadId () returned 0x970 [0064.036] GetCurrentThreadId () returned 0x970 [0064.036] GetCurrentThreadId () returned 0x970 [0064.036] GetCurrentThreadId () returned 0x970 [0064.036] GetCurrentThreadId () returned 0x970 [0064.036] GetCurrentThreadId () returned 0x970 [0064.036] GetCurrentThreadId () returned 0x970 [0064.036] GetCurrentThreadId () returned 0x970 [0064.036] GetCurrentThreadId () returned 0x970 [0064.036] GetCurrentThreadId () returned 0x970 [0064.036] GetCurrentThreadId () returned 0x970 [0064.036] GetCurrentThreadId () returned 0x970 [0064.036] GetCurrentThreadId () returned 0x970 [0064.036] GetCurrentThreadId () returned 0x970 [0064.036] GetCurrentThreadId () returned 0x970 [0064.036] GetCurrentThreadId () returned 0x970 [0064.036] GetCurrentThreadId () returned 0x970 [0064.036] GetCurrentThreadId () returned 0x970 [0064.036] GetCurrentThreadId () returned 0x970 [0064.036] GetCurrentThreadId () returned 0x970 [0064.036] GetCurrentThreadId () returned 0x970 [0064.036] GetCurrentThreadId () returned 0x970 [0064.036] GetCurrentThreadId () returned 0x970 [0064.036] GetCurrentThreadId () returned 0x970 [0064.036] GetCurrentThreadId () returned 0x970 [0064.037] GetCurrentThreadId () returned 0x970 [0064.037] GetCurrentThreadId () returned 0x970 [0064.037] GetCurrentThreadId () returned 0x970 [0064.037] GetCurrentThreadId () returned 0x970 [0064.037] GetCurrentThreadId () returned 0x970 [0064.037] GetCurrentThreadId () returned 0x970 [0064.037] GetCurrentThreadId () returned 0x970 [0064.037] GetCurrentThreadId () returned 0x970 [0064.037] GetCurrentThreadId () returned 0x970 [0064.037] GetCurrentThreadId () returned 0x970 [0064.037] GetCurrentThreadId () returned 0x970 [0064.037] GetCurrentThreadId () returned 0x970 [0064.037] GetCurrentThreadId () returned 0x970 [0064.037] GetCurrentThreadId () returned 0x970 [0064.037] GetCurrentThreadId () returned 0x970 [0064.037] GetCurrentThreadId () returned 0x970 [0064.037] GetCurrentThreadId () returned 0x970 [0064.037] GetCurrentThreadId () returned 0x970 [0064.037] GetCurrentThreadId () returned 0x970 [0064.037] GetCurrentThreadId () returned 0x970 [0064.037] GetCurrentThreadId () returned 0x970 [0064.037] GetCurrentThreadId () returned 0x970 [0064.037] GetCurrentThreadId () returned 0x970 [0064.037] GetCurrentThreadId () returned 0x970 [0064.037] GetCurrentThreadId () returned 0x970 [0064.037] GetCurrentThreadId () returned 0x970 [0064.037] GetCurrentThreadId () returned 0x970 [0064.037] GetCurrentThreadId () returned 0x970 [0064.037] GetCurrentThreadId () returned 0x970 [0064.037] GetCurrentThreadId () returned 0x970 [0064.037] GetCurrentThreadId () returned 0x970 [0064.037] GetCurrentThreadId () returned 0x970 [0064.037] GetCurrentThreadId () returned 0x970 [0064.037] GetCurrentThreadId () returned 0x970 [0064.037] GetCurrentThreadId () returned 0x970 [0064.037] GetCurrentThreadId () returned 0x970 [0064.037] GetCurrentThreadId () returned 0x970 [0064.037] GetCurrentThreadId () returned 0x970 [0064.037] GetCurrentThreadId () returned 0x970 [0064.037] GetCurrentThreadId () returned 0x970 [0064.037] GetCurrentThreadId () returned 0x970 [0064.037] GetCurrentThreadId () returned 0x970 [0064.037] GetCurrentThreadId () returned 0x970 [0064.037] GetCurrentThreadId () returned 0x970 [0064.038] GetCurrentThreadId () returned 0x970 [0064.038] GetCurrentThreadId () returned 0x970 [0064.038] GetCurrentThreadId () returned 0x970 [0064.038] GetCurrentThreadId () returned 0x970 [0064.038] GetCurrentThreadId () returned 0x970 [0064.038] GetCurrentThreadId () returned 0x970 [0064.038] GetCurrentThreadId () returned 0x970 [0064.038] GetCurrentThreadId () returned 0x970 [0064.038] GetCurrentThreadId () returned 0x970 [0064.038] GetCurrentThreadId () returned 0x970 [0064.038] GetCurrentThreadId () returned 0x970 [0064.038] GetCurrentThreadId () returned 0x970 [0064.038] GetCurrentThreadId () returned 0x970 [0064.038] GetCurrentThreadId () returned 0x970 [0064.038] GetCurrentThreadId () returned 0x970 [0064.038] GetCurrentThreadId () returned 0x970 [0064.038] GetCurrentThreadId () returned 0x970 [0064.038] GetCurrentThreadId () returned 0x970 [0064.038] GetCurrentThreadId () returned 0x970 [0064.038] GetCurrentThreadId () returned 0x970 [0064.038] GetCurrentThreadId () returned 0x970 [0064.038] GetCurrentThreadId () returned 0x970 [0064.038] GetCurrentThreadId () returned 0x970 [0064.038] GetCurrentThreadId () returned 0x970 [0064.038] GetCurrentThreadId () returned 0x970 [0064.038] GetCurrentThreadId () returned 0x970 [0064.038] GetCurrentThreadId () returned 0x970 [0064.038] GetCurrentThreadId () returned 0x970 [0064.038] GetCurrentThreadId () returned 0x970 [0064.038] GetCurrentThreadId () returned 0x970 [0064.038] GetCurrentThreadId () returned 0x970 [0064.038] GetCurrentThreadId () returned 0x970 [0064.038] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.038] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.038] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379b058, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0064.038] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.038] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.038] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379b058, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0064.038] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.038] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.038] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0064.039] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.039] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.039] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0064.039] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.039] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.039] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379b0b8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0064.039] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.039] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.039] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379b0b8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0064.039] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.039] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.039] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379b0b8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0064.039] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xb, wMilliseconds=0x13b)) [0064.039] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c5^O(w))QV3t>AQv(!=.Sb=2FgO+QmXg", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0064.039] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c5^O(w))QV3t>AQv(!=.Sb=2FgO+QmXg", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0064.039] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c5^O(w))QV3t>AQv(!=.Sb=2FgO+QmXg", cchWideChar=32, lpMultiByteStr=0x2003658, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c5^O(w))QV3t>AQv(!=.Sb=2FgO+QmXg", lpUsedDefaultChar=0x0) returned 32 [0064.039] GetCurrentThreadId () returned 0x970 [0064.039] GetCurrentThreadId () returned 0x970 [0064.039] GetCurrentThreadId () returned 0x970 [0064.039] GetCurrentThreadId () returned 0x970 [0064.039] GetCurrentThreadId () returned 0x970 [0064.039] GetCurrentThreadId () returned 0x970 [0064.047] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0064.047] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0064.047] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3796e58, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0064.047] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0064.047] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb048, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAEkKoQ4j632KLGu6OwssO+ywZHK2cPr7Qhn/8x2TlAAyXaZua5bGPHMssn/LOlwWA9/4opy0JYxfhGXTQVfUuVrf4kUah+r3VW1T1txSbGzwWFz1w4GVn3gX9s2Euw78yLu2HCTp15X9Thz4W4Hvqrjoyo1nY6r/h0pkgjKncbigR5L6Dsp8kiGYjXW3hyj69ZLL41M7acvfVuIXq1bxzau/nbzTjRAcBA==") returned 232 [0064.047] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xb, wMilliseconds=0x13b)) [0064.047] GetCurrentThreadId () returned 0x970 [0064.047] GetCurrentThreadId () returned 0x970 [0064.047] GetCurrentThreadId () returned 0x970 [0064.047] GetCurrentThreadId () returned 0x970 [0064.047] GetCurrentThreadId () returned 0x970 [0064.047] GetCurrentThreadId () returned 0x970 [0064.047] GetCurrentThreadId () returned 0x970 [0064.047] GetCurrentThreadId () returned 0x970 [0064.047] GetCurrentThreadId () returned 0x970 [0064.047] GetCurrentThreadId () returned 0x970 [0064.047] GetCurrentThreadId () returned 0x970 [0064.047] GetCurrentThreadId () returned 0x970 [0064.047] GetCurrentThreadId () returned 0x970 [0064.047] GetCurrentThreadId () returned 0x970 [0064.047] GetCurrentThreadId () returned 0x970 [0064.047] GetCurrentThreadId () returned 0x970 [0064.047] GetCurrentThreadId () returned 0x970 [0064.047] GetCurrentThreadId () returned 0x970 [0064.047] GetCurrentThreadId () returned 0x970 [0064.047] GetCurrentThreadId () returned 0x970 [0064.047] GetCurrentThreadId () returned 0x970 [0064.047] GetCurrentThreadId () returned 0x970 [0064.047] GetCurrentThreadId () returned 0x970 [0064.047] GetCurrentThreadId () returned 0x970 [0064.047] GetCurrentThreadId () returned 0x970 [0064.047] GetCurrentThreadId () returned 0x970 [0064.047] GetCurrentThreadId () returned 0x970 [0064.047] GetCurrentThreadId () returned 0x970 [0064.048] GetCurrentThreadId () returned 0x970 [0064.048] GetCurrentThreadId () returned 0x970 [0064.048] GetCurrentThreadId () returned 0x970 [0064.048] GetCurrentThreadId () returned 0x970 [0064.048] GetCurrentThreadId () returned 0x970 [0064.048] GetCurrentThreadId () returned 0x970 [0064.048] GetCurrentThreadId () returned 0x970 [0064.048] GetCurrentThreadId () returned 0x970 [0064.048] GetCurrentThreadId () returned 0x970 [0064.048] GetCurrentThreadId () returned 0x970 [0064.048] GetCurrentThreadId () returned 0x970 [0064.048] GetCurrentThreadId () returned 0x970 [0064.048] GetCurrentThreadId () returned 0x970 [0064.048] GetCurrentThreadId () returned 0x970 [0064.048] GetCurrentThreadId () returned 0x970 [0064.048] GetCurrentThreadId () returned 0x970 [0064.048] GetCurrentThreadId () returned 0x970 [0064.048] GetCurrentThreadId () returned 0x970 [0064.048] GetCurrentThreadId () returned 0x970 [0064.048] GetCurrentThreadId () returned 0x970 [0064.048] GetCurrentThreadId () returned 0x970 [0064.048] GetCurrentThreadId () returned 0x970 [0064.048] GetCurrentThreadId () returned 0x970 [0064.048] GetCurrentThreadId () returned 0x970 [0064.048] GetCurrentThreadId () returned 0x970 [0064.048] GetCurrentThreadId () returned 0x970 [0064.048] GetCurrentThreadId () returned 0x970 [0064.048] GetCurrentThreadId () returned 0x970 [0064.048] GetCurrentThreadId () returned 0x970 [0064.048] GetCurrentThreadId () returned 0x970 [0064.048] GetCurrentThreadId () returned 0x970 [0064.048] GetCurrentThreadId () returned 0x970 [0064.048] GetCurrentThreadId () returned 0x970 [0064.048] GetCurrentThreadId () returned 0x970 [0064.048] GetCurrentThreadId () returned 0x970 [0064.048] GetCurrentThreadId () returned 0x970 [0064.048] GetCurrentThreadId () returned 0x970 [0064.048] GetCurrentThreadId () returned 0x970 [0064.048] GetCurrentThreadId () returned 0x970 [0064.048] GetCurrentThreadId () returned 0x970 [0064.048] GetCurrentThreadId () returned 0x970 [0064.048] GetCurrentThreadId () returned 0x970 [0064.048] GetCurrentThreadId () returned 0x970 [0064.048] GetCurrentThreadId () returned 0x970 [0064.048] GetCurrentThreadId () returned 0x970 [0064.048] GetCurrentThreadId () returned 0x970 [0064.049] GetCurrentThreadId () returned 0x970 [0064.049] GetCurrentThreadId () returned 0x970 [0064.049] GetCurrentThreadId () returned 0x970 [0064.049] GetCurrentThreadId () returned 0x970 [0064.049] GetCurrentThreadId () returned 0x970 [0064.049] GetCurrentThreadId () returned 0x970 [0064.049] GetCurrentThreadId () returned 0x970 [0064.049] GetCurrentThreadId () returned 0x970 [0064.049] GetCurrentThreadId () returned 0x970 [0064.049] GetCurrentThreadId () returned 0x970 [0064.049] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAEkKoQ4j632KLGu6OwssO+ywZHK2cPr7Qhn/8x2TlAAyXaZua5bGPHMssn/LOlwWA9/4opy0JYxfhGXTQVfUuVrf4kUah+r3VW1T1txSbGzwWFz1w4GVn3gX9s2Euw78yLu2HCTp15X9Thz4W4Hvqrjoyo1nY6r/h0pkgjKncbigR5L6Dsp8kiGYjXW3hyj69ZLL41M7acvfVuIXq1bxzau/nbzTjRAcBA==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0064.049] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAEkKoQ4j632KLGu6OwssO+ywZHK2cPr7Qhn/8x2TlAAyXaZua5bGPHMssn/LOlwWA9/4opy0JYxfhGXTQVfUuVrf4kUah+r3VW1T1txSbGzwWFz1w4GVn3gX9s2Euw78yLu2HCTp15X9Thz4W4Hvqrjoyo1nY6r/h0pkgjKncbigR5L6Dsp8kiGYjXW3hyj69ZLL41M7acvfVuIXq1bxzau/nbzTjRAcBA==", cchWideChar=245, lpMultiByteStr=0x353933c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAEkKoQ4j632KLGu6OwssO+ywZHK2cPr7Qhn/8x2TlAAyXaZua5bGPHMssn/LOlwWA9/4opy0JYxfhGXTQVfUuVrf4kUah+r3VW1T1txSbGzwWFz1w4GVn3gX9s2Euw78yLu2HCTp15X9Thz4W4Hvqrjoyo1nY6r/h0pkgjKncbigR5L6Dsp8kiGYjXW3hyj69ZLL41M7acvfVuIXq1bxzau/nbzTjRAcBA==", lpUsedDefaultChar=0x0) returned 245 [0064.049] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0064.049] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0064.049] CloseHandle (hObject=0x158) returned 1 [0064.049] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png")) returned 0 [0064.049] GetLastError () returned 0x5 [0064.049] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png")) returned 0x20 [0064.049] SetLastError (dwErrCode=0x5) [0064.049] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=18431293907) returned 1 [0064.050] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Файл зашифрован [16to9Squareframe_SelectionSubpicture.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\Файл зашифрован [16to9squareframe_selectionsubpicture.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0064.050] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0064.050] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0064.050] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0064.050] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0064.050] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0064.050] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0064.050] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0064.050] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0064.051] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0064.051] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0064.051] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0064.051] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0064.051] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0064.051] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0064.051] SetEndOfFile (hFile=0x158) returned 1 [0064.051] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0064.051] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0064.051] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0064.051] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0064.051] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0064.052] WriteFile (in: hFile=0x158, lpBuffer=0x35f035c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f035c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0064.052] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="QczB)IeW+i$5P?}nm#(@t.A5sR7GJn$ZkvyG1x!<7", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0064.250] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GS>P?}nm#(@t.A5sR7GJn$ZkvyG1x!<7", cchWideChar=32, lpMultiByteStr=0x2036144, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GS>P?}nm#(@t.A5sR7GJn$ZkvyG1x!<7", lpUsedDefaultChar=0x0) returned 32 [0064.250] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0064.250] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0064.250] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70cace83, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70cace83, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x303d, dwReserved0=0x0, dwReserved1=0x0, cFileName="babyblue.png", cAlternateFileName="")) returned 0x295098 [0064.250] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0064.250] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0064.250] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png")) returned 0x20 [0064.252] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png")) returned 0x20 [0064.252] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png")) returned 0x20 [0064.252] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png")) returned 0x20 [0064.252] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70cace83, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70cace83, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x303d)) returned 1 [0064.252] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0064.252] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0064.252] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png")) returned 0x20 [0064.252] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png")) returned 0x20 [0064.252] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0064.252] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0064.252] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0064.252] SetEndOfFile (hFile=0x158) returned 1 [0064.253] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="babyblue.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0064.253] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="babyblue.png", cchWideChar=12, lpMultiByteStr=0x1fe35ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="babyblue.png", lpUsedDefaultChar=0x0) returned 12 [0064.253] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="babyblue.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0064.253] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="babyblue.png", cchWideChar=12, lpMultiByteStr=0x1fe39ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="babyblue.png", lpUsedDefaultChar=0x0) returned 12 [0064.253] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe39ec, cbMultiByte=12, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="babyblue.pngdeoInset.pnget.pngpngre.pngg") returned 12 [0064.253] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="babyblue.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0064.253] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="babyblue.png", cchWideChar=12, lpMultiByteStr=0x1fe35ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="babyblue.png", lpUsedDefaultChar=0x0) returned 12 [0064.254] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0064.254] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0064.254] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x303d [0064.254] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0064.254] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0064.254] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0064.254] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="babyblue.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0064.254] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="babyblue.png", cchWideChar=12, lpMultiByteStr=0x1fe35ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="babyblue.png", lpUsedDefaultChar=0x0) returned 12 [0064.254] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="babyblue.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0064.254] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="babyblue.png", cchWideChar=12, lpMultiByteStr=0x1fe39ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="babyblue.png", lpUsedDefaultChar=0x0) returned 12 [0064.254] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe39ec, cbMultiByte=12, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="babyblue.pngue.pngdeoInset.pnget.pngpngre.pngg") returned 12 [0064.255] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="babyblue.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0064.255] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="babyblue.png", cchWideChar=12, lpMultiByteStr=0x1fe35ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="babyblue.png", lpUsedDefaultChar=0x0) returned 12 [0064.255] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0064.256] CharToOemA (in: pSrc="babyblue.png", pDst=0x1fe39ec | out: pDst="babyblue.png") returned 1 [0064.256] WriteFile (in: hFile=0x158, lpBuffer=0x1fe39ec*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe39ec*, lpNumberOfBytesWritten=0x18e048*=0xc, lpOverlapped=0x0) returned 1 [0064.256] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0064.256] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0064.256] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0064.256] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=18451965219) returned 1 [0064.256] ReadFile (in: hFile=0x11c, lpBuffer=0x37bf4d0, nNumberOfBytesToRead=0x303d, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37bf4d0*, lpNumberOfBytesRead=0x18dd7c*=0x303d, lpOverlapped=0x0) returned 1 [0064.316] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0064.316] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=18457915006) returned 1 [0064.325] WriteFile (in: hFile=0x158, lpBuffer=0x379ad68*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379ad68*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0064.325] ReadFile (in: hFile=0x11c, lpBuffer=0x37bf4d0, nNumberOfBytesToRead=0x303d, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x37bf4d0*, lpNumberOfBytesRead=0x18de38*=0x303d, lpOverlapped=0x0) returned 1 [0064.325] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x47 [0064.325] WriteFile (in: hFile=0x158, lpBuffer=0x3803df0*, nNumberOfBytesToWrite=0x303d, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3803df0*, lpNumberOfBytesWritten=0x18de10*=0x303d, lpOverlapped=0x0) returned 1 [0064.326] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x3084 [0064.326] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0064.326] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0064.326] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0064.326] SetFilePointer (in: hFile=0x158, lDistanceToMove=12, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2a [0064.326] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x308e [0064.326] CloseHandle (hObject=0x11c) returned 1 [0064.326] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x308e [0064.326] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x308e [0064.327] SetFilePointer (in: hFile=0x158, lDistanceToMove=12430, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x308e [0064.327] SetFilePointer (in: hFile=0x158, lDistanceToMove=12430, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x308e [0064.327] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x308e [0064.327] SetFilePointer (in: hFile=0x158, lDistanceToMove=12430, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x308e [0064.327] SetEndOfFile (hFile=0x158) returned 1 [0064.327] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x308e [0064.327] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x308e [0064.327] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="babyblue.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0064.327] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="babyblue.png", cchWideChar=12, lpMultiByteStr=0x1fe35ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="babyblue.png", lpUsedDefaultChar=0x0) returned 12 [0064.327] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="babyblue.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0064.327] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="babyblue.png", cchWideChar=12, lpMultiByteStr=0x1fe43ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="babyblue.png", lpUsedDefaultChar=0x0) returned 12 [0064.327] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe43ec, cbMultiByte=12, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="babyblue.pngꞗ@涤(\x18믉`믑`") returned 12 [0064.327] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="babyblue.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0064.327] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="babyblue.png", cchWideChar=12, lpMultiByteStr=0x1fe35ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="babyblue.png", lpUsedDefaultChar=0x0) returned 12 [0064.327] WriteFile (in: hFile=0x158, lpBuffer=0x37a2fa8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x37a2fa8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0064.327] CharToOemA (in: pSrc="babyblue.png", pDst=0x1fe43ec | out: pDst="babyblue.png") returned 1 [0064.327] WriteFile (in: hFile=0x158, lpBuffer=0x1fe43ec*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe43ec*, lpNumberOfBytesWritten=0x18efcc*=0xc, lpOverlapped=0x0) returned 1 [0064.328] WriteFile (in: hFile=0x158, lpBuffer=0x379ae18*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379ae18*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0064.328] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0064.328] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0064.328] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x30d3 [0064.328] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x30d3 [0064.328] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0064.328] WriteFile (in: hFile=0x158, lpBuffer=0x35f04dc*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f04dc*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0064.328] DeleteFileW (lpFileName="") returned 0 [0064.328] GetLastError () returned 0x3 [0064.328] GetFileAttributesW (lpFileName="") returned 0xffffffff [0064.328] SetLastError (dwErrCode=0x3) [0064.328] FlushFileBuffers (hFile=0x158) returned 1 [0064.331] GetCurrentThreadId () returned 0x970 [0064.331] GetCurrentThreadId () returned 0x970 [0064.331] GetCurrentThreadId () returned 0x970 [0064.332] GetCurrentThreadId () returned 0x970 [0064.332] GetCurrentThreadId () returned 0x970 [0064.332] GetCurrentThreadId () returned 0x970 [0064.332] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x318a [0064.332] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x318a [0064.332] SetFilePointer (in: hFile=0x158, lDistanceToMove=12682, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x318a [0064.332] CloseHandle (hObject=0x158) returned 1 [0064.332] GetCurrentThreadId () returned 0x970 [0064.332] GetCurrentThreadId () returned 0x970 [0064.332] GetCurrentThreadId () returned 0x970 [0064.332] GetCurrentThreadId () returned 0x970 [0064.332] GetCurrentThreadId () returned 0x970 [0064.332] GetCurrentThreadId () returned 0x970 [0064.332] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\Файл зашифрован [babyblue.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\Файл зашифрован [babyblue.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0064.332] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x318a [0064.332] SetFilePointer (in: hFile=0x158, lDistanceToMove=12554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x310a [0064.332] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0064.332] GetFileType (hFile=0x158) returned 0x1 [0064.333] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xb, wMilliseconds=0x264)) [0064.333] GetCurrentThreadId () returned 0x970 [0064.333] GetCurrentThreadId () returned 0x970 [0064.333] GetCurrentThreadId () returned 0x970 [0064.333] GetCurrentThreadId () returned 0x970 [0064.333] GetCurrentThreadId () returned 0x970 [0064.333] GetCurrentThreadId () returned 0x970 [0064.333] GetCurrentThreadId () returned 0x970 [0064.333] GetCurrentThreadId () returned 0x970 [0064.333] GetCurrentThreadId () returned 0x970 [0064.333] GetCurrentThreadId () returned 0x970 [0064.333] GetCurrentThreadId () returned 0x970 [0064.333] GetCurrentThreadId () returned 0x970 [0064.333] GetCurrentThreadId () returned 0x970 [0064.333] GetCurrentThreadId () returned 0x970 [0064.333] GetCurrentThreadId () returned 0x970 [0064.333] GetCurrentThreadId () returned 0x970 [0064.333] GetCurrentThreadId () returned 0x970 [0064.333] GetCurrentThreadId () returned 0x970 [0064.333] GetCurrentThreadId () returned 0x970 [0064.333] GetCurrentThreadId () returned 0x970 [0064.333] GetCurrentThreadId () returned 0x970 [0064.333] GetCurrentThreadId () returned 0x970 [0064.333] GetCurrentThreadId () returned 0x970 [0064.333] GetCurrentThreadId () returned 0x970 [0064.333] GetCurrentThreadId () returned 0x970 [0064.333] GetCurrentThreadId () returned 0x970 [0064.333] GetCurrentThreadId () returned 0x970 [0064.333] GetCurrentThreadId () returned 0x970 [0064.333] GetCurrentThreadId () returned 0x970 [0064.333] GetCurrentThreadId () returned 0x970 [0064.333] GetCurrentThreadId () returned 0x970 [0064.333] GetCurrentThreadId () returned 0x970 [0064.333] GetCurrentThreadId () returned 0x970 [0064.333] GetCurrentThreadId () returned 0x970 [0064.333] GetCurrentThreadId () returned 0x970 [0064.333] GetCurrentThreadId () returned 0x970 [0064.333] GetCurrentThreadId () returned 0x970 [0064.333] GetCurrentThreadId () returned 0x970 [0064.333] GetCurrentThreadId () returned 0x970 [0064.333] GetCurrentThreadId () returned 0x970 [0064.333] GetCurrentThreadId () returned 0x970 [0064.333] GetCurrentThreadId () returned 0x970 [0064.333] GetCurrentThreadId () returned 0x970 [0064.334] GetCurrentThreadId () returned 0x970 [0064.334] GetCurrentThreadId () returned 0x970 [0064.334] GetCurrentThreadId () returned 0x970 [0064.334] GetCurrentThreadId () returned 0x970 [0064.334] GetCurrentThreadId () returned 0x970 [0064.334] GetCurrentThreadId () returned 0x970 [0064.334] GetCurrentThreadId () returned 0x970 [0064.334] GetCurrentThreadId () returned 0x970 [0064.334] GetCurrentThreadId () returned 0x970 [0064.334] GetCurrentThreadId () returned 0x970 [0064.334] GetCurrentThreadId () returned 0x970 [0064.334] GetCurrentThreadId () returned 0x970 [0064.334] GetCurrentThreadId () returned 0x970 [0064.334] GetCurrentThreadId () returned 0x970 [0064.334] GetCurrentThreadId () returned 0x970 [0064.334] GetCurrentThreadId () returned 0x970 [0064.334] GetCurrentThreadId () returned 0x970 [0064.334] GetCurrentThreadId () returned 0x970 [0064.334] GetCurrentThreadId () returned 0x970 [0064.334] GetCurrentThreadId () returned 0x970 [0064.334] GetCurrentThreadId () returned 0x970 [0064.334] GetCurrentThreadId () returned 0x970 [0064.334] GetCurrentThreadId () returned 0x970 [0064.334] GetCurrentThreadId () returned 0x970 [0064.334] GetCurrentThreadId () returned 0x970 [0064.334] GetCurrentThreadId () returned 0x970 [0064.334] GetCurrentThreadId () returned 0x970 [0064.334] GetCurrentThreadId () returned 0x970 [0064.334] GetCurrentThreadId () returned 0x970 [0064.334] GetCurrentThreadId () returned 0x970 [0064.334] GetCurrentThreadId () returned 0x970 [0064.334] GetCurrentThreadId () returned 0x970 [0064.334] GetCurrentThreadId () returned 0x970 [0064.334] GetCurrentThreadId () returned 0x970 [0064.334] GetCurrentThreadId () returned 0x970 [0064.334] GetCurrentThreadId () returned 0x970 [0064.334] GetCurrentThreadId () returned 0x970 [0064.334] GetCurrentThreadId () returned 0x970 [0064.334] GetCurrentThreadId () returned 0x970 [0064.334] GetCurrentThreadId () returned 0x970 [0064.334] GetCurrentThreadId () returned 0x970 [0064.334] GetCurrentThreadId () returned 0x970 [0064.334] GetCurrentThreadId () returned 0x970 [0064.334] GetCurrentThreadId () returned 0x970 [0064.334] GetCurrentThreadId () returned 0x970 [0064.335] GetCurrentThreadId () returned 0x970 [0064.335] GetCurrentThreadId () returned 0x970 [0064.335] GetCurrentThreadId () returned 0x970 [0064.335] GetCurrentThreadId () returned 0x970 [0064.335] GetCurrentThreadId () returned 0x970 [0064.335] GetCurrentThreadId () returned 0x970 [0064.335] GetCurrentThreadId () returned 0x970 [0064.335] GetCurrentThreadId () returned 0x970 [0064.335] GetCurrentThreadId () returned 0x970 [0064.335] GetCurrentThreadId () returned 0x970 [0064.335] GetCurrentThreadId () returned 0x970 [0064.335] GetCurrentThreadId () returned 0x970 [0064.335] GetCurrentThreadId () returned 0x970 [0064.335] GetCurrentThreadId () returned 0x970 [0064.335] GetCurrentThreadId () returned 0x970 [0064.335] GetCurrentThreadId () returned 0x970 [0064.335] GetCurrentThreadId () returned 0x970 [0064.335] GetCurrentThreadId () returned 0x970 [0064.335] GetCurrentThreadId () returned 0x970 [0064.335] GetCurrentThreadId () returned 0x970 [0064.335] GetCurrentThreadId () returned 0x970 [0064.335] GetCurrentThreadId () returned 0x970 [0064.335] GetCurrentThreadId () returned 0x970 [0064.335] GetCurrentThreadId () returned 0x970 [0064.335] GetCurrentThreadId () returned 0x970 [0064.335] GetCurrentThreadId () returned 0x970 [0064.335] GetCurrentThreadId () returned 0x970 [0064.335] GetCurrentThreadId () returned 0x970 [0064.335] GetCurrentThreadId () returned 0x970 [0064.335] GetCurrentThreadId () returned 0x970 [0064.335] GetCurrentThreadId () returned 0x970 [0064.335] GetCurrentThreadId () returned 0x970 [0064.335] GetCurrentThreadId () returned 0x970 [0064.335] GetCurrentThreadId () returned 0x970 [0064.335] GetCurrentThreadId () returned 0x970 [0064.335] GetCurrentThreadId () returned 0x970 [0064.335] GetCurrentThreadId () returned 0x970 [0064.335] GetCurrentThreadId () returned 0x970 [0064.335] GetCurrentThreadId () returned 0x970 [0064.335] GetCurrentThreadId () returned 0x970 [0064.335] GetCurrentThreadId () returned 0x970 [0064.335] GetCurrentThreadId () returned 0x970 [0064.335] GetCurrentThreadId () returned 0x970 [0064.335] GetCurrentThreadId () returned 0x970 [0064.335] GetCurrentThreadId () returned 0x970 [0064.335] GetCurrentThreadId () returned 0x970 [0064.336] GetCurrentThreadId () returned 0x970 [0064.336] GetCurrentThreadId () returned 0x970 [0064.336] GetCurrentThreadId () returned 0x970 [0064.336] GetCurrentThreadId () returned 0x970 [0064.336] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.336] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.336] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379b298, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0064.336] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.336] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.336] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379b298, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0064.336] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.336] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.336] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0064.336] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.336] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.336] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0064.336] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.336] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.336] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379b2f8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0064.336] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.336] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.336] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379b2f8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0064.336] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.336] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.336] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379b2f8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0064.336] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xb, wMilliseconds=0x264)) [0064.336] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GS>P?}nm#(@t.A5sR7GJn$ZkvyG1x!<7", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0064.336] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GS>P?}nm#(@t.A5sR7GJn$ZkvyG1x!<7", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0064.336] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GS>P?}nm#(@t.A5sR7GJn$ZkvyG1x!<7", cchWideChar=32, lpMultiByteStr=0x20037d8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GS>P?}nm#(@t.A5sR7GJn$ZkvyG1x!<7", lpUsedDefaultChar=0x0) returned 32 [0064.336] GetCurrentThreadId () returned 0x970 [0064.336] GetCurrentThreadId () returned 0x970 [0064.336] GetCurrentThreadId () returned 0x970 [0064.337] GetCurrentThreadId () returned 0x970 [0064.337] GetCurrentThreadId () returned 0x970 [0064.337] GetCurrentThreadId () returned 0x970 [0064.344] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0064.344] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0064.344] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x37972b8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0064.344] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb248, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0064.344] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb248, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAABWDRDqfrAjqBb+GNMFlc87b7/kqEww7xXJFVH7/L2sptdhcNWHyFr/0Ueu1XwiyHuSv2zddG3N4fPyOkTJEjK8zK8FIjj281mhKrPibcilOgberOw2l8kF689f3czXtB5bxmJM6m2Sq/6b9lbIlAMI7KzFe23BIlTJUsc+/kx3zIn/slFfSL2uaIiaAXBykboaer2gLjAQRvsHS5dNb/tggvEc8KXoJog==") returned 232 [0064.344] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xb, wMilliseconds=0x264)) [0064.344] GetCurrentThreadId () returned 0x970 [0064.344] GetCurrentThreadId () returned 0x970 [0064.344] GetCurrentThreadId () returned 0x970 [0064.344] GetCurrentThreadId () returned 0x970 [0064.344] GetCurrentThreadId () returned 0x970 [0064.344] GetCurrentThreadId () returned 0x970 [0064.344] GetCurrentThreadId () returned 0x970 [0064.344] GetCurrentThreadId () returned 0x970 [0064.344] GetCurrentThreadId () returned 0x970 [0064.344] GetCurrentThreadId () returned 0x970 [0064.344] GetCurrentThreadId () returned 0x970 [0064.344] GetCurrentThreadId () returned 0x970 [0064.345] GetCurrentThreadId () returned 0x970 [0064.345] GetCurrentThreadId () returned 0x970 [0064.345] GetCurrentThreadId () returned 0x970 [0064.345] GetCurrentThreadId () returned 0x970 [0064.345] GetCurrentThreadId () returned 0x970 [0064.345] GetCurrentThreadId () returned 0x970 [0064.345] GetCurrentThreadId () returned 0x970 [0064.345] GetCurrentThreadId () returned 0x970 [0064.345] GetCurrentThreadId () returned 0x970 [0064.345] GetCurrentThreadId () returned 0x970 [0064.345] GetCurrentThreadId () returned 0x970 [0064.345] GetCurrentThreadId () returned 0x970 [0064.345] GetCurrentThreadId () returned 0x970 [0064.345] GetCurrentThreadId () returned 0x970 [0064.345] GetCurrentThreadId () returned 0x970 [0064.345] GetCurrentThreadId () returned 0x970 [0064.345] GetCurrentThreadId () returned 0x970 [0064.345] GetCurrentThreadId () returned 0x970 [0064.345] GetCurrentThreadId () returned 0x970 [0064.345] GetCurrentThreadId () returned 0x970 [0064.345] GetCurrentThreadId () returned 0x970 [0064.345] GetCurrentThreadId () returned 0x970 [0064.345] GetCurrentThreadId () returned 0x970 [0064.345] GetCurrentThreadId () returned 0x970 [0064.345] GetCurrentThreadId () returned 0x970 [0064.345] GetCurrentThreadId () returned 0x970 [0064.345] GetCurrentThreadId () returned 0x970 [0064.345] GetCurrentThreadId () returned 0x970 [0064.345] GetCurrentThreadId () returned 0x970 [0064.345] GetCurrentThreadId () returned 0x970 [0064.345] GetCurrentThreadId () returned 0x970 [0064.345] GetCurrentThreadId () returned 0x970 [0064.345] GetCurrentThreadId () returned 0x970 [0064.345] GetCurrentThreadId () returned 0x970 [0064.345] GetCurrentThreadId () returned 0x970 [0064.345] GetCurrentThreadId () returned 0x970 [0064.345] GetCurrentThreadId () returned 0x970 [0064.345] GetCurrentThreadId () returned 0x970 [0064.346] GetCurrentThreadId () returned 0x970 [0064.346] GetCurrentThreadId () returned 0x970 [0064.346] GetCurrentThreadId () returned 0x970 [0064.346] GetCurrentThreadId () returned 0x970 [0064.346] GetCurrentThreadId () returned 0x970 [0064.346] GetCurrentThreadId () returned 0x970 [0064.346] GetCurrentThreadId () returned 0x970 [0064.346] GetCurrentThreadId () returned 0x970 [0064.346] GetCurrentThreadId () returned 0x970 [0064.346] GetCurrentThreadId () returned 0x970 [0064.346] GetCurrentThreadId () returned 0x970 [0064.346] GetCurrentThreadId () returned 0x970 [0064.346] GetCurrentThreadId () returned 0x970 [0064.346] GetCurrentThreadId () returned 0x970 [0064.346] GetCurrentThreadId () returned 0x970 [0064.346] GetCurrentThreadId () returned 0x970 [0064.346] GetCurrentThreadId () returned 0x970 [0064.346] GetCurrentThreadId () returned 0x970 [0064.346] GetCurrentThreadId () returned 0x970 [0064.346] GetCurrentThreadId () returned 0x970 [0064.346] GetCurrentThreadId () returned 0x970 [0064.346] GetCurrentThreadId () returned 0x970 [0064.346] GetCurrentThreadId () returned 0x970 [0064.346] GetCurrentThreadId () returned 0x970 [0064.346] GetCurrentThreadId () returned 0x970 [0064.346] GetCurrentThreadId () returned 0x970 [0064.346] GetCurrentThreadId () returned 0x970 [0064.346] GetCurrentThreadId () returned 0x970 [0064.346] GetCurrentThreadId () returned 0x970 [0064.346] GetCurrentThreadId () returned 0x970 [0064.346] GetCurrentThreadId () returned 0x970 [0064.346] GetCurrentThreadId () returned 0x970 [0064.346] GetCurrentThreadId () returned 0x970 [0064.346] GetCurrentThreadId () returned 0x970 [0064.346] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAABWDRDqfrAjqBb+GNMFlc87b7/kqEww7xXJFVH7/L2sptdhcNWHyFr/0Ueu1XwiyHuSv2zddG3N4fPyOkTJEjK8zK8FIjj281mhKrPibcilOgberOw2l8kF689f3czXtB5bxmJM6m2Sq/6b9lbIlAMI7KzFe23BIlTJUsc+/kx3zIn/slFfSL2uaIiaAXBykboaer2gLjAQRvsHS5dNb/tggvEc8KXoJog==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0064.346] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAABWDRDqfrAjqBb+GNMFlc87b7/kqEww7xXJFVH7/L2sptdhcNWHyFr/0Ueu1XwiyHuSv2zddG3N4fPyOkTJEjK8zK8FIjj281mhKrPibcilOgberOw2l8kF689f3czXtB5bxmJM6m2Sq/6b9lbIlAMI7KzFe23BIlTJUsc+/kx3zIn/slFfSL2uaIiaAXBykboaer2gLjAQRvsHS5dNb/tggvEc8KXoJog==", cchWideChar=245, lpMultiByteStr=0x353933c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAABWDRDqfrAjqBb+GNMFlc87b7/kqEww7xXJFVH7/L2sptdhcNWHyFr/0Ueu1XwiyHuSv2zddG3N4fPyOkTJEjK8zK8FIjj281mhKrPibcilOgberOw2l8kF689f3czXtB5bxmJM6m2Sq/6b9lbIlAMI7KzFe23BIlTJUsc+/kx3zIn/slFfSL2uaIiaAXBykboaer2gLjAQRvsHS5dNb/tggvEc8KXoJog==", lpUsedDefaultChar=0x0) returned 245 [0064.346] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0064.347] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0064.347] CloseHandle (hObject=0x158) returned 1 [0064.347] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png")) returned 0 [0064.347] GetLastError () returned 0x5 [0064.347] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png")) returned 0x20 [0064.347] SetLastError (dwErrCode=0x5) [0064.347] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=18461106762) returned 1 [0064.348] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\Файл зашифрован [LightBlueRectangle.PNG].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\Файл зашифрован [lightbluerectangle.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0064.348] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0064.348] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0064.348] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0064.348] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0064.348] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0064.349] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0064.349] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0064.349] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0064.349] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0064.349] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0064.349] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0064.349] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0064.349] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0064.349] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0064.349] SetEndOfFile (hFile=0x158) returned 1 [0064.349] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0064.349] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0064.349] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0064.349] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0064.349] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0064.350] WriteFile (in: hFile=0x158, lpBuffer=0x35f035c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f035c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0064.350] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="%$*KEhbUJnB~57$LBjCbYd}}mjiEQp2\"", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0064.350] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="%$*KEhbUJnB~57$LBjCbYd}}mjiEQp2\"", cchWideChar=32, lpMultiByteStr=0x203610c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="%$*KEhbUJnB~57$LBjCbYd}}mjiEQp2\"", lpUsedDefaultChar=0x0) returned 32 [0064.350] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0064.350] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0064.351] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70fa69c7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70fa69c7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f0141b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="LightBlueRectangle.PNG", cAlternateFileName="")) returned 0x295098 [0064.351] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0064.351] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0064.351] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\lightbluerectangle.png")) returned 0x20 [0064.351] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\lightbluerectangle.png")) returned 0x20 [0064.351] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\lightbluerectangle.png")) returned 0x20 [0064.352] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\lightbluerectangle.png")) returned 0x20 [0064.352] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\lightbluerectangle.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70fa69c7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70fa69c7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f0141b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdc)) returned 1 [0064.352] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0064.352] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0064.352] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\lightbluerectangle.png")) returned 0x20 [0064.352] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\lightbluerectangle.png")) returned 0x20 [0064.352] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0064.352] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0064.352] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0064.352] SetEndOfFile (hFile=0x158) returned 1 [0064.353] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="LightBlueRectangle.PNG", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0064.353] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="LightBlueRectangle.PNG", cchWideChar=22, lpMultiByteStr=0x1ff899c, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LightBlueRectangle.PNG", lpUsedDefaultChar=0x0) returned 22 [0064.353] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="LightBlueRectangle.PNG", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0064.353] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="LightBlueRectangle.PNG", cchWideChar=22, lpMultiByteStr=0x1ff89ec, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LightBlueRectangle.PNG", lpUsedDefaultChar=0x0) returned 22 [0064.353] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff89ec, cbMultiByte=22, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="LightBlueRectangle.PNGnget.pngpngre.pngg") returned 22 [0064.353] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="LightBlueRectangle.PNG", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0064.353] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="LightBlueRectangle.PNG", cchWideChar=22, lpMultiByteStr=0x1ff899c, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LightBlueRectangle.PNG", lpUsedDefaultChar=0x0) returned 22 [0064.353] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\lightbluerectangle.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0064.353] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0064.353] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0xdc [0064.354] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0064.354] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0064.354] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0064.354] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="LightBlueRectangle.PNG", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0064.354] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="LightBlueRectangle.PNG", cchWideChar=22, lpMultiByteStr=0x1ff899c, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LightBlueRectangle.PNG", lpUsedDefaultChar=0x0) returned 22 [0064.354] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="LightBlueRectangle.PNG", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0064.354] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="LightBlueRectangle.PNG", cchWideChar=22, lpMultiByteStr=0x1ff89ec, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LightBlueRectangle.PNG", lpUsedDefaultChar=0x0) returned 22 [0064.354] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff89ec, cbMultiByte=22, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="LightBlueRectangle.PNGle.PNGnget.pngpngre.pngg") returned 22 [0064.354] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="LightBlueRectangle.PNG", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0064.354] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="LightBlueRectangle.PNG", cchWideChar=22, lpMultiByteStr=0x1ff899c, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LightBlueRectangle.PNG", lpUsedDefaultChar=0x0) returned 22 [0064.354] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0064.355] CharToOemA (in: pSrc="LightBlueRectangle.PNG", pDst=0x1ff89ec | out: pDst="LightBlueRectangle.PNG") returned 1 [0064.355] WriteFile (in: hFile=0x158, lpBuffer=0x1ff89ec*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1ff89ec*, lpNumberOfBytesWritten=0x18e048*=0x16, lpOverlapped=0x0) returned 1 [0064.355] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0064.355] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0064.355] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0064.355] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=18461875264) returned 1 [0064.355] ReadFile (in: hFile=0x11c, lpBuffer=0x3785830, nNumberOfBytesToRead=0xdc, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3785830*, lpNumberOfBytesRead=0x18dd7c*=0xdc, lpOverlapped=0x0) returned 1 [0064.356] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0064.356] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=18461968987) returned 1 [0064.365] WriteFile (in: hFile=0x158, lpBuffer=0x379ae40*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379ae40*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0064.365] ReadFile (in: hFile=0x11c, lpBuffer=0x3785830, nNumberOfBytesToRead=0xdc, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3785830*, lpNumberOfBytesRead=0x18de38*=0xdc, lpOverlapped=0x0) returned 1 [0064.365] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x51 [0064.365] WriteFile (in: hFile=0x158, lpBuffer=0x3785910*, nNumberOfBytesToWrite=0xdc, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3785910*, lpNumberOfBytesWritten=0x18de10*=0xdc, lpOverlapped=0x0) returned 1 [0064.365] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x12d [0064.365] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0064.365] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0064.365] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0064.366] SetFilePointer (in: hFile=0x158, lDistanceToMove=22, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x34 [0064.366] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x137 [0064.366] CloseHandle (hObject=0x11c) returned 1 [0064.366] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x137 [0064.366] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x137 [0064.366] SetFilePointer (in: hFile=0x158, lDistanceToMove=311, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x137 [0064.366] SetFilePointer (in: hFile=0x158, lDistanceToMove=311, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x137 [0064.366] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x137 [0064.366] SetFilePointer (in: hFile=0x158, lDistanceToMove=311, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x137 [0064.366] SetEndOfFile (hFile=0x158) returned 1 [0064.366] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x137 [0064.366] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x137 [0064.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="LightBlueRectangle.PNG", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0064.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="LightBlueRectangle.PNG", cchWideChar=22, lpMultiByteStr=0x1ff89ec, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LightBlueRectangle.PNG", lpUsedDefaultChar=0x0) returned 22 [0064.367] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="LightBlueRectangle.PNG", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0064.367] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="LightBlueRectangle.PNG", cchWideChar=22, lpMultiByteStr=0x1ff899c, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LightBlueRectangle.PNG", lpUsedDefaultChar=0x0) returned 22 [0064.367] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff899c, cbMultiByte=22, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="LightBlueRectangle.PNG") returned 22 [0064.367] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="LightBlueRectangle.PNG", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0064.367] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="LightBlueRectangle.PNG", cchWideChar=22, lpMultiByteStr=0x1ff89ec, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LightBlueRectangle.PNG", lpUsedDefaultChar=0x0) returned 22 [0064.367] WriteFile (in: hFile=0x158, lpBuffer=0x37a2fa8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x37a2fa8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0064.367] CharToOemA (in: pSrc="LightBlueRectangle.PNG", pDst=0x1ff899c | out: pDst="LightBlueRectangle.PNG") returned 1 [0064.367] WriteFile (in: hFile=0x158, lpBuffer=0x1ff899c*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1ff899c*, lpNumberOfBytesWritten=0x18efcc*=0x16, lpOverlapped=0x0) returned 1 [0064.367] WriteFile (in: hFile=0x158, lpBuffer=0x379acf8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379acf8*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0064.367] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0064.367] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0064.367] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x186 [0064.367] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x186 [0064.367] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0064.367] WriteFile (in: hFile=0x158, lpBuffer=0x35f035c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f035c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0064.368] DeleteFileW (lpFileName="") returned 0 [0064.368] GetLastError () returned 0x3 [0064.368] GetFileAttributesW (lpFileName="") returned 0xffffffff [0064.368] SetLastError (dwErrCode=0x3) [0064.368] FlushFileBuffers (hFile=0x158) returned 1 [0064.371] GetCurrentThreadId () returned 0x970 [0064.371] GetCurrentThreadId () returned 0x970 [0064.371] GetCurrentThreadId () returned 0x970 [0064.371] GetCurrentThreadId () returned 0x970 [0064.371] GetCurrentThreadId () returned 0x970 [0064.371] GetCurrentThreadId () returned 0x970 [0064.371] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x23d [0064.371] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x23d [0064.371] SetFilePointer (in: hFile=0x158, lDistanceToMove=573, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x23d [0064.371] CloseHandle (hObject=0x158) returned 1 [0064.371] GetCurrentThreadId () returned 0x970 [0064.372] GetCurrentThreadId () returned 0x970 [0064.372] GetCurrentThreadId () returned 0x970 [0064.372] GetCurrentThreadId () returned 0x970 [0064.372] GetCurrentThreadId () returned 0x970 [0064.372] GetCurrentThreadId () returned 0x970 [0064.372] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\Файл зашифрован [LightBlueRectangle.PNG].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\Файл зашифрован [lightbluerectangle.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0064.372] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x23d [0064.372] SetFilePointer (in: hFile=0x158, lDistanceToMove=445, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1bd [0064.372] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0064.372] GetFileType (hFile=0x158) returned 0x1 [0064.372] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xb, wMilliseconds=0x283)) [0064.372] GetCurrentThreadId () returned 0x970 [0064.372] GetCurrentThreadId () returned 0x970 [0064.372] GetCurrentThreadId () returned 0x970 [0064.372] GetCurrentThreadId () returned 0x970 [0064.372] GetCurrentThreadId () returned 0x970 [0064.372] GetCurrentThreadId () returned 0x970 [0064.372] GetCurrentThreadId () returned 0x970 [0064.372] GetCurrentThreadId () returned 0x970 [0064.372] GetCurrentThreadId () returned 0x970 [0064.372] GetCurrentThreadId () returned 0x970 [0064.372] GetCurrentThreadId () returned 0x970 [0064.372] GetCurrentThreadId () returned 0x970 [0064.372] GetCurrentThreadId () returned 0x970 [0064.372] GetCurrentThreadId () returned 0x970 [0064.372] GetCurrentThreadId () returned 0x970 [0064.372] GetCurrentThreadId () returned 0x970 [0064.372] GetCurrentThreadId () returned 0x970 [0064.372] GetCurrentThreadId () returned 0x970 [0064.372] GetCurrentThreadId () returned 0x970 [0064.372] GetCurrentThreadId () returned 0x970 [0064.373] GetCurrentThreadId () returned 0x970 [0064.373] GetCurrentThreadId () returned 0x970 [0064.373] GetCurrentThreadId () returned 0x970 [0064.373] GetCurrentThreadId () returned 0x970 [0064.373] GetCurrentThreadId () returned 0x970 [0064.373] GetCurrentThreadId () returned 0x970 [0064.373] GetCurrentThreadId () returned 0x970 [0064.373] GetCurrentThreadId () returned 0x970 [0064.373] GetCurrentThreadId () returned 0x970 [0064.373] GetCurrentThreadId () returned 0x970 [0064.373] GetCurrentThreadId () returned 0x970 [0064.373] GetCurrentThreadId () returned 0x970 [0064.373] GetCurrentThreadId () returned 0x970 [0064.373] GetCurrentThreadId () returned 0x970 [0064.373] GetCurrentThreadId () returned 0x970 [0064.373] GetCurrentThreadId () returned 0x970 [0064.373] GetCurrentThreadId () returned 0x970 [0064.373] GetCurrentThreadId () returned 0x970 [0064.373] GetCurrentThreadId () returned 0x970 [0064.373] GetCurrentThreadId () returned 0x970 [0064.373] GetCurrentThreadId () returned 0x970 [0064.373] GetCurrentThreadId () returned 0x970 [0064.373] GetCurrentThreadId () returned 0x970 [0064.373] GetCurrentThreadId () returned 0x970 [0064.373] GetCurrentThreadId () returned 0x970 [0064.373] GetCurrentThreadId () returned 0x970 [0064.373] GetCurrentThreadId () returned 0x970 [0064.373] GetCurrentThreadId () returned 0x970 [0064.373] GetCurrentThreadId () returned 0x970 [0064.373] GetCurrentThreadId () returned 0x970 [0064.373] GetCurrentThreadId () returned 0x970 [0064.373] GetCurrentThreadId () returned 0x970 [0064.373] GetCurrentThreadId () returned 0x970 [0064.373] GetCurrentThreadId () returned 0x970 [0064.373] GetCurrentThreadId () returned 0x970 [0064.373] GetCurrentThreadId () returned 0x970 [0064.373] GetCurrentThreadId () returned 0x970 [0064.373] GetCurrentThreadId () returned 0x970 [0064.373] GetCurrentThreadId () returned 0x970 [0064.373] GetCurrentThreadId () returned 0x970 [0064.373] GetCurrentThreadId () returned 0x970 [0064.373] GetCurrentThreadId () returned 0x970 [0064.373] GetCurrentThreadId () returned 0x970 [0064.373] GetCurrentThreadId () returned 0x970 [0064.373] GetCurrentThreadId () returned 0x970 [0064.374] GetCurrentThreadId () returned 0x970 [0064.374] GetCurrentThreadId () returned 0x970 [0064.374] GetCurrentThreadId () returned 0x970 [0064.374] GetCurrentThreadId () returned 0x970 [0064.374] GetCurrentThreadId () returned 0x970 [0064.374] GetCurrentThreadId () returned 0x970 [0064.374] GetCurrentThreadId () returned 0x970 [0064.374] GetCurrentThreadId () returned 0x970 [0064.374] GetCurrentThreadId () returned 0x970 [0064.374] GetCurrentThreadId () returned 0x970 [0064.374] GetCurrentThreadId () returned 0x970 [0064.374] GetCurrentThreadId () returned 0x970 [0064.374] GetCurrentThreadId () returned 0x970 [0064.374] GetCurrentThreadId () returned 0x970 [0064.374] GetCurrentThreadId () returned 0x970 [0064.374] GetCurrentThreadId () returned 0x970 [0064.374] GetCurrentThreadId () returned 0x970 [0064.374] GetCurrentThreadId () returned 0x970 [0064.374] GetCurrentThreadId () returned 0x970 [0064.374] GetCurrentThreadId () returned 0x970 [0064.374] GetCurrentThreadId () returned 0x970 [0064.374] GetCurrentThreadId () returned 0x970 [0064.374] GetCurrentThreadId () returned 0x970 [0064.374] GetCurrentThreadId () returned 0x970 [0064.374] GetCurrentThreadId () returned 0x970 [0064.374] GetCurrentThreadId () returned 0x970 [0064.374] GetCurrentThreadId () returned 0x970 [0064.374] GetCurrentThreadId () returned 0x970 [0064.374] GetCurrentThreadId () returned 0x970 [0064.374] GetCurrentThreadId () returned 0x970 [0064.374] GetCurrentThreadId () returned 0x970 [0064.374] GetCurrentThreadId () returned 0x970 [0064.374] GetCurrentThreadId () returned 0x970 [0064.374] GetCurrentThreadId () returned 0x970 [0064.374] GetCurrentThreadId () returned 0x970 [0064.374] GetCurrentThreadId () returned 0x970 [0064.374] GetCurrentThreadId () returned 0x970 [0064.374] GetCurrentThreadId () returned 0x970 [0064.374] GetCurrentThreadId () returned 0x970 [0064.374] GetCurrentThreadId () returned 0x970 [0064.374] GetCurrentThreadId () returned 0x970 [0064.374] GetCurrentThreadId () returned 0x970 [0064.374] GetCurrentThreadId () returned 0x970 [0064.374] GetCurrentThreadId () returned 0x970 [0064.374] GetCurrentThreadId () returned 0x970 [0064.374] GetCurrentThreadId () returned 0x970 [0064.375] GetCurrentThreadId () returned 0x970 [0064.375] GetCurrentThreadId () returned 0x970 [0064.375] GetCurrentThreadId () returned 0x970 [0064.375] GetCurrentThreadId () returned 0x970 [0064.375] GetCurrentThreadId () returned 0x970 [0064.375] GetCurrentThreadId () returned 0x970 [0064.375] GetCurrentThreadId () returned 0x970 [0064.375] GetCurrentThreadId () returned 0x970 [0064.375] GetCurrentThreadId () returned 0x970 [0064.375] GetCurrentThreadId () returned 0x970 [0064.375] GetCurrentThreadId () returned 0x970 [0064.375] GetCurrentThreadId () returned 0x970 [0064.375] GetCurrentThreadId () returned 0x970 [0064.375] GetCurrentThreadId () returned 0x970 [0064.375] GetCurrentThreadId () returned 0x970 [0064.375] GetCurrentThreadId () returned 0x970 [0064.375] GetCurrentThreadId () returned 0x970 [0064.375] GetCurrentThreadId () returned 0x970 [0064.375] GetCurrentThreadId () returned 0x970 [0064.375] GetCurrentThreadId () returned 0x970 [0064.375] GetCurrentThreadId () returned 0x970 [0064.375] GetCurrentThreadId () returned 0x970 [0064.375] GetCurrentThreadId () returned 0x970 [0064.375] GetCurrentThreadId () returned 0x970 [0064.375] GetCurrentThreadId () returned 0x970 [0064.375] GetCurrentThreadId () returned 0x970 [0064.375] GetCurrentThreadId () returned 0x970 [0064.375] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.375] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.375] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379b2f8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0064.375] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.375] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.375] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379b2f8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0064.375] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.375] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.375] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0064.375] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.375] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.375] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0064.375] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.376] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.376] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379b358, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0064.376] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.376] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.376] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379b358, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0064.376] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.376] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.376] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379b358, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0064.376] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xb, wMilliseconds=0x283)) [0064.376] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="%$*KEhbUJnB~57$LBjCbYd}}mjiEQp2\"", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0064.376] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="%$*KEhbUJnB~57$LBjCbYd}}mjiEQp2\"", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0064.376] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="%$*KEhbUJnB~57$LBjCbYd}}mjiEQp2\"", cchWideChar=32, lpMultiByteStr=0x2003748, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="%$*KEhbUJnB~57$LBjCbYd}}mjiEQp2\"", lpUsedDefaultChar=0x0) returned 32 [0064.376] GetCurrentThreadId () returned 0x970 [0064.376] GetCurrentThreadId () returned 0x970 [0064.376] GetCurrentThreadId () returned 0x970 [0064.376] GetCurrentThreadId () returned 0x970 [0064.376] GetCurrentThreadId () returned 0x970 [0064.376] GetCurrentThreadId () returned 0x970 [0064.384] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0064.384] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0064.384] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3797308, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0064.384] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb248, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0064.384] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb248, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAD+WZDIo+bseeBDItITeNg82QUVfJKAElJ/p8CGaWL5zHFNSwFnoLTpniyOfdyrkwAuyZ4F0B1tQbwbEbt57t6/lfzCXqiPrTQhihY+cPc/rygqMkZQ54mJH0S9VmTCBNt/k2Dwcg6xEa8Ls10kVuxrIffWq8oxy9KogedYLLjOoBlr4nzQ4/bWq+LdNP7I84uA5F5zwa3xbTzjVr7lzZnokzVfkC4UTVw==") returned 232 [0064.384] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xb, wMilliseconds=0x292)) [0064.384] GetCurrentThreadId () returned 0x970 [0064.384] GetCurrentThreadId () returned 0x970 [0064.384] GetCurrentThreadId () returned 0x970 [0064.384] GetCurrentThreadId () returned 0x970 [0064.384] GetCurrentThreadId () returned 0x970 [0064.384] GetCurrentThreadId () returned 0x970 [0064.384] GetCurrentThreadId () returned 0x970 [0064.384] GetCurrentThreadId () returned 0x970 [0064.384] GetCurrentThreadId () returned 0x970 [0064.384] GetCurrentThreadId () returned 0x970 [0064.384] GetCurrentThreadId () returned 0x970 [0064.384] GetCurrentThreadId () returned 0x970 [0064.384] GetCurrentThreadId () returned 0x970 [0064.384] GetCurrentThreadId () returned 0x970 [0064.384] GetCurrentThreadId () returned 0x970 [0064.384] GetCurrentThreadId () returned 0x970 [0064.384] GetCurrentThreadId () returned 0x970 [0064.384] GetCurrentThreadId () returned 0x970 [0064.384] GetCurrentThreadId () returned 0x970 [0064.384] GetCurrentThreadId () returned 0x970 [0064.384] GetCurrentThreadId () returned 0x970 [0064.384] GetCurrentThreadId () returned 0x970 [0064.384] GetCurrentThreadId () returned 0x970 [0064.384] GetCurrentThreadId () returned 0x970 [0064.384] GetCurrentThreadId () returned 0x970 [0064.384] GetCurrentThreadId () returned 0x970 [0064.384] GetCurrentThreadId () returned 0x970 [0064.384] GetCurrentThreadId () returned 0x970 [0064.384] GetCurrentThreadId () returned 0x970 [0064.384] GetCurrentThreadId () returned 0x970 [0064.384] GetCurrentThreadId () returned 0x970 [0064.385] GetCurrentThreadId () returned 0x970 [0064.385] GetCurrentThreadId () returned 0x970 [0064.385] GetCurrentThreadId () returned 0x970 [0064.385] GetCurrentThreadId () returned 0x970 [0064.385] GetCurrentThreadId () returned 0x970 [0064.385] GetCurrentThreadId () returned 0x970 [0064.385] GetCurrentThreadId () returned 0x970 [0064.385] GetCurrentThreadId () returned 0x970 [0064.385] GetCurrentThreadId () returned 0x970 [0064.385] GetCurrentThreadId () returned 0x970 [0064.385] GetCurrentThreadId () returned 0x970 [0064.385] GetCurrentThreadId () returned 0x970 [0064.385] GetCurrentThreadId () returned 0x970 [0064.385] GetCurrentThreadId () returned 0x970 [0064.385] GetCurrentThreadId () returned 0x970 [0064.385] GetCurrentThreadId () returned 0x970 [0064.385] GetCurrentThreadId () returned 0x970 [0064.385] GetCurrentThreadId () returned 0x970 [0064.385] GetCurrentThreadId () returned 0x970 [0064.385] GetCurrentThreadId () returned 0x970 [0064.385] GetCurrentThreadId () returned 0x970 [0064.385] GetCurrentThreadId () returned 0x970 [0064.385] GetCurrentThreadId () returned 0x970 [0064.385] GetCurrentThreadId () returned 0x970 [0064.385] GetCurrentThreadId () returned 0x970 [0064.385] GetCurrentThreadId () returned 0x970 [0064.385] GetCurrentThreadId () returned 0x970 [0064.385] GetCurrentThreadId () returned 0x970 [0064.385] GetCurrentThreadId () returned 0x970 [0064.385] GetCurrentThreadId () returned 0x970 [0064.385] GetCurrentThreadId () returned 0x970 [0064.385] GetCurrentThreadId () returned 0x970 [0064.385] GetCurrentThreadId () returned 0x970 [0064.385] GetCurrentThreadId () returned 0x970 [0064.385] GetCurrentThreadId () returned 0x970 [0064.385] GetCurrentThreadId () returned 0x970 [0064.385] GetCurrentThreadId () returned 0x970 [0064.385] GetCurrentThreadId () returned 0x970 [0064.385] GetCurrentThreadId () returned 0x970 [0064.385] GetCurrentThreadId () returned 0x970 [0064.385] GetCurrentThreadId () returned 0x970 [0064.385] GetCurrentThreadId () returned 0x970 [0064.385] GetCurrentThreadId () returned 0x970 [0064.385] GetCurrentThreadId () returned 0x970 [0064.385] GetCurrentThreadId () returned 0x970 [0064.385] GetCurrentThreadId () returned 0x970 [0064.386] GetCurrentThreadId () returned 0x970 [0064.386] GetCurrentThreadId () returned 0x970 [0064.386] GetCurrentThreadId () returned 0x970 [0064.386] GetCurrentThreadId () returned 0x970 [0064.386] GetCurrentThreadId () returned 0x970 [0064.386] GetCurrentThreadId () returned 0x970 [0064.386] GetCurrentThreadId () returned 0x970 [0064.386] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAD+WZDIo+bseeBDItITeNg82QUVfJKAElJ/p8CGaWL5zHFNSwFnoLTpniyOfdyrkwAuyZ4F0B1tQbwbEbt57t6/lfzCXqiPrTQhihY+cPc/rygqMkZQ54mJH0S9VmTCBNt/k2Dwcg6xEa8Ls10kVuxrIffWq8oxy9KogedYLLjOoBlr4nzQ4/bWq+LdNP7I84uA5F5zwa3xbTzjVr7lzZnokzVfkC4UTVw==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0064.386] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAD+WZDIo+bseeBDItITeNg82QUVfJKAElJ/p8CGaWL5zHFNSwFnoLTpniyOfdyrkwAuyZ4F0B1tQbwbEbt57t6/lfzCXqiPrTQhihY+cPc/rygqMkZQ54mJH0S9VmTCBNt/k2Dwcg6xEa8Ls10kVuxrIffWq8oxy9KogedYLLjOoBlr4nzQ4/bWq+LdNP7I84uA5F5zwa3xbTzjVr7lzZnokzVfkC4UTVw==", cchWideChar=245, lpMultiByteStr=0x353933c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAD+WZDIo+bseeBDItITeNg82QUVfJKAElJ/p8CGaWL5zHFNSwFnoLTpniyOfdyrkwAuyZ4F0B1tQbwbEbt57t6/lfzCXqiPrTQhihY+cPc/rygqMkZQ54mJH0S9VmTCBNt/k2Dwcg6xEa8Ls10kVuxrIffWq8oxy9KogedYLLjOoBlr4nzQ4/bWq+LdNP7I84uA5F5zwa3xbTzjVr7lzZnokzVfkC4UTVw==", lpUsedDefaultChar=0x0) returned 245 [0064.386] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0064.386] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0064.386] CloseHandle (hObject=0x158) returned 1 [0064.386] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\lightbluerectangle.png")) returned 0 [0064.386] GetLastError () returned 0x5 [0064.386] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\lightbluerectangle.png")) returned 0x20 [0064.387] SetLastError (dwErrCode=0x5) [0064.387] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=18465003309) returned 1 [0064.387] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\Файл зашифрован [MainMenuButtonIcon.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\Файл зашифрован [mainmenubuttonicon.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0064.388] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0064.388] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0064.388] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0064.388] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0064.388] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0064.388] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0064.388] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0064.388] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0064.388] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0064.388] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0064.388] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0064.388] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0064.388] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0064.388] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0064.388] SetEndOfFile (hFile=0x158) returned 1 [0064.389] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0064.389] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0064.389] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0064.389] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0064.389] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0064.390] WriteFile (in: hFile=0x158, lpBuffer=0x35f04dc*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f04dc*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0064.390] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=":?8V*pxa0a9@f5u+EH12()yFa,h!paBf", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0064.390] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=":?8V*pxa0a9@f5u+EH12()yFa,h!paBf", cchWideChar=32, lpMultiByteStr=0x203617c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=":?8V*pxa0a9@f5u+EH12()yFa,h!paBf", lpUsedDefaultChar=0x0) returned 32 [0064.390] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0064.390] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0064.390] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70fccb24, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70fccb24, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f27579, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb6a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MainMenuButtonIcon.png", cAlternateFileName="")) returned 0x295098 [0064.390] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0064.390] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0064.390] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\mainmenubuttonicon.png")) returned 0x20 [0064.390] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\mainmenubuttonicon.png")) returned 0x20 [0064.390] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\mainmenubuttonicon.png")) returned 0x20 [0064.390] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\mainmenubuttonicon.png")) returned 0x20 [0064.391] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\mainmenubuttonicon.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70fccb24, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70fccb24, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f27579, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb6a)) returned 1 [0064.391] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0064.391] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0064.391] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\mainmenubuttonicon.png")) returned 0x20 [0064.391] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\mainmenubuttonicon.png")) returned 0x20 [0064.391] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0064.391] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0064.391] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0064.391] SetEndOfFile (hFile=0x158) returned 1 [0064.392] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MainMenuButtonIcon.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0064.392] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MainMenuButtonIcon.png", cchWideChar=22, lpMultiByteStr=0x1ff89c4, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MainMenuButtonIcon.png", lpUsedDefaultChar=0x0) returned 22 [0064.392] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MainMenuButtonIcon.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0064.392] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MainMenuButtonIcon.png", cchWideChar=22, lpMultiByteStr=0x1ff8974, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MainMenuButtonIcon.png", lpUsedDefaultChar=0x0) returned 22 [0064.392] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff8974, cbMultiByte=22, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="MainMenuButtonIcon.pngnget.pngpngre.pngg") returned 22 [0064.392] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MainMenuButtonIcon.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0064.392] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MainMenuButtonIcon.png", cchWideChar=22, lpMultiByteStr=0x1ff89c4, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MainMenuButtonIcon.png", lpUsedDefaultChar=0x0) returned 22 [0064.392] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\mainmenubuttonicon.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0064.392] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0064.392] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0xb6a [0064.392] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0064.392] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0064.392] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0064.393] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MainMenuButtonIcon.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0064.393] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MainMenuButtonIcon.png", cchWideChar=22, lpMultiByteStr=0x1ff89c4, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MainMenuButtonIcon.png", lpUsedDefaultChar=0x0) returned 22 [0064.393] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MainMenuButtonIcon.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0064.393] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MainMenuButtonIcon.png", cchWideChar=22, lpMultiByteStr=0x1ff8974, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MainMenuButtonIcon.png", lpUsedDefaultChar=0x0) returned 22 [0064.393] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff8974, cbMultiByte=22, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="MainMenuButtonIcon.pngon.pngnget.pngpngre.pngg") returned 22 [0064.393] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MainMenuButtonIcon.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0064.393] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MainMenuButtonIcon.png", cchWideChar=22, lpMultiByteStr=0x1ff89c4, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MainMenuButtonIcon.png", lpUsedDefaultChar=0x0) returned 22 [0064.393] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0064.394] CharToOemA (in: pSrc="MainMenuButtonIcon.png", pDst=0x1ff8974 | out: pDst="MainMenuButtonIcon.png") returned 1 [0064.394] WriteFile (in: hFile=0x158, lpBuffer=0x1ff8974*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1ff8974*, lpNumberOfBytesWritten=0x18e048*=0x16, lpOverlapped=0x0) returned 1 [0064.394] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0064.394] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0064.394] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0064.394] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=18465756264) returned 1 [0064.401] ReadFile (in: hFile=0x11c, lpBuffer=0x37bf4d0, nNumberOfBytesToRead=0xb6a, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37bf4d0*, lpNumberOfBytesRead=0x18dd7c*=0xb6a, lpOverlapped=0x0) returned 1 [0064.403] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0064.403] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=18466619563) returned 1 [0064.413] WriteFile (in: hFile=0x158, lpBuffer=0x379ade0*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379ade0*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0064.414] ReadFile (in: hFile=0x11c, lpBuffer=0x37bf4d0, nNumberOfBytesToRead=0xb6a, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x37bf4d0*, lpNumberOfBytesRead=0x18de38*=0xb6a, lpOverlapped=0x0) returned 1 [0064.414] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x51 [0064.414] WriteFile (in: hFile=0x158, lpBuffer=0x38018f0*, nNumberOfBytesToWrite=0xb6a, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x38018f0*, lpNumberOfBytesWritten=0x18de10*=0xb6a, lpOverlapped=0x0) returned 1 [0064.414] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0xbbb [0064.414] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0064.414] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0064.414] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0064.414] SetFilePointer (in: hFile=0x158, lDistanceToMove=22, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x34 [0064.414] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0xbc5 [0064.414] CloseHandle (hObject=0x11c) returned 1 [0064.415] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xbc5 [0064.415] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xbc5 [0064.415] SetFilePointer (in: hFile=0x158, lDistanceToMove=3013, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xbc5 [0064.415] SetFilePointer (in: hFile=0x158, lDistanceToMove=3013, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0xbc5 [0064.415] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xbc5 [0064.415] SetFilePointer (in: hFile=0x158, lDistanceToMove=3013, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0xbc5 [0064.415] SetEndOfFile (hFile=0x158) returned 1 [0064.415] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xbc5 [0064.415] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xbc5 [0064.415] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MainMenuButtonIcon.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0064.415] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MainMenuButtonIcon.png", cchWideChar=22, lpMultiByteStr=0x1ff8974, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MainMenuButtonIcon.png", lpUsedDefaultChar=0x0) returned 22 [0064.415] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MainMenuButtonIcon.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0064.415] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MainMenuButtonIcon.png", cchWideChar=22, lpMultiByteStr=0x1ff89c4, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MainMenuButtonIcon.png", lpUsedDefaultChar=0x0) returned 22 [0064.415] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff89c4, cbMultiByte=22, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="MainMenuButtonIcon.png") returned 22 [0064.415] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MainMenuButtonIcon.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0064.415] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MainMenuButtonIcon.png", cchWideChar=22, lpMultiByteStr=0x1ff8974, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MainMenuButtonIcon.png", lpUsedDefaultChar=0x0) returned 22 [0064.416] WriteFile (in: hFile=0x158, lpBuffer=0x37a2fa8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x37a2fa8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0064.416] CharToOemA (in: pSrc="MainMenuButtonIcon.png", pDst=0x1ff89c4 | out: pDst="MainMenuButtonIcon.png") returned 1 [0064.416] WriteFile (in: hFile=0x158, lpBuffer=0x1ff89c4*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1ff89c4*, lpNumberOfBytesWritten=0x18efcc*=0x16, lpOverlapped=0x0) returned 1 [0064.416] WriteFile (in: hFile=0x158, lpBuffer=0x379ad58*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379ad58*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0064.416] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0064.416] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0064.416] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xc14 [0064.416] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xc14 [0064.416] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0064.416] WriteFile (in: hFile=0x158, lpBuffer=0x35f04dc*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f04dc*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0064.416] DeleteFileW (lpFileName="") returned 0 [0064.416] GetLastError () returned 0x3 [0064.416] GetFileAttributesW (lpFileName="") returned 0xffffffff [0064.416] SetLastError (dwErrCode=0x3) [0064.416] FlushFileBuffers (hFile=0x158) returned 1 [0064.429] GetCurrentThreadId () returned 0x970 [0064.429] GetCurrentThreadId () returned 0x970 [0064.429] GetCurrentThreadId () returned 0x970 [0064.429] GetCurrentThreadId () returned 0x970 [0064.429] GetCurrentThreadId () returned 0x970 [0064.429] GetCurrentThreadId () returned 0x970 [0064.429] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xccb [0064.429] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xccb [0064.429] SetFilePointer (in: hFile=0x158, lDistanceToMove=3275, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xccb [0064.429] CloseHandle (hObject=0x158) returned 1 [0064.429] GetCurrentThreadId () returned 0x970 [0064.429] GetCurrentThreadId () returned 0x970 [0064.429] GetCurrentThreadId () returned 0x970 [0064.430] GetCurrentThreadId () returned 0x970 [0064.430] GetCurrentThreadId () returned 0x970 [0064.430] GetCurrentThreadId () returned 0x970 [0064.430] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\Файл зашифрован [MainMenuButtonIcon.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\Файл зашифрован [mainmenubuttonicon.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0064.430] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xccb [0064.430] SetFilePointer (in: hFile=0x158, lDistanceToMove=3147, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc4b [0064.430] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0064.430] GetFileType (hFile=0x158) returned 0x1 [0064.430] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xb, wMilliseconds=0x2c1)) [0064.430] GetCurrentThreadId () returned 0x970 [0064.430] GetCurrentThreadId () returned 0x970 [0064.430] GetCurrentThreadId () returned 0x970 [0064.430] GetCurrentThreadId () returned 0x970 [0064.430] GetCurrentThreadId () returned 0x970 [0064.430] GetCurrentThreadId () returned 0x970 [0064.430] GetCurrentThreadId () returned 0x970 [0064.430] GetCurrentThreadId () returned 0x970 [0064.430] GetCurrentThreadId () returned 0x970 [0064.430] GetCurrentThreadId () returned 0x970 [0064.430] GetCurrentThreadId () returned 0x970 [0064.430] GetCurrentThreadId () returned 0x970 [0064.430] GetCurrentThreadId () returned 0x970 [0064.430] GetCurrentThreadId () returned 0x970 [0064.430] GetCurrentThreadId () returned 0x970 [0064.430] GetCurrentThreadId () returned 0x970 [0064.430] GetCurrentThreadId () returned 0x970 [0064.430] GetCurrentThreadId () returned 0x970 [0064.430] GetCurrentThreadId () returned 0x970 [0064.430] GetCurrentThreadId () returned 0x970 [0064.430] GetCurrentThreadId () returned 0x970 [0064.430] GetCurrentThreadId () returned 0x970 [0064.431] GetCurrentThreadId () returned 0x970 [0064.431] GetCurrentThreadId () returned 0x970 [0064.431] GetCurrentThreadId () returned 0x970 [0064.431] GetCurrentThreadId () returned 0x970 [0064.431] GetCurrentThreadId () returned 0x970 [0064.431] GetCurrentThreadId () returned 0x970 [0064.431] GetCurrentThreadId () returned 0x970 [0064.431] GetCurrentThreadId () returned 0x970 [0064.431] GetCurrentThreadId () returned 0x970 [0064.431] GetCurrentThreadId () returned 0x970 [0064.431] GetCurrentThreadId () returned 0x970 [0064.431] GetCurrentThreadId () returned 0x970 [0064.431] GetCurrentThreadId () returned 0x970 [0064.431] GetCurrentThreadId () returned 0x970 [0064.431] GetCurrentThreadId () returned 0x970 [0064.431] GetCurrentThreadId () returned 0x970 [0064.431] GetCurrentThreadId () returned 0x970 [0064.431] GetCurrentThreadId () returned 0x970 [0064.431] GetCurrentThreadId () returned 0x970 [0064.431] GetCurrentThreadId () returned 0x970 [0064.431] GetCurrentThreadId () returned 0x970 [0064.431] GetCurrentThreadId () returned 0x970 [0064.431] GetCurrentThreadId () returned 0x970 [0064.431] GetCurrentThreadId () returned 0x970 [0064.431] GetCurrentThreadId () returned 0x970 [0064.431] GetCurrentThreadId () returned 0x970 [0064.431] GetCurrentThreadId () returned 0x970 [0064.431] GetCurrentThreadId () returned 0x970 [0064.431] GetCurrentThreadId () returned 0x970 [0064.431] GetCurrentThreadId () returned 0x970 [0064.431] GetCurrentThreadId () returned 0x970 [0064.431] GetCurrentThreadId () returned 0x970 [0064.431] GetCurrentThreadId () returned 0x970 [0064.431] GetCurrentThreadId () returned 0x970 [0064.431] GetCurrentThreadId () returned 0x970 [0064.431] GetCurrentThreadId () returned 0x970 [0064.431] GetCurrentThreadId () returned 0x970 [0064.431] GetCurrentThreadId () returned 0x970 [0064.431] GetCurrentThreadId () returned 0x970 [0064.431] GetCurrentThreadId () returned 0x970 [0064.431] GetCurrentThreadId () returned 0x970 [0064.431] GetCurrentThreadId () returned 0x970 [0064.431] GetCurrentThreadId () returned 0x970 [0064.431] GetCurrentThreadId () returned 0x970 [0064.431] GetCurrentThreadId () returned 0x970 [0064.432] GetCurrentThreadId () returned 0x970 [0064.432] GetCurrentThreadId () returned 0x970 [0064.432] GetCurrentThreadId () returned 0x970 [0064.432] GetCurrentThreadId () returned 0x970 [0064.432] GetCurrentThreadId () returned 0x970 [0064.432] GetCurrentThreadId () returned 0x970 [0064.432] GetCurrentThreadId () returned 0x970 [0064.432] GetCurrentThreadId () returned 0x970 [0064.432] GetCurrentThreadId () returned 0x970 [0064.432] GetCurrentThreadId () returned 0x970 [0064.432] GetCurrentThreadId () returned 0x970 [0064.432] GetCurrentThreadId () returned 0x970 [0064.432] GetCurrentThreadId () returned 0x970 [0064.432] GetCurrentThreadId () returned 0x970 [0064.432] GetCurrentThreadId () returned 0x970 [0064.432] GetCurrentThreadId () returned 0x970 [0064.432] GetCurrentThreadId () returned 0x970 [0064.432] GetCurrentThreadId () returned 0x970 [0064.432] GetCurrentThreadId () returned 0x970 [0064.432] GetCurrentThreadId () returned 0x970 [0064.432] GetCurrentThreadId () returned 0x970 [0064.432] GetCurrentThreadId () returned 0x970 [0064.432] GetCurrentThreadId () returned 0x970 [0064.432] GetCurrentThreadId () returned 0x970 [0064.432] GetCurrentThreadId () returned 0x970 [0064.432] GetCurrentThreadId () returned 0x970 [0064.432] GetCurrentThreadId () returned 0x970 [0064.432] GetCurrentThreadId () returned 0x970 [0064.432] GetCurrentThreadId () returned 0x970 [0064.432] GetCurrentThreadId () returned 0x970 [0064.432] GetCurrentThreadId () returned 0x970 [0064.432] GetCurrentThreadId () returned 0x970 [0064.432] GetCurrentThreadId () returned 0x970 [0064.432] GetCurrentThreadId () returned 0x970 [0064.432] GetCurrentThreadId () returned 0x970 [0064.432] GetCurrentThreadId () returned 0x970 [0064.432] GetCurrentThreadId () returned 0x970 [0064.432] GetCurrentThreadId () returned 0x970 [0064.432] GetCurrentThreadId () returned 0x970 [0064.432] GetCurrentThreadId () returned 0x970 [0064.432] GetCurrentThreadId () returned 0x970 [0064.432] GetCurrentThreadId () returned 0x970 [0064.432] GetCurrentThreadId () returned 0x970 [0064.432] GetCurrentThreadId () returned 0x970 [0064.432] GetCurrentThreadId () returned 0x970 [0064.433] GetCurrentThreadId () returned 0x970 [0064.433] GetCurrentThreadId () returned 0x970 [0064.433] GetCurrentThreadId () returned 0x970 [0064.433] GetCurrentThreadId () returned 0x970 [0064.433] GetCurrentThreadId () returned 0x970 [0064.433] GetCurrentThreadId () returned 0x970 [0064.433] GetCurrentThreadId () returned 0x970 [0064.433] GetCurrentThreadId () returned 0x970 [0064.433] GetCurrentThreadId () returned 0x970 [0064.433] GetCurrentThreadId () returned 0x970 [0064.433] GetCurrentThreadId () returned 0x970 [0064.433] GetCurrentThreadId () returned 0x970 [0064.433] GetCurrentThreadId () returned 0x970 [0064.433] GetCurrentThreadId () returned 0x970 [0064.433] GetCurrentThreadId () returned 0x970 [0064.433] GetCurrentThreadId () returned 0x970 [0064.433] GetCurrentThreadId () returned 0x970 [0064.433] GetCurrentThreadId () returned 0x970 [0064.433] GetCurrentThreadId () returned 0x970 [0064.433] GetCurrentThreadId () returned 0x970 [0064.433] GetCurrentThreadId () returned 0x970 [0064.433] GetCurrentThreadId () returned 0x970 [0064.433] GetCurrentThreadId () returned 0x970 [0064.433] GetCurrentThreadId () returned 0x970 [0064.433] GetCurrentThreadId () returned 0x970 [0064.433] GetCurrentThreadId () returned 0x970 [0064.433] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.433] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.433] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379b358, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0064.433] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.433] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.433] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379b358, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0064.433] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.433] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.433] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0064.433] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.433] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.433] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0064.433] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.434] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.434] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379b3b8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0064.434] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.434] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.434] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379b3b8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0064.434] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.434] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.434] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379b3b8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0064.434] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xb, wMilliseconds=0x2c1)) [0064.434] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr=":?8V*pxa0a9@f5u+EH12()yFa,h!paBf", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0064.434] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr=":?8V*pxa0a9@f5u+EH12()yFa,h!paBf", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0064.434] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr=":?8V*pxa0a9@f5u+EH12()yFa,h!paBf", cchWideChar=32, lpMultiByteStr=0x20037d8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=":?8V*pxa0a9@f5u+EH12()yFa,h!paBf", lpUsedDefaultChar=0x0) returned 32 [0064.434] GetCurrentThreadId () returned 0x970 [0064.434] GetCurrentThreadId () returned 0x970 [0064.434] GetCurrentThreadId () returned 0x970 [0064.434] GetCurrentThreadId () returned 0x970 [0064.434] GetCurrentThreadId () returned 0x970 [0064.434] GetCurrentThreadId () returned 0x970 [0064.442] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0064.442] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0064.442] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3797538, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0064.442] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb248, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0064.442] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb248, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAH60StM9o7l0s1ZGPjn+3hEx6LPtur15tL+uk++8s1+eoRhiNnkR0/2ILL7BbEsxVC3Stny031tOW8pCiu1Jfdn05d7rxXKAaefIgwQRB0aXGdIeKUUcv7JFlo2utzcAcZhwYscMeIgYXvwsWsmjqL55X4VivXzEKtQlKIJMsZupv/+f0J79a9J6vxjmCUatYTVbLcda0rLHDRnlj2hdpVK75LiW/AoDOw==") returned 232 [0064.442] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xb, wMilliseconds=0x2d1)) [0064.442] GetCurrentThreadId () returned 0x970 [0064.442] GetCurrentThreadId () returned 0x970 [0064.442] GetCurrentThreadId () returned 0x970 [0064.442] GetCurrentThreadId () returned 0x970 [0064.442] GetCurrentThreadId () returned 0x970 [0064.442] GetCurrentThreadId () returned 0x970 [0064.442] GetCurrentThreadId () returned 0x970 [0064.442] GetCurrentThreadId () returned 0x970 [0064.442] GetCurrentThreadId () returned 0x970 [0064.442] GetCurrentThreadId () returned 0x970 [0064.442] GetCurrentThreadId () returned 0x970 [0064.442] GetCurrentThreadId () returned 0x970 [0064.442] GetCurrentThreadId () returned 0x970 [0064.442] GetCurrentThreadId () returned 0x970 [0064.442] GetCurrentThreadId () returned 0x970 [0064.442] GetCurrentThreadId () returned 0x970 [0064.442] GetCurrentThreadId () returned 0x970 [0064.443] GetCurrentThreadId () returned 0x970 [0064.443] GetCurrentThreadId () returned 0x970 [0064.443] GetCurrentThreadId () returned 0x970 [0064.443] GetCurrentThreadId () returned 0x970 [0064.443] GetCurrentThreadId () returned 0x970 [0064.443] GetCurrentThreadId () returned 0x970 [0064.443] GetCurrentThreadId () returned 0x970 [0064.443] GetCurrentThreadId () returned 0x970 [0064.443] GetCurrentThreadId () returned 0x970 [0064.443] GetCurrentThreadId () returned 0x970 [0064.443] GetCurrentThreadId () returned 0x970 [0064.443] GetCurrentThreadId () returned 0x970 [0064.443] GetCurrentThreadId () returned 0x970 [0064.443] GetCurrentThreadId () returned 0x970 [0064.443] GetCurrentThreadId () returned 0x970 [0064.443] GetCurrentThreadId () returned 0x970 [0064.443] GetCurrentThreadId () returned 0x970 [0064.443] GetCurrentThreadId () returned 0x970 [0064.443] GetCurrentThreadId () returned 0x970 [0064.443] GetCurrentThreadId () returned 0x970 [0064.443] GetCurrentThreadId () returned 0x970 [0064.443] GetCurrentThreadId () returned 0x970 [0064.443] GetCurrentThreadId () returned 0x970 [0064.443] GetCurrentThreadId () returned 0x970 [0064.443] GetCurrentThreadId () returned 0x970 [0064.443] GetCurrentThreadId () returned 0x970 [0064.443] GetCurrentThreadId () returned 0x970 [0064.443] GetCurrentThreadId () returned 0x970 [0064.443] GetCurrentThreadId () returned 0x970 [0064.443] GetCurrentThreadId () returned 0x970 [0064.443] GetCurrentThreadId () returned 0x970 [0064.443] GetCurrentThreadId () returned 0x970 [0064.443] GetCurrentThreadId () returned 0x970 [0064.443] GetCurrentThreadId () returned 0x970 [0064.443] GetCurrentThreadId () returned 0x970 [0064.443] GetCurrentThreadId () returned 0x970 [0064.443] GetCurrentThreadId () returned 0x970 [0064.443] GetCurrentThreadId () returned 0x970 [0064.443] GetCurrentThreadId () returned 0x970 [0064.443] GetCurrentThreadId () returned 0x970 [0064.443] GetCurrentThreadId () returned 0x970 [0064.443] GetCurrentThreadId () returned 0x970 [0064.443] GetCurrentThreadId () returned 0x970 [0064.443] GetCurrentThreadId () returned 0x970 [0064.443] GetCurrentThreadId () returned 0x970 [0064.444] GetCurrentThreadId () returned 0x970 [0064.444] GetCurrentThreadId () returned 0x970 [0064.444] GetCurrentThreadId () returned 0x970 [0064.444] GetCurrentThreadId () returned 0x970 [0064.444] GetCurrentThreadId () returned 0x970 [0064.444] GetCurrentThreadId () returned 0x970 [0064.444] GetCurrentThreadId () returned 0x970 [0064.444] GetCurrentThreadId () returned 0x970 [0064.444] GetCurrentThreadId () returned 0x970 [0064.444] GetCurrentThreadId () returned 0x970 [0064.444] GetCurrentThreadId () returned 0x970 [0064.444] GetCurrentThreadId () returned 0x970 [0064.444] GetCurrentThreadId () returned 0x970 [0064.444] GetCurrentThreadId () returned 0x970 [0064.444] GetCurrentThreadId () returned 0x970 [0064.444] GetCurrentThreadId () returned 0x970 [0064.444] GetCurrentThreadId () returned 0x970 [0064.444] GetCurrentThreadId () returned 0x970 [0064.444] GetCurrentThreadId () returned 0x970 [0064.444] GetCurrentThreadId () returned 0x970 [0064.444] GetCurrentThreadId () returned 0x970 [0064.444] GetCurrentThreadId () returned 0x970 [0064.444] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAH60StM9o7l0s1ZGPjn+3hEx6LPtur15tL+uk++8s1+eoRhiNnkR0/2ILL7BbEsxVC3Stny031tOW8pCiu1Jfdn05d7rxXKAaefIgwQRB0aXGdIeKUUcv7JFlo2utzcAcZhwYscMeIgYXvwsWsmjqL55X4VivXzEKtQlKIJMsZupv/+f0J79a9J6vxjmCUatYTVbLcda0rLHDRnlj2hdpVK75LiW/AoDOw==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0064.444] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAH60StM9o7l0s1ZGPjn+3hEx6LPtur15tL+uk++8s1+eoRhiNnkR0/2ILL7BbEsxVC3Stny031tOW8pCiu1Jfdn05d7rxXKAaefIgwQRB0aXGdIeKUUcv7JFlo2utzcAcZhwYscMeIgYXvwsWsmjqL55X4VivXzEKtQlKIJMsZupv/+f0J79a9J6vxjmCUatYTVbLcda0rLHDRnlj2hdpVK75LiW/AoDOw==", cchWideChar=245, lpMultiByteStr=0x353933c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAH60StM9o7l0s1ZGPjn+3hEx6LPtur15tL+uk++8s1+eoRhiNnkR0/2ILL7BbEsxVC3Stny031tOW8pCiu1Jfdn05d7rxXKAaefIgwQRB0aXGdIeKUUcv7JFlo2utzcAcZhwYscMeIgYXvwsWsmjqL55X4VivXzEKtQlKIJMsZupv/+f0J79a9J6vxjmCUatYTVbLcda0rLHDRnlj2hdpVK75LiW/AoDOw==", lpUsedDefaultChar=0x0) returned 245 [0064.444] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0064.445] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0064.445] CloseHandle (hObject=0x158) returned 1 [0064.445] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\mainmenubuttonicon.png")) returned 0 [0064.445] GetLastError () returned 0x5 [0064.445] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\mainmenubuttonicon.png")) returned 0x20 [0064.445] SetLastError (dwErrCode=0x5) [0064.445] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=18470864480) returned 1 [0064.445] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\Файл зашифрован [navSubpicture.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\Файл зашифрован [navsubpicture.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0064.446] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0064.446] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0064.446] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0064.446] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0064.446] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0064.446] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0064.446] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0064.446] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0064.446] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0064.446] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0064.446] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0064.446] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0064.446] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0064.446] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0064.446] SetEndOfFile (hFile=0x158) returned 1 [0064.447] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0064.447] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0064.447] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0064.447] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0064.447] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0064.448] WriteFile (in: hFile=0x158, lpBuffer=0x35f035c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f035c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0064.448] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="%H$", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0064.796] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="9xfl\"37ZBY#+}**)Fh&J#jdK.)%46~1>", cchWideChar=32, lpMultiByteStr=0x20349a4, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="9xfl\"37ZBY#+}**)Fh&J#jdK.)%46~1>", lpUsedDefaultChar=0x0) returned 32 [0064.796] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0064.796] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0064.797] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x728a4ecf, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x728a4ecf, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49fbfaf1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xcc1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.png", cAlternateFileName="")) returned 0x295098 [0064.797] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0064.797] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0064.797] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\background.png")) returned 0x20 [0064.797] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\background.png")) returned 0x20 [0064.797] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\background.png")) returned 0x20 [0064.797] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\background.png")) returned 0x20 [0064.797] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\background.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x728a4ecf, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x728a4ecf, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49fbfaf1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xcc1b)) returned 1 [0064.797] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0064.797] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0064.797] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\background.png")) returned 0x20 [0064.797] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\background.png")) returned 0x20 [0064.797] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0064.797] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0064.797] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0064.797] SetEndOfFile (hFile=0x158) returned 1 [0064.798] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="background.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0064.798] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="background.png", cchWideChar=14, lpMultiByteStr=0x1fe374c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="background.png", lpUsedDefaultChar=0x0) returned 14 [0064.798] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="background.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0064.798] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="background.png", cchWideChar=14, lpMultiByteStr=0x1fe3c4c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="background.png", lpUsedDefaultChar=0x0) returned 14 [0064.798] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe3c4c, cbMultiByte=14, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="background.pngk.pngsk.pngt.pngpngre.pngg") returned 14 [0064.799] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="background.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0064.799] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="background.png", cchWideChar=14, lpMultiByteStr=0x1fe374c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="background.png", lpUsedDefaultChar=0x0) returned 14 [0064.799] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0064.799] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0064.799] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0xcc1b [0064.799] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0064.799] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0064.799] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0064.799] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="background.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0064.799] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="background.png", cchWideChar=14, lpMultiByteStr=0x1fe374c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="background.png", lpUsedDefaultChar=0x0) returned 14 [0064.799] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="background.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0064.799] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="background.png", cchWideChar=14, lpMultiByteStr=0x1fe3c4c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="background.png", lpUsedDefaultChar=0x0) returned 14 [0064.799] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe3c4c, cbMultiByte=14, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="background.pngnd.pngk.pngsk.pngt.pngpngre.pngg") returned 14 [0064.799] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="background.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0064.799] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="background.png", cchWideChar=14, lpMultiByteStr=0x1fe374c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="background.png", lpUsedDefaultChar=0x0) returned 14 [0064.799] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0064.800] CharToOemA (in: pSrc="background.png", pDst=0x1fe3c4c | out: pDst="background.png") returned 1 [0064.800] WriteFile (in: hFile=0x158, lpBuffer=0x1fe3c4c*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe3c4c*, lpNumberOfBytesWritten=0x18e048*=0xe, lpOverlapped=0x0) returned 1 [0064.800] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0064.801] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0064.801] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0064.801] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=18506421638) returned 1 [0064.801] ReadFile (in: hFile=0x11c, lpBuffer=0x37c6700, nNumberOfBytesToRead=0xcc1b, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37c6700*, lpNumberOfBytesRead=0x18dd7c*=0xcc1b, lpOverlapped=0x0) returned 1 [0064.803] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0064.803] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=18506656435) returned 1 [0064.812] WriteFile (in: hFile=0x158, lpBuffer=0x379ad08*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379ad08*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0064.812] ReadFile (in: hFile=0x11c, lpBuffer=0x37c6700, nNumberOfBytesToRead=0xcc1b, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x37c6700*, lpNumberOfBytesRead=0x18de38*=0xcc1b, lpOverlapped=0x0) returned 1 [0064.814] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x49 [0064.814] WriteFile (in: hFile=0x158, lpBuffer=0x3814b20*, nNumberOfBytesToWrite=0xcc1b, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3814b20*, lpNumberOfBytesWritten=0x18de10*=0xcc1b, lpOverlapped=0x0) returned 1 [0064.815] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0xcc64 [0064.815] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0064.815] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0064.815] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0064.815] SetFilePointer (in: hFile=0x158, lDistanceToMove=14, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2c [0064.815] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0xcc6e [0064.815] CloseHandle (hObject=0x11c) returned 1 [0064.815] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xcc6e [0064.815] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xcc6e [0064.815] SetFilePointer (in: hFile=0x158, lDistanceToMove=52334, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xcc6e [0064.815] SetFilePointer (in: hFile=0x158, lDistanceToMove=52334, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0xcc6e [0064.815] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xcc6e [0064.815] SetFilePointer (in: hFile=0x158, lDistanceToMove=52334, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0xcc6e [0064.815] SetEndOfFile (hFile=0x158) returned 1 [0064.816] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xcc6e [0064.816] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xcc6e [0064.816] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="background.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0064.816] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="background.png", cchWideChar=14, lpMultiByteStr=0x1fe374c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="background.png", lpUsedDefaultChar=0x0) returned 14 [0064.816] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="background.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0064.816] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="background.png", cchWideChar=14, lpMultiByteStr=0x1fe380c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="background.png", lpUsedDefaultChar=0x0) returned 14 [0064.816] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe380c, cbMultiByte=14, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="background.png⍜'\x18믉`믑`") returned 14 [0064.816] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="background.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0064.816] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="background.png", cchWideChar=14, lpMultiByteStr=0x1fe374c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="background.png", lpUsedDefaultChar=0x0) returned 14 [0064.816] WriteFile (in: hFile=0x158, lpBuffer=0x37aa1d8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x37aa1d8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0064.816] CharToOemA (in: pSrc="background.png", pDst=0x1fe380c | out: pDst="background.png") returned 1 [0064.816] WriteFile (in: hFile=0x158, lpBuffer=0x1fe380c*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe380c*, lpNumberOfBytesWritten=0x18efcc*=0xe, lpOverlapped=0x0) returned 1 [0064.817] WriteFile (in: hFile=0x158, lpBuffer=0x379ad58*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379ad58*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0064.817] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0064.817] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0064.817] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xccb5 [0064.817] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xccb5 [0064.817] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0064.817] WriteFile (in: hFile=0x158, lpBuffer=0x35f035c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f035c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0064.817] DeleteFileW (lpFileName="") returned 0 [0064.817] GetLastError () returned 0x3 [0064.817] GetFileAttributesW (lpFileName="") returned 0xffffffff [0064.817] SetLastError (dwErrCode=0x3) [0064.817] FlushFileBuffers (hFile=0x158) returned 1 [0064.820] GetCurrentThreadId () returned 0x970 [0064.820] GetCurrentThreadId () returned 0x970 [0064.820] GetCurrentThreadId () returned 0x970 [0064.820] GetCurrentThreadId () returned 0x970 [0064.820] GetCurrentThreadId () returned 0x970 [0064.820] GetCurrentThreadId () returned 0x970 [0064.820] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xcd6c [0064.820] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xcd6c [0064.820] SetFilePointer (in: hFile=0x158, lDistanceToMove=52588, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xcd6c [0064.820] CloseHandle (hObject=0x158) returned 1 [0064.820] GetCurrentThreadId () returned 0x970 [0064.820] GetCurrentThreadId () returned 0x970 [0064.820] GetCurrentThreadId () returned 0x970 [0064.820] GetCurrentThreadId () returned 0x970 [0064.820] GetCurrentThreadId () returned 0x970 [0064.820] GetCurrentThreadId () returned 0x970 [0064.820] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Файл зашифрован [background.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\Файл зашифрован [background.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0064.821] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xcd6c [0064.821] SetFilePointer (in: hFile=0x158, lDistanceToMove=52460, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xccec [0064.821] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0064.821] GetFileType (hFile=0x158) returned 0x1 [0064.821] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xc, wMilliseconds=0x5f)) [0064.821] GetCurrentThreadId () returned 0x970 [0064.821] GetCurrentThreadId () returned 0x970 [0064.821] GetCurrentThreadId () returned 0x970 [0064.821] GetCurrentThreadId () returned 0x970 [0064.821] GetCurrentThreadId () returned 0x970 [0064.821] GetCurrentThreadId () returned 0x970 [0064.821] GetCurrentThreadId () returned 0x970 [0064.821] GetCurrentThreadId () returned 0x970 [0064.821] GetCurrentThreadId () returned 0x970 [0064.821] GetCurrentThreadId () returned 0x970 [0064.821] GetCurrentThreadId () returned 0x970 [0064.821] GetCurrentThreadId () returned 0x970 [0064.821] GetCurrentThreadId () returned 0x970 [0064.821] GetCurrentThreadId () returned 0x970 [0064.821] GetCurrentThreadId () returned 0x970 [0064.821] GetCurrentThreadId () returned 0x970 [0064.821] GetCurrentThreadId () returned 0x970 [0064.821] GetCurrentThreadId () returned 0x970 [0064.821] GetCurrentThreadId () returned 0x970 [0064.821] GetCurrentThreadId () returned 0x970 [0064.821] GetCurrentThreadId () returned 0x970 [0064.821] GetCurrentThreadId () returned 0x970 [0064.821] GetCurrentThreadId () returned 0x970 [0064.821] GetCurrentThreadId () returned 0x970 [0064.821] GetCurrentThreadId () returned 0x970 [0064.821] GetCurrentThreadId () returned 0x970 [0064.821] GetCurrentThreadId () returned 0x970 [0064.821] GetCurrentThreadId () returned 0x970 [0064.821] GetCurrentThreadId () returned 0x970 [0064.821] GetCurrentThreadId () returned 0x970 [0064.821] GetCurrentThreadId () returned 0x970 [0064.821] GetCurrentThreadId () returned 0x970 [0064.821] GetCurrentThreadId () returned 0x970 [0064.822] GetCurrentThreadId () returned 0x970 [0064.822] GetCurrentThreadId () returned 0x970 [0064.822] GetCurrentThreadId () returned 0x970 [0064.822] GetCurrentThreadId () returned 0x970 [0064.822] GetCurrentThreadId () returned 0x970 [0064.822] GetCurrentThreadId () returned 0x970 [0064.822] GetCurrentThreadId () returned 0x970 [0064.822] GetCurrentThreadId () returned 0x970 [0064.822] GetCurrentThreadId () returned 0x970 [0064.822] GetCurrentThreadId () returned 0x970 [0064.822] GetCurrentThreadId () returned 0x970 [0064.822] GetCurrentThreadId () returned 0x970 [0064.822] GetCurrentThreadId () returned 0x970 [0064.822] GetCurrentThreadId () returned 0x970 [0064.822] GetCurrentThreadId () returned 0x970 [0064.822] GetCurrentThreadId () returned 0x970 [0064.822] GetCurrentThreadId () returned 0x970 [0064.822] GetCurrentThreadId () returned 0x970 [0064.822] GetCurrentThreadId () returned 0x970 [0064.822] GetCurrentThreadId () returned 0x970 [0064.822] GetCurrentThreadId () returned 0x970 [0064.822] GetCurrentThreadId () returned 0x970 [0064.822] GetCurrentThreadId () returned 0x970 [0064.822] GetCurrentThreadId () returned 0x970 [0064.822] GetCurrentThreadId () returned 0x970 [0064.822] GetCurrentThreadId () returned 0x970 [0064.822] GetCurrentThreadId () returned 0x970 [0064.822] GetCurrentThreadId () returned 0x970 [0064.822] GetCurrentThreadId () returned 0x970 [0064.822] GetCurrentThreadId () returned 0x970 [0064.822] GetCurrentThreadId () returned 0x970 [0064.822] GetCurrentThreadId () returned 0x970 [0064.822] GetCurrentThreadId () returned 0x970 [0064.822] GetCurrentThreadId () returned 0x970 [0064.822] GetCurrentThreadId () returned 0x970 [0064.822] GetCurrentThreadId () returned 0x970 [0064.822] GetCurrentThreadId () returned 0x970 [0064.822] GetCurrentThreadId () returned 0x970 [0064.822] GetCurrentThreadId () returned 0x970 [0064.822] GetCurrentThreadId () returned 0x970 [0064.822] GetCurrentThreadId () returned 0x970 [0064.822] GetCurrentThreadId () returned 0x970 [0064.822] GetCurrentThreadId () returned 0x970 [0064.822] GetCurrentThreadId () returned 0x970 [0064.822] GetCurrentThreadId () returned 0x970 [0064.823] GetCurrentThreadId () returned 0x970 [0064.823] GetCurrentThreadId () returned 0x970 [0064.823] GetCurrentThreadId () returned 0x970 [0064.823] GetCurrentThreadId () returned 0x970 [0064.823] GetCurrentThreadId () returned 0x970 [0064.823] GetCurrentThreadId () returned 0x970 [0064.823] GetCurrentThreadId () returned 0x970 [0064.823] GetCurrentThreadId () returned 0x970 [0064.823] GetCurrentThreadId () returned 0x970 [0064.823] GetCurrentThreadId () returned 0x970 [0064.823] GetCurrentThreadId () returned 0x970 [0064.823] GetCurrentThreadId () returned 0x970 [0064.823] GetCurrentThreadId () returned 0x970 [0064.823] GetCurrentThreadId () returned 0x970 [0064.823] GetCurrentThreadId () returned 0x970 [0064.823] GetCurrentThreadId () returned 0x970 [0064.823] GetCurrentThreadId () returned 0x970 [0064.823] GetCurrentThreadId () returned 0x970 [0064.823] GetCurrentThreadId () returned 0x970 [0064.823] GetCurrentThreadId () returned 0x970 [0064.823] GetCurrentThreadId () returned 0x970 [0064.823] GetCurrentThreadId () returned 0x970 [0064.823] GetCurrentThreadId () returned 0x970 [0064.823] GetCurrentThreadId () returned 0x970 [0064.823] GetCurrentThreadId () returned 0x970 [0064.823] GetCurrentThreadId () returned 0x970 [0064.823] GetCurrentThreadId () returned 0x970 [0064.823] GetCurrentThreadId () returned 0x970 [0064.823] GetCurrentThreadId () returned 0x970 [0064.823] GetCurrentThreadId () returned 0x970 [0064.823] GetCurrentThreadId () returned 0x970 [0064.823] GetCurrentThreadId () returned 0x970 [0064.823] GetCurrentThreadId () returned 0x970 [0064.823] GetCurrentThreadId () returned 0x970 [0064.823] GetCurrentThreadId () returned 0x970 [0064.823] GetCurrentThreadId () returned 0x970 [0064.823] GetCurrentThreadId () returned 0x970 [0064.823] GetCurrentThreadId () returned 0x970 [0064.823] GetCurrentThreadId () returned 0x970 [0064.823] GetCurrentThreadId () returned 0x970 [0064.823] GetCurrentThreadId () returned 0x970 [0064.823] GetCurrentThreadId () returned 0x970 [0064.823] GetCurrentThreadId () returned 0x970 [0064.823] GetCurrentThreadId () returned 0x970 [0064.823] GetCurrentThreadId () returned 0x970 [0064.823] GetCurrentThreadId () returned 0x970 [0064.824] GetCurrentThreadId () returned 0x970 [0064.824] GetCurrentThreadId () returned 0x970 [0064.824] GetCurrentThreadId () returned 0x970 [0064.824] GetCurrentThreadId () returned 0x970 [0064.824] GetCurrentThreadId () returned 0x970 [0064.824] GetCurrentThreadId () returned 0x970 [0064.824] GetCurrentThreadId () returned 0x970 [0064.824] GetCurrentThreadId () returned 0x970 [0064.824] GetCurrentThreadId () returned 0x970 [0064.824] GetCurrentThreadId () returned 0x970 [0064.824] GetCurrentThreadId () returned 0x970 [0064.824] GetCurrentThreadId () returned 0x970 [0064.824] GetCurrentThreadId () returned 0x970 [0064.824] GetCurrentThreadId () returned 0x970 [0064.824] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.824] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.824] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379b6b8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0064.824] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.824] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.824] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379b6b8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0064.824] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.824] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.824] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0064.824] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.824] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.824] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0064.824] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.824] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.824] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379b718, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0064.824] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.824] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.824] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379b718, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0064.824] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.824] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.824] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379b718, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0064.824] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xc, wMilliseconds=0x5f)) [0064.824] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="9xfl\"37ZBY#+}**)Fh&J#jdK.)%46~1>", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0064.825] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="9xfl\"37ZBY#+}**)Fh&J#jdK.)%46~1>", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0064.825] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="9xfl\"37ZBY#+}**)Fh&J#jdK.)%46~1>", cchWideChar=32, lpMultiByteStr=0x20039e8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="9xfl\"37ZBY#+}**)Fh&J#jdK.)%46~1>", lpUsedDefaultChar=0x0) returned 32 [0064.825] GetCurrentThreadId () returned 0x970 [0064.825] GetCurrentThreadId () returned 0x970 [0064.825] GetCurrentThreadId () returned 0x970 [0064.825] GetCurrentThreadId () returned 0x970 [0064.825] GetCurrentThreadId () returned 0x970 [0064.825] GetCurrentThreadId () returned 0x970 [0064.832] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0064.832] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0064.832] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3797da8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0064.832] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb248, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0064.833] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb248, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAADOBhRE87jxhA5L8cn0sir8KxKbhFeioaEiPXEUNVSSEPMFxIWSdE3FkPicN0XpIuvULhuFH5RL1QJ/WTDATTCTCFn0kEaJr0iWH8LxEhB1gufVZjgJKYiNPQPMWkYDdfYmTLkIENKeGDuVqe+3ib3cEpZ01V1SgApUK5x7ZtJR/DRVdfe+GTHFCQMGBLn4tf4f/294707zQVl7MNzz/Uu0TSWsImvrSMA==") returned 232 [0064.833] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xc, wMilliseconds=0x6f)) [0064.833] GetCurrentThreadId () returned 0x970 [0064.833] GetCurrentThreadId () returned 0x970 [0064.833] GetCurrentThreadId () returned 0x970 [0064.833] GetCurrentThreadId () returned 0x970 [0064.833] GetCurrentThreadId () returned 0x970 [0064.833] GetCurrentThreadId () returned 0x970 [0064.833] GetCurrentThreadId () returned 0x970 [0064.833] GetCurrentThreadId () returned 0x970 [0064.833] GetCurrentThreadId () returned 0x970 [0064.833] GetCurrentThreadId () returned 0x970 [0064.833] GetCurrentThreadId () returned 0x970 [0064.833] GetCurrentThreadId () returned 0x970 [0064.833] GetCurrentThreadId () returned 0x970 [0064.833] GetCurrentThreadId () returned 0x970 [0064.833] GetCurrentThreadId () returned 0x970 [0064.833] GetCurrentThreadId () returned 0x970 [0064.833] GetCurrentThreadId () returned 0x970 [0064.833] GetCurrentThreadId () returned 0x970 [0064.833] GetCurrentThreadId () returned 0x970 [0064.833] GetCurrentThreadId () returned 0x970 [0064.833] GetCurrentThreadId () returned 0x970 [0064.833] GetCurrentThreadId () returned 0x970 [0064.833] GetCurrentThreadId () returned 0x970 [0064.833] GetCurrentThreadId () returned 0x970 [0064.833] GetCurrentThreadId () returned 0x970 [0064.833] GetCurrentThreadId () returned 0x970 [0064.833] GetCurrentThreadId () returned 0x970 [0064.833] GetCurrentThreadId () returned 0x970 [0064.833] GetCurrentThreadId () returned 0x970 [0064.833] GetCurrentThreadId () returned 0x970 [0064.833] GetCurrentThreadId () returned 0x970 [0064.833] GetCurrentThreadId () returned 0x970 [0064.833] GetCurrentThreadId () returned 0x970 [0064.833] GetCurrentThreadId () returned 0x970 [0064.833] GetCurrentThreadId () returned 0x970 [0064.833] GetCurrentThreadId () returned 0x970 [0064.833] GetCurrentThreadId () returned 0x970 [0064.833] GetCurrentThreadId () returned 0x970 [0064.833] GetCurrentThreadId () returned 0x970 [0064.833] GetCurrentThreadId () returned 0x970 [0064.833] GetCurrentThreadId () returned 0x970 [0064.834] GetCurrentThreadId () returned 0x970 [0064.834] GetCurrentThreadId () returned 0x970 [0064.834] GetCurrentThreadId () returned 0x970 [0064.834] GetCurrentThreadId () returned 0x970 [0064.834] GetCurrentThreadId () returned 0x970 [0064.834] GetCurrentThreadId () returned 0x970 [0064.834] GetCurrentThreadId () returned 0x970 [0064.834] GetCurrentThreadId () returned 0x970 [0064.834] GetCurrentThreadId () returned 0x970 [0064.834] GetCurrentThreadId () returned 0x970 [0064.834] GetCurrentThreadId () returned 0x970 [0064.834] GetCurrentThreadId () returned 0x970 [0064.834] GetCurrentThreadId () returned 0x970 [0064.834] GetCurrentThreadId () returned 0x970 [0064.834] GetCurrentThreadId () returned 0x970 [0064.834] GetCurrentThreadId () returned 0x970 [0064.834] GetCurrentThreadId () returned 0x970 [0064.834] GetCurrentThreadId () returned 0x970 [0064.834] GetCurrentThreadId () returned 0x970 [0064.834] GetCurrentThreadId () returned 0x970 [0064.834] GetCurrentThreadId () returned 0x970 [0064.834] GetCurrentThreadId () returned 0x970 [0064.834] GetCurrentThreadId () returned 0x970 [0064.834] GetCurrentThreadId () returned 0x970 [0064.834] GetCurrentThreadId () returned 0x970 [0064.834] GetCurrentThreadId () returned 0x970 [0064.834] GetCurrentThreadId () returned 0x970 [0064.834] GetCurrentThreadId () returned 0x970 [0064.834] GetCurrentThreadId () returned 0x970 [0064.834] GetCurrentThreadId () returned 0x970 [0064.834] GetCurrentThreadId () returned 0x970 [0064.834] GetCurrentThreadId () returned 0x970 [0064.834] GetCurrentThreadId () returned 0x970 [0064.834] GetCurrentThreadId () returned 0x970 [0064.834] GetCurrentThreadId () returned 0x970 [0064.834] GetCurrentThreadId () returned 0x970 [0064.834] GetCurrentThreadId () returned 0x970 [0064.834] GetCurrentThreadId () returned 0x970 [0064.834] GetCurrentThreadId () returned 0x970 [0064.834] GetCurrentThreadId () returned 0x970 [0064.834] GetCurrentThreadId () returned 0x970 [0064.834] GetCurrentThreadId () returned 0x970 [0064.834] GetCurrentThreadId () returned 0x970 [0064.834] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAADOBhRE87jxhA5L8cn0sir8KxKbhFeioaEiPXEUNVSSEPMFxIWSdE3FkPicN0XpIuvULhuFH5RL1QJ/WTDATTCTCFn0kEaJr0iWH8LxEhB1gufVZjgJKYiNPQPMWkYDdfYmTLkIENKeGDuVqe+3ib3cEpZ01V1SgApUK5x7ZtJR/DRVdfe+GTHFCQMGBLn4tf4f/294707zQVl7MNzz/Uu0TSWsImvrSMA==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0064.835] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAADOBhRE87jxhA5L8cn0sir8KxKbhFeioaEiPXEUNVSSEPMFxIWSdE3FkPicN0XpIuvULhuFH5RL1QJ/WTDATTCTCFn0kEaJr0iWH8LxEhB1gufVZjgJKYiNPQPMWkYDdfYmTLkIENKeGDuVqe+3ib3cEpZ01V1SgApUK5x7ZtJR/DRVdfe+GTHFCQMGBLn4tf4f/294707zQVl7MNzz/Uu0TSWsImvrSMA==", cchWideChar=245, lpMultiByteStr=0x353933c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAADOBhRE87jxhA5L8cn0sir8KxKbhFeioaEiPXEUNVSSEPMFxIWSdE3FkPicN0XpIuvULhuFH5RL1QJ/WTDATTCTCFn0kEaJr0iWH8LxEhB1gufVZjgJKYiNPQPMWkYDdfYmTLkIENKeGDuVqe+3ib3cEpZ01V1SgApUK5x7ZtJR/DRVdfe+GTHFCQMGBLn4tf4f/294707zQVl7MNzz/Uu0TSWsImvrSMA==", lpUsedDefaultChar=0x0) returned 245 [0064.835] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0064.835] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0064.835] CloseHandle (hObject=0x158) returned 1 [0064.835] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\background.png")) returned 0 [0064.835] GetLastError () returned 0x5 [0064.835] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\background.png")) returned 0x20 [0064.835] SetLastError (dwErrCode=0x5) [0064.835] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=18510093842) returned 1 [0064.838] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Файл зашифрован [btn-back-static.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\Файл зашифрован [btn-back-static.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0064.838] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0064.838] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0064.838] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0064.838] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0064.838] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0064.839] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0064.839] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0064.839] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0064.839] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0064.839] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0064.839] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0064.839] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0064.839] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0064.839] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0064.839] SetEndOfFile (hFile=0x158) returned 1 [0064.839] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0064.839] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0064.839] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0064.839] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0064.839] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0064.841] WriteFile (in: hFile=0x158, lpBuffer=0x35f04dc*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f04dc*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0064.841] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="\"J14uaPiP}7hwekS}Hg^", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0064.841] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="\"J14uaPiP}7hwekS}Hg^", cchWideChar=32, lpMultiByteStr=0x203641c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\"J14uaPiP}7hwekS}Hg^", lpUsedDefaultChar=0x0) returned 32 [0064.841] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0064.841] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0064.841] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729af85a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729af85a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a377d1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-back-static.png", cAlternateFileName="")) returned 0x295098 [0064.841] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0064.841] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0064.841] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-back-static.png")) returned 0x20 [0064.842] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-back-static.png")) returned 0x20 [0064.842] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-back-static.png")) returned 0x20 [0064.842] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-back-static.png")) returned 0x20 [0064.842] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-back-static.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729af85a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729af85a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a377d1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdc5)) returned 1 [0064.843] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0064.843] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0064.843] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-back-static.png")) returned 0x20 [0064.843] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-back-static.png")) returned 0x20 [0064.843] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0064.843] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0064.843] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0064.843] SetEndOfFile (hFile=0x158) returned 1 [0064.844] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="btn-back-static.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0064.844] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="btn-back-static.png", cchWideChar=19, lpMultiByteStr=0x1ff89c4, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn-back-static.png", lpUsedDefaultChar=0x0) returned 19 [0064.844] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="btn-back-static.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0064.844] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="btn-back-static.png", cchWideChar=19, lpMultiByteStr=0x1ff8a14, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn-back-static.png", lpUsedDefaultChar=0x0) returned 19 [0064.844] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff8a14, cbMultiByte=19, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="btn-back-static.pngsk.pngt.pngpngre.pngg") returned 19 [0064.844] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="btn-back-static.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0064.844] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="btn-back-static.png", cchWideChar=19, lpMultiByteStr=0x1ff89c4, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn-back-static.png", lpUsedDefaultChar=0x0) returned 19 [0064.844] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-back-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0064.844] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0064.844] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0xdc5 [0064.844] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0064.844] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0064.844] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0064.845] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="btn-back-static.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0064.845] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="btn-back-static.png", cchWideChar=19, lpMultiByteStr=0x1ff89c4, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn-back-static.png", lpUsedDefaultChar=0x0) returned 19 [0064.845] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="btn-back-static.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0064.845] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="btn-back-static.png", cchWideChar=19, lpMultiByteStr=0x1ff8a14, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn-back-static.png", lpUsedDefaultChar=0x0) returned 19 [0064.845] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff8a14, cbMultiByte=19, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="btn-back-static.pngic.pngsk.pngt.pngpngre.pngg") returned 19 [0064.845] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="btn-back-static.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0064.845] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="btn-back-static.png", cchWideChar=19, lpMultiByteStr=0x1ff89c4, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn-back-static.png", lpUsedDefaultChar=0x0) returned 19 [0064.845] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0064.846] CharToOemA (in: pSrc="btn-back-static.png", pDst=0x1ff8a14 | out: pDst="btn-back-static.png") returned 1 [0064.846] WriteFile (in: hFile=0x158, lpBuffer=0x1ff8a14*, nNumberOfBytesToWrite=0x13, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1ff8a14*, lpNumberOfBytesWritten=0x18e048*=0x13, lpOverlapped=0x0) returned 1 [0064.846] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0064.846] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0064.846] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0064.846] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=18510962056) returned 1 [0064.846] ReadFile (in: hFile=0x11c, lpBuffer=0x37c6700, nNumberOfBytesToRead=0xdc5, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37c6700*, lpNumberOfBytesRead=0x18dd7c*=0xdc5, lpOverlapped=0x0) returned 1 [0064.848] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0064.848] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=18511121832) returned 1 [0064.857] WriteFile (in: hFile=0x158, lpBuffer=0x379ad38*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379ad38*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0064.858] ReadFile (in: hFile=0x11c, lpBuffer=0x37c6700, nNumberOfBytesToRead=0xdc5, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x37c6700*, lpNumberOfBytesRead=0x18de38*=0xdc5, lpOverlapped=0x0) returned 1 [0064.858] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x4e [0064.858] WriteFile (in: hFile=0x158, lpBuffer=0x3808d20*, nNumberOfBytesToWrite=0xdc5, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3808d20*, lpNumberOfBytesWritten=0x18de10*=0xdc5, lpOverlapped=0x0) returned 1 [0064.858] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0xe13 [0064.858] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0064.858] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0064.858] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0064.858] SetFilePointer (in: hFile=0x158, lDistanceToMove=19, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x31 [0064.858] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0xe1d [0064.859] CloseHandle (hObject=0x11c) returned 1 [0064.859] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xe1d [0064.859] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xe1d [0064.859] SetFilePointer (in: hFile=0x158, lDistanceToMove=3613, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xe1d [0064.859] SetFilePointer (in: hFile=0x158, lDistanceToMove=3613, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0xe1d [0064.859] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xe1d [0064.859] SetFilePointer (in: hFile=0x158, lDistanceToMove=3613, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0xe1d [0064.859] SetEndOfFile (hFile=0x158) returned 1 [0064.859] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xe1d [0064.859] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xe1d [0064.859] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="btn-back-static.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0064.859] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="btn-back-static.png", cchWideChar=19, lpMultiByteStr=0x1ff8a14, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn-back-static.png", lpUsedDefaultChar=0x0) returned 19 [0064.859] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="btn-back-static.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0064.859] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="btn-back-static.png", cchWideChar=19, lpMultiByteStr=0x1ff89c4, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn-back-static.png", lpUsedDefaultChar=0x0) returned 19 [0064.859] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff89c4, cbMultiByte=19, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="btn-back-static.png`믑`") returned 19 [0064.860] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="btn-back-static.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0064.860] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="btn-back-static.png", cchWideChar=19, lpMultiByteStr=0x1ff8a14, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn-back-static.png", lpUsedDefaultChar=0x0) returned 19 [0064.860] WriteFile (in: hFile=0x158, lpBuffer=0x37aa1d8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x37aa1d8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0064.860] CharToOemA (in: pSrc="btn-back-static.png", pDst=0x1ff89c4 | out: pDst="btn-back-static.png") returned 1 [0064.860] WriteFile (in: hFile=0x158, lpBuffer=0x1ff89c4*, nNumberOfBytesToWrite=0x13, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1ff89c4*, lpNumberOfBytesWritten=0x18efcc*=0x13, lpOverlapped=0x0) returned 1 [0064.860] WriteFile (in: hFile=0x158, lpBuffer=0x379ae18*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379ae18*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0064.860] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0064.860] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0064.860] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xe69 [0064.860] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xe69 [0064.860] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0064.860] WriteFile (in: hFile=0x158, lpBuffer=0x35f04dc*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f04dc*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0064.860] DeleteFileW (lpFileName="") returned 0 [0064.860] GetLastError () returned 0x3 [0064.860] GetFileAttributesW (lpFileName="") returned 0xffffffff [0064.860] SetLastError (dwErrCode=0x3) [0064.861] FlushFileBuffers (hFile=0x158) returned 1 [0064.871] GetCurrentThreadId () returned 0x970 [0064.871] GetCurrentThreadId () returned 0x970 [0064.871] GetCurrentThreadId () returned 0x970 [0064.871] GetCurrentThreadId () returned 0x970 [0064.871] GetCurrentThreadId () returned 0x970 [0064.871] GetCurrentThreadId () returned 0x970 [0064.871] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xf20 [0064.871] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xf20 [0064.871] SetFilePointer (in: hFile=0x158, lDistanceToMove=3872, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xf20 [0064.871] CloseHandle (hObject=0x158) returned 1 [0064.871] GetCurrentThreadId () returned 0x970 [0064.871] GetCurrentThreadId () returned 0x970 [0064.871] GetCurrentThreadId () returned 0x970 [0064.871] GetCurrentThreadId () returned 0x970 [0064.871] GetCurrentThreadId () returned 0x970 [0064.871] GetCurrentThreadId () returned 0x970 [0064.871] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Файл зашифрован [btn-back-static.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\Файл зашифрован [btn-back-static.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0064.872] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf20 [0064.872] SetFilePointer (in: hFile=0x158, lDistanceToMove=3744, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xea0 [0064.872] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0064.872] GetFileType (hFile=0x158) returned 0x1 [0064.872] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xc, wMilliseconds=0x8e)) [0064.872] GetCurrentThreadId () returned 0x970 [0064.872] GetCurrentThreadId () returned 0x970 [0064.872] GetCurrentThreadId () returned 0x970 [0064.872] GetCurrentThreadId () returned 0x970 [0064.872] GetCurrentThreadId () returned 0x970 [0064.872] GetCurrentThreadId () returned 0x970 [0064.872] GetCurrentThreadId () returned 0x970 [0064.872] GetCurrentThreadId () returned 0x970 [0064.872] GetCurrentThreadId () returned 0x970 [0064.872] GetCurrentThreadId () returned 0x970 [0064.872] GetCurrentThreadId () returned 0x970 [0064.872] GetCurrentThreadId () returned 0x970 [0064.872] GetCurrentThreadId () returned 0x970 [0064.872] GetCurrentThreadId () returned 0x970 [0064.872] GetCurrentThreadId () returned 0x970 [0064.872] GetCurrentThreadId () returned 0x970 [0064.872] GetCurrentThreadId () returned 0x970 [0064.872] GetCurrentThreadId () returned 0x970 [0064.872] GetCurrentThreadId () returned 0x970 [0064.872] GetCurrentThreadId () returned 0x970 [0064.872] GetCurrentThreadId () returned 0x970 [0064.872] GetCurrentThreadId () returned 0x970 [0064.872] GetCurrentThreadId () returned 0x970 [0064.872] GetCurrentThreadId () returned 0x970 [0064.872] GetCurrentThreadId () returned 0x970 [0064.872] GetCurrentThreadId () returned 0x970 [0064.872] GetCurrentThreadId () returned 0x970 [0064.872] GetCurrentThreadId () returned 0x970 [0064.872] GetCurrentThreadId () returned 0x970 [0064.872] GetCurrentThreadId () returned 0x970 [0064.872] GetCurrentThreadId () returned 0x970 [0064.873] GetCurrentThreadId () returned 0x970 [0064.873] GetCurrentThreadId () returned 0x970 [0064.873] GetCurrentThreadId () returned 0x970 [0064.873] GetCurrentThreadId () returned 0x970 [0064.873] GetCurrentThreadId () returned 0x970 [0064.873] GetCurrentThreadId () returned 0x970 [0064.873] GetCurrentThreadId () returned 0x970 [0064.873] GetCurrentThreadId () returned 0x970 [0064.873] GetCurrentThreadId () returned 0x970 [0064.873] GetCurrentThreadId () returned 0x970 [0064.873] GetCurrentThreadId () returned 0x970 [0064.873] GetCurrentThreadId () returned 0x970 [0064.873] GetCurrentThreadId () returned 0x970 [0064.873] GetCurrentThreadId () returned 0x970 [0064.873] GetCurrentThreadId () returned 0x970 [0064.873] GetCurrentThreadId () returned 0x970 [0064.873] GetCurrentThreadId () returned 0x970 [0064.873] GetCurrentThreadId () returned 0x970 [0064.873] GetCurrentThreadId () returned 0x970 [0064.873] GetCurrentThreadId () returned 0x970 [0064.873] GetCurrentThreadId () returned 0x970 [0064.873] GetCurrentThreadId () returned 0x970 [0064.873] GetCurrentThreadId () returned 0x970 [0064.873] GetCurrentThreadId () returned 0x970 [0064.873] GetCurrentThreadId () returned 0x970 [0064.873] GetCurrentThreadId () returned 0x970 [0064.873] GetCurrentThreadId () returned 0x970 [0064.873] GetCurrentThreadId () returned 0x970 [0064.873] GetCurrentThreadId () returned 0x970 [0064.873] GetCurrentThreadId () returned 0x970 [0064.873] GetCurrentThreadId () returned 0x970 [0064.873] GetCurrentThreadId () returned 0x970 [0064.873] GetCurrentThreadId () returned 0x970 [0064.873] GetCurrentThreadId () returned 0x970 [0064.873] GetCurrentThreadId () returned 0x970 [0064.873] GetCurrentThreadId () returned 0x970 [0064.873] GetCurrentThreadId () returned 0x970 [0064.873] GetCurrentThreadId () returned 0x970 [0064.873] GetCurrentThreadId () returned 0x970 [0064.873] GetCurrentThreadId () returned 0x970 [0064.873] GetCurrentThreadId () returned 0x970 [0064.873] GetCurrentThreadId () returned 0x970 [0064.873] GetCurrentThreadId () returned 0x970 [0064.873] GetCurrentThreadId () returned 0x970 [0064.874] GetCurrentThreadId () returned 0x970 [0064.874] GetCurrentThreadId () returned 0x970 [0064.874] GetCurrentThreadId () returned 0x970 [0064.874] GetCurrentThreadId () returned 0x970 [0064.874] GetCurrentThreadId () returned 0x970 [0064.874] GetCurrentThreadId () returned 0x970 [0064.874] GetCurrentThreadId () returned 0x970 [0064.874] GetCurrentThreadId () returned 0x970 [0064.874] GetCurrentThreadId () returned 0x970 [0064.874] GetCurrentThreadId () returned 0x970 [0064.874] GetCurrentThreadId () returned 0x970 [0064.874] GetCurrentThreadId () returned 0x970 [0064.874] GetCurrentThreadId () returned 0x970 [0064.874] GetCurrentThreadId () returned 0x970 [0064.874] GetCurrentThreadId () returned 0x970 [0064.874] GetCurrentThreadId () returned 0x970 [0064.874] GetCurrentThreadId () returned 0x970 [0064.874] GetCurrentThreadId () returned 0x970 [0064.874] GetCurrentThreadId () returned 0x970 [0064.874] GetCurrentThreadId () returned 0x970 [0064.874] GetCurrentThreadId () returned 0x970 [0064.874] GetCurrentThreadId () returned 0x970 [0064.874] GetCurrentThreadId () returned 0x970 [0064.874] GetCurrentThreadId () returned 0x970 [0064.874] GetCurrentThreadId () returned 0x970 [0064.874] GetCurrentThreadId () returned 0x970 [0064.874] GetCurrentThreadId () returned 0x970 [0064.874] GetCurrentThreadId () returned 0x970 [0064.874] GetCurrentThreadId () returned 0x970 [0064.874] GetCurrentThreadId () returned 0x970 [0064.874] GetCurrentThreadId () returned 0x970 [0064.874] GetCurrentThreadId () returned 0x970 [0064.874] GetCurrentThreadId () returned 0x970 [0064.874] GetCurrentThreadId () returned 0x970 [0064.874] GetCurrentThreadId () returned 0x970 [0064.874] GetCurrentThreadId () returned 0x970 [0064.874] GetCurrentThreadId () returned 0x970 [0064.874] GetCurrentThreadId () returned 0x970 [0064.874] GetCurrentThreadId () returned 0x970 [0064.874] GetCurrentThreadId () returned 0x970 [0064.874] GetCurrentThreadId () returned 0x970 [0064.874] GetCurrentThreadId () returned 0x970 [0064.874] GetCurrentThreadId () returned 0x970 [0064.874] GetCurrentThreadId () returned 0x970 [0064.875] GetCurrentThreadId () returned 0x970 [0064.875] GetCurrentThreadId () returned 0x970 [0064.875] GetCurrentThreadId () returned 0x970 [0064.875] GetCurrentThreadId () returned 0x970 [0064.875] GetCurrentThreadId () returned 0x970 [0064.875] GetCurrentThreadId () returned 0x970 [0064.875] GetCurrentThreadId () returned 0x970 [0064.875] GetCurrentThreadId () returned 0x970 [0064.875] GetCurrentThreadId () returned 0x970 [0064.875] GetCurrentThreadId () returned 0x970 [0064.875] GetCurrentThreadId () returned 0x970 [0064.875] GetCurrentThreadId () returned 0x970 [0064.875] GetCurrentThreadId () returned 0x970 [0064.875] GetCurrentThreadId () returned 0x970 [0064.875] GetCurrentThreadId () returned 0x970 [0064.875] GetCurrentThreadId () returned 0x970 [0064.875] GetCurrentThreadId () returned 0x970 [0064.875] GetCurrentThreadId () returned 0x970 [0064.875] GetCurrentThreadId () returned 0x970 [0064.875] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.875] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.875] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379b718, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0064.875] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.875] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.875] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379b718, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0064.875] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.875] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.875] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0064.875] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.875] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.875] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0064.875] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.875] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.875] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379b778, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0064.875] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.875] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.875] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379b778, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0064.876] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.876] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.876] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379b778, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0064.876] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xc, wMilliseconds=0x8e)) [0064.876] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="\"J14uaPiP}7hwekS}Hg^", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0064.876] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="\"J14uaPiP}7hwekS}Hg^", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0064.876] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="\"J14uaPiP}7hwekS}Hg^", cchWideChar=32, lpMultiByteStr=0x2003898, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\"J14uaPiP}7hwekS}Hg^", lpUsedDefaultChar=0x0) returned 32 [0064.876] GetCurrentThreadId () returned 0x970 [0064.876] GetCurrentThreadId () returned 0x970 [0064.876] GetCurrentThreadId () returned 0x970 [0064.876] GetCurrentThreadId () returned 0x970 [0064.876] GetCurrentThreadId () returned 0x970 [0064.876] GetCurrentThreadId () returned 0x970 [0064.884] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0064.884] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0064.884] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3797e98, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0064.884] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb248, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0064.884] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb248, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAGMHPYXIneJRWaLe8Aj2xv6D7Bp5ew5ZnDkWgSObPAralM9XCmX1cFWzUKL0iaOvJoZ8SUeX+6RvxMmC2fTLhGxKEDE6J3Loczq9zJ3P2NcVd49GHfXnQNucLYMxj/ZWUgQTyEOSdpplkEnbLjMl2j3/AIM+LbYRa4xv38hSqXwzoSOW2oXEv2G1bz1cfUts6ttAjA+RFP3riEDdyQomBoyVnH2X6LvNrQ==") returned 232 [0064.884] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xc, wMilliseconds=0x9e)) [0064.884] GetCurrentThreadId () returned 0x970 [0064.884] GetCurrentThreadId () returned 0x970 [0064.884] GetCurrentThreadId () returned 0x970 [0064.884] GetCurrentThreadId () returned 0x970 [0064.884] GetCurrentThreadId () returned 0x970 [0064.884] GetCurrentThreadId () returned 0x970 [0064.884] GetCurrentThreadId () returned 0x970 [0064.884] GetCurrentThreadId () returned 0x970 [0064.884] GetCurrentThreadId () returned 0x970 [0064.884] GetCurrentThreadId () returned 0x970 [0064.884] GetCurrentThreadId () returned 0x970 [0064.884] GetCurrentThreadId () returned 0x970 [0064.884] GetCurrentThreadId () returned 0x970 [0064.884] GetCurrentThreadId () returned 0x970 [0064.884] GetCurrentThreadId () returned 0x970 [0064.884] GetCurrentThreadId () returned 0x970 [0064.884] GetCurrentThreadId () returned 0x970 [0064.884] GetCurrentThreadId () returned 0x970 [0064.884] GetCurrentThreadId () returned 0x970 [0064.884] GetCurrentThreadId () returned 0x970 [0064.884] GetCurrentThreadId () returned 0x970 [0064.885] GetCurrentThreadId () returned 0x970 [0064.885] GetCurrentThreadId () returned 0x970 [0064.885] GetCurrentThreadId () returned 0x970 [0064.885] GetCurrentThreadId () returned 0x970 [0064.885] GetCurrentThreadId () returned 0x970 [0064.885] GetCurrentThreadId () returned 0x970 [0064.885] GetCurrentThreadId () returned 0x970 [0064.885] GetCurrentThreadId () returned 0x970 [0064.885] GetCurrentThreadId () returned 0x970 [0064.885] GetCurrentThreadId () returned 0x970 [0064.885] GetCurrentThreadId () returned 0x970 [0064.885] GetCurrentThreadId () returned 0x970 [0064.885] GetCurrentThreadId () returned 0x970 [0064.885] GetCurrentThreadId () returned 0x970 [0064.885] GetCurrentThreadId () returned 0x970 [0064.885] GetCurrentThreadId () returned 0x970 [0064.885] GetCurrentThreadId () returned 0x970 [0064.885] GetCurrentThreadId () returned 0x970 [0064.885] GetCurrentThreadId () returned 0x970 [0064.885] GetCurrentThreadId () returned 0x970 [0064.885] GetCurrentThreadId () returned 0x970 [0064.885] GetCurrentThreadId () returned 0x970 [0064.885] GetCurrentThreadId () returned 0x970 [0064.885] GetCurrentThreadId () returned 0x970 [0064.885] GetCurrentThreadId () returned 0x970 [0064.885] GetCurrentThreadId () returned 0x970 [0064.885] GetCurrentThreadId () returned 0x970 [0064.885] GetCurrentThreadId () returned 0x970 [0064.885] GetCurrentThreadId () returned 0x970 [0064.885] GetCurrentThreadId () returned 0x970 [0064.885] GetCurrentThreadId () returned 0x970 [0064.885] GetCurrentThreadId () returned 0x970 [0064.885] GetCurrentThreadId () returned 0x970 [0064.885] GetCurrentThreadId () returned 0x970 [0064.885] GetCurrentThreadId () returned 0x970 [0064.885] GetCurrentThreadId () returned 0x970 [0064.885] GetCurrentThreadId () returned 0x970 [0064.885] GetCurrentThreadId () returned 0x970 [0064.885] GetCurrentThreadId () returned 0x970 [0064.885] GetCurrentThreadId () returned 0x970 [0064.885] GetCurrentThreadId () returned 0x970 [0064.885] GetCurrentThreadId () returned 0x970 [0064.885] GetCurrentThreadId () returned 0x970 [0064.885] GetCurrentThreadId () returned 0x970 [0064.886] GetCurrentThreadId () returned 0x970 [0064.886] GetCurrentThreadId () returned 0x970 [0064.886] GetCurrentThreadId () returned 0x970 [0064.886] GetCurrentThreadId () returned 0x970 [0064.886] GetCurrentThreadId () returned 0x970 [0064.886] GetCurrentThreadId () returned 0x970 [0064.886] GetCurrentThreadId () returned 0x970 [0064.886] GetCurrentThreadId () returned 0x970 [0064.886] GetCurrentThreadId () returned 0x970 [0064.886] GetCurrentThreadId () returned 0x970 [0064.886] GetCurrentThreadId () returned 0x970 [0064.886] GetCurrentThreadId () returned 0x970 [0064.886] GetCurrentThreadId () returned 0x970 [0064.886] GetCurrentThreadId () returned 0x970 [0064.886] GetCurrentThreadId () returned 0x970 [0064.886] GetCurrentThreadId () returned 0x970 [0064.886] GetCurrentThreadId () returned 0x970 [0064.886] GetCurrentThreadId () returned 0x970 [0064.886] GetCurrentThreadId () returned 0x970 [0064.886] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAGMHPYXIneJRWaLe8Aj2xv6D7Bp5ew5ZnDkWgSObPAralM9XCmX1cFWzUKL0iaOvJoZ8SUeX+6RvxMmC2fTLhGxKEDE6J3Loczq9zJ3P2NcVd49GHfXnQNucLYMxj/ZWUgQTyEOSdpplkEnbLjMl2j3/AIM+LbYRa4xv38hSqXwzoSOW2oXEv2G1bz1cfUts6ttAjA+RFP3riEDdyQomBoyVnH2X6LvNrQ==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0064.886] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAGMHPYXIneJRWaLe8Aj2xv6D7Bp5ew5ZnDkWgSObPAralM9XCmX1cFWzUKL0iaOvJoZ8SUeX+6RvxMmC2fTLhGxKEDE6J3Loczq9zJ3P2NcVd49GHfXnQNucLYMxj/ZWUgQTyEOSdpplkEnbLjMl2j3/AIM+LbYRa4xv38hSqXwzoSOW2oXEv2G1bz1cfUts6ttAjA+RFP3riEDdyQomBoyVnH2X6LvNrQ==", cchWideChar=245, lpMultiByteStr=0x353933c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAGMHPYXIneJRWaLe8Aj2xv6D7Bp5ew5ZnDkWgSObPAralM9XCmX1cFWzUKL0iaOvJoZ8SUeX+6RvxMmC2fTLhGxKEDE6J3Loczq9zJ3P2NcVd49GHfXnQNucLYMxj/ZWUgQTyEOSdpplkEnbLjMl2j3/AIM+LbYRa4xv38hSqXwzoSOW2oXEv2G1bz1cfUts6ttAjA+RFP3riEDdyQomBoyVnH2X6LvNrQ==", lpUsedDefaultChar=0x0) returned 245 [0064.886] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0064.886] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0064.886] CloseHandle (hObject=0x158) returned 1 [0064.887] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-back-static.png")) returned 0 [0064.887] GetLastError () returned 0x5 [0064.887] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-back-static.png")) returned 0x20 [0064.887] SetLastError (dwErrCode=0x5) [0064.887] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=18515027521) returned 1 [0064.887] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Файл зашифрован [btn-next-static.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\Файл зашифрован [btn-next-static.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0064.887] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0064.887] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0064.887] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0064.887] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0064.888] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0064.888] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0064.888] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0064.888] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0064.888] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0064.888] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0064.888] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0064.888] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0064.888] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0064.888] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0064.888] SetEndOfFile (hFile=0x158) returned 1 [0064.888] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0064.888] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0064.888] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0064.888] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0064.888] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0064.889] WriteFile (in: hFile=0x158, lpBuffer=0x35f035c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f035c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0064.889] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="@%K#A,haF!5sP)0Q^ee:+)}si%cH+rWA", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0064.890] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="@%K#A,haF!5sP)0Q^ee:+)}si%cH+rWA", cchWideChar=32, lpMultiByteStr=0x20363e4, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="@%K#A,haF!5sP)0Q^ee:+)}si%cH+rWA", lpUsedDefaultChar=0x0) returned 32 [0064.890] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0064.890] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0064.890] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729af85a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729af85a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a377d1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdfc, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-next-static.png", cAlternateFileName="")) returned 0x295098 [0064.890] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0064.890] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0064.890] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-next-static.png")) returned 0x20 [0064.890] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-next-static.png")) returned 0x20 [0064.890] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-next-static.png")) returned 0x20 [0064.890] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-next-static.png")) returned 0x20 [0064.890] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-next-static.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729af85a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729af85a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a377d1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdfc)) returned 1 [0064.890] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0064.890] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0064.890] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-next-static.png")) returned 0x20 [0064.890] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-next-static.png")) returned 0x20 [0064.890] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0064.891] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0064.891] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0064.891] SetEndOfFile (hFile=0x158) returned 1 [0064.891] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="btn-next-static.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0064.891] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="btn-next-static.png", cchWideChar=19, lpMultiByteStr=0x1ff885c, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn-next-static.png", lpUsedDefaultChar=0x0) returned 19 [0064.892] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="btn-next-static.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0064.892] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="btn-next-static.png", cchWideChar=19, lpMultiByteStr=0x1ff89ec, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn-next-static.png", lpUsedDefaultChar=0x0) returned 19 [0064.892] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff89ec, cbMultiByte=19, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="btn-next-static.pngsk.pngt.pngpngre.pngg") returned 19 [0064.892] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="btn-next-static.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0064.892] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="btn-next-static.png", cchWideChar=19, lpMultiByteStr=0x1ff885c, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn-next-static.png", lpUsedDefaultChar=0x0) returned 19 [0064.892] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-next-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0064.892] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0064.892] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0xdfc [0064.892] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0064.892] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0064.892] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0064.892] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="btn-next-static.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0064.892] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="btn-next-static.png", cchWideChar=19, lpMultiByteStr=0x1ff885c, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn-next-static.png", lpUsedDefaultChar=0x0) returned 19 [0064.892] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="btn-next-static.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0064.892] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="btn-next-static.png", cchWideChar=19, lpMultiByteStr=0x1ff89ec, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn-next-static.png", lpUsedDefaultChar=0x0) returned 19 [0064.892] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff89ec, cbMultiByte=19, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="btn-next-static.pngic.pngsk.pngt.pngpngre.pngg") returned 19 [0064.893] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="btn-next-static.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0064.893] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="btn-next-static.png", cchWideChar=19, lpMultiByteStr=0x1ff885c, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn-next-static.png", lpUsedDefaultChar=0x0) returned 19 [0064.893] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0064.893] CharToOemA (in: pSrc="btn-next-static.png", pDst=0x1ff89ec | out: pDst="btn-next-static.png") returned 1 [0064.893] WriteFile (in: hFile=0x158, lpBuffer=0x1ff89ec*, nNumberOfBytesToWrite=0x13, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1ff89ec*, lpNumberOfBytesWritten=0x18e048*=0x13, lpOverlapped=0x0) returned 1 [0064.894] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0064.894] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0064.894] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0064.894] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=18515748518) returned 1 [0064.894] ReadFile (in: hFile=0x11c, lpBuffer=0x37c6700, nNumberOfBytesToRead=0xdfc, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37c6700*, lpNumberOfBytesRead=0x18dd7c*=0xdfc, lpOverlapped=0x0) returned 1 [0064.896] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0064.896] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=18515915706) returned 1 [0064.904] WriteFile (in: hFile=0x158, lpBuffer=0x379ade0*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379ade0*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0064.904] ReadFile (in: hFile=0x11c, lpBuffer=0x37c6700, nNumberOfBytesToRead=0xdfc, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x37c6700*, lpNumberOfBytesRead=0x18de38*=0xdfc, lpOverlapped=0x0) returned 1 [0064.905] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x4e [0064.905] WriteFile (in: hFile=0x158, lpBuffer=0x3808d20*, nNumberOfBytesToWrite=0xdfc, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3808d20*, lpNumberOfBytesWritten=0x18de10*=0xdfc, lpOverlapped=0x0) returned 1 [0064.905] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0xe4a [0064.905] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0064.905] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0064.905] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0064.905] SetFilePointer (in: hFile=0x158, lDistanceToMove=19, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x31 [0064.905] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0xe54 [0064.905] CloseHandle (hObject=0x11c) returned 1 [0064.905] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xe54 [0064.905] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xe54 [0064.906] SetFilePointer (in: hFile=0x158, lDistanceToMove=3668, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xe54 [0064.906] SetFilePointer (in: hFile=0x158, lDistanceToMove=3668, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0xe54 [0064.906] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xe54 [0064.906] SetFilePointer (in: hFile=0x158, lDistanceToMove=3668, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0xe54 [0064.906] SetEndOfFile (hFile=0x158) returned 1 [0064.906] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xe54 [0064.906] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xe54 [0064.906] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="btn-next-static.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0064.906] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="btn-next-static.png", cchWideChar=19, lpMultiByteStr=0x1ff89ec, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn-next-static.png", lpUsedDefaultChar=0x0) returned 19 [0064.906] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="btn-next-static.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0064.906] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="btn-next-static.png", cchWideChar=19, lpMultiByteStr=0x1ff885c, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn-next-static.png", lpUsedDefaultChar=0x0) returned 19 [0064.906] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff885c, cbMultiByte=19, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="btn-next-static.png`믑`") returned 19 [0064.906] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="btn-next-static.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0064.906] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="btn-next-static.png", cchWideChar=19, lpMultiByteStr=0x1ff89ec, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn-next-static.png", lpUsedDefaultChar=0x0) returned 19 [0064.906] WriteFile (in: hFile=0x158, lpBuffer=0x37aa1d8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x37aa1d8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0064.906] CharToOemA (in: pSrc="btn-next-static.png", pDst=0x1ff885c | out: pDst="btn-next-static.png") returned 1 [0064.906] WriteFile (in: hFile=0x158, lpBuffer=0x1ff885c*, nNumberOfBytesToWrite=0x13, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1ff885c*, lpNumberOfBytesWritten=0x18efcc*=0x13, lpOverlapped=0x0) returned 1 [0064.907] WriteFile (in: hFile=0x158, lpBuffer=0x379acf8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379acf8*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0064.907] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0064.907] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0064.907] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xea0 [0064.907] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xea0 [0064.907] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0064.907] WriteFile (in: hFile=0x158, lpBuffer=0x35f035c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f035c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0064.907] DeleteFileW (lpFileName="") returned 0 [0064.907] GetLastError () returned 0x3 [0064.907] GetFileAttributesW (lpFileName="") returned 0xffffffff [0064.907] SetLastError (dwErrCode=0x3) [0064.907] FlushFileBuffers (hFile=0x158) returned 1 [0064.910] GetCurrentThreadId () returned 0x970 [0064.910] GetCurrentThreadId () returned 0x970 [0064.910] GetCurrentThreadId () returned 0x970 [0064.910] GetCurrentThreadId () returned 0x970 [0064.910] GetCurrentThreadId () returned 0x970 [0064.910] GetCurrentThreadId () returned 0x970 [0064.910] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xf57 [0064.910] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xf57 [0064.911] SetFilePointer (in: hFile=0x158, lDistanceToMove=3927, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xf57 [0064.911] CloseHandle (hObject=0x158) returned 1 [0064.911] GetCurrentThreadId () returned 0x970 [0064.911] GetCurrentThreadId () returned 0x970 [0064.911] GetCurrentThreadId () returned 0x970 [0064.911] GetCurrentThreadId () returned 0x970 [0064.911] GetCurrentThreadId () returned 0x970 [0064.911] GetCurrentThreadId () returned 0x970 [0064.911] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Файл зашифрован [btn-next-static.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\Файл зашифрован [btn-next-static.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0064.911] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf57 [0064.911] SetFilePointer (in: hFile=0x158, lDistanceToMove=3799, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xed7 [0064.911] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0064.911] GetFileType (hFile=0x158) returned 0x1 [0064.911] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xc, wMilliseconds=0xbd)) [0064.911] GetCurrentThreadId () returned 0x970 [0064.911] GetCurrentThreadId () returned 0x970 [0064.911] GetCurrentThreadId () returned 0x970 [0064.911] GetCurrentThreadId () returned 0x970 [0064.911] GetCurrentThreadId () returned 0x970 [0064.911] GetCurrentThreadId () returned 0x970 [0064.911] GetCurrentThreadId () returned 0x970 [0064.911] GetCurrentThreadId () returned 0x970 [0064.911] GetCurrentThreadId () returned 0x970 [0064.911] GetCurrentThreadId () returned 0x970 [0064.911] GetCurrentThreadId () returned 0x970 [0064.912] GetCurrentThreadId () returned 0x970 [0064.912] GetCurrentThreadId () returned 0x970 [0064.912] GetCurrentThreadId () returned 0x970 [0064.912] GetCurrentThreadId () returned 0x970 [0064.912] GetCurrentThreadId () returned 0x970 [0064.912] GetCurrentThreadId () returned 0x970 [0064.912] GetCurrentThreadId () returned 0x970 [0064.912] GetCurrentThreadId () returned 0x970 [0064.912] GetCurrentThreadId () returned 0x970 [0064.912] GetCurrentThreadId () returned 0x970 [0064.912] GetCurrentThreadId () returned 0x970 [0064.912] GetCurrentThreadId () returned 0x970 [0064.912] GetCurrentThreadId () returned 0x970 [0064.912] GetCurrentThreadId () returned 0x970 [0064.912] GetCurrentThreadId () returned 0x970 [0064.912] GetCurrentThreadId () returned 0x970 [0064.912] GetCurrentThreadId () returned 0x970 [0064.912] GetCurrentThreadId () returned 0x970 [0064.912] GetCurrentThreadId () returned 0x970 [0064.912] GetCurrentThreadId () returned 0x970 [0064.912] GetCurrentThreadId () returned 0x970 [0064.912] GetCurrentThreadId () returned 0x970 [0064.912] GetCurrentThreadId () returned 0x970 [0064.912] GetCurrentThreadId () returned 0x970 [0064.912] GetCurrentThreadId () returned 0x970 [0064.912] GetCurrentThreadId () returned 0x970 [0064.912] GetCurrentThreadId () returned 0x970 [0064.912] GetCurrentThreadId () returned 0x970 [0064.912] GetCurrentThreadId () returned 0x970 [0064.912] GetCurrentThreadId () returned 0x970 [0064.912] GetCurrentThreadId () returned 0x970 [0064.912] GetCurrentThreadId () returned 0x970 [0064.912] GetCurrentThreadId () returned 0x970 [0064.912] GetCurrentThreadId () returned 0x970 [0064.912] GetCurrentThreadId () returned 0x970 [0064.912] GetCurrentThreadId () returned 0x970 [0064.912] GetCurrentThreadId () returned 0x970 [0064.912] GetCurrentThreadId () returned 0x970 [0064.912] GetCurrentThreadId () returned 0x970 [0064.912] GetCurrentThreadId () returned 0x970 [0064.912] GetCurrentThreadId () returned 0x970 [0064.912] GetCurrentThreadId () returned 0x970 [0064.912] GetCurrentThreadId () returned 0x970 [0064.912] GetCurrentThreadId () returned 0x970 [0064.912] GetCurrentThreadId () returned 0x970 [0064.913] GetCurrentThreadId () returned 0x970 [0064.913] GetCurrentThreadId () returned 0x970 [0064.913] GetCurrentThreadId () returned 0x970 [0064.913] GetCurrentThreadId () returned 0x970 [0064.913] GetCurrentThreadId () returned 0x970 [0064.913] GetCurrentThreadId () returned 0x970 [0064.913] GetCurrentThreadId () returned 0x970 [0064.913] GetCurrentThreadId () returned 0x970 [0064.913] GetCurrentThreadId () returned 0x970 [0064.913] GetCurrentThreadId () returned 0x970 [0064.913] GetCurrentThreadId () returned 0x970 [0064.913] GetCurrentThreadId () returned 0x970 [0064.913] GetCurrentThreadId () returned 0x970 [0064.913] GetCurrentThreadId () returned 0x970 [0064.913] GetCurrentThreadId () returned 0x970 [0064.913] GetCurrentThreadId () returned 0x970 [0064.913] GetCurrentThreadId () returned 0x970 [0064.913] GetCurrentThreadId () returned 0x970 [0064.913] GetCurrentThreadId () returned 0x970 [0064.913] GetCurrentThreadId () returned 0x970 [0064.913] GetCurrentThreadId () returned 0x970 [0064.913] GetCurrentThreadId () returned 0x970 [0064.913] GetCurrentThreadId () returned 0x970 [0064.913] GetCurrentThreadId () returned 0x970 [0064.913] GetCurrentThreadId () returned 0x970 [0064.913] GetCurrentThreadId () returned 0x970 [0064.913] GetCurrentThreadId () returned 0x970 [0064.913] GetCurrentThreadId () returned 0x970 [0064.913] GetCurrentThreadId () returned 0x970 [0064.913] GetCurrentThreadId () returned 0x970 [0064.913] GetCurrentThreadId () returned 0x970 [0064.913] GetCurrentThreadId () returned 0x970 [0064.913] GetCurrentThreadId () returned 0x970 [0064.913] GetCurrentThreadId () returned 0x970 [0064.913] GetCurrentThreadId () returned 0x970 [0064.913] GetCurrentThreadId () returned 0x970 [0064.913] GetCurrentThreadId () returned 0x970 [0064.913] GetCurrentThreadId () returned 0x970 [0064.913] GetCurrentThreadId () returned 0x970 [0064.913] GetCurrentThreadId () returned 0x970 [0064.913] GetCurrentThreadId () returned 0x970 [0064.913] GetCurrentThreadId () returned 0x970 [0064.913] GetCurrentThreadId () returned 0x970 [0064.913] GetCurrentThreadId () returned 0x970 [0064.914] GetCurrentThreadId () returned 0x970 [0064.914] GetCurrentThreadId () returned 0x970 [0064.914] GetCurrentThreadId () returned 0x970 [0064.914] GetCurrentThreadId () returned 0x970 [0064.914] GetCurrentThreadId () returned 0x970 [0064.914] GetCurrentThreadId () returned 0x970 [0064.914] GetCurrentThreadId () returned 0x970 [0064.914] GetCurrentThreadId () returned 0x970 [0064.914] GetCurrentThreadId () returned 0x970 [0064.914] GetCurrentThreadId () returned 0x970 [0064.914] GetCurrentThreadId () returned 0x970 [0064.914] GetCurrentThreadId () returned 0x970 [0064.914] GetCurrentThreadId () returned 0x970 [0064.914] GetCurrentThreadId () returned 0x970 [0064.914] GetCurrentThreadId () returned 0x970 [0064.914] GetCurrentThreadId () returned 0x970 [0064.914] GetCurrentThreadId () returned 0x970 [0064.914] GetCurrentThreadId () returned 0x970 [0064.914] GetCurrentThreadId () returned 0x970 [0064.914] GetCurrentThreadId () returned 0x970 [0064.914] GetCurrentThreadId () returned 0x970 [0064.914] GetCurrentThreadId () returned 0x970 [0064.914] GetCurrentThreadId () returned 0x970 [0064.914] GetCurrentThreadId () returned 0x970 [0064.914] GetCurrentThreadId () returned 0x970 [0064.914] GetCurrentThreadId () returned 0x970 [0064.914] GetCurrentThreadId () returned 0x970 [0064.914] GetCurrentThreadId () returned 0x970 [0064.914] GetCurrentThreadId () returned 0x970 [0064.914] GetCurrentThreadId () returned 0x970 [0064.914] GetCurrentThreadId () returned 0x970 [0064.914] GetCurrentThreadId () returned 0x970 [0064.914] GetCurrentThreadId () returned 0x970 [0064.914] GetCurrentThreadId () returned 0x970 [0064.914] GetCurrentThreadId () returned 0x970 [0064.914] GetCurrentThreadId () returned 0x970 [0064.914] GetCurrentThreadId () returned 0x970 [0064.914] GetCurrentThreadId () returned 0x970 [0064.914] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.914] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.914] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379b778, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0064.914] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.914] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.915] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379b778, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0064.915] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.915] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.915] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0064.915] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.915] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.915] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0064.915] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.915] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.915] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379b7d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0064.915] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.915] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.915] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379b7d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0064.915] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.915] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.915] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379b7d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0064.915] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xc, wMilliseconds=0xbd)) [0064.915] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="@%K#A,haF!5sP)0Q^ee:+)}si%cH+rWA", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0064.915] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="@%K#A,haF!5sP)0Q^ee:+)}si%cH+rWA", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0064.915] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="@%K#A,haF!5sP)0Q^ee:+)}si%cH+rWA", cchWideChar=32, lpMultiByteStr=0x20039e8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="@%K#A,haF!5sP)0Q^ee:+)}si%cH+rWA", lpUsedDefaultChar=0x0) returned 32 [0064.915] GetCurrentThreadId () returned 0x970 [0064.915] GetCurrentThreadId () returned 0x970 [0064.915] GetCurrentThreadId () returned 0x970 [0064.915] GetCurrentThreadId () returned 0x970 [0064.915] GetCurrentThreadId () returned 0x970 [0064.915] GetCurrentThreadId () returned 0x970 [0064.923] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0064.923] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0064.923] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3797f88, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0064.923] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb248, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0064.923] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb248, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAHlIHBWwvmpRVKL3KKy/1n5WzbenOZ35Fb7tSiGIMXnTKzSHIGQp86is7Mbp/VXtwMs1GDZ+Wp/UyW9PpwPy22osS4ccQSYdZj9TBpsfCOGzUhBtmX3DmpS5nPt0GCSfEM9lHd33UwGHzBahL+vV6ju5zo+Lf18g2OJFpEI82EEcbCR8KRM3RuWkLiN1EpAYFFgJQglL2sO9tnC1YJ4Cm5A3MuSOSd8uBw==") returned 232 [0064.923] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xc, wMilliseconds=0xbd)) [0064.923] GetCurrentThreadId () returned 0x970 [0064.923] GetCurrentThreadId () returned 0x970 [0064.923] GetCurrentThreadId () returned 0x970 [0064.923] GetCurrentThreadId () returned 0x970 [0064.923] GetCurrentThreadId () returned 0x970 [0064.923] GetCurrentThreadId () returned 0x970 [0064.923] GetCurrentThreadId () returned 0x970 [0064.923] GetCurrentThreadId () returned 0x970 [0064.923] GetCurrentThreadId () returned 0x970 [0064.923] GetCurrentThreadId () returned 0x970 [0064.923] GetCurrentThreadId () returned 0x970 [0064.923] GetCurrentThreadId () returned 0x970 [0064.923] GetCurrentThreadId () returned 0x970 [0064.923] GetCurrentThreadId () returned 0x970 [0064.923] GetCurrentThreadId () returned 0x970 [0064.923] GetCurrentThreadId () returned 0x970 [0064.923] GetCurrentThreadId () returned 0x970 [0064.923] GetCurrentThreadId () returned 0x970 [0064.923] GetCurrentThreadId () returned 0x970 [0064.923] GetCurrentThreadId () returned 0x970 [0064.923] GetCurrentThreadId () returned 0x970 [0064.923] GetCurrentThreadId () returned 0x970 [0064.923] GetCurrentThreadId () returned 0x970 [0064.923] GetCurrentThreadId () returned 0x970 [0064.923] GetCurrentThreadId () returned 0x970 [0064.923] GetCurrentThreadId () returned 0x970 [0064.923] GetCurrentThreadId () returned 0x970 [0064.923] GetCurrentThreadId () returned 0x970 [0064.923] GetCurrentThreadId () returned 0x970 [0064.923] GetCurrentThreadId () returned 0x970 [0064.924] GetCurrentThreadId () returned 0x970 [0064.924] GetCurrentThreadId () returned 0x970 [0064.924] GetCurrentThreadId () returned 0x970 [0064.924] GetCurrentThreadId () returned 0x970 [0064.924] GetCurrentThreadId () returned 0x970 [0064.924] GetCurrentThreadId () returned 0x970 [0064.924] GetCurrentThreadId () returned 0x970 [0064.924] GetCurrentThreadId () returned 0x970 [0064.924] GetCurrentThreadId () returned 0x970 [0064.924] GetCurrentThreadId () returned 0x970 [0064.924] GetCurrentThreadId () returned 0x970 [0064.924] GetCurrentThreadId () returned 0x970 [0064.924] GetCurrentThreadId () returned 0x970 [0064.924] GetCurrentThreadId () returned 0x970 [0064.924] GetCurrentThreadId () returned 0x970 [0064.924] GetCurrentThreadId () returned 0x970 [0064.924] GetCurrentThreadId () returned 0x970 [0064.924] GetCurrentThreadId () returned 0x970 [0064.924] GetCurrentThreadId () returned 0x970 [0064.924] GetCurrentThreadId () returned 0x970 [0064.924] GetCurrentThreadId () returned 0x970 [0064.924] GetCurrentThreadId () returned 0x970 [0064.924] GetCurrentThreadId () returned 0x970 [0064.924] GetCurrentThreadId () returned 0x970 [0064.924] GetCurrentThreadId () returned 0x970 [0064.924] GetCurrentThreadId () returned 0x970 [0064.924] GetCurrentThreadId () returned 0x970 [0064.924] GetCurrentThreadId () returned 0x970 [0064.924] GetCurrentThreadId () returned 0x970 [0064.924] GetCurrentThreadId () returned 0x970 [0064.924] GetCurrentThreadId () returned 0x970 [0064.924] GetCurrentThreadId () returned 0x970 [0064.924] GetCurrentThreadId () returned 0x970 [0064.924] GetCurrentThreadId () returned 0x970 [0064.924] GetCurrentThreadId () returned 0x970 [0064.924] GetCurrentThreadId () returned 0x970 [0064.924] GetCurrentThreadId () returned 0x970 [0064.924] GetCurrentThreadId () returned 0x970 [0064.924] GetCurrentThreadId () returned 0x970 [0064.924] GetCurrentThreadId () returned 0x970 [0064.924] GetCurrentThreadId () returned 0x970 [0064.924] GetCurrentThreadId () returned 0x970 [0064.924] GetCurrentThreadId () returned 0x970 [0064.924] GetCurrentThreadId () returned 0x970 [0064.924] GetCurrentThreadId () returned 0x970 [0064.924] GetCurrentThreadId () returned 0x970 [0064.925] GetCurrentThreadId () returned 0x970 [0064.925] GetCurrentThreadId () returned 0x970 [0064.925] GetCurrentThreadId () returned 0x970 [0064.925] GetCurrentThreadId () returned 0x970 [0064.925] GetCurrentThreadId () returned 0x970 [0064.925] GetCurrentThreadId () returned 0x970 [0064.925] GetCurrentThreadId () returned 0x970 [0064.925] GetCurrentThreadId () returned 0x970 [0064.925] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAHlIHBWwvmpRVKL3KKy/1n5WzbenOZ35Fb7tSiGIMXnTKzSHIGQp86is7Mbp/VXtwMs1GDZ+Wp/UyW9PpwPy22osS4ccQSYdZj9TBpsfCOGzUhBtmX3DmpS5nPt0GCSfEM9lHd33UwGHzBahL+vV6ju5zo+Lf18g2OJFpEI82EEcbCR8KRM3RuWkLiN1EpAYFFgJQglL2sO9tnC1YJ4Cm5A3MuSOSd8uBw==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0064.925] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAHlIHBWwvmpRVKL3KKy/1n5WzbenOZ35Fb7tSiGIMXnTKzSHIGQp86is7Mbp/VXtwMs1GDZ+Wp/UyW9PpwPy22osS4ccQSYdZj9TBpsfCOGzUhBtmX3DmpS5nPt0GCSfEM9lHd33UwGHzBahL+vV6ju5zo+Lf18g2OJFpEI82EEcbCR8KRM3RuWkLiN1EpAYFFgJQglL2sO9tnC1YJ4Cm5A3MuSOSd8uBw==", cchWideChar=245, lpMultiByteStr=0x353933c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAHlIHBWwvmpRVKL3KKy/1n5WzbenOZ35Fb7tSiGIMXnTKzSHIGQp86is7Mbp/VXtwMs1GDZ+Wp/UyW9PpwPy22osS4ccQSYdZj9TBpsfCOGzUhBtmX3DmpS5nPt0GCSfEM9lHd33UwGHzBahL+vV6ju5zo+Lf18g2OJFpEI82EEcbCR8KRM3RuWkLiN1EpAYFFgJQglL2sO9tnC1YJ4Cm5A3MuSOSd8uBw==", lpUsedDefaultChar=0x0) returned 245 [0064.925] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0064.925] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0064.925] CloseHandle (hObject=0x158) returned 1 [0064.925] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-next-static.png")) returned 0 [0064.925] GetLastError () returned 0x5 [0064.925] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-next-static.png")) returned 0x20 [0064.926] SetLastError (dwErrCode=0x5) [0064.926] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=18518902699) returned 1 [0064.926] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Файл зашифрован [btn-previous-static.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\Файл зашифрован [btn-previous-static.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0064.926] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0064.926] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0064.926] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0064.926] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0064.926] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0064.926] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0064.926] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0064.926] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0064.926] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0064.927] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0064.927] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0064.927] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0064.927] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0064.927] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0064.927] SetEndOfFile (hFile=0x158) returned 1 [0064.927] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0064.927] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0064.927] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0064.927] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0064.927] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0064.928] WriteFile (in: hFile=0x158, lpBuffer=0x35f04dc*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f04dc*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0064.928] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="#aN3%{#*40$<~-4y1b=8Ar.<8aj)\"J\"M", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0064.928] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="#aN3%{#*40$<~-4y1b=8Ar.<8aj)\"J\"M", cchWideChar=32, lpMultiByteStr=0x20364c4, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="#aN3%{#*40$<~-4y1b=8Ar.<8aj)\"J\"M", lpUsedDefaultChar=0x0) returned 32 [0064.928] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0064.928] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0064.928] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729d59b7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729d59b7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a377d1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xe0b, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-previous-static.png", cAlternateFileName="")) returned 0x295098 [0064.928] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0064.928] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0064.928] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-previous-static.png")) returned 0x20 [0064.929] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-previous-static.png")) returned 0x20 [0064.929] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-previous-static.png")) returned 0x20 [0064.929] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-previous-static.png")) returned 0x20 [0064.929] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-previous-static.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729d59b7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729d59b7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a377d1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xe0b)) returned 1 [0064.929] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0064.929] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0064.929] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-previous-static.png")) returned 0x20 [0064.929] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-previous-static.png")) returned 0x20 [0064.929] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0064.929] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0064.929] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0064.929] SetEndOfFile (hFile=0x158) returned 1 [0064.930] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="btn-previous-static.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0064.930] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="btn-previous-static.png", cchWideChar=23, lpMultiByteStr=0x1ff88fc, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn-previous-static.png", lpUsedDefaultChar=0x0) returned 23 [0064.930] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="btn-previous-static.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0064.930] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="btn-previous-static.png", cchWideChar=23, lpMultiByteStr=0x1ff8974, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn-previous-static.png", lpUsedDefaultChar=0x0) returned 23 [0064.930] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff8974, cbMultiByte=23, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="btn-previous-static.pngngt.pngpngre.pngg") returned 23 [0064.930] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="btn-previous-static.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0064.930] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="btn-previous-static.png", cchWideChar=23, lpMultiByteStr=0x1ff88fc, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn-previous-static.png", lpUsedDefaultChar=0x0) returned 23 [0064.930] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-previous-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0064.931] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0064.931] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0xe0b [0064.931] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0064.931] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0064.931] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0064.931] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="btn-previous-static.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0064.931] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="btn-previous-static.png", cchWideChar=23, lpMultiByteStr=0x1ff88fc, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn-previous-static.png", lpUsedDefaultChar=0x0) returned 23 [0064.931] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="btn-previous-static.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0064.931] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="btn-previous-static.png", cchWideChar=23, lpMultiByteStr=0x1ff8974, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn-previous-static.png", lpUsedDefaultChar=0x0) returned 23 [0064.931] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff8974, cbMultiByte=23, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="btn-previous-static.pngic.pngngt.pngpngre.pngg") returned 23 [0064.931] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="btn-previous-static.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0064.931] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="btn-previous-static.png", cchWideChar=23, lpMultiByteStr=0x1ff88fc, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn-previous-static.png", lpUsedDefaultChar=0x0) returned 23 [0064.931] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0064.932] CharToOemA (in: pSrc="btn-previous-static.png", pDst=0x1ff8974 | out: pDst="btn-previous-static.png") returned 1 [0064.932] WriteFile (in: hFile=0x158, lpBuffer=0x1ff8974*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1ff8974*, lpNumberOfBytesWritten=0x18e048*=0x17, lpOverlapped=0x0) returned 1 [0064.932] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0064.932] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0064.932] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0064.932] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=18519586629) returned 1 [0064.932] ReadFile (in: hFile=0x11c, lpBuffer=0x37c6700, nNumberOfBytesToRead=0xe0b, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37c6700*, lpNumberOfBytesRead=0x18dd7c*=0xe0b, lpOverlapped=0x0) returned 1 [0064.934] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0064.934] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=18519759408) returned 1 [0064.943] WriteFile (in: hFile=0x158, lpBuffer=0x379adc8*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379adc8*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0064.943] ReadFile (in: hFile=0x11c, lpBuffer=0x37c6700, nNumberOfBytesToRead=0xe0b, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x37c6700*, lpNumberOfBytesRead=0x18de38*=0xe0b, lpOverlapped=0x0) returned 1 [0064.943] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x52 [0064.943] WriteFile (in: hFile=0x158, lpBuffer=0x3808d20*, nNumberOfBytesToWrite=0xe0b, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3808d20*, lpNumberOfBytesWritten=0x18de10*=0xe0b, lpOverlapped=0x0) returned 1 [0064.943] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0xe5d [0064.944] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0064.944] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0064.944] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0064.944] SetFilePointer (in: hFile=0x158, lDistanceToMove=23, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x35 [0064.944] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0xe67 [0064.944] CloseHandle (hObject=0x11c) returned 1 [0064.944] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xe67 [0064.944] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xe67 [0064.944] SetFilePointer (in: hFile=0x158, lDistanceToMove=3687, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xe67 [0064.944] SetFilePointer (in: hFile=0x158, lDistanceToMove=3687, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0xe67 [0064.944] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xe67 [0064.944] SetFilePointer (in: hFile=0x158, lDistanceToMove=3687, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0xe67 [0064.944] SetEndOfFile (hFile=0x158) returned 1 [0064.945] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xe67 [0064.945] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xe67 [0064.945] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="btn-previous-static.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0064.945] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="btn-previous-static.png", cchWideChar=23, lpMultiByteStr=0x1ff8974, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn-previous-static.png", lpUsedDefaultChar=0x0) returned 23 [0064.945] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="btn-previous-static.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0064.945] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="btn-previous-static.png", cchWideChar=23, lpMultiByteStr=0x1ff88fc, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn-previous-static.png", lpUsedDefaultChar=0x0) returned 23 [0064.945] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff88fc, cbMultiByte=23, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="btn-previous-static.pngĀ䭐ȁ\x14\x14\x01c䃈㫋秈ﳔว") returned 23 [0064.945] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="btn-previous-static.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0064.945] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="btn-previous-static.png", cchWideChar=23, lpMultiByteStr=0x1ff8974, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn-previous-static.png", lpUsedDefaultChar=0x0) returned 23 [0064.945] WriteFile (in: hFile=0x158, lpBuffer=0x37aa1d8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x37aa1d8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0064.945] CharToOemA (in: pSrc="btn-previous-static.png", pDst=0x1ff88fc | out: pDst="btn-previous-static.png") returned 1 [0064.945] WriteFile (in: hFile=0x158, lpBuffer=0x1ff88fc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1ff88fc*, lpNumberOfBytesWritten=0x18efcc*=0x17, lpOverlapped=0x0) returned 1 [0064.945] WriteFile (in: hFile=0x158, lpBuffer=0x379ad58*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379ad58*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0064.945] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0064.945] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0064.945] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xeb7 [0064.946] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xeb7 [0064.946] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0064.946] WriteFile (in: hFile=0x158, lpBuffer=0x35f04dc*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f04dc*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0064.946] DeleteFileW (lpFileName="") returned 0 [0064.946] GetLastError () returned 0x3 [0064.946] GetFileAttributesW (lpFileName="") returned 0xffffffff [0064.946] SetLastError (dwErrCode=0x3) [0064.946] FlushFileBuffers (hFile=0x158) returned 1 [0064.949] GetCurrentThreadId () returned 0x970 [0064.949] GetCurrentThreadId () returned 0x970 [0064.949] GetCurrentThreadId () returned 0x970 [0064.949] GetCurrentThreadId () returned 0x970 [0064.949] GetCurrentThreadId () returned 0x970 [0064.949] GetCurrentThreadId () returned 0x970 [0064.949] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xf6e [0064.949] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xf6e [0064.949] SetFilePointer (in: hFile=0x158, lDistanceToMove=3950, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xf6e [0064.949] CloseHandle (hObject=0x158) returned 1 [0064.949] GetCurrentThreadId () returned 0x970 [0064.949] GetCurrentThreadId () returned 0x970 [0064.949] GetCurrentThreadId () returned 0x970 [0064.949] GetCurrentThreadId () returned 0x970 [0064.949] GetCurrentThreadId () returned 0x970 [0064.949] GetCurrentThreadId () returned 0x970 [0064.949] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Файл зашифрован [btn-previous-static.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\Файл зашифрован [btn-previous-static.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0064.949] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf6e [0064.949] SetFilePointer (in: hFile=0x158, lDistanceToMove=3822, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xeee [0064.950] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0064.950] GetFileType (hFile=0x158) returned 0x1 [0064.950] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xc, wMilliseconds=0xdc)) [0064.950] GetCurrentThreadId () returned 0x970 [0064.950] GetCurrentThreadId () returned 0x970 [0064.950] GetCurrentThreadId () returned 0x970 [0064.950] GetCurrentThreadId () returned 0x970 [0064.950] GetCurrentThreadId () returned 0x970 [0064.950] GetCurrentThreadId () returned 0x970 [0064.950] GetCurrentThreadId () returned 0x970 [0064.950] GetCurrentThreadId () returned 0x970 [0064.950] GetCurrentThreadId () returned 0x970 [0064.950] GetCurrentThreadId () returned 0x970 [0064.950] GetCurrentThreadId () returned 0x970 [0064.950] GetCurrentThreadId () returned 0x970 [0064.950] GetCurrentThreadId () returned 0x970 [0064.950] GetCurrentThreadId () returned 0x970 [0064.950] GetCurrentThreadId () returned 0x970 [0064.950] GetCurrentThreadId () returned 0x970 [0064.950] GetCurrentThreadId () returned 0x970 [0064.950] GetCurrentThreadId () returned 0x970 [0064.950] GetCurrentThreadId () returned 0x970 [0064.950] GetCurrentThreadId () returned 0x970 [0064.950] GetCurrentThreadId () returned 0x970 [0064.950] GetCurrentThreadId () returned 0x970 [0064.950] GetCurrentThreadId () returned 0x970 [0064.950] GetCurrentThreadId () returned 0x970 [0064.950] GetCurrentThreadId () returned 0x970 [0064.950] GetCurrentThreadId () returned 0x970 [0064.950] GetCurrentThreadId () returned 0x970 [0064.950] GetCurrentThreadId () returned 0x970 [0064.950] GetCurrentThreadId () returned 0x970 [0064.950] GetCurrentThreadId () returned 0x970 [0064.950] GetCurrentThreadId () returned 0x970 [0064.950] GetCurrentThreadId () returned 0x970 [0064.950] GetCurrentThreadId () returned 0x970 [0064.950] GetCurrentThreadId () returned 0x970 [0064.950] GetCurrentThreadId () returned 0x970 [0064.950] GetCurrentThreadId () returned 0x970 [0064.950] GetCurrentThreadId () returned 0x970 [0064.950] GetCurrentThreadId () returned 0x970 [0064.951] GetCurrentThreadId () returned 0x970 [0064.951] GetCurrentThreadId () returned 0x970 [0064.951] GetCurrentThreadId () returned 0x970 [0064.951] GetCurrentThreadId () returned 0x970 [0064.951] GetCurrentThreadId () returned 0x970 [0064.951] GetCurrentThreadId () returned 0x970 [0064.951] GetCurrentThreadId () returned 0x970 [0064.951] GetCurrentThreadId () returned 0x970 [0064.951] GetCurrentThreadId () returned 0x970 [0064.951] GetCurrentThreadId () returned 0x970 [0064.951] GetCurrentThreadId () returned 0x970 [0064.951] GetCurrentThreadId () returned 0x970 [0064.951] GetCurrentThreadId () returned 0x970 [0064.951] GetCurrentThreadId () returned 0x970 [0064.951] GetCurrentThreadId () returned 0x970 [0064.951] GetCurrentThreadId () returned 0x970 [0064.951] GetCurrentThreadId () returned 0x970 [0064.951] GetCurrentThreadId () returned 0x970 [0064.951] GetCurrentThreadId () returned 0x970 [0064.951] GetCurrentThreadId () returned 0x970 [0064.951] GetCurrentThreadId () returned 0x970 [0064.951] GetCurrentThreadId () returned 0x970 [0064.951] GetCurrentThreadId () returned 0x970 [0064.951] GetCurrentThreadId () returned 0x970 [0064.951] GetCurrentThreadId () returned 0x970 [0064.951] GetCurrentThreadId () returned 0x970 [0064.951] GetCurrentThreadId () returned 0x970 [0064.951] GetCurrentThreadId () returned 0x970 [0064.951] GetCurrentThreadId () returned 0x970 [0064.951] GetCurrentThreadId () returned 0x970 [0064.951] GetCurrentThreadId () returned 0x970 [0064.951] GetCurrentThreadId () returned 0x970 [0064.951] GetCurrentThreadId () returned 0x970 [0064.951] GetCurrentThreadId () returned 0x970 [0064.951] GetCurrentThreadId () returned 0x970 [0064.951] GetCurrentThreadId () returned 0x970 [0064.951] GetCurrentThreadId () returned 0x970 [0064.951] GetCurrentThreadId () returned 0x970 [0064.951] GetCurrentThreadId () returned 0x970 [0064.951] GetCurrentThreadId () returned 0x970 [0064.951] GetCurrentThreadId () returned 0x970 [0064.951] GetCurrentThreadId () returned 0x970 [0064.951] GetCurrentThreadId () returned 0x970 [0064.951] GetCurrentThreadId () returned 0x970 [0064.951] GetCurrentThreadId () returned 0x970 [0064.951] GetCurrentThreadId () returned 0x970 [0064.951] GetCurrentThreadId () returned 0x970 [0064.952] GetCurrentThreadId () returned 0x970 [0064.952] GetCurrentThreadId () returned 0x970 [0064.952] GetCurrentThreadId () returned 0x970 [0064.952] GetCurrentThreadId () returned 0x970 [0064.952] GetCurrentThreadId () returned 0x970 [0064.952] GetCurrentThreadId () returned 0x970 [0064.952] GetCurrentThreadId () returned 0x970 [0064.952] GetCurrentThreadId () returned 0x970 [0064.952] GetCurrentThreadId () returned 0x970 [0064.952] GetCurrentThreadId () returned 0x970 [0064.952] GetCurrentThreadId () returned 0x970 [0064.952] GetCurrentThreadId () returned 0x970 [0064.952] GetCurrentThreadId () returned 0x970 [0064.952] GetCurrentThreadId () returned 0x970 [0064.952] GetCurrentThreadId () returned 0x970 [0064.952] GetCurrentThreadId () returned 0x970 [0064.952] GetCurrentThreadId () returned 0x970 [0064.952] GetCurrentThreadId () returned 0x970 [0064.952] GetCurrentThreadId () returned 0x970 [0064.952] GetCurrentThreadId () returned 0x970 [0064.952] GetCurrentThreadId () returned 0x970 [0064.952] GetCurrentThreadId () returned 0x970 [0064.952] GetCurrentThreadId () returned 0x970 [0064.952] GetCurrentThreadId () returned 0x970 [0064.952] GetCurrentThreadId () returned 0x970 [0064.952] GetCurrentThreadId () returned 0x970 [0064.952] GetCurrentThreadId () returned 0x970 [0064.952] GetCurrentThreadId () returned 0x970 [0064.952] GetCurrentThreadId () returned 0x970 [0064.952] GetCurrentThreadId () returned 0x970 [0064.952] GetCurrentThreadId () returned 0x970 [0064.952] GetCurrentThreadId () returned 0x970 [0064.952] GetCurrentThreadId () returned 0x970 [0064.952] GetCurrentThreadId () returned 0x970 [0064.952] GetCurrentThreadId () returned 0x970 [0064.952] GetCurrentThreadId () returned 0x970 [0064.952] GetCurrentThreadId () returned 0x970 [0064.952] GetCurrentThreadId () returned 0x970 [0064.952] GetCurrentThreadId () returned 0x970 [0064.952] GetCurrentThreadId () returned 0x970 [0064.952] GetCurrentThreadId () returned 0x970 [0064.952] GetCurrentThreadId () returned 0x970 [0064.952] GetCurrentThreadId () returned 0x970 [0064.952] GetCurrentThreadId () returned 0x970 [0064.952] GetCurrentThreadId () returned 0x970 [0064.952] GetCurrentThreadId () returned 0x970 [0064.953] GetCurrentThreadId () returned 0x970 [0064.953] GetCurrentThreadId () returned 0x970 [0064.953] GetCurrentThreadId () returned 0x970 [0064.953] GetCurrentThreadId () returned 0x970 [0064.953] GetCurrentThreadId () returned 0x970 [0064.953] GetCurrentThreadId () returned 0x970 [0064.953] GetCurrentThreadId () returned 0x970 [0064.953] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.953] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.953] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379b7d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0064.953] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.953] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.953] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379b7d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0064.953] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.953] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.953] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0064.953] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.953] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.953] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0064.953] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.953] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.953] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379b838, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0064.953] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.953] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.953] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379b838, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0064.953] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.953] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.953] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379b838, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0064.953] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xc, wMilliseconds=0xdc)) [0064.953] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="#aN3%{#*40$<~-4y1b=8Ar.<8aj)\"J\"M", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0064.953] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="#aN3%{#*40$<~-4y1b=8Ar.<8aj)\"J\"M", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0064.953] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="#aN3%{#*40$<~-4y1b=8Ar.<8aj)\"J\"M", cchWideChar=32, lpMultiByteStr=0x2003a18, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="#aN3%{#*40$<~-4y1b=8Ar.<8aj)\"J\"M", lpUsedDefaultChar=0x0) returned 32 [0064.954] GetCurrentThreadId () returned 0x970 [0064.954] GetCurrentThreadId () returned 0x970 [0064.954] GetCurrentThreadId () returned 0x970 [0064.954] GetCurrentThreadId () returned 0x970 [0064.954] GetCurrentThreadId () returned 0x970 [0064.954] GetCurrentThreadId () returned 0x970 [0064.961] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0064.961] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0064.961] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3798078, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0064.961] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb248, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0064.961] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb248, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAFf8Xi8KOqgK8trP5zgAvqxTLp27w3kkXof9iJOjQ//hj/pPwRN/vc6BaYh0bZ8zyqDz4kk97zTjpbcuRz2PI8GoyGk0PEtN9jtF+Pt7UN1u0Y4ohcsGChkrXBMzy2q3+SfJs0fcz8p0P6LsQaOfxjf6cqOWhnQupO2uVnFxPuWN98Zd7cRiiadn1dKo+7p8zmanMYVZ7kkdBzX3HyTzJAQb4SADvij8QQ==") returned 232 [0064.961] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xc, wMilliseconds=0xec)) [0064.961] GetCurrentThreadId () returned 0x970 [0064.961] GetCurrentThreadId () returned 0x970 [0064.961] GetCurrentThreadId () returned 0x970 [0064.961] GetCurrentThreadId () returned 0x970 [0064.961] GetCurrentThreadId () returned 0x970 [0064.961] GetCurrentThreadId () returned 0x970 [0064.961] GetCurrentThreadId () returned 0x970 [0064.961] GetCurrentThreadId () returned 0x970 [0064.961] GetCurrentThreadId () returned 0x970 [0064.961] GetCurrentThreadId () returned 0x970 [0064.961] GetCurrentThreadId () returned 0x970 [0064.961] GetCurrentThreadId () returned 0x970 [0064.961] GetCurrentThreadId () returned 0x970 [0064.961] GetCurrentThreadId () returned 0x970 [0064.961] GetCurrentThreadId () returned 0x970 [0064.961] GetCurrentThreadId () returned 0x970 [0064.962] GetCurrentThreadId () returned 0x970 [0064.962] GetCurrentThreadId () returned 0x970 [0064.962] GetCurrentThreadId () returned 0x970 [0064.962] GetCurrentThreadId () returned 0x970 [0064.962] GetCurrentThreadId () returned 0x970 [0064.962] GetCurrentThreadId () returned 0x970 [0064.962] GetCurrentThreadId () returned 0x970 [0064.962] GetCurrentThreadId () returned 0x970 [0064.962] GetCurrentThreadId () returned 0x970 [0064.962] GetCurrentThreadId () returned 0x970 [0064.962] GetCurrentThreadId () returned 0x970 [0064.962] GetCurrentThreadId () returned 0x970 [0064.962] GetCurrentThreadId () returned 0x970 [0064.962] GetCurrentThreadId () returned 0x970 [0064.962] GetCurrentThreadId () returned 0x970 [0064.962] GetCurrentThreadId () returned 0x970 [0064.962] GetCurrentThreadId () returned 0x970 [0064.962] GetCurrentThreadId () returned 0x970 [0064.962] GetCurrentThreadId () returned 0x970 [0064.962] GetCurrentThreadId () returned 0x970 [0064.962] GetCurrentThreadId () returned 0x970 [0064.962] GetCurrentThreadId () returned 0x970 [0064.962] GetCurrentThreadId () returned 0x970 [0064.962] GetCurrentThreadId () returned 0x970 [0064.962] GetCurrentThreadId () returned 0x970 [0064.962] GetCurrentThreadId () returned 0x970 [0064.962] GetCurrentThreadId () returned 0x970 [0064.962] GetCurrentThreadId () returned 0x970 [0064.962] GetCurrentThreadId () returned 0x970 [0064.962] GetCurrentThreadId () returned 0x970 [0064.962] GetCurrentThreadId () returned 0x970 [0064.962] GetCurrentThreadId () returned 0x970 [0064.962] GetCurrentThreadId () returned 0x970 [0064.962] GetCurrentThreadId () returned 0x970 [0064.962] GetCurrentThreadId () returned 0x970 [0064.962] GetCurrentThreadId () returned 0x970 [0064.962] GetCurrentThreadId () returned 0x970 [0064.962] GetCurrentThreadId () returned 0x970 [0064.962] GetCurrentThreadId () returned 0x970 [0064.962] GetCurrentThreadId () returned 0x970 [0064.962] GetCurrentThreadId () returned 0x970 [0064.962] GetCurrentThreadId () returned 0x970 [0064.962] GetCurrentThreadId () returned 0x970 [0064.962] GetCurrentThreadId () returned 0x970 [0064.962] GetCurrentThreadId () returned 0x970 [0064.963] GetCurrentThreadId () returned 0x970 [0064.963] GetCurrentThreadId () returned 0x970 [0064.963] GetCurrentThreadId () returned 0x970 [0064.963] GetCurrentThreadId () returned 0x970 [0064.963] GetCurrentThreadId () returned 0x970 [0064.963] GetCurrentThreadId () returned 0x970 [0064.963] GetCurrentThreadId () returned 0x970 [0064.963] GetCurrentThreadId () returned 0x970 [0064.963] GetCurrentThreadId () returned 0x970 [0064.963] GetCurrentThreadId () returned 0x970 [0064.963] GetCurrentThreadId () returned 0x970 [0064.963] GetCurrentThreadId () returned 0x970 [0064.963] GetCurrentThreadId () returned 0x970 [0064.963] GetCurrentThreadId () returned 0x970 [0064.963] GetCurrentThreadId () returned 0x970 [0064.963] GetCurrentThreadId () returned 0x970 [0064.963] GetCurrentThreadId () returned 0x970 [0064.963] GetCurrentThreadId () returned 0x970 [0064.963] GetCurrentThreadId () returned 0x970 [0064.963] GetCurrentThreadId () returned 0x970 [0064.963] GetCurrentThreadId () returned 0x970 [0064.963] GetCurrentThreadId () returned 0x970 [0064.963] GetCurrentThreadId () returned 0x970 [0064.963] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAFf8Xi8KOqgK8trP5zgAvqxTLp27w3kkXof9iJOjQ//hj/pPwRN/vc6BaYh0bZ8zyqDz4kk97zTjpbcuRz2PI8GoyGk0PEtN9jtF+Pt7UN1u0Y4ohcsGChkrXBMzy2q3+SfJs0fcz8p0P6LsQaOfxjf6cqOWhnQupO2uVnFxPuWN98Zd7cRiiadn1dKo+7p8zmanMYVZ7kkdBzX3HyTzJAQb4SADvij8QQ==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0064.963] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAFf8Xi8KOqgK8trP5zgAvqxTLp27w3kkXof9iJOjQ//hj/pPwRN/vc6BaYh0bZ8zyqDz4kk97zTjpbcuRz2PI8GoyGk0PEtN9jtF+Pt7UN1u0Y4ohcsGChkrXBMzy2q3+SfJs0fcz8p0P6LsQaOfxjf6cqOWhnQupO2uVnFxPuWN98Zd7cRiiadn1dKo+7p8zmanMYVZ7kkdBzX3HyTzJAQb4SADvij8QQ==", cchWideChar=245, lpMultiByteStr=0x353933c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAFf8Xi8KOqgK8trP5zgAvqxTLp27w3kkXof9iJOjQ//hj/pPwRN/vc6BaYh0bZ8zyqDz4kk97zTjpbcuRz2PI8GoyGk0PEtN9jtF+Pt7UN1u0Y4ohcsGChkrXBMzy2q3+SfJs0fcz8p0P6LsQaOfxjf6cqOWhnQupO2uVnFxPuWN98Zd7cRiiadn1dKo+7p8zmanMYVZ7kkdBzX3HyTzJAQb4SADvij8QQ==", lpUsedDefaultChar=0x0) returned 245 [0064.963] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0064.963] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0064.963] CloseHandle (hObject=0x158) returned 1 [0064.964] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-previous-static.png")) returned 0 [0064.964] GetLastError () returned 0x5 [0064.964] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-previous-static.png")) returned 0x20 [0064.964] SetLastError (dwErrCode=0x5) [0064.964] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=18522731901) returned 1 [0064.964] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Файл зашифрован [button-highlight.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\Файл зашифрован [button-highlight.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0064.968] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0064.968] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0064.969] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0064.969] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0064.969] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0064.969] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0064.969] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0064.969] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0064.969] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0064.969] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0064.969] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0064.969] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0064.969] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0064.969] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0064.969] SetEndOfFile (hFile=0x158) returned 1 [0064.969] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0064.969] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0064.969] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0064.969] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0064.970] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0064.970] WriteFile (in: hFile=0x158, lpBuffer=0x35f035c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f035c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0064.971] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="8Q9DBa0Bnt0u}}f&j{DHU}uL\"y&pD?sc", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0064.971] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="8Q9DBa0Bnt0u}}f&j{DHU}uL\"y&pD?sc", cchWideChar=32, lpMultiByteStr=0x203648c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8Q9DBa0Bnt0u}}f&j{DHU}uL\"y&pD?sc", lpUsedDefaultChar=0x0) returned 32 [0064.971] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0064.971] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0064.971] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729d59b7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729d59b7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a39de7d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x75d, dwReserved0=0x0, dwReserved1=0x0, cFileName="button-highlight.png", cAlternateFileName="")) returned 0x295098 [0064.971] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0064.971] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0064.971] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\button-highlight.png")) returned 0x20 [0064.971] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\button-highlight.png")) returned 0x20 [0064.971] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\button-highlight.png")) returned 0x20 [0064.971] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\button-highlight.png")) returned 0x20 [0064.971] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\button-highlight.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729d59b7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729d59b7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a39de7d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x75d)) returned 1 [0064.971] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0064.971] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0064.971] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\button-highlight.png")) returned 0x20 [0064.971] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\button-highlight.png")) returned 0x20 [0064.972] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0064.972] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0064.972] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0064.972] SetEndOfFile (hFile=0x158) returned 1 [0064.973] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="button-highlight.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0064.973] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="button-highlight.png", cchWideChar=20, lpMultiByteStr=0x1ff899c, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button-highlight.png", lpUsedDefaultChar=0x0) returned 20 [0064.973] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="button-highlight.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0064.973] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="button-highlight.png", cchWideChar=20, lpMultiByteStr=0x1ff8a14, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button-highlight.png", lpUsedDefaultChar=0x0) returned 20 [0064.973] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff8a14, cbMultiByte=20, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="button-highlight.pngpngngt.pngpngre.pngg") returned 20 [0064.973] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="button-highlight.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0064.973] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="button-highlight.png", cchWideChar=20, lpMultiByteStr=0x1ff899c, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button-highlight.png", lpUsedDefaultChar=0x0) returned 20 [0064.973] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\button-highlight.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0064.973] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0064.973] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x75d [0064.973] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0064.973] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0064.973] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0064.973] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="button-highlight.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0064.973] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="button-highlight.png", cchWideChar=20, lpMultiByteStr=0x1ff899c, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button-highlight.png", lpUsedDefaultChar=0x0) returned 20 [0064.974] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="button-highlight.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0064.974] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="button-highlight.png", cchWideChar=20, lpMultiByteStr=0x1ff8a14, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button-highlight.png", lpUsedDefaultChar=0x0) returned 20 [0064.974] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff8a14, cbMultiByte=20, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="button-highlight.pnght.pngpngngt.pngpngre.pngg") returned 20 [0064.974] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="button-highlight.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0064.974] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="button-highlight.png", cchWideChar=20, lpMultiByteStr=0x1ff899c, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button-highlight.png", lpUsedDefaultChar=0x0) returned 20 [0064.974] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0064.975] CharToOemA (in: pSrc="button-highlight.png", pDst=0x1ff8a14 | out: pDst="button-highlight.png") returned 1 [0064.975] WriteFile (in: hFile=0x158, lpBuffer=0x1ff8a14*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1ff8a14*, lpNumberOfBytesWritten=0x18e048*=0x14, lpOverlapped=0x0) returned 1 [0064.975] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0064.975] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0064.975] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0064.975] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=18523845828) returned 1 [0064.975] ReadFile (in: hFile=0x11c, lpBuffer=0x37c6720, nNumberOfBytesToRead=0x75d, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37c6720*, lpNumberOfBytesRead=0x18dd7c*=0x75d, lpOverlapped=0x0) returned 1 [0064.976] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0064.976] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=18523990847) returned 1 [0064.985] WriteFile (in: hFile=0x158, lpBuffer=0x379aca8*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379aca8*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0064.985] ReadFile (in: hFile=0x11c, lpBuffer=0x37c6720, nNumberOfBytesToRead=0x75d, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x37c6720*, lpNumberOfBytesRead=0x18de38*=0x75d, lpOverlapped=0x0) returned 1 [0064.985] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x4f [0064.986] WriteFile (in: hFile=0x158, lpBuffer=0x37c6ee0*, nNumberOfBytesToWrite=0x75d, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x37c6ee0*, lpNumberOfBytesWritten=0x18de10*=0x75d, lpOverlapped=0x0) returned 1 [0064.986] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x7ac [0064.986] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0064.986] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0064.986] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0064.986] SetFilePointer (in: hFile=0x158, lDistanceToMove=20, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x32 [0064.986] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x7b6 [0064.986] CloseHandle (hObject=0x11c) returned 1 [0064.986] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x7b6 [0064.986] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x7b6 [0064.986] SetFilePointer (in: hFile=0x158, lDistanceToMove=1974, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x7b6 [0064.986] SetFilePointer (in: hFile=0x158, lDistanceToMove=1974, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x7b6 [0064.987] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x7b6 [0064.987] SetFilePointer (in: hFile=0x158, lDistanceToMove=1974, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x7b6 [0064.987] SetEndOfFile (hFile=0x158) returned 1 [0064.987] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x7b6 [0064.987] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x7b6 [0064.987] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="button-highlight.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0064.987] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="button-highlight.png", cchWideChar=20, lpMultiByteStr=0x1ff8a14, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button-highlight.png", lpUsedDefaultChar=0x0) returned 20 [0064.987] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="button-highlight.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0064.987] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="button-highlight.png", cchWideChar=20, lpMultiByteStr=0x1ff899c, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button-highlight.png", lpUsedDefaultChar=0x0) returned 20 [0064.987] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff899c, cbMultiByte=20, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="button-highlight.png믑`") returned 20 [0064.987] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="button-highlight.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0064.987] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="button-highlight.png", cchWideChar=20, lpMultiByteStr=0x1ff8a14, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button-highlight.png", lpUsedDefaultChar=0x0) returned 20 [0064.987] WriteFile (in: hFile=0x158, lpBuffer=0x37aa1d8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x37aa1d8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0064.987] CharToOemA (in: pSrc="button-highlight.png", pDst=0x1ff899c | out: pDst="button-highlight.png") returned 1 [0064.987] WriteFile (in: hFile=0x158, lpBuffer=0x1ff899c*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1ff899c*, lpNumberOfBytesWritten=0x18efcc*=0x14, lpOverlapped=0x0) returned 1 [0064.988] WriteFile (in: hFile=0x158, lpBuffer=0x379ae18*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379ae18*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0064.988] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0064.988] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0064.988] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x803 [0064.988] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x803 [0064.988] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0064.988] WriteFile (in: hFile=0x158, lpBuffer=0x35f035c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f035c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0064.988] DeleteFileW (lpFileName="") returned 0 [0064.988] GetLastError () returned 0x3 [0064.989] GetFileAttributesW (lpFileName="") returned 0xffffffff [0064.989] SetLastError (dwErrCode=0x3) [0064.989] FlushFileBuffers (hFile=0x158) returned 1 [0064.994] GetCurrentThreadId () returned 0x970 [0064.994] GetCurrentThreadId () returned 0x970 [0064.994] GetCurrentThreadId () returned 0x970 [0064.994] GetCurrentThreadId () returned 0x970 [0064.994] GetCurrentThreadId () returned 0x970 [0064.994] GetCurrentThreadId () returned 0x970 [0064.994] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x8ba [0064.994] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x8ba [0064.994] SetFilePointer (in: hFile=0x158, lDistanceToMove=2234, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x8ba [0064.994] CloseHandle (hObject=0x158) returned 1 [0064.995] GetCurrentThreadId () returned 0x970 [0064.995] GetCurrentThreadId () returned 0x970 [0064.995] GetCurrentThreadId () returned 0x970 [0064.995] GetCurrentThreadId () returned 0x970 [0064.995] GetCurrentThreadId () returned 0x970 [0064.995] GetCurrentThreadId () returned 0x970 [0064.995] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Файл зашифрован [button-highlight.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\Файл зашифрован [button-highlight.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0064.995] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8ba [0064.995] SetFilePointer (in: hFile=0x158, lDistanceToMove=2106, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x83a [0064.995] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0064.995] GetFileType (hFile=0x158) returned 0x1 [0064.995] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xc, wMilliseconds=0x10b)) [0064.995] GetCurrentThreadId () returned 0x970 [0064.995] GetCurrentThreadId () returned 0x970 [0064.995] GetCurrentThreadId () returned 0x970 [0064.995] GetCurrentThreadId () returned 0x970 [0064.995] GetCurrentThreadId () returned 0x970 [0064.995] GetCurrentThreadId () returned 0x970 [0064.995] GetCurrentThreadId () returned 0x970 [0064.995] GetCurrentThreadId () returned 0x970 [0064.995] GetCurrentThreadId () returned 0x970 [0064.995] GetCurrentThreadId () returned 0x970 [0064.995] GetCurrentThreadId () returned 0x970 [0064.996] GetCurrentThreadId () returned 0x970 [0064.996] GetCurrentThreadId () returned 0x970 [0064.996] GetCurrentThreadId () returned 0x970 [0064.996] GetCurrentThreadId () returned 0x970 [0064.996] GetCurrentThreadId () returned 0x970 [0064.996] GetCurrentThreadId () returned 0x970 [0064.996] GetCurrentThreadId () returned 0x970 [0064.996] GetCurrentThreadId () returned 0x970 [0064.996] GetCurrentThreadId () returned 0x970 [0064.996] GetCurrentThreadId () returned 0x970 [0064.996] GetCurrentThreadId () returned 0x970 [0064.996] GetCurrentThreadId () returned 0x970 [0064.996] GetCurrentThreadId () returned 0x970 [0064.996] GetCurrentThreadId () returned 0x970 [0064.996] GetCurrentThreadId () returned 0x970 [0064.996] GetCurrentThreadId () returned 0x970 [0064.996] GetCurrentThreadId () returned 0x970 [0064.996] GetCurrentThreadId () returned 0x970 [0064.996] GetCurrentThreadId () returned 0x970 [0064.996] GetCurrentThreadId () returned 0x970 [0064.996] GetCurrentThreadId () returned 0x970 [0064.996] GetCurrentThreadId () returned 0x970 [0064.996] GetCurrentThreadId () returned 0x970 [0064.996] GetCurrentThreadId () returned 0x970 [0064.996] GetCurrentThreadId () returned 0x970 [0064.996] GetCurrentThreadId () returned 0x970 [0064.996] GetCurrentThreadId () returned 0x970 [0064.996] GetCurrentThreadId () returned 0x970 [0064.996] GetCurrentThreadId () returned 0x970 [0064.996] GetCurrentThreadId () returned 0x970 [0064.996] GetCurrentThreadId () returned 0x970 [0064.996] GetCurrentThreadId () returned 0x970 [0064.996] GetCurrentThreadId () returned 0x970 [0064.996] GetCurrentThreadId () returned 0x970 [0064.996] GetCurrentThreadId () returned 0x970 [0064.996] GetCurrentThreadId () returned 0x970 [0064.996] GetCurrentThreadId () returned 0x970 [0064.996] GetCurrentThreadId () returned 0x970 [0064.996] GetCurrentThreadId () returned 0x970 [0064.996] GetCurrentThreadId () returned 0x970 [0064.996] GetCurrentThreadId () returned 0x970 [0064.996] GetCurrentThreadId () returned 0x970 [0064.996] GetCurrentThreadId () returned 0x970 [0064.996] GetCurrentThreadId () returned 0x970 [0064.996] GetCurrentThreadId () returned 0x970 [0064.996] GetCurrentThreadId () returned 0x970 [0064.997] GetCurrentThreadId () returned 0x970 [0064.997] GetCurrentThreadId () returned 0x970 [0064.997] GetCurrentThreadId () returned 0x970 [0064.997] GetCurrentThreadId () returned 0x970 [0064.997] GetCurrentThreadId () returned 0x970 [0064.997] GetCurrentThreadId () returned 0x970 [0064.997] GetCurrentThreadId () returned 0x970 [0064.997] GetCurrentThreadId () returned 0x970 [0064.997] GetCurrentThreadId () returned 0x970 [0064.997] GetCurrentThreadId () returned 0x970 [0064.997] GetCurrentThreadId () returned 0x970 [0064.997] GetCurrentThreadId () returned 0x970 [0064.997] GetCurrentThreadId () returned 0x970 [0064.997] GetCurrentThreadId () returned 0x970 [0064.997] GetCurrentThreadId () returned 0x970 [0064.997] GetCurrentThreadId () returned 0x970 [0064.997] GetCurrentThreadId () returned 0x970 [0064.997] GetCurrentThreadId () returned 0x970 [0064.997] GetCurrentThreadId () returned 0x970 [0064.997] GetCurrentThreadId () returned 0x970 [0064.997] GetCurrentThreadId () returned 0x970 [0064.997] GetCurrentThreadId () returned 0x970 [0064.997] GetCurrentThreadId () returned 0x970 [0064.997] GetCurrentThreadId () returned 0x970 [0064.997] GetCurrentThreadId () returned 0x970 [0064.997] GetCurrentThreadId () returned 0x970 [0064.997] GetCurrentThreadId () returned 0x970 [0064.997] GetCurrentThreadId () returned 0x970 [0064.997] GetCurrentThreadId () returned 0x970 [0064.997] GetCurrentThreadId () returned 0x970 [0064.997] GetCurrentThreadId () returned 0x970 [0064.997] GetCurrentThreadId () returned 0x970 [0064.997] GetCurrentThreadId () returned 0x970 [0064.997] GetCurrentThreadId () returned 0x970 [0064.997] GetCurrentThreadId () returned 0x970 [0064.997] GetCurrentThreadId () returned 0x970 [0064.997] GetCurrentThreadId () returned 0x970 [0064.997] GetCurrentThreadId () returned 0x970 [0064.997] GetCurrentThreadId () returned 0x970 [0064.997] GetCurrentThreadId () returned 0x970 [0064.997] GetCurrentThreadId () returned 0x970 [0064.997] GetCurrentThreadId () returned 0x970 [0064.997] GetCurrentThreadId () returned 0x970 [0064.997] GetCurrentThreadId () returned 0x970 [0064.997] GetCurrentThreadId () returned 0x970 [0064.998] GetCurrentThreadId () returned 0x970 [0064.998] GetCurrentThreadId () returned 0x970 [0064.998] GetCurrentThreadId () returned 0x970 [0064.998] GetCurrentThreadId () returned 0x970 [0064.998] GetCurrentThreadId () returned 0x970 [0064.998] GetCurrentThreadId () returned 0x970 [0064.998] GetCurrentThreadId () returned 0x970 [0064.998] GetCurrentThreadId () returned 0x970 [0064.998] GetCurrentThreadId () returned 0x970 [0064.998] GetCurrentThreadId () returned 0x970 [0064.998] GetCurrentThreadId () returned 0x970 [0064.998] GetCurrentThreadId () returned 0x970 [0064.998] GetCurrentThreadId () returned 0x970 [0064.998] GetCurrentThreadId () returned 0x970 [0064.998] GetCurrentThreadId () returned 0x970 [0064.998] GetCurrentThreadId () returned 0x970 [0064.998] GetCurrentThreadId () returned 0x970 [0064.998] GetCurrentThreadId () returned 0x970 [0064.998] GetCurrentThreadId () returned 0x970 [0064.998] GetCurrentThreadId () returned 0x970 [0064.998] GetCurrentThreadId () returned 0x970 [0064.998] GetCurrentThreadId () returned 0x970 [0064.998] GetCurrentThreadId () returned 0x970 [0064.998] GetCurrentThreadId () returned 0x970 [0064.998] GetCurrentThreadId () returned 0x970 [0064.998] GetCurrentThreadId () returned 0x970 [0064.998] GetCurrentThreadId () returned 0x970 [0064.998] GetCurrentThreadId () returned 0x970 [0064.998] GetCurrentThreadId () returned 0x970 [0064.998] GetCurrentThreadId () returned 0x970 [0064.998] GetCurrentThreadId () returned 0x970 [0064.998] GetCurrentThreadId () returned 0x970 [0064.998] GetCurrentThreadId () returned 0x970 [0064.998] GetCurrentThreadId () returned 0x970 [0064.998] GetCurrentThreadId () returned 0x970 [0064.998] GetCurrentThreadId () returned 0x970 [0064.998] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.998] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.998] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379b838, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0064.998] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.998] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.999] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379b838, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0064.999] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.999] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.999] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0064.999] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.999] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.999] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0064.999] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.999] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.999] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379b898, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0064.999] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.999] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.999] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379b898, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0064.999] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.999] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0064.999] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379b898, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0064.999] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xc, wMilliseconds=0x10b)) [0064.999] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8Q9DBa0Bnt0u}}f&j{DHU}uL\"y&pD?sc", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0064.999] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8Q9DBa0Bnt0u}}f&j{DHU}uL\"y&pD?sc", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0064.999] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8Q9DBa0Bnt0u}}f&j{DHU}uL\"y&pD?sc", cchWideChar=32, lpMultiByteStr=0x2003a48, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8Q9DBa0Bnt0u}}f&j{DHU}uL\"y&pD?sc", lpUsedDefaultChar=0x0) returned 32 [0064.999] GetCurrentThreadId () returned 0x970 [0064.999] GetCurrentThreadId () returned 0x970 [0064.999] GetCurrentThreadId () returned 0x970 [0064.999] GetCurrentThreadId () returned 0x970 [0064.999] GetCurrentThreadId () returned 0x970 [0064.999] GetCurrentThreadId () returned 0x970 [0065.007] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0065.007] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0065.007] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3798168, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0065.007] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb248, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0065.007] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb248, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAGSbnFtTb7iUFs7XcZQgmLIodLtENx4QuKiZiYag1SZf958b/GaO6hsskuKcZTWetablYHauVncagrLPLNhapqr3c/k7UTUgSebDMAOeK8aEWEpMgn+W1hcDUZa6ErbruYUqs8pEAi+ziDVh+GdYMycE63Vqqa8gmZLOrTkkItpuZ71jnrlXMV30AXNjoYPMh/f4rOl3lvjp0HOVv9w+6+1a8I17yikC6w==") returned 232 [0065.007] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xc, wMilliseconds=0x11a)) [0065.007] GetCurrentThreadId () returned 0x970 [0065.007] GetCurrentThreadId () returned 0x970 [0065.007] GetCurrentThreadId () returned 0x970 [0065.007] GetCurrentThreadId () returned 0x970 [0065.007] GetCurrentThreadId () returned 0x970 [0065.007] GetCurrentThreadId () returned 0x970 [0065.007] GetCurrentThreadId () returned 0x970 [0065.007] GetCurrentThreadId () returned 0x970 [0065.007] GetCurrentThreadId () returned 0x970 [0065.007] GetCurrentThreadId () returned 0x970 [0065.007] GetCurrentThreadId () returned 0x970 [0065.007] GetCurrentThreadId () returned 0x970 [0065.007] GetCurrentThreadId () returned 0x970 [0065.007] GetCurrentThreadId () returned 0x970 [0065.007] GetCurrentThreadId () returned 0x970 [0065.007] GetCurrentThreadId () returned 0x970 [0065.007] GetCurrentThreadId () returned 0x970 [0065.007] GetCurrentThreadId () returned 0x970 [0065.008] GetCurrentThreadId () returned 0x970 [0065.008] GetCurrentThreadId () returned 0x970 [0065.008] GetCurrentThreadId () returned 0x970 [0065.008] GetCurrentThreadId () returned 0x970 [0065.008] GetCurrentThreadId () returned 0x970 [0065.008] GetCurrentThreadId () returned 0x970 [0065.008] GetCurrentThreadId () returned 0x970 [0065.008] GetCurrentThreadId () returned 0x970 [0065.008] GetCurrentThreadId () returned 0x970 [0065.008] GetCurrentThreadId () returned 0x970 [0065.008] GetCurrentThreadId () returned 0x970 [0065.008] GetCurrentThreadId () returned 0x970 [0065.008] GetCurrentThreadId () returned 0x970 [0065.008] GetCurrentThreadId () returned 0x970 [0065.008] GetCurrentThreadId () returned 0x970 [0065.008] GetCurrentThreadId () returned 0x970 [0065.008] GetCurrentThreadId () returned 0x970 [0065.008] GetCurrentThreadId () returned 0x970 [0065.008] GetCurrentThreadId () returned 0x970 [0065.008] GetCurrentThreadId () returned 0x970 [0065.008] GetCurrentThreadId () returned 0x970 [0065.008] GetCurrentThreadId () returned 0x970 [0065.008] GetCurrentThreadId () returned 0x970 [0065.008] GetCurrentThreadId () returned 0x970 [0065.008] GetCurrentThreadId () returned 0x970 [0065.008] GetCurrentThreadId () returned 0x970 [0065.008] GetCurrentThreadId () returned 0x970 [0065.008] GetCurrentThreadId () returned 0x970 [0065.008] GetCurrentThreadId () returned 0x970 [0065.008] GetCurrentThreadId () returned 0x970 [0065.008] GetCurrentThreadId () returned 0x970 [0065.008] GetCurrentThreadId () returned 0x970 [0065.008] GetCurrentThreadId () returned 0x970 [0065.008] GetCurrentThreadId () returned 0x970 [0065.008] GetCurrentThreadId () returned 0x970 [0065.008] GetCurrentThreadId () returned 0x970 [0065.008] GetCurrentThreadId () returned 0x970 [0065.008] GetCurrentThreadId () returned 0x970 [0065.008] GetCurrentThreadId () returned 0x970 [0065.008] GetCurrentThreadId () returned 0x970 [0065.008] GetCurrentThreadId () returned 0x970 [0065.008] GetCurrentThreadId () returned 0x970 [0065.008] GetCurrentThreadId () returned 0x970 [0065.008] GetCurrentThreadId () returned 0x970 [0065.008] GetCurrentThreadId () returned 0x970 [0065.009] GetCurrentThreadId () returned 0x970 [0065.009] GetCurrentThreadId () returned 0x970 [0065.009] GetCurrentThreadId () returned 0x970 [0065.009] GetCurrentThreadId () returned 0x970 [0065.009] GetCurrentThreadId () returned 0x970 [0065.009] GetCurrentThreadId () returned 0x970 [0065.009] GetCurrentThreadId () returned 0x970 [0065.009] GetCurrentThreadId () returned 0x970 [0065.009] GetCurrentThreadId () returned 0x970 [0065.009] GetCurrentThreadId () returned 0x970 [0065.009] GetCurrentThreadId () returned 0x970 [0065.009] GetCurrentThreadId () returned 0x970 [0065.009] GetCurrentThreadId () returned 0x970 [0065.009] GetCurrentThreadId () returned 0x970 [0065.009] GetCurrentThreadId () returned 0x970 [0065.009] GetCurrentThreadId () returned 0x970 [0065.009] GetCurrentThreadId () returned 0x970 [0065.009] GetCurrentThreadId () returned 0x970 [0065.009] GetCurrentThreadId () returned 0x970 [0065.009] GetCurrentThreadId () returned 0x970 [0065.009] GetCurrentThreadId () returned 0x970 [0065.009] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAGSbnFtTb7iUFs7XcZQgmLIodLtENx4QuKiZiYag1SZf958b/GaO6hsskuKcZTWetablYHauVncagrLPLNhapqr3c/k7UTUgSebDMAOeK8aEWEpMgn+W1hcDUZa6ErbruYUqs8pEAi+ziDVh+GdYMycE63Vqqa8gmZLOrTkkItpuZ71jnrlXMV30AXNjoYPMh/f4rOl3lvjp0HOVv9w+6+1a8I17yikC6w==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0065.009] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAGSbnFtTb7iUFs7XcZQgmLIodLtENx4QuKiZiYag1SZf958b/GaO6hsskuKcZTWetablYHauVncagrLPLNhapqr3c/k7UTUgSebDMAOeK8aEWEpMgn+W1hcDUZa6ErbruYUqs8pEAi+ziDVh+GdYMycE63Vqqa8gmZLOrTkkItpuZ71jnrlXMV30AXNjoYPMh/f4rOl3lvjp0HOVv9w+6+1a8I17yikC6w==", cchWideChar=245, lpMultiByteStr=0x353933c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAGSbnFtTb7iUFs7XcZQgmLIodLtENx4QuKiZiYag1SZf958b/GaO6hsskuKcZTWetablYHauVncagrLPLNhapqr3c/k7UTUgSebDMAOeK8aEWEpMgn+W1hcDUZa6ErbruYUqs8pEAi+ziDVh+GdYMycE63Vqqa8gmZLOrTkkItpuZ71jnrlXMV30AXNjoYPMh/f4rOl3lvjp0HOVv9w+6+1a8I17yikC6w==", lpUsedDefaultChar=0x0) returned 245 [0065.009] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0065.009] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0065.009] CloseHandle (hObject=0x158) returned 1 [0065.009] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\button-highlight.png")) returned 0 [0065.010] GetLastError () returned 0x5 [0065.010] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\button-highlight.png")) returned 0x20 [0065.010] SetLastError (dwErrCode=0x5) [0065.010] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=18527316870) returned 1 [0065.010] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Файл зашифрован [chapters-static.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\Файл зашифрован [chapters-static.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0065.010] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0065.011] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0065.011] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0065.011] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0065.011] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0065.011] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0065.011] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0065.011] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0065.011] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0065.011] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0065.011] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0065.011] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0065.011] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0065.011] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0065.011] SetEndOfFile (hFile=0x158) returned 1 [0065.011] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0065.011] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0065.011] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0065.012] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0065.012] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0065.013] WriteFile (in: hFile=0x158, lpBuffer=0x35f04dc*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f04dc*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0065.013] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="yzeh3ugC0l\\N~rYGc&rskR3dAd2NYfpV", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0065.013] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="yzeh3ugC0l\\N~rYGc&rskR3dAd2NYfpV", cchWideChar=32, lpMultiByteStr=0x20364fc, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="yzeh3ugC0l\\N~rYGc&rskR3dAd2NYfpV", lpUsedDefaultChar=0x0) returned 32 [0065.013] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0065.013] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0065.013] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729d59b7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729d59b7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a39de7d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x55f, dwReserved0=0x0, dwReserved1=0x0, cFileName="chapters-static.png", cAlternateFileName="")) returned 0x295098 [0065.013] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0065.013] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0065.013] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\chapters-static.png")) returned 0x20 [0065.014] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\chapters-static.png")) returned 0x20 [0065.014] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\chapters-static.png")) returned 0x20 [0065.014] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\chapters-static.png")) returned 0x20 [0065.014] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\chapters-static.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729d59b7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729d59b7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a39de7d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x55f)) returned 1 [0065.014] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0065.014] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0065.014] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\chapters-static.png")) returned 0x20 [0065.014] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\chapters-static.png")) returned 0x20 [0065.014] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0065.014] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0065.014] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0065.014] SetEndOfFile (hFile=0x158) returned 1 [0065.015] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="chapters-static.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0065.015] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="chapters-static.png", cchWideChar=19, lpMultiByteStr=0x1ff89c4, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="chapters-static.png", lpUsedDefaultChar=0x0) returned 19 [0065.016] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="chapters-static.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0065.016] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="chapters-static.png", cchWideChar=19, lpMultiByteStr=0x1ff89ec, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="chapters-static.png", lpUsedDefaultChar=0x0) returned 19 [0065.016] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff89ec, cbMultiByte=19, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="chapters-static.pnggpngngt.pngpngre.pngg") returned 19 [0065.016] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="chapters-static.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0065.016] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="chapters-static.png", cchWideChar=19, lpMultiByteStr=0x1ff89c4, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="chapters-static.png", lpUsedDefaultChar=0x0) returned 19 [0065.016] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\chapters-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0065.016] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0065.016] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x55f [0065.016] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0065.016] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0065.016] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0065.016] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="chapters-static.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0065.016] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="chapters-static.png", cchWideChar=19, lpMultiByteStr=0x1ff89c4, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="chapters-static.png", lpUsedDefaultChar=0x0) returned 19 [0065.016] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="chapters-static.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0065.016] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="chapters-static.png", cchWideChar=19, lpMultiByteStr=0x1ff89ec, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="chapters-static.png", lpUsedDefaultChar=0x0) returned 19 [0065.017] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff89ec, cbMultiByte=19, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="chapters-static.pngic.pnggpngngt.pngpngre.pngg") returned 19 [0065.017] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="chapters-static.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0065.017] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="chapters-static.png", cchWideChar=19, lpMultiByteStr=0x1ff89c4, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="chapters-static.png", lpUsedDefaultChar=0x0) returned 19 [0065.017] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0065.018] CharToOemA (in: pSrc="chapters-static.png", pDst=0x1ff89ec | out: pDst="chapters-static.png") returned 1 [0065.018] WriteFile (in: hFile=0x158, lpBuffer=0x1ff89ec*, nNumberOfBytesToWrite=0x13, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1ff89ec*, lpNumberOfBytesWritten=0x18e048*=0x13, lpOverlapped=0x0) returned 1 [0065.018] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0065.018] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0065.018] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0065.018] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=18528138396) returned 1 [0065.018] ReadFile (in: hFile=0x11c, lpBuffer=0x37c6720, nNumberOfBytesToRead=0x55f, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37c6720*, lpNumberOfBytesRead=0x18dd7c*=0x55f, lpOverlapped=0x0) returned 1 [0065.019] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0065.020] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=18528300336) returned 1 [0065.028] WriteFile (in: hFile=0x158, lpBuffer=0x379adb0*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379adb0*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0065.028] ReadFile (in: hFile=0x11c, lpBuffer=0x37c6720, nNumberOfBytesToRead=0x55f, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x37c6720*, lpNumberOfBytesRead=0x18de38*=0x55f, lpOverlapped=0x0) returned 1 [0065.028] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x4e [0065.028] WriteFile (in: hFile=0x158, lpBuffer=0x37c6d00*, nNumberOfBytesToWrite=0x55f, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x37c6d00*, lpNumberOfBytesWritten=0x18de10*=0x55f, lpOverlapped=0x0) returned 1 [0065.029] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x5ad [0065.029] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0065.029] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0065.029] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0065.029] SetFilePointer (in: hFile=0x158, lDistanceToMove=19, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x31 [0065.029] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x5b7 [0065.029] CloseHandle (hObject=0x11c) returned 1 [0065.029] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x5b7 [0065.029] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x5b7 [0065.029] SetFilePointer (in: hFile=0x158, lDistanceToMove=1463, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x5b7 [0065.029] SetFilePointer (in: hFile=0x158, lDistanceToMove=1463, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x5b7 [0065.029] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x5b7 [0065.030] SetFilePointer (in: hFile=0x158, lDistanceToMove=1463, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x5b7 [0065.030] SetEndOfFile (hFile=0x158) returned 1 [0065.030] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x5b7 [0065.030] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x5b7 [0065.030] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="chapters-static.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0065.030] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="chapters-static.png", cchWideChar=19, lpMultiByteStr=0x1ff89ec, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="chapters-static.png", lpUsedDefaultChar=0x0) returned 19 [0065.030] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="chapters-static.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0065.030] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="chapters-static.png", cchWideChar=19, lpMultiByteStr=0x1ff89c4, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="chapters-static.png", lpUsedDefaultChar=0x0) returned 19 [0065.030] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff89c4, cbMultiByte=19, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="chapters-static.png`믑`") returned 19 [0065.030] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="chapters-static.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0065.030] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="chapters-static.png", cchWideChar=19, lpMultiByteStr=0x1ff89ec, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="chapters-static.png", lpUsedDefaultChar=0x0) returned 19 [0065.030] WriteFile (in: hFile=0x158, lpBuffer=0x37aa1d8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x37aa1d8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0065.030] CharToOemA (in: pSrc="chapters-static.png", pDst=0x1ff89c4 | out: pDst="chapters-static.png") returned 1 [0065.030] WriteFile (in: hFile=0x158, lpBuffer=0x1ff89c4*, nNumberOfBytesToWrite=0x13, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1ff89c4*, lpNumberOfBytesWritten=0x18efcc*=0x13, lpOverlapped=0x0) returned 1 [0065.030] WriteFile (in: hFile=0x158, lpBuffer=0x379acf8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379acf8*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0065.030] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0065.031] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0065.031] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x603 [0065.031] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x603 [0065.031] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0065.031] WriteFile (in: hFile=0x158, lpBuffer=0x35f04dc*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f04dc*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0065.031] DeleteFileW (lpFileName="") returned 0 [0065.031] GetLastError () returned 0x3 [0065.031] GetFileAttributesW (lpFileName="") returned 0xffffffff [0065.031] SetLastError (dwErrCode=0x3) [0065.031] FlushFileBuffers (hFile=0x158) returned 1 [0065.036] GetCurrentThreadId () returned 0x970 [0065.036] GetCurrentThreadId () returned 0x970 [0065.036] GetCurrentThreadId () returned 0x970 [0065.036] GetCurrentThreadId () returned 0x970 [0065.036] GetCurrentThreadId () returned 0x970 [0065.036] GetCurrentThreadId () returned 0x970 [0065.036] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x6ba [0065.036] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x6ba [0065.036] SetFilePointer (in: hFile=0x158, lDistanceToMove=1722, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x6ba [0065.036] CloseHandle (hObject=0x158) returned 1 [0065.036] GetCurrentThreadId () returned 0x970 [0065.036] GetCurrentThreadId () returned 0x970 [0065.036] GetCurrentThreadId () returned 0x970 [0065.036] GetCurrentThreadId () returned 0x970 [0065.036] GetCurrentThreadId () returned 0x970 [0065.036] GetCurrentThreadId () returned 0x970 [0065.036] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Файл зашифрован [chapters-static.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\Файл зашифрован [chapters-static.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0065.037] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6ba [0065.037] SetFilePointer (in: hFile=0x158, lDistanceToMove=1594, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x63a [0065.037] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0065.037] GetFileType (hFile=0x158) returned 0x1 [0065.037] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xc, wMilliseconds=0x13a)) [0065.037] GetCurrentThreadId () returned 0x970 [0065.037] GetCurrentThreadId () returned 0x970 [0065.037] GetCurrentThreadId () returned 0x970 [0065.037] GetCurrentThreadId () returned 0x970 [0065.037] GetCurrentThreadId () returned 0x970 [0065.037] GetCurrentThreadId () returned 0x970 [0065.037] GetCurrentThreadId () returned 0x970 [0065.037] GetCurrentThreadId () returned 0x970 [0065.037] GetCurrentThreadId () returned 0x970 [0065.037] GetCurrentThreadId () returned 0x970 [0065.037] GetCurrentThreadId () returned 0x970 [0065.037] GetCurrentThreadId () returned 0x970 [0065.037] GetCurrentThreadId () returned 0x970 [0065.037] GetCurrentThreadId () returned 0x970 [0065.037] GetCurrentThreadId () returned 0x970 [0065.037] GetCurrentThreadId () returned 0x970 [0065.037] GetCurrentThreadId () returned 0x970 [0065.037] GetCurrentThreadId () returned 0x970 [0065.037] GetCurrentThreadId () returned 0x970 [0065.037] GetCurrentThreadId () returned 0x970 [0065.037] GetCurrentThreadId () returned 0x970 [0065.037] GetCurrentThreadId () returned 0x970 [0065.037] GetCurrentThreadId () returned 0x970 [0065.037] GetCurrentThreadId () returned 0x970 [0065.037] GetCurrentThreadId () returned 0x970 [0065.037] GetCurrentThreadId () returned 0x970 [0065.037] GetCurrentThreadId () returned 0x970 [0065.037] GetCurrentThreadId () returned 0x970 [0065.038] GetCurrentThreadId () returned 0x970 [0065.038] GetCurrentThreadId () returned 0x970 [0065.038] GetCurrentThreadId () returned 0x970 [0065.038] GetCurrentThreadId () returned 0x970 [0065.038] GetCurrentThreadId () returned 0x970 [0065.038] GetCurrentThreadId () returned 0x970 [0065.038] GetCurrentThreadId () returned 0x970 [0065.038] GetCurrentThreadId () returned 0x970 [0065.038] GetCurrentThreadId () returned 0x970 [0065.038] GetCurrentThreadId () returned 0x970 [0065.038] GetCurrentThreadId () returned 0x970 [0065.038] GetCurrentThreadId () returned 0x970 [0065.038] GetCurrentThreadId () returned 0x970 [0065.038] GetCurrentThreadId () returned 0x970 [0065.038] GetCurrentThreadId () returned 0x970 [0065.038] GetCurrentThreadId () returned 0x970 [0065.038] GetCurrentThreadId () returned 0x970 [0065.038] GetCurrentThreadId () returned 0x970 [0065.038] GetCurrentThreadId () returned 0x970 [0065.038] GetCurrentThreadId () returned 0x970 [0065.038] GetCurrentThreadId () returned 0x970 [0065.038] GetCurrentThreadId () returned 0x970 [0065.038] GetCurrentThreadId () returned 0x970 [0065.038] GetCurrentThreadId () returned 0x970 [0065.038] GetCurrentThreadId () returned 0x970 [0065.038] GetCurrentThreadId () returned 0x970 [0065.038] GetCurrentThreadId () returned 0x970 [0065.038] GetCurrentThreadId () returned 0x970 [0065.038] GetCurrentThreadId () returned 0x970 [0065.038] GetCurrentThreadId () returned 0x970 [0065.038] GetCurrentThreadId () returned 0x970 [0065.038] GetCurrentThreadId () returned 0x970 [0065.038] GetCurrentThreadId () returned 0x970 [0065.038] GetCurrentThreadId () returned 0x970 [0065.038] GetCurrentThreadId () returned 0x970 [0065.038] GetCurrentThreadId () returned 0x970 [0065.038] GetCurrentThreadId () returned 0x970 [0065.038] GetCurrentThreadId () returned 0x970 [0065.038] GetCurrentThreadId () returned 0x970 [0065.038] GetCurrentThreadId () returned 0x970 [0065.038] GetCurrentThreadId () returned 0x970 [0065.038] GetCurrentThreadId () returned 0x970 [0065.038] GetCurrentThreadId () returned 0x970 [0065.038] GetCurrentThreadId () returned 0x970 [0065.038] GetCurrentThreadId () returned 0x970 [0065.039] GetCurrentThreadId () returned 0x970 [0065.039] GetCurrentThreadId () returned 0x970 [0065.039] GetCurrentThreadId () returned 0x970 [0065.039] GetCurrentThreadId () returned 0x970 [0065.039] GetCurrentThreadId () returned 0x970 [0065.039] GetCurrentThreadId () returned 0x970 [0065.039] GetCurrentThreadId () returned 0x970 [0065.039] GetCurrentThreadId () returned 0x970 [0065.039] GetCurrentThreadId () returned 0x970 [0065.039] GetCurrentThreadId () returned 0x970 [0065.039] GetCurrentThreadId () returned 0x970 [0065.039] GetCurrentThreadId () returned 0x970 [0065.039] GetCurrentThreadId () returned 0x970 [0065.039] GetCurrentThreadId () returned 0x970 [0065.039] GetCurrentThreadId () returned 0x970 [0065.039] GetCurrentThreadId () returned 0x970 [0065.039] GetCurrentThreadId () returned 0x970 [0065.039] GetCurrentThreadId () returned 0x970 [0065.039] GetCurrentThreadId () returned 0x970 [0065.039] GetCurrentThreadId () returned 0x970 [0065.039] GetCurrentThreadId () returned 0x970 [0065.039] GetCurrentThreadId () returned 0x970 [0065.039] GetCurrentThreadId () returned 0x970 [0065.039] GetCurrentThreadId () returned 0x970 [0065.039] GetCurrentThreadId () returned 0x970 [0065.039] GetCurrentThreadId () returned 0x970 [0065.039] GetCurrentThreadId () returned 0x970 [0065.039] GetCurrentThreadId () returned 0x970 [0065.039] GetCurrentThreadId () returned 0x970 [0065.039] GetCurrentThreadId () returned 0x970 [0065.039] GetCurrentThreadId () returned 0x970 [0065.039] GetCurrentThreadId () returned 0x970 [0065.039] GetCurrentThreadId () returned 0x970 [0065.039] GetCurrentThreadId () returned 0x970 [0065.039] GetCurrentThreadId () returned 0x970 [0065.039] GetCurrentThreadId () returned 0x970 [0065.039] GetCurrentThreadId () returned 0x970 [0065.039] GetCurrentThreadId () returned 0x970 [0065.039] GetCurrentThreadId () returned 0x970 [0065.039] GetCurrentThreadId () returned 0x970 [0065.039] GetCurrentThreadId () returned 0x970 [0065.039] GetCurrentThreadId () returned 0x970 [0065.039] GetCurrentThreadId () returned 0x970 [0065.039] GetCurrentThreadId () returned 0x970 [0065.039] GetCurrentThreadId () returned 0x970 [0065.039] GetCurrentThreadId () returned 0x970 [0065.040] GetCurrentThreadId () returned 0x970 [0065.040] GetCurrentThreadId () returned 0x970 [0065.040] GetCurrentThreadId () returned 0x970 [0065.040] GetCurrentThreadId () returned 0x970 [0065.040] GetCurrentThreadId () returned 0x970 [0065.040] GetCurrentThreadId () returned 0x970 [0065.040] GetCurrentThreadId () returned 0x970 [0065.040] GetCurrentThreadId () returned 0x970 [0065.040] GetCurrentThreadId () returned 0x970 [0065.040] GetCurrentThreadId () returned 0x970 [0065.040] GetCurrentThreadId () returned 0x970 [0065.040] GetCurrentThreadId () returned 0x970 [0065.040] GetCurrentThreadId () returned 0x970 [0065.040] GetCurrentThreadId () returned 0x970 [0065.040] GetCurrentThreadId () returned 0x970 [0065.040] GetCurrentThreadId () returned 0x970 [0065.040] GetCurrentThreadId () returned 0x970 [0065.040] GetCurrentThreadId () returned 0x970 [0065.040] GetCurrentThreadId () returned 0x970 [0065.040] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.040] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.040] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379b898, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.040] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.040] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.040] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379b898, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.040] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.040] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.040] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.040] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.040] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.040] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.040] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.040] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.040] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379b8f8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.040] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.040] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.040] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379b8f8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.040] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.040] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.041] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379b8f8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.041] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xc, wMilliseconds=0x13a)) [0065.041] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="yzeh3ugC0l\\N~rYGc&rskR3dAd2NYfpV", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0065.041] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="yzeh3ugC0l\\N~rYGc&rskR3dAd2NYfpV", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0065.041] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="yzeh3ugC0l\\N~rYGc&rskR3dAd2NYfpV", cchWideChar=32, lpMultiByteStr=0x2003a78, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="yzeh3ugC0l\\N~rYGc&rskR3dAd2NYfpV", lpUsedDefaultChar=0x0) returned 32 [0065.041] GetCurrentThreadId () returned 0x970 [0065.041] GetCurrentThreadId () returned 0x970 [0065.041] GetCurrentThreadId () returned 0x970 [0065.041] GetCurrentThreadId () returned 0x970 [0065.041] GetCurrentThreadId () returned 0x970 [0065.041] GetCurrentThreadId () returned 0x970 [0065.048] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0065.048] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0065.048] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3798258, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0065.048] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb248, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0065.048] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb248, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAEHZzk1j7JKx6sgttsAV9UtK20T7SPKx4u0XlfdPOdl+SlWf/VZYfijJ1LHh9pEU3JODFx7AnMDutdOc5+WpZiIvHUtAnZQYbtAR6lWMJHwSfUmAmreNaLqToV61p/XNcyKTGjMZE8kDnOczTjHGmlLxh7bWtJ1feMZuOlEM7juRUQdUaR/qkqhCnLNZDRE7688OdLGGfTWO7eZ6skAIFrbfXVsTHI3CdQ==") returned 232 [0065.048] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xc, wMilliseconds=0x13a)) [0065.048] GetCurrentThreadId () returned 0x970 [0065.048] GetCurrentThreadId () returned 0x970 [0065.048] GetCurrentThreadId () returned 0x970 [0065.048] GetCurrentThreadId () returned 0x970 [0065.049] GetCurrentThreadId () returned 0x970 [0065.049] GetCurrentThreadId () returned 0x970 [0065.049] GetCurrentThreadId () returned 0x970 [0065.049] GetCurrentThreadId () returned 0x970 [0065.049] GetCurrentThreadId () returned 0x970 [0065.049] GetCurrentThreadId () returned 0x970 [0065.049] GetCurrentThreadId () returned 0x970 [0065.049] GetCurrentThreadId () returned 0x970 [0065.049] GetCurrentThreadId () returned 0x970 [0065.049] GetCurrentThreadId () returned 0x970 [0065.049] GetCurrentThreadId () returned 0x970 [0065.049] GetCurrentThreadId () returned 0x970 [0065.049] GetCurrentThreadId () returned 0x970 [0065.049] GetCurrentThreadId () returned 0x970 [0065.049] GetCurrentThreadId () returned 0x970 [0065.049] GetCurrentThreadId () returned 0x970 [0065.049] GetCurrentThreadId () returned 0x970 [0065.049] GetCurrentThreadId () returned 0x970 [0065.049] GetCurrentThreadId () returned 0x970 [0065.049] GetCurrentThreadId () returned 0x970 [0065.049] GetCurrentThreadId () returned 0x970 [0065.049] GetCurrentThreadId () returned 0x970 [0065.049] GetCurrentThreadId () returned 0x970 [0065.049] GetCurrentThreadId () returned 0x970 [0065.049] GetCurrentThreadId () returned 0x970 [0065.049] GetCurrentThreadId () returned 0x970 [0065.049] GetCurrentThreadId () returned 0x970 [0065.049] GetCurrentThreadId () returned 0x970 [0065.049] GetCurrentThreadId () returned 0x970 [0065.049] GetCurrentThreadId () returned 0x970 [0065.049] GetCurrentThreadId () returned 0x970 [0065.049] GetCurrentThreadId () returned 0x970 [0065.049] GetCurrentThreadId () returned 0x970 [0065.049] GetCurrentThreadId () returned 0x970 [0065.049] GetCurrentThreadId () returned 0x970 [0065.049] GetCurrentThreadId () returned 0x970 [0065.049] GetCurrentThreadId () returned 0x970 [0065.049] GetCurrentThreadId () returned 0x970 [0065.049] GetCurrentThreadId () returned 0x970 [0065.049] GetCurrentThreadId () returned 0x970 [0065.049] GetCurrentThreadId () returned 0x970 [0065.049] GetCurrentThreadId () returned 0x970 [0065.049] GetCurrentThreadId () returned 0x970 [0065.049] GetCurrentThreadId () returned 0x970 [0065.049] GetCurrentThreadId () returned 0x970 [0065.050] GetCurrentThreadId () returned 0x970 [0065.050] GetCurrentThreadId () returned 0x970 [0065.050] GetCurrentThreadId () returned 0x970 [0065.050] GetCurrentThreadId () returned 0x970 [0065.050] GetCurrentThreadId () returned 0x970 [0065.050] GetCurrentThreadId () returned 0x970 [0065.050] GetCurrentThreadId () returned 0x970 [0065.050] GetCurrentThreadId () returned 0x970 [0065.050] GetCurrentThreadId () returned 0x970 [0065.050] GetCurrentThreadId () returned 0x970 [0065.050] GetCurrentThreadId () returned 0x970 [0065.050] GetCurrentThreadId () returned 0x970 [0065.050] GetCurrentThreadId () returned 0x970 [0065.050] GetCurrentThreadId () returned 0x970 [0065.050] GetCurrentThreadId () returned 0x970 [0065.050] GetCurrentThreadId () returned 0x970 [0065.050] GetCurrentThreadId () returned 0x970 [0065.050] GetCurrentThreadId () returned 0x970 [0065.050] GetCurrentThreadId () returned 0x970 [0065.050] GetCurrentThreadId () returned 0x970 [0065.050] GetCurrentThreadId () returned 0x970 [0065.050] GetCurrentThreadId () returned 0x970 [0065.050] GetCurrentThreadId () returned 0x970 [0065.050] GetCurrentThreadId () returned 0x970 [0065.050] GetCurrentThreadId () returned 0x970 [0065.050] GetCurrentThreadId () returned 0x970 [0065.050] GetCurrentThreadId () returned 0x970 [0065.050] GetCurrentThreadId () returned 0x970 [0065.050] GetCurrentThreadId () returned 0x970 [0065.050] GetCurrentThreadId () returned 0x970 [0065.050] GetCurrentThreadId () returned 0x970 [0065.050] GetCurrentThreadId () returned 0x970 [0065.050] GetCurrentThreadId () returned 0x970 [0065.050] GetCurrentThreadId () returned 0x970 [0065.050] GetCurrentThreadId () returned 0x970 [0065.050] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAEHZzk1j7JKx6sgttsAV9UtK20T7SPKx4u0XlfdPOdl+SlWf/VZYfijJ1LHh9pEU3JODFx7AnMDutdOc5+WpZiIvHUtAnZQYbtAR6lWMJHwSfUmAmreNaLqToV61p/XNcyKTGjMZE8kDnOczTjHGmlLxh7bWtJ1feMZuOlEM7juRUQdUaR/qkqhCnLNZDRE7688OdLGGfTWO7eZ6skAIFrbfXVsTHI3CdQ==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0065.050] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAEHZzk1j7JKx6sgttsAV9UtK20T7SPKx4u0XlfdPOdl+SlWf/VZYfijJ1LHh9pEU3JODFx7AnMDutdOc5+WpZiIvHUtAnZQYbtAR6lWMJHwSfUmAmreNaLqToV61p/XNcyKTGjMZE8kDnOczTjHGmlLxh7bWtJ1feMZuOlEM7juRUQdUaR/qkqhCnLNZDRE7688OdLGGfTWO7eZ6skAIFrbfXVsTHI3CdQ==", cchWideChar=245, lpMultiByteStr=0x353933c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAEHZzk1j7JKx6sgttsAV9UtK20T7SPKx4u0XlfdPOdl+SlWf/VZYfijJ1LHh9pEU3JODFx7AnMDutdOc5+WpZiIvHUtAnZQYbtAR6lWMJHwSfUmAmreNaLqToV61p/XNcyKTGjMZE8kDnOczTjHGmlLxh7bWtJ1feMZuOlEM7juRUQdUaR/qkqhCnLNZDRE7688OdLGGfTWO7eZ6skAIFrbfXVsTHI3CdQ==", lpUsedDefaultChar=0x0) returned 245 [0065.050] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0065.051] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0065.051] CloseHandle (hObject=0x158) returned 1 [0065.051] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\chapters-static.png")) returned 0 [0065.051] GetLastError () returned 0x5 [0065.051] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\chapters-static.png")) returned 0x20 [0065.051] SetLastError (dwErrCode=0x5) [0065.051] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=18531454515) returned 1 [0065.051] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Файл зашифрован [content-background.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\Файл зашифрован [content-background.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0065.052] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0065.052] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0065.052] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0065.052] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0065.052] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0065.052] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0065.052] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0065.052] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0065.052] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0065.052] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0065.052] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0065.052] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0065.052] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0065.052] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0065.052] SetEndOfFile (hFile=0x158) returned 1 [0065.053] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0065.053] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0065.053] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0065.053] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0065.053] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0065.054] WriteFile (in: hFile=0x158, lpBuffer=0x35f035c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f035c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0065.054] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="\"%sfNUO4J$+?\"~tZeke\\2z8>G)=gQb{f", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0065.054] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="\"%sfNUO4J$+?\"~tZeke\\2z8>G)=gQb{f", cchWideChar=32, lpMultiByteStr=0x2035ff4, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\"%sfNUO4J$+?\"~tZeke\\2z8>G)=gQb{f", lpUsedDefaultChar=0x0) returned 32 [0065.054] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0065.054] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0065.054] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729fbb14, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729fbb14, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4aba6851, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8df12, dwReserved0=0x0, dwReserved1=0x0, cFileName="content-background.png", cAlternateFileName="")) returned 0x295098 [0065.054] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0065.054] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0065.054] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-background.png")) returned 0x20 [0065.054] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-background.png")) returned 0x20 [0065.054] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-background.png")) returned 0x20 [0065.054] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-background.png")) returned 0x20 [0065.055] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-background.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729fbb14, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729fbb14, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4aba6851, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8df12)) returned 1 [0065.055] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0065.055] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0065.055] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-background.png")) returned 0x20 [0065.055] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-background.png")) returned 0x20 [0065.055] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0065.055] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0065.055] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0065.055] SetEndOfFile (hFile=0x158) returned 1 [0065.056] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="content-background.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0065.056] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="content-background.png", cchWideChar=22, lpMultiByteStr=0x1ff885c, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="content-background.png", lpUsedDefaultChar=0x0) returned 22 [0065.056] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="content-background.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0065.056] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="content-background.png", cchWideChar=22, lpMultiByteStr=0x1ff8974, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="content-background.png", lpUsedDefaultChar=0x0) returned 22 [0065.056] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff8974, cbMultiByte=22, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="content-background.pnggngt.pngpngre.pngg") returned 22 [0065.056] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="content-background.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0065.056] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="content-background.png", cchWideChar=22, lpMultiByteStr=0x1ff885c, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="content-background.png", lpUsedDefaultChar=0x0) returned 22 [0065.056] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0065.056] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0065.056] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x8df12 [0065.056] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0065.056] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0065.056] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0065.057] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="content-background.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0065.057] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="content-background.png", cchWideChar=22, lpMultiByteStr=0x1ff885c, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="content-background.png", lpUsedDefaultChar=0x0) returned 22 [0065.057] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="content-background.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0065.057] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="content-background.png", cchWideChar=22, lpMultiByteStr=0x1ff8974, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="content-background.png", lpUsedDefaultChar=0x0) returned 22 [0065.057] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff8974, cbMultiByte=22, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="content-background.pngnd.pnggngt.pngpngre.pngg") returned 22 [0065.057] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="content-background.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0065.057] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="content-background.png", cchWideChar=22, lpMultiByteStr=0x1ff885c, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="content-background.png", lpUsedDefaultChar=0x0) returned 22 [0065.057] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0065.058] CharToOemA (in: pSrc="content-background.png", pDst=0x1ff8974 | out: pDst="content-background.png") returned 1 [0065.058] WriteFile (in: hFile=0x158, lpBuffer=0x1ff8974*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1ff8974*, lpNumberOfBytesWritten=0x18e048*=0x16, lpOverlapped=0x0) returned 1 [0065.058] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0065.058] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0065.058] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0065.058] VirtualAlloc (lpAddress=0x0, dwSize=0x90000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ef10000 [0065.058] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=18532189706) returned 1 [0065.059] ReadFile (in: hFile=0x11c, lpBuffer=0x7ef10010, nNumberOfBytesToRead=0x8df12, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x7ef10010*, lpNumberOfBytesRead=0x18dd7c*=0x8df12, lpOverlapped=0x0) returned 1 [0065.075] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0065.075] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=18533847626) returned 1 [0065.084] WriteFile (in: hFile=0x158, lpBuffer=0x379acc0*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379acc0*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0065.084] ReadFile (in: hFile=0x11c, lpBuffer=0x7ef10010, nNumberOfBytesToRead=0x8df12, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x7ef10010*, lpNumberOfBytesRead=0x18de38*=0x8df12, lpOverlapped=0x0) returned 1 [0065.084] VirtualAlloc (lpAddress=0x0, dwSize=0x90000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ee80000 [0065.092] VirtualAlloc (lpAddress=0x0, dwSize=0x90000, flAllocationType=0x101000, flProtect=0x4) returned 0x7edf0000 [0065.116] VirtualFree (lpAddress=0x7edf0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0065.119] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x51 [0065.119] WriteFile (in: hFile=0x158, lpBuffer=0x7ee80010*, nNumberOfBytesToWrite=0x8df12, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x7ee80010*, lpNumberOfBytesWritten=0x18de10*=0x8df12, lpOverlapped=0x0) returned 1 [0065.129] VirtualFree (lpAddress=0x7ee80000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0065.131] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x8df63 [0065.132] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0065.132] VirtualFree (lpAddress=0x7ef10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0065.134] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0065.134] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0065.135] SetFilePointer (in: hFile=0x158, lDistanceToMove=22, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x34 [0065.135] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x8df6d [0065.135] CloseHandle (hObject=0x11c) returned 1 [0065.135] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x8df6d [0065.135] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x8df6d [0065.135] SetFilePointer (in: hFile=0x158, lDistanceToMove=581485, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x8df6d [0065.135] SetFilePointer (in: hFile=0x158, lDistanceToMove=581485, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x8df6d [0065.135] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x8df6d [0065.135] SetFilePointer (in: hFile=0x158, lDistanceToMove=581485, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x8df6d [0065.135] SetEndOfFile (hFile=0x158) returned 1 [0065.135] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x8df6d [0065.135] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x8df6d [0065.135] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="content-background.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0065.135] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="content-background.png", cchWideChar=22, lpMultiByteStr=0x1ff8974, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="content-background.png", lpUsedDefaultChar=0x0) returned 22 [0065.135] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="content-background.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0065.136] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="content-background.png", cchWideChar=22, lpMultiByteStr=0x1ff885c, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="content-background.png", lpUsedDefaultChar=0x0) returned 22 [0065.136] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff885c, cbMultiByte=22, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="content-background.png") returned 22 [0065.136] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="content-background.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0065.136] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="content-background.png", cchWideChar=22, lpMultiByteStr=0x1ff8974, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="content-background.png", lpUsedDefaultChar=0x0) returned 22 [0065.136] WriteFile (in: hFile=0x158, lpBuffer=0x37aa1d8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x37aa1d8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0065.136] CharToOemA (in: pSrc="content-background.png", pDst=0x1ff885c | out: pDst="content-background.png") returned 1 [0065.136] WriteFile (in: hFile=0x158, lpBuffer=0x1ff885c*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1ff885c*, lpNumberOfBytesWritten=0x18efcc*=0x16, lpOverlapped=0x0) returned 1 [0065.136] WriteFile (in: hFile=0x158, lpBuffer=0x379ad58*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379ad58*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0065.136] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0065.136] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0065.136] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x8dfbc [0065.136] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x8dfbc [0065.136] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0065.136] WriteFile (in: hFile=0x158, lpBuffer=0x35f035c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f035c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0065.137] DeleteFileW (lpFileName="") returned 0 [0065.137] GetLastError () returned 0x3 [0065.137] GetFileAttributesW (lpFileName="") returned 0xffffffff [0065.137] SetLastError (dwErrCode=0x3) [0065.137] FlushFileBuffers (hFile=0x158) returned 1 [0065.140] GetCurrentThreadId () returned 0x970 [0065.140] GetCurrentThreadId () returned 0x970 [0065.140] GetCurrentThreadId () returned 0x970 [0065.140] GetCurrentThreadId () returned 0x970 [0065.140] GetCurrentThreadId () returned 0x970 [0065.140] GetCurrentThreadId () returned 0x970 [0065.140] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x8e073 [0065.140] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x8e073 [0065.140] SetFilePointer (in: hFile=0x158, lDistanceToMove=581747, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x8e073 [0065.140] CloseHandle (hObject=0x158) returned 1 [0065.141] GetCurrentThreadId () returned 0x970 [0065.141] GetCurrentThreadId () returned 0x970 [0065.141] GetCurrentThreadId () returned 0x970 [0065.141] GetCurrentThreadId () returned 0x970 [0065.141] GetCurrentThreadId () returned 0x970 [0065.141] GetCurrentThreadId () returned 0x970 [0065.141] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Файл зашифрован [content-background.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\Файл зашифрован [content-background.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0065.141] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8e073 [0065.141] SetFilePointer (in: hFile=0x158, lDistanceToMove=581619, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8dff3 [0065.141] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0065.141] GetFileType (hFile=0x158) returned 0x1 [0065.141] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xc, wMilliseconds=0x197)) [0065.141] GetCurrentThreadId () returned 0x970 [0065.141] GetCurrentThreadId () returned 0x970 [0065.141] GetCurrentThreadId () returned 0x970 [0065.141] GetCurrentThreadId () returned 0x970 [0065.141] GetCurrentThreadId () returned 0x970 [0065.141] GetCurrentThreadId () returned 0x970 [0065.141] GetCurrentThreadId () returned 0x970 [0065.141] GetCurrentThreadId () returned 0x970 [0065.141] GetCurrentThreadId () returned 0x970 [0065.141] GetCurrentThreadId () returned 0x970 [0065.141] GetCurrentThreadId () returned 0x970 [0065.141] GetCurrentThreadId () returned 0x970 [0065.142] GetCurrentThreadId () returned 0x970 [0065.142] GetCurrentThreadId () returned 0x970 [0065.142] GetCurrentThreadId () returned 0x970 [0065.142] GetCurrentThreadId () returned 0x970 [0065.142] GetCurrentThreadId () returned 0x970 [0065.142] GetCurrentThreadId () returned 0x970 [0065.142] GetCurrentThreadId () returned 0x970 [0065.142] GetCurrentThreadId () returned 0x970 [0065.142] GetCurrentThreadId () returned 0x970 [0065.142] GetCurrentThreadId () returned 0x970 [0065.142] GetCurrentThreadId () returned 0x970 [0065.142] GetCurrentThreadId () returned 0x970 [0065.142] GetCurrentThreadId () returned 0x970 [0065.142] GetCurrentThreadId () returned 0x970 [0065.142] GetCurrentThreadId () returned 0x970 [0065.142] GetCurrentThreadId () returned 0x970 [0065.142] GetCurrentThreadId () returned 0x970 [0065.142] GetCurrentThreadId () returned 0x970 [0065.142] GetCurrentThreadId () returned 0x970 [0065.142] GetCurrentThreadId () returned 0x970 [0065.142] GetCurrentThreadId () returned 0x970 [0065.142] GetCurrentThreadId () returned 0x970 [0065.142] GetCurrentThreadId () returned 0x970 [0065.142] GetCurrentThreadId () returned 0x970 [0065.142] GetCurrentThreadId () returned 0x970 [0065.142] GetCurrentThreadId () returned 0x970 [0065.142] GetCurrentThreadId () returned 0x970 [0065.142] GetCurrentThreadId () returned 0x970 [0065.142] GetCurrentThreadId () returned 0x970 [0065.142] GetCurrentThreadId () returned 0x970 [0065.142] GetCurrentThreadId () returned 0x970 [0065.142] GetCurrentThreadId () returned 0x970 [0065.142] GetCurrentThreadId () returned 0x970 [0065.142] GetCurrentThreadId () returned 0x970 [0065.142] GetCurrentThreadId () returned 0x970 [0065.142] GetCurrentThreadId () returned 0x970 [0065.142] GetCurrentThreadId () returned 0x970 [0065.142] GetCurrentThreadId () returned 0x970 [0065.142] GetCurrentThreadId () returned 0x970 [0065.142] GetCurrentThreadId () returned 0x970 [0065.142] GetCurrentThreadId () returned 0x970 [0065.142] GetCurrentThreadId () returned 0x970 [0065.142] GetCurrentThreadId () returned 0x970 [0065.142] GetCurrentThreadId () returned 0x970 [0065.142] GetCurrentThreadId () returned 0x970 [0065.142] GetCurrentThreadId () returned 0x970 [0065.143] GetCurrentThreadId () returned 0x970 [0065.143] GetCurrentThreadId () returned 0x970 [0065.143] GetCurrentThreadId () returned 0x970 [0065.143] GetCurrentThreadId () returned 0x970 [0065.143] GetCurrentThreadId () returned 0x970 [0065.143] GetCurrentThreadId () returned 0x970 [0065.143] GetCurrentThreadId () returned 0x970 [0065.143] GetCurrentThreadId () returned 0x970 [0065.143] GetCurrentThreadId () returned 0x970 [0065.143] GetCurrentThreadId () returned 0x970 [0065.143] GetCurrentThreadId () returned 0x970 [0065.143] GetCurrentThreadId () returned 0x970 [0065.143] GetCurrentThreadId () returned 0x970 [0065.143] GetCurrentThreadId () returned 0x970 [0065.143] GetCurrentThreadId () returned 0x970 [0065.143] GetCurrentThreadId () returned 0x970 [0065.143] GetCurrentThreadId () returned 0x970 [0065.143] GetCurrentThreadId () returned 0x970 [0065.143] GetCurrentThreadId () returned 0x970 [0065.143] GetCurrentThreadId () returned 0x970 [0065.143] GetCurrentThreadId () returned 0x970 [0065.143] GetCurrentThreadId () returned 0x970 [0065.143] GetCurrentThreadId () returned 0x970 [0065.143] GetCurrentThreadId () returned 0x970 [0065.143] GetCurrentThreadId () returned 0x970 [0065.143] GetCurrentThreadId () returned 0x970 [0065.143] GetCurrentThreadId () returned 0x970 [0065.143] GetCurrentThreadId () returned 0x970 [0065.143] GetCurrentThreadId () returned 0x970 [0065.143] GetCurrentThreadId () returned 0x970 [0065.143] GetCurrentThreadId () returned 0x970 [0065.143] GetCurrentThreadId () returned 0x970 [0065.143] GetCurrentThreadId () returned 0x970 [0065.143] GetCurrentThreadId () returned 0x970 [0065.143] GetCurrentThreadId () returned 0x970 [0065.143] GetCurrentThreadId () returned 0x970 [0065.143] GetCurrentThreadId () returned 0x970 [0065.143] GetCurrentThreadId () returned 0x970 [0065.143] GetCurrentThreadId () returned 0x970 [0065.143] GetCurrentThreadId () returned 0x970 [0065.143] GetCurrentThreadId () returned 0x970 [0065.144] GetCurrentThreadId () returned 0x970 [0065.144] GetCurrentThreadId () returned 0x970 [0065.144] GetCurrentThreadId () returned 0x970 [0065.144] GetCurrentThreadId () returned 0x970 [0065.144] GetCurrentThreadId () returned 0x970 [0065.144] GetCurrentThreadId () returned 0x970 [0065.144] GetCurrentThreadId () returned 0x970 [0065.144] GetCurrentThreadId () returned 0x970 [0065.144] GetCurrentThreadId () returned 0x970 [0065.144] GetCurrentThreadId () returned 0x970 [0065.144] GetCurrentThreadId () returned 0x970 [0065.144] GetCurrentThreadId () returned 0x970 [0065.144] GetCurrentThreadId () returned 0x970 [0065.144] GetCurrentThreadId () returned 0x970 [0065.144] GetCurrentThreadId () returned 0x970 [0065.144] GetCurrentThreadId () returned 0x970 [0065.144] GetCurrentThreadId () returned 0x970 [0065.144] GetCurrentThreadId () returned 0x970 [0065.144] GetCurrentThreadId () returned 0x970 [0065.144] GetCurrentThreadId () returned 0x970 [0065.144] GetCurrentThreadId () returned 0x970 [0065.144] GetCurrentThreadId () returned 0x970 [0065.144] GetCurrentThreadId () returned 0x970 [0065.144] GetCurrentThreadId () returned 0x970 [0065.144] GetCurrentThreadId () returned 0x970 [0065.144] GetCurrentThreadId () returned 0x970 [0065.144] GetCurrentThreadId () returned 0x970 [0065.144] GetCurrentThreadId () returned 0x970 [0065.144] GetCurrentThreadId () returned 0x970 [0065.144] GetCurrentThreadId () returned 0x970 [0065.144] GetCurrentThreadId () returned 0x970 [0065.144] GetCurrentThreadId () returned 0x970 [0065.144] GetCurrentThreadId () returned 0x970 [0065.144] GetCurrentThreadId () returned 0x970 [0065.144] GetCurrentThreadId () returned 0x970 [0065.144] GetCurrentThreadId () returned 0x970 [0065.144] GetCurrentThreadId () returned 0x970 [0065.144] GetCurrentThreadId () returned 0x970 [0065.144] GetCurrentThreadId () returned 0x970 [0065.144] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.145] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.145] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379b8f8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.145] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.145] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.145] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379b8f8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.145] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.145] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.145] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.145] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.145] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.145] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.145] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.145] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.145] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379b958, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.145] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.145] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.145] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379b958, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.145] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.145] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.145] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379b958, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.145] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xc, wMilliseconds=0x1a7)) [0065.145] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="\"%sfNUO4J$+?\"~tZeke\\2z8>G)=gQb{f", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0065.145] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="\"%sfNUO4J$+?\"~tZeke\\2z8>G)=gQb{f", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0065.145] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="\"%sfNUO4J$+?\"~tZeke\\2z8>G)=gQb{f", cchWideChar=32, lpMultiByteStr=0x2003aa8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\"%sfNUO4J$+?\"~tZeke\\2z8>G)=gQb{f", lpUsedDefaultChar=0x0) returned 32 [0065.145] GetCurrentThreadId () returned 0x970 [0065.145] GetCurrentThreadId () returned 0x970 [0065.145] GetCurrentThreadId () returned 0x970 [0065.145] GetCurrentThreadId () returned 0x970 [0065.145] GetCurrentThreadId () returned 0x970 [0065.145] GetCurrentThreadId () returned 0x970 [0065.153] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0065.153] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0065.153] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3798348, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0065.153] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb248, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0065.153] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb248, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAB6LZxKYhs/tDvlZqMfS33RseOYI5U2pzicwfca/EUDJ7qw/bO6CC/kQJE57qSc9FIA3lcJfAzQ2XhJ4Xrab5mI4pys4fvvdJ8Yb0n6CPOaMx0p7wWpwpybzW9X3IwLZlWNeF7vl2vC4eRSIBLEsuA4EH5GM1NNjLrN8qWkhuV3W7rLWTF4gakCjiN2cE2DsAzmJ/xsgPlcbLtc6P7VllNkRfr0PG4gLuw==") returned 232 [0065.153] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xc, wMilliseconds=0x1a7)) [0065.153] GetCurrentThreadId () returned 0x970 [0065.153] GetCurrentThreadId () returned 0x970 [0065.153] GetCurrentThreadId () returned 0x970 [0065.153] GetCurrentThreadId () returned 0x970 [0065.153] GetCurrentThreadId () returned 0x970 [0065.153] GetCurrentThreadId () returned 0x970 [0065.153] GetCurrentThreadId () returned 0x970 [0065.153] GetCurrentThreadId () returned 0x970 [0065.153] GetCurrentThreadId () returned 0x970 [0065.153] GetCurrentThreadId () returned 0x970 [0065.153] GetCurrentThreadId () returned 0x970 [0065.153] GetCurrentThreadId () returned 0x970 [0065.153] GetCurrentThreadId () returned 0x970 [0065.153] GetCurrentThreadId () returned 0x970 [0065.153] GetCurrentThreadId () returned 0x970 [0065.153] GetCurrentThreadId () returned 0x970 [0065.153] GetCurrentThreadId () returned 0x970 [0065.153] GetCurrentThreadId () returned 0x970 [0065.153] GetCurrentThreadId () returned 0x970 [0065.153] GetCurrentThreadId () returned 0x970 [0065.154] GetCurrentThreadId () returned 0x970 [0065.154] GetCurrentThreadId () returned 0x970 [0065.154] GetCurrentThreadId () returned 0x970 [0065.154] GetCurrentThreadId () returned 0x970 [0065.154] GetCurrentThreadId () returned 0x970 [0065.154] GetCurrentThreadId () returned 0x970 [0065.154] GetCurrentThreadId () returned 0x970 [0065.154] GetCurrentThreadId () returned 0x970 [0065.154] GetCurrentThreadId () returned 0x970 [0065.154] GetCurrentThreadId () returned 0x970 [0065.154] GetCurrentThreadId () returned 0x970 [0065.154] GetCurrentThreadId () returned 0x970 [0065.154] GetCurrentThreadId () returned 0x970 [0065.154] GetCurrentThreadId () returned 0x970 [0065.154] GetCurrentThreadId () returned 0x970 [0065.154] GetCurrentThreadId () returned 0x970 [0065.154] GetCurrentThreadId () returned 0x970 [0065.154] GetCurrentThreadId () returned 0x970 [0065.154] GetCurrentThreadId () returned 0x970 [0065.154] GetCurrentThreadId () returned 0x970 [0065.154] GetCurrentThreadId () returned 0x970 [0065.154] GetCurrentThreadId () returned 0x970 [0065.154] GetCurrentThreadId () returned 0x970 [0065.154] GetCurrentThreadId () returned 0x970 [0065.154] GetCurrentThreadId () returned 0x970 [0065.154] GetCurrentThreadId () returned 0x970 [0065.154] GetCurrentThreadId () returned 0x970 [0065.154] GetCurrentThreadId () returned 0x970 [0065.154] GetCurrentThreadId () returned 0x970 [0065.154] GetCurrentThreadId () returned 0x970 [0065.154] GetCurrentThreadId () returned 0x970 [0065.154] GetCurrentThreadId () returned 0x970 [0065.154] GetCurrentThreadId () returned 0x970 [0065.154] GetCurrentThreadId () returned 0x970 [0065.154] GetCurrentThreadId () returned 0x970 [0065.154] GetCurrentThreadId () returned 0x970 [0065.154] GetCurrentThreadId () returned 0x970 [0065.154] GetCurrentThreadId () returned 0x970 [0065.154] GetCurrentThreadId () returned 0x970 [0065.154] GetCurrentThreadId () returned 0x970 [0065.154] GetCurrentThreadId () returned 0x970 [0065.154] GetCurrentThreadId () returned 0x970 [0065.154] GetCurrentThreadId () returned 0x970 [0065.154] GetCurrentThreadId () returned 0x970 [0065.154] GetCurrentThreadId () returned 0x970 [0065.154] GetCurrentThreadId () returned 0x970 [0065.155] GetCurrentThreadId () returned 0x970 [0065.155] GetCurrentThreadId () returned 0x970 [0065.155] GetCurrentThreadId () returned 0x970 [0065.155] GetCurrentThreadId () returned 0x970 [0065.155] GetCurrentThreadId () returned 0x970 [0065.155] GetCurrentThreadId () returned 0x970 [0065.155] GetCurrentThreadId () returned 0x970 [0065.155] GetCurrentThreadId () returned 0x970 [0065.155] GetCurrentThreadId () returned 0x970 [0065.155] GetCurrentThreadId () returned 0x970 [0065.155] GetCurrentThreadId () returned 0x970 [0065.155] GetCurrentThreadId () returned 0x970 [0065.155] GetCurrentThreadId () returned 0x970 [0065.155] GetCurrentThreadId () returned 0x970 [0065.155] GetCurrentThreadId () returned 0x970 [0065.155] GetCurrentThreadId () returned 0x970 [0065.155] GetCurrentThreadId () returned 0x970 [0065.155] GetCurrentThreadId () returned 0x970 [0065.155] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAB6LZxKYhs/tDvlZqMfS33RseOYI5U2pzicwfca/EUDJ7qw/bO6CC/kQJE57qSc9FIA3lcJfAzQ2XhJ4Xrab5mI4pys4fvvdJ8Yb0n6CPOaMx0p7wWpwpybzW9X3IwLZlWNeF7vl2vC4eRSIBLEsuA4EH5GM1NNjLrN8qWkhuV3W7rLWTF4gakCjiN2cE2DsAzmJ/xsgPlcbLtc6P7VllNkRfr0PG4gLuw==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0065.155] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAB6LZxKYhs/tDvlZqMfS33RseOYI5U2pzicwfca/EUDJ7qw/bO6CC/kQJE57qSc9FIA3lcJfAzQ2XhJ4Xrab5mI4pys4fvvdJ8Yb0n6CPOaMx0p7wWpwpybzW9X3IwLZlWNeF7vl2vC4eRSIBLEsuA4EH5GM1NNjLrN8qWkhuV3W7rLWTF4gakCjiN2cE2DsAzmJ/xsgPlcbLtc6P7VllNkRfr0PG4gLuw==", cchWideChar=245, lpMultiByteStr=0x353933c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAB6LZxKYhs/tDvlZqMfS33RseOYI5U2pzicwfca/EUDJ7qw/bO6CC/kQJE57qSc9FIA3lcJfAzQ2XhJ4Xrab5mI4pys4fvvdJ8Yb0n6CPOaMx0p7wWpwpybzW9X3IwLZlWNeF7vl2vC4eRSIBLEsuA4EH5GM1NNjLrN8qWkhuV3W7rLWTF4gakCjiN2cE2DsAzmJ/xsgPlcbLtc6P7VllNkRfr0PG4gLuw==", lpUsedDefaultChar=0x0) returned 245 [0065.155] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0065.155] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0065.155] CloseHandle (hObject=0x158) returned 1 [0065.155] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-background.png")) returned 0 [0065.156] GetLastError () returned 0x5 [0065.156] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-background.png")) returned 0x20 [0065.156] SetLastError (dwErrCode=0x5) [0065.156] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=18541912332) returned 1 [0065.156] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Файл зашифрован [content-foreground.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\Файл зашифрован [content-foreground.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0065.156] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0065.156] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0065.156] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0065.156] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0065.156] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0065.157] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0065.157] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0065.157] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0065.157] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0065.157] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0065.157] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0065.157] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0065.157] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0065.157] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0065.157] SetEndOfFile (hFile=0x158) returned 1 [0065.157] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0065.157] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0065.157] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0065.157] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0065.157] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0065.158] WriteFile (in: hFile=0x158, lpBuffer=0x35f04dc*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f04dc*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0065.158] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="y:MrV7ECr@NH75%?fOO/XZ{tMXkir>@k", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0065.158] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="y:MrV7ECr@NH75%?fOO/XZ{tMXkir>@k", cchWideChar=32, lpMultiByteStr=0x2036534, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="y:MrV7ECr@NH75%?fOO/XZ{tMXkir>@k", lpUsedDefaultChar=0x0) returned 32 [0065.158] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0065.158] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0065.158] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72a47dce, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72a47dce, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b362f69, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="content-foreground.png", cAlternateFileName="")) returned 0x295098 [0065.159] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0065.159] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0065.159] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-foreground.png")) returned 0x20 [0065.159] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-foreground.png")) returned 0x20 [0065.159] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-foreground.png")) returned 0x20 [0065.159] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-foreground.png")) returned 0x20 [0065.159] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-foreground.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72a47dce, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72a47dce, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b362f69, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2f0)) returned 1 [0065.159] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0065.159] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0065.159] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-foreground.png")) returned 0x20 [0065.159] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-foreground.png")) returned 0x20 [0065.159] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0065.159] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0065.160] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0065.160] SetEndOfFile (hFile=0x158) returned 1 [0065.160] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="content-foreground.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0065.160] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="content-foreground.png", cchWideChar=22, lpMultiByteStr=0x1ff88fc, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="content-foreground.png", lpUsedDefaultChar=0x0) returned 22 [0065.160] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="content-foreground.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0065.160] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="content-foreground.png", cchWideChar=22, lpMultiByteStr=0x1ff8a14, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="content-foreground.png", lpUsedDefaultChar=0x0) returned 22 [0065.161] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff8a14, cbMultiByte=22, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="content-foreground.pnggngt.pngpngre.pngg") returned 22 [0065.161] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="content-foreground.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0065.161] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="content-foreground.png", cchWideChar=22, lpMultiByteStr=0x1ff88fc, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="content-foreground.png", lpUsedDefaultChar=0x0) returned 22 [0065.161] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-foreground.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0065.161] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0065.161] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0xc2f0 [0065.161] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0065.161] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0065.161] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0065.161] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="content-foreground.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0065.161] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="content-foreground.png", cchWideChar=22, lpMultiByteStr=0x1ff88fc, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="content-foreground.png", lpUsedDefaultChar=0x0) returned 22 [0065.161] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="content-foreground.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0065.161] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="content-foreground.png", cchWideChar=22, lpMultiByteStr=0x1ff8a14, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="content-foreground.png", lpUsedDefaultChar=0x0) returned 22 [0065.161] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff8a14, cbMultiByte=22, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="content-foreground.pngnd.pnggngt.pngpngre.pngg") returned 22 [0065.161] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="content-foreground.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0065.161] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="content-foreground.png", cchWideChar=22, lpMultiByteStr=0x1ff88fc, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="content-foreground.png", lpUsedDefaultChar=0x0) returned 22 [0065.162] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0065.162] CharToOemA (in: pSrc="content-foreground.png", pDst=0x1ff8a14 | out: pDst="content-foreground.png") returned 1 [0065.162] WriteFile (in: hFile=0x158, lpBuffer=0x1ff8a14*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1ff8a14*, lpNumberOfBytesWritten=0x18e048*=0x16, lpOverlapped=0x0) returned 1 [0065.163] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0065.163] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0065.163] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0065.163] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=18542625319) returned 1 [0065.163] ReadFile (in: hFile=0x11c, lpBuffer=0x37c6700, nNumberOfBytesToRead=0xc2f0, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37c6700*, lpNumberOfBytesRead=0x18dd7c*=0xc2f0, lpOverlapped=0x0) returned 1 [0065.165] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0065.165] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=18542833392) returned 1 [0065.174] WriteFile (in: hFile=0x158, lpBuffer=0x379ae58*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379ae58*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0065.174] ReadFile (in: hFile=0x11c, lpBuffer=0x37c6700, nNumberOfBytesToRead=0xc2f0, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x37c6700*, lpNumberOfBytesRead=0x18de38*=0xc2f0, lpOverlapped=0x0) returned 1 [0065.175] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x51 [0065.175] WriteFile (in: hFile=0x158, lpBuffer=0x3814220*, nNumberOfBytesToWrite=0xc2f0, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3814220*, lpNumberOfBytesWritten=0x18de10*=0xc2f0, lpOverlapped=0x0) returned 1 [0065.176] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0xc341 [0065.176] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0065.176] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0065.176] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0065.176] SetFilePointer (in: hFile=0x158, lDistanceToMove=22, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x34 [0065.177] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0xc34b [0065.177] CloseHandle (hObject=0x11c) returned 1 [0065.177] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xc34b [0065.177] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xc34b [0065.177] SetFilePointer (in: hFile=0x158, lDistanceToMove=49995, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xc34b [0065.177] SetFilePointer (in: hFile=0x158, lDistanceToMove=49995, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0xc34b [0065.177] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xc34b [0065.177] SetFilePointer (in: hFile=0x158, lDistanceToMove=49995, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0xc34b [0065.177] SetEndOfFile (hFile=0x158) returned 1 [0065.177] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xc34b [0065.177] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xc34b [0065.177] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="content-foreground.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0065.177] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="content-foreground.png", cchWideChar=22, lpMultiByteStr=0x1ff8a14, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="content-foreground.png", lpUsedDefaultChar=0x0) returned 22 [0065.177] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="content-foreground.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0065.177] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="content-foreground.png", cchWideChar=22, lpMultiByteStr=0x1ff88fc, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="content-foreground.png", lpUsedDefaultChar=0x0) returned 22 [0065.178] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff88fc, cbMultiByte=22, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="content-foreground.png") returned 22 [0065.178] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="content-foreground.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0065.178] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="content-foreground.png", cchWideChar=22, lpMultiByteStr=0x1ff8a14, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="content-foreground.png", lpUsedDefaultChar=0x0) returned 22 [0065.178] WriteFile (in: hFile=0x158, lpBuffer=0x37aa1d8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x37aa1d8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0065.178] CharToOemA (in: pSrc="content-foreground.png", pDst=0x1ff88fc | out: pDst="content-foreground.png") returned 1 [0065.178] WriteFile (in: hFile=0x158, lpBuffer=0x1ff88fc*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1ff88fc*, lpNumberOfBytesWritten=0x18efcc*=0x16, lpOverlapped=0x0) returned 1 [0065.178] WriteFile (in: hFile=0x158, lpBuffer=0x379ae18*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379ae18*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0065.178] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0065.178] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0065.178] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xc39a [0065.178] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xc39a [0065.178] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0065.178] WriteFile (in: hFile=0x158, lpBuffer=0x35f04dc*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f04dc*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0065.178] DeleteFileW (lpFileName="") returned 0 [0065.178] GetLastError () returned 0x3 [0065.179] GetFileAttributesW (lpFileName="") returned 0xffffffff [0065.179] SetLastError (dwErrCode=0x3) [0065.179] FlushFileBuffers (hFile=0x158) returned 1 [0065.181] GetCurrentThreadId () returned 0x970 [0065.181] GetCurrentThreadId () returned 0x970 [0065.181] GetCurrentThreadId () returned 0x970 [0065.181] GetCurrentThreadId () returned 0x970 [0065.182] GetCurrentThreadId () returned 0x970 [0065.182] GetCurrentThreadId () returned 0x970 [0065.182] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xc451 [0065.182] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xc451 [0065.182] SetFilePointer (in: hFile=0x158, lDistanceToMove=50257, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xc451 [0065.182] CloseHandle (hObject=0x158) returned 1 [0065.182] GetCurrentThreadId () returned 0x970 [0065.182] GetCurrentThreadId () returned 0x970 [0065.182] GetCurrentThreadId () returned 0x970 [0065.182] GetCurrentThreadId () returned 0x970 [0065.182] GetCurrentThreadId () returned 0x970 [0065.182] GetCurrentThreadId () returned 0x970 [0065.182] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Файл зашифрован [content-foreground.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\Файл зашифрован [content-foreground.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0065.182] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc451 [0065.182] SetFilePointer (in: hFile=0x158, lDistanceToMove=50129, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc3d1 [0065.182] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0065.182] GetFileType (hFile=0x158) returned 0x1 [0065.182] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xc, wMilliseconds=0x1c6)) [0065.182] GetCurrentThreadId () returned 0x970 [0065.182] GetCurrentThreadId () returned 0x970 [0065.182] GetCurrentThreadId () returned 0x970 [0065.182] GetCurrentThreadId () returned 0x970 [0065.183] GetCurrentThreadId () returned 0x970 [0065.183] GetCurrentThreadId () returned 0x970 [0065.183] GetCurrentThreadId () returned 0x970 [0065.183] GetCurrentThreadId () returned 0x970 [0065.183] GetCurrentThreadId () returned 0x970 [0065.183] GetCurrentThreadId () returned 0x970 [0065.183] GetCurrentThreadId () returned 0x970 [0065.183] GetCurrentThreadId () returned 0x970 [0065.183] GetCurrentThreadId () returned 0x970 [0065.183] GetCurrentThreadId () returned 0x970 [0065.183] GetCurrentThreadId () returned 0x970 [0065.183] GetCurrentThreadId () returned 0x970 [0065.183] GetCurrentThreadId () returned 0x970 [0065.183] GetCurrentThreadId () returned 0x970 [0065.183] GetCurrentThreadId () returned 0x970 [0065.183] GetCurrentThreadId () returned 0x970 [0065.183] GetCurrentThreadId () returned 0x970 [0065.183] GetCurrentThreadId () returned 0x970 [0065.183] GetCurrentThreadId () returned 0x970 [0065.183] GetCurrentThreadId () returned 0x970 [0065.183] GetCurrentThreadId () returned 0x970 [0065.183] GetCurrentThreadId () returned 0x970 [0065.183] GetCurrentThreadId () returned 0x970 [0065.183] GetCurrentThreadId () returned 0x970 [0065.183] GetCurrentThreadId () returned 0x970 [0065.183] GetCurrentThreadId () returned 0x970 [0065.183] GetCurrentThreadId () returned 0x970 [0065.183] GetCurrentThreadId () returned 0x970 [0065.183] GetCurrentThreadId () returned 0x970 [0065.183] GetCurrentThreadId () returned 0x970 [0065.183] GetCurrentThreadId () returned 0x970 [0065.183] GetCurrentThreadId () returned 0x970 [0065.183] GetCurrentThreadId () returned 0x970 [0065.183] GetCurrentThreadId () returned 0x970 [0065.183] GetCurrentThreadId () returned 0x970 [0065.183] GetCurrentThreadId () returned 0x970 [0065.183] GetCurrentThreadId () returned 0x970 [0065.183] GetCurrentThreadId () returned 0x970 [0065.183] GetCurrentThreadId () returned 0x970 [0065.183] GetCurrentThreadId () returned 0x970 [0065.183] GetCurrentThreadId () returned 0x970 [0065.183] GetCurrentThreadId () returned 0x970 [0065.183] GetCurrentThreadId () returned 0x970 [0065.183] GetCurrentThreadId () returned 0x970 [0065.184] GetCurrentThreadId () returned 0x970 [0065.184] GetCurrentThreadId () returned 0x970 [0065.184] GetCurrentThreadId () returned 0x970 [0065.184] GetCurrentThreadId () returned 0x970 [0065.184] GetCurrentThreadId () returned 0x970 [0065.184] GetCurrentThreadId () returned 0x970 [0065.184] GetCurrentThreadId () returned 0x970 [0065.184] GetCurrentThreadId () returned 0x970 [0065.184] GetCurrentThreadId () returned 0x970 [0065.184] GetCurrentThreadId () returned 0x970 [0065.184] GetCurrentThreadId () returned 0x970 [0065.184] GetCurrentThreadId () returned 0x970 [0065.184] GetCurrentThreadId () returned 0x970 [0065.184] GetCurrentThreadId () returned 0x970 [0065.184] GetCurrentThreadId () returned 0x970 [0065.184] GetCurrentThreadId () returned 0x970 [0065.184] GetCurrentThreadId () returned 0x970 [0065.184] GetCurrentThreadId () returned 0x970 [0065.184] GetCurrentThreadId () returned 0x970 [0065.184] GetCurrentThreadId () returned 0x970 [0065.184] GetCurrentThreadId () returned 0x970 [0065.184] GetCurrentThreadId () returned 0x970 [0065.184] GetCurrentThreadId () returned 0x970 [0065.184] GetCurrentThreadId () returned 0x970 [0065.184] GetCurrentThreadId () returned 0x970 [0065.184] GetCurrentThreadId () returned 0x970 [0065.184] GetCurrentThreadId () returned 0x970 [0065.184] GetCurrentThreadId () returned 0x970 [0065.184] GetCurrentThreadId () returned 0x970 [0065.184] GetCurrentThreadId () returned 0x970 [0065.184] GetCurrentThreadId () returned 0x970 [0065.184] GetCurrentThreadId () returned 0x970 [0065.184] GetCurrentThreadId () returned 0x970 [0065.184] GetCurrentThreadId () returned 0x970 [0065.184] GetCurrentThreadId () returned 0x970 [0065.184] GetCurrentThreadId () returned 0x970 [0065.184] GetCurrentThreadId () returned 0x970 [0065.184] GetCurrentThreadId () returned 0x970 [0065.184] GetCurrentThreadId () returned 0x970 [0065.184] GetCurrentThreadId () returned 0x970 [0065.184] GetCurrentThreadId () returned 0x970 [0065.184] GetCurrentThreadId () returned 0x970 [0065.184] GetCurrentThreadId () returned 0x970 [0065.184] GetCurrentThreadId () returned 0x970 [0065.184] GetCurrentThreadId () returned 0x970 [0065.185] GetCurrentThreadId () returned 0x970 [0065.185] GetCurrentThreadId () returned 0x970 [0065.185] GetCurrentThreadId () returned 0x970 [0065.185] GetCurrentThreadId () returned 0x970 [0065.185] GetCurrentThreadId () returned 0x970 [0065.185] GetCurrentThreadId () returned 0x970 [0065.185] GetCurrentThreadId () returned 0x970 [0065.185] GetCurrentThreadId () returned 0x970 [0065.185] GetCurrentThreadId () returned 0x970 [0065.185] GetCurrentThreadId () returned 0x970 [0065.185] GetCurrentThreadId () returned 0x970 [0065.185] GetCurrentThreadId () returned 0x970 [0065.185] GetCurrentThreadId () returned 0x970 [0065.185] GetCurrentThreadId () returned 0x970 [0065.185] GetCurrentThreadId () returned 0x970 [0065.185] GetCurrentThreadId () returned 0x970 [0065.185] GetCurrentThreadId () returned 0x970 [0065.185] GetCurrentThreadId () returned 0x970 [0065.185] GetCurrentThreadId () returned 0x970 [0065.185] GetCurrentThreadId () returned 0x970 [0065.185] GetCurrentThreadId () returned 0x970 [0065.185] GetCurrentThreadId () returned 0x970 [0065.185] GetCurrentThreadId () returned 0x970 [0065.185] GetCurrentThreadId () returned 0x970 [0065.185] GetCurrentThreadId () returned 0x970 [0065.185] GetCurrentThreadId () returned 0x970 [0065.185] GetCurrentThreadId () returned 0x970 [0065.185] GetCurrentThreadId () returned 0x970 [0065.185] GetCurrentThreadId () returned 0x970 [0065.185] GetCurrentThreadId () returned 0x970 [0065.185] GetCurrentThreadId () returned 0x970 [0065.185] GetCurrentThreadId () returned 0x970 [0065.185] GetCurrentThreadId () returned 0x970 [0065.185] GetCurrentThreadId () returned 0x970 [0065.185] GetCurrentThreadId () returned 0x970 [0065.185] GetCurrentThreadId () returned 0x970 [0065.185] GetCurrentThreadId () returned 0x970 [0065.185] GetCurrentThreadId () returned 0x970 [0065.185] GetCurrentThreadId () returned 0x970 [0065.185] GetCurrentThreadId () returned 0x970 [0065.185] GetCurrentThreadId () returned 0x970 [0065.185] GetCurrentThreadId () returned 0x970 [0065.185] GetCurrentThreadId () returned 0x970 [0065.186] GetCurrentThreadId () returned 0x970 [0065.186] GetCurrentThreadId () returned 0x970 [0065.186] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.186] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.186] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379b958, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.186] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.186] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.186] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379b958, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.186] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.186] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.186] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.186] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.186] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.186] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.186] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.186] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.186] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379b9b8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.186] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.186] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.186] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379b9b8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.186] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.186] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.186] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379b9b8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.186] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xc, wMilliseconds=0x1c6)) [0065.186] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="y:MrV7ECr@NH75%?fOO/XZ{tMXkir>@k", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0065.186] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="y:MrV7ECr@NH75%?fOO/XZ{tMXkir>@k", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0065.186] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="y:MrV7ECr@NH75%?fOO/XZ{tMXkir>@k", cchWideChar=32, lpMultiByteStr=0x2003ad8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="y:MrV7ECr@NH75%?fOO/XZ{tMXkir>@k", lpUsedDefaultChar=0x0) returned 32 [0065.186] GetCurrentThreadId () returned 0x970 [0065.187] GetCurrentThreadId () returned 0x970 [0065.187] GetCurrentThreadId () returned 0x970 [0065.187] GetCurrentThreadId () returned 0x970 [0065.187] GetCurrentThreadId () returned 0x970 [0065.187] GetCurrentThreadId () returned 0x970 [0065.194] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0065.194] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0065.194] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3798438, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0065.194] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb248, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0065.194] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb248, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAACPgzp6+nRH1cLmBsr4IWK/btvkFLj8neDxCLqjx6C28/K253nM5slbJ2z4I71TqHISd3eacSiO6SOhWZqSdOU84K8wCSGO9j+AjKqQWOBPL3rOm1StR3UFDD0PEn7poyUQxw8rlruQNCKT3CGIGtom2dpqXAXpjByZX6/L03rd2Po63Z4a7LGleH0Nbvs5Q+SSSt1t8UxrZA3rtLTGZhR2ITTExY5CnEw==") returned 232 [0065.194] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xc, wMilliseconds=0x1d6)) [0065.194] GetCurrentThreadId () returned 0x970 [0065.194] GetCurrentThreadId () returned 0x970 [0065.194] GetCurrentThreadId () returned 0x970 [0065.194] GetCurrentThreadId () returned 0x970 [0065.194] GetCurrentThreadId () returned 0x970 [0065.194] GetCurrentThreadId () returned 0x970 [0065.194] GetCurrentThreadId () returned 0x970 [0065.195] GetCurrentThreadId () returned 0x970 [0065.195] GetCurrentThreadId () returned 0x970 [0065.195] GetCurrentThreadId () returned 0x970 [0065.195] GetCurrentThreadId () returned 0x970 [0065.195] GetCurrentThreadId () returned 0x970 [0065.195] GetCurrentThreadId () returned 0x970 [0065.195] GetCurrentThreadId () returned 0x970 [0065.195] GetCurrentThreadId () returned 0x970 [0065.195] GetCurrentThreadId () returned 0x970 [0065.195] GetCurrentThreadId () returned 0x970 [0065.195] GetCurrentThreadId () returned 0x970 [0065.195] GetCurrentThreadId () returned 0x970 [0065.195] GetCurrentThreadId () returned 0x970 [0065.195] GetCurrentThreadId () returned 0x970 [0065.195] GetCurrentThreadId () returned 0x970 [0065.195] GetCurrentThreadId () returned 0x970 [0065.195] GetCurrentThreadId () returned 0x970 [0065.195] GetCurrentThreadId () returned 0x970 [0065.195] GetCurrentThreadId () returned 0x970 [0065.195] GetCurrentThreadId () returned 0x970 [0065.195] GetCurrentThreadId () returned 0x970 [0065.195] GetCurrentThreadId () returned 0x970 [0065.195] GetCurrentThreadId () returned 0x970 [0065.195] GetCurrentThreadId () returned 0x970 [0065.195] GetCurrentThreadId () returned 0x970 [0065.195] GetCurrentThreadId () returned 0x970 [0065.195] GetCurrentThreadId () returned 0x970 [0065.195] GetCurrentThreadId () returned 0x970 [0065.195] GetCurrentThreadId () returned 0x970 [0065.195] GetCurrentThreadId () returned 0x970 [0065.195] GetCurrentThreadId () returned 0x970 [0065.195] GetCurrentThreadId () returned 0x970 [0065.195] GetCurrentThreadId () returned 0x970 [0065.195] GetCurrentThreadId () returned 0x970 [0065.195] GetCurrentThreadId () returned 0x970 [0065.195] GetCurrentThreadId () returned 0x970 [0065.195] GetCurrentThreadId () returned 0x970 [0065.195] GetCurrentThreadId () returned 0x970 [0065.195] GetCurrentThreadId () returned 0x970 [0065.195] GetCurrentThreadId () returned 0x970 [0065.195] GetCurrentThreadId () returned 0x970 [0065.195] GetCurrentThreadId () returned 0x970 [0065.195] GetCurrentThreadId () returned 0x970 [0065.195] GetCurrentThreadId () returned 0x970 [0065.195] GetCurrentThreadId () returned 0x970 [0065.195] GetCurrentThreadId () returned 0x970 [0065.196] GetCurrentThreadId () returned 0x970 [0065.196] GetCurrentThreadId () returned 0x970 [0065.196] GetCurrentThreadId () returned 0x970 [0065.196] GetCurrentThreadId () returned 0x970 [0065.196] GetCurrentThreadId () returned 0x970 [0065.196] GetCurrentThreadId () returned 0x970 [0065.196] GetCurrentThreadId () returned 0x970 [0065.196] GetCurrentThreadId () returned 0x970 [0065.196] GetCurrentThreadId () returned 0x970 [0065.196] GetCurrentThreadId () returned 0x970 [0065.196] GetCurrentThreadId () returned 0x970 [0065.196] GetCurrentThreadId () returned 0x970 [0065.196] GetCurrentThreadId () returned 0x970 [0065.196] GetCurrentThreadId () returned 0x970 [0065.196] GetCurrentThreadId () returned 0x970 [0065.196] GetCurrentThreadId () returned 0x970 [0065.196] GetCurrentThreadId () returned 0x970 [0065.196] GetCurrentThreadId () returned 0x970 [0065.196] GetCurrentThreadId () returned 0x970 [0065.196] GetCurrentThreadId () returned 0x970 [0065.196] GetCurrentThreadId () returned 0x970 [0065.196] GetCurrentThreadId () returned 0x970 [0065.196] GetCurrentThreadId () returned 0x970 [0065.196] GetCurrentThreadId () returned 0x970 [0065.196] GetCurrentThreadId () returned 0x970 [0065.196] GetCurrentThreadId () returned 0x970 [0065.196] GetCurrentThreadId () returned 0x970 [0065.196] GetCurrentThreadId () returned 0x970 [0065.196] GetCurrentThreadId () returned 0x970 [0065.196] GetCurrentThreadId () returned 0x970 [0065.196] GetCurrentThreadId () returned 0x970 [0065.196] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAACPgzp6+nRH1cLmBsr4IWK/btvkFLj8neDxCLqjx6C28/K253nM5slbJ2z4I71TqHISd3eacSiO6SOhWZqSdOU84K8wCSGO9j+AjKqQWOBPL3rOm1StR3UFDD0PEn7poyUQxw8rlruQNCKT3CGIGtom2dpqXAXpjByZX6/L03rd2Po63Z4a7LGleH0Nbvs5Q+SSSt1t8UxrZA3rtLTGZhR2ITTExY5CnEw==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0065.196] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAACPgzp6+nRH1cLmBsr4IWK/btvkFLj8neDxCLqjx6C28/K253nM5slbJ2z4I71TqHISd3eacSiO6SOhWZqSdOU84K8wCSGO9j+AjKqQWOBPL3rOm1StR3UFDD0PEn7poyUQxw8rlruQNCKT3CGIGtom2dpqXAXpjByZX6/L03rd2Po63Z4a7LGleH0Nbvs5Q+SSSt1t8UxrZA3rtLTGZhR2ITTExY5CnEw==", cchWideChar=245, lpMultiByteStr=0x353933c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAACPgzp6+nRH1cLmBsr4IWK/btvkFLj8neDxCLqjx6C28/K253nM5slbJ2z4I71TqHISd3eacSiO6SOhWZqSdOU84K8wCSGO9j+AjKqQWOBPL3rOm1StR3UFDD0PEn7poyUQxw8rlruQNCKT3CGIGtom2dpqXAXpjByZX6/L03rd2Po63Z4a7LGleH0Nbvs5Q+SSSt1t8UxrZA3rtLTGZhR2ITTExY5CnEw==", lpUsedDefaultChar=0x0) returned 245 [0065.196] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0065.196] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0065.197] CloseHandle (hObject=0x158) returned 1 [0065.197] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-foreground.png")) returned 0 [0065.197] GetLastError () returned 0x5 [0065.197] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-foreground.png")) returned 0x20 [0065.197] SetLastError (dwErrCode=0x5) [0065.197] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=18546036924) returned 1 [0065.197] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Файл зашифрован [curtains.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\Файл зашифрован [curtains.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0065.198] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0065.198] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0065.198] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0065.198] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0065.198] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0065.198] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0065.198] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0065.198] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0065.199] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0065.199] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0065.199] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0065.199] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0065.199] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0065.199] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0065.199] SetEndOfFile (hFile=0x158) returned 1 [0065.199] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0065.199] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0065.199] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0065.199] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0065.199] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0065.201] WriteFile (in: hFile=0x158, lpBuffer=0x35f035c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f035c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0065.201] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="cfHEH3&0?6%-*TKUO?$1Pfmf+Nk4CTDc", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0065.201] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="cfHEH3&0?6%-*TKUO?$1Pfmf+Nk4CTDc", cchWideChar=32, lpMultiByteStr=0x2036304, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cfHEH3&0?6%-*TKUO?$1Pfmf+Nk4CTDc", lpUsedDefaultChar=0x0) returned 32 [0065.201] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0065.202] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0065.202] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72a6df2b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72a6df2b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b362f69, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb8c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="curtains.png", cAlternateFileName="")) returned 0x295098 [0065.202] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0065.202] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0065.202] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\curtains.png")) returned 0x20 [0065.202] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\curtains.png")) returned 0x20 [0065.202] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\curtains.png")) returned 0x20 [0065.202] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\curtains.png")) returned 0x20 [0065.202] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\curtains.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72a6df2b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72a6df2b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b362f69, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb8c4)) returned 1 [0065.202] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0065.202] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0065.202] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\curtains.png")) returned 0x20 [0065.202] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\curtains.png")) returned 0x20 [0065.202] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0065.202] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0065.203] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0065.203] SetEndOfFile (hFile=0x158) returned 1 [0065.203] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="curtains.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0065.203] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="curtains.png", cchWideChar=12, lpMultiByteStr=0x1fe432c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="curtains.png", lpUsedDefaultChar=0x0) returned 12 [0065.203] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="curtains.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0065.203] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="curtains.png", cchWideChar=12, lpMultiByteStr=0x1fe398c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="curtains.png", lpUsedDefaultChar=0x0) returned 12 [0065.204] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe398c, cbMultiByte=12, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="curtains.png.pngnd.pnggngt.pngpngre.pngg") returned 12 [0065.204] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="curtains.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0065.204] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="curtains.png", cchWideChar=12, lpMultiByteStr=0x1fe432c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="curtains.png", lpUsedDefaultChar=0x0) returned 12 [0065.204] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\curtains.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0065.204] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0065.204] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0xb8c4 [0065.204] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0065.204] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0065.204] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0065.204] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="curtains.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0065.204] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="curtains.png", cchWideChar=12, lpMultiByteStr=0x1fe432c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="curtains.png", lpUsedDefaultChar=0x0) returned 12 [0065.204] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="curtains.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0065.204] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="curtains.png", cchWideChar=12, lpMultiByteStr=0x1fe398c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="curtains.png", lpUsedDefaultChar=0x0) returned 12 [0065.204] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe398c, cbMultiByte=12, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="curtains.pngns.png.pngnd.pnggngt.pngpngre.pngg") returned 12 [0065.204] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="curtains.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0065.204] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="curtains.png", cchWideChar=12, lpMultiByteStr=0x1fe432c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="curtains.png", lpUsedDefaultChar=0x0) returned 12 [0065.205] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0065.205] CharToOemA (in: pSrc="curtains.png", pDst=0x1fe398c | out: pDst="curtains.png") returned 1 [0065.205] WriteFile (in: hFile=0x158, lpBuffer=0x1fe398c*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe398c*, lpNumberOfBytesWritten=0x18e048*=0xc, lpOverlapped=0x0) returned 1 [0065.206] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0065.206] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0065.206] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0065.206] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=18546927826) returned 1 [0065.206] ReadFile (in: hFile=0x11c, lpBuffer=0x37c6700, nNumberOfBytesToRead=0xb8c4, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37c6700*, lpNumberOfBytesRead=0x18dd7c*=0xb8c4, lpOverlapped=0x0) returned 1 [0065.208] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0065.208] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=18547115413) returned 1 [0065.216] WriteFile (in: hFile=0x158, lpBuffer=0x379acd8*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379acd8*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0065.217] ReadFile (in: hFile=0x11c, lpBuffer=0x37c6700, nNumberOfBytesToRead=0xb8c4, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x37c6700*, lpNumberOfBytesRead=0x18de38*=0xb8c4, lpOverlapped=0x0) returned 1 [0065.218] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x47 [0065.218] WriteFile (in: hFile=0x158, lpBuffer=0x3813820*, nNumberOfBytesToWrite=0xb8c4, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3813820*, lpNumberOfBytesWritten=0x18de10*=0xb8c4, lpOverlapped=0x0) returned 1 [0065.219] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0xb90b [0065.219] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0065.219] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0065.219] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0065.219] SetFilePointer (in: hFile=0x158, lDistanceToMove=12, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2a [0065.219] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0xb915 [0065.219] CloseHandle (hObject=0x11c) returned 1 [0065.219] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xb915 [0065.219] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xb915 [0065.219] SetFilePointer (in: hFile=0x158, lDistanceToMove=47381, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xb915 [0065.220] SetFilePointer (in: hFile=0x158, lDistanceToMove=47381, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0xb915 [0065.220] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xb915 [0065.220] SetFilePointer (in: hFile=0x158, lDistanceToMove=47381, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0xb915 [0065.220] SetEndOfFile (hFile=0x158) returned 1 [0065.220] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xb915 [0065.220] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xb915 [0065.220] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="curtains.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0065.220] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="curtains.png", cchWideChar=12, lpMultiByteStr=0x1fe432c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="curtains.png", lpUsedDefaultChar=0x0) returned 12 [0065.220] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="curtains.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0065.220] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="curtains.png", cchWideChar=12, lpMultiByteStr=0x1fe358c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="curtains.png", lpUsedDefaultChar=0x0) returned 12 [0065.220] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe358c, cbMultiByte=12, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="curtains.pngꞗ@涤(\x18믉`믑`") returned 12 [0065.220] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="curtains.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0065.220] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="curtains.png", cchWideChar=12, lpMultiByteStr=0x1fe432c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="curtains.png", lpUsedDefaultChar=0x0) returned 12 [0065.220] WriteFile (in: hFile=0x158, lpBuffer=0x37aa1d8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x37aa1d8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0065.220] CharToOemA (in: pSrc="curtains.png", pDst=0x1fe358c | out: pDst="curtains.png") returned 1 [0065.220] WriteFile (in: hFile=0x158, lpBuffer=0x1fe358c*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe358c*, lpNumberOfBytesWritten=0x18efcc*=0xc, lpOverlapped=0x0) returned 1 [0065.221] WriteFile (in: hFile=0x158, lpBuffer=0x379acf8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379acf8*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0065.221] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0065.221] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0065.221] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xb95a [0065.221] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xb95a [0065.221] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0065.221] WriteFile (in: hFile=0x158, lpBuffer=0x35f035c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f035c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0065.221] DeleteFileW (lpFileName="") returned 0 [0065.221] GetLastError () returned 0x3 [0065.221] GetFileAttributesW (lpFileName="") returned 0xffffffff [0065.221] SetLastError (dwErrCode=0x3) [0065.221] FlushFileBuffers (hFile=0x158) returned 1 [0065.224] GetCurrentThreadId () returned 0x970 [0065.224] GetCurrentThreadId () returned 0x970 [0065.224] GetCurrentThreadId () returned 0x970 [0065.224] GetCurrentThreadId () returned 0x970 [0065.224] GetCurrentThreadId () returned 0x970 [0065.224] GetCurrentThreadId () returned 0x970 [0065.224] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xba11 [0065.224] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xba11 [0065.224] SetFilePointer (in: hFile=0x158, lDistanceToMove=47633, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xba11 [0065.224] CloseHandle (hObject=0x158) returned 1 [0065.224] GetCurrentThreadId () returned 0x970 [0065.224] GetCurrentThreadId () returned 0x970 [0065.224] GetCurrentThreadId () returned 0x970 [0065.224] GetCurrentThreadId () returned 0x970 [0065.225] GetCurrentThreadId () returned 0x970 [0065.225] GetCurrentThreadId () returned 0x970 [0065.225] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Файл зашифрован [curtains.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\Файл зашифрован [curtains.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0065.225] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xba11 [0065.225] SetFilePointer (in: hFile=0x158, lDistanceToMove=47505, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb991 [0065.225] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0065.225] GetFileType (hFile=0x158) returned 0x1 [0065.225] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xc, wMilliseconds=0x1f5)) [0065.225] GetCurrentThreadId () returned 0x970 [0065.225] GetCurrentThreadId () returned 0x970 [0065.225] GetCurrentThreadId () returned 0x970 [0065.225] GetCurrentThreadId () returned 0x970 [0065.225] GetCurrentThreadId () returned 0x970 [0065.225] GetCurrentThreadId () returned 0x970 [0065.225] GetCurrentThreadId () returned 0x970 [0065.225] GetCurrentThreadId () returned 0x970 [0065.225] GetCurrentThreadId () returned 0x970 [0065.225] GetCurrentThreadId () returned 0x970 [0065.225] GetCurrentThreadId () returned 0x970 [0065.225] GetCurrentThreadId () returned 0x970 [0065.225] GetCurrentThreadId () returned 0x970 [0065.225] GetCurrentThreadId () returned 0x970 [0065.225] GetCurrentThreadId () returned 0x970 [0065.225] GetCurrentThreadId () returned 0x970 [0065.225] GetCurrentThreadId () returned 0x970 [0065.225] GetCurrentThreadId () returned 0x970 [0065.225] GetCurrentThreadId () returned 0x970 [0065.225] GetCurrentThreadId () returned 0x970 [0065.225] GetCurrentThreadId () returned 0x970 [0065.225] GetCurrentThreadId () returned 0x970 [0065.226] GetCurrentThreadId () returned 0x970 [0065.226] GetCurrentThreadId () returned 0x970 [0065.226] GetCurrentThreadId () returned 0x970 [0065.226] GetCurrentThreadId () returned 0x970 [0065.226] GetCurrentThreadId () returned 0x970 [0065.226] GetCurrentThreadId () returned 0x970 [0065.226] GetCurrentThreadId () returned 0x970 [0065.226] GetCurrentThreadId () returned 0x970 [0065.226] GetCurrentThreadId () returned 0x970 [0065.226] GetCurrentThreadId () returned 0x970 [0065.226] GetCurrentThreadId () returned 0x970 [0065.226] GetCurrentThreadId () returned 0x970 [0065.226] GetCurrentThreadId () returned 0x970 [0065.226] GetCurrentThreadId () returned 0x970 [0065.226] GetCurrentThreadId () returned 0x970 [0065.226] GetCurrentThreadId () returned 0x970 [0065.226] GetCurrentThreadId () returned 0x970 [0065.226] GetCurrentThreadId () returned 0x970 [0065.226] GetCurrentThreadId () returned 0x970 [0065.226] GetCurrentThreadId () returned 0x970 [0065.226] GetCurrentThreadId () returned 0x970 [0065.226] GetCurrentThreadId () returned 0x970 [0065.226] GetCurrentThreadId () returned 0x970 [0065.226] GetCurrentThreadId () returned 0x970 [0065.226] GetCurrentThreadId () returned 0x970 [0065.226] GetCurrentThreadId () returned 0x970 [0065.226] GetCurrentThreadId () returned 0x970 [0065.226] GetCurrentThreadId () returned 0x970 [0065.226] GetCurrentThreadId () returned 0x970 [0065.226] GetCurrentThreadId () returned 0x970 [0065.226] GetCurrentThreadId () returned 0x970 [0065.226] GetCurrentThreadId () returned 0x970 [0065.226] GetCurrentThreadId () returned 0x970 [0065.226] GetCurrentThreadId () returned 0x970 [0065.226] GetCurrentThreadId () returned 0x970 [0065.226] GetCurrentThreadId () returned 0x970 [0065.226] GetCurrentThreadId () returned 0x970 [0065.226] GetCurrentThreadId () returned 0x970 [0065.226] GetCurrentThreadId () returned 0x970 [0065.226] GetCurrentThreadId () returned 0x970 [0065.226] GetCurrentThreadId () returned 0x970 [0065.226] GetCurrentThreadId () returned 0x970 [0065.226] GetCurrentThreadId () returned 0x970 [0065.226] GetCurrentThreadId () returned 0x970 [0065.226] GetCurrentThreadId () returned 0x970 [0065.226] GetCurrentThreadId () returned 0x970 [0065.227] GetCurrentThreadId () returned 0x970 [0065.227] GetCurrentThreadId () returned 0x970 [0065.227] GetCurrentThreadId () returned 0x970 [0065.227] GetCurrentThreadId () returned 0x970 [0065.227] GetCurrentThreadId () returned 0x970 [0065.227] GetCurrentThreadId () returned 0x970 [0065.227] GetCurrentThreadId () returned 0x970 [0065.227] GetCurrentThreadId () returned 0x970 [0065.227] GetCurrentThreadId () returned 0x970 [0065.227] GetCurrentThreadId () returned 0x970 [0065.227] GetCurrentThreadId () returned 0x970 [0065.227] GetCurrentThreadId () returned 0x970 [0065.227] GetCurrentThreadId () returned 0x970 [0065.227] GetCurrentThreadId () returned 0x970 [0065.227] GetCurrentThreadId () returned 0x970 [0065.227] GetCurrentThreadId () returned 0x970 [0065.227] GetCurrentThreadId () returned 0x970 [0065.227] GetCurrentThreadId () returned 0x970 [0065.227] GetCurrentThreadId () returned 0x970 [0065.227] GetCurrentThreadId () returned 0x970 [0065.227] GetCurrentThreadId () returned 0x970 [0065.227] GetCurrentThreadId () returned 0x970 [0065.227] GetCurrentThreadId () returned 0x970 [0065.227] GetCurrentThreadId () returned 0x970 [0065.227] GetCurrentThreadId () returned 0x970 [0065.227] GetCurrentThreadId () returned 0x970 [0065.227] GetCurrentThreadId () returned 0x970 [0065.227] GetCurrentThreadId () returned 0x970 [0065.227] GetCurrentThreadId () returned 0x970 [0065.227] GetCurrentThreadId () returned 0x970 [0065.227] GetCurrentThreadId () returned 0x970 [0065.227] GetCurrentThreadId () returned 0x970 [0065.227] GetCurrentThreadId () returned 0x970 [0065.227] GetCurrentThreadId () returned 0x970 [0065.227] GetCurrentThreadId () returned 0x970 [0065.227] GetCurrentThreadId () returned 0x970 [0065.227] GetCurrentThreadId () returned 0x970 [0065.227] GetCurrentThreadId () returned 0x970 [0065.227] GetCurrentThreadId () returned 0x970 [0065.227] GetCurrentThreadId () returned 0x970 [0065.227] GetCurrentThreadId () returned 0x970 [0065.227] GetCurrentThreadId () returned 0x970 [0065.227] GetCurrentThreadId () returned 0x970 [0065.227] GetCurrentThreadId () returned 0x970 [0065.228] GetCurrentThreadId () returned 0x970 [0065.228] GetCurrentThreadId () returned 0x970 [0065.228] GetCurrentThreadId () returned 0x970 [0065.228] GetCurrentThreadId () returned 0x970 [0065.228] GetCurrentThreadId () returned 0x970 [0065.228] GetCurrentThreadId () returned 0x970 [0065.228] GetCurrentThreadId () returned 0x970 [0065.228] GetCurrentThreadId () returned 0x970 [0065.228] GetCurrentThreadId () returned 0x970 [0065.228] GetCurrentThreadId () returned 0x970 [0065.228] GetCurrentThreadId () returned 0x970 [0065.228] GetCurrentThreadId () returned 0x970 [0065.228] GetCurrentThreadId () returned 0x970 [0065.228] GetCurrentThreadId () returned 0x970 [0065.228] GetCurrentThreadId () returned 0x970 [0065.228] GetCurrentThreadId () returned 0x970 [0065.228] GetCurrentThreadId () returned 0x970 [0065.228] GetCurrentThreadId () returned 0x970 [0065.228] GetCurrentThreadId () returned 0x970 [0065.228] GetCurrentThreadId () returned 0x970 [0065.228] GetCurrentThreadId () returned 0x970 [0065.228] GetCurrentThreadId () returned 0x970 [0065.228] GetCurrentThreadId () returned 0x970 [0065.228] GetCurrentThreadId () returned 0x970 [0065.228] GetCurrentThreadId () returned 0x970 [0065.228] GetCurrentThreadId () returned 0x970 [0065.228] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.228] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.228] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379b9b8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.228] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.228] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.228] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379b9b8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.228] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.228] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.228] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.228] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.228] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.228] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.228] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.229] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.229] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379ba18, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.229] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.229] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.229] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379ba18, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.229] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.229] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.229] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379ba18, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.229] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xc, wMilliseconds=0x1f5)) [0065.229] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cfHEH3&0?6%-*TKUO?$1Pfmf+Nk4CTDc", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0065.229] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cfHEH3&0?6%-*TKUO?$1Pfmf+Nk4CTDc", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0065.229] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cfHEH3&0?6%-*TKUO?$1Pfmf+Nk4CTDc", cchWideChar=32, lpMultiByteStr=0x2003b68, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cfHEH3&0?6%-*TKUO?$1Pfmf+Nk4CTDc", lpUsedDefaultChar=0x0) returned 32 [0065.229] GetCurrentThreadId () returned 0x970 [0065.229] GetCurrentThreadId () returned 0x970 [0065.229] GetCurrentThreadId () returned 0x970 [0065.229] GetCurrentThreadId () returned 0x970 [0065.229] GetCurrentThreadId () returned 0x970 [0065.229] GetCurrentThreadId () returned 0x970 [0065.236] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0065.236] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0065.237] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3798528, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0065.237] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb248, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0065.237] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb248, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAF/PUV2jwWgnPNmnqow65lPJaOZqUr5Q3YaOBVznQUYnm++u0UhvvJE7HPT18OOKa1dKHBXFbWGAgtDv1jha8B6x0EeXju3aT4L8IQN8kpKAbZWaO+pWGQSmyx/0VDZ/+3mEvrQEyglyHvW4ylR2LxPPS8tMMhNfXDIq44Vo8CFBsUXUiy1bvCtI9PYiWicVzFR2ePAaTdnrf3fH2i2t0ZDcee+IKghbbA==") returned 232 [0065.237] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xc, wMilliseconds=0x1f5)) [0065.237] GetCurrentThreadId () returned 0x970 [0065.237] GetCurrentThreadId () returned 0x970 [0065.237] GetCurrentThreadId () returned 0x970 [0065.237] GetCurrentThreadId () returned 0x970 [0065.237] GetCurrentThreadId () returned 0x970 [0065.237] GetCurrentThreadId () returned 0x970 [0065.237] GetCurrentThreadId () returned 0x970 [0065.237] GetCurrentThreadId () returned 0x970 [0065.237] GetCurrentThreadId () returned 0x970 [0065.237] GetCurrentThreadId () returned 0x970 [0065.237] GetCurrentThreadId () returned 0x970 [0065.237] GetCurrentThreadId () returned 0x970 [0065.237] GetCurrentThreadId () returned 0x970 [0065.237] GetCurrentThreadId () returned 0x970 [0065.237] GetCurrentThreadId () returned 0x970 [0065.237] GetCurrentThreadId () returned 0x970 [0065.237] GetCurrentThreadId () returned 0x970 [0065.237] GetCurrentThreadId () returned 0x970 [0065.237] GetCurrentThreadId () returned 0x970 [0065.237] GetCurrentThreadId () returned 0x970 [0065.237] GetCurrentThreadId () returned 0x970 [0065.237] GetCurrentThreadId () returned 0x970 [0065.237] GetCurrentThreadId () returned 0x970 [0065.237] GetCurrentThreadId () returned 0x970 [0065.237] GetCurrentThreadId () returned 0x970 [0065.237] GetCurrentThreadId () returned 0x970 [0065.237] GetCurrentThreadId () returned 0x970 [0065.237] GetCurrentThreadId () returned 0x970 [0065.237] GetCurrentThreadId () returned 0x970 [0065.237] GetCurrentThreadId () returned 0x970 [0065.237] GetCurrentThreadId () returned 0x970 [0065.237] GetCurrentThreadId () returned 0x970 [0065.237] GetCurrentThreadId () returned 0x970 [0065.237] GetCurrentThreadId () returned 0x970 [0065.237] GetCurrentThreadId () returned 0x970 [0065.237] GetCurrentThreadId () returned 0x970 [0065.238] GetCurrentThreadId () returned 0x970 [0065.238] GetCurrentThreadId () returned 0x970 [0065.238] GetCurrentThreadId () returned 0x970 [0065.238] GetCurrentThreadId () returned 0x970 [0065.238] GetCurrentThreadId () returned 0x970 [0065.238] GetCurrentThreadId () returned 0x970 [0065.238] GetCurrentThreadId () returned 0x970 [0065.238] GetCurrentThreadId () returned 0x970 [0065.238] GetCurrentThreadId () returned 0x970 [0065.238] GetCurrentThreadId () returned 0x970 [0065.238] GetCurrentThreadId () returned 0x970 [0065.238] GetCurrentThreadId () returned 0x970 [0065.238] GetCurrentThreadId () returned 0x970 [0065.238] GetCurrentThreadId () returned 0x970 [0065.238] GetCurrentThreadId () returned 0x970 [0065.238] GetCurrentThreadId () returned 0x970 [0065.238] GetCurrentThreadId () returned 0x970 [0065.238] GetCurrentThreadId () returned 0x970 [0065.238] GetCurrentThreadId () returned 0x970 [0065.238] GetCurrentThreadId () returned 0x970 [0065.238] GetCurrentThreadId () returned 0x970 [0065.238] GetCurrentThreadId () returned 0x970 [0065.238] GetCurrentThreadId () returned 0x970 [0065.238] GetCurrentThreadId () returned 0x970 [0065.238] GetCurrentThreadId () returned 0x970 [0065.238] GetCurrentThreadId () returned 0x970 [0065.238] GetCurrentThreadId () returned 0x970 [0065.238] GetCurrentThreadId () returned 0x970 [0065.238] GetCurrentThreadId () returned 0x970 [0065.238] GetCurrentThreadId () returned 0x970 [0065.238] GetCurrentThreadId () returned 0x970 [0065.238] GetCurrentThreadId () returned 0x970 [0065.238] GetCurrentThreadId () returned 0x970 [0065.238] GetCurrentThreadId () returned 0x970 [0065.238] GetCurrentThreadId () returned 0x970 [0065.238] GetCurrentThreadId () returned 0x970 [0065.238] GetCurrentThreadId () returned 0x970 [0065.238] GetCurrentThreadId () returned 0x970 [0065.238] GetCurrentThreadId () returned 0x970 [0065.238] GetCurrentThreadId () returned 0x970 [0065.238] GetCurrentThreadId () returned 0x970 [0065.238] GetCurrentThreadId () returned 0x970 [0065.238] GetCurrentThreadId () returned 0x970 [0065.238] GetCurrentThreadId () returned 0x970 [0065.238] GetCurrentThreadId () returned 0x970 [0065.239] GetCurrentThreadId () returned 0x970 [0065.239] GetCurrentThreadId () returned 0x970 [0065.239] GetCurrentThreadId () returned 0x970 [0065.239] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAF/PUV2jwWgnPNmnqow65lPJaOZqUr5Q3YaOBVznQUYnm++u0UhvvJE7HPT18OOKa1dKHBXFbWGAgtDv1jha8B6x0EeXju3aT4L8IQN8kpKAbZWaO+pWGQSmyx/0VDZ/+3mEvrQEyglyHvW4ylR2LxPPS8tMMhNfXDIq44Vo8CFBsUXUiy1bvCtI9PYiWicVzFR2ePAaTdnrf3fH2i2t0ZDcee+IKghbbA==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0065.239] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAF/PUV2jwWgnPNmnqow65lPJaOZqUr5Q3YaOBVznQUYnm++u0UhvvJE7HPT18OOKa1dKHBXFbWGAgtDv1jha8B6x0EeXju3aT4L8IQN8kpKAbZWaO+pWGQSmyx/0VDZ/+3mEvrQEyglyHvW4ylR2LxPPS8tMMhNfXDIq44Vo8CFBsUXUiy1bvCtI9PYiWicVzFR2ePAaTdnrf3fH2i2t0ZDcee+IKghbbA==", cchWideChar=245, lpMultiByteStr=0x353933c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAF/PUV2jwWgnPNmnqow65lPJaOZqUr5Q3YaOBVznQUYnm++u0UhvvJE7HPT18OOKa1dKHBXFbWGAgtDv1jha8B6x0EeXju3aT4L8IQN8kpKAbZWaO+pWGQSmyx/0VDZ/+3mEvrQEyglyHvW4ylR2LxPPS8tMMhNfXDIq44Vo8CFBsUXUiy1bvCtI9PYiWicVzFR2ePAaTdnrf3fH2i2t0ZDcee+IKghbbA==", lpUsedDefaultChar=0x0) returned 245 [0065.239] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0065.239] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0065.239] CloseHandle (hObject=0x158) returned 1 [0065.239] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\curtains.png")) returned 0 [0065.239] GetLastError () returned 0x5 [0065.239] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\curtains.png")) returned 0x20 [0065.239] SetLastError (dwErrCode=0x5) [0065.239] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=18550275777) returned 1 [0065.239] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Файл зашифрован [highlight.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\Файл зашифрован [highlight.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0065.240] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0065.240] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0065.240] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0065.240] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0065.240] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0065.240] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0065.240] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0065.240] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0065.240] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0065.240] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0065.240] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0065.241] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0065.241] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0065.241] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0065.241] SetEndOfFile (hFile=0x158) returned 1 [0065.241] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0065.241] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0065.241] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0065.241] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0065.241] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0065.242] WriteFile (in: hFile=0x158, lpBuffer=0x35f04dc*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f04dc*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0065.242] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="\\:8$UNFb}h<:(\\$B/biN8Dm}F9?)Y#i~", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0065.242] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="\\:8$UNFb}h<:(\\$B/biN8Dm}F9?)Y#i~", cchWideChar=32, lpMultiByteStr=0x20361ec, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\\:8$UNFb}h<:(\\$B/biN8Dm}F9?)Y#i~", lpUsedDefaultChar=0x0) returned 32 [0065.242] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0065.242] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0065.242] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72a94088, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72a94088, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5c4549, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x609, dwReserved0=0x0, dwReserved1=0x0, cFileName="highlight.png", cAlternateFileName="")) returned 0x295098 [0065.242] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0065.242] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0065.242] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\highlight.png")) returned 0x20 [0065.243] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\highlight.png")) returned 0x20 [0065.243] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\highlight.png")) returned 0x20 [0065.243] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\highlight.png")) returned 0x20 [0065.243] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\highlight.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72a94088, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72a94088, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5c4549, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x609)) returned 1 [0065.243] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0065.243] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0065.244] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\highlight.png")) returned 0x20 [0065.244] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\highlight.png")) returned 0x20 [0065.244] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0065.244] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0065.244] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0065.244] SetEndOfFile (hFile=0x158) returned 1 [0065.245] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="highlight.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0065.245] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="highlight.png", cchWideChar=13, lpMultiByteStr=0x1fe368c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="highlight.png", lpUsedDefaultChar=0x0) returned 13 [0065.245] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="highlight.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0065.245] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="highlight.png", cchWideChar=13, lpMultiByteStr=0x1fe3bac, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="highlight.png", lpUsedDefaultChar=0x0) returned 13 [0065.245] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe3bac, cbMultiByte=13, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="highlight.pngpngnd.pnggngt.pngpngre.pngg") returned 13 [0065.245] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="highlight.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0065.245] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="highlight.png", cchWideChar=13, lpMultiByteStr=0x1fe368c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="highlight.png", lpUsedDefaultChar=0x0) returned 13 [0065.245] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\highlight.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0065.245] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0065.245] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x609 [0065.245] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0065.245] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0065.246] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0065.246] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="highlight.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0065.246] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="highlight.png", cchWideChar=13, lpMultiByteStr=0x1fe368c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="highlight.png", lpUsedDefaultChar=0x0) returned 13 [0065.246] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="highlight.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0065.246] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="highlight.png", cchWideChar=13, lpMultiByteStr=0x1fe3bac, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="highlight.png", lpUsedDefaultChar=0x0) returned 13 [0065.246] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe3bac, cbMultiByte=13, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="highlight.pnght.pngpngnd.pnggngt.pngpngre.pngg") returned 13 [0065.246] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="highlight.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0065.246] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="highlight.png", cchWideChar=13, lpMultiByteStr=0x1fe368c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="highlight.png", lpUsedDefaultChar=0x0) returned 13 [0065.246] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0065.247] CharToOemA (in: pSrc="highlight.png", pDst=0x1fe3bac | out: pDst="highlight.png") returned 1 [0065.247] WriteFile (in: hFile=0x158, lpBuffer=0x1fe3bac*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe3bac*, lpNumberOfBytesWritten=0x18e048*=0xd, lpOverlapped=0x0) returned 1 [0065.247] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0065.247] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0065.247] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0065.247] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=18551088572) returned 1 [0065.248] ReadFile (in: hFile=0x11c, lpBuffer=0x37c6720, nNumberOfBytesToRead=0x609, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37c6720*, lpNumberOfBytesRead=0x18dd7c*=0x609, lpOverlapped=0x0) returned 1 [0065.250] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0065.250] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=18551318983) returned 1 [0065.262] WriteFile (in: hFile=0x158, lpBuffer=0x379ad68*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379ad68*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0065.263] ReadFile (in: hFile=0x11c, lpBuffer=0x37c6720, nNumberOfBytesToRead=0x609, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x37c6720*, lpNumberOfBytesRead=0x18de38*=0x609, lpOverlapped=0x0) returned 1 [0065.263] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x48 [0065.263] WriteFile (in: hFile=0x158, lpBuffer=0x37c6d90*, nNumberOfBytesToWrite=0x609, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x37c6d90*, lpNumberOfBytesWritten=0x18de10*=0x609, lpOverlapped=0x0) returned 1 [0065.263] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x651 [0065.263] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0065.263] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0065.263] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0065.264] SetFilePointer (in: hFile=0x158, lDistanceToMove=13, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2b [0065.264] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x65b [0065.264] CloseHandle (hObject=0x11c) returned 1 [0065.264] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x65b [0065.264] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x65b [0065.264] SetFilePointer (in: hFile=0x158, lDistanceToMove=1627, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x65b [0065.264] SetFilePointer (in: hFile=0x158, lDistanceToMove=1627, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x65b [0065.264] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x65b [0065.264] SetFilePointer (in: hFile=0x158, lDistanceToMove=1627, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x65b [0065.264] SetEndOfFile (hFile=0x158) returned 1 [0065.265] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x65b [0065.265] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x65b [0065.265] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="highlight.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0065.265] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="highlight.png", cchWideChar=13, lpMultiByteStr=0x1fe368c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="highlight.png", lpUsedDefaultChar=0x0) returned 13 [0065.265] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="highlight.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0065.265] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="highlight.png", cchWideChar=13, lpMultiByteStr=0x1fe430c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="highlight.png", lpUsedDefaultChar=0x0) returned 13 [0065.265] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe430c, cbMultiByte=13, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="highlight.png@涤(\x18믉`믑`") returned 13 [0065.265] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="highlight.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0065.265] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="highlight.png", cchWideChar=13, lpMultiByteStr=0x1fe368c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="highlight.png", lpUsedDefaultChar=0x0) returned 13 [0065.265] WriteFile (in: hFile=0x158, lpBuffer=0x37aa1d8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x37aa1d8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0065.265] CharToOemA (in: pSrc="highlight.png", pDst=0x1fe430c | out: pDst="highlight.png") returned 1 [0065.266] WriteFile (in: hFile=0x158, lpBuffer=0x1fe430c*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe430c*, lpNumberOfBytesWritten=0x18efcc*=0xd, lpOverlapped=0x0) returned 1 [0065.266] WriteFile (in: hFile=0x158, lpBuffer=0x379ad58*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379ad58*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0065.266] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0065.266] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0065.266] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x6a1 [0065.266] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x6a1 [0065.266] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0065.266] WriteFile (in: hFile=0x158, lpBuffer=0x35f04dc*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f04dc*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0065.266] DeleteFileW (lpFileName="") returned 0 [0065.266] GetLastError () returned 0x3 [0065.266] GetFileAttributesW (lpFileName="") returned 0xffffffff [0065.267] SetLastError (dwErrCode=0x3) [0065.267] FlushFileBuffers (hFile=0x158) returned 1 [0065.270] GetCurrentThreadId () returned 0x970 [0065.270] GetCurrentThreadId () returned 0x970 [0065.270] GetCurrentThreadId () returned 0x970 [0065.270] GetCurrentThreadId () returned 0x970 [0065.270] GetCurrentThreadId () returned 0x970 [0065.270] GetCurrentThreadId () returned 0x970 [0065.270] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x758 [0065.270] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x758 [0065.271] SetFilePointer (in: hFile=0x158, lDistanceToMove=1880, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x758 [0065.271] CloseHandle (hObject=0x158) returned 1 [0065.271] GetCurrentThreadId () returned 0x970 [0065.271] GetCurrentThreadId () returned 0x970 [0065.271] GetCurrentThreadId () returned 0x970 [0065.271] GetCurrentThreadId () returned 0x970 [0065.271] GetCurrentThreadId () returned 0x970 [0065.271] GetCurrentThreadId () returned 0x970 [0065.271] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Файл зашифрован [highlight.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\Файл зашифрован [highlight.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0065.271] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x758 [0065.271] SetFilePointer (in: hFile=0x158, lDistanceToMove=1752, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6d8 [0065.271] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0065.271] GetFileType (hFile=0x158) returned 0x1 [0065.271] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xc, wMilliseconds=0x224)) [0065.272] GetCurrentThreadId () returned 0x970 [0065.272] GetCurrentThreadId () returned 0x970 [0065.272] GetCurrentThreadId () returned 0x970 [0065.272] GetCurrentThreadId () returned 0x970 [0065.272] GetCurrentThreadId () returned 0x970 [0065.272] GetCurrentThreadId () returned 0x970 [0065.272] GetCurrentThreadId () returned 0x970 [0065.272] GetCurrentThreadId () returned 0x970 [0065.272] GetCurrentThreadId () returned 0x970 [0065.272] GetCurrentThreadId () returned 0x970 [0065.272] GetCurrentThreadId () returned 0x970 [0065.272] GetCurrentThreadId () returned 0x970 [0065.272] GetCurrentThreadId () returned 0x970 [0065.272] GetCurrentThreadId () returned 0x970 [0065.272] GetCurrentThreadId () returned 0x970 [0065.272] GetCurrentThreadId () returned 0x970 [0065.272] GetCurrentThreadId () returned 0x970 [0065.272] GetCurrentThreadId () returned 0x970 [0065.272] GetCurrentThreadId () returned 0x970 [0065.272] GetCurrentThreadId () returned 0x970 [0065.272] GetCurrentThreadId () returned 0x970 [0065.272] GetCurrentThreadId () returned 0x970 [0065.272] GetCurrentThreadId () returned 0x970 [0065.272] GetCurrentThreadId () returned 0x970 [0065.272] GetCurrentThreadId () returned 0x970 [0065.272] GetCurrentThreadId () returned 0x970 [0065.272] GetCurrentThreadId () returned 0x970 [0065.272] GetCurrentThreadId () returned 0x970 [0065.272] GetCurrentThreadId () returned 0x970 [0065.272] GetCurrentThreadId () returned 0x970 [0065.272] GetCurrentThreadId () returned 0x970 [0065.272] GetCurrentThreadId () returned 0x970 [0065.272] GetCurrentThreadId () returned 0x970 [0065.272] GetCurrentThreadId () returned 0x970 [0065.273] GetCurrentThreadId () returned 0x970 [0065.273] GetCurrentThreadId () returned 0x970 [0065.273] GetCurrentThreadId () returned 0x970 [0065.273] GetCurrentThreadId () returned 0x970 [0065.273] GetCurrentThreadId () returned 0x970 [0065.273] GetCurrentThreadId () returned 0x970 [0065.273] GetCurrentThreadId () returned 0x970 [0065.273] GetCurrentThreadId () returned 0x970 [0065.273] GetCurrentThreadId () returned 0x970 [0065.273] GetCurrentThreadId () returned 0x970 [0065.273] GetCurrentThreadId () returned 0x970 [0065.273] GetCurrentThreadId () returned 0x970 [0065.273] GetCurrentThreadId () returned 0x970 [0065.273] GetCurrentThreadId () returned 0x970 [0065.273] GetCurrentThreadId () returned 0x970 [0065.273] GetCurrentThreadId () returned 0x970 [0065.273] GetCurrentThreadId () returned 0x970 [0065.273] GetCurrentThreadId () returned 0x970 [0065.273] GetCurrentThreadId () returned 0x970 [0065.273] GetCurrentThreadId () returned 0x970 [0065.273] GetCurrentThreadId () returned 0x970 [0065.273] GetCurrentThreadId () returned 0x970 [0065.273] GetCurrentThreadId () returned 0x970 [0065.273] GetCurrentThreadId () returned 0x970 [0065.273] GetCurrentThreadId () returned 0x970 [0065.273] GetCurrentThreadId () returned 0x970 [0065.273] GetCurrentThreadId () returned 0x970 [0065.273] GetCurrentThreadId () returned 0x970 [0065.273] GetCurrentThreadId () returned 0x970 [0065.273] GetCurrentThreadId () returned 0x970 [0065.273] GetCurrentThreadId () returned 0x970 [0065.273] GetCurrentThreadId () returned 0x970 [0065.273] GetCurrentThreadId () returned 0x970 [0065.274] GetCurrentThreadId () returned 0x970 [0065.274] GetCurrentThreadId () returned 0x970 [0065.274] GetCurrentThreadId () returned 0x970 [0065.274] GetCurrentThreadId () returned 0x970 [0065.274] GetCurrentThreadId () returned 0x970 [0065.274] GetCurrentThreadId () returned 0x970 [0065.274] GetCurrentThreadId () returned 0x970 [0065.274] GetCurrentThreadId () returned 0x970 [0065.274] GetCurrentThreadId () returned 0x970 [0065.274] GetCurrentThreadId () returned 0x970 [0065.274] GetCurrentThreadId () returned 0x970 [0065.274] GetCurrentThreadId () returned 0x970 [0065.274] GetCurrentThreadId () returned 0x970 [0065.274] GetCurrentThreadId () returned 0x970 [0065.274] GetCurrentThreadId () returned 0x970 [0065.274] GetCurrentThreadId () returned 0x970 [0065.274] GetCurrentThreadId () returned 0x970 [0065.274] GetCurrentThreadId () returned 0x970 [0065.274] GetCurrentThreadId () returned 0x970 [0065.274] GetCurrentThreadId () returned 0x970 [0065.274] GetCurrentThreadId () returned 0x970 [0065.274] GetCurrentThreadId () returned 0x970 [0065.274] GetCurrentThreadId () returned 0x970 [0065.274] GetCurrentThreadId () returned 0x970 [0065.274] GetCurrentThreadId () returned 0x970 [0065.274] GetCurrentThreadId () returned 0x970 [0065.274] GetCurrentThreadId () returned 0x970 [0065.274] GetCurrentThreadId () returned 0x970 [0065.274] GetCurrentThreadId () returned 0x970 [0065.274] GetCurrentThreadId () returned 0x970 [0065.274] GetCurrentThreadId () returned 0x970 [0065.274] GetCurrentThreadId () returned 0x970 [0065.274] GetCurrentThreadId () returned 0x970 [0065.274] GetCurrentThreadId () returned 0x970 [0065.275] GetCurrentThreadId () returned 0x970 [0065.275] GetCurrentThreadId () returned 0x970 [0065.275] GetCurrentThreadId () returned 0x970 [0065.275] GetCurrentThreadId () returned 0x970 [0065.275] GetCurrentThreadId () returned 0x970 [0065.275] GetCurrentThreadId () returned 0x970 [0065.275] GetCurrentThreadId () returned 0x970 [0065.275] GetCurrentThreadId () returned 0x970 [0065.275] GetCurrentThreadId () returned 0x970 [0065.275] GetCurrentThreadId () returned 0x970 [0065.275] GetCurrentThreadId () returned 0x970 [0065.275] GetCurrentThreadId () returned 0x970 [0065.275] GetCurrentThreadId () returned 0x970 [0065.275] GetCurrentThreadId () returned 0x970 [0065.275] GetCurrentThreadId () returned 0x970 [0065.275] GetCurrentThreadId () returned 0x970 [0065.275] GetCurrentThreadId () returned 0x970 [0065.275] GetCurrentThreadId () returned 0x970 [0065.275] GetCurrentThreadId () returned 0x970 [0065.275] GetCurrentThreadId () returned 0x970 [0065.275] GetCurrentThreadId () returned 0x970 [0065.275] GetCurrentThreadId () returned 0x970 [0065.275] GetCurrentThreadId () returned 0x970 [0065.275] GetCurrentThreadId () returned 0x970 [0065.275] GetCurrentThreadId () returned 0x970 [0065.275] GetCurrentThreadId () returned 0x970 [0065.275] GetCurrentThreadId () returned 0x970 [0065.275] GetCurrentThreadId () returned 0x970 [0065.275] GetCurrentThreadId () returned 0x970 [0065.275] GetCurrentThreadId () returned 0x970 [0065.275] GetCurrentThreadId () returned 0x970 [0065.275] GetCurrentThreadId () returned 0x970 [0065.275] GetCurrentThreadId () returned 0x970 [0065.275] GetCurrentThreadId () returned 0x970 [0065.276] GetCurrentThreadId () returned 0x970 [0065.276] GetCurrentThreadId () returned 0x970 [0065.276] GetCurrentThreadId () returned 0x970 [0065.276] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.276] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.276] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379ba18, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.276] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.276] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.276] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379ba18, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.276] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.276] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.276] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.276] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.276] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.276] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.276] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.276] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.276] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379ba78, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.276] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.276] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.276] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379ba78, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.276] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.276] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.276] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379ba78, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.276] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xc, wMilliseconds=0x224)) [0065.277] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="\\:8$UNFb}h<:(\\$B/biN8Dm}F9?)Y#i~", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0065.277] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="\\:8$UNFb}h<:(\\$B/biN8Dm}F9?)Y#i~", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0065.277] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="\\:8$UNFb}h<:(\\$B/biN8Dm}F9?)Y#i~", cchWideChar=32, lpMultiByteStr=0x2003b98, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\\:8$UNFb}h<:(\\$B/biN8Dm}F9?)Y#i~", lpUsedDefaultChar=0x0) returned 32 [0065.277] GetCurrentThreadId () returned 0x970 [0065.277] GetCurrentThreadId () returned 0x970 [0065.277] GetCurrentThreadId () returned 0x970 [0065.277] GetCurrentThreadId () returned 0x970 [0065.277] GetCurrentThreadId () returned 0x970 [0065.277] GetCurrentThreadId () returned 0x970 [0065.287] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0065.288] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0065.288] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3798618, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0065.288] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb248, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0065.288] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb248, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAGMxUTAWwdZQrFerrMWts6+IfbJbwcfzOxw0Ym3d8+OVLo/0xY6uXw5nab3k0ySscsypn1O2v/2RwNNcu0PFm47AkFlW6ZKwxJZNT5faVLwWwydJACC66WO3GPwcB7aV69SnEcHVP2MXM822W0u5xDhDaoClYNUVlKZzaUasPgd5JiLPZKkdWN9MAvy/uybOdAwXSUSX8LJkmV35JpBbmHNwPfivCIr/bA==") returned 232 [0065.288] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xc, wMilliseconds=0x233)) [0065.288] GetCurrentThreadId () returned 0x970 [0065.288] GetCurrentThreadId () returned 0x970 [0065.288] GetCurrentThreadId () returned 0x970 [0065.288] GetCurrentThreadId () returned 0x970 [0065.288] GetCurrentThreadId () returned 0x970 [0065.288] GetCurrentThreadId () returned 0x970 [0065.288] GetCurrentThreadId () returned 0x970 [0065.288] GetCurrentThreadId () returned 0x970 [0065.288] GetCurrentThreadId () returned 0x970 [0065.288] GetCurrentThreadId () returned 0x970 [0065.288] GetCurrentThreadId () returned 0x970 [0065.288] GetCurrentThreadId () returned 0x970 [0065.288] GetCurrentThreadId () returned 0x970 [0065.288] GetCurrentThreadId () returned 0x970 [0065.288] GetCurrentThreadId () returned 0x970 [0065.288] GetCurrentThreadId () returned 0x970 [0065.288] GetCurrentThreadId () returned 0x970 [0065.288] GetCurrentThreadId () returned 0x970 [0065.288] GetCurrentThreadId () returned 0x970 [0065.288] GetCurrentThreadId () returned 0x970 [0065.288] GetCurrentThreadId () returned 0x970 [0065.288] GetCurrentThreadId () returned 0x970 [0065.288] GetCurrentThreadId () returned 0x970 [0065.288] GetCurrentThreadId () returned 0x970 [0065.288] GetCurrentThreadId () returned 0x970 [0065.288] GetCurrentThreadId () returned 0x970 [0065.288] GetCurrentThreadId () returned 0x970 [0065.289] GetCurrentThreadId () returned 0x970 [0065.289] GetCurrentThreadId () returned 0x970 [0065.289] GetCurrentThreadId () returned 0x970 [0065.289] GetCurrentThreadId () returned 0x970 [0065.289] GetCurrentThreadId () returned 0x970 [0065.289] GetCurrentThreadId () returned 0x970 [0065.289] GetCurrentThreadId () returned 0x970 [0065.289] GetCurrentThreadId () returned 0x970 [0065.289] GetCurrentThreadId () returned 0x970 [0065.289] GetCurrentThreadId () returned 0x970 [0065.289] GetCurrentThreadId () returned 0x970 [0065.289] GetCurrentThreadId () returned 0x970 [0065.289] GetCurrentThreadId () returned 0x970 [0065.289] GetCurrentThreadId () returned 0x970 [0065.289] GetCurrentThreadId () returned 0x970 [0065.289] GetCurrentThreadId () returned 0x970 [0065.289] GetCurrentThreadId () returned 0x970 [0065.289] GetCurrentThreadId () returned 0x970 [0065.289] GetCurrentThreadId () returned 0x970 [0065.289] GetCurrentThreadId () returned 0x970 [0065.289] GetCurrentThreadId () returned 0x970 [0065.289] GetCurrentThreadId () returned 0x970 [0065.289] GetCurrentThreadId () returned 0x970 [0065.289] GetCurrentThreadId () returned 0x970 [0065.289] GetCurrentThreadId () returned 0x970 [0065.289] GetCurrentThreadId () returned 0x970 [0065.289] GetCurrentThreadId () returned 0x970 [0065.289] GetCurrentThreadId () returned 0x970 [0065.289] GetCurrentThreadId () returned 0x970 [0065.289] GetCurrentThreadId () returned 0x970 [0065.289] GetCurrentThreadId () returned 0x970 [0065.289] GetCurrentThreadId () returned 0x970 [0065.289] GetCurrentThreadId () returned 0x970 [0065.289] GetCurrentThreadId () returned 0x970 [0065.289] GetCurrentThreadId () returned 0x970 [0065.290] GetCurrentThreadId () returned 0x970 [0065.290] GetCurrentThreadId () returned 0x970 [0065.290] GetCurrentThreadId () returned 0x970 [0065.290] GetCurrentThreadId () returned 0x970 [0065.290] GetCurrentThreadId () returned 0x970 [0065.290] GetCurrentThreadId () returned 0x970 [0065.290] GetCurrentThreadId () returned 0x970 [0065.290] GetCurrentThreadId () returned 0x970 [0065.290] GetCurrentThreadId () returned 0x970 [0065.290] GetCurrentThreadId () returned 0x970 [0065.290] GetCurrentThreadId () returned 0x970 [0065.290] GetCurrentThreadId () returned 0x970 [0065.290] GetCurrentThreadId () returned 0x970 [0065.290] GetCurrentThreadId () returned 0x970 [0065.290] GetCurrentThreadId () returned 0x970 [0065.290] GetCurrentThreadId () returned 0x970 [0065.290] GetCurrentThreadId () returned 0x970 [0065.290] GetCurrentThreadId () returned 0x970 [0065.290] GetCurrentThreadId () returned 0x970 [0065.290] GetCurrentThreadId () returned 0x970 [0065.290] GetCurrentThreadId () returned 0x970 [0065.290] GetCurrentThreadId () returned 0x970 [0065.290] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAGMxUTAWwdZQrFerrMWts6+IfbJbwcfzOxw0Ym3d8+OVLo/0xY6uXw5nab3k0ySscsypn1O2v/2RwNNcu0PFm47AkFlW6ZKwxJZNT5faVLwWwydJACC66WO3GPwcB7aV69SnEcHVP2MXM822W0u5xDhDaoClYNUVlKZzaUasPgd5JiLPZKkdWN9MAvy/uybOdAwXSUSX8LJkmV35JpBbmHNwPfivCIr/bA==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0065.290] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAGMxUTAWwdZQrFerrMWts6+IfbJbwcfzOxw0Ym3d8+OVLo/0xY6uXw5nab3k0ySscsypn1O2v/2RwNNcu0PFm47AkFlW6ZKwxJZNT5faVLwWwydJACC66WO3GPwcB7aV69SnEcHVP2MXM822W0u5xDhDaoClYNUVlKZzaUasPgd5JiLPZKkdWN9MAvy/uybOdAwXSUSX8LJkmV35JpBbmHNwPfivCIr/bA==", cchWideChar=245, lpMultiByteStr=0x353933c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAGMxUTAWwdZQrFerrMWts6+IfbJbwcfzOxw0Ym3d8+OVLo/0xY6uXw5nab3k0ySscsypn1O2v/2RwNNcu0PFm47AkFlW6ZKwxJZNT5faVLwWwydJACC66WO3GPwcB7aV69SnEcHVP2MXM822W0u5xDhDaoClYNUVlKZzaUasPgd5JiLPZKkdWN9MAvy/uybOdAwXSUSX8LJkmV35JpBbmHNwPfivCIr/bA==", lpUsedDefaultChar=0x0) returned 245 [0065.290] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0065.291] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0065.291] CloseHandle (hObject=0x158) returned 1 [0065.291] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\highlight.png")) returned 0 [0065.291] GetLastError () returned 0x5 [0065.291] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\highlight.png")) returned 0x20 [0065.291] SetLastError (dwErrCode=0x5) [0065.291] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=18555659756) returned 1 [0065.293] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Файл зашифрован [mainimage-mask.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\Файл зашифрован [mainimage-mask.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0065.294] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0065.294] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0065.294] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0065.294] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0065.294] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0065.294] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0065.294] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0065.294] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0065.295] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0065.295] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0065.295] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0065.295] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0065.295] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0065.295] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0065.295] SetEndOfFile (hFile=0x158) returned 1 [0065.295] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0065.295] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0065.295] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0065.295] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0065.295] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0065.297] WriteFile (in: hFile=0x158, lpBuffer=0x35f035c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f035c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0065.297] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=")/73T}prYx},n7H*QFC#BjZ,clWGY1NN", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0065.297] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=")/73T}prYx},n7H*QFC#BjZ,clWGY1NN", cchWideChar=32, lpMultiByteStr=0x203664c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=")/73T}prYx},n7H*QFC#BjZ,clWGY1NN", lpUsedDefaultChar=0x0) returned 32 [0065.297] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0065.297] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0065.297] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72aba1e5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72aba1e5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x239b, dwReserved0=0x0, dwReserved1=0x0, cFileName="mainimage-mask.png", cAlternateFileName="")) returned 0x295098 [0065.297] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0065.297] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0065.297] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\mainimage-mask.png")) returned 0x20 [0065.298] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\mainimage-mask.png")) returned 0x20 [0065.298] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\mainimage-mask.png")) returned 0x20 [0065.298] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\mainimage-mask.png")) returned 0x20 [0065.298] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\mainimage-mask.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72aba1e5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72aba1e5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x239b)) returned 1 [0065.298] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0065.298] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0065.298] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\mainimage-mask.png")) returned 0x20 [0065.298] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\mainimage-mask.png")) returned 0x20 [0065.298] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0065.298] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0065.298] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0065.298] SetEndOfFile (hFile=0x158) returned 1 [0065.299] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="mainimage-mask.png", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0065.300] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="mainimage-mask.png", cchWideChar=18, lpMultiByteStr=0x1ff899c, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mainimage-mask.png", lpUsedDefaultChar=0x0) returned 18 [0065.300] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="mainimage-mask.png", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0065.300] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="mainimage-mask.png", cchWideChar=18, lpMultiByteStr=0x1ff8a14, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mainimage-mask.png", lpUsedDefaultChar=0x0) returned 18 [0065.300] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff8a14, cbMultiByte=18, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="mainimage-mask.png.pnggngt.pngpngre.pngg") returned 18 [0065.300] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="mainimage-mask.png", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0065.300] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="mainimage-mask.png", cchWideChar=18, lpMultiByteStr=0x1ff899c, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mainimage-mask.png", lpUsedDefaultChar=0x0) returned 18 [0065.300] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\mainimage-mask.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0065.300] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0065.300] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x239b [0065.301] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0065.301] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0065.301] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0065.301] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="mainimage-mask.png", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0065.301] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="mainimage-mask.png", cchWideChar=18, lpMultiByteStr=0x1ff899c, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mainimage-mask.png", lpUsedDefaultChar=0x0) returned 18 [0065.301] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="mainimage-mask.png", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0065.301] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="mainimage-mask.png", cchWideChar=18, lpMultiByteStr=0x1ff8a14, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mainimage-mask.png", lpUsedDefaultChar=0x0) returned 18 [0065.301] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff8a14, cbMultiByte=18, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="mainimage-mask.pngsk.png.pnggngt.pngpngre.pngg") returned 18 [0065.301] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="mainimage-mask.png", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0065.301] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="mainimage-mask.png", cchWideChar=18, lpMultiByteStr=0x1ff899c, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mainimage-mask.png", lpUsedDefaultChar=0x0) returned 18 [0065.301] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0065.302] CharToOemA (in: pSrc="mainimage-mask.png", pDst=0x1ff8a14 | out: pDst="mainimage-mask.png") returned 1 [0065.302] WriteFile (in: hFile=0x158, lpBuffer=0x1ff8a14*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1ff8a14*, lpNumberOfBytesWritten=0x18e048*=0x12, lpOverlapped=0x0) returned 1 [0065.303] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0065.303] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0065.303] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0065.303] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=18556645420) returned 1 [0065.303] ReadFile (in: hFile=0x11c, lpBuffer=0x37c6700, nNumberOfBytesToRead=0x239b, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37c6700*, lpNumberOfBytesRead=0x18dd7c*=0x239b, lpOverlapped=0x0) returned 1 [0065.305] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0065.305] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=18556880425) returned 1 [0065.316] WriteFile (in: hFile=0x158, lpBuffer=0x379ae40*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379ae40*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0065.316] ReadFile (in: hFile=0x11c, lpBuffer=0x37c6700, nNumberOfBytesToRead=0x239b, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x37c6700*, lpNumberOfBytesRead=0x18de38*=0x239b, lpOverlapped=0x0) returned 1 [0065.317] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x4d [0065.317] WriteFile (in: hFile=0x158, lpBuffer=0x380a320*, nNumberOfBytesToWrite=0x239b, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x380a320*, lpNumberOfBytesWritten=0x18de10*=0x239b, lpOverlapped=0x0) returned 1 [0065.317] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x23e8 [0065.317] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0065.317] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0065.317] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0065.317] SetFilePointer (in: hFile=0x158, lDistanceToMove=18, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x30 [0065.318] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x23f2 [0065.318] CloseHandle (hObject=0x11c) returned 1 [0065.318] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x23f2 [0065.318] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x23f2 [0065.318] SetFilePointer (in: hFile=0x158, lDistanceToMove=9202, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x23f2 [0065.318] SetFilePointer (in: hFile=0x158, lDistanceToMove=9202, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x23f2 [0065.318] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x23f2 [0065.318] SetFilePointer (in: hFile=0x158, lDistanceToMove=9202, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x23f2 [0065.318] SetEndOfFile (hFile=0x158) returned 1 [0065.318] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x23f2 [0065.318] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x23f2 [0065.318] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="mainimage-mask.png", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0065.318] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="mainimage-mask.png", cchWideChar=18, lpMultiByteStr=0x1ff8a14, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mainimage-mask.png", lpUsedDefaultChar=0x0) returned 18 [0065.318] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="mainimage-mask.png", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0065.318] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="mainimage-mask.png", cchWideChar=18, lpMultiByteStr=0x1ff899c, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mainimage-mask.png", lpUsedDefaultChar=0x0) returned 18 [0065.318] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff899c, cbMultiByte=18, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="mainimage-mask.png믉`믑`") returned 18 [0065.319] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="mainimage-mask.png", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0065.319] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="mainimage-mask.png", cchWideChar=18, lpMultiByteStr=0x1ff8a14, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mainimage-mask.png", lpUsedDefaultChar=0x0) returned 18 [0065.319] WriteFile (in: hFile=0x158, lpBuffer=0x37aa1d8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x37aa1d8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0065.319] CharToOemA (in: pSrc="mainimage-mask.png", pDst=0x1ff899c | out: pDst="mainimage-mask.png") returned 1 [0065.319] WriteFile (in: hFile=0x158, lpBuffer=0x1ff899c*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1ff899c*, lpNumberOfBytesWritten=0x18efcc*=0x12, lpOverlapped=0x0) returned 1 [0065.319] WriteFile (in: hFile=0x158, lpBuffer=0x379ae18*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379ae18*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0065.319] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0065.319] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0065.319] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x243d [0065.319] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x243d [0065.319] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0065.319] WriteFile (in: hFile=0x158, lpBuffer=0x35f035c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f035c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0065.319] DeleteFileW (lpFileName="") returned 0 [0065.320] GetLastError () returned 0x3 [0065.320] GetFileAttributesW (lpFileName="") returned 0xffffffff [0065.320] SetLastError (dwErrCode=0x3) [0065.320] FlushFileBuffers (hFile=0x158) returned 1 [0065.323] GetCurrentThreadId () returned 0x970 [0065.323] GetCurrentThreadId () returned 0x970 [0065.323] GetCurrentThreadId () returned 0x970 [0065.323] GetCurrentThreadId () returned 0x970 [0065.323] GetCurrentThreadId () returned 0x970 [0065.323] GetCurrentThreadId () returned 0x970 [0065.323] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x24f4 [0065.323] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x24f4 [0065.323] SetFilePointer (in: hFile=0x158, lDistanceToMove=9460, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x24f4 [0065.323] CloseHandle (hObject=0x158) returned 1 [0065.323] GetCurrentThreadId () returned 0x970 [0065.323] GetCurrentThreadId () returned 0x970 [0065.323] GetCurrentThreadId () returned 0x970 [0065.323] GetCurrentThreadId () returned 0x970 [0065.323] GetCurrentThreadId () returned 0x970 [0065.323] GetCurrentThreadId () returned 0x970 [0065.323] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Файл зашифрован [mainimage-mask.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\Файл зашифрован [mainimage-mask.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0065.324] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x24f4 [0065.324] SetFilePointer (in: hFile=0x158, lDistanceToMove=9332, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2474 [0065.324] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0065.324] GetFileType (hFile=0x158) returned 0x1 [0065.324] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xc, wMilliseconds=0x252)) [0065.324] GetCurrentThreadId () returned 0x970 [0065.324] GetCurrentThreadId () returned 0x970 [0065.324] GetCurrentThreadId () returned 0x970 [0065.324] GetCurrentThreadId () returned 0x970 [0065.324] GetCurrentThreadId () returned 0x970 [0065.324] GetCurrentThreadId () returned 0x970 [0065.324] GetCurrentThreadId () returned 0x970 [0065.324] GetCurrentThreadId () returned 0x970 [0065.324] GetCurrentThreadId () returned 0x970 [0065.324] GetCurrentThreadId () returned 0x970 [0065.324] GetCurrentThreadId () returned 0x970 [0065.324] GetCurrentThreadId () returned 0x970 [0065.324] GetCurrentThreadId () returned 0x970 [0065.324] GetCurrentThreadId () returned 0x970 [0065.324] GetCurrentThreadId () returned 0x970 [0065.324] GetCurrentThreadId () returned 0x970 [0065.324] GetCurrentThreadId () returned 0x970 [0065.324] GetCurrentThreadId () returned 0x970 [0065.324] GetCurrentThreadId () returned 0x970 [0065.324] GetCurrentThreadId () returned 0x970 [0065.324] GetCurrentThreadId () returned 0x970 [0065.324] GetCurrentThreadId () returned 0x970 [0065.324] GetCurrentThreadId () returned 0x970 [0065.324] GetCurrentThreadId () returned 0x970 [0065.324] GetCurrentThreadId () returned 0x970 [0065.324] GetCurrentThreadId () returned 0x970 [0065.324] GetCurrentThreadId () returned 0x970 [0065.324] GetCurrentThreadId () returned 0x970 [0065.324] GetCurrentThreadId () returned 0x970 [0065.324] GetCurrentThreadId () returned 0x970 [0065.325] GetCurrentThreadId () returned 0x970 [0065.325] GetCurrentThreadId () returned 0x970 [0065.325] GetCurrentThreadId () returned 0x970 [0065.325] GetCurrentThreadId () returned 0x970 [0065.325] GetCurrentThreadId () returned 0x970 [0065.325] GetCurrentThreadId () returned 0x970 [0065.325] GetCurrentThreadId () returned 0x970 [0065.325] GetCurrentThreadId () returned 0x970 [0065.325] GetCurrentThreadId () returned 0x970 [0065.325] GetCurrentThreadId () returned 0x970 [0065.325] GetCurrentThreadId () returned 0x970 [0065.325] GetCurrentThreadId () returned 0x970 [0065.325] GetCurrentThreadId () returned 0x970 [0065.325] GetCurrentThreadId () returned 0x970 [0065.325] GetCurrentThreadId () returned 0x970 [0065.325] GetCurrentThreadId () returned 0x970 [0065.325] GetCurrentThreadId () returned 0x970 [0065.325] GetCurrentThreadId () returned 0x970 [0065.325] GetCurrentThreadId () returned 0x970 [0065.325] GetCurrentThreadId () returned 0x970 [0065.325] GetCurrentThreadId () returned 0x970 [0065.325] GetCurrentThreadId () returned 0x970 [0065.325] GetCurrentThreadId () returned 0x970 [0065.325] GetCurrentThreadId () returned 0x970 [0065.325] GetCurrentThreadId () returned 0x970 [0065.325] GetCurrentThreadId () returned 0x970 [0065.325] GetCurrentThreadId () returned 0x970 [0065.325] GetCurrentThreadId () returned 0x970 [0065.325] GetCurrentThreadId () returned 0x970 [0065.325] GetCurrentThreadId () returned 0x970 [0065.325] GetCurrentThreadId () returned 0x970 [0065.325] GetCurrentThreadId () returned 0x970 [0065.325] GetCurrentThreadId () returned 0x970 [0065.325] GetCurrentThreadId () returned 0x970 [0065.325] GetCurrentThreadId () returned 0x970 [0065.325] GetCurrentThreadId () returned 0x970 [0065.325] GetCurrentThreadId () returned 0x970 [0065.325] GetCurrentThreadId () returned 0x970 [0065.325] GetCurrentThreadId () returned 0x970 [0065.325] GetCurrentThreadId () returned 0x970 [0065.325] GetCurrentThreadId () returned 0x970 [0065.325] GetCurrentThreadId () returned 0x970 [0065.325] GetCurrentThreadId () returned 0x970 [0065.325] GetCurrentThreadId () returned 0x970 [0065.325] GetCurrentThreadId () returned 0x970 [0065.326] GetCurrentThreadId () returned 0x970 [0065.326] GetCurrentThreadId () returned 0x970 [0065.326] GetCurrentThreadId () returned 0x970 [0065.326] GetCurrentThreadId () returned 0x970 [0065.326] GetCurrentThreadId () returned 0x970 [0065.326] GetCurrentThreadId () returned 0x970 [0065.326] GetCurrentThreadId () returned 0x970 [0065.326] GetCurrentThreadId () returned 0x970 [0065.326] GetCurrentThreadId () returned 0x970 [0065.326] GetCurrentThreadId () returned 0x970 [0065.326] GetCurrentThreadId () returned 0x970 [0065.326] GetCurrentThreadId () returned 0x970 [0065.326] GetCurrentThreadId () returned 0x970 [0065.326] GetCurrentThreadId () returned 0x970 [0065.326] GetCurrentThreadId () returned 0x970 [0065.326] GetCurrentThreadId () returned 0x970 [0065.326] GetCurrentThreadId () returned 0x970 [0065.326] GetCurrentThreadId () returned 0x970 [0065.326] GetCurrentThreadId () returned 0x970 [0065.326] GetCurrentThreadId () returned 0x970 [0065.326] GetCurrentThreadId () returned 0x970 [0065.326] GetCurrentThreadId () returned 0x970 [0065.326] GetCurrentThreadId () returned 0x970 [0065.326] GetCurrentThreadId () returned 0x970 [0065.326] GetCurrentThreadId () returned 0x970 [0065.326] GetCurrentThreadId () returned 0x970 [0065.326] GetCurrentThreadId () returned 0x970 [0065.326] GetCurrentThreadId () returned 0x970 [0065.326] GetCurrentThreadId () returned 0x970 [0065.326] GetCurrentThreadId () returned 0x970 [0065.326] GetCurrentThreadId () returned 0x970 [0065.326] GetCurrentThreadId () returned 0x970 [0065.326] GetCurrentThreadId () returned 0x970 [0065.326] GetCurrentThreadId () returned 0x970 [0065.326] GetCurrentThreadId () returned 0x970 [0065.326] GetCurrentThreadId () returned 0x970 [0065.326] GetCurrentThreadId () returned 0x970 [0065.326] GetCurrentThreadId () returned 0x970 [0065.326] GetCurrentThreadId () returned 0x970 [0065.326] GetCurrentThreadId () returned 0x970 [0065.326] GetCurrentThreadId () returned 0x970 [0065.326] GetCurrentThreadId () returned 0x970 [0065.326] GetCurrentThreadId () returned 0x970 [0065.326] GetCurrentThreadId () returned 0x970 [0065.326] GetCurrentThreadId () returned 0x970 [0065.327] GetCurrentThreadId () returned 0x970 [0065.327] GetCurrentThreadId () returned 0x970 [0065.327] GetCurrentThreadId () returned 0x970 [0065.327] GetCurrentThreadId () returned 0x970 [0065.327] GetCurrentThreadId () returned 0x970 [0065.327] GetCurrentThreadId () returned 0x970 [0065.327] GetCurrentThreadId () returned 0x970 [0065.327] GetCurrentThreadId () returned 0x970 [0065.327] GetCurrentThreadId () returned 0x970 [0065.327] GetCurrentThreadId () returned 0x970 [0065.327] GetCurrentThreadId () returned 0x970 [0065.327] GetCurrentThreadId () returned 0x970 [0065.327] GetCurrentThreadId () returned 0x970 [0065.327] GetCurrentThreadId () returned 0x970 [0065.327] GetCurrentThreadId () returned 0x970 [0065.327] GetCurrentThreadId () returned 0x970 [0065.327] GetCurrentThreadId () returned 0x970 [0065.327] GetCurrentThreadId () returned 0x970 [0065.327] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.327] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.327] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379ba78, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.327] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.327] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.327] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379ba78, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.327] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.327] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.327] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.327] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.327] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.327] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.327] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.327] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.327] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379bad8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.327] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.327] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.327] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379bad8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.327] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.328] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.328] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379bad8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.328] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xc, wMilliseconds=0x252)) [0065.328] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr=")/73T}prYx},n7H*QFC#BjZ,clWGY1NN", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0065.328] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr=")/73T}prYx},n7H*QFC#BjZ,clWGY1NN", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0065.328] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr=")/73T}prYx},n7H*QFC#BjZ,clWGY1NN", cchWideChar=32, lpMultiByteStr=0x20039b8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=")/73T}prYx},n7H*QFC#BjZ,clWGY1NN", lpUsedDefaultChar=0x0) returned 32 [0065.328] GetCurrentThreadId () returned 0x970 [0065.328] GetCurrentThreadId () returned 0x970 [0065.328] GetCurrentThreadId () returned 0x970 [0065.328] GetCurrentThreadId () returned 0x970 [0065.328] GetCurrentThreadId () returned 0x970 [0065.328] GetCurrentThreadId () returned 0x970 [0065.335] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0065.335] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0065.335] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3798708, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0065.335] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb248, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0065.335] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb248, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAEMDRi2c9UPg6qQJeaExkhiMJP7A+p/3M96S8JdLOGvmQ6Dw0gcEB+nkSZeiQVGz4Isu8lC3lWN1o1CE89dKX6wqPcvMKOOsPq2s/rtm0Z9oOggmuMDFWHxoynmBiI2Pqkf6RZRUQM9pngUZAwYpxuiXCNaMi5n3zlvBVPu0WN4MICO64hPfkbKg23/GVC3XvKvxFFiAKPmxe8h4Gj0Kg6Y/p21nAB9IUg==") returned 232 [0065.335] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xc, wMilliseconds=0x262)) [0065.336] GetCurrentThreadId () returned 0x970 [0065.336] GetCurrentThreadId () returned 0x970 [0065.336] GetCurrentThreadId () returned 0x970 [0065.336] GetCurrentThreadId () returned 0x970 [0065.336] GetCurrentThreadId () returned 0x970 [0065.336] GetCurrentThreadId () returned 0x970 [0065.336] GetCurrentThreadId () returned 0x970 [0065.336] GetCurrentThreadId () returned 0x970 [0065.336] GetCurrentThreadId () returned 0x970 [0065.336] GetCurrentThreadId () returned 0x970 [0065.336] GetCurrentThreadId () returned 0x970 [0065.336] GetCurrentThreadId () returned 0x970 [0065.336] GetCurrentThreadId () returned 0x970 [0065.336] GetCurrentThreadId () returned 0x970 [0065.336] GetCurrentThreadId () returned 0x970 [0065.336] GetCurrentThreadId () returned 0x970 [0065.336] GetCurrentThreadId () returned 0x970 [0065.336] GetCurrentThreadId () returned 0x970 [0065.336] GetCurrentThreadId () returned 0x970 [0065.336] GetCurrentThreadId () returned 0x970 [0065.336] GetCurrentThreadId () returned 0x970 [0065.336] GetCurrentThreadId () returned 0x970 [0065.336] GetCurrentThreadId () returned 0x970 [0065.336] GetCurrentThreadId () returned 0x970 [0065.336] GetCurrentThreadId () returned 0x970 [0065.336] GetCurrentThreadId () returned 0x970 [0065.336] GetCurrentThreadId () returned 0x970 [0065.336] GetCurrentThreadId () returned 0x970 [0065.336] GetCurrentThreadId () returned 0x970 [0065.336] GetCurrentThreadId () returned 0x970 [0065.336] GetCurrentThreadId () returned 0x970 [0065.336] GetCurrentThreadId () returned 0x970 [0065.336] GetCurrentThreadId () returned 0x970 [0065.336] GetCurrentThreadId () returned 0x970 [0065.336] GetCurrentThreadId () returned 0x970 [0065.336] GetCurrentThreadId () returned 0x970 [0065.336] GetCurrentThreadId () returned 0x970 [0065.336] GetCurrentThreadId () returned 0x970 [0065.336] GetCurrentThreadId () returned 0x970 [0065.336] GetCurrentThreadId () returned 0x970 [0065.336] GetCurrentThreadId () returned 0x970 [0065.336] GetCurrentThreadId () returned 0x970 [0065.336] GetCurrentThreadId () returned 0x970 [0065.336] GetCurrentThreadId () returned 0x970 [0065.336] GetCurrentThreadId () returned 0x970 [0065.337] GetCurrentThreadId () returned 0x970 [0065.337] GetCurrentThreadId () returned 0x970 [0065.337] GetCurrentThreadId () returned 0x970 [0065.337] GetCurrentThreadId () returned 0x970 [0065.337] GetCurrentThreadId () returned 0x970 [0065.337] GetCurrentThreadId () returned 0x970 [0065.337] GetCurrentThreadId () returned 0x970 [0065.337] GetCurrentThreadId () returned 0x970 [0065.337] GetCurrentThreadId () returned 0x970 [0065.337] GetCurrentThreadId () returned 0x970 [0065.337] GetCurrentThreadId () returned 0x970 [0065.337] GetCurrentThreadId () returned 0x970 [0065.337] GetCurrentThreadId () returned 0x970 [0065.337] GetCurrentThreadId () returned 0x970 [0065.337] GetCurrentThreadId () returned 0x970 [0065.337] GetCurrentThreadId () returned 0x970 [0065.337] GetCurrentThreadId () returned 0x970 [0065.337] GetCurrentThreadId () returned 0x970 [0065.337] GetCurrentThreadId () returned 0x970 [0065.337] GetCurrentThreadId () returned 0x970 [0065.337] GetCurrentThreadId () returned 0x970 [0065.337] GetCurrentThreadId () returned 0x970 [0065.337] GetCurrentThreadId () returned 0x970 [0065.337] GetCurrentThreadId () returned 0x970 [0065.337] GetCurrentThreadId () returned 0x970 [0065.337] GetCurrentThreadId () returned 0x970 [0065.337] GetCurrentThreadId () returned 0x970 [0065.337] GetCurrentThreadId () returned 0x970 [0065.337] GetCurrentThreadId () returned 0x970 [0065.337] GetCurrentThreadId () returned 0x970 [0065.337] GetCurrentThreadId () returned 0x970 [0065.337] GetCurrentThreadId () returned 0x970 [0065.337] GetCurrentThreadId () returned 0x970 [0065.337] GetCurrentThreadId () returned 0x970 [0065.337] GetCurrentThreadId () returned 0x970 [0065.337] GetCurrentThreadId () returned 0x970 [0065.337] GetCurrentThreadId () returned 0x970 [0065.337] GetCurrentThreadId () returned 0x970 [0065.337] GetCurrentThreadId () returned 0x970 [0065.337] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAEMDRi2c9UPg6qQJeaExkhiMJP7A+p/3M96S8JdLOGvmQ6Dw0gcEB+nkSZeiQVGz4Isu8lC3lWN1o1CE89dKX6wqPcvMKOOsPq2s/rtm0Z9oOggmuMDFWHxoynmBiI2Pqkf6RZRUQM9pngUZAwYpxuiXCNaMi5n3zlvBVPu0WN4MICO64hPfkbKg23/GVC3XvKvxFFiAKPmxe8h4Gj0Kg6Y/p21nAB9IUg==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0065.337] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAEMDRi2c9UPg6qQJeaExkhiMJP7A+p/3M96S8JdLOGvmQ6Dw0gcEB+nkSZeiQVGz4Isu8lC3lWN1o1CE89dKX6wqPcvMKOOsPq2s/rtm0Z9oOggmuMDFWHxoynmBiI2Pqkf6RZRUQM9pngUZAwYpxuiXCNaMi5n3zlvBVPu0WN4MICO64hPfkbKg23/GVC3XvKvxFFiAKPmxe8h4Gj0Kg6Y/p21nAB9IUg==", cchWideChar=245, lpMultiByteStr=0x353933c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAEMDRi2c9UPg6qQJeaExkhiMJP7A+p/3M96S8JdLOGvmQ6Dw0gcEB+nkSZeiQVGz4Isu8lC3lWN1o1CE89dKX6wqPcvMKOOsPq2s/rtm0Z9oOggmuMDFWHxoynmBiI2Pqkf6RZRUQM9pngUZAwYpxuiXCNaMi5n3zlvBVPu0WN4MICO64hPfkbKg23/GVC3XvKvxFFiAKPmxe8h4Gj0Kg6Y/p21nAB9IUg==", lpUsedDefaultChar=0x0) returned 245 [0065.337] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0065.338] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0065.338] CloseHandle (hObject=0x158) returned 1 [0065.338] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\mainimage-mask.png")) returned 0 [0065.338] GetLastError () returned 0x5 [0065.338] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\mainimage-mask.png")) returned 0x20 [0065.338] SetLastError (dwErrCode=0x5) [0065.338] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=18560152187) returned 1 [0065.338] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Файл зашифрован [notes-static.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\Файл зашифрован [notes-static.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0065.340] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0065.340] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0065.340] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0065.340] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0065.340] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0065.340] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0065.340] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0065.340] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0065.340] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0065.340] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0065.340] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0065.340] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0065.340] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0065.340] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0065.340] SetEndOfFile (hFile=0x158) returned 1 [0065.341] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0065.341] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0065.341] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0065.341] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0065.341] WriteFile (in: hFile=0x158, lpBuffer=0x3777058*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777058*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0065.342] WriteFile (in: hFile=0x158, lpBuffer=0x35f04dc*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f04dc*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0065.342] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Fr{B-NsQiwpBTVbkEu{K2!:NXH<@FhZx", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0065.342] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Fr{B-NsQiwpBTVbkEu{K2!:NXH<@FhZx", cchWideChar=32, lpMultiByteStr=0x2036614, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Fr{B-NsQiwpBTVbkEu{K2!:NXH<@FhZx", lpUsedDefaultChar=0x0) returned 32 [0065.342] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0065.342] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0065.342] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72ae0342, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72ae0342, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x559, dwReserved0=0x0, dwReserved1=0x0, cFileName="notes-static.png", cAlternateFileName="")) returned 0x295098 [0065.342] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0065.342] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0065.342] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\notes-static.png")) returned 0x20 [0065.343] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\notes-static.png")) returned 0x20 [0065.343] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\notes-static.png")) returned 0x20 [0065.343] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\notes-static.png")) returned 0x20 [0065.343] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\notes-static.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72ae0342, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72ae0342, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x559)) returned 1 [0065.343] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0065.343] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0065.343] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\notes-static.png")) returned 0x20 [0065.343] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\notes-static.png")) returned 0x20 [0065.343] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0065.343] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0065.344] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0065.344] SetEndOfFile (hFile=0x158) returned 1 [0065.344] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="notes-static.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0065.345] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="notes-static.png", cchWideChar=16, lpMultiByteStr=0x1ff89c4, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="notes-static.png", lpUsedDefaultChar=0x0) returned 16 [0065.345] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="notes-static.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0065.345] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="notes-static.png", cchWideChar=16, lpMultiByteStr=0x1ff89ec, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="notes-static.png", lpUsedDefaultChar=0x0) returned 16 [0065.345] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff89ec, cbMultiByte=16, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="notes-static.pngng.pnggngt.pngpngre.pngg") returned 16 [0065.345] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="notes-static.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0065.345] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="notes-static.png", cchWideChar=16, lpMultiByteStr=0x1ff89c4, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="notes-static.png", lpUsedDefaultChar=0x0) returned 16 [0065.345] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\notes-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0065.345] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0065.345] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x559 [0065.345] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0065.345] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0065.345] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0065.345] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="notes-static.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0065.345] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="notes-static.png", cchWideChar=16, lpMultiByteStr=0x1ff89c4, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="notes-static.png", lpUsedDefaultChar=0x0) returned 16 [0065.345] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="notes-static.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0065.346] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="notes-static.png", cchWideChar=16, lpMultiByteStr=0x1ff89ec, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="notes-static.png", lpUsedDefaultChar=0x0) returned 16 [0065.346] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff89ec, cbMultiByte=16, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="notes-static.pngic.pngng.pnggngt.pngpngre.pngg") returned 16 [0065.346] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="notes-static.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0065.346] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="notes-static.png", cchWideChar=16, lpMultiByteStr=0x1ff89c4, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="notes-static.png", lpUsedDefaultChar=0x0) returned 16 [0065.346] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0065.347] CharToOemA (in: pSrc="notes-static.png", pDst=0x1ff89ec | out: pDst="notes-static.png") returned 1 [0065.347] WriteFile (in: hFile=0x158, lpBuffer=0x1ff89ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1ff89ec*, lpNumberOfBytesWritten=0x18e048*=0x10, lpOverlapped=0x0) returned 1 [0065.347] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0065.347] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0065.347] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0065.347] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=18561049831) returned 1 [0065.347] ReadFile (in: hFile=0x11c, lpBuffer=0x37c6720, nNumberOfBytesToRead=0x559, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37c6720*, lpNumberOfBytesRead=0x18dd7c*=0x559, lpOverlapped=0x0) returned 1 [0065.349] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0065.349] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=18561233807) returned 1 [0065.358] WriteFile (in: hFile=0x158, lpBuffer=0x379ad98*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379ad98*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0065.358] ReadFile (in: hFile=0x11c, lpBuffer=0x37c6720, nNumberOfBytesToRead=0x559, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x37c6720*, lpNumberOfBytesRead=0x18de38*=0x559, lpOverlapped=0x0) returned 1 [0065.358] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x4b [0065.358] WriteFile (in: hFile=0x158, lpBuffer=0x37c6c80*, nNumberOfBytesToWrite=0x559, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x37c6c80*, lpNumberOfBytesWritten=0x18de10*=0x559, lpOverlapped=0x0) returned 1 [0065.358] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x5a4 [0065.358] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0065.358] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0065.358] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0065.358] SetFilePointer (in: hFile=0x158, lDistanceToMove=16, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2e [0065.358] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x5ae [0065.358] CloseHandle (hObject=0x11c) returned 1 [0065.359] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x5ae [0065.359] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x5ae [0065.359] SetFilePointer (in: hFile=0x158, lDistanceToMove=1454, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x5ae [0065.359] SetFilePointer (in: hFile=0x158, lDistanceToMove=1454, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x5ae [0065.359] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x5ae [0065.359] SetFilePointer (in: hFile=0x158, lDistanceToMove=1454, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x5ae [0065.359] SetEndOfFile (hFile=0x158) returned 1 [0065.359] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x5ae [0065.359] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x5ae [0065.359] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="notes-static.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0065.359] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="notes-static.png", cchWideChar=16, lpMultiByteStr=0x1ff89ec, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="notes-static.png", lpUsedDefaultChar=0x0) returned 16 [0065.359] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="notes-static.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0065.359] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="notes-static.png", cchWideChar=16, lpMultiByteStr=0x1ff89c4, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="notes-static.png", lpUsedDefaultChar=0x0) returned 16 [0065.359] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff89c4, cbMultiByte=16, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="notes-static.png\x18믉`믑`") returned 16 [0065.359] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="notes-static.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0065.359] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="notes-static.png", cchWideChar=16, lpMultiByteStr=0x1ff89ec, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="notes-static.png", lpUsedDefaultChar=0x0) returned 16 [0065.360] WriteFile (in: hFile=0x158, lpBuffer=0x37aa1d8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x37aa1d8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0065.360] CharToOemA (in: pSrc="notes-static.png", pDst=0x1ff89c4 | out: pDst="notes-static.png") returned 1 [0065.360] WriteFile (in: hFile=0x158, lpBuffer=0x1ff89c4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1ff89c4*, lpNumberOfBytesWritten=0x18efcc*=0x10, lpOverlapped=0x0) returned 1 [0065.360] WriteFile (in: hFile=0x158, lpBuffer=0x379acf8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379acf8*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0065.360] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0065.360] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0065.360] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x5f7 [0065.360] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x5f7 [0065.360] WriteFile (in: hFile=0x158, lpBuffer=0x3777058*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777058*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0065.360] WriteFile (in: hFile=0x158, lpBuffer=0x35f04dc*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f04dc*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0065.360] DeleteFileW (lpFileName="") returned 0 [0065.360] GetLastError () returned 0x3 [0065.360] GetFileAttributesW (lpFileName="") returned 0xffffffff [0065.360] SetLastError (dwErrCode=0x3) [0065.360] FlushFileBuffers (hFile=0x158) returned 1 [0065.363] GetCurrentThreadId () returned 0x970 [0065.363] GetCurrentThreadId () returned 0x970 [0065.363] GetCurrentThreadId () returned 0x970 [0065.363] GetCurrentThreadId () returned 0x970 [0065.363] GetCurrentThreadId () returned 0x970 [0065.363] GetCurrentThreadId () returned 0x970 [0065.363] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x6ae [0065.363] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x6ae [0065.363] SetFilePointer (in: hFile=0x158, lDistanceToMove=1710, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x6ae [0065.363] CloseHandle (hObject=0x158) returned 1 [0065.363] GetCurrentThreadId () returned 0x970 [0065.364] GetCurrentThreadId () returned 0x970 [0065.364] GetCurrentThreadId () returned 0x970 [0065.364] GetCurrentThreadId () returned 0x970 [0065.364] GetCurrentThreadId () returned 0x970 [0065.364] GetCurrentThreadId () returned 0x970 [0065.364] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Файл зашифрован [notes-static.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\Файл зашифрован [notes-static.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0065.364] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6ae [0065.364] SetFilePointer (in: hFile=0x158, lDistanceToMove=1582, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x62e [0065.364] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0065.364] GetFileType (hFile=0x158) returned 0x1 [0065.364] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xc, wMilliseconds=0x281)) [0065.364] GetCurrentThreadId () returned 0x970 [0065.364] GetCurrentThreadId () returned 0x970 [0065.364] GetCurrentThreadId () returned 0x970 [0065.364] GetCurrentThreadId () returned 0x970 [0065.364] GetCurrentThreadId () returned 0x970 [0065.364] GetCurrentThreadId () returned 0x970 [0065.364] GetCurrentThreadId () returned 0x970 [0065.364] GetCurrentThreadId () returned 0x970 [0065.364] GetCurrentThreadId () returned 0x970 [0065.364] GetCurrentThreadId () returned 0x970 [0065.364] GetCurrentThreadId () returned 0x970 [0065.364] GetCurrentThreadId () returned 0x970 [0065.364] GetCurrentThreadId () returned 0x970 [0065.364] GetCurrentThreadId () returned 0x970 [0065.364] GetCurrentThreadId () returned 0x970 [0065.364] GetCurrentThreadId () returned 0x970 [0065.364] GetCurrentThreadId () returned 0x970 [0065.364] GetCurrentThreadId () returned 0x970 [0065.364] GetCurrentThreadId () returned 0x970 [0065.364] GetCurrentThreadId () returned 0x970 [0065.364] GetCurrentThreadId () returned 0x970 [0065.365] GetCurrentThreadId () returned 0x970 [0065.365] GetCurrentThreadId () returned 0x970 [0065.365] GetCurrentThreadId () returned 0x970 [0065.365] GetCurrentThreadId () returned 0x970 [0065.365] GetCurrentThreadId () returned 0x970 [0065.365] GetCurrentThreadId () returned 0x970 [0065.365] GetCurrentThreadId () returned 0x970 [0065.365] GetCurrentThreadId () returned 0x970 [0065.365] GetCurrentThreadId () returned 0x970 [0065.365] GetCurrentThreadId () returned 0x970 [0065.365] GetCurrentThreadId () returned 0x970 [0065.365] GetCurrentThreadId () returned 0x970 [0065.365] GetCurrentThreadId () returned 0x970 [0065.365] GetCurrentThreadId () returned 0x970 [0065.365] GetCurrentThreadId () returned 0x970 [0065.365] GetCurrentThreadId () returned 0x970 [0065.365] GetCurrentThreadId () returned 0x970 [0065.365] GetCurrentThreadId () returned 0x970 [0065.365] GetCurrentThreadId () returned 0x970 [0065.365] GetCurrentThreadId () returned 0x970 [0065.365] GetCurrentThreadId () returned 0x970 [0065.365] GetCurrentThreadId () returned 0x970 [0065.365] GetCurrentThreadId () returned 0x970 [0065.365] GetCurrentThreadId () returned 0x970 [0065.365] GetCurrentThreadId () returned 0x970 [0065.365] GetCurrentThreadId () returned 0x970 [0065.365] GetCurrentThreadId () returned 0x970 [0065.365] GetCurrentThreadId () returned 0x970 [0065.365] GetCurrentThreadId () returned 0x970 [0065.365] GetCurrentThreadId () returned 0x970 [0065.365] GetCurrentThreadId () returned 0x970 [0065.365] GetCurrentThreadId () returned 0x970 [0065.365] GetCurrentThreadId () returned 0x970 [0065.365] GetCurrentThreadId () returned 0x970 [0065.365] GetCurrentThreadId () returned 0x970 [0065.365] GetCurrentThreadId () returned 0x970 [0065.365] GetCurrentThreadId () returned 0x970 [0065.365] GetCurrentThreadId () returned 0x970 [0065.365] GetCurrentThreadId () returned 0x970 [0065.365] GetCurrentThreadId () returned 0x970 [0065.365] GetCurrentThreadId () returned 0x970 [0065.365] GetCurrentThreadId () returned 0x970 [0065.365] GetCurrentThreadId () returned 0x970 [0065.365] GetCurrentThreadId () returned 0x970 [0065.365] GetCurrentThreadId () returned 0x970 [0065.366] GetCurrentThreadId () returned 0x970 [0065.366] GetCurrentThreadId () returned 0x970 [0065.366] GetCurrentThreadId () returned 0x970 [0065.366] GetCurrentThreadId () returned 0x970 [0065.366] GetCurrentThreadId () returned 0x970 [0065.366] GetCurrentThreadId () returned 0x970 [0065.366] GetCurrentThreadId () returned 0x970 [0065.366] GetCurrentThreadId () returned 0x970 [0065.366] GetCurrentThreadId () returned 0x970 [0065.366] GetCurrentThreadId () returned 0x970 [0065.366] GetCurrentThreadId () returned 0x970 [0065.366] GetCurrentThreadId () returned 0x970 [0065.366] GetCurrentThreadId () returned 0x970 [0065.366] GetCurrentThreadId () returned 0x970 [0065.366] GetCurrentThreadId () returned 0x970 [0065.366] GetCurrentThreadId () returned 0x970 [0065.366] GetCurrentThreadId () returned 0x970 [0065.366] GetCurrentThreadId () returned 0x970 [0065.366] GetCurrentThreadId () returned 0x970 [0065.366] GetCurrentThreadId () returned 0x970 [0065.366] GetCurrentThreadId () returned 0x970 [0065.366] GetCurrentThreadId () returned 0x970 [0065.366] GetCurrentThreadId () returned 0x970 [0065.366] GetCurrentThreadId () returned 0x970 [0065.366] GetCurrentThreadId () returned 0x970 [0065.366] GetCurrentThreadId () returned 0x970 [0065.366] GetCurrentThreadId () returned 0x970 [0065.366] GetCurrentThreadId () returned 0x970 [0065.366] GetCurrentThreadId () returned 0x970 [0065.366] GetCurrentThreadId () returned 0x970 [0065.366] GetCurrentThreadId () returned 0x970 [0065.366] GetCurrentThreadId () returned 0x970 [0065.366] GetCurrentThreadId () returned 0x970 [0065.366] GetCurrentThreadId () returned 0x970 [0065.366] GetCurrentThreadId () returned 0x970 [0065.366] GetCurrentThreadId () returned 0x970 [0065.366] GetCurrentThreadId () returned 0x970 [0065.366] GetCurrentThreadId () returned 0x970 [0065.366] GetCurrentThreadId () returned 0x970 [0065.366] GetCurrentThreadId () returned 0x970 [0065.366] GetCurrentThreadId () returned 0x970 [0065.366] GetCurrentThreadId () returned 0x970 [0065.366] GetCurrentThreadId () returned 0x970 [0065.366] GetCurrentThreadId () returned 0x970 [0065.366] GetCurrentThreadId () returned 0x970 [0065.366] GetCurrentThreadId () returned 0x970 [0065.367] GetCurrentThreadId () returned 0x970 [0065.367] GetCurrentThreadId () returned 0x970 [0065.367] GetCurrentThreadId () returned 0x970 [0065.367] GetCurrentThreadId () returned 0x970 [0065.367] GetCurrentThreadId () returned 0x970 [0065.367] GetCurrentThreadId () returned 0x970 [0065.367] GetCurrentThreadId () returned 0x970 [0065.367] GetCurrentThreadId () returned 0x970 [0065.367] GetCurrentThreadId () returned 0x970 [0065.367] GetCurrentThreadId () returned 0x970 [0065.367] GetCurrentThreadId () returned 0x970 [0065.367] GetCurrentThreadId () returned 0x970 [0065.367] GetCurrentThreadId () returned 0x970 [0065.367] GetCurrentThreadId () returned 0x970 [0065.367] GetCurrentThreadId () returned 0x970 [0065.367] GetCurrentThreadId () returned 0x970 [0065.367] GetCurrentThreadId () returned 0x970 [0065.367] GetCurrentThreadId () returned 0x970 [0065.367] GetCurrentThreadId () returned 0x970 [0065.367] GetCurrentThreadId () returned 0x970 [0065.367] GetCurrentThreadId () returned 0x970 [0065.367] GetCurrentThreadId () returned 0x970 [0065.367] GetCurrentThreadId () returned 0x970 [0065.367] GetCurrentThreadId () returned 0x970 [0065.367] GetCurrentThreadId () returned 0x970 [0065.367] GetCurrentThreadId () returned 0x970 [0065.367] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.367] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.367] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379bad8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.367] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.367] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.367] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379bad8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.367] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.367] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.367] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.367] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.367] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.367] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.367] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.367] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.368] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379bb38, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.368] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.368] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.368] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379bb38, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.368] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.368] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.368] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379bb38, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.368] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xc, wMilliseconds=0x281)) [0065.368] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Fr{B-NsQiwpBTVbkEu{K2!:NXH<@FhZx", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0065.368] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Fr{B-NsQiwpBTVbkEu{K2!:NXH<@FhZx", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0065.368] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Fr{B-NsQiwpBTVbkEu{K2!:NXH<@FhZx", cchWideChar=32, lpMultiByteStr=0x2003b98, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Fr{B-NsQiwpBTVbkEu{K2!:NXH<@FhZx", lpUsedDefaultChar=0x0) returned 32 [0065.368] GetCurrentThreadId () returned 0x970 [0065.368] GetCurrentThreadId () returned 0x970 [0065.368] GetCurrentThreadId () returned 0x970 [0065.368] GetCurrentThreadId () returned 0x970 [0065.368] GetCurrentThreadId () returned 0x970 [0065.368] GetCurrentThreadId () returned 0x970 [0065.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0065.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0065.376] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x37987f8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0065.376] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb248, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0065.376] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb248, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAHdSgV6rjPuxw5zHr4K/PlyR3RqrI+N4s7HE5Guc7XrzJ+HpU9+ViEgB4Y+O1E9+T5FkA9AM6sIExJwjUMaPz5XktGg9agCATYeFKMy02TWcMNkK7tFYijkSvPClHu7K5YCnLtN/T1wuMMoVSuOhuNUyOJX6JG05TDF5YKEVwkOgvOfW8vgb7FklBif+GJSDN0IJBcXlS9NQjLMCB2TtE1CgUWALlul78w==") returned 232 [0065.376] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xc, wMilliseconds=0x281)) [0065.376] GetCurrentThreadId () returned 0x970 [0065.376] GetCurrentThreadId () returned 0x970 [0065.376] GetCurrentThreadId () returned 0x970 [0065.376] GetCurrentThreadId () returned 0x970 [0065.376] GetCurrentThreadId () returned 0x970 [0065.376] GetCurrentThreadId () returned 0x970 [0065.376] GetCurrentThreadId () returned 0x970 [0065.376] GetCurrentThreadId () returned 0x970 [0065.376] GetCurrentThreadId () returned 0x970 [0065.376] GetCurrentThreadId () returned 0x970 [0065.376] GetCurrentThreadId () returned 0x970 [0065.376] GetCurrentThreadId () returned 0x970 [0065.376] GetCurrentThreadId () returned 0x970 [0065.376] GetCurrentThreadId () returned 0x970 [0065.376] GetCurrentThreadId () returned 0x970 [0065.376] GetCurrentThreadId () returned 0x970 [0065.376] GetCurrentThreadId () returned 0x970 [0065.376] GetCurrentThreadId () returned 0x970 [0065.376] GetCurrentThreadId () returned 0x970 [0065.376] GetCurrentThreadId () returned 0x970 [0065.376] GetCurrentThreadId () returned 0x970 [0065.376] GetCurrentThreadId () returned 0x970 [0065.376] GetCurrentThreadId () returned 0x970 [0065.376] GetCurrentThreadId () returned 0x970 [0065.376] GetCurrentThreadId () returned 0x970 [0065.376] GetCurrentThreadId () returned 0x970 [0065.376] GetCurrentThreadId () returned 0x970 [0065.376] GetCurrentThreadId () returned 0x970 [0065.376] GetCurrentThreadId () returned 0x970 [0065.376] GetCurrentThreadId () returned 0x970 [0065.376] GetCurrentThreadId () returned 0x970 [0065.376] GetCurrentThreadId () returned 0x970 [0065.376] GetCurrentThreadId () returned 0x970 [0065.376] GetCurrentThreadId () returned 0x970 [0065.376] GetCurrentThreadId () returned 0x970 [0065.376] GetCurrentThreadId () returned 0x970 [0065.376] GetCurrentThreadId () returned 0x970 [0065.376] GetCurrentThreadId () returned 0x970 [0065.376] GetCurrentThreadId () returned 0x970 [0065.376] GetCurrentThreadId () returned 0x970 [0065.377] GetCurrentThreadId () returned 0x970 [0065.377] GetCurrentThreadId () returned 0x970 [0065.377] GetCurrentThreadId () returned 0x970 [0065.377] GetCurrentThreadId () returned 0x970 [0065.377] GetCurrentThreadId () returned 0x970 [0065.377] GetCurrentThreadId () returned 0x970 [0065.377] GetCurrentThreadId () returned 0x970 [0065.377] GetCurrentThreadId () returned 0x970 [0065.377] GetCurrentThreadId () returned 0x970 [0065.377] GetCurrentThreadId () returned 0x970 [0065.377] GetCurrentThreadId () returned 0x970 [0065.377] GetCurrentThreadId () returned 0x970 [0065.377] GetCurrentThreadId () returned 0x970 [0065.377] GetCurrentThreadId () returned 0x970 [0065.377] GetCurrentThreadId () returned 0x970 [0065.377] GetCurrentThreadId () returned 0x970 [0065.377] GetCurrentThreadId () returned 0x970 [0065.377] GetCurrentThreadId () returned 0x970 [0065.377] GetCurrentThreadId () returned 0x970 [0065.377] GetCurrentThreadId () returned 0x970 [0065.377] GetCurrentThreadId () returned 0x970 [0065.377] GetCurrentThreadId () returned 0x970 [0065.377] GetCurrentThreadId () returned 0x970 [0065.377] GetCurrentThreadId () returned 0x970 [0065.377] GetCurrentThreadId () returned 0x970 [0065.377] GetCurrentThreadId () returned 0x970 [0065.377] GetCurrentThreadId () returned 0x970 [0065.377] GetCurrentThreadId () returned 0x970 [0065.377] GetCurrentThreadId () returned 0x970 [0065.377] GetCurrentThreadId () returned 0x970 [0065.377] GetCurrentThreadId () returned 0x970 [0065.377] GetCurrentThreadId () returned 0x970 [0065.377] GetCurrentThreadId () returned 0x970 [0065.377] GetCurrentThreadId () returned 0x970 [0065.377] GetCurrentThreadId () returned 0x970 [0065.377] GetCurrentThreadId () returned 0x970 [0065.377] GetCurrentThreadId () returned 0x970 [0065.377] GetCurrentThreadId () returned 0x970 [0065.377] GetCurrentThreadId () returned 0x970 [0065.377] GetCurrentThreadId () returned 0x970 [0065.377] GetCurrentThreadId () returned 0x970 [0065.377] GetCurrentThreadId () returned 0x970 [0065.378] GetCurrentThreadId () returned 0x970 [0065.378] GetCurrentThreadId () returned 0x970 [0065.378] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAHdSgV6rjPuxw5zHr4K/PlyR3RqrI+N4s7HE5Guc7XrzJ+HpU9+ViEgB4Y+O1E9+T5FkA9AM6sIExJwjUMaPz5XktGg9agCATYeFKMy02TWcMNkK7tFYijkSvPClHu7K5YCnLtN/T1wuMMoVSuOhuNUyOJX6JG05TDF5YKEVwkOgvOfW8vgb7FklBif+GJSDN0IJBcXlS9NQjLMCB2TtE1CgUWALlul78w==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0065.378] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAHdSgV6rjPuxw5zHr4K/PlyR3RqrI+N4s7HE5Guc7XrzJ+HpU9+ViEgB4Y+O1E9+T5FkA9AM6sIExJwjUMaPz5XktGg9agCATYeFKMy02TWcMNkK7tFYijkSvPClHu7K5YCnLtN/T1wuMMoVSuOhuNUyOJX6JG05TDF5YKEVwkOgvOfW8vgb7FklBif+GJSDN0IJBcXlS9NQjLMCB2TtE1CgUWALlul78w==", cchWideChar=245, lpMultiByteStr=0x353933c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAHdSgV6rjPuxw5zHr4K/PlyR3RqrI+N4s7HE5Guc7XrzJ+HpU9+ViEgB4Y+O1E9+T5FkA9AM6sIExJwjUMaPz5XktGg9agCATYeFKMy02TWcMNkK7tFYijkSvPClHu7K5YCnLtN/T1wuMMoVSuOhuNUyOJX6JG05TDF5YKEVwkOgvOfW8vgb7FklBif+GJSDN0IJBcXlS9NQjLMCB2TtE1CgUWALlul78w==", lpUsedDefaultChar=0x0) returned 245 [0065.378] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0065.378] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0065.378] CloseHandle (hObject=0x158) returned 1 [0065.378] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\notes-static.png")) returned 0 [0065.378] GetLastError () returned 0x5 [0065.378] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\notes-static.png")) returned 0x20 [0065.378] SetLastError (dwErrCode=0x5) [0065.378] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=18564180305) returned 1 [0065.378] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Файл зашифрован [play-static.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\Файл зашифрован [play-static.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0065.379] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0065.380] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0065.380] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0065.380] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0065.380] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0065.380] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0065.380] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0065.380] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0065.380] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0065.380] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0065.380] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0065.380] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0065.380] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0065.380] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0065.380] SetEndOfFile (hFile=0x158) returned 1 [0065.380] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0065.380] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0065.380] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0065.381] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0065.381] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0065.381] WriteFile (in: hFile=0x158, lpBuffer=0x35f035c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f035c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0065.382] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="\"EE?0PQHk+)kAm)djM!e4uP?Dwf4e1Pf", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0065.382] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="\"EE?0PQHk+)kAm)djM!e4uP?Dwf4e1Pf", cchWideChar=32, lpMultiByteStr=0x20366bc, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\"EE?0PQHk+)kAm)djM!e4uP?Dwf4e1Pf", lpUsedDefaultChar=0x0) returned 32 [0065.382] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0065.382] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0065.382] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\play-static.png", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72ae0342, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72ae0342, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x505, dwReserved0=0x0, dwReserved1=0x0, cFileName="play-static.png", cAlternateFileName="")) returned 0x295098 [0065.382] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0065.382] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0065.382] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\play-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\play-static.png")) returned 0x20 [0065.382] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\play-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\play-static.png")) returned 0x20 [0065.382] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\play-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\play-static.png")) returned 0x20 [0065.382] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\play-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\play-static.png")) returned 0x20 [0065.382] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\play-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\play-static.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72ae0342, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72ae0342, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x505)) returned 1 [0065.382] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0065.382] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0065.382] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\play-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\play-static.png")) returned 0x20 [0065.382] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\play-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\play-static.png")) returned 0x20 [0065.382] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0065.383] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0065.383] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0065.383] SetEndOfFile (hFile=0x158) returned 1 [0065.383] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="play-static.png", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0065.383] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="play-static.png", cchWideChar=15, lpMultiByteStr=0x1fe432c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="play-static.png", lpUsedDefaultChar=0x0) returned 15 [0065.384] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="play-static.png", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0065.384] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="play-static.png", cchWideChar=15, lpMultiByteStr=0x1fe44ac, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="play-static.png", lpUsedDefaultChar=0x0) returned 15 [0065.384] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe44ac, cbMultiByte=15, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="play-static.pnggng.pnggngt.pngpngre.pngg") returned 15 [0065.384] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="play-static.png", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0065.384] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="play-static.png", cchWideChar=15, lpMultiByteStr=0x1fe432c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="play-static.png", lpUsedDefaultChar=0x0) returned 15 [0065.384] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\play-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\play-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0065.384] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0065.384] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x505 [0065.384] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0065.384] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0065.384] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0065.384] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="play-static.png", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0065.384] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="play-static.png", cchWideChar=15, lpMultiByteStr=0x1fe432c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="play-static.png", lpUsedDefaultChar=0x0) returned 15 [0065.384] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="play-static.png", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0065.384] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="play-static.png", cchWideChar=15, lpMultiByteStr=0x1fe44ac, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="play-static.png", lpUsedDefaultChar=0x0) returned 15 [0065.384] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe44ac, cbMultiByte=15, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="play-static.pngic.pnggng.pnggngt.pngpngre.pngg") returned 15 [0065.385] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="play-static.png", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0065.385] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="play-static.png", cchWideChar=15, lpMultiByteStr=0x1fe432c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="play-static.png", lpUsedDefaultChar=0x0) returned 15 [0065.385] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0065.386] CharToOemA (in: pSrc="play-static.png", pDst=0x1fe44ac | out: pDst="play-static.png") returned 1 [0065.386] WriteFile (in: hFile=0x158, lpBuffer=0x1fe44ac*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe44ac*, lpNumberOfBytesWritten=0x18e048*=0xf, lpOverlapped=0x0) returned 1 [0065.386] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0065.386] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0065.386] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0065.386] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=18564956779) returned 1 [0065.386] ReadFile (in: hFile=0x11c, lpBuffer=0x37c6720, nNumberOfBytesToRead=0x505, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37c6720*, lpNumberOfBytesRead=0x18dd7c*=0x505, lpOverlapped=0x0) returned 1 [0065.389] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0065.389] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=18565292162) returned 1 [0065.398] WriteFile (in: hFile=0x158, lpBuffer=0x379adf8*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379adf8*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0065.398] ReadFile (in: hFile=0x11c, lpBuffer=0x37c6720, nNumberOfBytesToRead=0x505, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x37c6720*, lpNumberOfBytesRead=0x18de38*=0x505, lpOverlapped=0x0) returned 1 [0065.398] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x4a [0065.398] WriteFile (in: hFile=0x158, lpBuffer=0x37c6c80*, nNumberOfBytesToWrite=0x505, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x37c6c80*, lpNumberOfBytesWritten=0x18de10*=0x505, lpOverlapped=0x0) returned 1 [0065.399] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x54f [0065.399] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0065.399] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0065.399] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0065.399] SetFilePointer (in: hFile=0x158, lDistanceToMove=15, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2d [0065.399] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x559 [0065.399] CloseHandle (hObject=0x11c) returned 1 [0065.399] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x559 [0065.399] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x559 [0065.399] SetFilePointer (in: hFile=0x158, lDistanceToMove=1369, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x559 [0065.399] SetFilePointer (in: hFile=0x158, lDistanceToMove=1369, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x559 [0065.399] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x559 [0065.399] SetFilePointer (in: hFile=0x158, lDistanceToMove=1369, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x559 [0065.400] SetEndOfFile (hFile=0x158) returned 1 [0065.400] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x559 [0065.400] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x559 [0065.400] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="play-static.png", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0065.400] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="play-static.png", cchWideChar=15, lpMultiByteStr=0x1fe432c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="play-static.png", lpUsedDefaultChar=0x0) returned 15 [0065.400] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="play-static.png", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0065.400] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="play-static.png", cchWideChar=15, lpMultiByteStr=0x1fe488c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="play-static.png", lpUsedDefaultChar=0x0) returned 15 [0065.400] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe488c, cbMultiByte=15, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="play-static.png'\x18믉`믑`") returned 15 [0065.400] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="play-static.png", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0065.400] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="play-static.png", cchWideChar=15, lpMultiByteStr=0x1fe432c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="play-static.png", lpUsedDefaultChar=0x0) returned 15 [0065.400] WriteFile (in: hFile=0x158, lpBuffer=0x37aa1d8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x37aa1d8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0065.400] CharToOemA (in: pSrc="play-static.png", pDst=0x1fe488c | out: pDst="play-static.png") returned 1 [0065.400] WriteFile (in: hFile=0x158, lpBuffer=0x1fe488c*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe488c*, lpNumberOfBytesWritten=0x18efcc*=0xf, lpOverlapped=0x0) returned 1 [0065.400] WriteFile (in: hFile=0x158, lpBuffer=0x379ad58*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379ad58*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0065.400] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0065.401] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0065.401] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x5a1 [0065.401] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x5a1 [0065.401] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0065.401] WriteFile (in: hFile=0x158, lpBuffer=0x35f035c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f035c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0065.401] DeleteFileW (lpFileName="") returned 0 [0065.401] GetLastError () returned 0x3 [0065.401] GetFileAttributesW (lpFileName="") returned 0xffffffff [0065.401] SetLastError (dwErrCode=0x3) [0065.401] FlushFileBuffers (hFile=0x158) returned 1 [0065.411] GetCurrentThreadId () returned 0x970 [0065.411] GetCurrentThreadId () returned 0x970 [0065.411] GetCurrentThreadId () returned 0x970 [0065.411] GetCurrentThreadId () returned 0x970 [0065.411] GetCurrentThreadId () returned 0x970 [0065.411] GetCurrentThreadId () returned 0x970 [0065.411] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x658 [0065.411] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x658 [0065.411] SetFilePointer (in: hFile=0x158, lDistanceToMove=1624, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x658 [0065.411] CloseHandle (hObject=0x158) returned 1 [0065.412] GetCurrentThreadId () returned 0x970 [0065.412] GetCurrentThreadId () returned 0x970 [0065.412] GetCurrentThreadId () returned 0x970 [0065.412] GetCurrentThreadId () returned 0x970 [0065.412] GetCurrentThreadId () returned 0x970 [0065.412] GetCurrentThreadId () returned 0x970 [0065.412] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Файл зашифрован [play-static.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\Файл зашифрован [play-static.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0065.412] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x658 [0065.412] SetFilePointer (in: hFile=0x158, lDistanceToMove=1496, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5d8 [0065.412] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0065.412] GetFileType (hFile=0x158) returned 0x1 [0065.412] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xc, wMilliseconds=0x2b0)) [0065.412] GetCurrentThreadId () returned 0x970 [0065.412] GetCurrentThreadId () returned 0x970 [0065.412] GetCurrentThreadId () returned 0x970 [0065.412] GetCurrentThreadId () returned 0x970 [0065.412] GetCurrentThreadId () returned 0x970 [0065.412] GetCurrentThreadId () returned 0x970 [0065.412] GetCurrentThreadId () returned 0x970 [0065.412] GetCurrentThreadId () returned 0x970 [0065.413] GetCurrentThreadId () returned 0x970 [0065.413] GetCurrentThreadId () returned 0x970 [0065.413] GetCurrentThreadId () returned 0x970 [0065.413] GetCurrentThreadId () returned 0x970 [0065.413] GetCurrentThreadId () returned 0x970 [0065.413] GetCurrentThreadId () returned 0x970 [0065.413] GetCurrentThreadId () returned 0x970 [0065.413] GetCurrentThreadId () returned 0x970 [0065.413] GetCurrentThreadId () returned 0x970 [0065.413] GetCurrentThreadId () returned 0x970 [0065.413] GetCurrentThreadId () returned 0x970 [0065.413] GetCurrentThreadId () returned 0x970 [0065.413] GetCurrentThreadId () returned 0x970 [0065.413] GetCurrentThreadId () returned 0x970 [0065.413] GetCurrentThreadId () returned 0x970 [0065.413] GetCurrentThreadId () returned 0x970 [0065.413] GetCurrentThreadId () returned 0x970 [0065.413] GetCurrentThreadId () returned 0x970 [0065.413] GetCurrentThreadId () returned 0x970 [0065.413] GetCurrentThreadId () returned 0x970 [0065.413] GetCurrentThreadId () returned 0x970 [0065.413] GetCurrentThreadId () returned 0x970 [0065.413] GetCurrentThreadId () returned 0x970 [0065.413] GetCurrentThreadId () returned 0x970 [0065.413] GetCurrentThreadId () returned 0x970 [0065.413] GetCurrentThreadId () returned 0x970 [0065.413] GetCurrentThreadId () returned 0x970 [0065.413] GetCurrentThreadId () returned 0x970 [0065.413] GetCurrentThreadId () returned 0x970 [0065.413] GetCurrentThreadId () returned 0x970 [0065.413] GetCurrentThreadId () returned 0x970 [0065.413] GetCurrentThreadId () returned 0x970 [0065.413] GetCurrentThreadId () returned 0x970 [0065.413] GetCurrentThreadId () returned 0x970 [0065.413] GetCurrentThreadId () returned 0x970 [0065.413] GetCurrentThreadId () returned 0x970 [0065.413] GetCurrentThreadId () returned 0x970 [0065.413] GetCurrentThreadId () returned 0x970 [0065.413] GetCurrentThreadId () returned 0x970 [0065.413] GetCurrentThreadId () returned 0x970 [0065.413] GetCurrentThreadId () returned 0x970 [0065.413] GetCurrentThreadId () returned 0x970 [0065.413] GetCurrentThreadId () returned 0x970 [0065.413] GetCurrentThreadId () returned 0x970 [0065.413] GetCurrentThreadId () returned 0x970 [0065.414] GetCurrentThreadId () returned 0x970 [0065.414] GetCurrentThreadId () returned 0x970 [0065.414] GetCurrentThreadId () returned 0x970 [0065.414] GetCurrentThreadId () returned 0x970 [0065.414] GetCurrentThreadId () returned 0x970 [0065.414] GetCurrentThreadId () returned 0x970 [0065.414] GetCurrentThreadId () returned 0x970 [0065.414] GetCurrentThreadId () returned 0x970 [0065.414] GetCurrentThreadId () returned 0x970 [0065.414] GetCurrentThreadId () returned 0x970 [0065.414] GetCurrentThreadId () returned 0x970 [0065.414] GetCurrentThreadId () returned 0x970 [0065.414] GetCurrentThreadId () returned 0x970 [0065.414] GetCurrentThreadId () returned 0x970 [0065.414] GetCurrentThreadId () returned 0x970 [0065.414] GetCurrentThreadId () returned 0x970 [0065.414] GetCurrentThreadId () returned 0x970 [0065.414] GetCurrentThreadId () returned 0x970 [0065.414] GetCurrentThreadId () returned 0x970 [0065.414] GetCurrentThreadId () returned 0x970 [0065.414] GetCurrentThreadId () returned 0x970 [0065.414] GetCurrentThreadId () returned 0x970 [0065.414] GetCurrentThreadId () returned 0x970 [0065.414] GetCurrentThreadId () returned 0x970 [0065.414] GetCurrentThreadId () returned 0x970 [0065.414] GetCurrentThreadId () returned 0x970 [0065.414] GetCurrentThreadId () returned 0x970 [0065.414] GetCurrentThreadId () returned 0x970 [0065.414] GetCurrentThreadId () returned 0x970 [0065.414] GetCurrentThreadId () returned 0x970 [0065.414] GetCurrentThreadId () returned 0x970 [0065.414] GetCurrentThreadId () returned 0x970 [0065.414] GetCurrentThreadId () returned 0x970 [0065.414] GetCurrentThreadId () returned 0x970 [0065.414] GetCurrentThreadId () returned 0x970 [0065.414] GetCurrentThreadId () returned 0x970 [0065.414] GetCurrentThreadId () returned 0x970 [0065.414] GetCurrentThreadId () returned 0x970 [0065.414] GetCurrentThreadId () returned 0x970 [0065.414] GetCurrentThreadId () returned 0x970 [0065.414] GetCurrentThreadId () returned 0x970 [0065.414] GetCurrentThreadId () returned 0x970 [0065.414] GetCurrentThreadId () returned 0x970 [0065.414] GetCurrentThreadId () returned 0x970 [0065.414] GetCurrentThreadId () returned 0x970 [0065.415] GetCurrentThreadId () returned 0x970 [0065.415] GetCurrentThreadId () returned 0x970 [0065.415] GetCurrentThreadId () returned 0x970 [0065.415] GetCurrentThreadId () returned 0x970 [0065.415] GetCurrentThreadId () returned 0x970 [0065.415] GetCurrentThreadId () returned 0x970 [0065.415] GetCurrentThreadId () returned 0x970 [0065.415] GetCurrentThreadId () returned 0x970 [0065.415] GetCurrentThreadId () returned 0x970 [0065.415] GetCurrentThreadId () returned 0x970 [0065.415] GetCurrentThreadId () returned 0x970 [0065.415] GetCurrentThreadId () returned 0x970 [0065.415] GetCurrentThreadId () returned 0x970 [0065.415] GetCurrentThreadId () returned 0x970 [0065.415] GetCurrentThreadId () returned 0x970 [0065.415] GetCurrentThreadId () returned 0x970 [0065.415] GetCurrentThreadId () returned 0x970 [0065.415] GetCurrentThreadId () returned 0x970 [0065.415] GetCurrentThreadId () returned 0x970 [0065.415] GetCurrentThreadId () returned 0x970 [0065.415] GetCurrentThreadId () returned 0x970 [0065.415] GetCurrentThreadId () returned 0x970 [0065.415] GetCurrentThreadId () returned 0x970 [0065.415] GetCurrentThreadId () returned 0x970 [0065.415] GetCurrentThreadId () returned 0x970 [0065.415] GetCurrentThreadId () returned 0x970 [0065.415] GetCurrentThreadId () returned 0x970 [0065.415] GetCurrentThreadId () returned 0x970 [0065.415] GetCurrentThreadId () returned 0x970 [0065.415] GetCurrentThreadId () returned 0x970 [0065.415] GetCurrentThreadId () returned 0x970 [0065.415] GetCurrentThreadId () returned 0x970 [0065.415] GetCurrentThreadId () returned 0x970 [0065.415] GetCurrentThreadId () returned 0x970 [0065.415] GetCurrentThreadId () returned 0x970 [0065.415] GetCurrentThreadId () returned 0x970 [0065.415] GetCurrentThreadId () returned 0x970 [0065.415] GetCurrentThreadId () returned 0x970 [0065.415] GetCurrentThreadId () returned 0x970 [0065.415] GetCurrentThreadId () returned 0x970 [0065.415] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.415] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.415] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379bb38, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.415] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.415] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.416] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379bb38, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.416] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.416] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.416] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.416] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.416] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.416] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.416] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.416] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.416] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379bb98, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.416] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.416] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.416] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379bb98, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.416] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.416] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.416] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379bb98, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.416] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xc, wMilliseconds=0x2b0)) [0065.416] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="\"EE?0PQHk+)kAm)djM!e4uP?Dwf4e1Pf", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0065.416] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="\"EE?0PQHk+)kAm)djM!e4uP?Dwf4e1Pf", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0065.416] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="\"EE?0PQHk+)kAm)djM!e4uP?Dwf4e1Pf", cchWideChar=32, lpMultiByteStr=0x2003c28, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\"EE?0PQHk+)kAm)djM!e4uP?Dwf4e1Pf", lpUsedDefaultChar=0x0) returned 32 [0065.416] GetCurrentThreadId () returned 0x970 [0065.416] GetCurrentThreadId () returned 0x970 [0065.416] GetCurrentThreadId () returned 0x970 [0065.416] GetCurrentThreadId () returned 0x970 [0065.416] GetCurrentThreadId () returned 0x970 [0065.416] GetCurrentThreadId () returned 0x970 [0065.424] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0065.424] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0065.424] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x37988e8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0065.424] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb248, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0065.424] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb248, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAGZ0YWHsctrnP89N/N1rhLO88Dgjvp4ehBNcaoZ/SvwyCPljM9NPK4i0BjSU+RwOaB8sYF/MzVcBjoK8KEpj5h+u+/U8AS41BQDDq6f03Bg5KfXv341DWodJm1wbJoQXup/1D+MerWcwBToUTo6FG/HGXpp6p79PNFa/ZeswfcTPa4DmcmDvdHQbwpfZxxoj7Iv3J5uS5VIYV+BriIq14MC8GQzyzR6l/Q==") returned 232 [0065.424] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xc, wMilliseconds=0x2c0)) [0065.424] GetCurrentThreadId () returned 0x970 [0065.424] GetCurrentThreadId () returned 0x970 [0065.424] GetCurrentThreadId () returned 0x970 [0065.424] GetCurrentThreadId () returned 0x970 [0065.424] GetCurrentThreadId () returned 0x970 [0065.424] GetCurrentThreadId () returned 0x970 [0065.424] GetCurrentThreadId () returned 0x970 [0065.424] GetCurrentThreadId () returned 0x970 [0065.424] GetCurrentThreadId () returned 0x970 [0065.425] GetCurrentThreadId () returned 0x970 [0065.425] GetCurrentThreadId () returned 0x970 [0065.425] GetCurrentThreadId () returned 0x970 [0065.425] GetCurrentThreadId () returned 0x970 [0065.425] GetCurrentThreadId () returned 0x970 [0065.425] GetCurrentThreadId () returned 0x970 [0065.425] GetCurrentThreadId () returned 0x970 [0065.425] GetCurrentThreadId () returned 0x970 [0065.425] GetCurrentThreadId () returned 0x970 [0065.425] GetCurrentThreadId () returned 0x970 [0065.425] GetCurrentThreadId () returned 0x970 [0065.425] GetCurrentThreadId () returned 0x970 [0065.425] GetCurrentThreadId () returned 0x970 [0065.425] GetCurrentThreadId () returned 0x970 [0065.425] GetCurrentThreadId () returned 0x970 [0065.425] GetCurrentThreadId () returned 0x970 [0065.425] GetCurrentThreadId () returned 0x970 [0065.425] GetCurrentThreadId () returned 0x970 [0065.425] GetCurrentThreadId () returned 0x970 [0065.425] GetCurrentThreadId () returned 0x970 [0065.425] GetCurrentThreadId () returned 0x970 [0065.425] GetCurrentThreadId () returned 0x970 [0065.425] GetCurrentThreadId () returned 0x970 [0065.425] GetCurrentThreadId () returned 0x970 [0065.425] GetCurrentThreadId () returned 0x970 [0065.425] GetCurrentThreadId () returned 0x970 [0065.425] GetCurrentThreadId () returned 0x970 [0065.425] GetCurrentThreadId () returned 0x970 [0065.425] GetCurrentThreadId () returned 0x970 [0065.425] GetCurrentThreadId () returned 0x970 [0065.425] GetCurrentThreadId () returned 0x970 [0065.425] GetCurrentThreadId () returned 0x970 [0065.425] GetCurrentThreadId () returned 0x970 [0065.425] GetCurrentThreadId () returned 0x970 [0065.425] GetCurrentThreadId () returned 0x970 [0065.425] GetCurrentThreadId () returned 0x970 [0065.425] GetCurrentThreadId () returned 0x970 [0065.425] GetCurrentThreadId () returned 0x970 [0065.425] GetCurrentThreadId () returned 0x970 [0065.425] GetCurrentThreadId () returned 0x970 [0065.425] GetCurrentThreadId () returned 0x970 [0065.425] GetCurrentThreadId () returned 0x970 [0065.425] GetCurrentThreadId () returned 0x970 [0065.425] GetCurrentThreadId () returned 0x970 [0065.425] GetCurrentThreadId () returned 0x970 [0065.426] GetCurrentThreadId () returned 0x970 [0065.426] GetCurrentThreadId () returned 0x970 [0065.426] GetCurrentThreadId () returned 0x970 [0065.426] GetCurrentThreadId () returned 0x970 [0065.426] GetCurrentThreadId () returned 0x970 [0065.426] GetCurrentThreadId () returned 0x970 [0065.426] GetCurrentThreadId () returned 0x970 [0065.426] GetCurrentThreadId () returned 0x970 [0065.426] GetCurrentThreadId () returned 0x970 [0065.426] GetCurrentThreadId () returned 0x970 [0065.426] GetCurrentThreadId () returned 0x970 [0065.426] GetCurrentThreadId () returned 0x970 [0065.426] GetCurrentThreadId () returned 0x970 [0065.426] GetCurrentThreadId () returned 0x970 [0065.426] GetCurrentThreadId () returned 0x970 [0065.426] GetCurrentThreadId () returned 0x970 [0065.426] GetCurrentThreadId () returned 0x970 [0065.426] GetCurrentThreadId () returned 0x970 [0065.426] GetCurrentThreadId () returned 0x970 [0065.426] GetCurrentThreadId () returned 0x970 [0065.426] GetCurrentThreadId () returned 0x970 [0065.426] GetCurrentThreadId () returned 0x970 [0065.426] GetCurrentThreadId () returned 0x970 [0065.426] GetCurrentThreadId () returned 0x970 [0065.426] GetCurrentThreadId () returned 0x970 [0065.426] GetCurrentThreadId () returned 0x970 [0065.426] GetCurrentThreadId () returned 0x970 [0065.426] GetCurrentThreadId () returned 0x970 [0065.426] GetCurrentThreadId () returned 0x970 [0065.426] GetCurrentThreadId () returned 0x970 [0065.426] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAGZ0YWHsctrnP89N/N1rhLO88Dgjvp4ehBNcaoZ/SvwyCPljM9NPK4i0BjSU+RwOaB8sYF/MzVcBjoK8KEpj5h+u+/U8AS41BQDDq6f03Bg5KfXv341DWodJm1wbJoQXup/1D+MerWcwBToUTo6FG/HGXpp6p79PNFa/ZeswfcTPa4DmcmDvdHQbwpfZxxoj7Iv3J5uS5VIYV+BriIq14MC8GQzyzR6l/Q==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0065.426] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAGZ0YWHsctrnP89N/N1rhLO88Dgjvp4ehBNcaoZ/SvwyCPljM9NPK4i0BjSU+RwOaB8sYF/MzVcBjoK8KEpj5h+u+/U8AS41BQDDq6f03Bg5KfXv341DWodJm1wbJoQXup/1D+MerWcwBToUTo6FG/HGXpp6p79PNFa/ZeswfcTPa4DmcmDvdHQbwpfZxxoj7Iv3J5uS5VIYV+BriIq14MC8GQzyzR6l/Q==", cchWideChar=245, lpMultiByteStr=0x353933c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAGZ0YWHsctrnP89N/N1rhLO88Dgjvp4ehBNcaoZ/SvwyCPljM9NPK4i0BjSU+RwOaB8sYF/MzVcBjoK8KEpj5h+u+/U8AS41BQDDq6f03Bg5KfXv341DWodJm1wbJoQXup/1D+MerWcwBToUTo6FG/HGXpp6p79PNFa/ZeswfcTPa4DmcmDvdHQbwpfZxxoj7Iv3J5uS5VIYV+BriIq14MC8GQzyzR6l/Q==", lpUsedDefaultChar=0x0) returned 245 [0065.426] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0065.426] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0065.427] CloseHandle (hObject=0x158) returned 1 [0065.427] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\play-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\play-static.png")) returned 0 [0065.427] GetLastError () returned 0x5 [0065.427] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\play-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\play-static.png")) returned 0x20 [0065.427] SetLastError (dwErrCode=0x5) [0065.427] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=18569036245) returned 1 [0065.427] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Файл зашифрован [BlackRectangle.bmp].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\Файл зашифрован [blackrectangle.bmp].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0065.427] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0065.427] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0065.428] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0065.428] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0065.428] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0065.428] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0065.428] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0065.428] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0065.428] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0065.428] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0065.428] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0065.428] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0065.428] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0065.428] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0065.428] SetEndOfFile (hFile=0x158) returned 1 [0065.428] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0065.428] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0065.428] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0065.429] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0065.429] WriteFile (in: hFile=0x158, lpBuffer=0x3777058*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777058*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0065.432] WriteFile (in: hFile=0x158, lpBuffer=0x35f04dc*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f04dc*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0065.432] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="?33j,vMGt=5#*iF(,m8&D22m>VON\"?F5", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0065.432] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="?33j,vMGt=5#*iF(,m8&D22m>VON\"?F5", cchWideChar=32, lpMultiByteStr=0x20349dc, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="?33j,vMGt=5#*iF(,m8&D22m>VON\"?F5", lpUsedDefaultChar=0x0) returned 32 [0065.432] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0065.432] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0065.432] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BlackRectangle.bmp", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ecb0968, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ecb0968, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1276, dwReserved0=0x0, dwReserved1=0x0, cFileName="BlackRectangle.bmp", cAlternateFileName="")) returned 0x295098 [0065.432] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0065.432] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0065.432] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BlackRectangle.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\blackrectangle.bmp")) returned 0x20 [0065.433] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BlackRectangle.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\blackrectangle.bmp")) returned 0x20 [0065.433] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BlackRectangle.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\blackrectangle.bmp")) returned 0x20 [0065.433] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BlackRectangle.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\blackrectangle.bmp")) returned 0x20 [0065.433] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BlackRectangle.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\blackrectangle.bmp"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ecb0968, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ecb0968, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1276)) returned 1 [0065.433] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0065.433] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0065.433] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BlackRectangle.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\blackrectangle.bmp")) returned 0x20 [0065.433] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BlackRectangle.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\blackrectangle.bmp")) returned 0x20 [0065.434] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0065.434] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0065.434] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0065.434] SetEndOfFile (hFile=0x158) returned 1 [0065.434] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BlackRectangle.bmp", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0065.435] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BlackRectangle.bmp", cchWideChar=18, lpMultiByteStr=0x1ff885c, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BlackRectangle.bmp", lpUsedDefaultChar=0x0) returned 18 [0065.435] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BlackRectangle.bmp", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0065.435] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BlackRectangle.bmp", cchWideChar=18, lpMultiByteStr=0x1ff8a14, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BlackRectangle.bmp", lpUsedDefaultChar=0x0) returned 18 [0065.435] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff8a14, cbMultiByte=18, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="BlackRectangle.bmp.pnggngt.pngpngre.pngg") returned 18 [0065.435] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BlackRectangle.bmp", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0065.435] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BlackRectangle.bmp", cchWideChar=18, lpMultiByteStr=0x1ff885c, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BlackRectangle.bmp", lpUsedDefaultChar=0x0) returned 18 [0065.435] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BlackRectangle.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\blackrectangle.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0065.435] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0065.435] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x1276 [0065.435] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0065.435] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0065.435] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0065.435] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BlackRectangle.bmp", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0065.435] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BlackRectangle.bmp", cchWideChar=18, lpMultiByteStr=0x1ff885c, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BlackRectangle.bmp", lpUsedDefaultChar=0x0) returned 18 [0065.436] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BlackRectangle.bmp", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0065.436] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BlackRectangle.bmp", cchWideChar=18, lpMultiByteStr=0x1ff8a14, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BlackRectangle.bmp", lpUsedDefaultChar=0x0) returned 18 [0065.436] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff8a14, cbMultiByte=18, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="BlackRectangle.bmple.bmp.pnggngt.pngpngre.pngg") returned 18 [0065.436] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BlackRectangle.bmp", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0065.436] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BlackRectangle.bmp", cchWideChar=18, lpMultiByteStr=0x1ff885c, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BlackRectangle.bmp", lpUsedDefaultChar=0x0) returned 18 [0065.436] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0065.437] CharToOemA (in: pSrc="BlackRectangle.bmp", pDst=0x1ff8a14 | out: pDst="BlackRectangle.bmp") returned 1 [0065.437] WriteFile (in: hFile=0x158, lpBuffer=0x1ff8a14*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1ff8a14*, lpNumberOfBytesWritten=0x18e048*=0x12, lpOverlapped=0x0) returned 1 [0065.437] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0065.437] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0065.437] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0065.437] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=18570041599) returned 1 [0065.437] ReadFile (in: hFile=0x11c, lpBuffer=0x37c6700, nNumberOfBytesToRead=0x1276, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37c6700*, lpNumberOfBytesRead=0x18dd7c*=0x1276, lpOverlapped=0x0) returned 1 [0065.438] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0065.438] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=18570185425) returned 1 [0065.447] WriteFile (in: hFile=0x158, lpBuffer=0x379ad20*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379ad20*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0065.447] ReadFile (in: hFile=0x11c, lpBuffer=0x37c6700, nNumberOfBytesToRead=0x1276, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x37c6700*, lpNumberOfBytesRead=0x18de38*=0x1276, lpOverlapped=0x0) returned 1 [0065.448] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x4d [0065.448] WriteFile (in: hFile=0x158, lpBuffer=0x3809220*, nNumberOfBytesToWrite=0x1276, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3809220*, lpNumberOfBytesWritten=0x18de10*=0x1276, lpOverlapped=0x0) returned 1 [0065.448] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x12c3 [0065.448] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0065.448] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0065.448] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0065.448] SetFilePointer (in: hFile=0x158, lDistanceToMove=18, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x30 [0065.448] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x12cd [0065.448] CloseHandle (hObject=0x11c) returned 1 [0065.448] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x12cd [0065.448] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x12cd [0065.449] SetFilePointer (in: hFile=0x158, lDistanceToMove=4813, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x12cd [0065.449] SetFilePointer (in: hFile=0x158, lDistanceToMove=4813, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x12cd [0065.449] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x12cd [0065.449] SetFilePointer (in: hFile=0x158, lDistanceToMove=4813, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x12cd [0065.449] SetEndOfFile (hFile=0x158) returned 1 [0065.449] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x12cd [0065.449] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x12cd [0065.449] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BlackRectangle.bmp", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0065.449] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BlackRectangle.bmp", cchWideChar=18, lpMultiByteStr=0x1ff8a14, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BlackRectangle.bmp", lpUsedDefaultChar=0x0) returned 18 [0065.449] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BlackRectangle.bmp", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0065.449] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BlackRectangle.bmp", cchWideChar=18, lpMultiByteStr=0x1ff885c, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BlackRectangle.bmp", lpUsedDefaultChar=0x0) returned 18 [0065.449] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff885c, cbMultiByte=18, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="BlackRectangle.bmp믉`믑`") returned 18 [0065.449] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BlackRectangle.bmp", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0065.449] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BlackRectangle.bmp", cchWideChar=18, lpMultiByteStr=0x1ff8a14, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BlackRectangle.bmp", lpUsedDefaultChar=0x0) returned 18 [0065.449] WriteFile (in: hFile=0x158, lpBuffer=0x37aa1d8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x37aa1d8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0065.449] CharToOemA (in: pSrc="BlackRectangle.bmp", pDst=0x1ff885c | out: pDst="BlackRectangle.bmp") returned 1 [0065.450] WriteFile (in: hFile=0x158, lpBuffer=0x1ff885c*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1ff885c*, lpNumberOfBytesWritten=0x18efcc*=0x12, lpOverlapped=0x0) returned 1 [0065.450] WriteFile (in: hFile=0x158, lpBuffer=0x379ae18*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379ae18*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0065.450] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0065.450] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0065.450] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1318 [0065.450] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1318 [0065.450] WriteFile (in: hFile=0x158, lpBuffer=0x3777058*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777058*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0065.450] WriteFile (in: hFile=0x158, lpBuffer=0x35f04dc*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f04dc*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0065.450] DeleteFileW (lpFileName="") returned 0 [0065.450] GetLastError () returned 0x3 [0065.450] GetFileAttributesW (lpFileName="") returned 0xffffffff [0065.450] SetLastError (dwErrCode=0x3) [0065.450] FlushFileBuffers (hFile=0x158) returned 1 [0065.454] GetCurrentThreadId () returned 0x970 [0065.454] GetCurrentThreadId () returned 0x970 [0065.454] GetCurrentThreadId () returned 0x970 [0065.454] GetCurrentThreadId () returned 0x970 [0065.454] GetCurrentThreadId () returned 0x970 [0065.454] GetCurrentThreadId () returned 0x970 [0065.454] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x13cf [0065.454] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x13cf [0065.454] SetFilePointer (in: hFile=0x158, lDistanceToMove=5071, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x13cf [0065.454] CloseHandle (hObject=0x158) returned 1 [0065.454] GetCurrentThreadId () returned 0x970 [0065.454] GetCurrentThreadId () returned 0x970 [0065.454] GetCurrentThreadId () returned 0x970 [0065.454] GetCurrentThreadId () returned 0x970 [0065.454] GetCurrentThreadId () returned 0x970 [0065.454] GetCurrentThreadId () returned 0x970 [0065.454] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Файл зашифрован [BlackRectangle.bmp].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\Файл зашифрован [blackrectangle.bmp].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0065.454] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13cf [0065.454] SetFilePointer (in: hFile=0x158, lDistanceToMove=4943, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x134f [0065.454] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0065.454] GetFileType (hFile=0x158) returned 0x1 [0065.454] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xc, wMilliseconds=0x2cf)) [0065.455] GetCurrentThreadId () returned 0x970 [0065.455] GetCurrentThreadId () returned 0x970 [0065.455] GetCurrentThreadId () returned 0x970 [0065.455] GetCurrentThreadId () returned 0x970 [0065.455] GetCurrentThreadId () returned 0x970 [0065.455] GetCurrentThreadId () returned 0x970 [0065.455] GetCurrentThreadId () returned 0x970 [0065.455] GetCurrentThreadId () returned 0x970 [0065.455] GetCurrentThreadId () returned 0x970 [0065.455] GetCurrentThreadId () returned 0x970 [0065.455] GetCurrentThreadId () returned 0x970 [0065.455] GetCurrentThreadId () returned 0x970 [0065.455] GetCurrentThreadId () returned 0x970 [0065.455] GetCurrentThreadId () returned 0x970 [0065.455] GetCurrentThreadId () returned 0x970 [0065.455] GetCurrentThreadId () returned 0x970 [0065.455] GetCurrentThreadId () returned 0x970 [0065.455] GetCurrentThreadId () returned 0x970 [0065.455] GetCurrentThreadId () returned 0x970 [0065.455] GetCurrentThreadId () returned 0x970 [0065.455] GetCurrentThreadId () returned 0x970 [0065.455] GetCurrentThreadId () returned 0x970 [0065.455] GetCurrentThreadId () returned 0x970 [0065.455] GetCurrentThreadId () returned 0x970 [0065.455] GetCurrentThreadId () returned 0x970 [0065.455] GetCurrentThreadId () returned 0x970 [0065.455] GetCurrentThreadId () returned 0x970 [0065.455] GetCurrentThreadId () returned 0x970 [0065.455] GetCurrentThreadId () returned 0x970 [0065.455] GetCurrentThreadId () returned 0x970 [0065.455] GetCurrentThreadId () returned 0x970 [0065.455] GetCurrentThreadId () returned 0x970 [0065.455] GetCurrentThreadId () returned 0x970 [0065.455] GetCurrentThreadId () returned 0x970 [0065.455] GetCurrentThreadId () returned 0x970 [0065.455] GetCurrentThreadId () returned 0x970 [0065.455] GetCurrentThreadId () returned 0x970 [0065.455] GetCurrentThreadId () returned 0x970 [0065.455] GetCurrentThreadId () returned 0x970 [0065.455] GetCurrentThreadId () returned 0x970 [0065.456] GetCurrentThreadId () returned 0x970 [0065.456] GetCurrentThreadId () returned 0x970 [0065.456] GetCurrentThreadId () returned 0x970 [0065.456] GetCurrentThreadId () returned 0x970 [0065.456] GetCurrentThreadId () returned 0x970 [0065.456] GetCurrentThreadId () returned 0x970 [0065.456] GetCurrentThreadId () returned 0x970 [0065.456] GetCurrentThreadId () returned 0x970 [0065.456] GetCurrentThreadId () returned 0x970 [0065.456] GetCurrentThreadId () returned 0x970 [0065.456] GetCurrentThreadId () returned 0x970 [0065.456] GetCurrentThreadId () returned 0x970 [0065.456] GetCurrentThreadId () returned 0x970 [0065.456] GetCurrentThreadId () returned 0x970 [0065.456] GetCurrentThreadId () returned 0x970 [0065.456] GetCurrentThreadId () returned 0x970 [0065.456] GetCurrentThreadId () returned 0x970 [0065.456] GetCurrentThreadId () returned 0x970 [0065.456] GetCurrentThreadId () returned 0x970 [0065.456] GetCurrentThreadId () returned 0x970 [0065.456] GetCurrentThreadId () returned 0x970 [0065.456] GetCurrentThreadId () returned 0x970 [0065.456] GetCurrentThreadId () returned 0x970 [0065.456] GetCurrentThreadId () returned 0x970 [0065.456] GetCurrentThreadId () returned 0x970 [0065.456] GetCurrentThreadId () returned 0x970 [0065.456] GetCurrentThreadId () returned 0x970 [0065.456] GetCurrentThreadId () returned 0x970 [0065.456] GetCurrentThreadId () returned 0x970 [0065.456] GetCurrentThreadId () returned 0x970 [0065.456] GetCurrentThreadId () returned 0x970 [0065.456] GetCurrentThreadId () returned 0x970 [0065.456] GetCurrentThreadId () returned 0x970 [0065.456] GetCurrentThreadId () returned 0x970 [0065.456] GetCurrentThreadId () returned 0x970 [0065.456] GetCurrentThreadId () returned 0x970 [0065.456] GetCurrentThreadId () returned 0x970 [0065.456] GetCurrentThreadId () returned 0x970 [0065.456] GetCurrentThreadId () returned 0x970 [0065.456] GetCurrentThreadId () returned 0x970 [0065.456] GetCurrentThreadId () returned 0x970 [0065.456] GetCurrentThreadId () returned 0x970 [0065.456] GetCurrentThreadId () returned 0x970 [0065.457] GetCurrentThreadId () returned 0x970 [0065.457] GetCurrentThreadId () returned 0x970 [0065.457] GetCurrentThreadId () returned 0x970 [0065.457] GetCurrentThreadId () returned 0x970 [0065.457] GetCurrentThreadId () returned 0x970 [0065.457] GetCurrentThreadId () returned 0x970 [0065.457] GetCurrentThreadId () returned 0x970 [0065.457] GetCurrentThreadId () returned 0x970 [0065.457] GetCurrentThreadId () returned 0x970 [0065.457] GetCurrentThreadId () returned 0x970 [0065.457] GetCurrentThreadId () returned 0x970 [0065.457] GetCurrentThreadId () returned 0x970 [0065.457] GetCurrentThreadId () returned 0x970 [0065.457] GetCurrentThreadId () returned 0x970 [0065.457] GetCurrentThreadId () returned 0x970 [0065.457] GetCurrentThreadId () returned 0x970 [0065.457] GetCurrentThreadId () returned 0x970 [0065.457] GetCurrentThreadId () returned 0x970 [0065.457] GetCurrentThreadId () returned 0x970 [0065.457] GetCurrentThreadId () returned 0x970 [0065.457] GetCurrentThreadId () returned 0x970 [0065.457] GetCurrentThreadId () returned 0x970 [0065.457] GetCurrentThreadId () returned 0x970 [0065.457] GetCurrentThreadId () returned 0x970 [0065.457] GetCurrentThreadId () returned 0x970 [0065.457] GetCurrentThreadId () returned 0x970 [0065.457] GetCurrentThreadId () returned 0x970 [0065.457] GetCurrentThreadId () returned 0x970 [0065.457] GetCurrentThreadId () returned 0x970 [0065.457] GetCurrentThreadId () returned 0x970 [0065.457] GetCurrentThreadId () returned 0x970 [0065.457] GetCurrentThreadId () returned 0x970 [0065.457] GetCurrentThreadId () returned 0x970 [0065.457] GetCurrentThreadId () returned 0x970 [0065.457] GetCurrentThreadId () returned 0x970 [0065.457] GetCurrentThreadId () returned 0x970 [0065.457] GetCurrentThreadId () returned 0x970 [0065.457] GetCurrentThreadId () returned 0x970 [0065.457] GetCurrentThreadId () returned 0x970 [0065.457] GetCurrentThreadId () returned 0x970 [0065.457] GetCurrentThreadId () returned 0x970 [0065.457] GetCurrentThreadId () returned 0x970 [0065.457] GetCurrentThreadId () returned 0x970 [0065.457] GetCurrentThreadId () returned 0x970 [0065.457] GetCurrentThreadId () returned 0x970 [0065.458] GetCurrentThreadId () returned 0x970 [0065.458] GetCurrentThreadId () returned 0x970 [0065.458] GetCurrentThreadId () returned 0x970 [0065.458] GetCurrentThreadId () returned 0x970 [0065.458] GetCurrentThreadId () returned 0x970 [0065.458] GetCurrentThreadId () returned 0x970 [0065.458] GetCurrentThreadId () returned 0x970 [0065.458] GetCurrentThreadId () returned 0x970 [0065.458] GetCurrentThreadId () returned 0x970 [0065.458] GetCurrentThreadId () returned 0x970 [0065.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379bb98, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379bb98, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379bbf8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379bbf8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379bbf8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.458] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xc, wMilliseconds=0x2df)) [0065.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="?33j,vMGt=5#*iF(,m8&D22m>VON\"?F5", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0065.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="?33j,vMGt=5#*iF(,m8&D22m>VON\"?F5", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0065.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="?33j,vMGt=5#*iF(,m8&D22m>VON\"?F5", cchWideChar=32, lpMultiByteStr=0x2003b98, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="?33j,vMGt=5#*iF(,m8&D22m>VON\"?F5", lpUsedDefaultChar=0x0) returned 32 [0065.459] GetCurrentThreadId () returned 0x970 [0065.459] GetCurrentThreadId () returned 0x970 [0065.459] GetCurrentThreadId () returned 0x970 [0065.459] GetCurrentThreadId () returned 0x970 [0065.459] GetCurrentThreadId () returned 0x970 [0065.459] GetCurrentThreadId () returned 0x970 [0065.466] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0065.466] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0065.466] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x37989d8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0065.466] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb248, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0065.466] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb248, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAABmPZN8iV63XdipcOUQ/A7hs7LQ7Sk8YJ7xn7AEzboevOsRN1tTCp4xWocYGvOucVkSmYJNjGVGSPxuw8RKT5bBpJw7ojPElMhxCVZxH6RQlmIhqeEhsh47rQLgamoQ6rh02CgM8QrIHgQoVWnLdzhljZIINKu7UeA0pj9ATLBQFg4UXvKMB6pkv07+efeUyiM2C1mXsJw7l6rERg4mwQqfOdqUbId+rjg==") returned 232 [0065.466] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xc, wMilliseconds=0x2df)) [0065.466] GetCurrentThreadId () returned 0x970 [0065.466] GetCurrentThreadId () returned 0x970 [0065.466] GetCurrentThreadId () returned 0x970 [0065.466] GetCurrentThreadId () returned 0x970 [0065.466] GetCurrentThreadId () returned 0x970 [0065.466] GetCurrentThreadId () returned 0x970 [0065.466] GetCurrentThreadId () returned 0x970 [0065.466] GetCurrentThreadId () returned 0x970 [0065.466] GetCurrentThreadId () returned 0x970 [0065.466] GetCurrentThreadId () returned 0x970 [0065.466] GetCurrentThreadId () returned 0x970 [0065.466] GetCurrentThreadId () returned 0x970 [0065.466] GetCurrentThreadId () returned 0x970 [0065.467] GetCurrentThreadId () returned 0x970 [0065.467] GetCurrentThreadId () returned 0x970 [0065.467] GetCurrentThreadId () returned 0x970 [0065.467] GetCurrentThreadId () returned 0x970 [0065.467] GetCurrentThreadId () returned 0x970 [0065.467] GetCurrentThreadId () returned 0x970 [0065.467] GetCurrentThreadId () returned 0x970 [0065.467] GetCurrentThreadId () returned 0x970 [0065.467] GetCurrentThreadId () returned 0x970 [0065.467] GetCurrentThreadId () returned 0x970 [0065.467] GetCurrentThreadId () returned 0x970 [0065.467] GetCurrentThreadId () returned 0x970 [0065.467] GetCurrentThreadId () returned 0x970 [0065.467] GetCurrentThreadId () returned 0x970 [0065.467] GetCurrentThreadId () returned 0x970 [0065.467] GetCurrentThreadId () returned 0x970 [0065.467] GetCurrentThreadId () returned 0x970 [0065.467] GetCurrentThreadId () returned 0x970 [0065.467] GetCurrentThreadId () returned 0x970 [0065.467] GetCurrentThreadId () returned 0x970 [0065.467] GetCurrentThreadId () returned 0x970 [0065.467] GetCurrentThreadId () returned 0x970 [0065.467] GetCurrentThreadId () returned 0x970 [0065.467] GetCurrentThreadId () returned 0x970 [0065.467] GetCurrentThreadId () returned 0x970 [0065.467] GetCurrentThreadId () returned 0x970 [0065.467] GetCurrentThreadId () returned 0x970 [0065.467] GetCurrentThreadId () returned 0x970 [0065.467] GetCurrentThreadId () returned 0x970 [0065.467] GetCurrentThreadId () returned 0x970 [0065.467] GetCurrentThreadId () returned 0x970 [0065.467] GetCurrentThreadId () returned 0x970 [0065.467] GetCurrentThreadId () returned 0x970 [0065.467] GetCurrentThreadId () returned 0x970 [0065.467] GetCurrentThreadId () returned 0x970 [0065.467] GetCurrentThreadId () returned 0x970 [0065.467] GetCurrentThreadId () returned 0x970 [0065.467] GetCurrentThreadId () returned 0x970 [0065.467] GetCurrentThreadId () returned 0x970 [0065.467] GetCurrentThreadId () returned 0x970 [0065.467] GetCurrentThreadId () returned 0x970 [0065.467] GetCurrentThreadId () returned 0x970 [0065.467] GetCurrentThreadId () returned 0x970 [0065.467] GetCurrentThreadId () returned 0x970 [0065.467] GetCurrentThreadId () returned 0x970 [0065.467] GetCurrentThreadId () returned 0x970 [0065.468] GetCurrentThreadId () returned 0x970 [0065.468] GetCurrentThreadId () returned 0x970 [0065.468] GetCurrentThreadId () returned 0x970 [0065.468] GetCurrentThreadId () returned 0x970 [0065.468] GetCurrentThreadId () returned 0x970 [0065.468] GetCurrentThreadId () returned 0x970 [0065.468] GetCurrentThreadId () returned 0x970 [0065.468] GetCurrentThreadId () returned 0x970 [0065.468] GetCurrentThreadId () returned 0x970 [0065.468] GetCurrentThreadId () returned 0x970 [0065.468] GetCurrentThreadId () returned 0x970 [0065.468] GetCurrentThreadId () returned 0x970 [0065.468] GetCurrentThreadId () returned 0x970 [0065.468] GetCurrentThreadId () returned 0x970 [0065.468] GetCurrentThreadId () returned 0x970 [0065.468] GetCurrentThreadId () returned 0x970 [0065.468] GetCurrentThreadId () returned 0x970 [0065.468] GetCurrentThreadId () returned 0x970 [0065.468] GetCurrentThreadId () returned 0x970 [0065.468] GetCurrentThreadId () returned 0x970 [0065.468] GetCurrentThreadId () returned 0x970 [0065.468] GetCurrentThreadId () returned 0x970 [0065.468] GetCurrentThreadId () returned 0x970 [0065.468] GetCurrentThreadId () returned 0x970 [0065.468] GetCurrentThreadId () returned 0x970 [0065.468] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAABmPZN8iV63XdipcOUQ/A7hs7LQ7Sk8YJ7xn7AEzboevOsRN1tTCp4xWocYGvOucVkSmYJNjGVGSPxuw8RKT5bBpJw7ojPElMhxCVZxH6RQlmIhqeEhsh47rQLgamoQ6rh02CgM8QrIHgQoVWnLdzhljZIINKu7UeA0pj9ATLBQFg4UXvKMB6pkv07+efeUyiM2C1mXsJw7l6rERg4mwQqfOdqUbId+rjg==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0065.468] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAABmPZN8iV63XdipcOUQ/A7hs7LQ7Sk8YJ7xn7AEzboevOsRN1tTCp4xWocYGvOucVkSmYJNjGVGSPxuw8RKT5bBpJw7ojPElMhxCVZxH6RQlmIhqeEhsh47rQLgamoQ6rh02CgM8QrIHgQoVWnLdzhljZIINKu7UeA0pj9ATLBQFg4UXvKMB6pkv07+efeUyiM2C1mXsJw7l6rERg4mwQqfOdqUbId+rjg==", cchWideChar=245, lpMultiByteStr=0x353933c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAABmPZN8iV63XdipcOUQ/A7hs7LQ7Sk8YJ7xn7AEzboevOsRN1tTCp4xWocYGvOucVkSmYJNjGVGSPxuw8RKT5bBpJw7ojPElMhxCVZxH6RQlmIhqeEhsh47rQLgamoQ6rh02CgM8QrIHgQoVWnLdzhljZIINKu7UeA0pj9ATLBQFg4UXvKMB6pkv07+efeUyiM2C1mXsJw7l6rERg4mwQqfOdqUbId+rjg==", lpUsedDefaultChar=0x0) returned 245 [0065.468] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0065.468] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0065.468] CloseHandle (hObject=0x158) returned 1 [0065.469] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BlackRectangle.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\blackrectangle.bmp")) returned 0 [0065.469] GetLastError () returned 0x5 [0065.469] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BlackRectangle.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\blackrectangle.bmp")) returned 0x20 [0065.469] SetLastError (dwErrCode=0x5) [0065.469] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=18573226337) returned 1 [0065.469] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Файл зашифрован [circleround_glass.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\Файл зашифрован [circleround_glass.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0065.469] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0065.469] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0065.469] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0065.469] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0065.469] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0065.470] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0065.470] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0065.470] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0065.470] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0065.470] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0065.470] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0065.470] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0065.470] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0065.470] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0065.470] SetEndOfFile (hFile=0x158) returned 1 [0065.470] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0065.470] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0065.470] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0065.470] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0065.470] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0065.471] WriteFile (in: hFile=0x158, lpBuffer=0x35f035c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f035c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0065.471] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="S73EYszr9+u/BcS\"1ft%bTbY,H\\~c-00", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0065.471] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="S73EYszr9+u/BcS\"1ft%bTbY,H\\~c-00", cchWideChar=32, lpMultiByteStr=0x2036684, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="S73EYszr9+u/BcS\"1ft%bTbY,H\\~c-00", lpUsedDefaultChar=0x0) returned 32 [0065.472] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0065.472] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0065.472] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ebf2297, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ebf2297, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6a91, dwReserved0=0x0, dwReserved1=0x0, cFileName="circleround_glass.png", cAlternateFileName="")) returned 0x295098 [0065.472] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0065.472] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0065.472] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_glass.png")) returned 0x20 [0065.472] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_glass.png")) returned 0x20 [0065.472] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_glass.png")) returned 0x20 [0065.472] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_glass.png")) returned 0x20 [0065.472] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_glass.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ebf2297, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ebf2297, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6a91)) returned 1 [0065.472] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0065.472] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0065.472] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_glass.png")) returned 0x20 [0065.472] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_glass.png")) returned 0x20 [0065.472] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0065.473] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0065.473] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0065.473] SetEndOfFile (hFile=0x158) returned 1 [0065.473] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="circleround_glass.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0065.473] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="circleround_glass.png", cchWideChar=21, lpMultiByteStr=0x1ff88fc, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="circleround_glass.png", lpUsedDefaultChar=0x0) returned 21 [0065.474] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="circleround_glass.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0065.474] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="circleround_glass.png", cchWideChar=21, lpMultiByteStr=0x1ff89ec, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="circleround_glass.png", lpUsedDefaultChar=0x0) returned 21 [0065.474] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff89ec, cbMultiByte=21, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="circleround_glass.pngggngt.pngpngre.pngg") returned 21 [0065.474] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="circleround_glass.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0065.474] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="circleround_glass.png", cchWideChar=21, lpMultiByteStr=0x1ff88fc, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="circleround_glass.png", lpUsedDefaultChar=0x0) returned 21 [0065.474] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_glass.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0065.474] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0065.474] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x6a91 [0065.474] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0065.474] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0065.474] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0065.474] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="circleround_glass.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0065.474] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="circleround_glass.png", cchWideChar=21, lpMultiByteStr=0x1ff88fc, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="circleround_glass.png", lpUsedDefaultChar=0x0) returned 21 [0065.474] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="circleround_glass.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0065.474] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="circleround_glass.png", cchWideChar=21, lpMultiByteStr=0x1ff89ec, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="circleround_glass.png", lpUsedDefaultChar=0x0) returned 21 [0065.474] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff89ec, cbMultiByte=21, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="circleround_glass.pngss.pngggngt.pngpngre.pngg") returned 21 [0065.475] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="circleround_glass.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0065.475] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="circleround_glass.png", cchWideChar=21, lpMultiByteStr=0x1ff88fc, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="circleround_glass.png", lpUsedDefaultChar=0x0) returned 21 [0065.475] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0065.475] CharToOemA (in: pSrc="circleround_glass.png", pDst=0x1ff89ec | out: pDst="circleround_glass.png") returned 1 [0065.475] WriteFile (in: hFile=0x158, lpBuffer=0x1ff89ec*, nNumberOfBytesToWrite=0x15, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1ff89ec*, lpNumberOfBytesWritten=0x18e048*=0x15, lpOverlapped=0x0) returned 1 [0065.476] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0065.476] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0065.476] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0065.476] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=18573933896) returned 1 [0065.476] ReadFile (in: hFile=0x11c, lpBuffer=0x37c6700, nNumberOfBytesToRead=0x6a91, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37c6700*, lpNumberOfBytesRead=0x18dd7c*=0x6a91, lpOverlapped=0x0) returned 1 [0065.478] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0065.478] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=18574129816) returned 1 [0065.486] WriteFile (in: hFile=0x158, lpBuffer=0x379adc8*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379adc8*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0065.487] ReadFile (in: hFile=0x11c, lpBuffer=0x37c6700, nNumberOfBytesToRead=0x6a91, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x37c6700*, lpNumberOfBytesRead=0x18de38*=0x6a91, lpOverlapped=0x0) returned 1 [0065.488] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x50 [0065.488] WriteFile (in: hFile=0x158, lpBuffer=0x380ea20*, nNumberOfBytesToWrite=0x6a91, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x380ea20*, lpNumberOfBytesWritten=0x18de10*=0x6a91, lpOverlapped=0x0) returned 1 [0065.488] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x6ae1 [0065.488] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0065.488] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0065.489] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0065.489] SetFilePointer (in: hFile=0x158, lDistanceToMove=21, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x33 [0065.489] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x6aeb [0065.489] CloseHandle (hObject=0x11c) returned 1 [0065.489] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x6aeb [0065.489] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x6aeb [0065.489] SetFilePointer (in: hFile=0x158, lDistanceToMove=27371, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x6aeb [0065.489] SetFilePointer (in: hFile=0x158, lDistanceToMove=27371, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x6aeb [0065.489] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x6aeb [0065.489] SetFilePointer (in: hFile=0x158, lDistanceToMove=27371, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x6aeb [0065.489] SetEndOfFile (hFile=0x158) returned 1 [0065.489] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x6aeb [0065.489] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x6aeb [0065.489] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="circleround_glass.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0065.490] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="circleround_glass.png", cchWideChar=21, lpMultiByteStr=0x1ff89ec, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="circleround_glass.png", lpUsedDefaultChar=0x0) returned 21 [0065.490] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="circleround_glass.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0065.490] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="circleround_glass.png", cchWideChar=21, lpMultiByteStr=0x1ff88fc, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="circleround_glass.png", lpUsedDefaultChar=0x0) returned 21 [0065.490] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff88fc, cbMultiByte=21, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="circleround_glass.png`") returned 21 [0065.490] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="circleround_glass.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0065.490] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="circleround_glass.png", cchWideChar=21, lpMultiByteStr=0x1ff89ec, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="circleround_glass.png", lpUsedDefaultChar=0x0) returned 21 [0065.490] WriteFile (in: hFile=0x158, lpBuffer=0x37aa1d8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x37aa1d8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0065.490] CharToOemA (in: pSrc="circleround_glass.png", pDst=0x1ff88fc | out: pDst="circleround_glass.png") returned 1 [0065.490] WriteFile (in: hFile=0x158, lpBuffer=0x1ff88fc*, nNumberOfBytesToWrite=0x15, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1ff88fc*, lpNumberOfBytesWritten=0x18efcc*=0x15, lpOverlapped=0x0) returned 1 [0065.490] WriteFile (in: hFile=0x158, lpBuffer=0x379acf8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379acf8*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0065.490] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0065.490] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0065.490] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x6b39 [0065.490] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x6b39 [0065.490] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0065.490] WriteFile (in: hFile=0x158, lpBuffer=0x35f035c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f035c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0065.491] DeleteFileW (lpFileName="") returned 0 [0065.491] GetLastError () returned 0x3 [0065.491] GetFileAttributesW (lpFileName="") returned 0xffffffff [0065.491] SetLastError (dwErrCode=0x3) [0065.491] FlushFileBuffers (hFile=0x158) returned 1 [0065.493] GetCurrentThreadId () returned 0x970 [0065.494] GetCurrentThreadId () returned 0x970 [0065.494] GetCurrentThreadId () returned 0x970 [0065.494] GetCurrentThreadId () returned 0x970 [0065.494] GetCurrentThreadId () returned 0x970 [0065.494] GetCurrentThreadId () returned 0x970 [0065.494] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x6bf0 [0065.494] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x6bf0 [0065.494] SetFilePointer (in: hFile=0x158, lDistanceToMove=27632, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x6bf0 [0065.494] CloseHandle (hObject=0x158) returned 1 [0065.494] GetCurrentThreadId () returned 0x970 [0065.494] GetCurrentThreadId () returned 0x970 [0065.494] GetCurrentThreadId () returned 0x970 [0065.494] GetCurrentThreadId () returned 0x970 [0065.494] GetCurrentThreadId () returned 0x970 [0065.494] GetCurrentThreadId () returned 0x970 [0065.494] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Файл зашифрован [circleround_glass.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\Файл зашифрован [circleround_glass.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0065.494] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6bf0 [0065.494] SetFilePointer (in: hFile=0x158, lDistanceToMove=27504, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6b70 [0065.494] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0065.494] GetFileType (hFile=0x158) returned 0x1 [0065.494] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xc, wMilliseconds=0x2fe)) [0065.494] GetCurrentThreadId () returned 0x970 [0065.495] GetCurrentThreadId () returned 0x970 [0065.495] GetCurrentThreadId () returned 0x970 [0065.495] GetCurrentThreadId () returned 0x970 [0065.495] GetCurrentThreadId () returned 0x970 [0065.495] GetCurrentThreadId () returned 0x970 [0065.495] GetCurrentThreadId () returned 0x970 [0065.495] GetCurrentThreadId () returned 0x970 [0065.495] GetCurrentThreadId () returned 0x970 [0065.495] GetCurrentThreadId () returned 0x970 [0065.495] GetCurrentThreadId () returned 0x970 [0065.495] GetCurrentThreadId () returned 0x970 [0065.495] GetCurrentThreadId () returned 0x970 [0065.495] GetCurrentThreadId () returned 0x970 [0065.495] GetCurrentThreadId () returned 0x970 [0065.495] GetCurrentThreadId () returned 0x970 [0065.495] GetCurrentThreadId () returned 0x970 [0065.495] GetCurrentThreadId () returned 0x970 [0065.495] GetCurrentThreadId () returned 0x970 [0065.495] GetCurrentThreadId () returned 0x970 [0065.495] GetCurrentThreadId () returned 0x970 [0065.495] GetCurrentThreadId () returned 0x970 [0065.495] GetCurrentThreadId () returned 0x970 [0065.495] GetCurrentThreadId () returned 0x970 [0065.495] GetCurrentThreadId () returned 0x970 [0065.495] GetCurrentThreadId () returned 0x970 [0065.495] GetCurrentThreadId () returned 0x970 [0065.495] GetCurrentThreadId () returned 0x970 [0065.495] GetCurrentThreadId () returned 0x970 [0065.495] GetCurrentThreadId () returned 0x970 [0065.495] GetCurrentThreadId () returned 0x970 [0065.495] GetCurrentThreadId () returned 0x970 [0065.495] GetCurrentThreadId () returned 0x970 [0065.495] GetCurrentThreadId () returned 0x970 [0065.495] GetCurrentThreadId () returned 0x970 [0065.495] GetCurrentThreadId () returned 0x970 [0065.495] GetCurrentThreadId () returned 0x970 [0065.495] GetCurrentThreadId () returned 0x970 [0065.495] GetCurrentThreadId () returned 0x970 [0065.495] GetCurrentThreadId () returned 0x970 [0065.495] GetCurrentThreadId () returned 0x970 [0065.495] GetCurrentThreadId () returned 0x970 [0065.495] GetCurrentThreadId () returned 0x970 [0065.495] GetCurrentThreadId () returned 0x970 [0065.495] GetCurrentThreadId () returned 0x970 [0065.495] GetCurrentThreadId () returned 0x970 [0065.496] GetCurrentThreadId () returned 0x970 [0065.496] GetCurrentThreadId () returned 0x970 [0065.496] GetCurrentThreadId () returned 0x970 [0065.496] GetCurrentThreadId () returned 0x970 [0065.496] GetCurrentThreadId () returned 0x970 [0065.496] GetCurrentThreadId () returned 0x970 [0065.496] GetCurrentThreadId () returned 0x970 [0065.496] GetCurrentThreadId () returned 0x970 [0065.496] GetCurrentThreadId () returned 0x970 [0065.496] GetCurrentThreadId () returned 0x970 [0065.496] GetCurrentThreadId () returned 0x970 [0065.496] GetCurrentThreadId () returned 0x970 [0065.496] GetCurrentThreadId () returned 0x970 [0065.496] GetCurrentThreadId () returned 0x970 [0065.496] GetCurrentThreadId () returned 0x970 [0065.496] GetCurrentThreadId () returned 0x970 [0065.496] GetCurrentThreadId () returned 0x970 [0065.496] GetCurrentThreadId () returned 0x970 [0065.496] GetCurrentThreadId () returned 0x970 [0065.496] GetCurrentThreadId () returned 0x970 [0065.496] GetCurrentThreadId () returned 0x970 [0065.496] GetCurrentThreadId () returned 0x970 [0065.496] GetCurrentThreadId () returned 0x970 [0065.496] GetCurrentThreadId () returned 0x970 [0065.496] GetCurrentThreadId () returned 0x970 [0065.496] GetCurrentThreadId () returned 0x970 [0065.496] GetCurrentThreadId () returned 0x970 [0065.496] GetCurrentThreadId () returned 0x970 [0065.496] GetCurrentThreadId () returned 0x970 [0065.496] GetCurrentThreadId () returned 0x970 [0065.496] GetCurrentThreadId () returned 0x970 [0065.496] GetCurrentThreadId () returned 0x970 [0065.496] GetCurrentThreadId () returned 0x970 [0065.496] GetCurrentThreadId () returned 0x970 [0065.496] GetCurrentThreadId () returned 0x970 [0065.496] GetCurrentThreadId () returned 0x970 [0065.496] GetCurrentThreadId () returned 0x970 [0065.496] GetCurrentThreadId () returned 0x970 [0065.496] GetCurrentThreadId () returned 0x970 [0065.496] GetCurrentThreadId () returned 0x970 [0065.496] GetCurrentThreadId () returned 0x970 [0065.496] GetCurrentThreadId () returned 0x970 [0065.496] GetCurrentThreadId () returned 0x970 [0065.496] GetCurrentThreadId () returned 0x970 [0065.496] GetCurrentThreadId () returned 0x970 [0065.497] GetCurrentThreadId () returned 0x970 [0065.497] GetCurrentThreadId () returned 0x970 [0065.497] GetCurrentThreadId () returned 0x970 [0065.497] GetCurrentThreadId () returned 0x970 [0065.497] GetCurrentThreadId () returned 0x970 [0065.497] GetCurrentThreadId () returned 0x970 [0065.497] GetCurrentThreadId () returned 0x970 [0065.497] GetCurrentThreadId () returned 0x970 [0065.497] GetCurrentThreadId () returned 0x970 [0065.497] GetCurrentThreadId () returned 0x970 [0065.497] GetCurrentThreadId () returned 0x970 [0065.497] GetCurrentThreadId () returned 0x970 [0065.497] GetCurrentThreadId () returned 0x970 [0065.497] GetCurrentThreadId () returned 0x970 [0065.497] GetCurrentThreadId () returned 0x970 [0065.497] GetCurrentThreadId () returned 0x970 [0065.497] GetCurrentThreadId () returned 0x970 [0065.497] GetCurrentThreadId () returned 0x970 [0065.497] GetCurrentThreadId () returned 0x970 [0065.497] GetCurrentThreadId () returned 0x970 [0065.497] GetCurrentThreadId () returned 0x970 [0065.497] GetCurrentThreadId () returned 0x970 [0065.497] GetCurrentThreadId () returned 0x970 [0065.497] GetCurrentThreadId () returned 0x970 [0065.497] GetCurrentThreadId () returned 0x970 [0065.497] GetCurrentThreadId () returned 0x970 [0065.497] GetCurrentThreadId () returned 0x970 [0065.497] GetCurrentThreadId () returned 0x970 [0065.497] GetCurrentThreadId () returned 0x970 [0065.497] GetCurrentThreadId () returned 0x970 [0065.497] GetCurrentThreadId () returned 0x970 [0065.497] GetCurrentThreadId () returned 0x970 [0065.497] GetCurrentThreadId () returned 0x970 [0065.497] GetCurrentThreadId () returned 0x970 [0065.497] GetCurrentThreadId () returned 0x970 [0065.497] GetCurrentThreadId () returned 0x970 [0065.497] GetCurrentThreadId () returned 0x970 [0065.497] GetCurrentThreadId () returned 0x970 [0065.497] GetCurrentThreadId () returned 0x970 [0065.497] GetCurrentThreadId () returned 0x970 [0065.497] GetCurrentThreadId () returned 0x970 [0065.497] GetCurrentThreadId () returned 0x970 [0065.497] GetCurrentThreadId () returned 0x970 [0065.497] GetCurrentThreadId () returned 0x970 [0065.497] GetCurrentThreadId () returned 0x970 [0065.498] GetCurrentThreadId () returned 0x970 [0065.498] GetCurrentThreadId () returned 0x970 [0065.498] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.498] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.498] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379bbf8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.498] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.498] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.498] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379bbf8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.498] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.498] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.498] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.498] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.498] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.498] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.498] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.498] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.498] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379bc58, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.498] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.498] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.498] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379bc58, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.498] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.498] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.498] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379bc58, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.498] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xc, wMilliseconds=0x2fe)) [0065.498] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="S73EYszr9+u/BcS\"1ft%bTbY,H\\~c-00", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0065.498] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="S73EYszr9+u/BcS\"1ft%bTbY,H\\~c-00", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0065.498] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="S73EYszr9+u/BcS\"1ft%bTbY,H\\~c-00", cchWideChar=32, lpMultiByteStr=0x2003c28, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="S73EYszr9+u/BcS\"1ft%bTbY,H\\~c-00", lpUsedDefaultChar=0x0) returned 32 [0065.498] GetCurrentThreadId () returned 0x970 [0065.498] GetCurrentThreadId () returned 0x970 [0065.498] GetCurrentThreadId () returned 0x970 [0065.498] GetCurrentThreadId () returned 0x970 [0065.498] GetCurrentThreadId () returned 0x970 [0065.499] GetCurrentThreadId () returned 0x970 [0065.507] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0065.507] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0065.507] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3798ac8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0065.507] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb248, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0065.507] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb248, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAIHjG/jY6ZSTTUUai6KE0PzxxliVTig7G85LIIx6xgeuI1PChe2DUiQn2FyCijQMy4vWThelpgioRJnEI+6KDBd+o17W3IWIaOneuSYSk4PH92nl3VE4WeUrNzW9pwk1ui3QRRqdcsdiQgrdlwncrBCKRTCS608Ewjb86HEzir+9gkG3VJx2lqEgD2imM/PhCe/Iq3sIWDo+PMmvVPS4/e/BI4iNTlmNhQ==") returned 232 [0065.507] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xc, wMilliseconds=0x30e)) [0065.507] GetCurrentThreadId () returned 0x970 [0065.507] GetCurrentThreadId () returned 0x970 [0065.507] GetCurrentThreadId () returned 0x970 [0065.507] GetCurrentThreadId () returned 0x970 [0065.507] GetCurrentThreadId () returned 0x970 [0065.507] GetCurrentThreadId () returned 0x970 [0065.507] GetCurrentThreadId () returned 0x970 [0065.507] GetCurrentThreadId () returned 0x970 [0065.507] GetCurrentThreadId () returned 0x970 [0065.507] GetCurrentThreadId () returned 0x970 [0065.507] GetCurrentThreadId () returned 0x970 [0065.507] GetCurrentThreadId () returned 0x970 [0065.507] GetCurrentThreadId () returned 0x970 [0065.508] GetCurrentThreadId () returned 0x970 [0065.508] GetCurrentThreadId () returned 0x970 [0065.508] GetCurrentThreadId () returned 0x970 [0065.508] GetCurrentThreadId () returned 0x970 [0065.508] GetCurrentThreadId () returned 0x970 [0065.508] GetCurrentThreadId () returned 0x970 [0065.508] GetCurrentThreadId () returned 0x970 [0065.508] GetCurrentThreadId () returned 0x970 [0065.508] GetCurrentThreadId () returned 0x970 [0065.508] GetCurrentThreadId () returned 0x970 [0065.508] GetCurrentThreadId () returned 0x970 [0065.508] GetCurrentThreadId () returned 0x970 [0065.508] GetCurrentThreadId () returned 0x970 [0065.508] GetCurrentThreadId () returned 0x970 [0065.508] GetCurrentThreadId () returned 0x970 [0065.508] GetCurrentThreadId () returned 0x970 [0065.508] GetCurrentThreadId () returned 0x970 [0065.508] GetCurrentThreadId () returned 0x970 [0065.508] GetCurrentThreadId () returned 0x970 [0065.508] GetCurrentThreadId () returned 0x970 [0065.508] GetCurrentThreadId () returned 0x970 [0065.508] GetCurrentThreadId () returned 0x970 [0065.508] GetCurrentThreadId () returned 0x970 [0065.508] GetCurrentThreadId () returned 0x970 [0065.508] GetCurrentThreadId () returned 0x970 [0065.508] GetCurrentThreadId () returned 0x970 [0065.508] GetCurrentThreadId () returned 0x970 [0065.508] GetCurrentThreadId () returned 0x970 [0065.508] GetCurrentThreadId () returned 0x970 [0065.508] GetCurrentThreadId () returned 0x970 [0065.508] GetCurrentThreadId () returned 0x970 [0065.508] GetCurrentThreadId () returned 0x970 [0065.508] GetCurrentThreadId () returned 0x970 [0065.508] GetCurrentThreadId () returned 0x970 [0065.508] GetCurrentThreadId () returned 0x970 [0065.508] GetCurrentThreadId () returned 0x970 [0065.508] GetCurrentThreadId () returned 0x970 [0065.508] GetCurrentThreadId () returned 0x970 [0065.508] GetCurrentThreadId () returned 0x970 [0065.508] GetCurrentThreadId () returned 0x970 [0065.508] GetCurrentThreadId () returned 0x970 [0065.508] GetCurrentThreadId () returned 0x970 [0065.508] GetCurrentThreadId () returned 0x970 [0065.508] GetCurrentThreadId () returned 0x970 [0065.508] GetCurrentThreadId () returned 0x970 [0065.509] GetCurrentThreadId () returned 0x970 [0065.509] GetCurrentThreadId () returned 0x970 [0065.509] GetCurrentThreadId () returned 0x970 [0065.509] GetCurrentThreadId () returned 0x970 [0065.509] GetCurrentThreadId () returned 0x970 [0065.509] GetCurrentThreadId () returned 0x970 [0065.509] GetCurrentThreadId () returned 0x970 [0065.509] GetCurrentThreadId () returned 0x970 [0065.509] GetCurrentThreadId () returned 0x970 [0065.509] GetCurrentThreadId () returned 0x970 [0065.509] GetCurrentThreadId () returned 0x970 [0065.509] GetCurrentThreadId () returned 0x970 [0065.509] GetCurrentThreadId () returned 0x970 [0065.509] GetCurrentThreadId () returned 0x970 [0065.509] GetCurrentThreadId () returned 0x970 [0065.509] GetCurrentThreadId () returned 0x970 [0065.509] GetCurrentThreadId () returned 0x970 [0065.509] GetCurrentThreadId () returned 0x970 [0065.509] GetCurrentThreadId () returned 0x970 [0065.509] GetCurrentThreadId () returned 0x970 [0065.509] GetCurrentThreadId () returned 0x970 [0065.509] GetCurrentThreadId () returned 0x970 [0065.509] GetCurrentThreadId () returned 0x970 [0065.509] GetCurrentThreadId () returned 0x970 [0065.509] GetCurrentThreadId () returned 0x970 [0065.509] GetCurrentThreadId () returned 0x970 [0065.509] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAIHjG/jY6ZSTTUUai6KE0PzxxliVTig7G85LIIx6xgeuI1PChe2DUiQn2FyCijQMy4vWThelpgioRJnEI+6KDBd+o17W3IWIaOneuSYSk4PH92nl3VE4WeUrNzW9pwk1ui3QRRqdcsdiQgrdlwncrBCKRTCS608Ewjb86HEzir+9gkG3VJx2lqEgD2imM/PhCe/Iq3sIWDo+PMmvVPS4/e/BI4iNTlmNhQ==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0065.509] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAIHjG/jY6ZSTTUUai6KE0PzxxliVTig7G85LIIx6xgeuI1PChe2DUiQn2FyCijQMy4vWThelpgioRJnEI+6KDBd+o17W3IWIaOneuSYSk4PH92nl3VE4WeUrNzW9pwk1ui3QRRqdcsdiQgrdlwncrBCKRTCS608Ewjb86HEzir+9gkG3VJx2lqEgD2imM/PhCe/Iq3sIWDo+PMmvVPS4/e/BI4iNTlmNhQ==", cchWideChar=245, lpMultiByteStr=0x353933c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAIHjG/jY6ZSTTUUai6KE0PzxxliVTig7G85LIIx6xgeuI1PChe2DUiQn2FyCijQMy4vWThelpgioRJnEI+6KDBd+o17W3IWIaOneuSYSk4PH92nl3VE4WeUrNzW9pwk1ui3QRRqdcsdiQgrdlwncrBCKRTCS608Ewjb86HEzir+9gkG3VJx2lqEgD2imM/PhCe/Iq3sIWDo+PMmvVPS4/e/BI4iNTlmNhQ==", lpUsedDefaultChar=0x0) returned 245 [0065.509] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0065.509] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0065.509] CloseHandle (hObject=0x158) returned 1 [0065.510] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_glass.png")) returned 0 [0065.510] GetLastError () returned 0x5 [0065.510] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_glass.png")) returned 0x20 [0065.510] SetLastError (dwErrCode=0x5) [0065.510] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=18577330800) returned 1 [0065.510] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Файл зашифрован [circleround_selectionsubpicture.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\Файл зашифрован [circleround_selectionsubpicture.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0065.510] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0065.510] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0065.511] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0065.511] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0065.511] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0065.511] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0065.511] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0065.511] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0065.511] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0065.511] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0065.511] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0065.511] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0065.511] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0065.511] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0065.511] SetEndOfFile (hFile=0x158) returned 1 [0065.511] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0065.511] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0065.511] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0065.511] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0065.512] WriteFile (in: hFile=0x158, lpBuffer=0x3777058*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777058*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0065.512] WriteFile (in: hFile=0x158, lpBuffer=0x35f04dc*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f04dc*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0065.513] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="aOh+UyW8UF#2*IsSvC,=hZF2?(OlIf#&", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0065.513] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="aOh+UyW8UF#2*IsSvC,=hZF2?(OlIf#&", cchWideChar=32, lpMultiByteStr=0x20360d4, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aOh+UyW8UF#2*IsSvC,=hZF2?(OlIf#&", lpUsedDefaultChar=0x0) returned 32 [0065.513] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0065.513] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0065.513] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ebf2297, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ebf2297, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf26, dwReserved0=0x0, dwReserved1=0x0, cFileName="circleround_selectionsubpicture.png", cAlternateFileName="")) returned 0x295098 [0065.513] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0065.513] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0065.513] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_selectionsubpicture.png")) returned 0x20 [0065.514] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_selectionsubpicture.png")) returned 0x20 [0065.514] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_selectionsubpicture.png")) returned 0x20 [0065.514] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_selectionsubpicture.png")) returned 0x20 [0065.514] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_selectionsubpicture.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ebf2297, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ebf2297, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf26)) returned 1 [0065.514] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0065.514] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0065.514] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_selectionsubpicture.png")) returned 0x20 [0065.514] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_selectionsubpicture.png")) returned 0x20 [0065.514] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0065.514] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0065.515] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0065.515] SetEndOfFile (hFile=0x158) returned 1 [0065.515] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="circleround_selectionsubpicture.png", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0065.515] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="circleround_selectionsubpicture.png", cchWideChar=35, lpMultiByteStr=0x20365dc, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="circleround_selectionsubpicture.png", lpUsedDefaultChar=0x0) returned 35 [0065.516] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="circleround_selectionsubpicture.png", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0065.516] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="circleround_selectionsubpicture.png", cchWideChar=35, lpMultiByteStr=0x20365a4, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="circleround_selectionsubpicture.png", lpUsedDefaultChar=0x0) returned 35 [0065.516] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x20365a4, cbMultiByte=35, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="circleround_selectionsubpicture.png.pngg") returned 35 [0065.516] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="circleround_selectionsubpicture.png", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0065.516] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="circleround_selectionsubpicture.png", cchWideChar=35, lpMultiByteStr=0x20365dc, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="circleround_selectionsubpicture.png", lpUsedDefaultChar=0x0) returned 35 [0065.516] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0065.516] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0065.516] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0xf26 [0065.516] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0065.516] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0065.516] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0065.516] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="circleround_selectionsubpicture.png", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0065.516] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="circleround_selectionsubpicture.png", cchWideChar=35, lpMultiByteStr=0x20365dc, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="circleround_selectionsubpicture.png", lpUsedDefaultChar=0x0) returned 35 [0065.516] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="circleround_selectionsubpicture.png", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0065.516] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="circleround_selectionsubpicture.png", cchWideChar=35, lpMultiByteStr=0x20365a4, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="circleround_selectionsubpicture.png", lpUsedDefaultChar=0x0) returned 35 [0065.517] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x20365a4, cbMultiByte=35, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="circleround_selectionsubpicture.pngre.png.pngg") returned 35 [0065.517] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="circleround_selectionsubpicture.png", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0065.517] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="circleround_selectionsubpicture.png", cchWideChar=35, lpMultiByteStr=0x20365dc, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="circleround_selectionsubpicture.png", lpUsedDefaultChar=0x0) returned 35 [0065.517] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0065.518] CharToOemA (in: pSrc="circleround_selectionsubpicture.png", pDst=0x20365a4 | out: pDst="circleround_selectionsubpicture.png") returned 1 [0065.518] WriteFile (in: hFile=0x158, lpBuffer=0x20365a4*, nNumberOfBytesToWrite=0x23, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x20365a4*, lpNumberOfBytesWritten=0x18e048*=0x23, lpOverlapped=0x0) returned 1 [0065.518] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0065.518] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0065.518] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0065.518] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=18578143105) returned 1 [0065.518] ReadFile (in: hFile=0x11c, lpBuffer=0x37c6700, nNumberOfBytesToRead=0xf26, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37c6700*, lpNumberOfBytesRead=0x18dd7c*=0xf26, lpOverlapped=0x0) returned 1 [0065.520] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0065.520] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=18578322067) returned 1 [0065.528] WriteFile (in: hFile=0x158, lpBuffer=0x379ad80*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379ad80*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0065.529] ReadFile (in: hFile=0x11c, lpBuffer=0x37c6700, nNumberOfBytesToRead=0xf26, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x37c6700*, lpNumberOfBytesRead=0x18de38*=0xf26, lpOverlapped=0x0) returned 1 [0065.529] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x5e [0065.529] WriteFile (in: hFile=0x158, lpBuffer=0x3808e20*, nNumberOfBytesToWrite=0xf26, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3808e20*, lpNumberOfBytesWritten=0x18de10*=0xf26, lpOverlapped=0x0) returned 1 [0065.529] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0xf84 [0065.529] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0065.529] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0065.529] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0065.529] SetFilePointer (in: hFile=0x158, lDistanceToMove=35, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x41 [0065.529] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0xf8e [0065.529] CloseHandle (hObject=0x11c) returned 1 [0065.530] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xf8e [0065.530] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xf8e [0065.530] SetFilePointer (in: hFile=0x158, lDistanceToMove=3982, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xf8e [0065.530] SetFilePointer (in: hFile=0x158, lDistanceToMove=3982, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0xf8e [0065.530] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xf8e [0065.530] SetFilePointer (in: hFile=0x158, lDistanceToMove=3982, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0xf8e [0065.530] SetEndOfFile (hFile=0x158) returned 1 [0065.530] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xf8e [0065.530] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xf8e [0065.530] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="circleround_selectionsubpicture.png", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0065.530] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="circleround_selectionsubpicture.png", cchWideChar=35, lpMultiByteStr=0x20365a4, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="circleround_selectionsubpicture.png", lpUsedDefaultChar=0x0) returned 35 [0065.530] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="circleround_selectionsubpicture.png", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0065.530] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="circleround_selectionsubpicture.png", cchWideChar=35, lpMultiByteStr=0x20365dc, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="circleround_selectionsubpicture.png", lpUsedDefaultChar=0x0) returned 35 [0065.530] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x20365dc, cbMultiByte=35, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="circleround_selectionsubpicture.png") returned 35 [0065.530] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="circleround_selectionsubpicture.png", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0065.530] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="circleround_selectionsubpicture.png", cchWideChar=35, lpMultiByteStr=0x20365a4, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="circleround_selectionsubpicture.png", lpUsedDefaultChar=0x0) returned 35 [0065.530] WriteFile (in: hFile=0x158, lpBuffer=0x37aa1d8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x37aa1d8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0065.531] CharToOemA (in: pSrc="circleround_selectionsubpicture.png", pDst=0x20365dc | out: pDst="circleround_selectionsubpicture.png") returned 1 [0065.531] WriteFile (in: hFile=0x158, lpBuffer=0x20365dc*, nNumberOfBytesToWrite=0x23, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x20365dc*, lpNumberOfBytesWritten=0x18efcc*=0x23, lpOverlapped=0x0) returned 1 [0065.531] WriteFile (in: hFile=0x158, lpBuffer=0x379ad58*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379ad58*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0065.531] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0065.531] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0065.531] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xfea [0065.531] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xfea [0065.531] WriteFile (in: hFile=0x158, lpBuffer=0x3777058*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777058*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0065.531] WriteFile (in: hFile=0x158, lpBuffer=0x35f04dc*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f04dc*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0065.531] DeleteFileW (lpFileName="") returned 0 [0065.531] GetLastError () returned 0x3 [0065.531] GetFileAttributesW (lpFileName="") returned 0xffffffff [0065.531] SetLastError (dwErrCode=0x3) [0065.531] FlushFileBuffers (hFile=0x158) returned 1 [0065.534] GetCurrentThreadId () returned 0x970 [0065.534] GetCurrentThreadId () returned 0x970 [0065.534] GetCurrentThreadId () returned 0x970 [0065.534] GetCurrentThreadId () returned 0x970 [0065.534] GetCurrentThreadId () returned 0x970 [0065.534] GetCurrentThreadId () returned 0x970 [0065.534] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x10a1 [0065.534] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x10a1 [0065.534] SetFilePointer (in: hFile=0x158, lDistanceToMove=4257, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x10a1 [0065.534] CloseHandle (hObject=0x158) returned 1 [0065.534] GetCurrentThreadId () returned 0x970 [0065.534] GetCurrentThreadId () returned 0x970 [0065.534] GetCurrentThreadId () returned 0x970 [0065.534] GetCurrentThreadId () returned 0x970 [0065.534] GetCurrentThreadId () returned 0x970 [0065.534] GetCurrentThreadId () returned 0x970 [0065.535] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Файл зашифрован [circleround_selectionsubpicture.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\Файл зашифрован [circleround_selectionsubpicture.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0065.535] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10a1 [0065.535] SetFilePointer (in: hFile=0x158, lDistanceToMove=4129, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1021 [0065.535] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0065.535] GetFileType (hFile=0x158) returned 0x1 [0065.535] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xc, wMilliseconds=0x32d)) [0065.535] GetCurrentThreadId () returned 0x970 [0065.535] GetCurrentThreadId () returned 0x970 [0065.535] GetCurrentThreadId () returned 0x970 [0065.535] GetCurrentThreadId () returned 0x970 [0065.535] GetCurrentThreadId () returned 0x970 [0065.535] GetCurrentThreadId () returned 0x970 [0065.535] GetCurrentThreadId () returned 0x970 [0065.535] GetCurrentThreadId () returned 0x970 [0065.535] GetCurrentThreadId () returned 0x970 [0065.535] GetCurrentThreadId () returned 0x970 [0065.535] GetCurrentThreadId () returned 0x970 [0065.535] GetCurrentThreadId () returned 0x970 [0065.535] GetCurrentThreadId () returned 0x970 [0065.535] GetCurrentThreadId () returned 0x970 [0065.535] GetCurrentThreadId () returned 0x970 [0065.535] GetCurrentThreadId () returned 0x970 [0065.535] GetCurrentThreadId () returned 0x970 [0065.535] GetCurrentThreadId () returned 0x970 [0065.535] GetCurrentThreadId () returned 0x970 [0065.535] GetCurrentThreadId () returned 0x970 [0065.535] GetCurrentThreadId () returned 0x970 [0065.535] GetCurrentThreadId () returned 0x970 [0065.535] GetCurrentThreadId () returned 0x970 [0065.535] GetCurrentThreadId () returned 0x970 [0065.535] GetCurrentThreadId () returned 0x970 [0065.535] GetCurrentThreadId () returned 0x970 [0065.535] GetCurrentThreadId () returned 0x970 [0065.535] GetCurrentThreadId () returned 0x970 [0065.536] GetCurrentThreadId () returned 0x970 [0065.536] GetCurrentThreadId () returned 0x970 [0065.536] GetCurrentThreadId () returned 0x970 [0065.536] GetCurrentThreadId () returned 0x970 [0065.536] GetCurrentThreadId () returned 0x970 [0065.536] GetCurrentThreadId () returned 0x970 [0065.536] GetCurrentThreadId () returned 0x970 [0065.536] GetCurrentThreadId () returned 0x970 [0065.536] GetCurrentThreadId () returned 0x970 [0065.536] GetCurrentThreadId () returned 0x970 [0065.536] GetCurrentThreadId () returned 0x970 [0065.536] GetCurrentThreadId () returned 0x970 [0065.536] GetCurrentThreadId () returned 0x970 [0065.536] GetCurrentThreadId () returned 0x970 [0065.536] GetCurrentThreadId () returned 0x970 [0065.536] GetCurrentThreadId () returned 0x970 [0065.536] GetCurrentThreadId () returned 0x970 [0065.536] GetCurrentThreadId () returned 0x970 [0065.536] GetCurrentThreadId () returned 0x970 [0065.536] GetCurrentThreadId () returned 0x970 [0065.536] GetCurrentThreadId () returned 0x970 [0065.536] GetCurrentThreadId () returned 0x970 [0065.536] GetCurrentThreadId () returned 0x970 [0065.536] GetCurrentThreadId () returned 0x970 [0065.536] GetCurrentThreadId () returned 0x970 [0065.536] GetCurrentThreadId () returned 0x970 [0065.536] GetCurrentThreadId () returned 0x970 [0065.536] GetCurrentThreadId () returned 0x970 [0065.536] GetCurrentThreadId () returned 0x970 [0065.536] GetCurrentThreadId () returned 0x970 [0065.536] GetCurrentThreadId () returned 0x970 [0065.536] GetCurrentThreadId () returned 0x970 [0065.536] GetCurrentThreadId () returned 0x970 [0065.536] GetCurrentThreadId () returned 0x970 [0065.536] GetCurrentThreadId () returned 0x970 [0065.536] GetCurrentThreadId () returned 0x970 [0065.536] GetCurrentThreadId () returned 0x970 [0065.536] GetCurrentThreadId () returned 0x970 [0065.536] GetCurrentThreadId () returned 0x970 [0065.536] GetCurrentThreadId () returned 0x970 [0065.536] GetCurrentThreadId () returned 0x970 [0065.536] GetCurrentThreadId () returned 0x970 [0065.536] GetCurrentThreadId () returned 0x970 [0065.536] GetCurrentThreadId () returned 0x970 [0065.536] GetCurrentThreadId () returned 0x970 [0065.536] GetCurrentThreadId () returned 0x970 [0065.537] GetCurrentThreadId () returned 0x970 [0065.537] GetCurrentThreadId () returned 0x970 [0065.537] GetCurrentThreadId () returned 0x970 [0065.537] GetCurrentThreadId () returned 0x970 [0065.537] GetCurrentThreadId () returned 0x970 [0065.537] GetCurrentThreadId () returned 0x970 [0065.537] GetCurrentThreadId () returned 0x970 [0065.537] GetCurrentThreadId () returned 0x970 [0065.537] GetCurrentThreadId () returned 0x970 [0065.537] GetCurrentThreadId () returned 0x970 [0065.537] GetCurrentThreadId () returned 0x970 [0065.537] GetCurrentThreadId () returned 0x970 [0065.537] GetCurrentThreadId () returned 0x970 [0065.537] GetCurrentThreadId () returned 0x970 [0065.537] GetCurrentThreadId () returned 0x970 [0065.537] GetCurrentThreadId () returned 0x970 [0065.537] GetCurrentThreadId () returned 0x970 [0065.537] GetCurrentThreadId () returned 0x970 [0065.537] GetCurrentThreadId () returned 0x970 [0065.537] GetCurrentThreadId () returned 0x970 [0065.537] GetCurrentThreadId () returned 0x970 [0065.537] GetCurrentThreadId () returned 0x970 [0065.537] GetCurrentThreadId () returned 0x970 [0065.537] GetCurrentThreadId () returned 0x970 [0065.537] GetCurrentThreadId () returned 0x970 [0065.537] GetCurrentThreadId () returned 0x970 [0065.537] GetCurrentThreadId () returned 0x970 [0065.537] GetCurrentThreadId () returned 0x970 [0065.537] GetCurrentThreadId () returned 0x970 [0065.537] GetCurrentThreadId () returned 0x970 [0065.537] GetCurrentThreadId () returned 0x970 [0065.537] GetCurrentThreadId () returned 0x970 [0065.537] GetCurrentThreadId () returned 0x970 [0065.537] GetCurrentThreadId () returned 0x970 [0065.537] GetCurrentThreadId () returned 0x970 [0065.537] GetCurrentThreadId () returned 0x970 [0065.537] GetCurrentThreadId () returned 0x970 [0065.537] GetCurrentThreadId () returned 0x970 [0065.537] GetCurrentThreadId () returned 0x970 [0065.537] GetCurrentThreadId () returned 0x970 [0065.537] GetCurrentThreadId () returned 0x970 [0065.537] GetCurrentThreadId () returned 0x970 [0065.537] GetCurrentThreadId () returned 0x970 [0065.537] GetCurrentThreadId () returned 0x970 [0065.538] GetCurrentThreadId () returned 0x970 [0065.538] GetCurrentThreadId () returned 0x970 [0065.538] GetCurrentThreadId () returned 0x970 [0065.538] GetCurrentThreadId () returned 0x970 [0065.538] GetCurrentThreadId () returned 0x970 [0065.538] GetCurrentThreadId () returned 0x970 [0065.538] GetCurrentThreadId () returned 0x970 [0065.538] GetCurrentThreadId () returned 0x970 [0065.538] GetCurrentThreadId () returned 0x970 [0065.538] GetCurrentThreadId () returned 0x970 [0065.538] GetCurrentThreadId () returned 0x970 [0065.538] GetCurrentThreadId () returned 0x970 [0065.538] GetCurrentThreadId () returned 0x970 [0065.538] GetCurrentThreadId () returned 0x970 [0065.538] GetCurrentThreadId () returned 0x970 [0065.538] GetCurrentThreadId () returned 0x970 [0065.538] GetCurrentThreadId () returned 0x970 [0065.538] GetCurrentThreadId () returned 0x970 [0065.538] GetCurrentThreadId () returned 0x970 [0065.538] GetCurrentThreadId () returned 0x970 [0065.538] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.538] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.538] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379bc58, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.538] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.538] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.538] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379bc58, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.538] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.538] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.538] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.538] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.538] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.538] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.538] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.538] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.538] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379bcb8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.538] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.538] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.538] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379bcb8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.539] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.539] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.539] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379bcb8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.539] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xc, wMilliseconds=0x32d)) [0065.539] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="aOh+UyW8UF#2*IsSvC,=hZF2?(OlIf#&", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0065.539] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="aOh+UyW8UF#2*IsSvC,=hZF2?(OlIf#&", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0065.539] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="aOh+UyW8UF#2*IsSvC,=hZF2?(OlIf#&", cchWideChar=32, lpMultiByteStr=0x2003c58, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aOh+UyW8UF#2*IsSvC,=hZF2?(OlIf#&", lpUsedDefaultChar=0x0) returned 32 [0065.539] GetCurrentThreadId () returned 0x970 [0065.539] GetCurrentThreadId () returned 0x970 [0065.539] GetCurrentThreadId () returned 0x970 [0065.539] GetCurrentThreadId () returned 0x970 [0065.539] GetCurrentThreadId () returned 0x970 [0065.539] GetCurrentThreadId () returned 0x970 [0065.546] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0065.546] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0065.546] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3798c58, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0065.546] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb448, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0065.546] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb448, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAADJRT/rrNJj3c1i+HJ7ybQDprF3zYJ9N3w2NpOGAho4aMPKykUYxno2rILu6LcWyrfp7whF+ZSJYYCInkctyFaRS0ImZNJnCjDMgvGGxLLhavv2RaWhLM96biWTw5q5UqSrpLUt7vLzuImxxpCHK1C+MtCvAvgjsb1guZJUn9x3l3ISl8ZpgrII//6z7qAlm+dJ1dbCVR5iqrXty6Rb17vUm9JwbNEtMxw==") returned 232 [0065.547] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xc, wMilliseconds=0x32d)) [0065.547] GetCurrentThreadId () returned 0x970 [0065.547] GetCurrentThreadId () returned 0x970 [0065.547] GetCurrentThreadId () returned 0x970 [0065.547] GetCurrentThreadId () returned 0x970 [0065.547] GetCurrentThreadId () returned 0x970 [0065.547] GetCurrentThreadId () returned 0x970 [0065.547] GetCurrentThreadId () returned 0x970 [0065.547] GetCurrentThreadId () returned 0x970 [0065.547] GetCurrentThreadId () returned 0x970 [0065.547] GetCurrentThreadId () returned 0x970 [0065.547] GetCurrentThreadId () returned 0x970 [0065.547] GetCurrentThreadId () returned 0x970 [0065.547] GetCurrentThreadId () returned 0x970 [0065.547] GetCurrentThreadId () returned 0x970 [0065.547] GetCurrentThreadId () returned 0x970 [0065.547] GetCurrentThreadId () returned 0x970 [0065.547] GetCurrentThreadId () returned 0x970 [0065.547] GetCurrentThreadId () returned 0x970 [0065.547] GetCurrentThreadId () returned 0x970 [0065.547] GetCurrentThreadId () returned 0x970 [0065.547] GetCurrentThreadId () returned 0x970 [0065.547] GetCurrentThreadId () returned 0x970 [0065.547] GetCurrentThreadId () returned 0x970 [0065.547] GetCurrentThreadId () returned 0x970 [0065.547] GetCurrentThreadId () returned 0x970 [0065.547] GetCurrentThreadId () returned 0x970 [0065.547] GetCurrentThreadId () returned 0x970 [0065.547] GetCurrentThreadId () returned 0x970 [0065.547] GetCurrentThreadId () returned 0x970 [0065.547] GetCurrentThreadId () returned 0x970 [0065.547] GetCurrentThreadId () returned 0x970 [0065.547] GetCurrentThreadId () returned 0x970 [0065.547] GetCurrentThreadId () returned 0x970 [0065.547] GetCurrentThreadId () returned 0x970 [0065.547] GetCurrentThreadId () returned 0x970 [0065.547] GetCurrentThreadId () returned 0x970 [0065.547] GetCurrentThreadId () returned 0x970 [0065.547] GetCurrentThreadId () returned 0x970 [0065.547] GetCurrentThreadId () returned 0x970 [0065.547] GetCurrentThreadId () returned 0x970 [0065.547] GetCurrentThreadId () returned 0x970 [0065.547] GetCurrentThreadId () returned 0x970 [0065.547] GetCurrentThreadId () returned 0x970 [0065.547] GetCurrentThreadId () returned 0x970 [0065.548] GetCurrentThreadId () returned 0x970 [0065.548] GetCurrentThreadId () returned 0x970 [0065.548] GetCurrentThreadId () returned 0x970 [0065.548] GetCurrentThreadId () returned 0x970 [0065.548] GetCurrentThreadId () returned 0x970 [0065.548] GetCurrentThreadId () returned 0x970 [0065.548] GetCurrentThreadId () returned 0x970 [0065.548] GetCurrentThreadId () returned 0x970 [0065.548] GetCurrentThreadId () returned 0x970 [0065.548] GetCurrentThreadId () returned 0x970 [0065.548] GetCurrentThreadId () returned 0x970 [0065.548] GetCurrentThreadId () returned 0x970 [0065.548] GetCurrentThreadId () returned 0x970 [0065.548] GetCurrentThreadId () returned 0x970 [0065.548] GetCurrentThreadId () returned 0x970 [0065.548] GetCurrentThreadId () returned 0x970 [0065.548] GetCurrentThreadId () returned 0x970 [0065.548] GetCurrentThreadId () returned 0x970 [0065.548] GetCurrentThreadId () returned 0x970 [0065.548] GetCurrentThreadId () returned 0x970 [0065.548] GetCurrentThreadId () returned 0x970 [0065.548] GetCurrentThreadId () returned 0x970 [0065.548] GetCurrentThreadId () returned 0x970 [0065.548] GetCurrentThreadId () returned 0x970 [0065.548] GetCurrentThreadId () returned 0x970 [0065.548] GetCurrentThreadId () returned 0x970 [0065.548] GetCurrentThreadId () returned 0x970 [0065.548] GetCurrentThreadId () returned 0x970 [0065.548] GetCurrentThreadId () returned 0x970 [0065.548] GetCurrentThreadId () returned 0x970 [0065.548] GetCurrentThreadId () returned 0x970 [0065.548] GetCurrentThreadId () returned 0x970 [0065.548] GetCurrentThreadId () returned 0x970 [0065.548] GetCurrentThreadId () returned 0x970 [0065.548] GetCurrentThreadId () returned 0x970 [0065.548] GetCurrentThreadId () returned 0x970 [0065.548] GetCurrentThreadId () returned 0x970 [0065.548] GetCurrentThreadId () returned 0x970 [0065.548] GetCurrentThreadId () returned 0x970 [0065.548] GetCurrentThreadId () returned 0x970 [0065.548] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAADJRT/rrNJj3c1i+HJ7ybQDprF3zYJ9N3w2NpOGAho4aMPKykUYxno2rILu6LcWyrfp7whF+ZSJYYCInkctyFaRS0ImZNJnCjDMgvGGxLLhavv2RaWhLM96biWTw5q5UqSrpLUt7vLzuImxxpCHK1C+MtCvAvgjsb1guZJUn9x3l3ISl8ZpgrII//6z7qAlm+dJ1dbCVR5iqrXty6Rb17vUm9JwbNEtMxw==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0065.548] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAADJRT/rrNJj3c1i+HJ7ybQDprF3zYJ9N3w2NpOGAho4aMPKykUYxno2rILu6LcWyrfp7whF+ZSJYYCInkctyFaRS0ImZNJnCjDMgvGGxLLhavv2RaWhLM96biWTw5q5UqSrpLUt7vLzuImxxpCHK1C+MtCvAvgjsb1guZJUn9x3l3ISl8ZpgrII//6z7qAlm+dJ1dbCVR5iqrXty6Rb17vUm9JwbNEtMxw==", cchWideChar=245, lpMultiByteStr=0x353933c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAADJRT/rrNJj3c1i+HJ7ybQDprF3zYJ9N3w2NpOGAho4aMPKykUYxno2rILu6LcWyrfp7whF+ZSJYYCInkctyFaRS0ImZNJnCjDMgvGGxLLhavv2RaWhLM96biWTw5q5UqSrpLUt7vLzuImxxpCHK1C+MtCvAvgjsb1guZJUn9x3l3ISl8ZpgrII//6z7qAlm+dJ1dbCVR5iqrXty6Rb17vUm9JwbNEtMxw==", lpUsedDefaultChar=0x0) returned 245 [0065.548] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0065.549] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0065.549] CloseHandle (hObject=0x158) returned 1 [0065.549] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_selectionsubpicture.png")) returned 0 [0065.549] GetLastError () returned 0x5 [0065.549] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_selectionsubpicture.png")) returned 0x20 [0065.549] SetLastError (dwErrCode=0x5) [0065.549] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=18581269060) returned 1 [0065.549] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Файл зашифрован [circleround_videoinset.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\Файл зашифрован [circleround_videoinset.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0065.551] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0065.551] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0065.551] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0065.551] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0065.551] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0065.551] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0065.551] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0065.551] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0065.551] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0065.551] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0065.551] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0065.551] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0065.551] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0065.551] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0065.551] SetEndOfFile (hFile=0x158) returned 1 [0065.552] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0065.552] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0065.552] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0065.552] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0065.552] WriteFile (in: hFile=0x158, lpBuffer=0x3777058*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777058*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0065.553] WriteFile (in: hFile=0x158, lpBuffer=0x35f035c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f035c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0065.553] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a^b#&P9JK#FRP{uuffd1@,8\\R@3R8yK1", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0065.553] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a^b#&P9JK#FRP{uuffd1@,8\\R@3R8yK1", cchWideChar=32, lpMultiByteStr=0x2036454, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="a^b#&P9JK#FRP{uuffd1@,8\\R@3R8yK1", lpUsedDefaultChar=0x0) returned 32 [0065.553] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0065.553] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0065.553] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ebcc13a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ebcc13a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="circleround_videoinset.png", cAlternateFileName="")) returned 0x295098 [0065.553] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0065.553] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0065.553] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_videoinset.png")) returned 0x20 [0065.553] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_videoinset.png")) returned 0x20 [0065.554] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_videoinset.png")) returned 0x20 [0065.554] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_videoinset.png")) returned 0x20 [0065.554] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_videoinset.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ebcc13a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ebcc13a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13c3)) returned 1 [0065.554] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0065.554] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0065.554] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_videoinset.png")) returned 0x20 [0065.554] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_videoinset.png")) returned 0x20 [0065.554] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0065.554] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0065.554] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0065.554] SetEndOfFile (hFile=0x158) returned 1 [0065.555] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="circleround_videoinset.png", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0065.555] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="circleround_videoinset.png", cchWideChar=26, lpMultiByteStr=0x200347c, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="circleround_videoinset.png", lpUsedDefaultChar=0x0) returned 26 [0065.555] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="circleround_videoinset.png", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0065.555] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="circleround_videoinset.png", cchWideChar=26, lpMultiByteStr=0x2003adc, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="circleround_videoinset.png", lpUsedDefaultChar=0x0) returned 26 [0065.555] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x2003adc, cbMultiByte=26, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="circleround_videoinset.pngpngre.png.pngg") returned 26 [0065.555] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="circleround_videoinset.png", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0065.555] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="circleround_videoinset.png", cchWideChar=26, lpMultiByteStr=0x200347c, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="circleround_videoinset.png", lpUsedDefaultChar=0x0) returned 26 [0065.555] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_videoinset.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0065.556] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0065.556] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x13c3 [0065.556] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0065.556] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0065.556] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0065.556] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="circleround_videoinset.png", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0065.556] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="circleround_videoinset.png", cchWideChar=26, lpMultiByteStr=0x200347c, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="circleround_videoinset.png", lpUsedDefaultChar=0x0) returned 26 [0065.556] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="circleround_videoinset.png", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0065.556] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="circleround_videoinset.png", cchWideChar=26, lpMultiByteStr=0x2003adc, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="circleround_videoinset.png", lpUsedDefaultChar=0x0) returned 26 [0065.556] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x2003adc, cbMultiByte=26, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="circleround_videoinset.pnget.pngpngre.png.pngg") returned 26 [0065.556] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="circleround_videoinset.png", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0065.556] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="circleround_videoinset.png", cchWideChar=26, lpMultiByteStr=0x200347c, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="circleround_videoinset.png", lpUsedDefaultChar=0x0) returned 26 [0065.556] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0065.557] CharToOemA (in: pSrc="circleround_videoinset.png", pDst=0x2003adc | out: pDst="circleround_videoinset.png") returned 1 [0065.557] WriteFile (in: hFile=0x158, lpBuffer=0x2003adc*, nNumberOfBytesToWrite=0x1a, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x2003adc*, lpNumberOfBytesWritten=0x18e048*=0x1a, lpOverlapped=0x0) returned 1 [0065.557] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0065.558] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0065.558] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0065.558] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=18582120333) returned 1 [0065.558] ReadFile (in: hFile=0x11c, lpBuffer=0x37c6700, nNumberOfBytesToRead=0x13c3, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37c6700*, lpNumberOfBytesRead=0x18dd7c*=0x13c3, lpOverlapped=0x0) returned 1 [0065.559] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0065.559] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=18582283278) returned 1 [0065.568] WriteFile (in: hFile=0x158, lpBuffer=0x379adb0*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379adb0*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0065.568] ReadFile (in: hFile=0x11c, lpBuffer=0x37c6700, nNumberOfBytesToRead=0x13c3, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x37c6700*, lpNumberOfBytesRead=0x18de38*=0x13c3, lpOverlapped=0x0) returned 1 [0065.569] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x55 [0065.569] WriteFile (in: hFile=0x158, lpBuffer=0x3809320*, nNumberOfBytesToWrite=0x13c3, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3809320*, lpNumberOfBytesWritten=0x18de10*=0x13c3, lpOverlapped=0x0) returned 1 [0065.569] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x1418 [0065.569] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0065.569] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0065.569] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0065.569] SetFilePointer (in: hFile=0x158, lDistanceToMove=26, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x38 [0065.569] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x1422 [0065.569] CloseHandle (hObject=0x11c) returned 1 [0065.569] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1422 [0065.570] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1422 [0065.570] SetFilePointer (in: hFile=0x158, lDistanceToMove=5154, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1422 [0065.570] SetFilePointer (in: hFile=0x158, lDistanceToMove=5154, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x1422 [0065.570] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1422 [0065.570] SetFilePointer (in: hFile=0x158, lDistanceToMove=5154, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x1422 [0065.570] SetEndOfFile (hFile=0x158) returned 1 [0065.570] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1422 [0065.570] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1422 [0065.570] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="circleround_videoinset.png", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0065.570] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="circleround_videoinset.png", cchWideChar=26, lpMultiByteStr=0x2003adc, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="circleround_videoinset.png", lpUsedDefaultChar=0x0) returned 26 [0065.570] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="circleround_videoinset.png", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0065.570] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="circleround_videoinset.png", cchWideChar=26, lpMultiByteStr=0x200347c, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="circleround_videoinset.png", lpUsedDefaultChar=0x0) returned 26 [0065.570] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x200347c, cbMultiByte=26, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="circleround_videoinset.png\x14\x14\x01c䃊㫋籋皡Ꮯ") returned 26 [0065.570] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="circleround_videoinset.png", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0065.570] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="circleround_videoinset.png", cchWideChar=26, lpMultiByteStr=0x2003adc, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="circleround_videoinset.png", lpUsedDefaultChar=0x0) returned 26 [0065.570] WriteFile (in: hFile=0x158, lpBuffer=0x37aa1d8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x37aa1d8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0065.571] CharToOemA (in: pSrc="circleround_videoinset.png", pDst=0x200347c | out: pDst="circleround_videoinset.png") returned 1 [0065.571] WriteFile (in: hFile=0x158, lpBuffer=0x200347c*, nNumberOfBytesToWrite=0x1a, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x200347c*, lpNumberOfBytesWritten=0x18efcc*=0x1a, lpOverlapped=0x0) returned 1 [0065.571] WriteFile (in: hFile=0x158, lpBuffer=0x379ae18*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379ae18*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0065.571] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0065.571] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0065.571] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1475 [0065.571] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1475 [0065.571] WriteFile (in: hFile=0x158, lpBuffer=0x3777058*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777058*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0065.571] WriteFile (in: hFile=0x158, lpBuffer=0x35f035c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f035c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0065.571] DeleteFileW (lpFileName="") returned 0 [0065.571] GetLastError () returned 0x3 [0065.571] GetFileAttributesW (lpFileName="") returned 0xffffffff [0065.571] SetLastError (dwErrCode=0x3) [0065.571] FlushFileBuffers (hFile=0x158) returned 1 [0065.574] GetCurrentThreadId () returned 0x970 [0065.574] GetCurrentThreadId () returned 0x970 [0065.574] GetCurrentThreadId () returned 0x970 [0065.574] GetCurrentThreadId () returned 0x970 [0065.574] GetCurrentThreadId () returned 0x970 [0065.574] GetCurrentThreadId () returned 0x970 [0065.574] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x152c [0065.574] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x152c [0065.574] SetFilePointer (in: hFile=0x158, lDistanceToMove=5420, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x152c [0065.575] CloseHandle (hObject=0x158) returned 1 [0065.575] GetCurrentThreadId () returned 0x970 [0065.575] GetCurrentThreadId () returned 0x970 [0065.575] GetCurrentThreadId () returned 0x970 [0065.575] GetCurrentThreadId () returned 0x970 [0065.575] GetCurrentThreadId () returned 0x970 [0065.575] GetCurrentThreadId () returned 0x970 [0065.575] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Файл зашифрован [circleround_videoinset.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\Файл зашифрован [circleround_videoinset.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0065.575] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x152c [0065.575] SetFilePointer (in: hFile=0x158, lDistanceToMove=5292, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x14ac [0065.575] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0065.575] GetFileType (hFile=0x158) returned 0x1 [0065.575] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xc, wMilliseconds=0x34c)) [0065.575] GetCurrentThreadId () returned 0x970 [0065.575] GetCurrentThreadId () returned 0x970 [0065.575] GetCurrentThreadId () returned 0x970 [0065.575] GetCurrentThreadId () returned 0x970 [0065.575] GetCurrentThreadId () returned 0x970 [0065.575] GetCurrentThreadId () returned 0x970 [0065.575] GetCurrentThreadId () returned 0x970 [0065.575] GetCurrentThreadId () returned 0x970 [0065.575] GetCurrentThreadId () returned 0x970 [0065.575] GetCurrentThreadId () returned 0x970 [0065.575] GetCurrentThreadId () returned 0x970 [0065.575] GetCurrentThreadId () returned 0x970 [0065.575] GetCurrentThreadId () returned 0x970 [0065.575] GetCurrentThreadId () returned 0x970 [0065.575] GetCurrentThreadId () returned 0x970 [0065.576] GetCurrentThreadId () returned 0x970 [0065.576] GetCurrentThreadId () returned 0x970 [0065.576] GetCurrentThreadId () returned 0x970 [0065.576] GetCurrentThreadId () returned 0x970 [0065.576] GetCurrentThreadId () returned 0x970 [0065.576] GetCurrentThreadId () returned 0x970 [0065.576] GetCurrentThreadId () returned 0x970 [0065.576] GetCurrentThreadId () returned 0x970 [0065.576] GetCurrentThreadId () returned 0x970 [0065.576] GetCurrentThreadId () returned 0x970 [0065.576] GetCurrentThreadId () returned 0x970 [0065.576] GetCurrentThreadId () returned 0x970 [0065.576] GetCurrentThreadId () returned 0x970 [0065.576] GetCurrentThreadId () returned 0x970 [0065.576] GetCurrentThreadId () returned 0x970 [0065.576] GetCurrentThreadId () returned 0x970 [0065.576] GetCurrentThreadId () returned 0x970 [0065.576] GetCurrentThreadId () returned 0x970 [0065.576] GetCurrentThreadId () returned 0x970 [0065.576] GetCurrentThreadId () returned 0x970 [0065.576] GetCurrentThreadId () returned 0x970 [0065.576] GetCurrentThreadId () returned 0x970 [0065.576] GetCurrentThreadId () returned 0x970 [0065.576] GetCurrentThreadId () returned 0x970 [0065.576] GetCurrentThreadId () returned 0x970 [0065.576] GetCurrentThreadId () returned 0x970 [0065.576] GetCurrentThreadId () returned 0x970 [0065.576] GetCurrentThreadId () returned 0x970 [0065.576] GetCurrentThreadId () returned 0x970 [0065.576] GetCurrentThreadId () returned 0x970 [0065.576] GetCurrentThreadId () returned 0x970 [0065.576] GetCurrentThreadId () returned 0x970 [0065.576] GetCurrentThreadId () returned 0x970 [0065.576] GetCurrentThreadId () returned 0x970 [0065.576] GetCurrentThreadId () returned 0x970 [0065.576] GetCurrentThreadId () returned 0x970 [0065.576] GetCurrentThreadId () returned 0x970 [0065.576] GetCurrentThreadId () returned 0x970 [0065.576] GetCurrentThreadId () returned 0x970 [0065.576] GetCurrentThreadId () returned 0x970 [0065.576] GetCurrentThreadId () returned 0x970 [0065.576] GetCurrentThreadId () returned 0x970 [0065.576] GetCurrentThreadId () returned 0x970 [0065.576] GetCurrentThreadId () returned 0x970 [0065.576] GetCurrentThreadId () returned 0x970 [0065.576] GetCurrentThreadId () returned 0x970 [0065.576] GetCurrentThreadId () returned 0x970 [0065.577] GetCurrentThreadId () returned 0x970 [0065.577] GetCurrentThreadId () returned 0x970 [0065.577] GetCurrentThreadId () returned 0x970 [0065.577] GetCurrentThreadId () returned 0x970 [0065.577] GetCurrentThreadId () returned 0x970 [0065.577] GetCurrentThreadId () returned 0x970 [0065.577] GetCurrentThreadId () returned 0x970 [0065.577] GetCurrentThreadId () returned 0x970 [0065.577] GetCurrentThreadId () returned 0x970 [0065.577] GetCurrentThreadId () returned 0x970 [0065.577] GetCurrentThreadId () returned 0x970 [0065.577] GetCurrentThreadId () returned 0x970 [0065.577] GetCurrentThreadId () returned 0x970 [0065.577] GetCurrentThreadId () returned 0x970 [0065.577] GetCurrentThreadId () returned 0x970 [0065.577] GetCurrentThreadId () returned 0x970 [0065.577] GetCurrentThreadId () returned 0x970 [0065.577] GetCurrentThreadId () returned 0x970 [0065.577] GetCurrentThreadId () returned 0x970 [0065.577] GetCurrentThreadId () returned 0x970 [0065.577] GetCurrentThreadId () returned 0x970 [0065.577] GetCurrentThreadId () returned 0x970 [0065.577] GetCurrentThreadId () returned 0x970 [0065.577] GetCurrentThreadId () returned 0x970 [0065.577] GetCurrentThreadId () returned 0x970 [0065.577] GetCurrentThreadId () returned 0x970 [0065.577] GetCurrentThreadId () returned 0x970 [0065.577] GetCurrentThreadId () returned 0x970 [0065.577] GetCurrentThreadId () returned 0x970 [0065.577] GetCurrentThreadId () returned 0x970 [0065.577] GetCurrentThreadId () returned 0x970 [0065.577] GetCurrentThreadId () returned 0x970 [0065.577] GetCurrentThreadId () returned 0x970 [0065.577] GetCurrentThreadId () returned 0x970 [0065.577] GetCurrentThreadId () returned 0x970 [0065.577] GetCurrentThreadId () returned 0x970 [0065.577] GetCurrentThreadId () returned 0x970 [0065.577] GetCurrentThreadId () returned 0x970 [0065.577] GetCurrentThreadId () returned 0x970 [0065.577] GetCurrentThreadId () returned 0x970 [0065.577] GetCurrentThreadId () returned 0x970 [0065.577] GetCurrentThreadId () returned 0x970 [0065.577] GetCurrentThreadId () returned 0x970 [0065.577] GetCurrentThreadId () returned 0x970 [0065.578] GetCurrentThreadId () returned 0x970 [0065.578] GetCurrentThreadId () returned 0x970 [0065.578] GetCurrentThreadId () returned 0x970 [0065.578] GetCurrentThreadId () returned 0x970 [0065.578] GetCurrentThreadId () returned 0x970 [0065.578] GetCurrentThreadId () returned 0x970 [0065.578] GetCurrentThreadId () returned 0x970 [0065.578] GetCurrentThreadId () returned 0x970 [0065.578] GetCurrentThreadId () returned 0x970 [0065.578] GetCurrentThreadId () returned 0x970 [0065.578] GetCurrentThreadId () returned 0x970 [0065.578] GetCurrentThreadId () returned 0x970 [0065.578] GetCurrentThreadId () returned 0x970 [0065.578] GetCurrentThreadId () returned 0x970 [0065.578] GetCurrentThreadId () returned 0x970 [0065.578] GetCurrentThreadId () returned 0x970 [0065.578] GetCurrentThreadId () returned 0x970 [0065.578] GetCurrentThreadId () returned 0x970 [0065.578] GetCurrentThreadId () returned 0x970 [0065.578] GetCurrentThreadId () returned 0x970 [0065.578] GetCurrentThreadId () returned 0x970 [0065.578] GetCurrentThreadId () returned 0x970 [0065.578] GetCurrentThreadId () returned 0x970 [0065.578] GetCurrentThreadId () returned 0x970 [0065.578] GetCurrentThreadId () returned 0x970 [0065.578] GetCurrentThreadId () returned 0x970 [0065.578] GetCurrentThreadId () returned 0x970 [0065.578] GetCurrentThreadId () returned 0x970 [0065.578] GetCurrentThreadId () returned 0x970 [0065.578] GetCurrentThreadId () returned 0x970 [0065.578] GetCurrentThreadId () returned 0x970 [0065.578] GetCurrentThreadId () returned 0x970 [0065.578] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.578] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.578] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379bcb8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.578] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.578] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.578] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379bcb8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.578] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.578] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.578] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.578] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.579] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.579] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.579] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.579] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.579] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379bd18, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.579] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.579] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.579] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379bd18, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.579] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.579] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.579] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379bd18, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.579] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xc, wMilliseconds=0x34c)) [0065.579] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="a^b#&P9JK#FRP{uuffd1@,8\\R@3R8yK1", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0065.579] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="a^b#&P9JK#FRP{uuffd1@,8\\R@3R8yK1", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0065.579] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="a^b#&P9JK#FRP{uuffd1@,8\\R@3R8yK1", cchWideChar=32, lpMultiByteStr=0x2003c88, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="a^b#&P9JK#FRP{uuffd1@,8\\R@3R8yK1", lpUsedDefaultChar=0x0) returned 32 [0065.579] GetCurrentThreadId () returned 0x970 [0065.579] GetCurrentThreadId () returned 0x970 [0065.579] GetCurrentThreadId () returned 0x970 [0065.579] GetCurrentThreadId () returned 0x970 [0065.579] GetCurrentThreadId () returned 0x970 [0065.579] GetCurrentThreadId () returned 0x970 [0065.587] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0065.587] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0065.587] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3798ca8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0065.587] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb348, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0065.587] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb348, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAACbIkjw++FWrjPrr2ClHD+plC/GgS3VF0VN/FptBfUvH5/hwW0doZKKN2Am2YVhVNkkf78rvd2/QLXQ8tB///hgI5Szeek3QXfUBcDfmUd2shq+Xb2fgA8byQGXXFDaFDEpLu4nV+tYfjSnPSm0Fs/vgIXvO2sGeXS3GqPaByBHWFdwY61iQdk2QleBcI6LPwklp1xiGZw02cxU8cN53gF3GNsH9DfSt4Q==") returned 232 [0065.587] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xc, wMilliseconds=0x35c)) [0065.587] GetCurrentThreadId () returned 0x970 [0065.587] GetCurrentThreadId () returned 0x970 [0065.587] GetCurrentThreadId () returned 0x970 [0065.587] GetCurrentThreadId () returned 0x970 [0065.587] GetCurrentThreadId () returned 0x970 [0065.587] GetCurrentThreadId () returned 0x970 [0065.587] GetCurrentThreadId () returned 0x970 [0065.587] GetCurrentThreadId () returned 0x970 [0065.587] GetCurrentThreadId () returned 0x970 [0065.587] GetCurrentThreadId () returned 0x970 [0065.587] GetCurrentThreadId () returned 0x970 [0065.587] GetCurrentThreadId () returned 0x970 [0065.587] GetCurrentThreadId () returned 0x970 [0065.587] GetCurrentThreadId () returned 0x970 [0065.587] GetCurrentThreadId () returned 0x970 [0065.587] GetCurrentThreadId () returned 0x970 [0065.587] GetCurrentThreadId () returned 0x970 [0065.587] GetCurrentThreadId () returned 0x970 [0065.587] GetCurrentThreadId () returned 0x970 [0065.587] GetCurrentThreadId () returned 0x970 [0065.587] GetCurrentThreadId () returned 0x970 [0065.587] GetCurrentThreadId () returned 0x970 [0065.587] GetCurrentThreadId () returned 0x970 [0065.587] GetCurrentThreadId () returned 0x970 [0065.587] GetCurrentThreadId () returned 0x970 [0065.587] GetCurrentThreadId () returned 0x970 [0065.587] GetCurrentThreadId () returned 0x970 [0065.587] GetCurrentThreadId () returned 0x970 [0065.587] GetCurrentThreadId () returned 0x970 [0065.587] GetCurrentThreadId () returned 0x970 [0065.587] GetCurrentThreadId () returned 0x970 [0065.587] GetCurrentThreadId () returned 0x970 [0065.587] GetCurrentThreadId () returned 0x970 [0065.587] GetCurrentThreadId () returned 0x970 [0065.587] GetCurrentThreadId () returned 0x970 [0065.587] GetCurrentThreadId () returned 0x970 [0065.588] GetCurrentThreadId () returned 0x970 [0065.588] GetCurrentThreadId () returned 0x970 [0065.588] GetCurrentThreadId () returned 0x970 [0065.588] GetCurrentThreadId () returned 0x970 [0065.588] GetCurrentThreadId () returned 0x970 [0065.588] GetCurrentThreadId () returned 0x970 [0065.588] GetCurrentThreadId () returned 0x970 [0065.588] GetCurrentThreadId () returned 0x970 [0065.588] GetCurrentThreadId () returned 0x970 [0065.588] GetCurrentThreadId () returned 0x970 [0065.588] GetCurrentThreadId () returned 0x970 [0065.588] GetCurrentThreadId () returned 0x970 [0065.588] GetCurrentThreadId () returned 0x970 [0065.588] GetCurrentThreadId () returned 0x970 [0065.588] GetCurrentThreadId () returned 0x970 [0065.588] GetCurrentThreadId () returned 0x970 [0065.588] GetCurrentThreadId () returned 0x970 [0065.588] GetCurrentThreadId () returned 0x970 [0065.588] GetCurrentThreadId () returned 0x970 [0065.588] GetCurrentThreadId () returned 0x970 [0065.588] GetCurrentThreadId () returned 0x970 [0065.588] GetCurrentThreadId () returned 0x970 [0065.588] GetCurrentThreadId () returned 0x970 [0065.588] GetCurrentThreadId () returned 0x970 [0065.588] GetCurrentThreadId () returned 0x970 [0065.588] GetCurrentThreadId () returned 0x970 [0065.588] GetCurrentThreadId () returned 0x970 [0065.588] GetCurrentThreadId () returned 0x970 [0065.588] GetCurrentThreadId () returned 0x970 [0065.588] GetCurrentThreadId () returned 0x970 [0065.588] GetCurrentThreadId () returned 0x970 [0065.588] GetCurrentThreadId () returned 0x970 [0065.588] GetCurrentThreadId () returned 0x970 [0065.588] GetCurrentThreadId () returned 0x970 [0065.588] GetCurrentThreadId () returned 0x970 [0065.588] GetCurrentThreadId () returned 0x970 [0065.588] GetCurrentThreadId () returned 0x970 [0065.588] GetCurrentThreadId () returned 0x970 [0065.588] GetCurrentThreadId () returned 0x970 [0065.588] GetCurrentThreadId () returned 0x970 [0065.588] GetCurrentThreadId () returned 0x970 [0065.588] GetCurrentThreadId () returned 0x970 [0065.588] GetCurrentThreadId () returned 0x970 [0065.588] GetCurrentThreadId () returned 0x970 [0065.588] GetCurrentThreadId () returned 0x970 [0065.588] GetCurrentThreadId () returned 0x970 [0065.589] GetCurrentThreadId () returned 0x970 [0065.589] GetCurrentThreadId () returned 0x970 [0065.589] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAACbIkjw++FWrjPrr2ClHD+plC/GgS3VF0VN/FptBfUvH5/hwW0doZKKN2Am2YVhVNkkf78rvd2/QLXQ8tB///hgI5Szeek3QXfUBcDfmUd2shq+Xb2fgA8byQGXXFDaFDEpLu4nV+tYfjSnPSm0Fs/vgIXvO2sGeXS3GqPaByBHWFdwY61iQdk2QleBcI6LPwklp1xiGZw02cxU8cN53gF3GNsH9DfSt4Q==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0065.589] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAACbIkjw++FWrjPrr2ClHD+plC/GgS3VF0VN/FptBfUvH5/hwW0doZKKN2Am2YVhVNkkf78rvd2/QLXQ8tB///hgI5Szeek3QXfUBcDfmUd2shq+Xb2fgA8byQGXXFDaFDEpLu4nV+tYfjSnPSm0Fs/vgIXvO2sGeXS3GqPaByBHWFdwY61iQdk2QleBcI6LPwklp1xiGZw02cxU8cN53gF3GNsH9DfSt4Q==", cchWideChar=245, lpMultiByteStr=0x353933c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAACbIkjw++FWrjPrr2ClHD+plC/GgS3VF0VN/FptBfUvH5/hwW0doZKKN2Am2YVhVNkkf78rvd2/QLXQ8tB///hgI5Szeek3QXfUBcDfmUd2shq+Xb2fgA8byQGXXFDaFDEpLu4nV+tYfjSnPSm0Fs/vgIXvO2sGeXS3GqPaByBHWFdwY61iQdk2QleBcI6LPwklp1xiGZw02cxU8cN53gF3GNsH9DfSt4Q==", lpUsedDefaultChar=0x0) returned 245 [0065.589] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0065.589] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0065.589] CloseHandle (hObject=0x158) returned 1 [0065.589] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_videoinset.png")) returned 0 [0065.589] GetLastError () returned 0x5 [0065.589] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_videoinset.png")) returned 0x20 [0065.589] SetLastError (dwErrCode=0x5) [0065.589] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=18585267420) returned 1 [0065.589] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Файл зашифрован [Circle_ButtonGraphic.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\Файл зашифрован [circle_buttongraphic.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0065.590] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0065.590] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0065.590] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0065.590] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0065.590] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0065.590] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0065.590] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0065.590] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0065.590] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0065.590] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0065.590] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0065.590] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0065.590] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0065.590] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0065.590] SetEndOfFile (hFile=0x158) returned 1 [0065.591] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0065.591] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0065.591] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0065.591] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0065.591] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0065.592] WriteFile (in: hFile=0x158, lpBuffer=0x35f04dc*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f04dc*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0065.592] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="4@FMggYnmhp?M$4kL:V)3b%3{\"?V)TR.", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0065.592] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="4@FMggYnmhp?M$4kL:V)3b%3{\"?V)TR.", cchWideChar=32, lpMultiByteStr=0x20365dc, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4@FMggYnmhp?M$4kL:V)3b%3{\"?V)TR.", lpUsedDefaultChar=0x0) returned 32 [0065.592] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0065.592] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0065.592] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6edbb2f3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6edbb2f3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c53d379, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6a91, dwReserved0=0x0, dwReserved1=0x0, cFileName="Circle_ButtonGraphic.png", cAlternateFileName="")) returned 0x295098 [0065.592] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0065.592] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0065.592] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_buttongraphic.png")) returned 0x20 [0065.592] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_buttongraphic.png")) returned 0x20 [0065.592] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_buttongraphic.png")) returned 0x20 [0065.592] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_buttongraphic.png")) returned 0x20 [0065.593] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_buttongraphic.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6edbb2f3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6edbb2f3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c53d379, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6a91)) returned 1 [0065.593] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0065.593] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0065.593] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_buttongraphic.png")) returned 0x20 [0065.593] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_buttongraphic.png")) returned 0x20 [0065.593] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0065.593] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0065.593] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0065.593] SetEndOfFile (hFile=0x158) returned 1 [0065.594] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Circle_ButtonGraphic.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0065.594] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Circle_ButtonGraphic.png", cchWideChar=24, lpMultiByteStr=0x2003a7c, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Circle_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 24 [0065.594] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Circle_ButtonGraphic.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0065.594] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Circle_ButtonGraphic.png", cchWideChar=24, lpMultiByteStr=0x20038fc, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Circle_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 24 [0065.594] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x20038fc, cbMultiByte=24, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="Circle_ButtonGraphic.pngngpngre.png.pngg") returned 24 [0065.594] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Circle_ButtonGraphic.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0065.594] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Circle_ButtonGraphic.png", cchWideChar=24, lpMultiByteStr=0x2003a7c, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Circle_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 24 [0065.594] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0065.594] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0065.594] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x6a91 [0065.594] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0065.594] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0065.594] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0065.595] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Circle_ButtonGraphic.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0065.595] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Circle_ButtonGraphic.png", cchWideChar=24, lpMultiByteStr=0x2003a7c, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Circle_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 24 [0065.595] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Circle_ButtonGraphic.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0065.595] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Circle_ButtonGraphic.png", cchWideChar=24, lpMultiByteStr=0x20038fc, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Circle_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 24 [0065.595] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x20038fc, cbMultiByte=24, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="Circle_ButtonGraphic.pngic.pngngpngre.png.pngg") returned 24 [0065.595] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Circle_ButtonGraphic.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0065.595] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Circle_ButtonGraphic.png", cchWideChar=24, lpMultiByteStr=0x2003a7c, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Circle_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 24 [0065.595] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0065.596] CharToOemA (in: pSrc="Circle_ButtonGraphic.png", pDst=0x20038fc | out: pDst="Circle_ButtonGraphic.png") returned 1 [0065.596] WriteFile (in: hFile=0x158, lpBuffer=0x20038fc*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x20038fc*, lpNumberOfBytesWritten=0x18e048*=0x18, lpOverlapped=0x0) returned 1 [0065.596] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0065.596] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0065.596] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0065.596] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=18585963255) returned 1 [0065.596] ReadFile (in: hFile=0x11c, lpBuffer=0x37c6700, nNumberOfBytesToRead=0x6a91, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37c6700*, lpNumberOfBytesRead=0x18dd7c*=0x6a91, lpOverlapped=0x0) returned 1 [0065.598] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0065.598] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=18586139101) returned 1 [0065.607] WriteFile (in: hFile=0x158, lpBuffer=0x379acc0*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379acc0*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0065.607] ReadFile (in: hFile=0x11c, lpBuffer=0x37c6700, nNumberOfBytesToRead=0x6a91, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x37c6700*, lpNumberOfBytesRead=0x18de38*=0x6a91, lpOverlapped=0x0) returned 1 [0065.607] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x53 [0065.608] WriteFile (in: hFile=0x158, lpBuffer=0x380ea20*, nNumberOfBytesToWrite=0x6a91, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x380ea20*, lpNumberOfBytesWritten=0x18de10*=0x6a91, lpOverlapped=0x0) returned 1 [0065.608] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x6ae4 [0065.608] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0065.608] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0065.608] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0065.608] SetFilePointer (in: hFile=0x158, lDistanceToMove=24, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x36 [0065.609] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x6aee [0065.609] CloseHandle (hObject=0x11c) returned 1 [0065.609] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x6aee [0065.609] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x6aee [0065.609] SetFilePointer (in: hFile=0x158, lDistanceToMove=27374, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x6aee [0065.609] SetFilePointer (in: hFile=0x158, lDistanceToMove=27374, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x6aee [0065.609] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x6aee [0065.609] SetFilePointer (in: hFile=0x158, lDistanceToMove=27374, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x6aee [0065.609] SetEndOfFile (hFile=0x158) returned 1 [0065.609] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x6aee [0065.609] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x6aee [0065.609] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Circle_ButtonGraphic.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0065.609] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Circle_ButtonGraphic.png", cchWideChar=24, lpMultiByteStr=0x20038fc, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Circle_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 24 [0065.609] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Circle_ButtonGraphic.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0065.609] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Circle_ButtonGraphic.png", cchWideChar=24, lpMultiByteStr=0x2003a7c, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Circle_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 24 [0065.609] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x2003a7c, cbMultiByte=24, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="Circle_ButtonGraphic.png䭐ȁ\x14\x14\x01c䃊㫋ꘄ釴檭") returned 24 [0065.610] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Circle_ButtonGraphic.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0065.610] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Circle_ButtonGraphic.png", cchWideChar=24, lpMultiByteStr=0x20038fc, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Circle_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 24 [0065.610] WriteFile (in: hFile=0x158, lpBuffer=0x37aa1d8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x37aa1d8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0065.610] CharToOemA (in: pSrc="Circle_ButtonGraphic.png", pDst=0x2003a7c | out: pDst="Circle_ButtonGraphic.png") returned 1 [0065.610] WriteFile (in: hFile=0x158, lpBuffer=0x2003a7c*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x2003a7c*, lpNumberOfBytesWritten=0x18efcc*=0x18, lpOverlapped=0x0) returned 1 [0065.610] WriteFile (in: hFile=0x158, lpBuffer=0x379acf8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379acf8*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0065.610] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0065.610] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0065.610] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x6b3f [0065.610] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x6b3f [0065.610] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0065.610] WriteFile (in: hFile=0x158, lpBuffer=0x35f04dc*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f04dc*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0065.610] DeleteFileW (lpFileName="") returned 0 [0065.610] GetLastError () returned 0x3 [0065.610] GetFileAttributesW (lpFileName="") returned 0xffffffff [0065.610] SetLastError (dwErrCode=0x3) [0065.610] FlushFileBuffers (hFile=0x158) returned 1 [0065.614] GetCurrentThreadId () returned 0x970 [0065.614] GetCurrentThreadId () returned 0x970 [0065.614] GetCurrentThreadId () returned 0x970 [0065.614] GetCurrentThreadId () returned 0x970 [0065.614] GetCurrentThreadId () returned 0x970 [0065.614] GetCurrentThreadId () returned 0x970 [0065.614] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x6bf6 [0065.614] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x6bf6 [0065.614] SetFilePointer (in: hFile=0x158, lDistanceToMove=27638, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x6bf6 [0065.614] CloseHandle (hObject=0x158) returned 1 [0065.614] GetCurrentThreadId () returned 0x970 [0065.614] GetCurrentThreadId () returned 0x970 [0065.614] GetCurrentThreadId () returned 0x970 [0065.614] GetCurrentThreadId () returned 0x970 [0065.614] GetCurrentThreadId () returned 0x970 [0065.614] GetCurrentThreadId () returned 0x970 [0065.614] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Файл зашифрован [Circle_ButtonGraphic.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\Файл зашифрован [circle_buttongraphic.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0065.614] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6bf6 [0065.614] SetFilePointer (in: hFile=0x158, lDistanceToMove=27510, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6b76 [0065.614] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0065.614] GetFileType (hFile=0x158) returned 0x1 [0065.614] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xc, wMilliseconds=0x37b)) [0065.614] GetCurrentThreadId () returned 0x970 [0065.615] GetCurrentThreadId () returned 0x970 [0065.615] GetCurrentThreadId () returned 0x970 [0065.615] GetCurrentThreadId () returned 0x970 [0065.615] GetCurrentThreadId () returned 0x970 [0065.615] GetCurrentThreadId () returned 0x970 [0065.615] GetCurrentThreadId () returned 0x970 [0065.615] GetCurrentThreadId () returned 0x970 [0065.615] GetCurrentThreadId () returned 0x970 [0065.615] GetCurrentThreadId () returned 0x970 [0065.615] GetCurrentThreadId () returned 0x970 [0065.615] GetCurrentThreadId () returned 0x970 [0065.615] GetCurrentThreadId () returned 0x970 [0065.615] GetCurrentThreadId () returned 0x970 [0065.615] GetCurrentThreadId () returned 0x970 [0065.615] GetCurrentThreadId () returned 0x970 [0065.615] GetCurrentThreadId () returned 0x970 [0065.615] GetCurrentThreadId () returned 0x970 [0065.615] GetCurrentThreadId () returned 0x970 [0065.615] GetCurrentThreadId () returned 0x970 [0065.615] GetCurrentThreadId () returned 0x970 [0065.615] GetCurrentThreadId () returned 0x970 [0065.615] GetCurrentThreadId () returned 0x970 [0065.615] GetCurrentThreadId () returned 0x970 [0065.615] GetCurrentThreadId () returned 0x970 [0065.615] GetCurrentThreadId () returned 0x970 [0065.615] GetCurrentThreadId () returned 0x970 [0065.615] GetCurrentThreadId () returned 0x970 [0065.615] GetCurrentThreadId () returned 0x970 [0065.615] GetCurrentThreadId () returned 0x970 [0065.615] GetCurrentThreadId () returned 0x970 [0065.615] GetCurrentThreadId () returned 0x970 [0065.615] GetCurrentThreadId () returned 0x970 [0065.615] GetCurrentThreadId () returned 0x970 [0065.615] GetCurrentThreadId () returned 0x970 [0065.615] GetCurrentThreadId () returned 0x970 [0065.615] GetCurrentThreadId () returned 0x970 [0065.615] GetCurrentThreadId () returned 0x970 [0065.615] GetCurrentThreadId () returned 0x970 [0065.615] GetCurrentThreadId () returned 0x970 [0065.615] GetCurrentThreadId () returned 0x970 [0065.615] GetCurrentThreadId () returned 0x970 [0065.615] GetCurrentThreadId () returned 0x970 [0065.615] GetCurrentThreadId () returned 0x970 [0065.615] GetCurrentThreadId () returned 0x970 [0065.615] GetCurrentThreadId () returned 0x970 [0065.615] GetCurrentThreadId () returned 0x970 [0065.616] GetCurrentThreadId () returned 0x970 [0065.616] GetCurrentThreadId () returned 0x970 [0065.616] GetCurrentThreadId () returned 0x970 [0065.616] GetCurrentThreadId () returned 0x970 [0065.616] GetCurrentThreadId () returned 0x970 [0065.616] GetCurrentThreadId () returned 0x970 [0065.616] GetCurrentThreadId () returned 0x970 [0065.616] GetCurrentThreadId () returned 0x970 [0065.616] GetCurrentThreadId () returned 0x970 [0065.616] GetCurrentThreadId () returned 0x970 [0065.616] GetCurrentThreadId () returned 0x970 [0065.616] GetCurrentThreadId () returned 0x970 [0065.616] GetCurrentThreadId () returned 0x970 [0065.616] GetCurrentThreadId () returned 0x970 [0065.616] GetCurrentThreadId () returned 0x970 [0065.616] GetCurrentThreadId () returned 0x970 [0065.616] GetCurrentThreadId () returned 0x970 [0065.616] GetCurrentThreadId () returned 0x970 [0065.616] GetCurrentThreadId () returned 0x970 [0065.616] GetCurrentThreadId () returned 0x970 [0065.616] GetCurrentThreadId () returned 0x970 [0065.616] GetCurrentThreadId () returned 0x970 [0065.616] GetCurrentThreadId () returned 0x970 [0065.616] GetCurrentThreadId () returned 0x970 [0065.616] GetCurrentThreadId () returned 0x970 [0065.616] GetCurrentThreadId () returned 0x970 [0065.616] GetCurrentThreadId () returned 0x970 [0065.616] GetCurrentThreadId () returned 0x970 [0065.616] GetCurrentThreadId () returned 0x970 [0065.616] GetCurrentThreadId () returned 0x970 [0065.616] GetCurrentThreadId () returned 0x970 [0065.616] GetCurrentThreadId () returned 0x970 [0065.616] GetCurrentThreadId () returned 0x970 [0065.616] GetCurrentThreadId () returned 0x970 [0065.616] GetCurrentThreadId () returned 0x970 [0065.616] GetCurrentThreadId () returned 0x970 [0065.616] GetCurrentThreadId () returned 0x970 [0065.616] GetCurrentThreadId () returned 0x970 [0065.616] GetCurrentThreadId () returned 0x970 [0065.616] GetCurrentThreadId () returned 0x970 [0065.616] GetCurrentThreadId () returned 0x970 [0065.616] GetCurrentThreadId () returned 0x970 [0065.616] GetCurrentThreadId () returned 0x970 [0065.616] GetCurrentThreadId () returned 0x970 [0065.616] GetCurrentThreadId () returned 0x970 [0065.616] GetCurrentThreadId () returned 0x970 [0065.616] GetCurrentThreadId () returned 0x970 [0065.617] GetCurrentThreadId () returned 0x970 [0065.617] GetCurrentThreadId () returned 0x970 [0065.617] GetCurrentThreadId () returned 0x970 [0065.617] GetCurrentThreadId () returned 0x970 [0065.617] GetCurrentThreadId () returned 0x970 [0065.617] GetCurrentThreadId () returned 0x970 [0065.617] GetCurrentThreadId () returned 0x970 [0065.617] GetCurrentThreadId () returned 0x970 [0065.617] GetCurrentThreadId () returned 0x970 [0065.617] GetCurrentThreadId () returned 0x970 [0065.617] GetCurrentThreadId () returned 0x970 [0065.617] GetCurrentThreadId () returned 0x970 [0065.617] GetCurrentThreadId () returned 0x970 [0065.617] GetCurrentThreadId () returned 0x970 [0065.617] GetCurrentThreadId () returned 0x970 [0065.617] GetCurrentThreadId () returned 0x970 [0065.617] GetCurrentThreadId () returned 0x970 [0065.617] GetCurrentThreadId () returned 0x970 [0065.617] GetCurrentThreadId () returned 0x970 [0065.617] GetCurrentThreadId () returned 0x970 [0065.617] GetCurrentThreadId () returned 0x970 [0065.617] GetCurrentThreadId () returned 0x970 [0065.617] GetCurrentThreadId () returned 0x970 [0065.617] GetCurrentThreadId () returned 0x970 [0065.617] GetCurrentThreadId () returned 0x970 [0065.617] GetCurrentThreadId () returned 0x970 [0065.617] GetCurrentThreadId () returned 0x970 [0065.617] GetCurrentThreadId () returned 0x970 [0065.617] GetCurrentThreadId () returned 0x970 [0065.617] GetCurrentThreadId () returned 0x970 [0065.617] GetCurrentThreadId () returned 0x970 [0065.617] GetCurrentThreadId () returned 0x970 [0065.617] GetCurrentThreadId () returned 0x970 [0065.617] GetCurrentThreadId () returned 0x970 [0065.617] GetCurrentThreadId () returned 0x970 [0065.617] GetCurrentThreadId () returned 0x970 [0065.617] GetCurrentThreadId () returned 0x970 [0065.617] GetCurrentThreadId () returned 0x970 [0065.617] GetCurrentThreadId () returned 0x970 [0065.617] GetCurrentThreadId () returned 0x970 [0065.617] GetCurrentThreadId () returned 0x970 [0065.617] GetCurrentThreadId () returned 0x970 [0065.617] GetCurrentThreadId () returned 0x970 [0065.617] GetCurrentThreadId () returned 0x970 [0065.617] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.618] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.618] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379bd18, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.618] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.618] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.618] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379bd18, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.618] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.618] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.618] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.618] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.618] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.618] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.618] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.618] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.618] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379bd78, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.618] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.618] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.618] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379bd78, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.618] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.618] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.618] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379bd78, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.618] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xc, wMilliseconds=0x37b)) [0065.618] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="4@FMggYnmhp?M$4kL:V)3b%3{\"?V)TR.", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0065.618] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="4@FMggYnmhp?M$4kL:V)3b%3{\"?V)TR.", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0065.618] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="4@FMggYnmhp?M$4kL:V)3b%3{\"?V)TR.", cchWideChar=32, lpMultiByteStr=0x2003cb8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4@FMggYnmhp?M$4kL:V)3b%3{\"?V)TR.", lpUsedDefaultChar=0x0) returned 32 [0065.618] GetCurrentThreadId () returned 0x970 [0065.618] GetCurrentThreadId () returned 0x970 [0065.618] GetCurrentThreadId () returned 0x970 [0065.618] GetCurrentThreadId () returned 0x970 [0065.618] GetCurrentThreadId () returned 0x970 [0065.618] GetCurrentThreadId () returned 0x970 [0065.626] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0065.626] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0065.626] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3798d98, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0065.626] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb348, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0065.626] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb348, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAErQLH51rcq9GQrdWuk30QlenQlPoeEWNdKQCpv5VsQn9NYiD1cUd3cj1tbBgTgLrQBTmrMHWvWlHa+htybqUbA6nJAjngynP7ThD0K8CvXcRbjmZnsqJipDJBUA9GWon5NHXzL+yrvmYCXH9PTo6R0MRWBgZ4mwjniO1E86kacE1BLgeY1UaY5g4JBboqP0V72ifm2+wHgUiu7yHyZexoer08Ttaa1gbg==") returned 232 [0065.626] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xc, wMilliseconds=0x37b)) [0065.626] GetCurrentThreadId () returned 0x970 [0065.626] GetCurrentThreadId () returned 0x970 [0065.626] GetCurrentThreadId () returned 0x970 [0065.626] GetCurrentThreadId () returned 0x970 [0065.626] GetCurrentThreadId () returned 0x970 [0065.626] GetCurrentThreadId () returned 0x970 [0065.626] GetCurrentThreadId () returned 0x970 [0065.626] GetCurrentThreadId () returned 0x970 [0065.626] GetCurrentThreadId () returned 0x970 [0065.626] GetCurrentThreadId () returned 0x970 [0065.626] GetCurrentThreadId () returned 0x970 [0065.626] GetCurrentThreadId () returned 0x970 [0065.626] GetCurrentThreadId () returned 0x970 [0065.626] GetCurrentThreadId () returned 0x970 [0065.626] GetCurrentThreadId () returned 0x970 [0065.626] GetCurrentThreadId () returned 0x970 [0065.626] GetCurrentThreadId () returned 0x970 [0065.626] GetCurrentThreadId () returned 0x970 [0065.626] GetCurrentThreadId () returned 0x970 [0065.626] GetCurrentThreadId () returned 0x970 [0065.626] GetCurrentThreadId () returned 0x970 [0065.627] GetCurrentThreadId () returned 0x970 [0065.627] GetCurrentThreadId () returned 0x970 [0065.627] GetCurrentThreadId () returned 0x970 [0065.627] GetCurrentThreadId () returned 0x970 [0065.627] GetCurrentThreadId () returned 0x970 [0065.627] GetCurrentThreadId () returned 0x970 [0065.627] GetCurrentThreadId () returned 0x970 [0065.627] GetCurrentThreadId () returned 0x970 [0065.627] GetCurrentThreadId () returned 0x970 [0065.627] GetCurrentThreadId () returned 0x970 [0065.627] GetCurrentThreadId () returned 0x970 [0065.627] GetCurrentThreadId () returned 0x970 [0065.627] GetCurrentThreadId () returned 0x970 [0065.627] GetCurrentThreadId () returned 0x970 [0065.627] GetCurrentThreadId () returned 0x970 [0065.627] GetCurrentThreadId () returned 0x970 [0065.627] GetCurrentThreadId () returned 0x970 [0065.627] GetCurrentThreadId () returned 0x970 [0065.627] GetCurrentThreadId () returned 0x970 [0065.627] GetCurrentThreadId () returned 0x970 [0065.627] GetCurrentThreadId () returned 0x970 [0065.627] GetCurrentThreadId () returned 0x970 [0065.627] GetCurrentThreadId () returned 0x970 [0065.627] GetCurrentThreadId () returned 0x970 [0065.627] GetCurrentThreadId () returned 0x970 [0065.627] GetCurrentThreadId () returned 0x970 [0065.627] GetCurrentThreadId () returned 0x970 [0065.627] GetCurrentThreadId () returned 0x970 [0065.627] GetCurrentThreadId () returned 0x970 [0065.627] GetCurrentThreadId () returned 0x970 [0065.628] GetCurrentThreadId () returned 0x970 [0065.628] GetCurrentThreadId () returned 0x970 [0065.628] GetCurrentThreadId () returned 0x970 [0065.628] GetCurrentThreadId () returned 0x970 [0065.628] GetCurrentThreadId () returned 0x970 [0065.628] GetCurrentThreadId () returned 0x970 [0065.628] GetCurrentThreadId () returned 0x970 [0065.628] GetCurrentThreadId () returned 0x970 [0065.628] GetCurrentThreadId () returned 0x970 [0065.628] GetCurrentThreadId () returned 0x970 [0065.628] GetCurrentThreadId () returned 0x970 [0065.628] GetCurrentThreadId () returned 0x970 [0065.628] GetCurrentThreadId () returned 0x970 [0065.628] GetCurrentThreadId () returned 0x970 [0065.628] GetCurrentThreadId () returned 0x970 [0065.628] GetCurrentThreadId () returned 0x970 [0065.628] GetCurrentThreadId () returned 0x970 [0065.628] GetCurrentThreadId () returned 0x970 [0065.628] GetCurrentThreadId () returned 0x970 [0065.628] GetCurrentThreadId () returned 0x970 [0065.628] GetCurrentThreadId () returned 0x970 [0065.628] GetCurrentThreadId () returned 0x970 [0065.628] GetCurrentThreadId () returned 0x970 [0065.628] GetCurrentThreadId () returned 0x970 [0065.628] GetCurrentThreadId () returned 0x970 [0065.628] GetCurrentThreadId () returned 0x970 [0065.628] GetCurrentThreadId () returned 0x970 [0065.628] GetCurrentThreadId () returned 0x970 [0065.628] GetCurrentThreadId () returned 0x970 [0065.628] GetCurrentThreadId () returned 0x970 [0065.628] GetCurrentThreadId () returned 0x970 [0065.628] GetCurrentThreadId () returned 0x970 [0065.628] GetCurrentThreadId () returned 0x970 [0065.628] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAErQLH51rcq9GQrdWuk30QlenQlPoeEWNdKQCpv5VsQn9NYiD1cUd3cj1tbBgTgLrQBTmrMHWvWlHa+htybqUbA6nJAjngynP7ThD0K8CvXcRbjmZnsqJipDJBUA9GWon5NHXzL+yrvmYCXH9PTo6R0MRWBgZ4mwjniO1E86kacE1BLgeY1UaY5g4JBboqP0V72ifm2+wHgUiu7yHyZexoer08Ttaa1gbg==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0065.628] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAErQLH51rcq9GQrdWuk30QlenQlPoeEWNdKQCpv5VsQn9NYiD1cUd3cj1tbBgTgLrQBTmrMHWvWlHa+htybqUbA6nJAjngynP7ThD0K8CvXcRbjmZnsqJipDJBUA9GWon5NHXzL+yrvmYCXH9PTo6R0MRWBgZ4mwjniO1E86kacE1BLgeY1UaY5g4JBboqP0V72ifm2+wHgUiu7yHyZexoer08Ttaa1gbg==", cchWideChar=245, lpMultiByteStr=0x353933c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAErQLH51rcq9GQrdWuk30QlenQlPoeEWNdKQCpv5VsQn9NYiD1cUd3cj1tbBgTgLrQBTmrMHWvWlHa+htybqUbA6nJAjngynP7ThD0K8CvXcRbjmZnsqJipDJBUA9GWon5NHXzL+yrvmYCXH9PTo6R0MRWBgZ4mwjniO1E86kacE1BLgeY1UaY5g4JBboqP0V72ifm2+wHgUiu7yHyZexoer08Ttaa1gbg==", lpUsedDefaultChar=0x0) returned 245 [0065.628] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0065.628] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0065.629] CloseHandle (hObject=0x158) returned 1 [0065.629] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_buttongraphic.png")) returned 0 [0065.629] GetLastError () returned 0x5 [0065.629] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_buttongraphic.png")) returned 0x20 [0065.629] SetLastError (dwErrCode=0x5) [0065.629] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=18589237614) returned 1 [0065.629] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Файл зашифрован [circle_glass_Thumbnail.bmp].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\Файл зашифрован [circle_glass_thumbnail.bmp].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0065.630] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0065.630] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0065.630] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0065.630] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0065.630] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0065.630] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0065.630] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0065.630] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0065.631] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0065.631] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0065.631] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0065.631] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0065.631] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0065.631] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0065.631] SetEndOfFile (hFile=0x158) returned 1 [0065.631] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0065.631] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0065.631] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0065.631] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0065.631] WriteFile (in: hFile=0x158, lpBuffer=0x3777058*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777058*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0065.632] WriteFile (in: hFile=0x158, lpBuffer=0x35f035c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f035c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0065.632] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MT3@LW:qaUzGqU*uYz>AAc!,FggT(K\\z", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0065.632] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MT3@LW:qaUzGqU*uYz>AAc!,FggT(K\\z", cchWideChar=32, lpMultiByteStr=0x20367d4, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MT3@LW:qaUzGqU*uYz>AAc!,FggT(K\\z", lpUsedDefaultChar=0x0) returned 32 [0065.632] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0065.632] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0065.632] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e990cc7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e990cc7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c7063e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="circle_glass_Thumbnail.bmp", cAlternateFileName="")) returned 0x295098 [0065.632] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0065.632] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0065.632] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_glass_thumbnail.bmp")) returned 0x20 [0065.633] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_glass_thumbnail.bmp")) returned 0x20 [0065.633] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_glass_thumbnail.bmp")) returned 0x20 [0065.633] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_glass_thumbnail.bmp")) returned 0x20 [0065.633] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_glass_thumbnail.bmp"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e990cc7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e990cc7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c7063e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0)) returned 1 [0065.633] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0065.633] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0065.633] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_glass_thumbnail.bmp")) returned 0x20 [0065.633] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_glass_thumbnail.bmp")) returned 0x20 [0065.633] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0065.633] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0065.633] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0065.633] SetEndOfFile (hFile=0x158) returned 1 [0065.634] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="circle_glass_Thumbnail.bmp", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0065.634] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="circle_glass_Thumbnail.bmp", cchWideChar=26, lpMultiByteStr=0x2003b3c, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="circle_glass_Thumbnail.bmp", lpUsedDefaultChar=0x0) returned 26 [0065.634] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="circle_glass_Thumbnail.bmp", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0065.634] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="circle_glass_Thumbnail.bmp", cchWideChar=26, lpMultiByteStr=0x2003b6c, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="circle_glass_Thumbnail.bmp", lpUsedDefaultChar=0x0) returned 26 [0065.634] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x2003b6c, cbMultiByte=26, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="circle_glass_Thumbnail.bmppngre.png.pngg") returned 26 [0065.634] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="circle_glass_Thumbnail.bmp", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0065.634] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="circle_glass_Thumbnail.bmp", cchWideChar=26, lpMultiByteStr=0x2003b3c, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="circle_glass_Thumbnail.bmp", lpUsedDefaultChar=0x0) returned 26 [0065.634] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_glass_thumbnail.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0065.635] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0065.635] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x13d0 [0065.635] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0065.635] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0065.635] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0065.635] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="circle_glass_Thumbnail.bmp", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0065.635] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="circle_glass_Thumbnail.bmp", cchWideChar=26, lpMultiByteStr=0x2003b3c, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="circle_glass_Thumbnail.bmp", lpUsedDefaultChar=0x0) returned 26 [0065.635] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="circle_glass_Thumbnail.bmp", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0065.635] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="circle_glass_Thumbnail.bmp", cchWideChar=26, lpMultiByteStr=0x2003b6c, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="circle_glass_Thumbnail.bmp", lpUsedDefaultChar=0x0) returned 26 [0065.635] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x2003b6c, cbMultiByte=26, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="circle_glass_Thumbnail.bmpil.bmppngre.png.pngg") returned 26 [0065.635] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="circle_glass_Thumbnail.bmp", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0065.635] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="circle_glass_Thumbnail.bmp", cchWideChar=26, lpMultiByteStr=0x2003b3c, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="circle_glass_Thumbnail.bmp", lpUsedDefaultChar=0x0) returned 26 [0065.635] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0065.636] CharToOemA (in: pSrc="circle_glass_Thumbnail.bmp", pDst=0x2003b6c | out: pDst="circle_glass_Thumbnail.bmp") returned 1 [0065.636] WriteFile (in: hFile=0x158, lpBuffer=0x2003b6c*, nNumberOfBytesToWrite=0x1a, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x2003b6c*, lpNumberOfBytesWritten=0x18e048*=0x1a, lpOverlapped=0x0) returned 1 [0065.636] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0065.636] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0065.636] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0065.636] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=18589988065) returned 1 [0065.636] ReadFile (in: hFile=0x11c, lpBuffer=0x37c6700, nNumberOfBytesToRead=0x13d0, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37c6700*, lpNumberOfBytesRead=0x18dd7c*=0x13d0, lpOverlapped=0x0) returned 1 [0065.638] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0065.638] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=18590145694) returned 1 [0065.647] WriteFile (in: hFile=0x158, lpBuffer=0x379ae58*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379ae58*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0065.648] ReadFile (in: hFile=0x11c, lpBuffer=0x37c6700, nNumberOfBytesToRead=0x13d0, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x37c6700*, lpNumberOfBytesRead=0x18de38*=0x13d0, lpOverlapped=0x0) returned 1 [0065.648] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x55 [0065.648] WriteFile (in: hFile=0x158, lpBuffer=0x3809320*, nNumberOfBytesToWrite=0x13d0, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3809320*, lpNumberOfBytesWritten=0x18de10*=0x13d0, lpOverlapped=0x0) returned 1 [0065.648] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x1425 [0065.648] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0065.648] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0065.648] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0065.648] SetFilePointer (in: hFile=0x158, lDistanceToMove=26, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x38 [0065.648] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x142f [0065.649] CloseHandle (hObject=0x11c) returned 1 [0065.649] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x142f [0065.649] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x142f [0065.649] SetFilePointer (in: hFile=0x158, lDistanceToMove=5167, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x142f [0065.649] SetFilePointer (in: hFile=0x158, lDistanceToMove=5167, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x142f [0065.649] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x142f [0065.649] SetFilePointer (in: hFile=0x158, lDistanceToMove=5167, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x142f [0065.649] SetEndOfFile (hFile=0x158) returned 1 [0065.649] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x142f [0065.649] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x142f [0065.649] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="circle_glass_Thumbnail.bmp", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0065.649] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="circle_glass_Thumbnail.bmp", cchWideChar=26, lpMultiByteStr=0x2003b6c, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="circle_glass_Thumbnail.bmp", lpUsedDefaultChar=0x0) returned 26 [0065.649] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="circle_glass_Thumbnail.bmp", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0065.649] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="circle_glass_Thumbnail.bmp", cchWideChar=26, lpMultiByteStr=0x2003b3c, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="circle_glass_Thumbnail.bmp", lpUsedDefaultChar=0x0) returned 26 [0065.649] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x2003b3c, cbMultiByte=26, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="circle_glass_Thumbnail.bmp\x14\x14\x01c䃊㫋켚ⲔᏬ") returned 26 [0065.649] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="circle_glass_Thumbnail.bmp", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0065.650] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="circle_glass_Thumbnail.bmp", cchWideChar=26, lpMultiByteStr=0x2003b6c, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="circle_glass_Thumbnail.bmp", lpUsedDefaultChar=0x0) returned 26 [0065.650] WriteFile (in: hFile=0x158, lpBuffer=0x37aa1d8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x37aa1d8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0065.650] CharToOemA (in: pSrc="circle_glass_Thumbnail.bmp", pDst=0x2003b3c | out: pDst="circle_glass_Thumbnail.bmp") returned 1 [0065.650] WriteFile (in: hFile=0x158, lpBuffer=0x2003b3c*, nNumberOfBytesToWrite=0x1a, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x2003b3c*, lpNumberOfBytesWritten=0x18efcc*=0x1a, lpOverlapped=0x0) returned 1 [0065.650] WriteFile (in: hFile=0x158, lpBuffer=0x379ad58*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379ad58*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0065.650] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0065.650] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0065.650] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1482 [0065.650] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1482 [0065.650] WriteFile (in: hFile=0x158, lpBuffer=0x3777058*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777058*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0065.650] WriteFile (in: hFile=0x158, lpBuffer=0x35f035c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f035c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0065.650] DeleteFileW (lpFileName="") returned 0 [0065.650] GetLastError () returned 0x3 [0065.650] GetFileAttributesW (lpFileName="") returned 0xffffffff [0065.650] SetLastError (dwErrCode=0x3) [0065.650] FlushFileBuffers (hFile=0x158) returned 1 [0065.653] GetCurrentThreadId () returned 0x970 [0065.653] GetCurrentThreadId () returned 0x970 [0065.653] GetCurrentThreadId () returned 0x970 [0065.653] GetCurrentThreadId () returned 0x970 [0065.653] GetCurrentThreadId () returned 0x970 [0065.653] GetCurrentThreadId () returned 0x970 [0065.653] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x1539 [0065.653] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x1539 [0065.653] SetFilePointer (in: hFile=0x158, lDistanceToMove=5433, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x1539 [0065.653] CloseHandle (hObject=0x158) returned 1 [0065.653] GetCurrentThreadId () returned 0x970 [0065.653] GetCurrentThreadId () returned 0x970 [0065.653] GetCurrentThreadId () returned 0x970 [0065.653] GetCurrentThreadId () returned 0x970 [0065.653] GetCurrentThreadId () returned 0x970 [0065.653] GetCurrentThreadId () returned 0x970 [0065.654] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Файл зашифрован [circle_glass_Thumbnail.bmp].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\Файл зашифрован [circle_glass_thumbnail.bmp].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0065.654] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1539 [0065.654] SetFilePointer (in: hFile=0x158, lDistanceToMove=5305, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x14b9 [0065.654] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0065.654] GetFileType (hFile=0x158) returned 0x1 [0065.654] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xc, wMilliseconds=0x39a)) [0065.654] GetCurrentThreadId () returned 0x970 [0065.654] GetCurrentThreadId () returned 0x970 [0065.654] GetCurrentThreadId () returned 0x970 [0065.654] GetCurrentThreadId () returned 0x970 [0065.654] GetCurrentThreadId () returned 0x970 [0065.654] GetCurrentThreadId () returned 0x970 [0065.654] GetCurrentThreadId () returned 0x970 [0065.654] GetCurrentThreadId () returned 0x970 [0065.654] GetCurrentThreadId () returned 0x970 [0065.654] GetCurrentThreadId () returned 0x970 [0065.654] GetCurrentThreadId () returned 0x970 [0065.654] GetCurrentThreadId () returned 0x970 [0065.654] GetCurrentThreadId () returned 0x970 [0065.654] GetCurrentThreadId () returned 0x970 [0065.654] GetCurrentThreadId () returned 0x970 [0065.654] GetCurrentThreadId () returned 0x970 [0065.654] GetCurrentThreadId () returned 0x970 [0065.654] GetCurrentThreadId () returned 0x970 [0065.654] GetCurrentThreadId () returned 0x970 [0065.654] GetCurrentThreadId () returned 0x970 [0065.654] GetCurrentThreadId () returned 0x970 [0065.654] GetCurrentThreadId () returned 0x970 [0065.654] GetCurrentThreadId () returned 0x970 [0065.654] GetCurrentThreadId () returned 0x970 [0065.654] GetCurrentThreadId () returned 0x970 [0065.654] GetCurrentThreadId () returned 0x970 [0065.654] GetCurrentThreadId () returned 0x970 [0065.654] GetCurrentThreadId () returned 0x970 [0065.655] GetCurrentThreadId () returned 0x970 [0065.655] GetCurrentThreadId () returned 0x970 [0065.655] GetCurrentThreadId () returned 0x970 [0065.655] GetCurrentThreadId () returned 0x970 [0065.655] GetCurrentThreadId () returned 0x970 [0065.655] GetCurrentThreadId () returned 0x970 [0065.655] GetCurrentThreadId () returned 0x970 [0065.655] GetCurrentThreadId () returned 0x970 [0065.655] GetCurrentThreadId () returned 0x970 [0065.655] GetCurrentThreadId () returned 0x970 [0065.655] GetCurrentThreadId () returned 0x970 [0065.655] GetCurrentThreadId () returned 0x970 [0065.655] GetCurrentThreadId () returned 0x970 [0065.655] GetCurrentThreadId () returned 0x970 [0065.655] GetCurrentThreadId () returned 0x970 [0065.655] GetCurrentThreadId () returned 0x970 [0065.655] GetCurrentThreadId () returned 0x970 [0065.655] GetCurrentThreadId () returned 0x970 [0065.655] GetCurrentThreadId () returned 0x970 [0065.655] GetCurrentThreadId () returned 0x970 [0065.655] GetCurrentThreadId () returned 0x970 [0065.655] GetCurrentThreadId () returned 0x970 [0065.655] GetCurrentThreadId () returned 0x970 [0065.655] GetCurrentThreadId () returned 0x970 [0065.655] GetCurrentThreadId () returned 0x970 [0065.655] GetCurrentThreadId () returned 0x970 [0065.655] GetCurrentThreadId () returned 0x970 [0065.655] GetCurrentThreadId () returned 0x970 [0065.655] GetCurrentThreadId () returned 0x970 [0065.655] GetCurrentThreadId () returned 0x970 [0065.655] GetCurrentThreadId () returned 0x970 [0065.655] GetCurrentThreadId () returned 0x970 [0065.655] GetCurrentThreadId () returned 0x970 [0065.655] GetCurrentThreadId () returned 0x970 [0065.655] GetCurrentThreadId () returned 0x970 [0065.655] GetCurrentThreadId () returned 0x970 [0065.655] GetCurrentThreadId () returned 0x970 [0065.655] GetCurrentThreadId () returned 0x970 [0065.655] GetCurrentThreadId () returned 0x970 [0065.655] GetCurrentThreadId () returned 0x970 [0065.655] GetCurrentThreadId () returned 0x970 [0065.655] GetCurrentThreadId () returned 0x970 [0065.656] GetCurrentThreadId () returned 0x970 [0065.656] GetCurrentThreadId () returned 0x970 [0065.656] GetCurrentThreadId () returned 0x970 [0065.656] GetCurrentThreadId () returned 0x970 [0065.656] GetCurrentThreadId () returned 0x970 [0065.656] GetCurrentThreadId () returned 0x970 [0065.656] GetCurrentThreadId () returned 0x970 [0065.656] GetCurrentThreadId () returned 0x970 [0065.656] GetCurrentThreadId () returned 0x970 [0065.656] GetCurrentThreadId () returned 0x970 [0065.656] GetCurrentThreadId () returned 0x970 [0065.656] GetCurrentThreadId () returned 0x970 [0065.656] GetCurrentThreadId () returned 0x970 [0065.656] GetCurrentThreadId () returned 0x970 [0065.656] GetCurrentThreadId () returned 0x970 [0065.656] GetCurrentThreadId () returned 0x970 [0065.656] GetCurrentThreadId () returned 0x970 [0065.656] GetCurrentThreadId () returned 0x970 [0065.656] GetCurrentThreadId () returned 0x970 [0065.656] GetCurrentThreadId () returned 0x970 [0065.656] GetCurrentThreadId () returned 0x970 [0065.656] GetCurrentThreadId () returned 0x970 [0065.656] GetCurrentThreadId () returned 0x970 [0065.656] GetCurrentThreadId () returned 0x970 [0065.656] GetCurrentThreadId () returned 0x970 [0065.656] GetCurrentThreadId () returned 0x970 [0065.656] GetCurrentThreadId () returned 0x970 [0065.656] GetCurrentThreadId () returned 0x970 [0065.656] GetCurrentThreadId () returned 0x970 [0065.656] GetCurrentThreadId () returned 0x970 [0065.656] GetCurrentThreadId () returned 0x970 [0065.656] GetCurrentThreadId () returned 0x970 [0065.657] GetCurrentThreadId () returned 0x970 [0065.657] GetCurrentThreadId () returned 0x970 [0065.657] GetCurrentThreadId () returned 0x970 [0065.657] GetCurrentThreadId () returned 0x970 [0065.657] GetCurrentThreadId () returned 0x970 [0065.657] GetCurrentThreadId () returned 0x970 [0065.657] GetCurrentThreadId () returned 0x970 [0065.657] GetCurrentThreadId () returned 0x970 [0065.657] GetCurrentThreadId () returned 0x970 [0065.657] GetCurrentThreadId () returned 0x970 [0065.657] GetCurrentThreadId () returned 0x970 [0065.657] GetCurrentThreadId () returned 0x970 [0065.657] GetCurrentThreadId () returned 0x970 [0065.657] GetCurrentThreadId () returned 0x970 [0065.657] GetCurrentThreadId () returned 0x970 [0065.657] GetCurrentThreadId () returned 0x970 [0065.657] GetCurrentThreadId () returned 0x970 [0065.657] GetCurrentThreadId () returned 0x970 [0065.657] GetCurrentThreadId () returned 0x970 [0065.657] GetCurrentThreadId () returned 0x970 [0065.657] GetCurrentThreadId () returned 0x970 [0065.657] GetCurrentThreadId () returned 0x970 [0065.657] GetCurrentThreadId () returned 0x970 [0065.657] GetCurrentThreadId () returned 0x970 [0065.657] GetCurrentThreadId () returned 0x970 [0065.657] GetCurrentThreadId () returned 0x970 [0065.657] GetCurrentThreadId () returned 0x970 [0065.657] GetCurrentThreadId () returned 0x970 [0065.657] GetCurrentThreadId () returned 0x970 [0065.657] GetCurrentThreadId () returned 0x970 [0065.657] GetCurrentThreadId () returned 0x970 [0065.657] GetCurrentThreadId () returned 0x970 [0065.657] GetCurrentThreadId () returned 0x970 [0065.657] GetCurrentThreadId () returned 0x970 [0065.658] GetCurrentThreadId () returned 0x970 [0065.658] GetCurrentThreadId () returned 0x970 [0065.658] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.658] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.658] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379bd78, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.658] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.658] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.658] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379bd78, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.658] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.658] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.658] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.658] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.658] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.658] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.658] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.658] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.658] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379bdd8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.658] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.658] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.658] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379bdd8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.658] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.658] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.659] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379bdd8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.659] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xc, wMilliseconds=0x3aa)) [0065.659] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MT3@LW:qaUzGqU*uYz>AAc!,FggT(K\\z", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0065.659] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MT3@LW:qaUzGqU*uYz>AAc!,FggT(K\\z", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0065.659] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MT3@LW:qaUzGqU*uYz>AAc!,FggT(K\\z", cchWideChar=32, lpMultiByteStr=0x2003ce8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MT3@LW:qaUzGqU*uYz>AAc!,FggT(K\\z", lpUsedDefaultChar=0x0) returned 32 [0065.659] GetCurrentThreadId () returned 0x970 [0065.659] GetCurrentThreadId () returned 0x970 [0065.659] GetCurrentThreadId () returned 0x970 [0065.659] GetCurrentThreadId () returned 0x970 [0065.659] GetCurrentThreadId () returned 0x970 [0065.659] GetCurrentThreadId () returned 0x970 [0065.667] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0065.667] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0065.667] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3798e88, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0065.667] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb348, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0065.667] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb348, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAACPZqMgkxmllYxFkRA3q9VV8XzR83n2wC3mQ3Qn7Y7XKznHFNXtjmjbgbK6bl6PAnQgTa3IIFvYWjLoHNjb7tjXQW1UmWAx4oMOJ4JFPPX/kVLzDFWnXqH3cmhLWG9ozw4aUN8ap2nWMi50oc1ZjxCQOw1mCBleimoHKP8zMIqTRlGbMMLAiMrQ7QrAkGEsZfjs13OiQeOZLvS+TsUoBvL037h1uCndItg==") returned 232 [0065.667] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xc, wMilliseconds=0x3aa)) [0065.667] GetCurrentThreadId () returned 0x970 [0065.667] GetCurrentThreadId () returned 0x970 [0065.667] GetCurrentThreadId () returned 0x970 [0065.667] GetCurrentThreadId () returned 0x970 [0065.667] GetCurrentThreadId () returned 0x970 [0065.667] GetCurrentThreadId () returned 0x970 [0065.667] GetCurrentThreadId () returned 0x970 [0065.667] GetCurrentThreadId () returned 0x970 [0065.667] GetCurrentThreadId () returned 0x970 [0065.667] GetCurrentThreadId () returned 0x970 [0065.667] GetCurrentThreadId () returned 0x970 [0065.667] GetCurrentThreadId () returned 0x970 [0065.667] GetCurrentThreadId () returned 0x970 [0065.667] GetCurrentThreadId () returned 0x970 [0065.667] GetCurrentThreadId () returned 0x970 [0065.667] GetCurrentThreadId () returned 0x970 [0065.667] GetCurrentThreadId () returned 0x970 [0065.667] GetCurrentThreadId () returned 0x970 [0065.667] GetCurrentThreadId () returned 0x970 [0065.667] GetCurrentThreadId () returned 0x970 [0065.667] GetCurrentThreadId () returned 0x970 [0065.667] GetCurrentThreadId () returned 0x970 [0065.667] GetCurrentThreadId () returned 0x970 [0065.667] GetCurrentThreadId () returned 0x970 [0065.667] GetCurrentThreadId () returned 0x970 [0065.667] GetCurrentThreadId () returned 0x970 [0065.667] GetCurrentThreadId () returned 0x970 [0065.667] GetCurrentThreadId () returned 0x970 [0065.667] GetCurrentThreadId () returned 0x970 [0065.667] GetCurrentThreadId () returned 0x970 [0065.667] GetCurrentThreadId () returned 0x970 [0065.667] GetCurrentThreadId () returned 0x970 [0065.667] GetCurrentThreadId () returned 0x970 [0065.667] GetCurrentThreadId () returned 0x970 [0065.667] GetCurrentThreadId () returned 0x970 [0065.667] GetCurrentThreadId () returned 0x970 [0065.668] GetCurrentThreadId () returned 0x970 [0065.668] GetCurrentThreadId () returned 0x970 [0065.668] GetCurrentThreadId () returned 0x970 [0065.668] GetCurrentThreadId () returned 0x970 [0065.668] GetCurrentThreadId () returned 0x970 [0065.668] GetCurrentThreadId () returned 0x970 [0065.668] GetCurrentThreadId () returned 0x970 [0065.668] GetCurrentThreadId () returned 0x970 [0065.668] GetCurrentThreadId () returned 0x970 [0065.668] GetCurrentThreadId () returned 0x970 [0065.668] GetCurrentThreadId () returned 0x970 [0065.668] GetCurrentThreadId () returned 0x970 [0065.668] GetCurrentThreadId () returned 0x970 [0065.668] GetCurrentThreadId () returned 0x970 [0065.668] GetCurrentThreadId () returned 0x970 [0065.668] GetCurrentThreadId () returned 0x970 [0065.668] GetCurrentThreadId () returned 0x970 [0065.668] GetCurrentThreadId () returned 0x970 [0065.668] GetCurrentThreadId () returned 0x970 [0065.668] GetCurrentThreadId () returned 0x970 [0065.668] GetCurrentThreadId () returned 0x970 [0065.668] GetCurrentThreadId () returned 0x970 [0065.668] GetCurrentThreadId () returned 0x970 [0065.668] GetCurrentThreadId () returned 0x970 [0065.668] GetCurrentThreadId () returned 0x970 [0065.668] GetCurrentThreadId () returned 0x970 [0065.668] GetCurrentThreadId () returned 0x970 [0065.668] GetCurrentThreadId () returned 0x970 [0065.668] GetCurrentThreadId () returned 0x970 [0065.668] GetCurrentThreadId () returned 0x970 [0065.668] GetCurrentThreadId () returned 0x970 [0065.668] GetCurrentThreadId () returned 0x970 [0065.668] GetCurrentThreadId () returned 0x970 [0065.668] GetCurrentThreadId () returned 0x970 [0065.668] GetCurrentThreadId () returned 0x970 [0065.668] GetCurrentThreadId () returned 0x970 [0065.668] GetCurrentThreadId () returned 0x970 [0065.668] GetCurrentThreadId () returned 0x970 [0065.668] GetCurrentThreadId () returned 0x970 [0065.668] GetCurrentThreadId () returned 0x970 [0065.668] GetCurrentThreadId () returned 0x970 [0065.668] GetCurrentThreadId () returned 0x970 [0065.668] GetCurrentThreadId () returned 0x970 [0065.668] GetCurrentThreadId () returned 0x970 [0065.668] GetCurrentThreadId () returned 0x970 [0065.669] GetCurrentThreadId () returned 0x970 [0065.669] GetCurrentThreadId () returned 0x970 [0065.669] GetCurrentThreadId () returned 0x970 [0065.669] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAACPZqMgkxmllYxFkRA3q9VV8XzR83n2wC3mQ3Qn7Y7XKznHFNXtjmjbgbK6bl6PAnQgTa3IIFvYWjLoHNjb7tjXQW1UmWAx4oMOJ4JFPPX/kVLzDFWnXqH3cmhLWG9ozw4aUN8ap2nWMi50oc1ZjxCQOw1mCBleimoHKP8zMIqTRlGbMMLAiMrQ7QrAkGEsZfjs13OiQeOZLvS+TsUoBvL037h1uCndItg==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0065.669] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAACPZqMgkxmllYxFkRA3q9VV8XzR83n2wC3mQ3Qn7Y7XKznHFNXtjmjbgbK6bl6PAnQgTa3IIFvYWjLoHNjb7tjXQW1UmWAx4oMOJ4JFPPX/kVLzDFWnXqH3cmhLWG9ozw4aUN8ap2nWMi50oc1ZjxCQOw1mCBleimoHKP8zMIqTRlGbMMLAiMrQ7QrAkGEsZfjs13OiQeOZLvS+TsUoBvL037h1uCndItg==", cchWideChar=245, lpMultiByteStr=0x353933c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAACPZqMgkxmllYxFkRA3q9VV8XzR83n2wC3mQ3Qn7Y7XKznHFNXtjmjbgbK6bl6PAnQgTa3IIFvYWjLoHNjb7tjXQW1UmWAx4oMOJ4JFPPX/kVLzDFWnXqH3cmhLWG9ozw4aUN8ap2nWMi50oc1ZjxCQOw1mCBleimoHKP8zMIqTRlGbMMLAiMrQ7QrAkGEsZfjs13OiQeOZLvS+TsUoBvL037h1uCndItg==", lpUsedDefaultChar=0x0) returned 245 [0065.669] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0065.669] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0065.669] CloseHandle (hObject=0x158) returned 1 [0065.669] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_glass_thumbnail.bmp")) returned 0 [0065.669] GetLastError () returned 0x5 [0065.669] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_glass_thumbnail.bmp")) returned 0x20 [0065.669] SetLastError (dwErrCode=0x5) [0065.669] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=18593278946) returned 1 [0065.669] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Файл зашифрован [Circle_SelectionSubpictureA.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\Файл зашифрован [circle_selectionsubpicturea.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0065.670] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0065.670] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0065.670] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0065.670] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0065.670] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0065.670] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0065.670] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0065.670] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0065.670] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0065.671] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0065.671] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0065.671] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0065.671] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0065.671] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0065.671] SetEndOfFile (hFile=0x158) returned 1 [0065.671] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0065.671] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0065.671] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0065.671] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0065.671] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0065.672] WriteFile (in: hFile=0x158, lpBuffer=0x35f04dc*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f04dc*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0065.672] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="!M#84.wh>^hD77KYdHiL7Bf5yF\".LuM5", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0065.672] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="!M#84.wh>^hD77KYdHiL7Bf5yF\".LuM5", cchWideChar=32, lpMultiByteStr=0x2034b9c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="!M#84.wh>^hD77KYdHiL7Bf5yF\".LuM5", lpUsedDefaultChar=0x0) returned 32 [0065.672] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0065.672] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0065.672] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ede1450, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ede1450, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c7063e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf26, dwReserved0=0x0, dwReserved1=0x0, cFileName="Circle_SelectionSubpictureA.png", cAlternateFileName="")) returned 0x295098 [0065.673] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0065.673] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0065.673] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpicturea.png")) returned 0x20 [0065.673] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpicturea.png")) returned 0x20 [0065.673] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpicturea.png")) returned 0x20 [0065.673] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpicturea.png")) returned 0x20 [0065.673] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpicturea.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ede1450, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ede1450, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c7063e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf26)) returned 1 [0065.673] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0065.673] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0065.673] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpicturea.png")) returned 0x20 [0065.673] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpicturea.png")) returned 0x20 [0065.673] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0065.673] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0065.673] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0065.673] SetEndOfFile (hFile=0x158) returned 1 [0065.674] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Circle_SelectionSubpictureA.png", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0065.674] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Circle_SelectionSubpictureA.png", cchWideChar=31, lpMultiByteStr=0x20037ac, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Circle_SelectionSubpictureA.png", lpUsedDefaultChar=0x0) returned 31 [0065.674] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Circle_SelectionSubpictureA.png", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0065.674] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Circle_SelectionSubpictureA.png", cchWideChar=31, lpMultiByteStr=0x2003adc, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Circle_SelectionSubpictureA.png", lpUsedDefaultChar=0x0) returned 31 [0065.674] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x2003adc, cbMultiByte=31, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="Circle_SelectionSubpictureA.png.png.pngg") returned 31 [0065.675] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Circle_SelectionSubpictureA.png", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0065.675] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Circle_SelectionSubpictureA.png", cchWideChar=31, lpMultiByteStr=0x20037ac, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Circle_SelectionSubpictureA.png", lpUsedDefaultChar=0x0) returned 31 [0065.675] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpicturea.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0065.675] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0065.675] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0xf26 [0065.675] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0065.675] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0065.675] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0065.675] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Circle_SelectionSubpictureA.png", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0065.675] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Circle_SelectionSubpictureA.png", cchWideChar=31, lpMultiByteStr=0x20037ac, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Circle_SelectionSubpictureA.png", lpUsedDefaultChar=0x0) returned 31 [0065.675] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Circle_SelectionSubpictureA.png", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0065.675] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Circle_SelectionSubpictureA.png", cchWideChar=31, lpMultiByteStr=0x2003adc, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Circle_SelectionSubpictureA.png", lpUsedDefaultChar=0x0) returned 31 [0065.675] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x2003adc, cbMultiByte=31, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="Circle_SelectionSubpictureA.pngeA.png.png.pngg") returned 31 [0065.675] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Circle_SelectionSubpictureA.png", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0065.675] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Circle_SelectionSubpictureA.png", cchWideChar=31, lpMultiByteStr=0x20037ac, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Circle_SelectionSubpictureA.png", lpUsedDefaultChar=0x0) returned 31 [0065.675] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0065.676] CharToOemA (in: pSrc="Circle_SelectionSubpictureA.png", pDst=0x2003adc | out: pDst="Circle_SelectionSubpictureA.png") returned 1 [0065.676] WriteFile (in: hFile=0x158, lpBuffer=0x2003adc*, nNumberOfBytesToWrite=0x1f, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x2003adc*, lpNumberOfBytesWritten=0x18e048*=0x1f, lpOverlapped=0x0) returned 1 [0065.676] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0065.677] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0065.677] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0065.677] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=18594013655) returned 1 [0065.677] ReadFile (in: hFile=0x11c, lpBuffer=0x37c6700, nNumberOfBytesToRead=0xf26, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37c6700*, lpNumberOfBytesRead=0x18dd7c*=0xf26, lpOverlapped=0x0) returned 1 [0065.678] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0065.678] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=18594170102) returned 1 [0065.687] WriteFile (in: hFile=0x158, lpBuffer=0x379ade0*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379ade0*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0065.687] ReadFile (in: hFile=0x11c, lpBuffer=0x37c6700, nNumberOfBytesToRead=0xf26, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x37c6700*, lpNumberOfBytesRead=0x18de38*=0xf26, lpOverlapped=0x0) returned 1 [0065.687] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x5a [0065.687] WriteFile (in: hFile=0x158, lpBuffer=0x3808e20*, nNumberOfBytesToWrite=0xf26, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3808e20*, lpNumberOfBytesWritten=0x18de10*=0xf26, lpOverlapped=0x0) returned 1 [0065.687] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0xf80 [0065.687] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0065.687] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0065.688] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0065.688] SetFilePointer (in: hFile=0x158, lDistanceToMove=31, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x3d [0065.688] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0xf8a [0065.688] CloseHandle (hObject=0x11c) returned 1 [0065.688] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xf8a [0065.688] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xf8a [0065.688] SetFilePointer (in: hFile=0x158, lDistanceToMove=3978, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xf8a [0065.688] SetFilePointer (in: hFile=0x158, lDistanceToMove=3978, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0xf8a [0065.688] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xf8a [0065.688] SetFilePointer (in: hFile=0x158, lDistanceToMove=3978, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0xf8a [0065.688] SetEndOfFile (hFile=0x158) returned 1 [0065.688] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xf8a [0065.688] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xf8a [0065.688] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Circle_SelectionSubpictureA.png", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0065.688] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Circle_SelectionSubpictureA.png", cchWideChar=31, lpMultiByteStr=0x2003adc, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Circle_SelectionSubpictureA.png", lpUsedDefaultChar=0x0) returned 31 [0065.689] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Circle_SelectionSubpictureA.png", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0065.689] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Circle_SelectionSubpictureA.png", cchWideChar=31, lpMultiByteStr=0x20037ac, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Circle_SelectionSubpictureA.png", lpUsedDefaultChar=0x0) returned 31 [0065.689] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x20037ac, cbMultiByte=31, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="Circle_SelectionSubpictureA.png㫋쥤椔ག") returned 31 [0065.689] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Circle_SelectionSubpictureA.png", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0065.689] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Circle_SelectionSubpictureA.png", cchWideChar=31, lpMultiByteStr=0x2003adc, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Circle_SelectionSubpictureA.png", lpUsedDefaultChar=0x0) returned 31 [0065.689] WriteFile (in: hFile=0x158, lpBuffer=0x37aa1d8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x37aa1d8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0065.689] CharToOemA (in: pSrc="Circle_SelectionSubpictureA.png", pDst=0x20037ac | out: pDst="Circle_SelectionSubpictureA.png") returned 1 [0065.689] WriteFile (in: hFile=0x158, lpBuffer=0x20037ac*, nNumberOfBytesToWrite=0x1f, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x20037ac*, lpNumberOfBytesWritten=0x18efcc*=0x1f, lpOverlapped=0x0) returned 1 [0065.689] WriteFile (in: hFile=0x158, lpBuffer=0x379ae18*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379ae18*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0065.689] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0065.689] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0065.689] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xfe2 [0065.689] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xfe2 [0065.689] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0065.690] WriteFile (in: hFile=0x158, lpBuffer=0x35f04dc*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f04dc*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0065.690] DeleteFileW (lpFileName="") returned 0 [0065.690] GetLastError () returned 0x3 [0065.690] GetFileAttributesW (lpFileName="") returned 0xffffffff [0065.690] SetLastError (dwErrCode=0x3) [0065.690] FlushFileBuffers (hFile=0x158) returned 1 [0065.692] GetCurrentThreadId () returned 0x970 [0065.692] GetCurrentThreadId () returned 0x970 [0065.692] GetCurrentThreadId () returned 0x970 [0065.692] GetCurrentThreadId () returned 0x970 [0065.692] GetCurrentThreadId () returned 0x970 [0065.692] GetCurrentThreadId () returned 0x970 [0065.692] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x1099 [0065.692] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x1099 [0065.692] SetFilePointer (in: hFile=0x158, lDistanceToMove=4249, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x1099 [0065.693] CloseHandle (hObject=0x158) returned 1 [0065.693] GetCurrentThreadId () returned 0x970 [0065.693] GetCurrentThreadId () returned 0x970 [0065.693] GetCurrentThreadId () returned 0x970 [0065.693] GetCurrentThreadId () returned 0x970 [0065.693] GetCurrentThreadId () returned 0x970 [0065.693] GetCurrentThreadId () returned 0x970 [0065.693] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Файл зашифрован [Circle_SelectionSubpictureA.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\Файл зашифрован [circle_selectionsubpicturea.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0065.693] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1099 [0065.693] SetFilePointer (in: hFile=0x158, lDistanceToMove=4121, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1019 [0065.693] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0065.693] GetFileType (hFile=0x158) returned 0x1 [0065.693] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xc, wMilliseconds=0x3c9)) [0065.693] GetCurrentThreadId () returned 0x970 [0065.693] GetCurrentThreadId () returned 0x970 [0065.693] GetCurrentThreadId () returned 0x970 [0065.693] GetCurrentThreadId () returned 0x970 [0065.693] GetCurrentThreadId () returned 0x970 [0065.693] GetCurrentThreadId () returned 0x970 [0065.693] GetCurrentThreadId () returned 0x970 [0065.693] GetCurrentThreadId () returned 0x970 [0065.693] GetCurrentThreadId () returned 0x970 [0065.693] GetCurrentThreadId () returned 0x970 [0065.693] GetCurrentThreadId () returned 0x970 [0065.693] GetCurrentThreadId () returned 0x970 [0065.693] GetCurrentThreadId () returned 0x970 [0065.693] GetCurrentThreadId () returned 0x970 [0065.693] GetCurrentThreadId () returned 0x970 [0065.694] GetCurrentThreadId () returned 0x970 [0065.694] GetCurrentThreadId () returned 0x970 [0065.694] GetCurrentThreadId () returned 0x970 [0065.694] GetCurrentThreadId () returned 0x970 [0065.694] GetCurrentThreadId () returned 0x970 [0065.694] GetCurrentThreadId () returned 0x970 [0065.694] GetCurrentThreadId () returned 0x970 [0065.694] GetCurrentThreadId () returned 0x970 [0065.694] GetCurrentThreadId () returned 0x970 [0065.694] GetCurrentThreadId () returned 0x970 [0065.694] GetCurrentThreadId () returned 0x970 [0065.694] GetCurrentThreadId () returned 0x970 [0065.694] GetCurrentThreadId () returned 0x970 [0065.694] GetCurrentThreadId () returned 0x970 [0065.694] GetCurrentThreadId () returned 0x970 [0065.694] GetCurrentThreadId () returned 0x970 [0065.694] GetCurrentThreadId () returned 0x970 [0065.694] GetCurrentThreadId () returned 0x970 [0065.694] GetCurrentThreadId () returned 0x970 [0065.694] GetCurrentThreadId () returned 0x970 [0065.694] GetCurrentThreadId () returned 0x970 [0065.694] GetCurrentThreadId () returned 0x970 [0065.694] GetCurrentThreadId () returned 0x970 [0065.694] GetCurrentThreadId () returned 0x970 [0065.694] GetCurrentThreadId () returned 0x970 [0065.694] GetCurrentThreadId () returned 0x970 [0065.694] GetCurrentThreadId () returned 0x970 [0065.694] GetCurrentThreadId () returned 0x970 [0065.694] GetCurrentThreadId () returned 0x970 [0065.694] GetCurrentThreadId () returned 0x970 [0065.694] GetCurrentThreadId () returned 0x970 [0065.694] GetCurrentThreadId () returned 0x970 [0065.694] GetCurrentThreadId () returned 0x970 [0065.694] GetCurrentThreadId () returned 0x970 [0065.694] GetCurrentThreadId () returned 0x970 [0065.694] GetCurrentThreadId () returned 0x970 [0065.694] GetCurrentThreadId () returned 0x970 [0065.694] GetCurrentThreadId () returned 0x970 [0065.694] GetCurrentThreadId () returned 0x970 [0065.694] GetCurrentThreadId () returned 0x970 [0065.694] GetCurrentThreadId () returned 0x970 [0065.694] GetCurrentThreadId () returned 0x970 [0065.694] GetCurrentThreadId () returned 0x970 [0065.694] GetCurrentThreadId () returned 0x970 [0065.694] GetCurrentThreadId () returned 0x970 [0065.694] GetCurrentThreadId () returned 0x970 [0065.695] GetCurrentThreadId () returned 0x970 [0065.695] GetCurrentThreadId () returned 0x970 [0065.695] GetCurrentThreadId () returned 0x970 [0065.695] GetCurrentThreadId () returned 0x970 [0065.695] GetCurrentThreadId () returned 0x970 [0065.695] GetCurrentThreadId () returned 0x970 [0065.695] GetCurrentThreadId () returned 0x970 [0065.695] GetCurrentThreadId () returned 0x970 [0065.695] GetCurrentThreadId () returned 0x970 [0065.695] GetCurrentThreadId () returned 0x970 [0065.695] GetCurrentThreadId () returned 0x970 [0065.695] GetCurrentThreadId () returned 0x970 [0065.695] GetCurrentThreadId () returned 0x970 [0065.695] GetCurrentThreadId () returned 0x970 [0065.695] GetCurrentThreadId () returned 0x970 [0065.695] GetCurrentThreadId () returned 0x970 [0065.695] GetCurrentThreadId () returned 0x970 [0065.695] GetCurrentThreadId () returned 0x970 [0065.695] GetCurrentThreadId () returned 0x970 [0065.695] GetCurrentThreadId () returned 0x970 [0065.695] GetCurrentThreadId () returned 0x970 [0065.695] GetCurrentThreadId () returned 0x970 [0065.695] GetCurrentThreadId () returned 0x970 [0065.695] GetCurrentThreadId () returned 0x970 [0065.695] GetCurrentThreadId () returned 0x970 [0065.695] GetCurrentThreadId () returned 0x970 [0065.695] GetCurrentThreadId () returned 0x970 [0065.695] GetCurrentThreadId () returned 0x970 [0065.695] GetCurrentThreadId () returned 0x970 [0065.695] GetCurrentThreadId () returned 0x970 [0065.695] GetCurrentThreadId () returned 0x970 [0065.695] GetCurrentThreadId () returned 0x970 [0065.695] GetCurrentThreadId () returned 0x970 [0065.695] GetCurrentThreadId () returned 0x970 [0065.695] GetCurrentThreadId () returned 0x970 [0065.695] GetCurrentThreadId () returned 0x970 [0065.695] GetCurrentThreadId () returned 0x970 [0065.695] GetCurrentThreadId () returned 0x970 [0065.695] GetCurrentThreadId () returned 0x970 [0065.695] GetCurrentThreadId () returned 0x970 [0065.695] GetCurrentThreadId () returned 0x970 [0065.695] GetCurrentThreadId () returned 0x970 [0065.695] GetCurrentThreadId () returned 0x970 [0065.695] GetCurrentThreadId () returned 0x970 [0065.695] GetCurrentThreadId () returned 0x970 [0065.695] GetCurrentThreadId () returned 0x970 [0065.696] GetCurrentThreadId () returned 0x970 [0065.696] GetCurrentThreadId () returned 0x970 [0065.696] GetCurrentThreadId () returned 0x970 [0065.696] GetCurrentThreadId () returned 0x970 [0065.696] GetCurrentThreadId () returned 0x970 [0065.696] GetCurrentThreadId () returned 0x970 [0065.696] GetCurrentThreadId () returned 0x970 [0065.696] GetCurrentThreadId () returned 0x970 [0065.696] GetCurrentThreadId () returned 0x970 [0065.696] GetCurrentThreadId () returned 0x970 [0065.696] GetCurrentThreadId () returned 0x970 [0065.696] GetCurrentThreadId () returned 0x970 [0065.696] GetCurrentThreadId () returned 0x970 [0065.696] GetCurrentThreadId () returned 0x970 [0065.696] GetCurrentThreadId () returned 0x970 [0065.696] GetCurrentThreadId () returned 0x970 [0065.696] GetCurrentThreadId () returned 0x970 [0065.696] GetCurrentThreadId () returned 0x970 [0065.696] GetCurrentThreadId () returned 0x970 [0065.696] GetCurrentThreadId () returned 0x970 [0065.696] GetCurrentThreadId () returned 0x970 [0065.696] GetCurrentThreadId () returned 0x970 [0065.696] GetCurrentThreadId () returned 0x970 [0065.696] GetCurrentThreadId () returned 0x970 [0065.696] GetCurrentThreadId () returned 0x970 [0065.696] GetCurrentThreadId () returned 0x970 [0065.696] GetCurrentThreadId () returned 0x970 [0065.696] GetCurrentThreadId () returned 0x970 [0065.696] GetCurrentThreadId () returned 0x970 [0065.696] GetCurrentThreadId () returned 0x970 [0065.696] GetCurrentThreadId () returned 0x970 [0065.696] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.696] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.696] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379bdd8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.696] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.696] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.696] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379bdd8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.696] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.696] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.696] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.696] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.696] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.697] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.697] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.697] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.697] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379be38, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.697] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.697] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.697] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379be38, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.697] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.697] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.697] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379be38, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.697] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xc, wMilliseconds=0x3c9)) [0065.697] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="!M#84.wh>^hD77KYdHiL7Bf5yF\".LuM5", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0065.697] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="!M#84.wh>^hD77KYdHiL7Bf5yF\".LuM5", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0065.697] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="!M#84.wh>^hD77KYdHiL7Bf5yF\".LuM5", cchWideChar=32, lpMultiByteStr=0x2003d18, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="!M#84.wh>^hD77KYdHiL7Bf5yF\".LuM5", lpUsedDefaultChar=0x0) returned 32 [0065.697] GetCurrentThreadId () returned 0x970 [0065.697] GetCurrentThreadId () returned 0x970 [0065.697] GetCurrentThreadId () returned 0x970 [0065.697] GetCurrentThreadId () returned 0x970 [0065.697] GetCurrentThreadId () returned 0x970 [0065.697] GetCurrentThreadId () returned 0x970 [0065.704] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0065.705] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0065.705] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3799018, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0065.705] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb348, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0065.705] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb348, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAFoVT2zsPwQpc+Ec4pVz2PEEs9Gb/d+K6Iw9Arg7SLhpkam0WlgMHGqkXpaudkVU4uzsUuJ/JW9m/utQEZdzlmFut0910xQc38cTDlxNAtHj4SHAu6C5D0UScX65piK8yTONkQKJIgRpYa1CYz81AfbhFqJvcD/CEWiU0wqUykQBfxjc9+xxzUQBP4/gwvz2kRSrgKXTKFcwEv8mfCUOkVJoLN3AGurf5g==") returned 232 [0065.705] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xc, wMilliseconds=0x3c9)) [0065.705] GetCurrentThreadId () returned 0x970 [0065.705] GetCurrentThreadId () returned 0x970 [0065.705] GetCurrentThreadId () returned 0x970 [0065.705] GetCurrentThreadId () returned 0x970 [0065.705] GetCurrentThreadId () returned 0x970 [0065.705] GetCurrentThreadId () returned 0x970 [0065.705] GetCurrentThreadId () returned 0x970 [0065.705] GetCurrentThreadId () returned 0x970 [0065.705] GetCurrentThreadId () returned 0x970 [0065.705] GetCurrentThreadId () returned 0x970 [0065.705] GetCurrentThreadId () returned 0x970 [0065.705] GetCurrentThreadId () returned 0x970 [0065.705] GetCurrentThreadId () returned 0x970 [0065.705] GetCurrentThreadId () returned 0x970 [0065.705] GetCurrentThreadId () returned 0x970 [0065.705] GetCurrentThreadId () returned 0x970 [0065.705] GetCurrentThreadId () returned 0x970 [0065.705] GetCurrentThreadId () returned 0x970 [0065.705] GetCurrentThreadId () returned 0x970 [0065.705] GetCurrentThreadId () returned 0x970 [0065.705] GetCurrentThreadId () returned 0x970 [0065.705] GetCurrentThreadId () returned 0x970 [0065.705] GetCurrentThreadId () returned 0x970 [0065.705] GetCurrentThreadId () returned 0x970 [0065.705] GetCurrentThreadId () returned 0x970 [0065.705] GetCurrentThreadId () returned 0x970 [0065.705] GetCurrentThreadId () returned 0x970 [0065.705] GetCurrentThreadId () returned 0x970 [0065.705] GetCurrentThreadId () returned 0x970 [0065.705] GetCurrentThreadId () returned 0x970 [0065.705] GetCurrentThreadId () returned 0x970 [0065.705] GetCurrentThreadId () returned 0x970 [0065.705] GetCurrentThreadId () returned 0x970 [0065.705] GetCurrentThreadId () returned 0x970 [0065.706] GetCurrentThreadId () returned 0x970 [0065.706] GetCurrentThreadId () returned 0x970 [0065.706] GetCurrentThreadId () returned 0x970 [0065.706] GetCurrentThreadId () returned 0x970 [0065.706] GetCurrentThreadId () returned 0x970 [0065.706] GetCurrentThreadId () returned 0x970 [0065.706] GetCurrentThreadId () returned 0x970 [0065.706] GetCurrentThreadId () returned 0x970 [0065.706] GetCurrentThreadId () returned 0x970 [0065.706] GetCurrentThreadId () returned 0x970 [0065.706] GetCurrentThreadId () returned 0x970 [0065.706] GetCurrentThreadId () returned 0x970 [0065.706] GetCurrentThreadId () returned 0x970 [0065.706] GetCurrentThreadId () returned 0x970 [0065.706] GetCurrentThreadId () returned 0x970 [0065.706] GetCurrentThreadId () returned 0x970 [0065.706] GetCurrentThreadId () returned 0x970 [0065.706] GetCurrentThreadId () returned 0x970 [0065.706] GetCurrentThreadId () returned 0x970 [0065.706] GetCurrentThreadId () returned 0x970 [0065.706] GetCurrentThreadId () returned 0x970 [0065.706] GetCurrentThreadId () returned 0x970 [0065.706] GetCurrentThreadId () returned 0x970 [0065.706] GetCurrentThreadId () returned 0x970 [0065.706] GetCurrentThreadId () returned 0x970 [0065.706] GetCurrentThreadId () returned 0x970 [0065.706] GetCurrentThreadId () returned 0x970 [0065.706] GetCurrentThreadId () returned 0x970 [0065.706] GetCurrentThreadId () returned 0x970 [0065.706] GetCurrentThreadId () returned 0x970 [0065.706] GetCurrentThreadId () returned 0x970 [0065.706] GetCurrentThreadId () returned 0x970 [0065.706] GetCurrentThreadId () returned 0x970 [0065.706] GetCurrentThreadId () returned 0x970 [0065.706] GetCurrentThreadId () returned 0x970 [0065.706] GetCurrentThreadId () returned 0x970 [0065.706] GetCurrentThreadId () returned 0x970 [0065.706] GetCurrentThreadId () returned 0x970 [0065.706] GetCurrentThreadId () returned 0x970 [0065.706] GetCurrentThreadId () returned 0x970 [0065.706] GetCurrentThreadId () returned 0x970 [0065.706] GetCurrentThreadId () returned 0x970 [0065.706] GetCurrentThreadId () returned 0x970 [0065.706] GetCurrentThreadId () returned 0x970 [0065.707] GetCurrentThreadId () returned 0x970 [0065.707] GetCurrentThreadId () returned 0x970 [0065.707] GetCurrentThreadId () returned 0x970 [0065.707] GetCurrentThreadId () returned 0x970 [0065.707] GetCurrentThreadId () returned 0x970 [0065.707] GetCurrentThreadId () returned 0x970 [0065.707] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAFoVT2zsPwQpc+Ec4pVz2PEEs9Gb/d+K6Iw9Arg7SLhpkam0WlgMHGqkXpaudkVU4uzsUuJ/JW9m/utQEZdzlmFut0910xQc38cTDlxNAtHj4SHAu6C5D0UScX65piK8yTONkQKJIgRpYa1CYz81AfbhFqJvcD/CEWiU0wqUykQBfxjc9+xxzUQBP4/gwvz2kRSrgKXTKFcwEv8mfCUOkVJoLN3AGurf5g==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0065.707] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAFoVT2zsPwQpc+Ec4pVz2PEEs9Gb/d+K6Iw9Arg7SLhpkam0WlgMHGqkXpaudkVU4uzsUuJ/JW9m/utQEZdzlmFut0910xQc38cTDlxNAtHj4SHAu6C5D0UScX65piK8yTONkQKJIgRpYa1CYz81AfbhFqJvcD/CEWiU0wqUykQBfxjc9+xxzUQBP4/gwvz2kRSrgKXTKFcwEv8mfCUOkVJoLN3AGurf5g==", cchWideChar=245, lpMultiByteStr=0x353933c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAFoVT2zsPwQpc+Ec4pVz2PEEs9Gb/d+K6Iw9Arg7SLhpkam0WlgMHGqkXpaudkVU4uzsUuJ/JW9m/utQEZdzlmFut0910xQc38cTDlxNAtHj4SHAu6C5D0UScX65piK8yTONkQKJIgRpYa1CYz81AfbhFqJvcD/CEWiU0wqUykQBfxjc9+xxzUQBP4/gwvz2kRSrgKXTKFcwEv8mfCUOkVJoLN3AGurf5g==", lpUsedDefaultChar=0x0) returned 245 [0065.707] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0065.707] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0065.707] CloseHandle (hObject=0x158) returned 1 [0065.707] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpicturea.png")) returned 0 [0065.707] GetLastError () returned 0x5 [0065.707] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpicturea.png")) returned 0x20 [0065.707] SetLastError (dwErrCode=0x5) [0065.707] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=18597076934) returned 1 [0065.707] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Файл зашифрован [Circle_SelectionSubpictureB.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\Файл зашифрован [circle_selectionsubpictureb.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0065.708] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0065.708] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0065.708] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0065.708] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0065.708] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0065.708] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0065.708] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0065.708] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0065.708] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0065.708] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0065.708] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0065.708] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0065.709] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0065.709] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0065.709] SetEndOfFile (hFile=0x158) returned 1 [0065.709] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0065.709] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0065.709] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0065.709] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0065.709] WriteFile (in: hFile=0x158, lpBuffer=0x3777058*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777058*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0065.710] WriteFile (in: hFile=0x158, lpBuffer=0x35f035c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f035c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0065.710] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="hN#o4j7=Z5CSBMYjb\\&Ho2NtyuN#s~Q:", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0065.710] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="hN#o4j7=Z5CSBMYjb\\&Ho2NtyuN#s~Q:", cchWideChar=32, lpMultiByteStr=0x203680c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hN#o4j7=Z5CSBMYjb\\&Ho2NtyuN#s~Q:", lpUsedDefaultChar=0x0) returned 32 [0065.710] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0065.710] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0065.710] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ede1450, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ede1450, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c7063e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Circle_SelectionSubpictureB.png", cAlternateFileName="")) returned 0x295098 [0065.710] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0065.710] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0065.711] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpictureb.png")) returned 0x20 [0065.711] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpictureb.png")) returned 0x20 [0065.711] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpictureb.png")) returned 0x20 [0065.711] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpictureb.png")) returned 0x20 [0065.711] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpictureb.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ede1450, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ede1450, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c7063e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc8f)) returned 1 [0065.712] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0065.712] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0065.712] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpictureb.png")) returned 0x20 [0065.712] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpictureb.png")) returned 0x20 [0065.712] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0065.712] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0065.712] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0065.712] SetEndOfFile (hFile=0x158) returned 1 [0065.713] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Circle_SelectionSubpictureB.png", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0065.713] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Circle_SelectionSubpictureB.png", cchWideChar=31, lpMultiByteStr=0x200395c, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Circle_SelectionSubpictureB.png", lpUsedDefaultChar=0x0) returned 31 [0065.713] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Circle_SelectionSubpictureB.png", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0065.713] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Circle_SelectionSubpictureB.png", cchWideChar=31, lpMultiByteStr=0x20038fc, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Circle_SelectionSubpictureB.png", lpUsedDefaultChar=0x0) returned 31 [0065.713] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x20038fc, cbMultiByte=31, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="Circle_SelectionSubpictureB.png.png.pngg") returned 31 [0065.713] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Circle_SelectionSubpictureB.png", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0065.713] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Circle_SelectionSubpictureB.png", cchWideChar=31, lpMultiByteStr=0x200395c, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Circle_SelectionSubpictureB.png", lpUsedDefaultChar=0x0) returned 31 [0065.713] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpictureb.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0065.713] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0065.713] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0xc8f [0065.713] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0065.713] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0065.713] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0065.714] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Circle_SelectionSubpictureB.png", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0065.714] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Circle_SelectionSubpictureB.png", cchWideChar=31, lpMultiByteStr=0x200395c, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Circle_SelectionSubpictureB.png", lpUsedDefaultChar=0x0) returned 31 [0065.714] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Circle_SelectionSubpictureB.png", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0065.714] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Circle_SelectionSubpictureB.png", cchWideChar=31, lpMultiByteStr=0x20038fc, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Circle_SelectionSubpictureB.png", lpUsedDefaultChar=0x0) returned 31 [0065.714] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x20038fc, cbMultiByte=31, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="Circle_SelectionSubpictureB.pngeB.png.png.pngg") returned 31 [0065.714] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Circle_SelectionSubpictureB.png", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0065.714] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Circle_SelectionSubpictureB.png", cchWideChar=31, lpMultiByteStr=0x200395c, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Circle_SelectionSubpictureB.png", lpUsedDefaultChar=0x0) returned 31 [0065.714] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0065.715] CharToOemA (in: pSrc="Circle_SelectionSubpictureB.png", pDst=0x20038fc | out: pDst="Circle_SelectionSubpictureB.png") returned 1 [0065.715] WriteFile (in: hFile=0x158, lpBuffer=0x20038fc*, nNumberOfBytesToWrite=0x1f, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x20038fc*, lpNumberOfBytesWritten=0x18e048*=0x1f, lpOverlapped=0x0) returned 1 [0065.715] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0065.715] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0065.715] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0065.715] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=18597882568) returned 1 [0065.715] ReadFile (in: hFile=0x11c, lpBuffer=0x37cda30, nNumberOfBytesToRead=0xc8f, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37cda30*, lpNumberOfBytesRead=0x18dd7c*=0xc8f, lpOverlapped=0x0) returned 1 [0065.719] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0065.719] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=18598284025) returned 1 [0065.728] WriteFile (in: hFile=0x158, lpBuffer=0x379ad68*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379ad68*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0065.728] ReadFile (in: hFile=0x11c, lpBuffer=0x37cda30, nNumberOfBytesToRead=0xc8f, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x37cda30*, lpNumberOfBytesRead=0x18de38*=0xc8f, lpOverlapped=0x0) returned 1 [0065.728] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x5a [0065.728] WriteFile (in: hFile=0x158, lpBuffer=0x380ff50*, nNumberOfBytesToWrite=0xc8f, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x380ff50*, lpNumberOfBytesWritten=0x18de10*=0xc8f, lpOverlapped=0x0) returned 1 [0065.729] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0xce9 [0065.729] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0065.729] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0065.729] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0065.729] SetFilePointer (in: hFile=0x158, lDistanceToMove=31, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x3d [0065.729] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0xcf3 [0065.729] CloseHandle (hObject=0x11c) returned 1 [0065.729] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xcf3 [0065.729] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xcf3 [0065.729] SetFilePointer (in: hFile=0x158, lDistanceToMove=3315, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xcf3 [0065.729] SetFilePointer (in: hFile=0x158, lDistanceToMove=3315, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0xcf3 [0065.729] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xcf3 [0065.730] SetFilePointer (in: hFile=0x158, lDistanceToMove=3315, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0xcf3 [0065.730] SetEndOfFile (hFile=0x158) returned 1 [0065.730] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xcf3 [0065.730] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xcf3 [0065.730] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Circle_SelectionSubpictureB.png", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0065.730] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Circle_SelectionSubpictureB.png", cchWideChar=31, lpMultiByteStr=0x20038fc, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Circle_SelectionSubpictureB.png", lpUsedDefaultChar=0x0) returned 31 [0065.730] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Circle_SelectionSubpictureB.png", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0065.730] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Circle_SelectionSubpictureB.png", cchWideChar=31, lpMultiByteStr=0x200395c, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Circle_SelectionSubpictureB.png", lpUsedDefaultChar=0x0) returned 31 [0065.730] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x200395c, cbMultiByte=31, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="Circle_SelectionSubpictureB.png㫋鲰斅ಫ") returned 31 [0065.730] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Circle_SelectionSubpictureB.png", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0065.730] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Circle_SelectionSubpictureB.png", cchWideChar=31, lpMultiByteStr=0x20038fc, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Circle_SelectionSubpictureB.png", lpUsedDefaultChar=0x0) returned 31 [0065.730] WriteFile (in: hFile=0x158, lpBuffer=0x37b1508*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x37b1508*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0065.730] CharToOemA (in: pSrc="Circle_SelectionSubpictureB.png", pDst=0x200395c | out: pDst="Circle_SelectionSubpictureB.png") returned 1 [0065.730] WriteFile (in: hFile=0x158, lpBuffer=0x200395c*, nNumberOfBytesToWrite=0x1f, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x200395c*, lpNumberOfBytesWritten=0x18efcc*=0x1f, lpOverlapped=0x0) returned 1 [0065.730] WriteFile (in: hFile=0x158, lpBuffer=0x379acf8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379acf8*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0065.730] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0065.731] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0065.731] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xd4b [0065.731] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xd4b [0065.731] WriteFile (in: hFile=0x158, lpBuffer=0x3777058*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777058*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0065.731] WriteFile (in: hFile=0x158, lpBuffer=0x35f035c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f035c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0065.731] DeleteFileW (lpFileName="") returned 0 [0065.731] GetLastError () returned 0x3 [0065.731] GetFileAttributesW (lpFileName="") returned 0xffffffff [0065.731] SetLastError (dwErrCode=0x3) [0065.731] FlushFileBuffers (hFile=0x158) returned 1 [0065.734] GetCurrentThreadId () returned 0x970 [0065.734] GetCurrentThreadId () returned 0x970 [0065.734] GetCurrentThreadId () returned 0x970 [0065.734] GetCurrentThreadId () returned 0x970 [0065.734] GetCurrentThreadId () returned 0x970 [0065.734] GetCurrentThreadId () returned 0x970 [0065.734] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xe02 [0065.734] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xe02 [0065.734] SetFilePointer (in: hFile=0x158, lDistanceToMove=3586, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xe02 [0065.734] CloseHandle (hObject=0x158) returned 1 [0065.734] GetCurrentThreadId () returned 0x970 [0065.734] GetCurrentThreadId () returned 0x970 [0065.734] GetCurrentThreadId () returned 0x970 [0065.734] GetCurrentThreadId () returned 0x970 [0065.734] GetCurrentThreadId () returned 0x970 [0065.734] GetCurrentThreadId () returned 0x970 [0065.734] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Файл зашифрован [Circle_SelectionSubpictureB.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\Файл зашифрован [circle_selectionsubpictureb.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0065.735] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe02 [0065.735] SetFilePointer (in: hFile=0x158, lDistanceToMove=3458, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd82 [0065.735] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0065.735] GetFileType (hFile=0x158) returned 0x1 [0065.735] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xd, wMilliseconds=0x0)) [0065.735] GetCurrentThreadId () returned 0x970 [0065.735] GetCurrentThreadId () returned 0x970 [0065.735] GetCurrentThreadId () returned 0x970 [0065.735] GetCurrentThreadId () returned 0x970 [0065.735] GetCurrentThreadId () returned 0x970 [0065.735] GetCurrentThreadId () returned 0x970 [0065.735] GetCurrentThreadId () returned 0x970 [0065.735] GetCurrentThreadId () returned 0x970 [0065.735] GetCurrentThreadId () returned 0x970 [0065.735] GetCurrentThreadId () returned 0x970 [0065.735] GetCurrentThreadId () returned 0x970 [0065.735] GetCurrentThreadId () returned 0x970 [0065.735] GetCurrentThreadId () returned 0x970 [0065.735] GetCurrentThreadId () returned 0x970 [0065.735] GetCurrentThreadId () returned 0x970 [0065.735] GetCurrentThreadId () returned 0x970 [0065.735] GetCurrentThreadId () returned 0x970 [0065.735] GetCurrentThreadId () returned 0x970 [0065.735] GetCurrentThreadId () returned 0x970 [0065.735] GetCurrentThreadId () returned 0x970 [0065.735] GetCurrentThreadId () returned 0x970 [0065.735] GetCurrentThreadId () returned 0x970 [0065.735] GetCurrentThreadId () returned 0x970 [0065.735] GetCurrentThreadId () returned 0x970 [0065.735] GetCurrentThreadId () returned 0x970 [0065.735] GetCurrentThreadId () returned 0x970 [0065.735] GetCurrentThreadId () returned 0x970 [0065.735] GetCurrentThreadId () returned 0x970 [0065.735] GetCurrentThreadId () returned 0x970 [0065.735] GetCurrentThreadId () returned 0x970 [0065.735] GetCurrentThreadId () returned 0x970 [0065.735] GetCurrentThreadId () returned 0x970 [0065.735] GetCurrentThreadId () returned 0x970 [0065.735] GetCurrentThreadId () returned 0x970 [0065.736] GetCurrentThreadId () returned 0x970 [0065.736] GetCurrentThreadId () returned 0x970 [0065.736] GetCurrentThreadId () returned 0x970 [0065.736] GetCurrentThreadId () returned 0x970 [0065.736] GetCurrentThreadId () returned 0x970 [0065.736] GetCurrentThreadId () returned 0x970 [0065.736] GetCurrentThreadId () returned 0x970 [0065.736] GetCurrentThreadId () returned 0x970 [0065.736] GetCurrentThreadId () returned 0x970 [0065.736] GetCurrentThreadId () returned 0x970 [0065.736] GetCurrentThreadId () returned 0x970 [0065.736] GetCurrentThreadId () returned 0x970 [0065.736] GetCurrentThreadId () returned 0x970 [0065.736] GetCurrentThreadId () returned 0x970 [0065.736] GetCurrentThreadId () returned 0x970 [0065.736] GetCurrentThreadId () returned 0x970 [0065.736] GetCurrentThreadId () returned 0x970 [0065.736] GetCurrentThreadId () returned 0x970 [0065.736] GetCurrentThreadId () returned 0x970 [0065.736] GetCurrentThreadId () returned 0x970 [0065.736] GetCurrentThreadId () returned 0x970 [0065.736] GetCurrentThreadId () returned 0x970 [0065.736] GetCurrentThreadId () returned 0x970 [0065.736] GetCurrentThreadId () returned 0x970 [0065.736] GetCurrentThreadId () returned 0x970 [0065.736] GetCurrentThreadId () returned 0x970 [0065.736] GetCurrentThreadId () returned 0x970 [0065.736] GetCurrentThreadId () returned 0x970 [0065.736] GetCurrentThreadId () returned 0x970 [0065.736] GetCurrentThreadId () returned 0x970 [0065.736] GetCurrentThreadId () returned 0x970 [0065.736] GetCurrentThreadId () returned 0x970 [0065.736] GetCurrentThreadId () returned 0x970 [0065.736] GetCurrentThreadId () returned 0x970 [0065.736] GetCurrentThreadId () returned 0x970 [0065.736] GetCurrentThreadId () returned 0x970 [0065.736] GetCurrentThreadId () returned 0x970 [0065.736] GetCurrentThreadId () returned 0x970 [0065.736] GetCurrentThreadId () returned 0x970 [0065.736] GetCurrentThreadId () returned 0x970 [0065.736] GetCurrentThreadId () returned 0x970 [0065.736] GetCurrentThreadId () returned 0x970 [0065.736] GetCurrentThreadId () returned 0x970 [0065.737] GetCurrentThreadId () returned 0x970 [0065.737] GetCurrentThreadId () returned 0x970 [0065.737] GetCurrentThreadId () returned 0x970 [0065.737] GetCurrentThreadId () returned 0x970 [0065.737] GetCurrentThreadId () returned 0x970 [0065.737] GetCurrentThreadId () returned 0x970 [0065.737] GetCurrentThreadId () returned 0x970 [0065.737] GetCurrentThreadId () returned 0x970 [0065.737] GetCurrentThreadId () returned 0x970 [0065.737] GetCurrentThreadId () returned 0x970 [0065.737] GetCurrentThreadId () returned 0x970 [0065.737] GetCurrentThreadId () returned 0x970 [0065.737] GetCurrentThreadId () returned 0x970 [0065.737] GetCurrentThreadId () returned 0x970 [0065.737] GetCurrentThreadId () returned 0x970 [0065.737] GetCurrentThreadId () returned 0x970 [0065.737] GetCurrentThreadId () returned 0x970 [0065.737] GetCurrentThreadId () returned 0x970 [0065.737] GetCurrentThreadId () returned 0x970 [0065.737] GetCurrentThreadId () returned 0x970 [0065.737] GetCurrentThreadId () returned 0x970 [0065.737] GetCurrentThreadId () returned 0x970 [0065.737] GetCurrentThreadId () returned 0x970 [0065.737] GetCurrentThreadId () returned 0x970 [0065.737] GetCurrentThreadId () returned 0x970 [0065.737] GetCurrentThreadId () returned 0x970 [0065.737] GetCurrentThreadId () returned 0x970 [0065.737] GetCurrentThreadId () returned 0x970 [0065.737] GetCurrentThreadId () returned 0x970 [0065.737] GetCurrentThreadId () returned 0x970 [0065.737] GetCurrentThreadId () returned 0x970 [0065.737] GetCurrentThreadId () returned 0x970 [0065.737] GetCurrentThreadId () returned 0x970 [0065.737] GetCurrentThreadId () returned 0x970 [0065.737] GetCurrentThreadId () returned 0x970 [0065.737] GetCurrentThreadId () returned 0x970 [0065.737] GetCurrentThreadId () returned 0x970 [0065.737] GetCurrentThreadId () returned 0x970 [0065.737] GetCurrentThreadId () returned 0x970 [0065.737] GetCurrentThreadId () returned 0x970 [0065.737] GetCurrentThreadId () returned 0x970 [0065.737] GetCurrentThreadId () returned 0x970 [0065.737] GetCurrentThreadId () returned 0x970 [0065.737] GetCurrentThreadId () returned 0x970 [0065.738] GetCurrentThreadId () returned 0x970 [0065.738] GetCurrentThreadId () returned 0x970 [0065.738] GetCurrentThreadId () returned 0x970 [0065.738] GetCurrentThreadId () returned 0x970 [0065.738] GetCurrentThreadId () returned 0x970 [0065.738] GetCurrentThreadId () returned 0x970 [0065.738] GetCurrentThreadId () returned 0x970 [0065.738] GetCurrentThreadId () returned 0x970 [0065.738] GetCurrentThreadId () returned 0x970 [0065.738] GetCurrentThreadId () returned 0x970 [0065.738] GetCurrentThreadId () returned 0x970 [0065.738] GetCurrentThreadId () returned 0x970 [0065.738] GetCurrentThreadId () returned 0x970 [0065.738] GetCurrentThreadId () returned 0x970 [0065.738] GetCurrentThreadId () returned 0x970 [0065.738] GetCurrentThreadId () returned 0x970 [0065.738] GetCurrentThreadId () returned 0x970 [0065.738] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.738] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.738] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379be38, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.738] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.738] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.738] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379be38, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.738] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.738] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.738] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.738] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.738] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.738] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.738] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.738] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.738] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379be98, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.738] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.738] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.738] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379be98, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.738] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.738] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.739] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379be98, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0065.739] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xd, wMilliseconds=0x10)) [0065.739] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hN#o4j7=Z5CSBMYjb\\&Ho2NtyuN#s~Q:", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0065.739] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hN#o4j7=Z5CSBMYjb\\&Ho2NtyuN#s~Q:", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0065.739] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hN#o4j7=Z5CSBMYjb\\&Ho2NtyuN#s~Q:", cchWideChar=32, lpMultiByteStr=0x2003d48, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hN#o4j7=Z5CSBMYjb\\&Ho2NtyuN#s~Q:", lpUsedDefaultChar=0x0) returned 32 [0065.739] GetCurrentThreadId () returned 0x970 [0065.739] GetCurrentThreadId () returned 0x970 [0065.739] GetCurrentThreadId () returned 0x970 [0065.739] GetCurrentThreadId () returned 0x970 [0065.739] GetCurrentThreadId () returned 0x970 [0065.739] GetCurrentThreadId () returned 0x970 [0065.746] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0065.746] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0065.746] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x37991f8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0065.746] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb348, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0065.746] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb348, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAC/wxCg/caDoKN9DHbKwkBNIdJHtqvCk3BSOhTfkV0K6iE9UkoJbTF3hfRlliVpdfiD1Hb9lAA4B0cb9PEQfaqoXUv6ZyYOIIwPUxTeJqtLgNdluB7MsBXG9NltSsG8Vif5v6Ijn37XzS6iPx7LXnopUWmtB3k4p1zTMSImfSnRALwO8OXWo9S7bZi2f2EJMfKqmAfRgxdUTnuUW6aV3+cB5W37b0nUAVQ==") returned 232 [0065.746] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xd, wMilliseconds=0x10)) [0065.746] GetCurrentThreadId () returned 0x970 [0065.746] GetCurrentThreadId () returned 0x970 [0065.746] GetCurrentThreadId () returned 0x970 [0065.746] GetCurrentThreadId () returned 0x970 [0065.746] GetCurrentThreadId () returned 0x970 [0065.746] GetCurrentThreadId () returned 0x970 [0065.746] GetCurrentThreadId () returned 0x970 [0065.747] GetCurrentThreadId () returned 0x970 [0065.747] GetCurrentThreadId () returned 0x970 [0065.747] GetCurrentThreadId () returned 0x970 [0065.747] GetCurrentThreadId () returned 0x970 [0065.747] GetCurrentThreadId () returned 0x970 [0065.747] GetCurrentThreadId () returned 0x970 [0065.747] GetCurrentThreadId () returned 0x970 [0065.747] GetCurrentThreadId () returned 0x970 [0065.747] GetCurrentThreadId () returned 0x970 [0065.747] GetCurrentThreadId () returned 0x970 [0065.747] GetCurrentThreadId () returned 0x970 [0065.747] GetCurrentThreadId () returned 0x970 [0065.747] GetCurrentThreadId () returned 0x970 [0065.747] GetCurrentThreadId () returned 0x970 [0065.747] GetCurrentThreadId () returned 0x970 [0065.747] GetCurrentThreadId () returned 0x970 [0065.747] GetCurrentThreadId () returned 0x970 [0065.747] GetCurrentThreadId () returned 0x970 [0065.747] GetCurrentThreadId () returned 0x970 [0065.747] GetCurrentThreadId () returned 0x970 [0065.747] GetCurrentThreadId () returned 0x970 [0065.747] GetCurrentThreadId () returned 0x970 [0065.747] GetCurrentThreadId () returned 0x970 [0065.747] GetCurrentThreadId () returned 0x970 [0065.747] GetCurrentThreadId () returned 0x970 [0065.747] GetCurrentThreadId () returned 0x970 [0065.747] GetCurrentThreadId () returned 0x970 [0065.747] GetCurrentThreadId () returned 0x970 [0065.747] GetCurrentThreadId () returned 0x970 [0065.747] GetCurrentThreadId () returned 0x970 [0065.747] GetCurrentThreadId () returned 0x970 [0065.747] GetCurrentThreadId () returned 0x970 [0065.747] GetCurrentThreadId () returned 0x970 [0065.747] GetCurrentThreadId () returned 0x970 [0065.747] GetCurrentThreadId () returned 0x970 [0065.747] GetCurrentThreadId () returned 0x970 [0065.747] GetCurrentThreadId () returned 0x970 [0065.747] GetCurrentThreadId () returned 0x970 [0065.747] GetCurrentThreadId () returned 0x970 [0065.747] GetCurrentThreadId () returned 0x970 [0065.747] GetCurrentThreadId () returned 0x970 [0065.747] GetCurrentThreadId () returned 0x970 [0065.747] GetCurrentThreadId () returned 0x970 [0065.747] GetCurrentThreadId () returned 0x970 [0065.747] GetCurrentThreadId () returned 0x970 [0065.747] GetCurrentThreadId () returned 0x970 [0065.748] GetCurrentThreadId () returned 0x970 [0065.748] GetCurrentThreadId () returned 0x970 [0065.748] GetCurrentThreadId () returned 0x970 [0065.748] GetCurrentThreadId () returned 0x970 [0065.748] GetCurrentThreadId () returned 0x970 [0065.748] GetCurrentThreadId () returned 0x970 [0065.748] GetCurrentThreadId () returned 0x970 [0065.748] GetCurrentThreadId () returned 0x970 [0065.748] GetCurrentThreadId () returned 0x970 [0065.748] GetCurrentThreadId () returned 0x970 [0065.748] GetCurrentThreadId () returned 0x970 [0065.748] GetCurrentThreadId () returned 0x970 [0065.748] GetCurrentThreadId () returned 0x970 [0065.748] GetCurrentThreadId () returned 0x970 [0065.748] GetCurrentThreadId () returned 0x970 [0065.748] GetCurrentThreadId () returned 0x970 [0065.748] GetCurrentThreadId () returned 0x970 [0065.748] GetCurrentThreadId () returned 0x970 [0065.748] GetCurrentThreadId () returned 0x970 [0065.748] GetCurrentThreadId () returned 0x970 [0065.748] GetCurrentThreadId () returned 0x970 [0065.748] GetCurrentThreadId () returned 0x970 [0065.748] GetCurrentThreadId () returned 0x970 [0065.748] GetCurrentThreadId () returned 0x970 [0065.748] GetCurrentThreadId () returned 0x970 [0065.748] GetCurrentThreadId () returned 0x970 [0065.748] GetCurrentThreadId () returned 0x970 [0065.748] GetCurrentThreadId () returned 0x970 [0065.748] GetCurrentThreadId () returned 0x970 [0065.748] GetCurrentThreadId () returned 0x970 [0065.748] GetCurrentThreadId () returned 0x970 [0065.748] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAC/wxCg/caDoKN9DHbKwkBNIdJHtqvCk3BSOhTfkV0K6iE9UkoJbTF3hfRlliVpdfiD1Hb9lAA4B0cb9PEQfaqoXUv6ZyYOIIwPUxTeJqtLgNdluB7MsBXG9NltSsG8Vif5v6Ijn37XzS6iPx7LXnopUWmtB3k4p1zTMSImfSnRALwO8OXWo9S7bZi2f2EJMfKqmAfRgxdUTnuUW6aV3+cB5W37b0nUAVQ==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0065.748] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAC/wxCg/caDoKN9DHbKwkBNIdJHtqvCk3BSOhTfkV0K6iE9UkoJbTF3hfRlliVpdfiD1Hb9lAA4B0cb9PEQfaqoXUv6ZyYOIIwPUxTeJqtLgNdluB7MsBXG9NltSsG8Vif5v6Ijn37XzS6iPx7LXnopUWmtB3k4p1zTMSImfSnRALwO8OXWo9S7bZi2f2EJMfKqmAfRgxdUTnuUW6aV3+cB5W37b0nUAVQ==", cchWideChar=245, lpMultiByteStr=0x353933c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAC/wxCg/caDoKN9DHbKwkBNIdJHtqvCk3BSOhTfkV0K6iE9UkoJbTF3hfRlliVpdfiD1Hb9lAA4B0cb9PEQfaqoXUv6ZyYOIIwPUxTeJqtLgNdluB7MsBXG9NltSsG8Vif5v6Ijn37XzS6iPx7LXnopUWmtB3k4p1zTMSImfSnRALwO8OXWo9S7bZi2f2EJMfKqmAfRgxdUTnuUW6aV3+cB5W37b0nUAVQ==", lpUsedDefaultChar=0x0) returned 245 [0065.748] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0065.748] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0065.749] CloseHandle (hObject=0x158) returned 1 [0065.749] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpictureb.png")) returned 0 [0065.749] GetLastError () returned 0x5 [0065.749] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpictureb.png")) returned 0x20 [0065.749] SetLastError (dwErrCode=0x5) [0065.749] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=18601231430) returned 1 [0065.749] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Файл зашифрован [Circle_VideoInset.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\Файл зашифрован [circle_videoinset.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0065.749] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0065.749] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0065.749] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0065.749] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0065.750] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0065.750] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0065.750] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0065.750] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0065.750] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0065.750] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0065.750] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0065.750] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0065.750] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0065.750] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0065.750] SetEndOfFile (hFile=0x158) returned 1 [0065.750] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0065.750] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0065.750] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0065.750] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0065.750] WriteFile (in: hFile=0x158, lpBuffer=0x3777058*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777058*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0065.751] WriteFile (in: hFile=0x158, lpBuffer=0x35f04dc*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f04dc*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0065.751] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="gt}hEh~Aa#z4S%=wX~PYjon$JptVF0@4KZ!\"StNa=EjK!+r", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0066.978] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="%\"UP\\m\":9).>VF0@4KZ!\"StNa=EjK!+r", cchWideChar=32, lpMultiByteStr=0x2036a3c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="%\"UP\\m\":9).>VF0@4KZ!\"StNa=EjK!+r", lpUsedDefaultChar=0x0) returned 32 [0066.978] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0066.978] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0066.978] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f1e591f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f1e591f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d08bb61, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 0x295098 [0066.978] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0066.978] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0066.978] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_selectionsubpicture.png")) returned 0x20 [0066.979] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_selectionsubpicture.png")) returned 0x20 [0066.979] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_selectionsubpicture.png")) returned 0x20 [0066.979] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_selectionsubpicture.png")) returned 0x20 [0066.979] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_selectionsubpicture.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f1e591f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f1e591f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d08bb61, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e)) returned 1 [0066.979] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0066.979] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0066.979] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_selectionsubpicture.png")) returned 0x20 [0066.980] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_selectionsubpicture.png")) returned 0x20 [0066.980] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0066.980] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0066.980] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0066.980] SetEndOfFile (hFile=0x158) returned 1 [0066.981] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0066.981] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x2036bfc, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0066.981] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0066.981] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x2036ae4, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0066.981] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x2036ae4, cbMultiByte=39, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="NavigationRight_SelectionSubpicture.pngg") returned 39 [0066.981] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0066.981] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x2036bfc, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0066.981] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0066.981] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0066.981] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0xc2e [0066.981] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0066.981] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0066.981] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0066.981] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0066.981] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x2036bfc, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0066.982] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0066.982] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x2036ae4, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0066.982] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x2036ae4, cbMultiByte=39, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="NavigationRight_SelectionSubpicture.pngre.pngg") returned 39 [0066.982] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0066.982] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x2036bfc, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0066.982] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0066.983] CharToOemA (in: pSrc="NavigationRight_SelectionSubpicture.png", pDst=0x2036ae4 | out: pDst="NavigationRight_SelectionSubpicture.png") returned 1 [0066.983] WriteFile (in: hFile=0x158, lpBuffer=0x2036ae4*, nNumberOfBytesToWrite=0x27, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x2036ae4*, lpNumberOfBytesWritten=0x18e048*=0x27, lpOverlapped=0x0) returned 1 [0066.983] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0066.983] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0066.983] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0066.983] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=18724652111) returned 1 [0066.983] ReadFile (in: hFile=0x11c, lpBuffer=0x37cda30, nNumberOfBytesToRead=0xc2e, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37cda30*, lpNumberOfBytesRead=0x18dd7c*=0xc2e, lpOverlapped=0x0) returned 1 [0066.987] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0066.987] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=18725054283) returned 1 [0066.996] WriteFile (in: hFile=0x158, lpBuffer=0x379acc0*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379acc0*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0066.996] ReadFile (in: hFile=0x11c, lpBuffer=0x37cda30, nNumberOfBytesToRead=0xc2e, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x37cda30*, lpNumberOfBytesRead=0x18de38*=0xc2e, lpOverlapped=0x0) returned 1 [0066.996] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x62 [0066.996] WriteFile (in: hFile=0x158, lpBuffer=0x380ff50*, nNumberOfBytesToWrite=0xc2e, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x380ff50*, lpNumberOfBytesWritten=0x18de10*=0xc2e, lpOverlapped=0x0) returned 1 [0066.996] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0xc90 [0066.996] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0066.996] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0066.997] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0066.997] SetFilePointer (in: hFile=0x158, lDistanceToMove=39, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x45 [0066.997] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0xc9a [0066.997] CloseHandle (hObject=0x11c) returned 1 [0066.997] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xc9a [0066.997] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xc9a [0066.997] SetFilePointer (in: hFile=0x158, lDistanceToMove=3226, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xc9a [0066.997] SetFilePointer (in: hFile=0x158, lDistanceToMove=3226, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0xc9a [0066.997] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xc9a [0066.998] SetFilePointer (in: hFile=0x158, lDistanceToMove=3226, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0xc9a [0066.998] SetEndOfFile (hFile=0x158) returned 1 [0066.998] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xc9a [0066.998] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xc9a [0066.998] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0066.998] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x2036ae4, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0066.998] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0066.998] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x2036bfc, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0066.998] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x2036bfc, cbMultiByte=39, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="NavigationRight_SelectionSubpicture.png") returned 39 [0066.998] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0066.998] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x2036ae4, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0066.998] WriteFile (in: hFile=0x158, lpBuffer=0x37b1508*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x37b1508*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0066.998] CharToOemA (in: pSrc="NavigationRight_SelectionSubpicture.png", pDst=0x2036bfc | out: pDst="NavigationRight_SelectionSubpicture.png") returned 1 [0066.998] WriteFile (in: hFile=0x158, lpBuffer=0x2036bfc*, nNumberOfBytesToWrite=0x27, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x2036bfc*, lpNumberOfBytesWritten=0x18efcc*=0x27, lpOverlapped=0x0) returned 1 [0066.999] WriteFile (in: hFile=0x158, lpBuffer=0x379ad88*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379ad88*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0066.999] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0066.999] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0066.999] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xcfa [0066.999] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xcfa [0066.999] WriteFile (in: hFile=0x158, lpBuffer=0x3777058*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777058*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0066.999] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0066.999] DeleteFileW (lpFileName="") returned 0 [0066.999] GetLastError () returned 0x3 [0066.999] GetFileAttributesW (lpFileName="") returned 0xffffffff [0066.999] SetLastError (dwErrCode=0x3) [0066.999] FlushFileBuffers (hFile=0x158) returned 1 [0067.002] GetCurrentThreadId () returned 0x970 [0067.002] GetCurrentThreadId () returned 0x970 [0067.002] GetCurrentThreadId () returned 0x970 [0067.002] GetCurrentThreadId () returned 0x970 [0067.002] GetCurrentThreadId () returned 0x970 [0067.002] GetCurrentThreadId () returned 0x970 [0067.002] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xdb1 [0067.002] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xdb1 [0067.002] SetFilePointer (in: hFile=0x158, lDistanceToMove=3505, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xdb1 [0067.002] CloseHandle (hObject=0x158) returned 1 [0067.003] GetCurrentThreadId () returned 0x970 [0067.003] GetCurrentThreadId () returned 0x970 [0067.003] GetCurrentThreadId () returned 0x970 [0067.003] GetCurrentThreadId () returned 0x970 [0067.003] GetCurrentThreadId () returned 0x970 [0067.003] GetCurrentThreadId () returned 0x970 [0067.003] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\Файл зашифрован [NavigationRight_SelectionSubpicture.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\Файл зашифрован [navigationright_selectionsubpicture.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0067.003] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdb1 [0067.003] SetFilePointer (in: hFile=0x158, lDistanceToMove=3377, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd31 [0067.003] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0067.003] GetFileType (hFile=0x158) returned 0x1 [0067.003] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xe, wMilliseconds=0x117)) [0067.003] GetCurrentThreadId () returned 0x970 [0067.003] GetCurrentThreadId () returned 0x970 [0067.003] GetCurrentThreadId () returned 0x970 [0067.003] GetCurrentThreadId () returned 0x970 [0067.003] GetCurrentThreadId () returned 0x970 [0067.003] GetCurrentThreadId () returned 0x970 [0067.003] GetCurrentThreadId () returned 0x970 [0067.003] GetCurrentThreadId () returned 0x970 [0067.003] GetCurrentThreadId () returned 0x970 [0067.003] GetCurrentThreadId () returned 0x970 [0067.003] GetCurrentThreadId () returned 0x970 [0067.003] GetCurrentThreadId () returned 0x970 [0067.003] GetCurrentThreadId () returned 0x970 [0067.003] GetCurrentThreadId () returned 0x970 [0067.003] GetCurrentThreadId () returned 0x970 [0067.003] GetCurrentThreadId () returned 0x970 [0067.003] GetCurrentThreadId () returned 0x970 [0067.003] GetCurrentThreadId () returned 0x970 [0067.003] GetCurrentThreadId () returned 0x970 [0067.003] GetCurrentThreadId () returned 0x970 [0067.004] GetCurrentThreadId () returned 0x970 [0067.004] GetCurrentThreadId () returned 0x970 [0067.004] GetCurrentThreadId () returned 0x970 [0067.004] GetCurrentThreadId () returned 0x970 [0067.004] GetCurrentThreadId () returned 0x970 [0067.004] GetCurrentThreadId () returned 0x970 [0067.004] GetCurrentThreadId () returned 0x970 [0067.004] GetCurrentThreadId () returned 0x970 [0067.004] GetCurrentThreadId () returned 0x970 [0067.004] GetCurrentThreadId () returned 0x970 [0067.004] GetCurrentThreadId () returned 0x970 [0067.004] GetCurrentThreadId () returned 0x970 [0067.004] GetCurrentThreadId () returned 0x970 [0067.004] GetCurrentThreadId () returned 0x970 [0067.004] GetCurrentThreadId () returned 0x970 [0067.004] GetCurrentThreadId () returned 0x970 [0067.004] GetCurrentThreadId () returned 0x970 [0067.004] GetCurrentThreadId () returned 0x970 [0067.004] GetCurrentThreadId () returned 0x970 [0067.004] GetCurrentThreadId () returned 0x970 [0067.004] GetCurrentThreadId () returned 0x970 [0067.004] GetCurrentThreadId () returned 0x970 [0067.004] GetCurrentThreadId () returned 0x970 [0067.004] GetCurrentThreadId () returned 0x970 [0067.004] GetCurrentThreadId () returned 0x970 [0067.004] GetCurrentThreadId () returned 0x970 [0067.004] GetCurrentThreadId () returned 0x970 [0067.004] GetCurrentThreadId () returned 0x970 [0067.004] GetCurrentThreadId () returned 0x970 [0067.004] GetCurrentThreadId () returned 0x970 [0067.004] GetCurrentThreadId () returned 0x970 [0067.004] GetCurrentThreadId () returned 0x970 [0067.004] GetCurrentThreadId () returned 0x970 [0067.004] GetCurrentThreadId () returned 0x970 [0067.004] GetCurrentThreadId () returned 0x970 [0067.004] GetCurrentThreadId () returned 0x970 [0067.004] GetCurrentThreadId () returned 0x970 [0067.004] GetCurrentThreadId () returned 0x970 [0067.004] GetCurrentThreadId () returned 0x970 [0067.004] GetCurrentThreadId () returned 0x970 [0067.004] GetCurrentThreadId () returned 0x970 [0067.004] GetCurrentThreadId () returned 0x970 [0067.004] GetCurrentThreadId () returned 0x970 [0067.004] GetCurrentThreadId () returned 0x970 [0067.004] GetCurrentThreadId () returned 0x970 [0067.005] GetCurrentThreadId () returned 0x970 [0067.005] GetCurrentThreadId () returned 0x970 [0067.005] GetCurrentThreadId () returned 0x970 [0067.005] GetCurrentThreadId () returned 0x970 [0067.005] GetCurrentThreadId () returned 0x970 [0067.005] GetCurrentThreadId () returned 0x970 [0067.005] GetCurrentThreadId () returned 0x970 [0067.005] GetCurrentThreadId () returned 0x970 [0067.005] GetCurrentThreadId () returned 0x970 [0067.005] GetCurrentThreadId () returned 0x970 [0067.005] GetCurrentThreadId () returned 0x970 [0067.005] GetCurrentThreadId () returned 0x970 [0067.005] GetCurrentThreadId () returned 0x970 [0067.005] GetCurrentThreadId () returned 0x970 [0067.005] GetCurrentThreadId () returned 0x970 [0067.005] GetCurrentThreadId () returned 0x970 [0067.005] GetCurrentThreadId () returned 0x970 [0067.005] GetCurrentThreadId () returned 0x970 [0067.005] GetCurrentThreadId () returned 0x970 [0067.005] GetCurrentThreadId () returned 0x970 [0067.005] GetCurrentThreadId () returned 0x970 [0067.005] GetCurrentThreadId () returned 0x970 [0067.005] GetCurrentThreadId () returned 0x970 [0067.005] GetCurrentThreadId () returned 0x970 [0067.005] GetCurrentThreadId () returned 0x970 [0067.005] GetCurrentThreadId () returned 0x970 [0067.005] GetCurrentThreadId () returned 0x970 [0067.005] GetCurrentThreadId () returned 0x970 [0067.005] GetCurrentThreadId () returned 0x970 [0067.005] GetCurrentThreadId () returned 0x970 [0067.005] GetCurrentThreadId () returned 0x970 [0067.005] GetCurrentThreadId () returned 0x970 [0067.005] GetCurrentThreadId () returned 0x970 [0067.005] GetCurrentThreadId () returned 0x970 [0067.005] GetCurrentThreadId () returned 0x970 [0067.005] GetCurrentThreadId () returned 0x970 [0067.005] GetCurrentThreadId () returned 0x970 [0067.005] GetCurrentThreadId () returned 0x970 [0067.005] GetCurrentThreadId () returned 0x970 [0067.005] GetCurrentThreadId () returned 0x970 [0067.005] GetCurrentThreadId () returned 0x970 [0067.005] GetCurrentThreadId () returned 0x970 [0067.005] GetCurrentThreadId () returned 0x970 [0067.005] GetCurrentThreadId () returned 0x970 [0067.006] GetCurrentThreadId () returned 0x970 [0067.006] GetCurrentThreadId () returned 0x970 [0067.006] GetCurrentThreadId () returned 0x970 [0067.006] GetCurrentThreadId () returned 0x970 [0067.006] GetCurrentThreadId () returned 0x970 [0067.006] GetCurrentThreadId () returned 0x970 [0067.006] GetCurrentThreadId () returned 0x970 [0067.006] GetCurrentThreadId () returned 0x970 [0067.006] GetCurrentThreadId () returned 0x970 [0067.006] GetCurrentThreadId () returned 0x970 [0067.006] GetCurrentThreadId () returned 0x970 [0067.006] GetCurrentThreadId () returned 0x970 [0067.006] GetCurrentThreadId () returned 0x970 [0067.006] GetCurrentThreadId () returned 0x970 [0067.006] GetCurrentThreadId () returned 0x970 [0067.006] GetCurrentThreadId () returned 0x970 [0067.006] GetCurrentThreadId () returned 0x970 [0067.006] GetCurrentThreadId () returned 0x970 [0067.006] GetCurrentThreadId () returned 0x970 [0067.006] GetCurrentThreadId () returned 0x970 [0067.006] GetCurrentThreadId () returned 0x970 [0067.006] GetCurrentThreadId () returned 0x970 [0067.006] GetCurrentThreadId () returned 0x970 [0067.006] GetCurrentThreadId () returned 0x970 [0067.006] GetCurrentThreadId () returned 0x970 [0067.006] GetCurrentThreadId () returned 0x970 [0067.006] GetCurrentThreadId () returned 0x970 [0067.006] GetCurrentThreadId () returned 0x970 [0067.006] GetCurrentThreadId () returned 0x970 [0067.006] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.006] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.006] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379c618, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0067.006] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.006] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.006] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379c618, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0067.006] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.006] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.006] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0067.006] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.006] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.007] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0067.007] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.007] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.007] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379c678, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0067.007] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.007] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.007] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379c678, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0067.007] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.007] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.007] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379c678, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0067.007] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xe, wMilliseconds=0x117)) [0067.007] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="%\"UP\\m\":9).>VF0@4KZ!\"StNa=EjK!+r", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0067.007] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="%\"UP\\m\":9).>VF0@4KZ!\"StNa=EjK!+r", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0067.007] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="%\"UP\\m\":9).>VF0@4KZ!\"StNa=EjK!+r", cchWideChar=32, lpMultiByteStr=0x2004138, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="%\"UP\\m\":9).>VF0@4KZ!\"StNa=EjK!+r", lpUsedDefaultChar=0x0) returned 32 [0067.007] GetCurrentThreadId () returned 0x970 [0067.007] GetCurrentThreadId () returned 0x970 [0067.007] GetCurrentThreadId () returned 0x970 [0067.007] GetCurrentThreadId () returned 0x970 [0067.007] GetCurrentThreadId () returned 0x970 [0067.007] GetCurrentThreadId () returned 0x970 [0067.014] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0067.014] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0067.015] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x379a4b8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0067.015] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb848, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0067.015] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb848, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAEJ9COYygJq0WKmy67hEyuLU/vK+dqlBB0VtuqXOGcTa+U6sEHrt4yvvuXfR1KVoJgEcq1QX82dFdgFkOpFuxyCAj8NNo5Bysf+eEPwESUcsINynF9x8L0MQSrgpLdNpfo7QkzDD8ubHwuHOA3BBYlWayQoJDyWRS3Xs68uUHnEUTBpmPrlTOi7Pw+GvSx42LucW0mzMru+dftpNQf8wsErOVmLK+upZSw==") returned 232 [0067.015] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xe, wMilliseconds=0x117)) [0067.015] GetCurrentThreadId () returned 0x970 [0067.015] GetCurrentThreadId () returned 0x970 [0067.015] GetCurrentThreadId () returned 0x970 [0067.015] GetCurrentThreadId () returned 0x970 [0067.015] GetCurrentThreadId () returned 0x970 [0067.015] GetCurrentThreadId () returned 0x970 [0067.015] GetCurrentThreadId () returned 0x970 [0067.015] GetCurrentThreadId () returned 0x970 [0067.015] GetCurrentThreadId () returned 0x970 [0067.015] GetCurrentThreadId () returned 0x970 [0067.015] GetCurrentThreadId () returned 0x970 [0067.015] GetCurrentThreadId () returned 0x970 [0067.015] GetCurrentThreadId () returned 0x970 [0067.015] GetCurrentThreadId () returned 0x970 [0067.015] GetCurrentThreadId () returned 0x970 [0067.015] GetCurrentThreadId () returned 0x970 [0067.015] GetCurrentThreadId () returned 0x970 [0067.015] GetCurrentThreadId () returned 0x970 [0067.015] GetCurrentThreadId () returned 0x970 [0067.015] GetCurrentThreadId () returned 0x970 [0067.015] GetCurrentThreadId () returned 0x970 [0067.015] GetCurrentThreadId () returned 0x970 [0067.015] GetCurrentThreadId () returned 0x970 [0067.015] GetCurrentThreadId () returned 0x970 [0067.015] GetCurrentThreadId () returned 0x970 [0067.015] GetCurrentThreadId () returned 0x970 [0067.015] GetCurrentThreadId () returned 0x970 [0067.015] GetCurrentThreadId () returned 0x970 [0067.015] GetCurrentThreadId () returned 0x970 [0067.015] GetCurrentThreadId () returned 0x970 [0067.015] GetCurrentThreadId () returned 0x970 [0067.015] GetCurrentThreadId () returned 0x970 [0067.015] GetCurrentThreadId () returned 0x970 [0067.015] GetCurrentThreadId () returned 0x970 [0067.015] GetCurrentThreadId () returned 0x970 [0067.015] GetCurrentThreadId () returned 0x970 [0067.015] GetCurrentThreadId () returned 0x970 [0067.015] GetCurrentThreadId () returned 0x970 [0067.016] GetCurrentThreadId () returned 0x970 [0067.016] GetCurrentThreadId () returned 0x970 [0067.016] GetCurrentThreadId () returned 0x970 [0067.016] GetCurrentThreadId () returned 0x970 [0067.016] GetCurrentThreadId () returned 0x970 [0067.016] GetCurrentThreadId () returned 0x970 [0067.016] GetCurrentThreadId () returned 0x970 [0067.016] GetCurrentThreadId () returned 0x970 [0067.016] GetCurrentThreadId () returned 0x970 [0067.016] GetCurrentThreadId () returned 0x970 [0067.016] GetCurrentThreadId () returned 0x970 [0067.016] GetCurrentThreadId () returned 0x970 [0067.016] GetCurrentThreadId () returned 0x970 [0067.016] GetCurrentThreadId () returned 0x970 [0067.016] GetCurrentThreadId () returned 0x970 [0067.016] GetCurrentThreadId () returned 0x970 [0067.016] GetCurrentThreadId () returned 0x970 [0067.016] GetCurrentThreadId () returned 0x970 [0067.016] GetCurrentThreadId () returned 0x970 [0067.016] GetCurrentThreadId () returned 0x970 [0067.016] GetCurrentThreadId () returned 0x970 [0067.016] GetCurrentThreadId () returned 0x970 [0067.016] GetCurrentThreadId () returned 0x970 [0067.016] GetCurrentThreadId () returned 0x970 [0067.016] GetCurrentThreadId () returned 0x970 [0067.016] GetCurrentThreadId () returned 0x970 [0067.016] GetCurrentThreadId () returned 0x970 [0067.016] GetCurrentThreadId () returned 0x970 [0067.016] GetCurrentThreadId () returned 0x970 [0067.016] GetCurrentThreadId () returned 0x970 [0067.016] GetCurrentThreadId () returned 0x970 [0067.016] GetCurrentThreadId () returned 0x970 [0067.016] GetCurrentThreadId () returned 0x970 [0067.016] GetCurrentThreadId () returned 0x970 [0067.016] GetCurrentThreadId () returned 0x970 [0067.016] GetCurrentThreadId () returned 0x970 [0067.016] GetCurrentThreadId () returned 0x970 [0067.016] GetCurrentThreadId () returned 0x970 [0067.017] GetCurrentThreadId () returned 0x970 [0067.017] GetCurrentThreadId () returned 0x970 [0067.017] GetCurrentThreadId () returned 0x970 [0067.017] GetCurrentThreadId () returned 0x970 [0067.017] GetCurrentThreadId () returned 0x970 [0067.017] GetCurrentThreadId () returned 0x970 [0067.017] GetCurrentThreadId () returned 0x970 [0067.017] GetCurrentThreadId () returned 0x970 [0067.017] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAEJ9COYygJq0WKmy67hEyuLU/vK+dqlBB0VtuqXOGcTa+U6sEHrt4yvvuXfR1KVoJgEcq1QX82dFdgFkOpFuxyCAj8NNo5Bysf+eEPwESUcsINynF9x8L0MQSrgpLdNpfo7QkzDD8ubHwuHOA3BBYlWayQoJDyWRS3Xs68uUHnEUTBpmPrlTOi7Pw+GvSx42LucW0mzMru+dftpNQf8wsErOVmLK+upZSw==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0067.017] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAEJ9COYygJq0WKmy67hEyuLU/vK+dqlBB0VtuqXOGcTa+U6sEHrt4yvvuXfR1KVoJgEcq1QX82dFdgFkOpFuxyCAj8NNo5Bysf+eEPwESUcsINynF9x8L0MQSrgpLdNpfo7QkzDD8ubHwuHOA3BBYlWayQoJDyWRS3Xs68uUHnEUTBpmPrlTOi7Pw+GvSx42LucW0mzMru+dftpNQf8wsErOVmLK+upZSw==", cchWideChar=245, lpMultiByteStr=0x353999c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAEJ9COYygJq0WKmy67hEyuLU/vK+dqlBB0VtuqXOGcTa+U6sEHrt4yvvuXfR1KVoJgEcq1QX82dFdgFkOpFuxyCAj8NNo5Bysf+eEPwESUcsINynF9x8L0MQSrgpLdNpfo7QkzDD8ubHwuHOA3BBYlWayQoJDyWRS3Xs68uUHnEUTBpmPrlTOi7Pw+GvSx42LucW0mzMru+dftpNQf8wsErOVmLK+upZSw==", lpUsedDefaultChar=0x0) returned 245 [0067.017] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0067.017] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0067.017] CloseHandle (hObject=0x158) returned 1 [0067.017] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_selectionsubpicture.png")) returned 0 [0067.017] GetLastError () returned 0x5 [0067.017] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_selectionsubpicture.png")) returned 0x20 [0067.017] SetLastError (dwErrCode=0x5) [0067.017] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=18728086993) returned 1 [0067.018] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\Файл зашифрован [NavigationUp_ButtonGraphic.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\Файл зашифрован [navigationup_buttongraphic.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0067.018] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0067.019] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0067.019] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0067.019] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0067.019] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0067.019] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0067.019] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0067.019] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0067.019] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0067.019] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0067.019] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0067.019] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0067.019] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0067.019] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0067.019] SetEndOfFile (hFile=0x158) returned 1 [0067.019] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0067.019] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0067.019] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0067.020] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0067.020] WriteFile (in: hFile=0x158, lpBuffer=0x3777058*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777058*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0067.020] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0067.021] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="tiG$V60\"qQ}A?ZQD8Low0\"xOdtX1^H/#", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0067.021] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="tiG$V60\"qQ}A?ZQD8Low0\"xOdtX1^H/#", cchWideChar=32, lpMultiByteStr=0x2036cdc, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tiG$V60\"qQ}A?ZQD8Low0\"xOdtX1^H/#", lpUsedDefaultChar=0x0) returned 32 [0067.021] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0067.021] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0067.021] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f173508, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f173508, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d08bb61, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 0x295098 [0067.021] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0067.021] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0067.021] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_buttongraphic.png")) returned 0x20 [0067.022] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_buttongraphic.png")) returned 0x20 [0067.022] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_buttongraphic.png")) returned 0x20 [0067.022] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_buttongraphic.png")) returned 0x20 [0067.022] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_buttongraphic.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f173508, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f173508, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d08bb61, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b)) returned 1 [0067.022] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0067.022] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0067.022] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_buttongraphic.png")) returned 0x20 [0067.022] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_buttongraphic.png")) returned 0x20 [0067.022] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0067.022] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0067.022] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0067.022] SetEndOfFile (hFile=0x158) returned 1 [0067.023] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0067.023] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x20038fc, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0067.023] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0067.023] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x2003b6c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0067.023] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x2003b6c, cbMultiByte=30, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="NavigationUp_ButtonGraphic.pngpngre.pngg") returned 30 [0067.023] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0067.023] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x20038fc, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0067.024] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0067.024] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0067.024] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x135b [0067.024] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0067.024] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0067.024] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0067.024] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0067.024] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x20038fc, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0067.024] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0067.024] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x2003b6c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0067.024] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x2003b6c, cbMultiByte=30, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="NavigationUp_ButtonGraphic.pngic.pngpngre.pngg") returned 30 [0067.024] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0067.024] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x20038fc, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0067.024] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0067.025] CharToOemA (in: pSrc="NavigationUp_ButtonGraphic.png", pDst=0x2003b6c | out: pDst="NavigationUp_ButtonGraphic.png") returned 1 [0067.025] WriteFile (in: hFile=0x158, lpBuffer=0x2003b6c*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x2003b6c*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0067.025] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0067.025] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0067.025] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0067.026] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=18728904726) returned 1 [0067.026] ReadFile (in: hFile=0x11c, lpBuffer=0x37cda30, nNumberOfBytesToRead=0x135b, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37cda30*, lpNumberOfBytesRead=0x18dd7c*=0x135b, lpOverlapped=0x0) returned 1 [0067.027] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0067.027] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=18729068234) returned 1 [0067.036] WriteFile (in: hFile=0x158, lpBuffer=0x379adc8*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379adc8*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0067.036] ReadFile (in: hFile=0x11c, lpBuffer=0x37cda30, nNumberOfBytesToRead=0x135b, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x37cda30*, lpNumberOfBytesRead=0x18de38*=0x135b, lpOverlapped=0x0) returned 1 [0067.036] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x59 [0067.036] WriteFile (in: hFile=0x158, lpBuffer=0x3810650*, nNumberOfBytesToWrite=0x135b, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3810650*, lpNumberOfBytesWritten=0x18de10*=0x135b, lpOverlapped=0x0) returned 1 [0067.037] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x13b4 [0067.037] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0067.037] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0067.037] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0067.037] SetFilePointer (in: hFile=0x158, lDistanceToMove=30, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x3c [0067.037] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x13be [0067.037] CloseHandle (hObject=0x11c) returned 1 [0067.037] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x13be [0067.037] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x13be [0067.037] SetFilePointer (in: hFile=0x158, lDistanceToMove=5054, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x13be [0067.037] SetFilePointer (in: hFile=0x158, lDistanceToMove=5054, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x13be [0067.037] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x13be [0067.038] SetFilePointer (in: hFile=0x158, lDistanceToMove=5054, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x13be [0067.038] SetEndOfFile (hFile=0x158) returned 1 [0067.038] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x13be [0067.038] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x13be [0067.038] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0067.038] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x2003b6c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0067.038] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0067.038] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x20038fc, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0067.038] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x20038fc, cbMultiByte=30, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="NavigationUp_ButtonGraphic.png䃊㫋ÆǏ፷") returned 30 [0067.038] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0067.038] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x2003b6c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0067.038] WriteFile (in: hFile=0x158, lpBuffer=0x37b1508*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x37b1508*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0067.038] CharToOemA (in: pSrc="NavigationUp_ButtonGraphic.png", pDst=0x20038fc | out: pDst="NavigationUp_ButtonGraphic.png") returned 1 [0067.038] WriteFile (in: hFile=0x158, lpBuffer=0x20038fc*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x20038fc*, lpNumberOfBytesWritten=0x18efcc*=0x1e, lpOverlapped=0x0) returned 1 [0067.038] WriteFile (in: hFile=0x158, lpBuffer=0x379ade8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379ade8*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0067.039] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0067.039] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0067.039] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1415 [0067.039] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1415 [0067.039] WriteFile (in: hFile=0x158, lpBuffer=0x3777058*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777058*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0067.039] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0067.039] DeleteFileW (lpFileName="") returned 0 [0067.039] GetLastError () returned 0x3 [0067.039] GetFileAttributesW (lpFileName="") returned 0xffffffff [0067.039] SetLastError (dwErrCode=0x3) [0067.039] FlushFileBuffers (hFile=0x158) returned 1 [0067.042] GetCurrentThreadId () returned 0x970 [0067.042] GetCurrentThreadId () returned 0x970 [0067.042] GetCurrentThreadId () returned 0x970 [0067.042] GetCurrentThreadId () returned 0x970 [0067.042] GetCurrentThreadId () returned 0x970 [0067.042] GetCurrentThreadId () returned 0x970 [0067.042] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x14cc [0067.042] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x14cc [0067.042] SetFilePointer (in: hFile=0x158, lDistanceToMove=5324, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x14cc [0067.042] CloseHandle (hObject=0x158) returned 1 [0067.042] GetCurrentThreadId () returned 0x970 [0067.042] GetCurrentThreadId () returned 0x970 [0067.042] GetCurrentThreadId () returned 0x970 [0067.042] GetCurrentThreadId () returned 0x970 [0067.042] GetCurrentThreadId () returned 0x970 [0067.043] GetCurrentThreadId () returned 0x970 [0067.043] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\Файл зашифрован [NavigationUp_ButtonGraphic.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\Файл зашифрован [navigationup_buttongraphic.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0067.043] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14cc [0067.043] SetFilePointer (in: hFile=0x158, lDistanceToMove=5196, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x144c [0067.043] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0067.043] GetFileType (hFile=0x158) returned 0x1 [0067.043] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xe, wMilliseconds=0x136)) [0067.043] GetCurrentThreadId () returned 0x970 [0067.043] GetCurrentThreadId () returned 0x970 [0067.043] GetCurrentThreadId () returned 0x970 [0067.043] GetCurrentThreadId () returned 0x970 [0067.043] GetCurrentThreadId () returned 0x970 [0067.043] GetCurrentThreadId () returned 0x970 [0067.043] GetCurrentThreadId () returned 0x970 [0067.043] GetCurrentThreadId () returned 0x970 [0067.043] GetCurrentThreadId () returned 0x970 [0067.043] GetCurrentThreadId () returned 0x970 [0067.043] GetCurrentThreadId () returned 0x970 [0067.043] GetCurrentThreadId () returned 0x970 [0067.043] GetCurrentThreadId () returned 0x970 [0067.043] GetCurrentThreadId () returned 0x970 [0067.043] GetCurrentThreadId () returned 0x970 [0067.043] GetCurrentThreadId () returned 0x970 [0067.043] GetCurrentThreadId () returned 0x970 [0067.043] GetCurrentThreadId () returned 0x970 [0067.043] GetCurrentThreadId () returned 0x970 [0067.043] GetCurrentThreadId () returned 0x970 [0067.043] GetCurrentThreadId () returned 0x970 [0067.043] GetCurrentThreadId () returned 0x970 [0067.043] GetCurrentThreadId () returned 0x970 [0067.043] GetCurrentThreadId () returned 0x970 [0067.043] GetCurrentThreadId () returned 0x970 [0067.044] GetCurrentThreadId () returned 0x970 [0067.044] GetCurrentThreadId () returned 0x970 [0067.044] GetCurrentThreadId () returned 0x970 [0067.044] GetCurrentThreadId () returned 0x970 [0067.044] GetCurrentThreadId () returned 0x970 [0067.044] GetCurrentThreadId () returned 0x970 [0067.044] GetCurrentThreadId () returned 0x970 [0067.044] GetCurrentThreadId () returned 0x970 [0067.044] GetCurrentThreadId () returned 0x970 [0067.044] GetCurrentThreadId () returned 0x970 [0067.044] GetCurrentThreadId () returned 0x970 [0067.044] GetCurrentThreadId () returned 0x970 [0067.044] GetCurrentThreadId () returned 0x970 [0067.044] GetCurrentThreadId () returned 0x970 [0067.044] GetCurrentThreadId () returned 0x970 [0067.044] GetCurrentThreadId () returned 0x970 [0067.044] GetCurrentThreadId () returned 0x970 [0067.044] GetCurrentThreadId () returned 0x970 [0067.044] GetCurrentThreadId () returned 0x970 [0067.044] GetCurrentThreadId () returned 0x970 [0067.044] GetCurrentThreadId () returned 0x970 [0067.044] GetCurrentThreadId () returned 0x970 [0067.044] GetCurrentThreadId () returned 0x970 [0067.044] GetCurrentThreadId () returned 0x970 [0067.044] GetCurrentThreadId () returned 0x970 [0067.044] GetCurrentThreadId () returned 0x970 [0067.044] GetCurrentThreadId () returned 0x970 [0067.044] GetCurrentThreadId () returned 0x970 [0067.044] GetCurrentThreadId () returned 0x970 [0067.044] GetCurrentThreadId () returned 0x970 [0067.044] GetCurrentThreadId () returned 0x970 [0067.044] GetCurrentThreadId () returned 0x970 [0067.044] GetCurrentThreadId () returned 0x970 [0067.044] GetCurrentThreadId () returned 0x970 [0067.044] GetCurrentThreadId () returned 0x970 [0067.044] GetCurrentThreadId () returned 0x970 [0067.044] GetCurrentThreadId () returned 0x970 [0067.044] GetCurrentThreadId () returned 0x970 [0067.044] GetCurrentThreadId () returned 0x970 [0067.044] GetCurrentThreadId () returned 0x970 [0067.044] GetCurrentThreadId () returned 0x970 [0067.044] GetCurrentThreadId () returned 0x970 [0067.044] GetCurrentThreadId () returned 0x970 [0067.044] GetCurrentThreadId () returned 0x970 [0067.044] GetCurrentThreadId () returned 0x970 [0067.045] GetCurrentThreadId () returned 0x970 [0067.045] GetCurrentThreadId () returned 0x970 [0067.045] GetCurrentThreadId () returned 0x970 [0067.045] GetCurrentThreadId () returned 0x970 [0067.045] GetCurrentThreadId () returned 0x970 [0067.045] GetCurrentThreadId () returned 0x970 [0067.045] GetCurrentThreadId () returned 0x970 [0067.045] GetCurrentThreadId () returned 0x970 [0067.045] GetCurrentThreadId () returned 0x970 [0067.045] GetCurrentThreadId () returned 0x970 [0067.045] GetCurrentThreadId () returned 0x970 [0067.045] GetCurrentThreadId () returned 0x970 [0067.045] GetCurrentThreadId () returned 0x970 [0067.045] GetCurrentThreadId () returned 0x970 [0067.045] GetCurrentThreadId () returned 0x970 [0067.045] GetCurrentThreadId () returned 0x970 [0067.045] GetCurrentThreadId () returned 0x970 [0067.045] GetCurrentThreadId () returned 0x970 [0067.045] GetCurrentThreadId () returned 0x970 [0067.045] GetCurrentThreadId () returned 0x970 [0067.045] GetCurrentThreadId () returned 0x970 [0067.045] GetCurrentThreadId () returned 0x970 [0067.045] GetCurrentThreadId () returned 0x970 [0067.045] GetCurrentThreadId () returned 0x970 [0067.045] GetCurrentThreadId () returned 0x970 [0067.045] GetCurrentThreadId () returned 0x970 [0067.045] GetCurrentThreadId () returned 0x970 [0067.045] GetCurrentThreadId () returned 0x970 [0067.045] GetCurrentThreadId () returned 0x970 [0067.045] GetCurrentThreadId () returned 0x970 [0067.045] GetCurrentThreadId () returned 0x970 [0067.045] GetCurrentThreadId () returned 0x970 [0067.045] GetCurrentThreadId () returned 0x970 [0067.045] GetCurrentThreadId () returned 0x970 [0067.045] GetCurrentThreadId () returned 0x970 [0067.045] GetCurrentThreadId () returned 0x970 [0067.045] GetCurrentThreadId () returned 0x970 [0067.045] GetCurrentThreadId () returned 0x970 [0067.045] GetCurrentThreadId () returned 0x970 [0067.045] GetCurrentThreadId () returned 0x970 [0067.045] GetCurrentThreadId () returned 0x970 [0067.045] GetCurrentThreadId () returned 0x970 [0067.045] GetCurrentThreadId () returned 0x970 [0067.045] GetCurrentThreadId () returned 0x970 [0067.046] GetCurrentThreadId () returned 0x970 [0067.046] GetCurrentThreadId () returned 0x970 [0067.046] GetCurrentThreadId () returned 0x970 [0067.046] GetCurrentThreadId () returned 0x970 [0067.046] GetCurrentThreadId () returned 0x970 [0067.046] GetCurrentThreadId () returned 0x970 [0067.046] GetCurrentThreadId () returned 0x970 [0067.046] GetCurrentThreadId () returned 0x970 [0067.046] GetCurrentThreadId () returned 0x970 [0067.046] GetCurrentThreadId () returned 0x970 [0067.046] GetCurrentThreadId () returned 0x970 [0067.046] GetCurrentThreadId () returned 0x970 [0067.046] GetCurrentThreadId () returned 0x970 [0067.046] GetCurrentThreadId () returned 0x970 [0067.046] GetCurrentThreadId () returned 0x970 [0067.046] GetCurrentThreadId () returned 0x970 [0067.046] GetCurrentThreadId () returned 0x970 [0067.046] GetCurrentThreadId () returned 0x970 [0067.046] GetCurrentThreadId () returned 0x970 [0067.046] GetCurrentThreadId () returned 0x970 [0067.046] GetCurrentThreadId () returned 0x970 [0067.046] GetCurrentThreadId () returned 0x970 [0067.046] GetCurrentThreadId () returned 0x970 [0067.046] GetCurrentThreadId () returned 0x970 [0067.046] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.046] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.046] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379c678, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0067.046] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.046] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.046] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379c678, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0067.046] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.046] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.046] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0067.046] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.046] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.046] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0067.046] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.046] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.047] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379c6d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0067.047] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.047] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.047] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379c6d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0067.047] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.047] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.047] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379c6d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0067.047] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xe, wMilliseconds=0x146)) [0067.047] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tiG$V60\"qQ}A?ZQD8Low0\"xOdtX1^H/#", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0067.047] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tiG$V60\"qQ}A?ZQD8Low0\"xOdtX1^H/#", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0067.047] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tiG$V60\"qQ}A?ZQD8Low0\"xOdtX1^H/#", cchWideChar=32, lpMultiByteStr=0x2004168, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tiG$V60\"qQ}A?ZQD8Low0\"xOdtX1^H/#", lpUsedDefaultChar=0x0) returned 32 [0067.047] GetCurrentThreadId () returned 0x970 [0067.047] GetCurrentThreadId () returned 0x970 [0067.047] GetCurrentThreadId () returned 0x970 [0067.047] GetCurrentThreadId () returned 0x970 [0067.047] GetCurrentThreadId () returned 0x970 [0067.047] GetCurrentThreadId () returned 0x970 [0067.054] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0067.054] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0067.054] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x379a5a8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0067.054] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eba48, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0067.055] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eba48, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAH+zE+1WUCzA7X7EeuX9psaevLYn9BvkVEBpRK8Tlx2yWXDCYeU5jOWkQOIDzijxKOLcuooLJn2SvLjydSUNZLpAUST+yrR4470KZdZCQ11VnmKXGjZ4QyKrlo/+r9Ut0Spq+QcwQeGfJCAA4jih0zphtTCJPaAx82MxlM04sM49cJUfuWPNtv/WI1fW0qAdXvEh70aFabtvJ37H0UBpqD4GGsPt4BGdUw==") returned 232 [0067.055] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xe, wMilliseconds=0x146)) [0067.055] GetCurrentThreadId () returned 0x970 [0067.055] GetCurrentThreadId () returned 0x970 [0067.055] GetCurrentThreadId () returned 0x970 [0067.055] GetCurrentThreadId () returned 0x970 [0067.055] GetCurrentThreadId () returned 0x970 [0067.055] GetCurrentThreadId () returned 0x970 [0067.055] GetCurrentThreadId () returned 0x970 [0067.055] GetCurrentThreadId () returned 0x970 [0067.055] GetCurrentThreadId () returned 0x970 [0067.055] GetCurrentThreadId () returned 0x970 [0067.055] GetCurrentThreadId () returned 0x970 [0067.055] GetCurrentThreadId () returned 0x970 [0067.055] GetCurrentThreadId () returned 0x970 [0067.055] GetCurrentThreadId () returned 0x970 [0067.055] GetCurrentThreadId () returned 0x970 [0067.055] GetCurrentThreadId () returned 0x970 [0067.055] GetCurrentThreadId () returned 0x970 [0067.055] GetCurrentThreadId () returned 0x970 [0067.055] GetCurrentThreadId () returned 0x970 [0067.055] GetCurrentThreadId () returned 0x970 [0067.055] GetCurrentThreadId () returned 0x970 [0067.055] GetCurrentThreadId () returned 0x970 [0067.055] GetCurrentThreadId () returned 0x970 [0067.055] GetCurrentThreadId () returned 0x970 [0067.055] GetCurrentThreadId () returned 0x970 [0067.055] GetCurrentThreadId () returned 0x970 [0067.055] GetCurrentThreadId () returned 0x970 [0067.055] GetCurrentThreadId () returned 0x970 [0067.055] GetCurrentThreadId () returned 0x970 [0067.055] GetCurrentThreadId () returned 0x970 [0067.055] GetCurrentThreadId () returned 0x970 [0067.055] GetCurrentThreadId () returned 0x970 [0067.055] GetCurrentThreadId () returned 0x970 [0067.055] GetCurrentThreadId () returned 0x970 [0067.055] GetCurrentThreadId () returned 0x970 [0067.055] GetCurrentThreadId () returned 0x970 [0067.055] GetCurrentThreadId () returned 0x970 [0067.055] GetCurrentThreadId () returned 0x970 [0067.055] GetCurrentThreadId () returned 0x970 [0067.055] GetCurrentThreadId () returned 0x970 [0067.055] GetCurrentThreadId () returned 0x970 [0067.055] GetCurrentThreadId () returned 0x970 [0067.056] GetCurrentThreadId () returned 0x970 [0067.056] GetCurrentThreadId () returned 0x970 [0067.056] GetCurrentThreadId () returned 0x970 [0067.056] GetCurrentThreadId () returned 0x970 [0067.056] GetCurrentThreadId () returned 0x970 [0067.056] GetCurrentThreadId () returned 0x970 [0067.056] GetCurrentThreadId () returned 0x970 [0067.056] GetCurrentThreadId () returned 0x970 [0067.056] GetCurrentThreadId () returned 0x970 [0067.056] GetCurrentThreadId () returned 0x970 [0067.056] GetCurrentThreadId () returned 0x970 [0067.056] GetCurrentThreadId () returned 0x970 [0067.056] GetCurrentThreadId () returned 0x970 [0067.056] GetCurrentThreadId () returned 0x970 [0067.056] GetCurrentThreadId () returned 0x970 [0067.056] GetCurrentThreadId () returned 0x970 [0067.056] GetCurrentThreadId () returned 0x970 [0067.056] GetCurrentThreadId () returned 0x970 [0067.056] GetCurrentThreadId () returned 0x970 [0067.056] GetCurrentThreadId () returned 0x970 [0067.056] GetCurrentThreadId () returned 0x970 [0067.056] GetCurrentThreadId () returned 0x970 [0067.056] GetCurrentThreadId () returned 0x970 [0067.056] GetCurrentThreadId () returned 0x970 [0067.056] GetCurrentThreadId () returned 0x970 [0067.056] GetCurrentThreadId () returned 0x970 [0067.056] GetCurrentThreadId () returned 0x970 [0067.056] GetCurrentThreadId () returned 0x970 [0067.056] GetCurrentThreadId () returned 0x970 [0067.056] GetCurrentThreadId () returned 0x970 [0067.056] GetCurrentThreadId () returned 0x970 [0067.056] GetCurrentThreadId () returned 0x970 [0067.056] GetCurrentThreadId () returned 0x970 [0067.056] GetCurrentThreadId () returned 0x970 [0067.056] GetCurrentThreadId () returned 0x970 [0067.056] GetCurrentThreadId () returned 0x970 [0067.056] GetCurrentThreadId () returned 0x970 [0067.056] GetCurrentThreadId () returned 0x970 [0067.056] GetCurrentThreadId () returned 0x970 [0067.056] GetCurrentThreadId () returned 0x970 [0067.056] GetCurrentThreadId () returned 0x970 [0067.056] GetCurrentThreadId () returned 0x970 [0067.056] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAH+zE+1WUCzA7X7EeuX9psaevLYn9BvkVEBpRK8Tlx2yWXDCYeU5jOWkQOIDzijxKOLcuooLJn2SvLjydSUNZLpAUST+yrR4470KZdZCQ11VnmKXGjZ4QyKrlo/+r9Ut0Spq+QcwQeGfJCAA4jih0zphtTCJPaAx82MxlM04sM49cJUfuWPNtv/WI1fW0qAdXvEh70aFabtvJ37H0UBpqD4GGsPt4BGdUw==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0067.056] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAH+zE+1WUCzA7X7EeuX9psaevLYn9BvkVEBpRK8Tlx2yWXDCYeU5jOWkQOIDzijxKOLcuooLJn2SvLjydSUNZLpAUST+yrR4470KZdZCQ11VnmKXGjZ4QyKrlo/+r9Ut0Spq+QcwQeGfJCAA4jih0zphtTCJPaAx82MxlM04sM49cJUfuWPNtv/WI1fW0qAdXvEh70aFabtvJ37H0UBpqD4GGsPt4BGdUw==", cchWideChar=245, lpMultiByteStr=0x353988c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAH+zE+1WUCzA7X7EeuX9psaevLYn9BvkVEBpRK8Tlx2yWXDCYeU5jOWkQOIDzijxKOLcuooLJn2SvLjydSUNZLpAUST+yrR4470KZdZCQ11VnmKXGjZ4QyKrlo/+r9Ut0Spq+QcwQeGfJCAA4jih0zphtTCJPaAx82MxlM04sM49cJUfuWPNtv/WI1fW0qAdXvEh70aFabtvJ37H0UBpqD4GGsPt4BGdUw==", lpUsedDefaultChar=0x0) returned 245 [0067.057] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0067.057] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0067.057] CloseHandle (hObject=0x158) returned 1 [0067.057] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_buttongraphic.png")) returned 0 [0067.057] GetLastError () returned 0x5 [0067.057] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_buttongraphic.png")) returned 0x20 [0067.057] SetLastError (dwErrCode=0x5) [0067.057] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=18732064495) returned 1 [0067.057] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\Файл зашифрован [NavigationUp_SelectionSubpicture.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\Файл зашифрован [navigationup_selectionsubpicture.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0067.058] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0067.058] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0067.058] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0067.058] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0067.058] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0067.058] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0067.058] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0067.058] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0067.058] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0067.058] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0067.058] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0067.058] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0067.058] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0067.058] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0067.058] SetEndOfFile (hFile=0x158) returned 1 [0067.059] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0067.059] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0067.059] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0067.059] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0067.059] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0067.060] WriteFile (in: hFile=0x158, lpBuffer=0x35f035c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f035c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0067.060] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="T1KNgAE%sXyBixM#rA!zWbK2@", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0067.478] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="mv{z9f+:\"SlJg5#=P%#al>#rA!zWbK2@", cchWideChar=32, lpMultiByteStr=0x2036ae4, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mv{z9f+:\"SlJg5#=P%#al>#rA!zWbK2@", lpUsedDefaultChar=0x0) returned 32 [0067.478] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0067.478] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0067.479] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fc29730, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fc29730, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d14a237, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 0x295098 [0067.479] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0067.479] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0067.479] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_buttongraphic.png")) returned 0x20 [0067.479] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_buttongraphic.png")) returned 0x20 [0067.479] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_buttongraphic.png")) returned 0x20 [0067.479] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_buttongraphic.png")) returned 0x20 [0067.479] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_buttongraphic.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fc29730, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fc29730, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d14a237, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0)) returned 1 [0067.479] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0067.479] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0067.479] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_buttongraphic.png")) returned 0x20 [0067.479] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_buttongraphic.png")) returned 0x20 [0067.479] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0067.479] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0067.479] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0067.480] SetEndOfFile (hFile=0x158) returned 1 [0067.480] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0067.480] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x2036b8c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 32 [0067.481] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0067.481] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x203687c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 32 [0067.481] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x203687c, cbMultiByte=32, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="NavigationLeft_ButtonGraphic.png.pngpngg") returned 32 [0067.481] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0067.481] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x2036b8c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 32 [0067.481] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0067.481] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0067.481] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x13e0 [0067.481] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0067.481] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0067.481] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0067.481] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0067.481] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x2036b8c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 32 [0067.481] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0067.481] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x203687c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 32 [0067.481] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x203687c, cbMultiByte=32, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="NavigationLeft_ButtonGraphic.pngic.png.pngpngg") returned 32 [0067.482] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0067.482] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x2036b8c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 32 [0067.482] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0067.482] CharToOemA (in: pSrc="NavigationLeft_ButtonGraphic.png", pDst=0x203687c | out: pDst="NavigationLeft_ButtonGraphic.png") returned 1 [0067.482] WriteFile (in: hFile=0x158, lpBuffer=0x203687c*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x203687c*, lpNumberOfBytesWritten=0x18e048*=0x20, lpOverlapped=0x0) returned 1 [0067.483] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0067.483] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0067.483] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0067.483] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=18774633864) returned 1 [0067.483] ReadFile (in: hFile=0x11c, lpBuffer=0x37d4d60, nNumberOfBytesToRead=0x13e0, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37d4d60*, lpNumberOfBytesRead=0x18dd7c*=0x13e0, lpOverlapped=0x0) returned 1 [0067.485] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0067.485] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=18774818715) returned 1 [0067.494] WriteFile (in: hFile=0x158, lpBuffer=0x379adf8*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379adf8*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0067.494] ReadFile (in: hFile=0x11c, lpBuffer=0x37d4d60, nNumberOfBytesToRead=0x13e0, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x37d4d60*, lpNumberOfBytesRead=0x18de38*=0x13e0, lpOverlapped=0x0) returned 1 [0067.494] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x5b [0067.494] WriteFile (in: hFile=0x158, lpBuffer=0x3817980*, nNumberOfBytesToWrite=0x13e0, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3817980*, lpNumberOfBytesWritten=0x18de10*=0x13e0, lpOverlapped=0x0) returned 1 [0067.494] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x143b [0067.494] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0067.494] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0067.494] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0067.495] SetFilePointer (in: hFile=0x158, lDistanceToMove=32, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x3e [0067.495] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x1445 [0067.495] CloseHandle (hObject=0x11c) returned 1 [0067.495] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1445 [0067.495] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1445 [0067.495] SetFilePointer (in: hFile=0x158, lDistanceToMove=5189, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1445 [0067.495] SetFilePointer (in: hFile=0x158, lDistanceToMove=5189, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x1445 [0067.495] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1445 [0067.495] SetFilePointer (in: hFile=0x158, lDistanceToMove=5189, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x1445 [0067.495] SetEndOfFile (hFile=0x158) returned 1 [0067.495] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1445 [0067.495] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1445 [0067.495] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0067.495] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x203687c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 32 [0067.496] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0067.496] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x2036b8c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 32 [0067.496] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x2036b8c, cbMultiByte=32, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="NavigationLeft_ButtonGraphic.png?㵓ᏼ") returned 32 [0067.496] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0067.496] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x203687c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 32 [0067.496] WriteFile (in: hFile=0x158, lpBuffer=0x37b8838*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x37b8838*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0067.496] CharToOemA (in: pSrc="NavigationLeft_ButtonGraphic.png", pDst=0x2036b8c | out: pDst="NavigationLeft_ButtonGraphic.png") returned 1 [0067.496] WriteFile (in: hFile=0x158, lpBuffer=0x2036b8c*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x2036b8c*, lpNumberOfBytesWritten=0x18efcc*=0x20, lpOverlapped=0x0) returned 1 [0067.496] WriteFile (in: hFile=0x158, lpBuffer=0x379ad88*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379ad88*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0067.496] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0067.496] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0067.496] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x149e [0067.496] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x149e [0067.496] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0067.496] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0067.497] DeleteFileW (lpFileName="") returned 0 [0067.497] GetLastError () returned 0x3 [0067.497] GetFileAttributesW (lpFileName="") returned 0xffffffff [0067.497] SetLastError (dwErrCode=0x3) [0067.497] FlushFileBuffers (hFile=0x158) returned 1 [0067.499] GetCurrentThreadId () returned 0x970 [0067.499] GetCurrentThreadId () returned 0x970 [0067.499] GetCurrentThreadId () returned 0x970 [0067.499] GetCurrentThreadId () returned 0x970 [0067.499] GetCurrentThreadId () returned 0x970 [0067.499] GetCurrentThreadId () returned 0x970 [0067.499] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x1555 [0067.499] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x1555 [0067.499] SetFilePointer (in: hFile=0x158, lDistanceToMove=5461, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x1555 [0067.500] CloseHandle (hObject=0x158) returned 1 [0067.500] GetCurrentThreadId () returned 0x970 [0067.500] GetCurrentThreadId () returned 0x970 [0067.500] GetCurrentThreadId () returned 0x970 [0067.500] GetCurrentThreadId () returned 0x970 [0067.500] GetCurrentThreadId () returned 0x970 [0067.500] GetCurrentThreadId () returned 0x970 [0067.500] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\Файл зашифрован [NavigationLeft_ButtonGraphic.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\Файл зашифрован [navigationleft_buttongraphic.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0067.500] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1555 [0067.500] SetFilePointer (in: hFile=0x158, lDistanceToMove=5333, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x14d5 [0067.500] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0067.500] GetFileType (hFile=0x158) returned 0x1 [0067.500] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xe, wMilliseconds=0x30a)) [0067.500] GetCurrentThreadId () returned 0x970 [0067.500] GetCurrentThreadId () returned 0x970 [0067.500] GetCurrentThreadId () returned 0x970 [0067.500] GetCurrentThreadId () returned 0x970 [0067.500] GetCurrentThreadId () returned 0x970 [0067.500] GetCurrentThreadId () returned 0x970 [0067.500] GetCurrentThreadId () returned 0x970 [0067.500] GetCurrentThreadId () returned 0x970 [0067.500] GetCurrentThreadId () returned 0x970 [0067.500] GetCurrentThreadId () returned 0x970 [0067.500] GetCurrentThreadId () returned 0x970 [0067.500] GetCurrentThreadId () returned 0x970 [0067.500] GetCurrentThreadId () returned 0x970 [0067.500] GetCurrentThreadId () returned 0x970 [0067.501] GetCurrentThreadId () returned 0x970 [0067.501] GetCurrentThreadId () returned 0x970 [0067.501] GetCurrentThreadId () returned 0x970 [0067.501] GetCurrentThreadId () returned 0x970 [0067.501] GetCurrentThreadId () returned 0x970 [0067.501] GetCurrentThreadId () returned 0x970 [0067.501] GetCurrentThreadId () returned 0x970 [0067.501] GetCurrentThreadId () returned 0x970 [0067.501] GetCurrentThreadId () returned 0x970 [0067.501] GetCurrentThreadId () returned 0x970 [0067.501] GetCurrentThreadId () returned 0x970 [0067.501] GetCurrentThreadId () returned 0x970 [0067.501] GetCurrentThreadId () returned 0x970 [0067.501] GetCurrentThreadId () returned 0x970 [0067.501] GetCurrentThreadId () returned 0x970 [0067.501] GetCurrentThreadId () returned 0x970 [0067.501] GetCurrentThreadId () returned 0x970 [0067.501] GetCurrentThreadId () returned 0x970 [0067.501] GetCurrentThreadId () returned 0x970 [0067.501] GetCurrentThreadId () returned 0x970 [0067.501] GetCurrentThreadId () returned 0x970 [0067.501] GetCurrentThreadId () returned 0x970 [0067.501] GetCurrentThreadId () returned 0x970 [0067.501] GetCurrentThreadId () returned 0x970 [0067.501] GetCurrentThreadId () returned 0x970 [0067.501] GetCurrentThreadId () returned 0x970 [0067.501] GetCurrentThreadId () returned 0x970 [0067.501] GetCurrentThreadId () returned 0x970 [0067.501] GetCurrentThreadId () returned 0x970 [0067.501] GetCurrentThreadId () returned 0x970 [0067.501] GetCurrentThreadId () returned 0x970 [0067.501] GetCurrentThreadId () returned 0x970 [0067.501] GetCurrentThreadId () returned 0x970 [0067.501] GetCurrentThreadId () returned 0x970 [0067.501] GetCurrentThreadId () returned 0x970 [0067.501] GetCurrentThreadId () returned 0x970 [0067.501] GetCurrentThreadId () returned 0x970 [0067.501] GetCurrentThreadId () returned 0x970 [0067.501] GetCurrentThreadId () returned 0x970 [0067.501] GetCurrentThreadId () returned 0x970 [0067.501] GetCurrentThreadId () returned 0x970 [0067.501] GetCurrentThreadId () returned 0x970 [0067.501] GetCurrentThreadId () returned 0x970 [0067.501] GetCurrentThreadId () returned 0x970 [0067.501] GetCurrentThreadId () returned 0x970 [0067.502] GetCurrentThreadId () returned 0x970 [0067.502] GetCurrentThreadId () returned 0x970 [0067.502] GetCurrentThreadId () returned 0x970 [0067.502] GetCurrentThreadId () returned 0x970 [0067.502] GetCurrentThreadId () returned 0x970 [0067.502] GetCurrentThreadId () returned 0x970 [0067.502] GetCurrentThreadId () returned 0x970 [0067.502] GetCurrentThreadId () returned 0x970 [0067.502] GetCurrentThreadId () returned 0x970 [0067.502] GetCurrentThreadId () returned 0x970 [0067.502] GetCurrentThreadId () returned 0x970 [0067.502] GetCurrentThreadId () returned 0x970 [0067.502] GetCurrentThreadId () returned 0x970 [0067.502] GetCurrentThreadId () returned 0x970 [0067.502] GetCurrentThreadId () returned 0x970 [0067.502] GetCurrentThreadId () returned 0x970 [0067.502] GetCurrentThreadId () returned 0x970 [0067.502] GetCurrentThreadId () returned 0x970 [0067.502] GetCurrentThreadId () returned 0x970 [0067.502] GetCurrentThreadId () returned 0x970 [0067.502] GetCurrentThreadId () returned 0x970 [0067.502] GetCurrentThreadId () returned 0x970 [0067.502] GetCurrentThreadId () returned 0x970 [0067.502] GetCurrentThreadId () returned 0x970 [0067.502] GetCurrentThreadId () returned 0x970 [0067.502] GetCurrentThreadId () returned 0x970 [0067.502] GetCurrentThreadId () returned 0x970 [0067.502] GetCurrentThreadId () returned 0x970 [0067.502] GetCurrentThreadId () returned 0x970 [0067.502] GetCurrentThreadId () returned 0x970 [0067.502] GetCurrentThreadId () returned 0x970 [0067.502] GetCurrentThreadId () returned 0x970 [0067.502] GetCurrentThreadId () returned 0x970 [0067.502] GetCurrentThreadId () returned 0x970 [0067.502] GetCurrentThreadId () returned 0x970 [0067.502] GetCurrentThreadId () returned 0x970 [0067.502] GetCurrentThreadId () returned 0x970 [0067.502] GetCurrentThreadId () returned 0x970 [0067.502] GetCurrentThreadId () returned 0x970 [0067.502] GetCurrentThreadId () returned 0x970 [0067.502] GetCurrentThreadId () returned 0x970 [0067.502] GetCurrentThreadId () returned 0x970 [0067.502] GetCurrentThreadId () returned 0x970 [0067.502] GetCurrentThreadId () returned 0x970 [0067.502] GetCurrentThreadId () returned 0x970 [0067.502] GetCurrentThreadId () returned 0x970 [0067.503] GetCurrentThreadId () returned 0x970 [0067.503] GetCurrentThreadId () returned 0x970 [0067.503] GetCurrentThreadId () returned 0x970 [0067.503] GetCurrentThreadId () returned 0x970 [0067.503] GetCurrentThreadId () returned 0x970 [0067.503] GetCurrentThreadId () returned 0x970 [0067.503] GetCurrentThreadId () returned 0x970 [0067.503] GetCurrentThreadId () returned 0x970 [0067.503] GetCurrentThreadId () returned 0x970 [0067.503] GetCurrentThreadId () returned 0x970 [0067.503] GetCurrentThreadId () returned 0x970 [0067.503] GetCurrentThreadId () returned 0x970 [0067.503] GetCurrentThreadId () returned 0x970 [0067.503] GetCurrentThreadId () returned 0x970 [0067.503] GetCurrentThreadId () returned 0x970 [0067.503] GetCurrentThreadId () returned 0x970 [0067.503] GetCurrentThreadId () returned 0x970 [0067.503] GetCurrentThreadId () returned 0x970 [0067.503] GetCurrentThreadId () returned 0x970 [0067.503] GetCurrentThreadId () returned 0x970 [0067.503] GetCurrentThreadId () returned 0x970 [0067.503] GetCurrentThreadId () returned 0x970 [0067.503] GetCurrentThreadId () returned 0x970 [0067.503] GetCurrentThreadId () returned 0x970 [0067.503] GetCurrentThreadId () returned 0x970 [0067.503] GetCurrentThreadId () returned 0x970 [0067.503] GetCurrentThreadId () returned 0x970 [0067.503] GetCurrentThreadId () returned 0x970 [0067.503] GetCurrentThreadId () returned 0x970 [0067.503] GetCurrentThreadId () returned 0x970 [0067.503] GetCurrentThreadId () returned 0x970 [0067.503] GetCurrentThreadId () returned 0x970 [0067.503] GetCurrentThreadId () returned 0x970 [0067.503] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.503] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.503] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379ca98, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0067.503] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.503] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.503] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379ca98, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0067.503] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.504] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.504] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0067.504] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.504] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.504] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0067.504] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.504] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.504] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379caf8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0067.504] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.504] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.504] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379caf8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0067.504] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.504] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.504] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379caf8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0067.504] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xe, wMilliseconds=0x30a)) [0067.504] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="mv{z9f+:\"SlJg5#=P%#al>#rA!zWbK2@", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0067.504] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="mv{z9f+:\"SlJg5#=P%#al>#rA!zWbK2@", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0067.504] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="mv{z9f+:\"SlJg5#=P%#al>#rA!zWbK2@", cchWideChar=32, lpMultiByteStr=0x2004378, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mv{z9f+:\"SlJg5#=P%#al>#rA!zWbK2@", lpUsedDefaultChar=0x0) returned 32 [0067.504] GetCurrentThreadId () returned 0x970 [0067.504] GetCurrentThreadId () returned 0x970 [0067.504] GetCurrentThreadId () returned 0x970 [0067.504] GetCurrentThreadId () returned 0x970 [0067.504] GetCurrentThreadId () returned 0x970 [0067.504] GetCurrentThreadId () returned 0x970 [0067.512] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0067.512] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0067.512] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x37b08b8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0067.512] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ebc48, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0067.512] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ebc48, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAABs0YjUFTFN06uKPCOs8CQMQjBgGDXLVuohlg+mzbYA/tbzID9iKUIk2VWaFj/wi7idJ48SteTouYLDelouyHna19X5nECNoKibq9m8gJaHwOEWKH7yfNiEoKHkL52ZbH+cUdst63A0BpyKErPGLq0STSea0UXjjT62Fd3IGap01dYBDIncLtCmCRlIlxCzGKLZ0tkkeKgnBF/Bdt/LGWrt9+UCXcHXWuw==") returned 232 [0067.512] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xe, wMilliseconds=0x30a)) [0067.512] GetCurrentThreadId () returned 0x970 [0067.512] GetCurrentThreadId () returned 0x970 [0067.512] GetCurrentThreadId () returned 0x970 [0067.512] GetCurrentThreadId () returned 0x970 [0067.512] GetCurrentThreadId () returned 0x970 [0067.512] GetCurrentThreadId () returned 0x970 [0067.512] GetCurrentThreadId () returned 0x970 [0067.512] GetCurrentThreadId () returned 0x970 [0067.512] GetCurrentThreadId () returned 0x970 [0067.512] GetCurrentThreadId () returned 0x970 [0067.512] GetCurrentThreadId () returned 0x970 [0067.513] GetCurrentThreadId () returned 0x970 [0067.513] GetCurrentThreadId () returned 0x970 [0067.513] GetCurrentThreadId () returned 0x970 [0067.513] GetCurrentThreadId () returned 0x970 [0067.513] GetCurrentThreadId () returned 0x970 [0067.513] GetCurrentThreadId () returned 0x970 [0067.513] GetCurrentThreadId () returned 0x970 [0067.513] GetCurrentThreadId () returned 0x970 [0067.513] GetCurrentThreadId () returned 0x970 [0067.513] GetCurrentThreadId () returned 0x970 [0067.513] GetCurrentThreadId () returned 0x970 [0067.513] GetCurrentThreadId () returned 0x970 [0067.513] GetCurrentThreadId () returned 0x970 [0067.513] GetCurrentThreadId () returned 0x970 [0067.513] GetCurrentThreadId () returned 0x970 [0067.513] GetCurrentThreadId () returned 0x970 [0067.513] GetCurrentThreadId () returned 0x970 [0067.513] GetCurrentThreadId () returned 0x970 [0067.513] GetCurrentThreadId () returned 0x970 [0067.513] GetCurrentThreadId () returned 0x970 [0067.513] GetCurrentThreadId () returned 0x970 [0067.513] GetCurrentThreadId () returned 0x970 [0067.513] GetCurrentThreadId () returned 0x970 [0067.513] GetCurrentThreadId () returned 0x970 [0067.513] GetCurrentThreadId () returned 0x970 [0067.513] GetCurrentThreadId () returned 0x970 [0067.513] GetCurrentThreadId () returned 0x970 [0067.513] GetCurrentThreadId () returned 0x970 [0067.513] GetCurrentThreadId () returned 0x970 [0067.513] GetCurrentThreadId () returned 0x970 [0067.513] GetCurrentThreadId () returned 0x970 [0067.513] GetCurrentThreadId () returned 0x970 [0067.513] GetCurrentThreadId () returned 0x970 [0067.513] GetCurrentThreadId () returned 0x970 [0067.513] GetCurrentThreadId () returned 0x970 [0067.513] GetCurrentThreadId () returned 0x970 [0067.513] GetCurrentThreadId () returned 0x970 [0067.514] GetCurrentThreadId () returned 0x970 [0067.514] GetCurrentThreadId () returned 0x970 [0067.514] GetCurrentThreadId () returned 0x970 [0067.514] GetCurrentThreadId () returned 0x970 [0067.514] GetCurrentThreadId () returned 0x970 [0067.514] GetCurrentThreadId () returned 0x970 [0067.514] GetCurrentThreadId () returned 0x970 [0067.514] GetCurrentThreadId () returned 0x970 [0067.514] GetCurrentThreadId () returned 0x970 [0067.514] GetCurrentThreadId () returned 0x970 [0067.514] GetCurrentThreadId () returned 0x970 [0067.514] GetCurrentThreadId () returned 0x970 [0067.514] GetCurrentThreadId () returned 0x970 [0067.514] GetCurrentThreadId () returned 0x970 [0067.514] GetCurrentThreadId () returned 0x970 [0067.514] GetCurrentThreadId () returned 0x970 [0067.514] GetCurrentThreadId () returned 0x970 [0067.514] GetCurrentThreadId () returned 0x970 [0067.514] GetCurrentThreadId () returned 0x970 [0067.514] GetCurrentThreadId () returned 0x970 [0067.514] GetCurrentThreadId () returned 0x970 [0067.514] GetCurrentThreadId () returned 0x970 [0067.514] GetCurrentThreadId () returned 0x970 [0067.514] GetCurrentThreadId () returned 0x970 [0067.514] GetCurrentThreadId () returned 0x970 [0067.514] GetCurrentThreadId () returned 0x970 [0067.514] GetCurrentThreadId () returned 0x970 [0067.514] GetCurrentThreadId () returned 0x970 [0067.514] GetCurrentThreadId () returned 0x970 [0067.514] GetCurrentThreadId () returned 0x970 [0067.514] GetCurrentThreadId () returned 0x970 [0067.514] GetCurrentThreadId () returned 0x970 [0067.514] GetCurrentThreadId () returned 0x970 [0067.514] GetCurrentThreadId () returned 0x970 [0067.514] GetCurrentThreadId () returned 0x970 [0067.515] GetCurrentThreadId () returned 0x970 [0067.515] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAABs0YjUFTFN06uKPCOs8CQMQjBgGDXLVuohlg+mzbYA/tbzID9iKUIk2VWaFj/wi7idJ48SteTouYLDelouyHna19X5nECNoKibq9m8gJaHwOEWKH7yfNiEoKHkL52ZbH+cUdst63A0BpyKErPGLq0STSea0UXjjT62Fd3IGap01dYBDIncLtCmCRlIlxCzGKLZ0tkkeKgnBF/Bdt/LGWrt9+UCXcHXWuw==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0067.515] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAABs0YjUFTFN06uKPCOs8CQMQjBgGDXLVuohlg+mzbYA/tbzID9iKUIk2VWaFj/wi7idJ48SteTouYLDelouyHna19X5nECNoKibq9m8gJaHwOEWKH7yfNiEoKHkL52ZbH+cUdst63A0BpyKErPGLq0STSea0UXjjT62Fd3IGap01dYBDIncLtCmCRlIlxCzGKLZ0tkkeKgnBF/Bdt/LGWrt9+UCXcHXWuw==", cchWideChar=245, lpMultiByteStr=0x353988c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAABs0YjUFTFN06uKPCOs8CQMQjBgGDXLVuohlg+mzbYA/tbzID9iKUIk2VWaFj/wi7idJ48SteTouYLDelouyHna19X5nECNoKibq9m8gJaHwOEWKH7yfNiEoKHkL52ZbH+cUdst63A0BpyKErPGLq0STSea0UXjjT62Fd3IGap01dYBDIncLtCmCRlIlxCzGKLZ0tkkeKgnBF/Bdt/LGWrt9+UCXcHXWuw==", lpUsedDefaultChar=0x0) returned 245 [0067.515] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0067.515] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0067.515] CloseHandle (hObject=0x158) returned 1 [0067.515] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_buttongraphic.png")) returned 0 [0067.516] GetLastError () returned 0x5 [0067.516] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_buttongraphic.png")) returned 0x20 [0067.516] SetLastError (dwErrCode=0x5) [0067.516] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=18777920509) returned 1 [0067.516] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\Файл зашифрован [NavigationLeft_SelectionSubpicture.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\Файл зашифрован [navigationleft_selectionsubpicture.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0067.516] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0067.517] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0067.517] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0067.517] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0067.517] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0067.517] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0067.517] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0067.517] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0067.517] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0067.517] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0067.517] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0067.517] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0067.517] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0067.517] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0067.517] SetEndOfFile (hFile=0x158) returned 1 [0067.518] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0067.518] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0067.518] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0067.518] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0067.518] WriteFile (in: hFile=0x158, lpBuffer=0x3777058*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777058*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0067.519] WriteFile (in: hFile=0x158, lpBuffer=0x35f035c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f035c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0067.519] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1wC+0~fy:}L<0K/EjRV\\14?>H6#9ekE7", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0067.519] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1wC+0~fy:}L<0K/EjRV\\14?>H6#9ekE7", cchWideChar=32, lpMultiByteStr=0x2036fb4, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1wC+0~fy:}L<0K/EjRV\\14?>H6#9ekE7", lpUsedDefaultChar=0x0) returned 32 [0067.519] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0067.519] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0067.519] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fbdd476, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fbdd476, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d14a237, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 0x295098 [0067.519] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0067.519] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0067.519] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_selectionsubpicture.png")) returned 0x20 [0067.519] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_selectionsubpicture.png")) returned 0x20 [0067.520] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_selectionsubpicture.png")) returned 0x20 [0067.520] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_selectionsubpicture.png")) returned 0x20 [0067.520] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_selectionsubpicture.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fbdd476, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fbdd476, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d14a237, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a)) returned 1 [0067.520] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0067.520] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0067.520] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_selectionsubpicture.png")) returned 0x20 [0067.520] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_selectionsubpicture.png")) returned 0x20 [0067.520] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0067.520] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0067.520] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0067.520] SetEndOfFile (hFile=0x158) returned 1 [0067.521] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0067.521] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x2036fec, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 38 [0067.521] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0067.521] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x2036f44, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 38 [0067.521] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x2036f44, cbMultiByte=38, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="NavigationLeft_SelectionSubpicture.pnggg") returned 38 [0067.521] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0067.521] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x2036fec, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 38 [0067.521] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0067.522] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0067.522] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0xc3a [0067.522] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0067.522] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0067.522] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0067.522] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0067.522] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x2036fec, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 38 [0067.522] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0067.522] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x2036f44, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 38 [0067.522] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x2036f44, cbMultiByte=38, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="NavigationLeft_SelectionSubpicture.pngre.pnggg") returned 38 [0067.522] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0067.522] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x2036fec, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 38 [0067.522] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0067.523] CharToOemA (in: pSrc="NavigationLeft_SelectionSubpicture.png", pDst=0x2036f44 | out: pDst="NavigationLeft_SelectionSubpicture.png") returned 1 [0067.523] WriteFile (in: hFile=0x158, lpBuffer=0x2036f44*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x2036f44*, lpNumberOfBytesWritten=0x18e048*=0x26, lpOverlapped=0x0) returned 1 [0067.523] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0067.523] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0067.524] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0067.524] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=18778710475) returned 1 [0067.524] ReadFile (in: hFile=0x11c, lpBuffer=0x37d4d60, nNumberOfBytesToRead=0xc3a, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37d4d60*, lpNumberOfBytesRead=0x18dd7c*=0xc3a, lpOverlapped=0x0) returned 1 [0067.525] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0067.525] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=18778884143) returned 1 [0067.534] WriteFile (in: hFile=0x158, lpBuffer=0x379aca8*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379aca8*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0067.534] ReadFile (in: hFile=0x11c, lpBuffer=0x37d4d60, nNumberOfBytesToRead=0xc3a, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x37d4d60*, lpNumberOfBytesRead=0x18de38*=0xc3a, lpOverlapped=0x0) returned 1 [0067.534] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x61 [0067.534] WriteFile (in: hFile=0x158, lpBuffer=0x3817280*, nNumberOfBytesToWrite=0xc3a, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3817280*, lpNumberOfBytesWritten=0x18de10*=0xc3a, lpOverlapped=0x0) returned 1 [0067.535] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0xc9b [0067.535] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0067.535] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0067.535] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0067.535] SetFilePointer (in: hFile=0x158, lDistanceToMove=38, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x44 [0067.535] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0xca5 [0067.535] CloseHandle (hObject=0x11c) returned 1 [0067.535] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xca5 [0067.535] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xca5 [0067.535] SetFilePointer (in: hFile=0x158, lDistanceToMove=3237, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xca5 [0067.535] SetFilePointer (in: hFile=0x158, lDistanceToMove=3237, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0xca5 [0067.535] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xca5 [0067.536] SetFilePointer (in: hFile=0x158, lDistanceToMove=3237, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0xca5 [0067.536] SetEndOfFile (hFile=0x158) returned 1 [0067.536] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xca5 [0067.536] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xca5 [0067.536] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0067.536] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x2036f44, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 38 [0067.536] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0067.536] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x2036fec, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 38 [0067.536] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x2036fec, cbMultiByte=38, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="NavigationLeft_SelectionSubpicture.png&") returned 38 [0067.536] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0067.536] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x2036f44, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 38 [0067.536] WriteFile (in: hFile=0x158, lpBuffer=0x37b8838*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x37b8838*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0067.536] CharToOemA (in: pSrc="NavigationLeft_SelectionSubpicture.png", pDst=0x2036fec | out: pDst="NavigationLeft_SelectionSubpicture.png") returned 1 [0067.536] WriteFile (in: hFile=0x158, lpBuffer=0x2036fec*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x2036fec*, lpNumberOfBytesWritten=0x18efcc*=0x26, lpOverlapped=0x0) returned 1 [0067.536] WriteFile (in: hFile=0x158, lpBuffer=0x379ade8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379ade8*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0067.536] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0067.537] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0067.537] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xd04 [0067.537] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xd04 [0067.537] WriteFile (in: hFile=0x158, lpBuffer=0x3777058*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777058*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0067.537] WriteFile (in: hFile=0x158, lpBuffer=0x35f035c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f035c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0067.537] DeleteFileW (lpFileName="") returned 0 [0067.537] GetLastError () returned 0x3 [0067.537] GetFileAttributesW (lpFileName="") returned 0xffffffff [0067.537] SetLastError (dwErrCode=0x3) [0067.537] FlushFileBuffers (hFile=0x158) returned 1 [0067.539] GetCurrentThreadId () returned 0x970 [0067.539] GetCurrentThreadId () returned 0x970 [0067.539] GetCurrentThreadId () returned 0x970 [0067.539] GetCurrentThreadId () returned 0x970 [0067.539] GetCurrentThreadId () returned 0x970 [0067.539] GetCurrentThreadId () returned 0x970 [0067.539] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xdbb [0067.540] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xdbb [0067.540] SetFilePointer (in: hFile=0x158, lDistanceToMove=3515, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xdbb [0067.540] CloseHandle (hObject=0x158) returned 1 [0067.540] GetCurrentThreadId () returned 0x970 [0067.540] GetCurrentThreadId () returned 0x970 [0067.540] GetCurrentThreadId () returned 0x970 [0067.540] GetCurrentThreadId () returned 0x970 [0067.540] GetCurrentThreadId () returned 0x970 [0067.540] GetCurrentThreadId () returned 0x970 [0067.540] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\Файл зашифрован [NavigationLeft_SelectionSubpicture.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\Файл зашифрован [navigationleft_selectionsubpicture.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0067.540] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdbb [0067.540] SetFilePointer (in: hFile=0x158, lDistanceToMove=3387, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd3b [0067.540] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0067.540] GetFileType (hFile=0x158) returned 0x1 [0067.540] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xe, wMilliseconds=0x32a)) [0067.540] GetCurrentThreadId () returned 0x970 [0067.540] GetCurrentThreadId () returned 0x970 [0067.540] GetCurrentThreadId () returned 0x970 [0067.540] GetCurrentThreadId () returned 0x970 [0067.540] GetCurrentThreadId () returned 0x970 [0067.540] GetCurrentThreadId () returned 0x970 [0067.541] GetCurrentThreadId () returned 0x970 [0067.541] GetCurrentThreadId () returned 0x970 [0067.541] GetCurrentThreadId () returned 0x970 [0067.541] GetCurrentThreadId () returned 0x970 [0067.541] GetCurrentThreadId () returned 0x970 [0067.541] GetCurrentThreadId () returned 0x970 [0067.541] GetCurrentThreadId () returned 0x970 [0067.541] GetCurrentThreadId () returned 0x970 [0067.541] GetCurrentThreadId () returned 0x970 [0067.541] GetCurrentThreadId () returned 0x970 [0067.541] GetCurrentThreadId () returned 0x970 [0067.541] GetCurrentThreadId () returned 0x970 [0067.541] GetCurrentThreadId () returned 0x970 [0067.541] GetCurrentThreadId () returned 0x970 [0067.541] GetCurrentThreadId () returned 0x970 [0067.541] GetCurrentThreadId () returned 0x970 [0067.541] GetCurrentThreadId () returned 0x970 [0067.541] GetCurrentThreadId () returned 0x970 [0067.541] GetCurrentThreadId () returned 0x970 [0067.541] GetCurrentThreadId () returned 0x970 [0067.541] GetCurrentThreadId () returned 0x970 [0067.541] GetCurrentThreadId () returned 0x970 [0067.541] GetCurrentThreadId () returned 0x970 [0067.541] GetCurrentThreadId () returned 0x970 [0067.541] GetCurrentThreadId () returned 0x970 [0067.541] GetCurrentThreadId () returned 0x970 [0067.541] GetCurrentThreadId () returned 0x970 [0067.541] GetCurrentThreadId () returned 0x970 [0067.541] GetCurrentThreadId () returned 0x970 [0067.541] GetCurrentThreadId () returned 0x970 [0067.541] GetCurrentThreadId () returned 0x970 [0067.541] GetCurrentThreadId () returned 0x970 [0067.541] GetCurrentThreadId () returned 0x970 [0067.541] GetCurrentThreadId () returned 0x970 [0067.541] GetCurrentThreadId () returned 0x970 [0067.541] GetCurrentThreadId () returned 0x970 [0067.541] GetCurrentThreadId () returned 0x970 [0067.541] GetCurrentThreadId () returned 0x970 [0067.541] GetCurrentThreadId () returned 0x970 [0067.541] GetCurrentThreadId () returned 0x970 [0067.541] GetCurrentThreadId () returned 0x970 [0067.541] GetCurrentThreadId () returned 0x970 [0067.541] GetCurrentThreadId () returned 0x970 [0067.541] GetCurrentThreadId () returned 0x970 [0067.541] GetCurrentThreadId () returned 0x970 [0067.542] GetCurrentThreadId () returned 0x970 [0067.542] GetCurrentThreadId () returned 0x970 [0067.542] GetCurrentThreadId () returned 0x970 [0067.542] GetCurrentThreadId () returned 0x970 [0067.542] GetCurrentThreadId () returned 0x970 [0067.542] GetCurrentThreadId () returned 0x970 [0067.542] GetCurrentThreadId () returned 0x970 [0067.542] GetCurrentThreadId () returned 0x970 [0067.542] GetCurrentThreadId () returned 0x970 [0067.542] GetCurrentThreadId () returned 0x970 [0067.542] GetCurrentThreadId () returned 0x970 [0067.542] GetCurrentThreadId () returned 0x970 [0067.542] GetCurrentThreadId () returned 0x970 [0067.542] GetCurrentThreadId () returned 0x970 [0067.542] GetCurrentThreadId () returned 0x970 [0067.542] GetCurrentThreadId () returned 0x970 [0067.542] GetCurrentThreadId () returned 0x970 [0067.542] GetCurrentThreadId () returned 0x970 [0067.542] GetCurrentThreadId () returned 0x970 [0067.542] GetCurrentThreadId () returned 0x970 [0067.542] GetCurrentThreadId () returned 0x970 [0067.542] GetCurrentThreadId () returned 0x970 [0067.542] GetCurrentThreadId () returned 0x970 [0067.542] GetCurrentThreadId () returned 0x970 [0067.542] GetCurrentThreadId () returned 0x970 [0067.542] GetCurrentThreadId () returned 0x970 [0067.542] GetCurrentThreadId () returned 0x970 [0067.542] GetCurrentThreadId () returned 0x970 [0067.542] GetCurrentThreadId () returned 0x970 [0067.542] GetCurrentThreadId () returned 0x970 [0067.542] GetCurrentThreadId () returned 0x970 [0067.542] GetCurrentThreadId () returned 0x970 [0067.542] GetCurrentThreadId () returned 0x970 [0067.542] GetCurrentThreadId () returned 0x970 [0067.542] GetCurrentThreadId () returned 0x970 [0067.542] GetCurrentThreadId () returned 0x970 [0067.542] GetCurrentThreadId () returned 0x970 [0067.542] GetCurrentThreadId () returned 0x970 [0067.542] GetCurrentThreadId () returned 0x970 [0067.542] GetCurrentThreadId () returned 0x970 [0067.542] GetCurrentThreadId () returned 0x970 [0067.542] GetCurrentThreadId () returned 0x970 [0067.542] GetCurrentThreadId () returned 0x970 [0067.542] GetCurrentThreadId () returned 0x970 [0067.542] GetCurrentThreadId () returned 0x970 [0067.542] GetCurrentThreadId () returned 0x970 [0067.543] GetCurrentThreadId () returned 0x970 [0067.543] GetCurrentThreadId () returned 0x970 [0067.543] GetCurrentThreadId () returned 0x970 [0067.543] GetCurrentThreadId () returned 0x970 [0067.543] GetCurrentThreadId () returned 0x970 [0067.543] GetCurrentThreadId () returned 0x970 [0067.543] GetCurrentThreadId () returned 0x970 [0067.543] GetCurrentThreadId () returned 0x970 [0067.543] GetCurrentThreadId () returned 0x970 [0067.543] GetCurrentThreadId () returned 0x970 [0067.543] GetCurrentThreadId () returned 0x970 [0067.543] GetCurrentThreadId () returned 0x970 [0067.543] GetCurrentThreadId () returned 0x970 [0067.543] GetCurrentThreadId () returned 0x970 [0067.543] GetCurrentThreadId () returned 0x970 [0067.543] GetCurrentThreadId () returned 0x970 [0067.543] GetCurrentThreadId () returned 0x970 [0067.543] GetCurrentThreadId () returned 0x970 [0067.543] GetCurrentThreadId () returned 0x970 [0067.543] GetCurrentThreadId () returned 0x970 [0067.543] GetCurrentThreadId () returned 0x970 [0067.543] GetCurrentThreadId () returned 0x970 [0067.543] GetCurrentThreadId () returned 0x970 [0067.543] GetCurrentThreadId () returned 0x970 [0067.543] GetCurrentThreadId () returned 0x970 [0067.543] GetCurrentThreadId () returned 0x970 [0067.543] GetCurrentThreadId () returned 0x970 [0067.543] GetCurrentThreadId () returned 0x970 [0067.543] GetCurrentThreadId () returned 0x970 [0067.543] GetCurrentThreadId () returned 0x970 [0067.543] GetCurrentThreadId () returned 0x970 [0067.543] GetCurrentThreadId () returned 0x970 [0067.543] GetCurrentThreadId () returned 0x970 [0067.543] GetCurrentThreadId () returned 0x970 [0067.543] GetCurrentThreadId () returned 0x970 [0067.543] GetCurrentThreadId () returned 0x970 [0067.543] GetCurrentThreadId () returned 0x970 [0067.543] GetCurrentThreadId () returned 0x970 [0067.543] GetCurrentThreadId () returned 0x970 [0067.543] GetCurrentThreadId () returned 0x970 [0067.543] GetCurrentThreadId () returned 0x970 [0067.543] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.543] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.543] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379caf8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0067.544] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.544] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.544] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379caf8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0067.544] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.544] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.544] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0067.544] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.544] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.544] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0067.544] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.544] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.544] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379cb58, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0067.544] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.544] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.544] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379cb58, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0067.544] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.544] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.544] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379cb58, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0067.544] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xe, wMilliseconds=0x32a)) [0067.544] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1wC+0~fy:}L<0K/EjRV\\14?>H6#9ekE7", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0067.544] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1wC+0~fy:}L<0K/EjRV\\14?>H6#9ekE7", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0067.544] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1wC+0~fy:}L<0K/EjRV\\14?>H6#9ekE7", cchWideChar=32, lpMultiByteStr=0x20043a8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1wC+0~fy:}L<0K/EjRV\\14?>H6#9ekE7", lpUsedDefaultChar=0x0) returned 32 [0067.544] GetCurrentThreadId () returned 0x970 [0067.544] GetCurrentThreadId () returned 0x970 [0067.544] GetCurrentThreadId () returned 0x970 [0067.544] GetCurrentThreadId () returned 0x970 [0067.544] GetCurrentThreadId () returned 0x970 [0067.544] GetCurrentThreadId () returned 0x970 [0067.552] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0067.552] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0067.552] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x37b09a8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0067.552] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb948, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0067.552] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eb948, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAF41udpAcQzqj4YemYFDF3DTDBKgDpyDfuzR/xkQVG0r485W2cBrYSpL6bBSDCsqUHn1UV70oftT6ewp4WjeMQ3A5G/AzCY4Y4bLBrsLAR3nIKievc4Mq0CxSLYb/pKM49uqGG7CKGwaZX9Zd+wLz18XcyHGDb4Bk9pLjOFWAvTWpn8rTxPoSsm7PKvtjGwDJy07YWy6EPWR4CP+H9nk9Atx6aNNYgC/fw==") returned 232 [0067.552] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xe, wMilliseconds=0x339)) [0067.552] GetCurrentThreadId () returned 0x970 [0067.552] GetCurrentThreadId () returned 0x970 [0067.552] GetCurrentThreadId () returned 0x970 [0067.552] GetCurrentThreadId () returned 0x970 [0067.552] GetCurrentThreadId () returned 0x970 [0067.552] GetCurrentThreadId () returned 0x970 [0067.552] GetCurrentThreadId () returned 0x970 [0067.552] GetCurrentThreadId () returned 0x970 [0067.552] GetCurrentThreadId () returned 0x970 [0067.552] GetCurrentThreadId () returned 0x970 [0067.552] GetCurrentThreadId () returned 0x970 [0067.552] GetCurrentThreadId () returned 0x970 [0067.552] GetCurrentThreadId () returned 0x970 [0067.552] GetCurrentThreadId () returned 0x970 [0067.552] GetCurrentThreadId () returned 0x970 [0067.552] GetCurrentThreadId () returned 0x970 [0067.552] GetCurrentThreadId () returned 0x970 [0067.552] GetCurrentThreadId () returned 0x970 [0067.552] GetCurrentThreadId () returned 0x970 [0067.552] GetCurrentThreadId () returned 0x970 [0067.552] GetCurrentThreadId () returned 0x970 [0067.552] GetCurrentThreadId () returned 0x970 [0067.552] GetCurrentThreadId () returned 0x970 [0067.552] GetCurrentThreadId () returned 0x970 [0067.552] GetCurrentThreadId () returned 0x970 [0067.552] GetCurrentThreadId () returned 0x970 [0067.553] GetCurrentThreadId () returned 0x970 [0067.553] GetCurrentThreadId () returned 0x970 [0067.553] GetCurrentThreadId () returned 0x970 [0067.553] GetCurrentThreadId () returned 0x970 [0067.553] GetCurrentThreadId () returned 0x970 [0067.553] GetCurrentThreadId () returned 0x970 [0067.553] GetCurrentThreadId () returned 0x970 [0067.553] GetCurrentThreadId () returned 0x970 [0067.553] GetCurrentThreadId () returned 0x970 [0067.553] GetCurrentThreadId () returned 0x970 [0067.553] GetCurrentThreadId () returned 0x970 [0067.553] GetCurrentThreadId () returned 0x970 [0067.553] GetCurrentThreadId () returned 0x970 [0067.553] GetCurrentThreadId () returned 0x970 [0067.553] GetCurrentThreadId () returned 0x970 [0067.553] GetCurrentThreadId () returned 0x970 [0067.553] GetCurrentThreadId () returned 0x970 [0067.553] GetCurrentThreadId () returned 0x970 [0067.553] GetCurrentThreadId () returned 0x970 [0067.553] GetCurrentThreadId () returned 0x970 [0067.553] GetCurrentThreadId () returned 0x970 [0067.553] GetCurrentThreadId () returned 0x970 [0067.553] GetCurrentThreadId () returned 0x970 [0067.553] GetCurrentThreadId () returned 0x970 [0067.553] GetCurrentThreadId () returned 0x970 [0067.553] GetCurrentThreadId () returned 0x970 [0067.553] GetCurrentThreadId () returned 0x970 [0067.553] GetCurrentThreadId () returned 0x970 [0067.553] GetCurrentThreadId () returned 0x970 [0067.553] GetCurrentThreadId () returned 0x970 [0067.553] GetCurrentThreadId () returned 0x970 [0067.553] GetCurrentThreadId () returned 0x970 [0067.553] GetCurrentThreadId () returned 0x970 [0067.553] GetCurrentThreadId () returned 0x970 [0067.553] GetCurrentThreadId () returned 0x970 [0067.553] GetCurrentThreadId () returned 0x970 [0067.553] GetCurrentThreadId () returned 0x970 [0067.553] GetCurrentThreadId () returned 0x970 [0067.553] GetCurrentThreadId () returned 0x970 [0067.553] GetCurrentThreadId () returned 0x970 [0067.553] GetCurrentThreadId () returned 0x970 [0067.553] GetCurrentThreadId () returned 0x970 [0067.553] GetCurrentThreadId () returned 0x970 [0067.553] GetCurrentThreadId () returned 0x970 [0067.553] GetCurrentThreadId () returned 0x970 [0067.553] GetCurrentThreadId () returned 0x970 [0067.554] GetCurrentThreadId () returned 0x970 [0067.554] GetCurrentThreadId () returned 0x970 [0067.554] GetCurrentThreadId () returned 0x970 [0067.554] GetCurrentThreadId () returned 0x970 [0067.554] GetCurrentThreadId () returned 0x970 [0067.554] GetCurrentThreadId () returned 0x970 [0067.554] GetCurrentThreadId () returned 0x970 [0067.554] GetCurrentThreadId () returned 0x970 [0067.554] GetCurrentThreadId () returned 0x970 [0067.554] GetCurrentThreadId () returned 0x970 [0067.554] GetCurrentThreadId () returned 0x970 [0067.554] GetCurrentThreadId () returned 0x970 [0067.554] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAF41udpAcQzqj4YemYFDF3DTDBKgDpyDfuzR/xkQVG0r485W2cBrYSpL6bBSDCsqUHn1UV70oftT6ewp4WjeMQ3A5G/AzCY4Y4bLBrsLAR3nIKievc4Mq0CxSLYb/pKM49uqGG7CKGwaZX9Zd+wLz18XcyHGDb4Bk9pLjOFWAvTWpn8rTxPoSsm7PKvtjGwDJy07YWy6EPWR4CP+H9nk9Atx6aNNYgC/fw==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0067.554] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAF41udpAcQzqj4YemYFDF3DTDBKgDpyDfuzR/xkQVG0r485W2cBrYSpL6bBSDCsqUHn1UV70oftT6ewp4WjeMQ3A5G/AzCY4Y4bLBrsLAR3nIKievc4Mq0CxSLYb/pKM49uqGG7CKGwaZX9Zd+wLz18XcyHGDb4Bk9pLjOFWAvTWpn8rTxPoSsm7PKvtjGwDJy07YWy6EPWR4CP+H9nk9Atx6aNNYgC/fw==", cchWideChar=245, lpMultiByteStr=0x3539aac, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAF41udpAcQzqj4YemYFDF3DTDBKgDpyDfuzR/xkQVG0r485W2cBrYSpL6bBSDCsqUHn1UV70oftT6ewp4WjeMQ3A5G/AzCY4Y4bLBrsLAR3nIKievc4Mq0CxSLYb/pKM49uqGG7CKGwaZX9Zd+wLz18XcyHGDb4Bk9pLjOFWAvTWpn8rTxPoSsm7PKvtjGwDJy07YWy6EPWR4CP+H9nk9Atx6aNNYgC/fw==", lpUsedDefaultChar=0x0) returned 245 [0067.554] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0067.554] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0067.554] CloseHandle (hObject=0x158) returned 1 [0067.554] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_selectionsubpicture.png")) returned 0 [0067.554] GetLastError () returned 0x5 [0067.554] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_selectionsubpicture.png")) returned 0x20 [0067.554] SetLastError (dwErrCode=0x5) [0067.554] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=18781795426) returned 1 [0067.555] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\Файл зашифрован [NavigationRight_ButtonGraphic.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\Файл зашифрован [navigationright_buttongraphic.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0067.555] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0067.555] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0067.555] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0067.555] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0067.555] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0067.555] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0067.555] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0067.555] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0067.555] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0067.555] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0067.556] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0067.556] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0067.556] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0067.556] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0067.556] SetEndOfFile (hFile=0x158) returned 1 [0067.556] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0067.556] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0067.556] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0067.556] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0067.556] WriteFile (in: hFile=0x158, lpBuffer=0x3777058*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777058*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0067.557] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0067.557] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="\"hf<3FUU5%K\\30^Aqd,wX8vd4/eU\\RGQ", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0067.557] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="\"hf<3FUU5%K\\30^Aqd,wX8vd4/eU\\RGQ", cchWideChar=32, lpMultiByteStr=0x2036b8c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\"hf<3FUU5%K\\30^Aqd,wX8vd4/eU\\RGQ", lpUsedDefaultChar=0x0) returned 32 [0067.557] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0067.557] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0067.557] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fbdd476, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fbdd476, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d14a237, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 0x295098 [0067.557] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0067.557] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0067.557] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_buttongraphic.png")) returned 0x20 [0067.558] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_buttongraphic.png")) returned 0x20 [0067.558] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_buttongraphic.png")) returned 0x20 [0067.558] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_buttongraphic.png")) returned 0x20 [0067.558] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_buttongraphic.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fbdd476, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fbdd476, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d14a237, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1)) returned 1 [0067.558] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0067.558] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0067.558] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_buttongraphic.png")) returned 0x20 [0067.558] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_buttongraphic.png")) returned 0x20 [0067.558] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0067.558] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0067.558] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0067.558] SetEndOfFile (hFile=0x158) returned 1 [0067.559] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0067.559] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x2036f7c, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 33 [0067.559] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0067.559] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x203687c, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 33 [0067.559] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x203687c, cbMultiByte=33, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="NavigationRight_ButtonGraphic.pnge.pnggg") returned 33 [0067.559] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0067.559] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x2036f7c, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 33 [0067.559] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0067.559] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0067.560] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x13a1 [0067.560] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0067.560] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0067.560] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0067.560] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0067.560] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x2036f7c, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 33 [0067.560] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0067.560] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x203687c, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 33 [0067.560] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x203687c, cbMultiByte=33, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="NavigationRight_ButtonGraphic.pngic.pnge.pnggg") returned 33 [0067.560] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0067.560] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x2036f7c, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 33 [0067.560] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0067.561] CharToOemA (in: pSrc="NavigationRight_ButtonGraphic.png", pDst=0x203687c | out: pDst="NavigationRight_ButtonGraphic.png") returned 1 [0067.561] WriteFile (in: hFile=0x158, lpBuffer=0x203687c*, nNumberOfBytesToWrite=0x21, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x203687c*, lpNumberOfBytesWritten=0x18e048*=0x21, lpOverlapped=0x0) returned 1 [0067.561] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0067.561] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0067.561] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0067.561] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=18782478847) returned 1 [0067.561] ReadFile (in: hFile=0x11c, lpBuffer=0x37d4d60, nNumberOfBytesToRead=0x13a1, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37d4d60*, lpNumberOfBytesRead=0x18dd7c*=0x13a1, lpOverlapped=0x0) returned 1 [0067.563] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0067.563] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=18782682564) returned 1 [0067.572] WriteFile (in: hFile=0x158, lpBuffer=0x379ae28*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379ae28*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0067.572] ReadFile (in: hFile=0x11c, lpBuffer=0x37d4d60, nNumberOfBytesToRead=0x13a1, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x37d4d60*, lpNumberOfBytesRead=0x18de38*=0x13a1, lpOverlapped=0x0) returned 1 [0067.572] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x5c [0067.572] WriteFile (in: hFile=0x158, lpBuffer=0x3817980*, nNumberOfBytesToWrite=0x13a1, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3817980*, lpNumberOfBytesWritten=0x18de10*=0x13a1, lpOverlapped=0x0) returned 1 [0067.573] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x13fd [0067.573] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0067.573] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0067.573] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0067.573] SetFilePointer (in: hFile=0x158, lDistanceToMove=33, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x3f [0067.573] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x1407 [0067.573] CloseHandle (hObject=0x11c) returned 1 [0067.573] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1407 [0067.573] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1407 [0067.573] SetFilePointer (in: hFile=0x158, lDistanceToMove=5127, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1407 [0067.573] SetFilePointer (in: hFile=0x158, lDistanceToMove=5127, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x1407 [0067.573] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1407 [0067.574] SetFilePointer (in: hFile=0x158, lDistanceToMove=5127, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x1407 [0067.574] SetEndOfFile (hFile=0x158) returned 1 [0067.574] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1407 [0067.574] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1407 [0067.574] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0067.574] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x203687c, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 33 [0067.574] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0067.574] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x2036f7c, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 33 [0067.574] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x2036f7c, cbMultiByte=33, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="NavigationRight_ButtonGraphic.pngⵠᎽ") returned 33 [0067.574] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0067.574] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x203687c, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 33 [0067.574] WriteFile (in: hFile=0x158, lpBuffer=0x37b8838*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x37b8838*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0067.574] CharToOemA (in: pSrc="NavigationRight_ButtonGraphic.png", pDst=0x2036f7c | out: pDst="NavigationRight_ButtonGraphic.png") returned 1 [0067.574] WriteFile (in: hFile=0x158, lpBuffer=0x2036f7c*, nNumberOfBytesToWrite=0x21, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x2036f7c*, lpNumberOfBytesWritten=0x18efcc*=0x21, lpOverlapped=0x0) returned 1 [0067.574] WriteFile (in: hFile=0x158, lpBuffer=0x379ae18*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379ae18*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0067.574] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0067.575] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0067.575] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1461 [0067.575] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1461 [0067.575] WriteFile (in: hFile=0x158, lpBuffer=0x3777058*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777058*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0067.575] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0067.575] DeleteFileW (lpFileName="") returned 0 [0067.575] GetLastError () returned 0x3 [0067.575] GetFileAttributesW (lpFileName="") returned 0xffffffff [0067.575] SetLastError (dwErrCode=0x3) [0067.575] FlushFileBuffers (hFile=0x158) returned 1 [0067.578] GetCurrentThreadId () returned 0x970 [0067.578] GetCurrentThreadId () returned 0x970 [0067.578] GetCurrentThreadId () returned 0x970 [0067.578] GetCurrentThreadId () returned 0x970 [0067.578] GetCurrentThreadId () returned 0x970 [0067.578] GetCurrentThreadId () returned 0x970 [0067.578] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x1518 [0067.578] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x1518 [0067.578] SetFilePointer (in: hFile=0x158, lDistanceToMove=5400, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x1518 [0067.578] CloseHandle (hObject=0x158) returned 1 [0067.578] GetCurrentThreadId () returned 0x970 [0067.578] GetCurrentThreadId () returned 0x970 [0067.578] GetCurrentThreadId () returned 0x970 [0067.578] GetCurrentThreadId () returned 0x970 [0067.578] GetCurrentThreadId () returned 0x970 [0067.578] GetCurrentThreadId () returned 0x970 [0067.578] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\Файл зашифрован [NavigationRight_ButtonGraphic.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\Файл зашифрован [navigationright_buttongraphic.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0067.579] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1518 [0067.579] SetFilePointer (in: hFile=0x158, lDistanceToMove=5272, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1498 [0067.579] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0067.579] GetFileType (hFile=0x158) returned 0x1 [0067.579] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xe, wMilliseconds=0x358)) [0067.579] GetCurrentThreadId () returned 0x970 [0067.579] GetCurrentThreadId () returned 0x970 [0067.579] GetCurrentThreadId () returned 0x970 [0067.579] GetCurrentThreadId () returned 0x970 [0067.579] GetCurrentThreadId () returned 0x970 [0067.579] GetCurrentThreadId () returned 0x970 [0067.579] GetCurrentThreadId () returned 0x970 [0067.579] GetCurrentThreadId () returned 0x970 [0067.579] GetCurrentThreadId () returned 0x970 [0067.579] GetCurrentThreadId () returned 0x970 [0067.579] GetCurrentThreadId () returned 0x970 [0067.579] GetCurrentThreadId () returned 0x970 [0067.579] GetCurrentThreadId () returned 0x970 [0067.579] GetCurrentThreadId () returned 0x970 [0067.579] GetCurrentThreadId () returned 0x970 [0067.579] GetCurrentThreadId () returned 0x970 [0067.579] GetCurrentThreadId () returned 0x970 [0067.579] GetCurrentThreadId () returned 0x970 [0067.579] GetCurrentThreadId () returned 0x970 [0067.579] GetCurrentThreadId () returned 0x970 [0067.579] GetCurrentThreadId () returned 0x970 [0067.579] GetCurrentThreadId () returned 0x970 [0067.579] GetCurrentThreadId () returned 0x970 [0067.579] GetCurrentThreadId () returned 0x970 [0067.579] GetCurrentThreadId () returned 0x970 [0067.579] GetCurrentThreadId () returned 0x970 [0067.579] GetCurrentThreadId () returned 0x970 [0067.579] GetCurrentThreadId () returned 0x970 [0067.579] GetCurrentThreadId () returned 0x970 [0067.579] GetCurrentThreadId () returned 0x970 [0067.579] GetCurrentThreadId () returned 0x970 [0067.579] GetCurrentThreadId () returned 0x970 [0067.579] GetCurrentThreadId () returned 0x970 [0067.579] GetCurrentThreadId () returned 0x970 [0067.579] GetCurrentThreadId () returned 0x970 [0067.580] GetCurrentThreadId () returned 0x970 [0067.580] GetCurrentThreadId () returned 0x970 [0067.580] GetCurrentThreadId () returned 0x970 [0067.580] GetCurrentThreadId () returned 0x970 [0067.580] GetCurrentThreadId () returned 0x970 [0067.580] GetCurrentThreadId () returned 0x970 [0067.580] GetCurrentThreadId () returned 0x970 [0067.580] GetCurrentThreadId () returned 0x970 [0067.580] GetCurrentThreadId () returned 0x970 [0067.580] GetCurrentThreadId () returned 0x970 [0067.580] GetCurrentThreadId () returned 0x970 [0067.580] GetCurrentThreadId () returned 0x970 [0067.580] GetCurrentThreadId () returned 0x970 [0067.580] GetCurrentThreadId () returned 0x970 [0067.580] GetCurrentThreadId () returned 0x970 [0067.580] GetCurrentThreadId () returned 0x970 [0067.580] GetCurrentThreadId () returned 0x970 [0067.580] GetCurrentThreadId () returned 0x970 [0067.580] GetCurrentThreadId () returned 0x970 [0067.580] GetCurrentThreadId () returned 0x970 [0067.580] GetCurrentThreadId () returned 0x970 [0067.580] GetCurrentThreadId () returned 0x970 [0067.580] GetCurrentThreadId () returned 0x970 [0067.580] GetCurrentThreadId () returned 0x970 [0067.580] GetCurrentThreadId () returned 0x970 [0067.580] GetCurrentThreadId () returned 0x970 [0067.580] GetCurrentThreadId () returned 0x970 [0067.580] GetCurrentThreadId () returned 0x970 [0067.580] GetCurrentThreadId () returned 0x970 [0067.580] GetCurrentThreadId () returned 0x970 [0067.580] GetCurrentThreadId () returned 0x970 [0067.580] GetCurrentThreadId () returned 0x970 [0067.580] GetCurrentThreadId () returned 0x970 [0067.580] GetCurrentThreadId () returned 0x970 [0067.580] GetCurrentThreadId () returned 0x970 [0067.580] GetCurrentThreadId () returned 0x970 [0067.580] GetCurrentThreadId () returned 0x970 [0067.580] GetCurrentThreadId () returned 0x970 [0067.580] GetCurrentThreadId () returned 0x970 [0067.580] GetCurrentThreadId () returned 0x970 [0067.580] GetCurrentThreadId () returned 0x970 [0067.580] GetCurrentThreadId () returned 0x970 [0067.580] GetCurrentThreadId () returned 0x970 [0067.580] GetCurrentThreadId () returned 0x970 [0067.580] GetCurrentThreadId () returned 0x970 [0067.580] GetCurrentThreadId () returned 0x970 [0067.581] GetCurrentThreadId () returned 0x970 [0067.581] GetCurrentThreadId () returned 0x970 [0067.581] GetCurrentThreadId () returned 0x970 [0067.581] GetCurrentThreadId () returned 0x970 [0067.581] GetCurrentThreadId () returned 0x970 [0067.581] GetCurrentThreadId () returned 0x970 [0067.581] GetCurrentThreadId () returned 0x970 [0067.581] GetCurrentThreadId () returned 0x970 [0067.581] GetCurrentThreadId () returned 0x970 [0067.581] GetCurrentThreadId () returned 0x970 [0067.581] GetCurrentThreadId () returned 0x970 [0067.581] GetCurrentThreadId () returned 0x970 [0067.581] GetCurrentThreadId () returned 0x970 [0067.581] GetCurrentThreadId () returned 0x970 [0067.581] GetCurrentThreadId () returned 0x970 [0067.581] GetCurrentThreadId () returned 0x970 [0067.581] GetCurrentThreadId () returned 0x970 [0067.581] GetCurrentThreadId () returned 0x970 [0067.581] GetCurrentThreadId () returned 0x970 [0067.581] GetCurrentThreadId () returned 0x970 [0067.581] GetCurrentThreadId () returned 0x970 [0067.581] GetCurrentThreadId () returned 0x970 [0067.581] GetCurrentThreadId () returned 0x970 [0067.581] GetCurrentThreadId () returned 0x970 [0067.581] GetCurrentThreadId () returned 0x970 [0067.581] GetCurrentThreadId () returned 0x970 [0067.581] GetCurrentThreadId () returned 0x970 [0067.581] GetCurrentThreadId () returned 0x970 [0067.581] GetCurrentThreadId () returned 0x970 [0067.581] GetCurrentThreadId () returned 0x970 [0067.581] GetCurrentThreadId () returned 0x970 [0067.581] GetCurrentThreadId () returned 0x970 [0067.581] GetCurrentThreadId () returned 0x970 [0067.581] GetCurrentThreadId () returned 0x970 [0067.581] GetCurrentThreadId () returned 0x970 [0067.581] GetCurrentThreadId () returned 0x970 [0067.581] GetCurrentThreadId () returned 0x970 [0067.581] GetCurrentThreadId () returned 0x970 [0067.581] GetCurrentThreadId () returned 0x970 [0067.581] GetCurrentThreadId () returned 0x970 [0067.581] GetCurrentThreadId () returned 0x970 [0067.581] GetCurrentThreadId () returned 0x970 [0067.581] GetCurrentThreadId () returned 0x970 [0067.581] GetCurrentThreadId () returned 0x970 [0067.581] GetCurrentThreadId () returned 0x970 [0067.582] GetCurrentThreadId () returned 0x970 [0067.582] GetCurrentThreadId () returned 0x970 [0067.582] GetCurrentThreadId () returned 0x970 [0067.582] GetCurrentThreadId () returned 0x970 [0067.582] GetCurrentThreadId () returned 0x970 [0067.582] GetCurrentThreadId () returned 0x970 [0067.582] GetCurrentThreadId () returned 0x970 [0067.582] GetCurrentThreadId () returned 0x970 [0067.582] GetCurrentThreadId () returned 0x970 [0067.582] GetCurrentThreadId () returned 0x970 [0067.582] GetCurrentThreadId () returned 0x970 [0067.582] GetCurrentThreadId () returned 0x970 [0067.582] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.582] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.582] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379cb58, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0067.582] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.582] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.582] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379cb58, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0067.582] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.582] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.582] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0067.582] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.582] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.582] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0067.582] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.582] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.582] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379cbb8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0067.582] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.582] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.582] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379cbb8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0067.582] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.582] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.582] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379cbb8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0067.582] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xe, wMilliseconds=0x358)) [0067.582] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="\"hf<3FUU5%K\\30^Aqd,wX8vd4/eU\\RGQ", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0067.582] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="\"hf<3FUU5%K\\30^Aqd,wX8vd4/eU\\RGQ", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0067.583] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="\"hf<3FUU5%K\\30^Aqd,wX8vd4/eU\\RGQ", cchWideChar=32, lpMultiByteStr=0x20043d8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\"hf<3FUU5%K\\30^Aqd,wX8vd4/eU\\RGQ", lpUsedDefaultChar=0x0) returned 32 [0067.583] GetCurrentThreadId () returned 0x970 [0067.583] GetCurrentThreadId () returned 0x970 [0067.583] GetCurrentThreadId () returned 0x970 [0067.583] GetCurrentThreadId () returned 0x970 [0067.583] GetCurrentThreadId () returned 0x970 [0067.583] GetCurrentThreadId () returned 0x970 [0067.590] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0067.591] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0067.591] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x37b0a98, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0067.591] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ebd48, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0067.591] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ebd48, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAACC9jhn+YgtMJard+PpryfOqY7qr+qNCm0VimoBvYlGbXeSGkpiuzUalsyPdAtwTgGJVFSx0af/S5VfEJiSK7V6IP0Zd0pEHzSWCEiionm0g7sd7c+LS4Xt68BjRUrzvcI5EFACCCx1ogepkifqLobyixIPp/lmZ7Hbdf0wi+EKvKimMVD73miXUoq8AhORFuCH8Yi4mtfmWpuG2Gj3L9Ch+cU9FBypBSw==") returned 232 [0067.591] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xe, wMilliseconds=0x358)) [0067.591] GetCurrentThreadId () returned 0x970 [0067.591] GetCurrentThreadId () returned 0x970 [0067.591] GetCurrentThreadId () returned 0x970 [0067.591] GetCurrentThreadId () returned 0x970 [0067.591] GetCurrentThreadId () returned 0x970 [0067.591] GetCurrentThreadId () returned 0x970 [0067.591] GetCurrentThreadId () returned 0x970 [0067.591] GetCurrentThreadId () returned 0x970 [0067.591] GetCurrentThreadId () returned 0x970 [0067.591] GetCurrentThreadId () returned 0x970 [0067.591] GetCurrentThreadId () returned 0x970 [0067.591] GetCurrentThreadId () returned 0x970 [0067.591] GetCurrentThreadId () returned 0x970 [0067.591] GetCurrentThreadId () returned 0x970 [0067.591] GetCurrentThreadId () returned 0x970 [0067.591] GetCurrentThreadId () returned 0x970 [0067.591] GetCurrentThreadId () returned 0x970 [0067.591] GetCurrentThreadId () returned 0x970 [0067.591] GetCurrentThreadId () returned 0x970 [0067.591] GetCurrentThreadId () returned 0x970 [0067.591] GetCurrentThreadId () returned 0x970 [0067.591] GetCurrentThreadId () returned 0x970 [0067.591] GetCurrentThreadId () returned 0x970 [0067.591] GetCurrentThreadId () returned 0x970 [0067.591] GetCurrentThreadId () returned 0x970 [0067.591] GetCurrentThreadId () returned 0x970 [0067.591] GetCurrentThreadId () returned 0x970 [0067.591] GetCurrentThreadId () returned 0x970 [0067.591] GetCurrentThreadId () returned 0x970 [0067.591] GetCurrentThreadId () returned 0x970 [0067.591] GetCurrentThreadId () returned 0x970 [0067.592] GetCurrentThreadId () returned 0x970 [0067.592] GetCurrentThreadId () returned 0x970 [0067.592] GetCurrentThreadId () returned 0x970 [0067.592] GetCurrentThreadId () returned 0x970 [0067.592] GetCurrentThreadId () returned 0x970 [0067.592] GetCurrentThreadId () returned 0x970 [0067.592] GetCurrentThreadId () returned 0x970 [0067.592] GetCurrentThreadId () returned 0x970 [0067.592] GetCurrentThreadId () returned 0x970 [0067.592] GetCurrentThreadId () returned 0x970 [0067.592] GetCurrentThreadId () returned 0x970 [0067.592] GetCurrentThreadId () returned 0x970 [0067.592] GetCurrentThreadId () returned 0x970 [0067.592] GetCurrentThreadId () returned 0x970 [0067.592] GetCurrentThreadId () returned 0x970 [0067.592] GetCurrentThreadId () returned 0x970 [0067.592] GetCurrentThreadId () returned 0x970 [0067.592] GetCurrentThreadId () returned 0x970 [0067.592] GetCurrentThreadId () returned 0x970 [0067.592] GetCurrentThreadId () returned 0x970 [0067.592] GetCurrentThreadId () returned 0x970 [0067.592] GetCurrentThreadId () returned 0x970 [0067.592] GetCurrentThreadId () returned 0x970 [0067.592] GetCurrentThreadId () returned 0x970 [0067.592] GetCurrentThreadId () returned 0x970 [0067.592] GetCurrentThreadId () returned 0x970 [0067.592] GetCurrentThreadId () returned 0x970 [0067.592] GetCurrentThreadId () returned 0x970 [0067.592] GetCurrentThreadId () returned 0x970 [0067.592] GetCurrentThreadId () returned 0x970 [0067.592] GetCurrentThreadId () returned 0x970 [0067.592] GetCurrentThreadId () returned 0x970 [0067.592] GetCurrentThreadId () returned 0x970 [0067.592] GetCurrentThreadId () returned 0x970 [0067.592] GetCurrentThreadId () returned 0x970 [0067.593] GetCurrentThreadId () returned 0x970 [0067.593] GetCurrentThreadId () returned 0x970 [0067.593] GetCurrentThreadId () returned 0x970 [0067.593] GetCurrentThreadId () returned 0x970 [0067.593] GetCurrentThreadId () returned 0x970 [0067.593] GetCurrentThreadId () returned 0x970 [0067.593] GetCurrentThreadId () returned 0x970 [0067.593] GetCurrentThreadId () returned 0x970 [0067.593] GetCurrentThreadId () returned 0x970 [0067.593] GetCurrentThreadId () returned 0x970 [0067.593] GetCurrentThreadId () returned 0x970 [0067.593] GetCurrentThreadId () returned 0x970 [0067.593] GetCurrentThreadId () returned 0x970 [0067.593] GetCurrentThreadId () returned 0x970 [0067.593] GetCurrentThreadId () returned 0x970 [0067.593] GetCurrentThreadId () returned 0x970 [0067.593] GetCurrentThreadId () returned 0x970 [0067.593] GetCurrentThreadId () returned 0x970 [0067.593] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAACC9jhn+YgtMJard+PpryfOqY7qr+qNCm0VimoBvYlGbXeSGkpiuzUalsyPdAtwTgGJVFSx0af/S5VfEJiSK7V6IP0Zd0pEHzSWCEiionm0g7sd7c+LS4Xt68BjRUrzvcI5EFACCCx1ogepkifqLobyixIPp/lmZ7Hbdf0wi+EKvKimMVD73miXUoq8AhORFuCH8Yi4mtfmWpuG2Gj3L9Ch+cU9FBypBSw==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0067.593] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAACC9jhn+YgtMJard+PpryfOqY7qr+qNCm0VimoBvYlGbXeSGkpiuzUalsyPdAtwTgGJVFSx0af/S5VfEJiSK7V6IP0Zd0pEHzSWCEiionm0g7sd7c+LS4Xt68BjRUrzvcI5EFACCCx1ogepkifqLobyixIPp/lmZ7Hbdf0wi+EKvKimMVD73miXUoq8AhORFuCH8Yi4mtfmWpuG2Gj3L9Ch+cU9FBypBSw==", cchWideChar=245, lpMultiByteStr=0x353999c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAACC9jhn+YgtMJard+PpryfOqY7qr+qNCm0VimoBvYlGbXeSGkpiuzUalsyPdAtwTgGJVFSx0af/S5VfEJiSK7V6IP0Zd0pEHzSWCEiionm0g7sd7c+LS4Xt68BjRUrzvcI5EFACCCx1ogepkifqLobyixIPp/lmZ7Hbdf0wi+EKvKimMVD73miXUoq8AhORFuCH8Yi4mtfmWpuG2Gj3L9Ch+cU9FBypBSw==", lpUsedDefaultChar=0x0) returned 245 [0067.593] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0067.593] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0067.594] CloseHandle (hObject=0x158) returned 1 [0067.594] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_buttongraphic.png")) returned 0 [0067.594] GetLastError () returned 0x5 [0067.594] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_buttongraphic.png")) returned 0x20 [0067.594] SetLastError (dwErrCode=0x5) [0067.594] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=18785748092) returned 1 [0067.594] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\Файл зашифрован [NavigationRight_SelectionSubpicture.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\Файл зашифрован [navigationright_selectionsubpicture.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0067.596] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0067.596] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0067.596] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0067.596] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0067.596] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0067.596] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0067.596] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0067.596] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0067.597] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0067.597] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0067.597] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0067.597] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0067.597] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0067.597] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0067.597] SetEndOfFile (hFile=0x158) returned 1 [0067.597] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0067.597] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0067.597] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0067.597] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0067.597] WriteFile (in: hFile=0x158, lpBuffer=0x3777058*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777058*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0067.598] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0067.598] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Q)a%@HFq6d58", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0067.653] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=":26K25Nh\\\\UYh!G9w\"W%!H>%@HFq6d58", cchWideChar=32, lpMultiByteStr=0x2036f7c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=":26K25Nh\\\\UYh!G9w\"W%!H>%@HFq6d58", lpUsedDefaultChar=0x0) returned 32 [0067.653] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0067.653] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0067.653] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb911bc, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb911bc, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 0x295098 [0067.654] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0067.654] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0067.654] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_buttongraphic.png")) returned 0x20 [0067.654] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_buttongraphic.png")) returned 0x20 [0067.654] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_buttongraphic.png")) returned 0x20 [0067.654] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_buttongraphic.png")) returned 0x20 [0067.654] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_buttongraphic.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb911bc, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb911bc, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b)) returned 1 [0067.654] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0067.654] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0067.654] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_buttongraphic.png")) returned 0x20 [0067.654] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_buttongraphic.png")) returned 0x20 [0067.655] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0067.655] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0067.655] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0067.655] SetEndOfFile (hFile=0x158) returned 1 [0067.656] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0067.656] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x2003e3c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0067.656] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0067.656] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x20038fc, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0067.656] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x20038fc, cbMultiByte=30, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="NavigationUp_ButtonGraphic.pngpngre.pngg") returned 30 [0067.656] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0067.656] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x2003e3c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0067.656] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0067.656] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0067.656] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x135b [0067.656] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0067.657] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0067.657] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0067.657] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0067.657] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x2003e3c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0067.657] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0067.657] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x20038fc, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0067.657] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x20038fc, cbMultiByte=30, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="NavigationUp_ButtonGraphic.pngic.pngpngre.pngg") returned 30 [0067.657] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0067.657] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x2003e3c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0067.657] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0067.658] CharToOemA (in: pSrc="NavigationUp_ButtonGraphic.png", pDst=0x20038fc | out: pDst="NavigationUp_ButtonGraphic.png") returned 1 [0067.658] WriteFile (in: hFile=0x158, lpBuffer=0x20038fc*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x20038fc*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0067.658] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0067.658] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0067.658] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0067.659] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=18792242061) returned 1 [0067.659] ReadFile (in: hFile=0x11c, lpBuffer=0x37d4d60, nNumberOfBytesToRead=0x135b, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37d4d60*, lpNumberOfBytesRead=0x18dd7c*=0x135b, lpOverlapped=0x0) returned 1 [0067.662] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0067.662] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=18792539583) returned 1 [0067.671] WriteFile (in: hFile=0x158, lpBuffer=0x379adc8*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379adc8*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0067.671] ReadFile (in: hFile=0x11c, lpBuffer=0x37d4d60, nNumberOfBytesToRead=0x135b, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x37d4d60*, lpNumberOfBytesRead=0x18de38*=0x135b, lpOverlapped=0x0) returned 1 [0067.671] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x59 [0067.671] WriteFile (in: hFile=0x158, lpBuffer=0x3817980*, nNumberOfBytesToWrite=0x135b, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3817980*, lpNumberOfBytesWritten=0x18de10*=0x135b, lpOverlapped=0x0) returned 1 [0067.672] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x13b4 [0067.672] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0067.672] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0067.672] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0067.672] SetFilePointer (in: hFile=0x158, lDistanceToMove=30, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x3c [0067.672] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x13be [0067.672] CloseHandle (hObject=0x11c) returned 1 [0067.672] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x13be [0067.672] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x13be [0067.672] SetFilePointer (in: hFile=0x158, lDistanceToMove=5054, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x13be [0067.672] SetFilePointer (in: hFile=0x158, lDistanceToMove=5054, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x13be [0067.672] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x13be [0067.672] SetFilePointer (in: hFile=0x158, lDistanceToMove=5054, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x13be [0067.673] SetEndOfFile (hFile=0x158) returned 1 [0067.673] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x13be [0067.673] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x13be [0067.673] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0067.673] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x20038fc, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0067.673] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0067.673] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x2003e3c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0067.673] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x2003e3c, cbMultiByte=30, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="NavigationUp_ButtonGraphic.png䃊㫋ÆǏ፷") returned 30 [0067.673] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0067.673] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x20038fc, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0067.673] WriteFile (in: hFile=0x158, lpBuffer=0x37b8838*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x37b8838*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0067.673] CharToOemA (in: pSrc="NavigationUp_ButtonGraphic.png", pDst=0x2003e3c | out: pDst="NavigationUp_ButtonGraphic.png") returned 1 [0067.673] WriteFile (in: hFile=0x158, lpBuffer=0x2003e3c*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x2003e3c*, lpNumberOfBytesWritten=0x18efcc*=0x1e, lpOverlapped=0x0) returned 1 [0067.673] WriteFile (in: hFile=0x158, lpBuffer=0x379ade8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379ade8*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0067.673] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0067.674] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0067.674] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1415 [0067.674] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1415 [0067.674] WriteFile (in: hFile=0x158, lpBuffer=0x3777058*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777058*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0067.674] WriteFile (in: hFile=0x158, lpBuffer=0x35f035c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f035c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0067.674] DeleteFileW (lpFileName="") returned 0 [0067.674] GetLastError () returned 0x3 [0067.674] GetFileAttributesW (lpFileName="") returned 0xffffffff [0067.674] SetLastError (dwErrCode=0x3) [0067.674] FlushFileBuffers (hFile=0x158) returned 1 [0067.677] GetCurrentThreadId () returned 0x970 [0067.677] GetCurrentThreadId () returned 0x970 [0067.677] GetCurrentThreadId () returned 0x970 [0067.677] GetCurrentThreadId () returned 0x970 [0067.677] GetCurrentThreadId () returned 0x970 [0067.677] GetCurrentThreadId () returned 0x970 [0067.677] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x14cc [0067.677] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x14cc [0067.677] SetFilePointer (in: hFile=0x158, lDistanceToMove=5324, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x14cc [0067.677] CloseHandle (hObject=0x158) returned 1 [0067.677] GetCurrentThreadId () returned 0x970 [0067.677] GetCurrentThreadId () returned 0x970 [0067.677] GetCurrentThreadId () returned 0x970 [0067.677] GetCurrentThreadId () returned 0x970 [0067.677] GetCurrentThreadId () returned 0x970 [0067.677] GetCurrentThreadId () returned 0x970 [0067.677] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\Файл зашифрован [NavigationUp_ButtonGraphic.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\Файл зашифрован [navigationup_buttongraphic.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0067.678] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14cc [0067.678] SetFilePointer (in: hFile=0x158, lDistanceToMove=5196, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x144c [0067.678] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0067.678] GetFileType (hFile=0x158) returned 0x1 [0067.678] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xe, wMilliseconds=0x3b6)) [0067.678] GetCurrentThreadId () returned 0x970 [0067.678] GetCurrentThreadId () returned 0x970 [0067.678] GetCurrentThreadId () returned 0x970 [0067.678] GetCurrentThreadId () returned 0x970 [0067.678] GetCurrentThreadId () returned 0x970 [0067.678] GetCurrentThreadId () returned 0x970 [0067.678] GetCurrentThreadId () returned 0x970 [0067.678] GetCurrentThreadId () returned 0x970 [0067.678] GetCurrentThreadId () returned 0x970 [0067.678] GetCurrentThreadId () returned 0x970 [0067.678] GetCurrentThreadId () returned 0x970 [0067.678] GetCurrentThreadId () returned 0x970 [0067.678] GetCurrentThreadId () returned 0x970 [0067.678] GetCurrentThreadId () returned 0x970 [0067.678] GetCurrentThreadId () returned 0x970 [0067.678] GetCurrentThreadId () returned 0x970 [0067.678] GetCurrentThreadId () returned 0x970 [0067.678] GetCurrentThreadId () returned 0x970 [0067.678] GetCurrentThreadId () returned 0x970 [0067.678] GetCurrentThreadId () returned 0x970 [0067.678] GetCurrentThreadId () returned 0x970 [0067.678] GetCurrentThreadId () returned 0x970 [0067.678] GetCurrentThreadId () returned 0x970 [0067.678] GetCurrentThreadId () returned 0x970 [0067.678] GetCurrentThreadId () returned 0x970 [0067.678] GetCurrentThreadId () returned 0x970 [0067.678] GetCurrentThreadId () returned 0x970 [0067.678] GetCurrentThreadId () returned 0x970 [0067.678] GetCurrentThreadId () returned 0x970 [0067.678] GetCurrentThreadId () returned 0x970 [0067.678] GetCurrentThreadId () returned 0x970 [0067.678] GetCurrentThreadId () returned 0x970 [0067.678] GetCurrentThreadId () returned 0x970 [0067.678] GetCurrentThreadId () returned 0x970 [0067.679] GetCurrentThreadId () returned 0x970 [0067.679] GetCurrentThreadId () returned 0x970 [0067.679] GetCurrentThreadId () returned 0x970 [0067.679] GetCurrentThreadId () returned 0x970 [0067.679] GetCurrentThreadId () returned 0x970 [0067.679] GetCurrentThreadId () returned 0x970 [0067.679] GetCurrentThreadId () returned 0x970 [0067.679] GetCurrentThreadId () returned 0x970 [0067.679] GetCurrentThreadId () returned 0x970 [0067.679] GetCurrentThreadId () returned 0x970 [0067.679] GetCurrentThreadId () returned 0x970 [0067.679] GetCurrentThreadId () returned 0x970 [0067.679] GetCurrentThreadId () returned 0x970 [0067.679] GetCurrentThreadId () returned 0x970 [0067.679] GetCurrentThreadId () returned 0x970 [0067.679] GetCurrentThreadId () returned 0x970 [0067.679] GetCurrentThreadId () returned 0x970 [0067.679] GetCurrentThreadId () returned 0x970 [0067.679] GetCurrentThreadId () returned 0x970 [0067.679] GetCurrentThreadId () returned 0x970 [0067.679] GetCurrentThreadId () returned 0x970 [0067.679] GetCurrentThreadId () returned 0x970 [0067.679] GetCurrentThreadId () returned 0x970 [0067.679] GetCurrentThreadId () returned 0x970 [0067.679] GetCurrentThreadId () returned 0x970 [0067.679] GetCurrentThreadId () returned 0x970 [0067.679] GetCurrentThreadId () returned 0x970 [0067.679] GetCurrentThreadId () returned 0x970 [0067.679] GetCurrentThreadId () returned 0x970 [0067.679] GetCurrentThreadId () returned 0x970 [0067.679] GetCurrentThreadId () returned 0x970 [0067.679] GetCurrentThreadId () returned 0x970 [0067.679] GetCurrentThreadId () returned 0x970 [0067.679] GetCurrentThreadId () returned 0x970 [0067.679] GetCurrentThreadId () returned 0x970 [0067.679] GetCurrentThreadId () returned 0x970 [0067.679] GetCurrentThreadId () returned 0x970 [0067.679] GetCurrentThreadId () returned 0x970 [0067.679] GetCurrentThreadId () returned 0x970 [0067.679] GetCurrentThreadId () returned 0x970 [0067.679] GetCurrentThreadId () returned 0x970 [0067.679] GetCurrentThreadId () returned 0x970 [0067.679] GetCurrentThreadId () returned 0x970 [0067.679] GetCurrentThreadId () returned 0x970 [0067.679] GetCurrentThreadId () returned 0x970 [0067.680] GetCurrentThreadId () returned 0x970 [0067.680] GetCurrentThreadId () returned 0x970 [0067.680] GetCurrentThreadId () returned 0x970 [0067.680] GetCurrentThreadId () returned 0x970 [0067.680] GetCurrentThreadId () returned 0x970 [0067.680] GetCurrentThreadId () returned 0x970 [0067.680] GetCurrentThreadId () returned 0x970 [0067.680] GetCurrentThreadId () returned 0x970 [0067.680] GetCurrentThreadId () returned 0x970 [0067.680] GetCurrentThreadId () returned 0x970 [0067.680] GetCurrentThreadId () returned 0x970 [0067.680] GetCurrentThreadId () returned 0x970 [0067.680] GetCurrentThreadId () returned 0x970 [0067.680] GetCurrentThreadId () returned 0x970 [0067.680] GetCurrentThreadId () returned 0x970 [0067.680] GetCurrentThreadId () returned 0x970 [0067.680] GetCurrentThreadId () returned 0x970 [0067.680] GetCurrentThreadId () returned 0x970 [0067.680] GetCurrentThreadId () returned 0x970 [0067.680] GetCurrentThreadId () returned 0x970 [0067.680] GetCurrentThreadId () returned 0x970 [0067.680] GetCurrentThreadId () returned 0x970 [0067.680] GetCurrentThreadId () returned 0x970 [0067.680] GetCurrentThreadId () returned 0x970 [0067.680] GetCurrentThreadId () returned 0x970 [0067.680] GetCurrentThreadId () returned 0x970 [0067.680] GetCurrentThreadId () returned 0x970 [0067.680] GetCurrentThreadId () returned 0x970 [0067.680] GetCurrentThreadId () returned 0x970 [0067.680] GetCurrentThreadId () returned 0x970 [0067.680] GetCurrentThreadId () returned 0x970 [0067.680] GetCurrentThreadId () returned 0x970 [0067.680] GetCurrentThreadId () returned 0x970 [0067.680] GetCurrentThreadId () returned 0x970 [0067.680] GetCurrentThreadId () returned 0x970 [0067.680] GetCurrentThreadId () returned 0x970 [0067.680] GetCurrentThreadId () returned 0x970 [0067.680] GetCurrentThreadId () returned 0x970 [0067.680] GetCurrentThreadId () returned 0x970 [0067.680] GetCurrentThreadId () returned 0x970 [0067.680] GetCurrentThreadId () returned 0x970 [0067.680] GetCurrentThreadId () returned 0x970 [0067.680] GetCurrentThreadId () returned 0x970 [0067.680] GetCurrentThreadId () returned 0x970 [0067.680] GetCurrentThreadId () returned 0x970 [0067.680] GetCurrentThreadId () returned 0x970 [0067.681] GetCurrentThreadId () returned 0x970 [0067.681] GetCurrentThreadId () returned 0x970 [0067.681] GetCurrentThreadId () returned 0x970 [0067.681] GetCurrentThreadId () returned 0x970 [0067.681] GetCurrentThreadId () returned 0x970 [0067.681] GetCurrentThreadId () returned 0x970 [0067.681] GetCurrentThreadId () returned 0x970 [0067.681] GetCurrentThreadId () returned 0x970 [0067.681] GetCurrentThreadId () returned 0x970 [0067.681] GetCurrentThreadId () returned 0x970 [0067.681] GetCurrentThreadId () returned 0x970 [0067.681] GetCurrentThreadId () returned 0x970 [0067.681] GetCurrentThreadId () returned 0x970 [0067.681] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.681] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.681] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379cc18, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0067.681] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.681] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.681] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379cc18, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0067.681] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.681] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.681] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0067.681] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.681] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.681] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0067.681] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.681] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.681] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379cc78, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0067.681] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.681] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.681] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379cc78, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0067.681] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.681] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.681] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379cc78, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0067.681] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xe, wMilliseconds=0x3b6)) [0067.682] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr=":26K25Nh\\\\UYh!G9w\"W%!H>%@HFq6d58", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0067.682] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr=":26K25Nh\\\\UYh!G9w\"W%!H>%@HFq6d58", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0067.682] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr=":26K25Nh\\\\UYh!G9w\"W%!H>%@HFq6d58", cchWideChar=32, lpMultiByteStr=0x2004438, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=":26K25Nh\\\\UYh!G9w\"W%!H>%@HFq6d58", lpUsedDefaultChar=0x0) returned 32 [0067.682] GetCurrentThreadId () returned 0x970 [0067.682] GetCurrentThreadId () returned 0x970 [0067.682] GetCurrentThreadId () returned 0x970 [0067.682] GetCurrentThreadId () returned 0x970 [0067.682] GetCurrentThreadId () returned 0x970 [0067.682] GetCurrentThreadId () returned 0x970 [0067.689] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0067.689] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0067.689] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x37b0c78, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0067.689] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ebe48, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0067.689] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ebe48, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAABiXvwgXkFM9D9We/iK5pAgkhFvaX0iRQGbTxJqFyhaOpcSory/YmbP1j/wILRRLg4w2Ob6sC0q8E675b6MwDPFRMPV28fHOFmPKBZTFpUnFNV/p3WFxJzrwSYzowmIQqMrmOuQ1NEe1NzsSDso1IdNr7e0NbHQFWXRluGKcN32+X4eHgkGRv15uRY6gSIWlE9U2Gn3cScP+kk4VxQlk22wo5i5EXNBI7A==") returned 232 [0067.689] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xe, wMilliseconds=0x3c6)) [0067.690] GetCurrentThreadId () returned 0x970 [0067.690] GetCurrentThreadId () returned 0x970 [0067.690] GetCurrentThreadId () returned 0x970 [0067.690] GetCurrentThreadId () returned 0x970 [0067.690] GetCurrentThreadId () returned 0x970 [0067.690] GetCurrentThreadId () returned 0x970 [0067.690] GetCurrentThreadId () returned 0x970 [0067.690] GetCurrentThreadId () returned 0x970 [0067.690] GetCurrentThreadId () returned 0x970 [0067.690] GetCurrentThreadId () returned 0x970 [0067.690] GetCurrentThreadId () returned 0x970 [0067.690] GetCurrentThreadId () returned 0x970 [0067.690] GetCurrentThreadId () returned 0x970 [0067.690] GetCurrentThreadId () returned 0x970 [0067.690] GetCurrentThreadId () returned 0x970 [0067.690] GetCurrentThreadId () returned 0x970 [0067.690] GetCurrentThreadId () returned 0x970 [0067.690] GetCurrentThreadId () returned 0x970 [0067.690] GetCurrentThreadId () returned 0x970 [0067.690] GetCurrentThreadId () returned 0x970 [0067.690] GetCurrentThreadId () returned 0x970 [0067.690] GetCurrentThreadId () returned 0x970 [0067.690] GetCurrentThreadId () returned 0x970 [0067.690] GetCurrentThreadId () returned 0x970 [0067.690] GetCurrentThreadId () returned 0x970 [0067.690] GetCurrentThreadId () returned 0x970 [0067.690] GetCurrentThreadId () returned 0x970 [0067.690] GetCurrentThreadId () returned 0x970 [0067.690] GetCurrentThreadId () returned 0x970 [0067.690] GetCurrentThreadId () returned 0x970 [0067.690] GetCurrentThreadId () returned 0x970 [0067.690] GetCurrentThreadId () returned 0x970 [0067.690] GetCurrentThreadId () returned 0x970 [0067.690] GetCurrentThreadId () returned 0x970 [0067.690] GetCurrentThreadId () returned 0x970 [0067.690] GetCurrentThreadId () returned 0x970 [0067.690] GetCurrentThreadId () returned 0x970 [0067.690] GetCurrentThreadId () returned 0x970 [0067.690] GetCurrentThreadId () returned 0x970 [0067.690] GetCurrentThreadId () returned 0x970 [0067.690] GetCurrentThreadId () returned 0x970 [0067.690] GetCurrentThreadId () returned 0x970 [0067.690] GetCurrentThreadId () returned 0x970 [0067.690] GetCurrentThreadId () returned 0x970 [0067.691] GetCurrentThreadId () returned 0x970 [0067.691] GetCurrentThreadId () returned 0x970 [0067.691] GetCurrentThreadId () returned 0x970 [0067.691] GetCurrentThreadId () returned 0x970 [0067.691] GetCurrentThreadId () returned 0x970 [0067.691] GetCurrentThreadId () returned 0x970 [0067.691] GetCurrentThreadId () returned 0x970 [0067.691] GetCurrentThreadId () returned 0x970 [0067.691] GetCurrentThreadId () returned 0x970 [0067.691] GetCurrentThreadId () returned 0x970 [0067.691] GetCurrentThreadId () returned 0x970 [0067.691] GetCurrentThreadId () returned 0x970 [0067.691] GetCurrentThreadId () returned 0x970 [0067.691] GetCurrentThreadId () returned 0x970 [0067.691] GetCurrentThreadId () returned 0x970 [0067.691] GetCurrentThreadId () returned 0x970 [0067.691] GetCurrentThreadId () returned 0x970 [0067.691] GetCurrentThreadId () returned 0x970 [0067.691] GetCurrentThreadId () returned 0x970 [0067.691] GetCurrentThreadId () returned 0x970 [0067.691] GetCurrentThreadId () returned 0x970 [0067.691] GetCurrentThreadId () returned 0x970 [0067.691] GetCurrentThreadId () returned 0x970 [0067.691] GetCurrentThreadId () returned 0x970 [0067.691] GetCurrentThreadId () returned 0x970 [0067.691] GetCurrentThreadId () returned 0x970 [0067.691] GetCurrentThreadId () returned 0x970 [0067.691] GetCurrentThreadId () returned 0x970 [0067.691] GetCurrentThreadId () returned 0x970 [0067.691] GetCurrentThreadId () returned 0x970 [0067.691] GetCurrentThreadId () returned 0x970 [0067.691] GetCurrentThreadId () returned 0x970 [0067.691] GetCurrentThreadId () returned 0x970 [0067.691] GetCurrentThreadId () returned 0x970 [0067.691] GetCurrentThreadId () returned 0x970 [0067.691] GetCurrentThreadId () returned 0x970 [0067.691] GetCurrentThreadId () returned 0x970 [0067.691] GetCurrentThreadId () returned 0x970 [0067.691] GetCurrentThreadId () returned 0x970 [0067.691] GetCurrentThreadId () returned 0x970 [0067.691] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAABiXvwgXkFM9D9We/iK5pAgkhFvaX0iRQGbTxJqFyhaOpcSory/YmbP1j/wILRRLg4w2Ob6sC0q8E675b6MwDPFRMPV28fHOFmPKBZTFpUnFNV/p3WFxJzrwSYzowmIQqMrmOuQ1NEe1NzsSDso1IdNr7e0NbHQFWXRluGKcN32+X4eHgkGRv15uRY6gSIWlE9U2Gn3cScP+kk4VxQlk22wo5i5EXNBI7A==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0067.691] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAABiXvwgXkFM9D9We/iK5pAgkhFvaX0iRQGbTxJqFyhaOpcSory/YmbP1j/wILRRLg4w2Ob6sC0q8E675b6MwDPFRMPV28fHOFmPKBZTFpUnFNV/p3WFxJzrwSYzowmIQqMrmOuQ1NEe1NzsSDso1IdNr7e0NbHQFWXRluGKcN32+X4eHgkGRv15uRY6gSIWlE9U2Gn3cScP+kk4VxQlk22wo5i5EXNBI7A==", cchWideChar=245, lpMultiByteStr=0x3539aac, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAABiXvwgXkFM9D9We/iK5pAgkhFvaX0iRQGbTxJqFyhaOpcSory/YmbP1j/wILRRLg4w2Ob6sC0q8E675b6MwDPFRMPV28fHOFmPKBZTFpUnFNV/p3WFxJzrwSYzowmIQqMrmOuQ1NEe1NzsSDso1IdNr7e0NbHQFWXRluGKcN32+X4eHgkGRv15uRY6gSIWlE9U2Gn3cScP+kk4VxQlk22wo5i5EXNBI7A==", lpUsedDefaultChar=0x0) returned 245 [0067.691] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0067.692] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0067.692] CloseHandle (hObject=0x158) returned 1 [0067.692] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_buttongraphic.png")) returned 0 [0067.692] GetLastError () returned 0x5 [0067.692] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_buttongraphic.png")) returned 0x20 [0067.692] SetLastError (dwErrCode=0x5) [0067.692] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=18795557320) returned 1 [0067.692] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\Файл зашифрован [NavigationUp_SelectionSubpicture.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\Файл зашифрован [navigationup_selectionsubpicture.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0067.693] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0067.693] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0067.693] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0067.693] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0067.693] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0067.693] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0067.693] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0067.693] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0067.693] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0067.693] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0067.693] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0067.693] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0067.693] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0067.693] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0067.693] SetEndOfFile (hFile=0x158) returned 1 [0067.694] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0067.694] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0067.694] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0067.694] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0067.694] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0067.695] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0067.695] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="#@sH#!kElAIUk=.LU&$19R&%$o\"w0\\D4", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0067.695] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="#@sH#!kElAIUk=.LU&$19R&%$o\"w0\\D4", cchWideChar=32, lpMultiByteStr=0x2037024, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="#@sH#!kElAIUk=.LU&$19R&%$o\"w0\\D4", lpUsedDefaultChar=0x0) returned 32 [0067.695] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0067.695] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0067.695] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fbb7319, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fbb7319, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 0x295098 [0067.695] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0067.695] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0067.695] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_selectionsubpicture.png")) returned 0x20 [0067.695] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_selectionsubpicture.png")) returned 0x20 [0067.695] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_selectionsubpicture.png")) returned 0x20 [0067.696] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_selectionsubpicture.png")) returned 0x20 [0067.696] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_selectionsubpicture.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fbb7319, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fbb7319, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09)) returned 1 [0067.696] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0067.696] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0067.696] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_selectionsubpicture.png")) returned 0x20 [0067.696] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_selectionsubpicture.png")) returned 0x20 [0067.696] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0067.696] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0067.696] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0067.696] SetEndOfFile (hFile=0x158) returned 1 [0067.697] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0067.697] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x2037094, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0067.697] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0067.697] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x2036f44, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0067.697] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x2036f44, cbMultiByte=36, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="NavigationUp_SelectionSubpicture.pngpngg") returned 36 [0067.697] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0067.697] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x2037094, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0067.697] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0067.697] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0067.697] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0xc09 [0067.698] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0067.698] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0067.698] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0067.698] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0067.698] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x2037094, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0067.698] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0067.698] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x2036f44, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0067.698] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x2036f44, cbMultiByte=36, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="NavigationUp_SelectionSubpicture.pngre.pngpngg") returned 36 [0067.698] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0067.698] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x2037094, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0067.698] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0067.699] CharToOemA (in: pSrc="NavigationUp_SelectionSubpicture.png", pDst=0x2036f44 | out: pDst="NavigationUp_SelectionSubpicture.png") returned 1 [0067.699] WriteFile (in: hFile=0x158, lpBuffer=0x2036f44*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x2036f44*, lpNumberOfBytesWritten=0x18e048*=0x24, lpOverlapped=0x0) returned 1 [0067.699] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0067.699] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0067.699] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0067.699] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=18796457961) returned 1 [0067.701] ReadFile (in: hFile=0x11c, lpBuffer=0x37d4d60, nNumberOfBytesToRead=0xc09, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37d4d60*, lpNumberOfBytesRead=0x18dd7c*=0xc09, lpOverlapped=0x0) returned 1 [0067.703] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0067.703] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=18796649192) returned 1 [0067.712] WriteFile (in: hFile=0x158, lpBuffer=0x379ad38*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379ad38*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0067.712] ReadFile (in: hFile=0x11c, lpBuffer=0x37d4d60, nNumberOfBytesToRead=0xc09, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x37d4d60*, lpNumberOfBytesRead=0x18de38*=0xc09, lpOverlapped=0x0) returned 1 [0067.712] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x5f [0067.712] WriteFile (in: hFile=0x158, lpBuffer=0x3817180*, nNumberOfBytesToWrite=0xc09, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3817180*, lpNumberOfBytesWritten=0x18de10*=0xc09, lpOverlapped=0x0) returned 1 [0067.712] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0xc68 [0067.712] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0067.712] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0067.712] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0067.713] SetFilePointer (in: hFile=0x158, lDistanceToMove=36, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x42 [0067.713] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0xc72 [0067.713] CloseHandle (hObject=0x11c) returned 1 [0067.713] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xc72 [0067.713] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xc72 [0067.713] SetFilePointer (in: hFile=0x158, lDistanceToMove=3186, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xc72 [0067.713] SetFilePointer (in: hFile=0x158, lDistanceToMove=3186, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0xc72 [0067.713] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xc72 [0067.713] SetFilePointer (in: hFile=0x158, lDistanceToMove=3186, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0xc72 [0067.713] SetEndOfFile (hFile=0x158) returned 1 [0067.713] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xc72 [0067.713] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xc72 [0067.713] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0067.713] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x2036f44, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0067.714] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0067.714] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x2037094, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0067.714] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x2037094, cbMultiByte=36, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="NavigationUp_SelectionSubpicture.pngఉ") returned 36 [0067.714] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0067.714] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x2036f44, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0067.714] WriteFile (in: hFile=0x158, lpBuffer=0x37b8838*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x37b8838*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0067.714] CharToOemA (in: pSrc="NavigationUp_SelectionSubpicture.png", pDst=0x2037094 | out: pDst="NavigationUp_SelectionSubpicture.png") returned 1 [0067.714] WriteFile (in: hFile=0x158, lpBuffer=0x2037094*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x2037094*, lpNumberOfBytesWritten=0x18efcc*=0x24, lpOverlapped=0x0) returned 1 [0067.714] WriteFile (in: hFile=0x158, lpBuffer=0x379ae18*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379ae18*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0067.714] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0067.714] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0067.714] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xccf [0067.714] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xccf [0067.714] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0067.714] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0067.715] DeleteFileW (lpFileName="") returned 0 [0067.715] GetLastError () returned 0x3 [0067.715] GetFileAttributesW (lpFileName="") returned 0xffffffff [0067.715] SetLastError (dwErrCode=0x3) [0067.715] FlushFileBuffers (hFile=0x158) returned 1 [0067.718] GetCurrentThreadId () returned 0x970 [0067.718] GetCurrentThreadId () returned 0x970 [0067.718] GetCurrentThreadId () returned 0x970 [0067.718] GetCurrentThreadId () returned 0x970 [0067.718] GetCurrentThreadId () returned 0x970 [0067.718] GetCurrentThreadId () returned 0x970 [0067.718] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xd86 [0067.718] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xd86 [0067.718] SetFilePointer (in: hFile=0x158, lDistanceToMove=3462, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xd86 [0067.718] CloseHandle (hObject=0x158) returned 1 [0067.718] GetCurrentThreadId () returned 0x970 [0067.718] GetCurrentThreadId () returned 0x970 [0067.718] GetCurrentThreadId () returned 0x970 [0067.718] GetCurrentThreadId () returned 0x970 [0067.718] GetCurrentThreadId () returned 0x970 [0067.718] GetCurrentThreadId () returned 0x970 [0067.718] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\Файл зашифрован [NavigationUp_SelectionSubpicture.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\Файл зашифрован [navigationup_selectionsubpicture.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0067.718] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd86 [0067.718] SetFilePointer (in: hFile=0x158, lDistanceToMove=3334, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd06 [0067.719] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0067.719] GetFileType (hFile=0x158) returned 0x1 [0067.719] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xe, wMilliseconds=0x3e5)) [0067.719] GetCurrentThreadId () returned 0x970 [0067.719] GetCurrentThreadId () returned 0x970 [0067.719] GetCurrentThreadId () returned 0x970 [0067.719] GetCurrentThreadId () returned 0x970 [0067.719] GetCurrentThreadId () returned 0x970 [0067.719] GetCurrentThreadId () returned 0x970 [0067.719] GetCurrentThreadId () returned 0x970 [0067.719] GetCurrentThreadId () returned 0x970 [0067.719] GetCurrentThreadId () returned 0x970 [0067.719] GetCurrentThreadId () returned 0x970 [0067.719] GetCurrentThreadId () returned 0x970 [0067.719] GetCurrentThreadId () returned 0x970 [0067.719] GetCurrentThreadId () returned 0x970 [0067.719] GetCurrentThreadId () returned 0x970 [0067.719] GetCurrentThreadId () returned 0x970 [0067.719] GetCurrentThreadId () returned 0x970 [0067.719] GetCurrentThreadId () returned 0x970 [0067.719] GetCurrentThreadId () returned 0x970 [0067.719] GetCurrentThreadId () returned 0x970 [0067.719] GetCurrentThreadId () returned 0x970 [0067.719] GetCurrentThreadId () returned 0x970 [0067.719] GetCurrentThreadId () returned 0x970 [0067.719] GetCurrentThreadId () returned 0x970 [0067.719] GetCurrentThreadId () returned 0x970 [0067.719] GetCurrentThreadId () returned 0x970 [0067.719] GetCurrentThreadId () returned 0x970 [0067.719] GetCurrentThreadId () returned 0x970 [0067.719] GetCurrentThreadId () returned 0x970 [0067.719] GetCurrentThreadId () returned 0x970 [0067.719] GetCurrentThreadId () returned 0x970 [0067.719] GetCurrentThreadId () returned 0x970 [0067.719] GetCurrentThreadId () returned 0x970 [0067.719] GetCurrentThreadId () returned 0x970 [0067.719] GetCurrentThreadId () returned 0x970 [0067.719] GetCurrentThreadId () returned 0x970 [0067.719] GetCurrentThreadId () returned 0x970 [0067.719] GetCurrentThreadId () returned 0x970 [0067.719] GetCurrentThreadId () returned 0x970 [0067.719] GetCurrentThreadId () returned 0x970 [0067.720] GetCurrentThreadId () returned 0x970 [0067.720] GetCurrentThreadId () returned 0x970 [0067.720] GetCurrentThreadId () returned 0x970 [0067.720] GetCurrentThreadId () returned 0x970 [0067.720] GetCurrentThreadId () returned 0x970 [0067.720] GetCurrentThreadId () returned 0x970 [0067.720] GetCurrentThreadId () returned 0x970 [0067.720] GetCurrentThreadId () returned 0x970 [0067.720] GetCurrentThreadId () returned 0x970 [0067.720] GetCurrentThreadId () returned 0x970 [0067.720] GetCurrentThreadId () returned 0x970 [0067.720] GetCurrentThreadId () returned 0x970 [0067.720] GetCurrentThreadId () returned 0x970 [0067.720] GetCurrentThreadId () returned 0x970 [0067.720] GetCurrentThreadId () returned 0x970 [0067.720] GetCurrentThreadId () returned 0x970 [0067.720] GetCurrentThreadId () returned 0x970 [0067.720] GetCurrentThreadId () returned 0x970 [0067.720] GetCurrentThreadId () returned 0x970 [0067.720] GetCurrentThreadId () returned 0x970 [0067.720] GetCurrentThreadId () returned 0x970 [0067.720] GetCurrentThreadId () returned 0x970 [0067.720] GetCurrentThreadId () returned 0x970 [0067.720] GetCurrentThreadId () returned 0x970 [0067.720] GetCurrentThreadId () returned 0x970 [0067.720] GetCurrentThreadId () returned 0x970 [0067.720] GetCurrentThreadId () returned 0x970 [0067.720] GetCurrentThreadId () returned 0x970 [0067.720] GetCurrentThreadId () returned 0x970 [0067.720] GetCurrentThreadId () returned 0x970 [0067.720] GetCurrentThreadId () returned 0x970 [0067.720] GetCurrentThreadId () returned 0x970 [0067.720] GetCurrentThreadId () returned 0x970 [0067.720] GetCurrentThreadId () returned 0x970 [0067.720] GetCurrentThreadId () returned 0x970 [0067.720] GetCurrentThreadId () returned 0x970 [0067.720] GetCurrentThreadId () returned 0x970 [0067.720] GetCurrentThreadId () returned 0x970 [0067.720] GetCurrentThreadId () returned 0x970 [0067.720] GetCurrentThreadId () returned 0x970 [0067.720] GetCurrentThreadId () returned 0x970 [0067.720] GetCurrentThreadId () returned 0x970 [0067.720] GetCurrentThreadId () returned 0x970 [0067.720] GetCurrentThreadId () returned 0x970 [0067.720] GetCurrentThreadId () returned 0x970 [0067.720] GetCurrentThreadId () returned 0x970 [0067.721] GetCurrentThreadId () returned 0x970 [0067.721] GetCurrentThreadId () returned 0x970 [0067.721] GetCurrentThreadId () returned 0x970 [0067.721] GetCurrentThreadId () returned 0x970 [0067.721] GetCurrentThreadId () returned 0x970 [0067.721] GetCurrentThreadId () returned 0x970 [0067.721] GetCurrentThreadId () returned 0x970 [0067.721] GetCurrentThreadId () returned 0x970 [0067.721] GetCurrentThreadId () returned 0x970 [0067.721] GetCurrentThreadId () returned 0x970 [0067.721] GetCurrentThreadId () returned 0x970 [0067.721] GetCurrentThreadId () returned 0x970 [0067.721] GetCurrentThreadId () returned 0x970 [0067.721] GetCurrentThreadId () returned 0x970 [0067.721] GetCurrentThreadId () returned 0x970 [0067.721] GetCurrentThreadId () returned 0x970 [0067.721] GetCurrentThreadId () returned 0x970 [0067.721] GetCurrentThreadId () returned 0x970 [0067.721] GetCurrentThreadId () returned 0x970 [0067.721] GetCurrentThreadId () returned 0x970 [0067.721] GetCurrentThreadId () returned 0x970 [0067.721] GetCurrentThreadId () returned 0x970 [0067.721] GetCurrentThreadId () returned 0x970 [0067.721] GetCurrentThreadId () returned 0x970 [0067.721] GetCurrentThreadId () returned 0x970 [0067.721] GetCurrentThreadId () returned 0x970 [0067.721] GetCurrentThreadId () returned 0x970 [0067.721] GetCurrentThreadId () returned 0x970 [0067.721] GetCurrentThreadId () returned 0x970 [0067.721] GetCurrentThreadId () returned 0x970 [0067.721] GetCurrentThreadId () returned 0x970 [0067.721] GetCurrentThreadId () returned 0x970 [0067.721] GetCurrentThreadId () returned 0x970 [0067.721] GetCurrentThreadId () returned 0x970 [0067.721] GetCurrentThreadId () returned 0x970 [0067.721] GetCurrentThreadId () returned 0x970 [0067.721] GetCurrentThreadId () returned 0x970 [0067.721] GetCurrentThreadId () returned 0x970 [0067.721] GetCurrentThreadId () returned 0x970 [0067.721] GetCurrentThreadId () returned 0x970 [0067.721] GetCurrentThreadId () returned 0x970 [0067.721] GetCurrentThreadId () returned 0x970 [0067.721] GetCurrentThreadId () returned 0x970 [0067.722] GetCurrentThreadId () returned 0x970 [0067.722] GetCurrentThreadId () returned 0x970 [0067.722] GetCurrentThreadId () returned 0x970 [0067.722] GetCurrentThreadId () returned 0x970 [0067.722] GetCurrentThreadId () returned 0x970 [0067.722] GetCurrentThreadId () returned 0x970 [0067.722] GetCurrentThreadId () returned 0x970 [0067.722] GetCurrentThreadId () returned 0x970 [0067.722] GetCurrentThreadId () returned 0x970 [0067.722] GetCurrentThreadId () returned 0x970 [0067.722] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.722] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.722] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379cc78, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0067.722] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.722] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.722] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379cc78, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0067.722] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.722] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.722] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0067.722] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.722] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.722] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0067.722] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.722] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.722] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379ccd8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0067.722] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.722] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.722] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379ccd8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0067.722] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.722] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.722] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379ccd8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0067.722] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xe, wMilliseconds=0x3e5)) [0067.722] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="#@sH#!kElAIUk=.LU&$19R&%$o\"w0\\D4", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0067.722] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="#@sH#!kElAIUk=.LU&$19R&%$o\"w0\\D4", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0067.722] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="#@sH#!kElAIUk=.LU&$19R&%$o\"w0\\D4", cchWideChar=32, lpMultiByteStr=0x2004468, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="#@sH#!kElAIUk=.LU&$19R&%$o\"w0\\D4", lpUsedDefaultChar=0x0) returned 32 [0067.723] GetCurrentThreadId () returned 0x970 [0067.723] GetCurrentThreadId () returned 0x970 [0067.723] GetCurrentThreadId () returned 0x970 [0067.723] GetCurrentThreadId () returned 0x970 [0067.723] GetCurrentThreadId () returned 0x970 [0067.723] GetCurrentThreadId () returned 0x970 [0067.730] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0067.730] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0067.730] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x37b0c78, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0067.730] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ebd48, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0067.730] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ebd48, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAD7Fl8bTNCJww/MpA/sinM399WVdiz1kVAlDKwBMfkSBNFz2XleUd0yaIWC70ZdteIqbMwQhf/xDzDyogud+sQi0AwaM+ezx96bcYpNG/TpyVt69uZC1zl2q54MaGovDxH6mi3+niffrPM7ylcIGlcKSSzWn6z2eHySC++K44EJeGJtii2a7/nrCBXnlAX8DOAw4pT4i42v7ce/ODAr/QGax7iZpY6c2Lw==") returned 232 [0067.730] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xe, wMilliseconds=0x3e5)) [0067.730] GetCurrentThreadId () returned 0x970 [0067.730] GetCurrentThreadId () returned 0x970 [0067.730] GetCurrentThreadId () returned 0x970 [0067.730] GetCurrentThreadId () returned 0x970 [0067.731] GetCurrentThreadId () returned 0x970 [0067.731] GetCurrentThreadId () returned 0x970 [0067.731] GetCurrentThreadId () returned 0x970 [0067.731] GetCurrentThreadId () returned 0x970 [0067.731] GetCurrentThreadId () returned 0x970 [0067.731] GetCurrentThreadId () returned 0x970 [0067.731] GetCurrentThreadId () returned 0x970 [0067.731] GetCurrentThreadId () returned 0x970 [0067.731] GetCurrentThreadId () returned 0x970 [0067.731] GetCurrentThreadId () returned 0x970 [0067.731] GetCurrentThreadId () returned 0x970 [0067.731] GetCurrentThreadId () returned 0x970 [0067.731] GetCurrentThreadId () returned 0x970 [0067.731] GetCurrentThreadId () returned 0x970 [0067.731] GetCurrentThreadId () returned 0x970 [0067.731] GetCurrentThreadId () returned 0x970 [0067.731] GetCurrentThreadId () returned 0x970 [0067.731] GetCurrentThreadId () returned 0x970 [0067.731] GetCurrentThreadId () returned 0x970 [0067.731] GetCurrentThreadId () returned 0x970 [0067.731] GetCurrentThreadId () returned 0x970 [0067.731] GetCurrentThreadId () returned 0x970 [0067.731] GetCurrentThreadId () returned 0x970 [0067.731] GetCurrentThreadId () returned 0x970 [0067.731] GetCurrentThreadId () returned 0x970 [0067.731] GetCurrentThreadId () returned 0x970 [0067.731] GetCurrentThreadId () returned 0x970 [0067.731] GetCurrentThreadId () returned 0x970 [0067.731] GetCurrentThreadId () returned 0x970 [0067.731] GetCurrentThreadId () returned 0x970 [0067.731] GetCurrentThreadId () returned 0x970 [0067.731] GetCurrentThreadId () returned 0x970 [0067.731] GetCurrentThreadId () returned 0x970 [0067.731] GetCurrentThreadId () returned 0x970 [0067.731] GetCurrentThreadId () returned 0x970 [0067.731] GetCurrentThreadId () returned 0x970 [0067.731] GetCurrentThreadId () returned 0x970 [0067.731] GetCurrentThreadId () returned 0x970 [0067.731] GetCurrentThreadId () returned 0x970 [0067.731] GetCurrentThreadId () returned 0x970 [0067.731] GetCurrentThreadId () returned 0x970 [0067.731] GetCurrentThreadId () returned 0x970 [0067.731] GetCurrentThreadId () returned 0x970 [0067.731] GetCurrentThreadId () returned 0x970 [0067.731] GetCurrentThreadId () returned 0x970 [0067.731] GetCurrentThreadId () returned 0x970 [0067.732] GetCurrentThreadId () returned 0x970 [0067.732] GetCurrentThreadId () returned 0x970 [0067.732] GetCurrentThreadId () returned 0x970 [0067.732] GetCurrentThreadId () returned 0x970 [0067.732] GetCurrentThreadId () returned 0x970 [0067.732] GetCurrentThreadId () returned 0x970 [0067.732] GetCurrentThreadId () returned 0x970 [0067.732] GetCurrentThreadId () returned 0x970 [0067.732] GetCurrentThreadId () returned 0x970 [0067.732] GetCurrentThreadId () returned 0x970 [0067.732] GetCurrentThreadId () returned 0x970 [0067.732] GetCurrentThreadId () returned 0x970 [0067.732] GetCurrentThreadId () returned 0x970 [0067.732] GetCurrentThreadId () returned 0x970 [0067.732] GetCurrentThreadId () returned 0x970 [0067.732] GetCurrentThreadId () returned 0x970 [0067.732] GetCurrentThreadId () returned 0x970 [0067.732] GetCurrentThreadId () returned 0x970 [0067.732] GetCurrentThreadId () returned 0x970 [0067.732] GetCurrentThreadId () returned 0x970 [0067.732] GetCurrentThreadId () returned 0x970 [0067.732] GetCurrentThreadId () returned 0x970 [0067.732] GetCurrentThreadId () returned 0x970 [0067.732] GetCurrentThreadId () returned 0x970 [0067.732] GetCurrentThreadId () returned 0x970 [0067.732] GetCurrentThreadId () returned 0x970 [0067.732] GetCurrentThreadId () returned 0x970 [0067.732] GetCurrentThreadId () returned 0x970 [0067.732] GetCurrentThreadId () returned 0x970 [0067.732] GetCurrentThreadId () returned 0x970 [0067.732] GetCurrentThreadId () returned 0x970 [0067.732] GetCurrentThreadId () returned 0x970 [0067.732] GetCurrentThreadId () returned 0x970 [0067.732] GetCurrentThreadId () returned 0x970 [0067.732] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAD7Fl8bTNCJww/MpA/sinM399WVdiz1kVAlDKwBMfkSBNFz2XleUd0yaIWC70ZdteIqbMwQhf/xDzDyogud+sQi0AwaM+ezx96bcYpNG/TpyVt69uZC1zl2q54MaGovDxH6mi3+niffrPM7ylcIGlcKSSzWn6z2eHySC++K44EJeGJtii2a7/nrCBXnlAX8DOAw4pT4i42v7ce/ODAr/QGax7iZpY6c2Lw==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0067.732] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAD7Fl8bTNCJww/MpA/sinM399WVdiz1kVAlDKwBMfkSBNFz2XleUd0yaIWC70ZdteIqbMwQhf/xDzDyogud+sQi0AwaM+ezx96bcYpNG/TpyVt69uZC1zl2q54MaGovDxH6mi3+niffrPM7ylcIGlcKSSzWn6z2eHySC++K44EJeGJtii2a7/nrCBXnlAX8DOAw4pT4i42v7ce/ODAr/QGax7iZpY6c2Lw==", cchWideChar=245, lpMultiByteStr=0x3539ccc, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAD7Fl8bTNCJww/MpA/sinM399WVdiz1kVAlDKwBMfkSBNFz2XleUd0yaIWC70ZdteIqbMwQhf/xDzDyogud+sQi0AwaM+ezx96bcYpNG/TpyVt69uZC1zl2q54MaGovDxH6mi3+niffrPM7ylcIGlcKSSzWn6z2eHySC++K44EJeGJtii2a7/nrCBXnlAX8DOAw4pT4i42v7ce/ODAr/QGax7iZpY6c2Lw==", lpUsedDefaultChar=0x0) returned 245 [0067.732] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0067.733] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0067.733] CloseHandle (hObject=0x158) returned 1 [0067.733] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_selectionsubpicture.png")) returned 0 [0067.733] GetLastError () returned 0x5 [0067.733] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_selectionsubpicture.png")) returned 0x20 [0067.733] SetLastError (dwErrCode=0x5) [0067.733] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=18799645086) returned 1 [0067.733] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\Файл зашифрован [title_stripe.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\Файл зашифрован [title_stripe.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0067.734] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0067.734] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0067.734] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0067.734] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0067.734] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0067.734] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0067.734] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0067.734] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0067.734] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0067.734] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0067.734] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0067.734] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0067.734] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0067.734] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0067.734] SetEndOfFile (hFile=0x158) returned 1 [0067.735] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0067.735] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0067.735] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0067.735] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0067.735] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0067.736] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0067.736] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h,Slc{D=A}Nfjfz8^~v.@iC4$vh.b4$?", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0067.736] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h,Slc{D=A}Nfjfz8^~v.@iC4$vh.b4$?", cchWideChar=32, lpMultiByteStr=0x20370cc, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="h,Slc{D=A}Nfjfz8^~v.@iC4$vh.b4$?", lpUsedDefaultChar=0x0) returned 32 [0067.736] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0067.736] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0067.736] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\title_stripe.png", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb6b05f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb6b05f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="title_stripe.png", cAlternateFileName="")) returned 0x295098 [0067.736] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0067.736] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0067.736] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\title_stripe.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\title_stripe.png")) returned 0x20 [0067.736] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\title_stripe.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\title_stripe.png")) returned 0x20 [0067.736] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\title_stripe.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\title_stripe.png")) returned 0x20 [0067.737] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\title_stripe.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\title_stripe.png")) returned 0x20 [0067.737] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\title_stripe.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\title_stripe.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb6b05f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb6b05f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf2f)) returned 1 [0067.737] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0067.737] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0067.737] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\title_stripe.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\title_stripe.png")) returned 0x20 [0067.737] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\title_stripe.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\title_stripe.png")) returned 0x20 [0067.737] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0067.737] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0067.737] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0067.737] SetEndOfFile (hFile=0x158) returned 1 [0067.738] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="title_stripe.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0067.738] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="title_stripe.png", cchWideChar=16, lpMultiByteStr=0x1ff885c, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="title_stripe.png", lpUsedDefaultChar=0x0) returned 16 [0067.738] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="title_stripe.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0067.738] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="title_stripe.png", cchWideChar=16, lpMultiByteStr=0x1ff8a14, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="title_stripe.png", lpUsedDefaultChar=0x0) returned 16 [0067.738] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff8a14, cbMultiByte=16, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="title_stripe.pngSubpicture.pngre.pngpngg") returned 16 [0067.738] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="title_stripe.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0067.738] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="title_stripe.png", cchWideChar=16, lpMultiByteStr=0x1ff885c, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="title_stripe.png", lpUsedDefaultChar=0x0) returned 16 [0067.738] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\title_stripe.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\title_stripe.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0067.738] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0067.738] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0xf2f [0067.739] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0067.739] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0067.739] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0067.739] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="title_stripe.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0067.739] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="title_stripe.png", cchWideChar=16, lpMultiByteStr=0x1ff885c, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="title_stripe.png", lpUsedDefaultChar=0x0) returned 16 [0067.739] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="title_stripe.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0067.739] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="title_stripe.png", cchWideChar=16, lpMultiByteStr=0x1ff8a14, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="title_stripe.png", lpUsedDefaultChar=0x0) returned 16 [0067.739] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff8a14, cbMultiByte=16, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="title_stripe.pngpe.pngSubpicture.pngre.pngpngg") returned 16 [0067.739] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="title_stripe.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0067.739] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="title_stripe.png", cchWideChar=16, lpMultiByteStr=0x1ff885c, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="title_stripe.png", lpUsedDefaultChar=0x0) returned 16 [0067.739] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0067.740] CharToOemA (in: pSrc="title_stripe.png", pDst=0x1ff8a14 | out: pDst="title_stripe.png") returned 1 [0067.740] WriteFile (in: hFile=0x158, lpBuffer=0x1ff8a14*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1ff8a14*, lpNumberOfBytesWritten=0x18e048*=0x10, lpOverlapped=0x0) returned 1 [0067.740] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0067.740] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0067.740] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0067.740] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=18800372616) returned 1 [0067.740] ReadFile (in: hFile=0x11c, lpBuffer=0x37d4d60, nNumberOfBytesToRead=0xf2f, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37d4d60*, lpNumberOfBytesRead=0x18dd7c*=0xf2f, lpOverlapped=0x0) returned 1 [0067.742] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0067.742] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=18800522916) returned 1 [0067.751] WriteFile (in: hFile=0x158, lpBuffer=0x379ad20*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379ad20*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0067.751] ReadFile (in: hFile=0x11c, lpBuffer=0x37d4d60, nNumberOfBytesToRead=0xf2f, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x37d4d60*, lpNumberOfBytesRead=0x18de38*=0xf2f, lpOverlapped=0x0) returned 1 [0067.751] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x4b [0067.751] WriteFile (in: hFile=0x158, lpBuffer=0x3817580*, nNumberOfBytesToWrite=0xf2f, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3817580*, lpNumberOfBytesWritten=0x18de10*=0xf2f, lpOverlapped=0x0) returned 1 [0067.751] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0xf7a [0067.751] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0067.751] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0067.751] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0067.751] SetFilePointer (in: hFile=0x158, lDistanceToMove=16, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2e [0067.751] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0xf84 [0067.752] CloseHandle (hObject=0x11c) returned 1 [0067.752] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xf84 [0067.752] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xf84 [0067.752] SetFilePointer (in: hFile=0x158, lDistanceToMove=3972, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xf84 [0067.752] SetFilePointer (in: hFile=0x158, lDistanceToMove=3972, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0xf84 [0067.752] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xf84 [0067.752] SetFilePointer (in: hFile=0x158, lDistanceToMove=3972, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0xf84 [0067.752] SetEndOfFile (hFile=0x158) returned 1 [0067.752] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xf84 [0067.752] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xf84 [0067.752] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="title_stripe.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0067.752] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="title_stripe.png", cchWideChar=16, lpMultiByteStr=0x1ff8a14, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="title_stripe.png", lpUsedDefaultChar=0x0) returned 16 [0067.752] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="title_stripe.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0067.752] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="title_stripe.png", cchWideChar=16, lpMultiByteStr=0x1ff885c, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="title_stripe.png", lpUsedDefaultChar=0x0) returned 16 [0067.752] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff885c, cbMultiByte=16, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="title_stripe.png\x18믉`믑`") returned 16 [0067.752] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="title_stripe.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0067.753] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="title_stripe.png", cchWideChar=16, lpMultiByteStr=0x1ff8a14, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="title_stripe.png", lpUsedDefaultChar=0x0) returned 16 [0067.753] WriteFile (in: hFile=0x158, lpBuffer=0x37b8838*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x37b8838*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0067.753] CharToOemA (in: pSrc="title_stripe.png", pDst=0x1ff885c | out: pDst="title_stripe.png") returned 1 [0067.753] WriteFile (in: hFile=0x158, lpBuffer=0x1ff885c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1ff885c*, lpNumberOfBytesWritten=0x18efcc*=0x10, lpOverlapped=0x0) returned 1 [0067.753] WriteFile (in: hFile=0x158, lpBuffer=0x379ad88*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379ad88*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0067.753] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0067.753] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0067.753] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xfcd [0067.753] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xfcd [0067.753] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0067.753] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0067.754] DeleteFileW (lpFileName="") returned 0 [0067.754] GetLastError () returned 0x3 [0067.754] GetFileAttributesW (lpFileName="") returned 0xffffffff [0067.754] SetLastError (dwErrCode=0x3) [0067.754] FlushFileBuffers (hFile=0x158) returned 1 [0067.756] GetCurrentThreadId () returned 0x970 [0067.756] GetCurrentThreadId () returned 0x970 [0067.756] GetCurrentThreadId () returned 0x970 [0067.756] GetCurrentThreadId () returned 0x970 [0067.756] GetCurrentThreadId () returned 0x970 [0067.756] GetCurrentThreadId () returned 0x970 [0067.756] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x1084 [0067.756] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x1084 [0067.756] SetFilePointer (in: hFile=0x158, lDistanceToMove=4228, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x1084 [0067.757] CloseHandle (hObject=0x158) returned 1 [0067.757] GetCurrentThreadId () returned 0x970 [0067.757] GetCurrentThreadId () returned 0x970 [0067.757] GetCurrentThreadId () returned 0x970 [0067.757] GetCurrentThreadId () returned 0x970 [0067.757] GetCurrentThreadId () returned 0x970 [0067.757] GetCurrentThreadId () returned 0x970 [0067.757] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\Файл зашифрован [title_stripe.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\Файл зашифрован [title_stripe.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0067.757] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1084 [0067.757] SetFilePointer (in: hFile=0x158, lDistanceToMove=4100, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1004 [0067.757] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0067.757] GetFileType (hFile=0x158) returned 0x1 [0067.757] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xf, wMilliseconds=0x1c)) [0067.757] GetCurrentThreadId () returned 0x970 [0067.757] GetCurrentThreadId () returned 0x970 [0067.757] GetCurrentThreadId () returned 0x970 [0067.757] GetCurrentThreadId () returned 0x970 [0067.757] GetCurrentThreadId () returned 0x970 [0067.757] GetCurrentThreadId () returned 0x970 [0067.757] GetCurrentThreadId () returned 0x970 [0067.757] GetCurrentThreadId () returned 0x970 [0067.757] GetCurrentThreadId () returned 0x970 [0067.757] GetCurrentThreadId () returned 0x970 [0067.757] GetCurrentThreadId () returned 0x970 [0067.758] GetCurrentThreadId () returned 0x970 [0067.758] GetCurrentThreadId () returned 0x970 [0067.758] GetCurrentThreadId () returned 0x970 [0067.758] GetCurrentThreadId () returned 0x970 [0067.758] GetCurrentThreadId () returned 0x970 [0067.758] GetCurrentThreadId () returned 0x970 [0067.758] GetCurrentThreadId () returned 0x970 [0067.758] GetCurrentThreadId () returned 0x970 [0067.758] GetCurrentThreadId () returned 0x970 [0067.758] GetCurrentThreadId () returned 0x970 [0067.758] GetCurrentThreadId () returned 0x970 [0067.758] GetCurrentThreadId () returned 0x970 [0067.758] GetCurrentThreadId () returned 0x970 [0067.758] GetCurrentThreadId () returned 0x970 [0067.758] GetCurrentThreadId () returned 0x970 [0067.758] GetCurrentThreadId () returned 0x970 [0067.758] GetCurrentThreadId () returned 0x970 [0067.758] GetCurrentThreadId () returned 0x970 [0067.758] GetCurrentThreadId () returned 0x970 [0067.758] GetCurrentThreadId () returned 0x970 [0067.758] GetCurrentThreadId () returned 0x970 [0067.758] GetCurrentThreadId () returned 0x970 [0067.758] GetCurrentThreadId () returned 0x970 [0067.758] GetCurrentThreadId () returned 0x970 [0067.758] GetCurrentThreadId () returned 0x970 [0067.758] GetCurrentThreadId () returned 0x970 [0067.758] GetCurrentThreadId () returned 0x970 [0067.758] GetCurrentThreadId () returned 0x970 [0067.758] GetCurrentThreadId () returned 0x970 [0067.758] GetCurrentThreadId () returned 0x970 [0067.758] GetCurrentThreadId () returned 0x970 [0067.758] GetCurrentThreadId () returned 0x970 [0067.758] GetCurrentThreadId () returned 0x970 [0067.758] GetCurrentThreadId () returned 0x970 [0067.758] GetCurrentThreadId () returned 0x970 [0067.758] GetCurrentThreadId () returned 0x970 [0067.758] GetCurrentThreadId () returned 0x970 [0067.758] GetCurrentThreadId () returned 0x970 [0067.758] GetCurrentThreadId () returned 0x970 [0067.758] GetCurrentThreadId () returned 0x970 [0067.758] GetCurrentThreadId () returned 0x970 [0067.758] GetCurrentThreadId () returned 0x970 [0067.758] GetCurrentThreadId () returned 0x970 [0067.758] GetCurrentThreadId () returned 0x970 [0067.758] GetCurrentThreadId () returned 0x970 [0067.759] GetCurrentThreadId () returned 0x970 [0067.759] GetCurrentThreadId () returned 0x970 [0067.759] GetCurrentThreadId () returned 0x970 [0067.759] GetCurrentThreadId () returned 0x970 [0067.759] GetCurrentThreadId () returned 0x970 [0067.759] GetCurrentThreadId () returned 0x970 [0067.759] GetCurrentThreadId () returned 0x970 [0067.759] GetCurrentThreadId () returned 0x970 [0067.759] GetCurrentThreadId () returned 0x970 [0067.759] GetCurrentThreadId () returned 0x970 [0067.759] GetCurrentThreadId () returned 0x970 [0067.759] GetCurrentThreadId () returned 0x970 [0067.759] GetCurrentThreadId () returned 0x970 [0067.759] GetCurrentThreadId () returned 0x970 [0067.759] GetCurrentThreadId () returned 0x970 [0067.759] GetCurrentThreadId () returned 0x970 [0067.759] GetCurrentThreadId () returned 0x970 [0067.759] GetCurrentThreadId () returned 0x970 [0067.759] GetCurrentThreadId () returned 0x970 [0067.759] GetCurrentThreadId () returned 0x970 [0067.759] GetCurrentThreadId () returned 0x970 [0067.759] GetCurrentThreadId () returned 0x970 [0067.759] GetCurrentThreadId () returned 0x970 [0067.759] GetCurrentThreadId () returned 0x970 [0067.759] GetCurrentThreadId () returned 0x970 [0067.759] GetCurrentThreadId () returned 0x970 [0067.759] GetCurrentThreadId () returned 0x970 [0067.759] GetCurrentThreadId () returned 0x970 [0067.759] GetCurrentThreadId () returned 0x970 [0067.759] GetCurrentThreadId () returned 0x970 [0067.759] GetCurrentThreadId () returned 0x970 [0067.759] GetCurrentThreadId () returned 0x970 [0067.759] GetCurrentThreadId () returned 0x970 [0067.759] GetCurrentThreadId () returned 0x970 [0067.759] GetCurrentThreadId () returned 0x970 [0067.759] GetCurrentThreadId () returned 0x970 [0067.759] GetCurrentThreadId () returned 0x970 [0067.759] GetCurrentThreadId () returned 0x970 [0067.759] GetCurrentThreadId () returned 0x970 [0067.759] GetCurrentThreadId () returned 0x970 [0067.759] GetCurrentThreadId () returned 0x970 [0067.759] GetCurrentThreadId () returned 0x970 [0067.759] GetCurrentThreadId () returned 0x970 [0067.759] GetCurrentThreadId () returned 0x970 [0067.759] GetCurrentThreadId () returned 0x970 [0067.759] GetCurrentThreadId () returned 0x970 [0067.760] GetCurrentThreadId () returned 0x970 [0067.760] GetCurrentThreadId () returned 0x970 [0067.760] GetCurrentThreadId () returned 0x970 [0067.760] GetCurrentThreadId () returned 0x970 [0067.760] GetCurrentThreadId () returned 0x970 [0067.760] GetCurrentThreadId () returned 0x970 [0067.760] GetCurrentThreadId () returned 0x970 [0067.760] GetCurrentThreadId () returned 0x970 [0067.760] GetCurrentThreadId () returned 0x970 [0067.760] GetCurrentThreadId () returned 0x970 [0067.760] GetCurrentThreadId () returned 0x970 [0067.760] GetCurrentThreadId () returned 0x970 [0067.760] GetCurrentThreadId () returned 0x970 [0067.760] GetCurrentThreadId () returned 0x970 [0067.760] GetCurrentThreadId () returned 0x970 [0067.760] GetCurrentThreadId () returned 0x970 [0067.760] GetCurrentThreadId () returned 0x970 [0067.760] GetCurrentThreadId () returned 0x970 [0067.760] GetCurrentThreadId () returned 0x970 [0067.760] GetCurrentThreadId () returned 0x970 [0067.760] GetCurrentThreadId () returned 0x970 [0067.760] GetCurrentThreadId () returned 0x970 [0067.760] GetCurrentThreadId () returned 0x970 [0067.760] GetCurrentThreadId () returned 0x970 [0067.760] GetCurrentThreadId () returned 0x970 [0067.760] GetCurrentThreadId () returned 0x970 [0067.760] GetCurrentThreadId () returned 0x970 [0067.760] GetCurrentThreadId () returned 0x970 [0067.760] GetCurrentThreadId () returned 0x970 [0067.760] GetCurrentThreadId () returned 0x970 [0067.760] GetCurrentThreadId () returned 0x970 [0067.760] GetCurrentThreadId () returned 0x970 [0067.760] GetCurrentThreadId () returned 0x970 [0067.760] GetCurrentThreadId () returned 0x970 [0067.760] GetCurrentThreadId () returned 0x970 [0067.760] GetCurrentThreadId () returned 0x970 [0067.760] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.760] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.760] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379ccd8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0067.760] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.760] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.760] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379ccd8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0067.761] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.761] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.761] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0067.761] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.761] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.761] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0067.761] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.761] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.761] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379cd38, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0067.761] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.761] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.761] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379cd38, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0067.761] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.761] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.761] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379cd38, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0067.761] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xf, wMilliseconds=0x1c)) [0067.761] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="h,Slc{D=A}Nfjfz8^~v.@iC4$vh.b4$?", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0067.761] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="h,Slc{D=A}Nfjfz8^~v.@iC4$vh.b4$?", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0067.761] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="h,Slc{D=A}Nfjfz8^~v.@iC4$vh.b4$?", cchWideChar=32, lpMultiByteStr=0x2004498, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="h,Slc{D=A}Nfjfz8^~v.@iC4$vh.b4$?", lpUsedDefaultChar=0x0) returned 32 [0067.761] GetCurrentThreadId () returned 0x970 [0067.761] GetCurrentThreadId () returned 0x970 [0067.761] GetCurrentThreadId () returned 0x970 [0067.761] GetCurrentThreadId () returned 0x970 [0067.761] GetCurrentThreadId () returned 0x970 [0067.761] GetCurrentThreadId () returned 0x970 [0067.769] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0067.769] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0067.769] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x37b0cc8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0067.769] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ebd48, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0067.769] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ebd48, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAHQajaFQfvDp2bIBw+AlcXw5DBFbLjSFnvtPcSSvh2DHTq14027OLeaAvtHdfBJVDJWOgxbBfCc/sg1NSBWcHicMZrxkiNqec0baBwbqNqYo0kJBcq9eVUYns5I2imZiSg3n+EGQZ2p5f9+VC92CTNVmWRJCSvIawsrqx4Gwy/zugFLo4PCqMfKYqLUhrFigHocB5X0xrY1JLA9b+JPuTu5S3N9GWGCgKw==") returned 232 [0067.769] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xf, wMilliseconds=0x2c)) [0067.769] GetCurrentThreadId () returned 0x970 [0067.769] GetCurrentThreadId () returned 0x970 [0067.769] GetCurrentThreadId () returned 0x970 [0067.769] GetCurrentThreadId () returned 0x970 [0067.769] GetCurrentThreadId () returned 0x970 [0067.769] GetCurrentThreadId () returned 0x970 [0067.769] GetCurrentThreadId () returned 0x970 [0067.769] GetCurrentThreadId () returned 0x970 [0067.769] GetCurrentThreadId () returned 0x970 [0067.769] GetCurrentThreadId () returned 0x970 [0067.769] GetCurrentThreadId () returned 0x970 [0067.769] GetCurrentThreadId () returned 0x970 [0067.770] GetCurrentThreadId () returned 0x970 [0067.770] GetCurrentThreadId () returned 0x970 [0067.770] GetCurrentThreadId () returned 0x970 [0067.770] GetCurrentThreadId () returned 0x970 [0067.770] GetCurrentThreadId () returned 0x970 [0067.770] GetCurrentThreadId () returned 0x970 [0067.770] GetCurrentThreadId () returned 0x970 [0067.770] GetCurrentThreadId () returned 0x970 [0067.770] GetCurrentThreadId () returned 0x970 [0067.770] GetCurrentThreadId () returned 0x970 [0067.770] GetCurrentThreadId () returned 0x970 [0067.770] GetCurrentThreadId () returned 0x970 [0067.770] GetCurrentThreadId () returned 0x970 [0067.770] GetCurrentThreadId () returned 0x970 [0067.770] GetCurrentThreadId () returned 0x970 [0067.770] GetCurrentThreadId () returned 0x970 [0067.770] GetCurrentThreadId () returned 0x970 [0067.770] GetCurrentThreadId () returned 0x970 [0067.770] GetCurrentThreadId () returned 0x970 [0067.770] GetCurrentThreadId () returned 0x970 [0067.770] GetCurrentThreadId () returned 0x970 [0067.770] GetCurrentThreadId () returned 0x970 [0067.770] GetCurrentThreadId () returned 0x970 [0067.770] GetCurrentThreadId () returned 0x970 [0067.770] GetCurrentThreadId () returned 0x970 [0067.770] GetCurrentThreadId () returned 0x970 [0067.770] GetCurrentThreadId () returned 0x970 [0067.770] GetCurrentThreadId () returned 0x970 [0067.770] GetCurrentThreadId () returned 0x970 [0067.770] GetCurrentThreadId () returned 0x970 [0067.770] GetCurrentThreadId () returned 0x970 [0067.770] GetCurrentThreadId () returned 0x970 [0067.770] GetCurrentThreadId () returned 0x970 [0067.770] GetCurrentThreadId () returned 0x970 [0067.770] GetCurrentThreadId () returned 0x970 [0067.770] GetCurrentThreadId () returned 0x970 [0067.770] GetCurrentThreadId () returned 0x970 [0067.770] GetCurrentThreadId () returned 0x970 [0067.770] GetCurrentThreadId () returned 0x970 [0067.770] GetCurrentThreadId () returned 0x970 [0067.770] GetCurrentThreadId () returned 0x970 [0067.770] GetCurrentThreadId () returned 0x970 [0067.770] GetCurrentThreadId () returned 0x970 [0067.770] GetCurrentThreadId () returned 0x970 [0067.770] GetCurrentThreadId () returned 0x970 [0067.771] GetCurrentThreadId () returned 0x970 [0067.771] GetCurrentThreadId () returned 0x970 [0067.771] GetCurrentThreadId () returned 0x970 [0067.771] GetCurrentThreadId () returned 0x970 [0067.771] GetCurrentThreadId () returned 0x970 [0067.771] GetCurrentThreadId () returned 0x970 [0067.771] GetCurrentThreadId () returned 0x970 [0067.771] GetCurrentThreadId () returned 0x970 [0067.771] GetCurrentThreadId () returned 0x970 [0067.771] GetCurrentThreadId () returned 0x970 [0067.771] GetCurrentThreadId () returned 0x970 [0067.771] GetCurrentThreadId () returned 0x970 [0067.771] GetCurrentThreadId () returned 0x970 [0067.771] GetCurrentThreadId () returned 0x970 [0067.771] GetCurrentThreadId () returned 0x970 [0067.771] GetCurrentThreadId () returned 0x970 [0067.771] GetCurrentThreadId () returned 0x970 [0067.771] GetCurrentThreadId () returned 0x970 [0067.771] GetCurrentThreadId () returned 0x970 [0067.771] GetCurrentThreadId () returned 0x970 [0067.771] GetCurrentThreadId () returned 0x970 [0067.771] GetCurrentThreadId () returned 0x970 [0067.771] GetCurrentThreadId () returned 0x970 [0067.771] GetCurrentThreadId () returned 0x970 [0067.771] GetCurrentThreadId () returned 0x970 [0067.771] GetCurrentThreadId () returned 0x970 [0067.771] GetCurrentThreadId () returned 0x970 [0067.771] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAHQajaFQfvDp2bIBw+AlcXw5DBFbLjSFnvtPcSSvh2DHTq14027OLeaAvtHdfBJVDJWOgxbBfCc/sg1NSBWcHicMZrxkiNqec0baBwbqNqYo0kJBcq9eVUYns5I2imZiSg3n+EGQZ2p5f9+VC92CTNVmWRJCSvIawsrqx4Gwy/zugFLo4PCqMfKYqLUhrFigHocB5X0xrY1JLA9b+JPuTu5S3N9GWGCgKw==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0067.771] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAHQajaFQfvDp2bIBw+AlcXw5DBFbLjSFnvtPcSSvh2DHTq14027OLeaAvtHdfBJVDJWOgxbBfCc/sg1NSBWcHicMZrxkiNqec0baBwbqNqYo0kJBcq9eVUYns5I2imZiSg3n+EGQZ2p5f9+VC92CTNVmWRJCSvIawsrqx4Gwy/zugFLo4PCqMfKYqLUhrFigHocB5X0xrY1JLA9b+JPuTu5S3N9GWGCgKw==", cchWideChar=245, lpMultiByteStr=0x3539bbc, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAHQajaFQfvDp2bIBw+AlcXw5DBFbLjSFnvtPcSSvh2DHTq14027OLeaAvtHdfBJVDJWOgxbBfCc/sg1NSBWcHicMZrxkiNqec0baBwbqNqYo0kJBcq9eVUYns5I2imZiSg3n+EGQZ2p5f9+VC92CTNVmWRJCSvIawsrqx4Gwy/zugFLo4PCqMfKYqLUhrFigHocB5X0xrY1JLA9b+JPuTu5S3N9GWGCgKw==", lpUsedDefaultChar=0x0) returned 245 [0067.771] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0067.771] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0067.771] CloseHandle (hObject=0x158) returned 1 [0067.772] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\title_stripe.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\title_stripe.png")) returned 0 [0067.772] GetLastError () returned 0x5 [0067.772] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\title_stripe.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\title_stripe.png")) returned 0x20 [0067.772] SetLastError (dwErrCode=0x5) [0067.772] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=18803540727) returned 1 [0067.772] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\Файл зашифрован [1047x576black.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\Файл зашифрован [1047x576black.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0067.773] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0067.773] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0067.773] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0067.773] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0067.774] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0067.774] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0067.774] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0067.774] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0067.774] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0067.774] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0067.774] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0067.774] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0067.774] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0067.774] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0067.774] SetEndOfFile (hFile=0x158) returned 1 [0067.774] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0067.774] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0067.774] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0067.774] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0067.774] WriteFile (in: hFile=0x158, lpBuffer=0x3777058*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777058*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0067.775] WriteFile (in: hFile=0x158, lpBuffer=0x35f035c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f035c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0067.775] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=">iKbz&C2=>%8/Vw#}27QmH(#HnAkn>*7", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0067.775] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=">iKbz&C2=>%8/Vw#}27QmH(#HnAkn>*7", cchWideChar=32, lpMultiByteStr=0x203705c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=">iKbz&C2=>%8/Vw#}27QmH(#HnAkn>*7", lpUsedDefaultChar=0x0) returned 32 [0067.776] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0067.776] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0067.776] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70bee7b2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70bee7b2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 0x295098 [0067.776] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0067.776] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0067.776] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\1047x576black.png")) returned 0x20 [0067.777] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\1047x576black.png")) returned 0x20 [0067.777] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\1047x576black.png")) returned 0x20 [0067.777] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\1047x576black.png")) returned 0x20 [0067.777] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\1047x576black.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70bee7b2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70bee7b2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da)) returned 1 [0067.777] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0067.777] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0067.777] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\1047x576black.png")) returned 0x20 [0067.777] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\1047x576black.png")) returned 0x20 [0067.777] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0067.777] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0067.777] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0067.777] SetEndOfFile (hFile=0x158) returned 1 [0067.778] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0067.778] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x1ff88fc, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x0) returned 17 [0067.778] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0067.778] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x1ff88ac, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x0) returned 17 [0067.778] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff88ac, cbMultiByte=17, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="1047x576black.pngubpicture.pngre.pngpngg") returned 17 [0067.779] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0067.779] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x1ff88fc, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x0) returned 17 [0067.779] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\1047x576black.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0067.779] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0067.779] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x11da [0067.779] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0067.779] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0067.779] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0067.779] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0067.779] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x1ff88fc, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x0) returned 17 [0067.779] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0067.779] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x1ff88ac, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x0) returned 17 [0067.779] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff88ac, cbMultiByte=17, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="1047x576black.pngck.pngubpicture.pngre.pngpngg") returned 17 [0067.779] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0067.779] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x1ff88fc, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x0) returned 17 [0067.780] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0067.780] CharToOemA (in: pSrc="1047x576black.png", pDst=0x1ff88ac | out: pDst="1047x576black.png") returned 1 [0067.780] WriteFile (in: hFile=0x158, lpBuffer=0x1ff88ac*, nNumberOfBytesToWrite=0x11, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1ff88ac*, lpNumberOfBytesWritten=0x18e048*=0x11, lpOverlapped=0x0) returned 1 [0067.781] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0067.781] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0067.781] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0067.781] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=18804424392) returned 1 [0067.781] ReadFile (in: hFile=0x11c, lpBuffer=0x37d4d60, nNumberOfBytesToRead=0x11da, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37d4d60*, lpNumberOfBytesRead=0x18dd7c*=0x11da, lpOverlapped=0x0) returned 1 [0067.782] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0067.782] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=18804592404) returned 1 [0067.791] WriteFile (in: hFile=0x158, lpBuffer=0x379ad98*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379ad98*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0067.791] ReadFile (in: hFile=0x11c, lpBuffer=0x37d4d60, nNumberOfBytesToRead=0x11da, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x37d4d60*, lpNumberOfBytesRead=0x18de38*=0x11da, lpOverlapped=0x0) returned 1 [0067.791] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x4c [0067.792] WriteFile (in: hFile=0x158, lpBuffer=0x3817780*, nNumberOfBytesToWrite=0x11da, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3817780*, lpNumberOfBytesWritten=0x18de10*=0x11da, lpOverlapped=0x0) returned 1 [0067.792] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x1226 [0067.792] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0067.792] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0067.792] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0067.792] SetFilePointer (in: hFile=0x158, lDistanceToMove=17, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2f [0067.792] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x1230 [0067.792] CloseHandle (hObject=0x11c) returned 1 [0067.792] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1230 [0067.792] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1230 [0067.792] SetFilePointer (in: hFile=0x158, lDistanceToMove=4656, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1230 [0067.793] SetFilePointer (in: hFile=0x158, lDistanceToMove=4656, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x1230 [0067.793] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1230 [0067.793] SetFilePointer (in: hFile=0x158, lDistanceToMove=4656, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x1230 [0067.793] SetEndOfFile (hFile=0x158) returned 1 [0067.793] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1230 [0067.793] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1230 [0067.793] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0067.793] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x1ff88ac, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x0) returned 17 [0067.793] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0067.793] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x1ff88fc, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x0) returned 17 [0067.793] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff88fc, cbMultiByte=17, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="1047x576black.png\x18믉`믑`") returned 17 [0067.793] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0067.793] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x1ff88ac, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x0) returned 17 [0067.793] WriteFile (in: hFile=0x158, lpBuffer=0x37b8838*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x37b8838*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0067.793] CharToOemA (in: pSrc="1047x576black.png", pDst=0x1ff88fc | out: pDst="1047x576black.png") returned 1 [0067.793] WriteFile (in: hFile=0x158, lpBuffer=0x1ff88fc*, nNumberOfBytesToWrite=0x11, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1ff88fc*, lpNumberOfBytesWritten=0x18efcc*=0x11, lpOverlapped=0x0) returned 1 [0067.794] WriteFile (in: hFile=0x158, lpBuffer=0x379ade8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379ade8*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0067.794] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0067.794] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0067.794] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x127a [0067.794] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x127a [0067.794] WriteFile (in: hFile=0x158, lpBuffer=0x3777058*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777058*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0067.794] WriteFile (in: hFile=0x158, lpBuffer=0x35f035c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f035c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0067.794] DeleteFileW (lpFileName="") returned 0 [0067.794] GetLastError () returned 0x3 [0067.794] GetFileAttributesW (lpFileName="") returned 0xffffffff [0067.794] SetLastError (dwErrCode=0x3) [0067.794] FlushFileBuffers (hFile=0x158) returned 1 [0067.798] GetCurrentThreadId () returned 0x970 [0067.798] GetCurrentThreadId () returned 0x970 [0067.798] GetCurrentThreadId () returned 0x970 [0067.798] GetCurrentThreadId () returned 0x970 [0067.798] GetCurrentThreadId () returned 0x970 [0067.798] GetCurrentThreadId () returned 0x970 [0067.798] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x1331 [0067.798] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x1331 [0067.798] SetFilePointer (in: hFile=0x158, lDistanceToMove=4913, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x1331 [0067.798] CloseHandle (hObject=0x158) returned 1 [0067.798] GetCurrentThreadId () returned 0x970 [0067.798] GetCurrentThreadId () returned 0x970 [0067.798] GetCurrentThreadId () returned 0x970 [0067.798] GetCurrentThreadId () returned 0x970 [0067.798] GetCurrentThreadId () returned 0x970 [0067.799] GetCurrentThreadId () returned 0x970 [0067.799] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\Файл зашифрован [1047x576black.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\Файл зашифрован [1047x576black.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0067.799] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1331 [0067.799] SetFilePointer (in: hFile=0x158, lDistanceToMove=4785, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x12b1 [0067.799] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0067.799] GetFileType (hFile=0x158) returned 0x1 [0067.799] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xf, wMilliseconds=0x4b)) [0067.799] GetCurrentThreadId () returned 0x970 [0067.799] GetCurrentThreadId () returned 0x970 [0067.799] GetCurrentThreadId () returned 0x970 [0067.799] GetCurrentThreadId () returned 0x970 [0067.799] GetCurrentThreadId () returned 0x970 [0067.799] GetCurrentThreadId () returned 0x970 [0067.799] GetCurrentThreadId () returned 0x970 [0067.799] GetCurrentThreadId () returned 0x970 [0067.799] GetCurrentThreadId () returned 0x970 [0067.799] GetCurrentThreadId () returned 0x970 [0067.799] GetCurrentThreadId () returned 0x970 [0067.799] GetCurrentThreadId () returned 0x970 [0067.799] GetCurrentThreadId () returned 0x970 [0067.799] GetCurrentThreadId () returned 0x970 [0067.799] GetCurrentThreadId () returned 0x970 [0067.799] GetCurrentThreadId () returned 0x970 [0067.799] GetCurrentThreadId () returned 0x970 [0067.799] GetCurrentThreadId () returned 0x970 [0067.799] GetCurrentThreadId () returned 0x970 [0067.799] GetCurrentThreadId () returned 0x970 [0067.799] GetCurrentThreadId () returned 0x970 [0067.799] GetCurrentThreadId () returned 0x970 [0067.799] GetCurrentThreadId () returned 0x970 [0067.799] GetCurrentThreadId () returned 0x970 [0067.800] GetCurrentThreadId () returned 0x970 [0067.800] GetCurrentThreadId () returned 0x970 [0067.800] GetCurrentThreadId () returned 0x970 [0067.800] GetCurrentThreadId () returned 0x970 [0067.800] GetCurrentThreadId () returned 0x970 [0067.800] GetCurrentThreadId () returned 0x970 [0067.800] GetCurrentThreadId () returned 0x970 [0067.800] GetCurrentThreadId () returned 0x970 [0067.800] GetCurrentThreadId () returned 0x970 [0067.800] GetCurrentThreadId () returned 0x970 [0067.800] GetCurrentThreadId () returned 0x970 [0067.800] GetCurrentThreadId () returned 0x970 [0067.800] GetCurrentThreadId () returned 0x970 [0067.800] GetCurrentThreadId () returned 0x970 [0067.800] GetCurrentThreadId () returned 0x970 [0067.800] GetCurrentThreadId () returned 0x970 [0067.800] GetCurrentThreadId () returned 0x970 [0067.800] GetCurrentThreadId () returned 0x970 [0067.800] GetCurrentThreadId () returned 0x970 [0067.800] GetCurrentThreadId () returned 0x970 [0067.800] GetCurrentThreadId () returned 0x970 [0067.800] GetCurrentThreadId () returned 0x970 [0067.800] GetCurrentThreadId () returned 0x970 [0067.800] GetCurrentThreadId () returned 0x970 [0067.800] GetCurrentThreadId () returned 0x970 [0067.800] GetCurrentThreadId () returned 0x970 [0067.800] GetCurrentThreadId () returned 0x970 [0067.800] GetCurrentThreadId () returned 0x970 [0067.800] GetCurrentThreadId () returned 0x970 [0067.800] GetCurrentThreadId () returned 0x970 [0067.800] GetCurrentThreadId () returned 0x970 [0067.800] GetCurrentThreadId () returned 0x970 [0067.800] GetCurrentThreadId () returned 0x970 [0067.800] GetCurrentThreadId () returned 0x970 [0067.800] GetCurrentThreadId () returned 0x970 [0067.800] GetCurrentThreadId () returned 0x970 [0067.800] GetCurrentThreadId () returned 0x970 [0067.800] GetCurrentThreadId () returned 0x970 [0067.800] GetCurrentThreadId () returned 0x970 [0067.801] GetCurrentThreadId () returned 0x970 [0067.801] GetCurrentThreadId () returned 0x970 [0067.801] GetCurrentThreadId () returned 0x970 [0067.801] GetCurrentThreadId () returned 0x970 [0067.801] GetCurrentThreadId () returned 0x970 [0067.801] GetCurrentThreadId () returned 0x970 [0067.801] GetCurrentThreadId () returned 0x970 [0067.801] GetCurrentThreadId () returned 0x970 [0067.801] GetCurrentThreadId () returned 0x970 [0067.801] GetCurrentThreadId () returned 0x970 [0067.801] GetCurrentThreadId () returned 0x970 [0067.801] GetCurrentThreadId () returned 0x970 [0067.801] GetCurrentThreadId () returned 0x970 [0067.801] GetCurrentThreadId () returned 0x970 [0067.801] GetCurrentThreadId () returned 0x970 [0067.801] GetCurrentThreadId () returned 0x970 [0067.801] GetCurrentThreadId () returned 0x970 [0067.801] GetCurrentThreadId () returned 0x970 [0067.801] GetCurrentThreadId () returned 0x970 [0067.801] GetCurrentThreadId () returned 0x970 [0067.801] GetCurrentThreadId () returned 0x970 [0067.801] GetCurrentThreadId () returned 0x970 [0067.801] GetCurrentThreadId () returned 0x970 [0067.801] GetCurrentThreadId () returned 0x970 [0067.801] GetCurrentThreadId () returned 0x970 [0067.801] GetCurrentThreadId () returned 0x970 [0067.801] GetCurrentThreadId () returned 0x970 [0067.801] GetCurrentThreadId () returned 0x970 [0067.801] GetCurrentThreadId () returned 0x970 [0067.801] GetCurrentThreadId () returned 0x970 [0067.801] GetCurrentThreadId () returned 0x970 [0067.801] GetCurrentThreadId () returned 0x970 [0067.801] GetCurrentThreadId () returned 0x970 [0067.801] GetCurrentThreadId () returned 0x970 [0067.801] GetCurrentThreadId () returned 0x970 [0067.801] GetCurrentThreadId () returned 0x970 [0067.801] GetCurrentThreadId () returned 0x970 [0067.802] GetCurrentThreadId () returned 0x970 [0067.802] GetCurrentThreadId () returned 0x970 [0067.802] GetCurrentThreadId () returned 0x970 [0067.802] GetCurrentThreadId () returned 0x970 [0067.802] GetCurrentThreadId () returned 0x970 [0067.802] GetCurrentThreadId () returned 0x970 [0067.802] GetCurrentThreadId () returned 0x970 [0067.802] GetCurrentThreadId () returned 0x970 [0067.802] GetCurrentThreadId () returned 0x970 [0067.802] GetCurrentThreadId () returned 0x970 [0067.802] GetCurrentThreadId () returned 0x970 [0067.802] GetCurrentThreadId () returned 0x970 [0067.802] GetCurrentThreadId () returned 0x970 [0067.802] GetCurrentThreadId () returned 0x970 [0067.802] GetCurrentThreadId () returned 0x970 [0067.802] GetCurrentThreadId () returned 0x970 [0067.802] GetCurrentThreadId () returned 0x970 [0067.802] GetCurrentThreadId () returned 0x970 [0067.802] GetCurrentThreadId () returned 0x970 [0067.802] GetCurrentThreadId () returned 0x970 [0067.802] GetCurrentThreadId () returned 0x970 [0067.802] GetCurrentThreadId () returned 0x970 [0067.802] GetCurrentThreadId () returned 0x970 [0067.802] GetCurrentThreadId () returned 0x970 [0067.802] GetCurrentThreadId () returned 0x970 [0067.802] GetCurrentThreadId () returned 0x970 [0067.802] GetCurrentThreadId () returned 0x970 [0067.802] GetCurrentThreadId () returned 0x970 [0067.802] GetCurrentThreadId () returned 0x970 [0067.802] GetCurrentThreadId () returned 0x970 [0067.802] GetCurrentThreadId () returned 0x970 [0067.802] GetCurrentThreadId () returned 0x970 [0067.802] GetCurrentThreadId () returned 0x970 [0067.802] GetCurrentThreadId () returned 0x970 [0067.802] GetCurrentThreadId () returned 0x970 [0067.802] GetCurrentThreadId () returned 0x970 [0067.802] GetCurrentThreadId () returned 0x970 [0067.802] GetCurrentThreadId () returned 0x970 [0067.802] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.802] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.803] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379cd38, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0067.803] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.803] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.803] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379cd38, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0067.803] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.803] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.803] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0067.803] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.803] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.803] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0067.803] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.803] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.803] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379cd98, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0067.803] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.803] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.803] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379cd98, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0067.803] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.803] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0067.803] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379cd98, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0067.803] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xf, wMilliseconds=0x4b)) [0067.803] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr=">iKbz&C2=>%8/Vw#}27QmH(#HnAkn>*7", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0067.803] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr=">iKbz&C2=>%8/Vw#}27QmH(#HnAkn>*7", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0067.803] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr=">iKbz&C2=>%8/Vw#}27QmH(#HnAkn>*7", cchWideChar=32, lpMultiByteStr=0x20044c8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=">iKbz&C2=>%8/Vw#}27QmH(#HnAkn>*7", lpUsedDefaultChar=0x0) returned 32 [0067.803] GetCurrentThreadId () returned 0x970 [0067.804] GetCurrentThreadId () returned 0x970 [0067.804] GetCurrentThreadId () returned 0x970 [0067.804] GetCurrentThreadId () returned 0x970 [0067.804] GetCurrentThreadId () returned 0x970 [0067.804] GetCurrentThreadId () returned 0x970 [0067.814] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0067.814] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0067.814] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x37b0ea8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0067.814] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ebd48, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0067.814] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ebd48, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAFTP08i2vGvV2/eK1i6tyaUtxq99Og+rl89XkxkXJya7ppydrh4gnAG3Q9oA9P0xRiim8fp+aWbtfMVksObB3JyhniNdbhQMfYWobklWGtqSDG0FKuU5DJ0YGbKJjGgGzh1tT0iieS3c7uS1fOdeYTf/zV3GljIWbtQp6hLvkUvQQ5k7DD1ozUpwdylkt9h7QziO5btsxMAPKYAMFkRuw5yYYkBlSBSLIw==") returned 232 [0067.814] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0xf, wMilliseconds=0x5a)) [0067.814] GetCurrentThreadId () returned 0x970 [0067.814] GetCurrentThreadId () returned 0x970 [0067.814] GetCurrentThreadId () returned 0x970 [0067.814] GetCurrentThreadId () returned 0x970 [0067.814] GetCurrentThreadId () returned 0x970 [0067.814] GetCurrentThreadId () returned 0x970 [0067.814] GetCurrentThreadId () returned 0x970 [0067.814] GetCurrentThreadId () returned 0x970 [0067.814] GetCurrentThreadId () returned 0x970 [0067.815] GetCurrentThreadId () returned 0x970 [0067.815] GetCurrentThreadId () returned 0x970 [0067.815] GetCurrentThreadId () returned 0x970 [0067.815] GetCurrentThreadId () returned 0x970 [0067.815] GetCurrentThreadId () returned 0x970 [0067.815] GetCurrentThreadId () returned 0x970 [0067.815] GetCurrentThreadId () returned 0x970 [0067.815] GetCurrentThreadId () returned 0x970 [0067.815] GetCurrentThreadId () returned 0x970 [0067.815] GetCurrentThreadId () returned 0x970 [0067.815] GetCurrentThreadId () returned 0x970 [0067.815] GetCurrentThreadId () returned 0x970 [0067.815] GetCurrentThreadId () returned 0x970 [0067.815] GetCurrentThreadId () returned 0x970 [0067.815] GetCurrentThreadId () returned 0x970 [0067.815] GetCurrentThreadId () returned 0x970 [0067.815] GetCurrentThreadId () returned 0x970 [0067.815] GetCurrentThreadId () returned 0x970 [0067.815] GetCurrentThreadId () returned 0x970 [0067.815] GetCurrentThreadId () returned 0x970 [0067.815] GetCurrentThreadId () returned 0x970 [0067.815] GetCurrentThreadId () returned 0x970 [0067.815] GetCurrentThreadId () returned 0x970 [0067.815] GetCurrentThreadId () returned 0x970 [0067.815] GetCurrentThreadId () returned 0x970 [0067.815] GetCurrentThreadId () returned 0x970 [0067.815] GetCurrentThreadId () returned 0x970 [0067.815] GetCurrentThreadId () returned 0x970 [0067.816] GetCurrentThreadId () returned 0x970 [0067.816] GetCurrentThreadId () returned 0x970 [0067.816] GetCurrentThreadId () returned 0x970 [0067.816] GetCurrentThreadId () returned 0x970 [0067.816] GetCurrentThreadId () returned 0x970 [0067.816] GetCurrentThreadId () returned 0x970 [0067.816] GetCurrentThreadId () returned 0x970 [0067.816] GetCurrentThreadId () returned 0x970 [0067.816] GetCurrentThreadId () returned 0x970 [0067.816] GetCurrentThreadId () returned 0x970 [0067.816] GetCurrentThreadId () returned 0x970 [0067.816] GetCurrentThreadId () returned 0x970 [0067.816] GetCurrentThreadId () returned 0x970 [0067.816] GetCurrentThreadId () returned 0x970 [0067.816] GetCurrentThreadId () returned 0x970 [0067.816] GetCurrentThreadId () returned 0x970 [0067.816] GetCurrentThreadId () returned 0x970 [0067.816] GetCurrentThreadId () returned 0x970 [0067.816] GetCurrentThreadId () returned 0x970 [0067.816] GetCurrentThreadId () returned 0x970 [0067.816] GetCurrentThreadId () returned 0x970 [0067.816] GetCurrentThreadId () returned 0x970 [0067.816] GetCurrentThreadId () returned 0x970 [0067.816] GetCurrentThreadId () returned 0x970 [0067.816] GetCurrentThreadId () returned 0x970 [0067.816] GetCurrentThreadId () returned 0x970 [0067.816] GetCurrentThreadId () returned 0x970 [0067.816] GetCurrentThreadId () returned 0x970 [0067.817] GetCurrentThreadId () returned 0x970 [0067.817] GetCurrentThreadId () returned 0x970 [0067.817] GetCurrentThreadId () returned 0x970 [0067.817] GetCurrentThreadId () returned 0x970 [0067.817] GetCurrentThreadId () returned 0x970 [0067.817] GetCurrentThreadId () returned 0x970 [0067.817] GetCurrentThreadId () returned 0x970 [0067.817] GetCurrentThreadId () returned 0x970 [0067.817] GetCurrentThreadId () returned 0x970 [0067.817] GetCurrentThreadId () returned 0x970 [0067.817] GetCurrentThreadId () returned 0x970 [0067.817] GetCurrentThreadId () returned 0x970 [0067.817] GetCurrentThreadId () returned 0x970 [0067.817] GetCurrentThreadId () returned 0x970 [0067.817] GetCurrentThreadId () returned 0x970 [0067.817] GetCurrentThreadId () returned 0x970 [0067.817] GetCurrentThreadId () returned 0x970 [0067.817] GetCurrentThreadId () returned 0x970 [0067.817] GetCurrentThreadId () returned 0x970 [0067.817] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAFTP08i2vGvV2/eK1i6tyaUtxq99Og+rl89XkxkXJya7ppydrh4gnAG3Q9oA9P0xRiim8fp+aWbtfMVksObB3JyhniNdbhQMfYWobklWGtqSDG0FKuU5DJ0YGbKJjGgGzh1tT0iieS3c7uS1fOdeYTf/zV3GljIWbtQp6hLvkUvQQ5k7DD1ozUpwdylkt9h7QziO5btsxMAPKYAMFkRuw5yYYkBlSBSLIw==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0067.817] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAFTP08i2vGvV2/eK1i6tyaUtxq99Og+rl89XkxkXJya7ppydrh4gnAG3Q9oA9P0xRiim8fp+aWbtfMVksObB3JyhniNdbhQMfYWobklWGtqSDG0FKuU5DJ0YGbKJjGgGzh1tT0iieS3c7uS1fOdeYTf/zV3GljIWbtQp6hLvkUvQQ5k7DD1ozUpwdylkt9h7QziO5btsxMAPKYAMFkRuw5yYYkBlSBSLIw==", cchWideChar=245, lpMultiByteStr=0x3539bbc, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAFTP08i2vGvV2/eK1i6tyaUtxq99Og+rl89XkxkXJya7ppydrh4gnAG3Q9oA9P0xRiim8fp+aWbtfMVksObB3JyhniNdbhQMfYWobklWGtqSDG0FKuU5DJ0YGbKJjGgGzh1tT0iieS3c7uS1fOdeYTf/zV3GljIWbtQp6hLvkUvQQ5k7DD1ozUpwdylkt9h7QziO5btsxMAPKYAMFkRuw5yYYkBlSBSLIw==", lpUsedDefaultChar=0x0) returned 245 [0067.817] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0067.817] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0067.818] CloseHandle (hObject=0x158) returned 1 [0067.818] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\1047x576black.png")) returned 0 [0067.818] GetLastError () returned 0x5 [0067.818] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\1047x576black.png")) returned 0x20 [0067.818] SetLastError (dwErrCode=0x5) [0067.818] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=18808158473) returned 1 [0067.818] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\Файл зашифрован [203x8subpicture.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\Файл зашифрован [203x8subpicture.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0067.822] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0067.822] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0067.822] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0067.822] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0067.822] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0067.822] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0067.822] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0067.822] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0067.822] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0067.822] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0067.822] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0067.822] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0067.822] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0067.823] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0067.823] SetEndOfFile (hFile=0x158) returned 1 [0067.823] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0067.823] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0067.823] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0067.823] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0067.823] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0067.824] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0067.824] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="S627I", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0069.653] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="sU2S$Z>.zI8a064\"Hw6=4Tk)^RJs>27I", cchWideChar=32, lpMultiByteStr=0x2037794, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sU2S$Z>.zI8a064\"Hw6=4Tk)^RJs>27I", lpUsedDefaultChar=0x0) returned 32 [0069.653] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0069.654] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0069.654] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_ButtonGraphic.png", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef8434f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef8434f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 0x295098 [0069.654] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0069.654] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0069.654] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_buttongraphic.png")) returned 0x20 [0069.655] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_buttongraphic.png")) returned 0x20 [0069.655] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_buttongraphic.png")) returned 0x20 [0069.656] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_buttongraphic.png")) returned 0x20 [0069.656] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_buttongraphic.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef8434f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef8434f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b)) returned 1 [0069.656] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0069.656] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0069.656] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_buttongraphic.png")) returned 0x20 [0069.656] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_buttongraphic.png")) returned 0x20 [0069.656] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0069.656] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0069.656] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0069.656] SetEndOfFile (hFile=0x158) returned 1 [0069.657] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0069.657] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x200473c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0069.657] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0069.657] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x200479c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0069.657] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x200479c, cbMultiByte=30, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="NavigationUp_ButtonGraphic.pngpngre.pngg") returned 30 [0069.657] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0069.657] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x200473c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0069.657] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0069.657] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0069.658] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x135b [0069.658] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0069.658] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0069.658] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0069.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0069.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x200473c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0069.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0069.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x200479c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0069.658] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x200479c, cbMultiByte=30, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="NavigationUp_ButtonGraphic.pngic.pngpngre.pngg") returned 30 [0069.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0069.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x200473c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0069.658] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0069.659] CharToOemA (in: pSrc="NavigationUp_ButtonGraphic.png", pDst=0x200479c | out: pDst="NavigationUp_ButtonGraphic.png") returned 1 [0069.659] WriteFile (in: hFile=0x158, lpBuffer=0x200479c*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x200479c*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0069.659] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0069.659] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0069.659] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0069.659] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=18992283213) returned 1 [0069.659] ReadFile (in: hFile=0x11c, lpBuffer=0x3b549f0, nNumberOfBytesToRead=0x135b, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b549f0*, lpNumberOfBytesRead=0x18dd7c*=0x135b, lpOverlapped=0x0) returned 1 [0069.661] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0069.661] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=18992462625) returned 1 [0069.670] WriteFile (in: hFile=0x158, lpBuffer=0x379adf8*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379adf8*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0069.670] ReadFile (in: hFile=0x11c, lpBuffer=0x3b549f0, nNumberOfBytesToRead=0x135b, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3b549f0*, lpNumberOfBytesRead=0x18de38*=0x135b, lpOverlapped=0x0) returned 1 [0069.670] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x59 [0069.670] WriteFile (in: hFile=0x158, lpBuffer=0x3b97610*, nNumberOfBytesToWrite=0x135b, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3b97610*, lpNumberOfBytesWritten=0x18de10*=0x135b, lpOverlapped=0x0) returned 1 [0069.671] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x13b4 [0069.671] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0069.671] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0069.671] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0069.671] SetFilePointer (in: hFile=0x158, lDistanceToMove=30, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x3c [0069.671] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x13be [0069.671] CloseHandle (hObject=0x11c) returned 1 [0069.671] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x13be [0069.671] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x13be [0069.671] SetFilePointer (in: hFile=0x158, lDistanceToMove=5054, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x13be [0069.671] SetFilePointer (in: hFile=0x158, lDistanceToMove=5054, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x13be [0069.671] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x13be [0069.671] SetFilePointer (in: hFile=0x158, lDistanceToMove=5054, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x13be [0069.671] SetEndOfFile (hFile=0x158) returned 1 [0069.672] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x13be [0069.672] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x13be [0069.672] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0069.672] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x200479c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0069.672] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0069.672] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x200473c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0069.672] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x200473c, cbMultiByte=30, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="NavigationUp_ButtonGraphic.png䃊㫋ÆǏ፷") returned 30 [0069.672] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0069.672] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x200479c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0069.672] WriteFile (in: hFile=0x158, lpBuffer=0x3b384c8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3b384c8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0069.672] CharToOemA (in: pSrc="NavigationUp_ButtonGraphic.png", pDst=0x200473c | out: pDst="NavigationUp_ButtonGraphic.png") returned 1 [0069.672] WriteFile (in: hFile=0x158, lpBuffer=0x200473c*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x200473c*, lpNumberOfBytesWritten=0x18efcc*=0x1e, lpOverlapped=0x0) returned 1 [0069.672] WriteFile (in: hFile=0x158, lpBuffer=0x379ad88*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379ad88*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0069.672] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0069.672] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0069.673] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1415 [0069.673] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1415 [0069.673] WriteFile (in: hFile=0x158, lpBuffer=0x3777058*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777058*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0069.673] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0069.673] DeleteFileW (lpFileName="") returned 0 [0069.673] GetLastError () returned 0x3 [0069.673] GetFileAttributesW (lpFileName="") returned 0xffffffff [0069.673] SetLastError (dwErrCode=0x3) [0069.673] FlushFileBuffers (hFile=0x158) returned 1 [0069.676] GetCurrentThreadId () returned 0x970 [0069.676] GetCurrentThreadId () returned 0x970 [0069.676] GetCurrentThreadId () returned 0x970 [0069.676] GetCurrentThreadId () returned 0x970 [0069.676] GetCurrentThreadId () returned 0x970 [0069.676] GetCurrentThreadId () returned 0x970 [0069.676] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x14cc [0069.676] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x14cc [0069.676] SetFilePointer (in: hFile=0x158, lDistanceToMove=5324, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x14cc [0069.676] CloseHandle (hObject=0x158) returned 1 [0069.676] GetCurrentThreadId () returned 0x970 [0069.676] GetCurrentThreadId () returned 0x970 [0069.676] GetCurrentThreadId () returned 0x970 [0069.676] GetCurrentThreadId () returned 0x970 [0069.677] GetCurrentThreadId () returned 0x970 [0069.677] GetCurrentThreadId () returned 0x970 [0069.677] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Файл зашифрован [NavigationUp_ButtonGraphic.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\Файл зашифрован [navigationup_buttongraphic.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0069.677] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14cc [0069.677] SetFilePointer (in: hFile=0x158, lDistanceToMove=5196, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x144c [0069.677] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0069.677] GetFileType (hFile=0x158) returned 0x1 [0069.677] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x10, wMilliseconds=0x3b3)) [0069.677] GetCurrentThreadId () returned 0x970 [0069.677] GetCurrentThreadId () returned 0x970 [0069.677] GetCurrentThreadId () returned 0x970 [0069.677] GetCurrentThreadId () returned 0x970 [0069.677] GetCurrentThreadId () returned 0x970 [0069.677] GetCurrentThreadId () returned 0x970 [0069.677] GetCurrentThreadId () returned 0x970 [0069.677] GetCurrentThreadId () returned 0x970 [0069.677] GetCurrentThreadId () returned 0x970 [0069.677] GetCurrentThreadId () returned 0x970 [0069.677] GetCurrentThreadId () returned 0x970 [0069.677] GetCurrentThreadId () returned 0x970 [0069.677] GetCurrentThreadId () returned 0x970 [0069.677] GetCurrentThreadId () returned 0x970 [0069.677] GetCurrentThreadId () returned 0x970 [0069.677] GetCurrentThreadId () returned 0x970 [0069.677] GetCurrentThreadId () returned 0x970 [0069.677] GetCurrentThreadId () returned 0x970 [0069.677] GetCurrentThreadId () returned 0x970 [0069.677] GetCurrentThreadId () returned 0x970 [0069.677] GetCurrentThreadId () returned 0x970 [0069.677] GetCurrentThreadId () returned 0x970 [0069.677] GetCurrentThreadId () returned 0x970 [0069.677] GetCurrentThreadId () returned 0x970 [0069.678] GetCurrentThreadId () returned 0x970 [0069.678] GetCurrentThreadId () returned 0x970 [0069.678] GetCurrentThreadId () returned 0x970 [0069.678] GetCurrentThreadId () returned 0x970 [0069.678] GetCurrentThreadId () returned 0x970 [0069.678] GetCurrentThreadId () returned 0x970 [0069.678] GetCurrentThreadId () returned 0x970 [0069.678] GetCurrentThreadId () returned 0x970 [0069.678] GetCurrentThreadId () returned 0x970 [0069.678] GetCurrentThreadId () returned 0x970 [0069.678] GetCurrentThreadId () returned 0x970 [0069.678] GetCurrentThreadId () returned 0x970 [0069.678] GetCurrentThreadId () returned 0x970 [0069.678] GetCurrentThreadId () returned 0x970 [0069.678] GetCurrentThreadId () returned 0x970 [0069.678] GetCurrentThreadId () returned 0x970 [0069.678] GetCurrentThreadId () returned 0x970 [0069.678] GetCurrentThreadId () returned 0x970 [0069.678] GetCurrentThreadId () returned 0x970 [0069.678] GetCurrentThreadId () returned 0x970 [0069.678] GetCurrentThreadId () returned 0x970 [0069.678] GetCurrentThreadId () returned 0x970 [0069.678] GetCurrentThreadId () returned 0x970 [0069.678] GetCurrentThreadId () returned 0x970 [0069.678] GetCurrentThreadId () returned 0x970 [0069.678] GetCurrentThreadId () returned 0x970 [0069.678] GetCurrentThreadId () returned 0x970 [0069.678] GetCurrentThreadId () returned 0x970 [0069.678] GetCurrentThreadId () returned 0x970 [0069.678] GetCurrentThreadId () returned 0x970 [0069.678] GetCurrentThreadId () returned 0x970 [0069.678] GetCurrentThreadId () returned 0x970 [0069.678] GetCurrentThreadId () returned 0x970 [0069.678] GetCurrentThreadId () returned 0x970 [0069.678] GetCurrentThreadId () returned 0x970 [0069.678] GetCurrentThreadId () returned 0x970 [0069.678] GetCurrentThreadId () returned 0x970 [0069.678] GetCurrentThreadId () returned 0x970 [0069.678] GetCurrentThreadId () returned 0x970 [0069.678] GetCurrentThreadId () returned 0x970 [0069.678] GetCurrentThreadId () returned 0x970 [0069.678] GetCurrentThreadId () returned 0x970 [0069.678] GetCurrentThreadId () returned 0x970 [0069.678] GetCurrentThreadId () returned 0x970 [0069.678] GetCurrentThreadId () returned 0x970 [0069.678] GetCurrentThreadId () returned 0x970 [0069.679] GetCurrentThreadId () returned 0x970 [0069.679] GetCurrentThreadId () returned 0x970 [0069.679] GetCurrentThreadId () returned 0x970 [0069.679] GetCurrentThreadId () returned 0x970 [0069.679] GetCurrentThreadId () returned 0x970 [0069.679] GetCurrentThreadId () returned 0x970 [0069.679] GetCurrentThreadId () returned 0x970 [0069.679] GetCurrentThreadId () returned 0x970 [0069.679] GetCurrentThreadId () returned 0x970 [0069.679] GetCurrentThreadId () returned 0x970 [0069.679] GetCurrentThreadId () returned 0x970 [0069.679] GetCurrentThreadId () returned 0x970 [0069.679] GetCurrentThreadId () returned 0x970 [0069.679] GetCurrentThreadId () returned 0x970 [0069.679] GetCurrentThreadId () returned 0x970 [0069.679] GetCurrentThreadId () returned 0x970 [0069.679] GetCurrentThreadId () returned 0x970 [0069.679] GetCurrentThreadId () returned 0x970 [0069.679] GetCurrentThreadId () returned 0x970 [0069.679] GetCurrentThreadId () returned 0x970 [0069.679] GetCurrentThreadId () returned 0x970 [0069.679] GetCurrentThreadId () returned 0x970 [0069.679] GetCurrentThreadId () returned 0x970 [0069.679] GetCurrentThreadId () returned 0x970 [0069.679] GetCurrentThreadId () returned 0x970 [0069.679] GetCurrentThreadId () returned 0x970 [0069.679] GetCurrentThreadId () returned 0x970 [0069.679] GetCurrentThreadId () returned 0x970 [0069.679] GetCurrentThreadId () returned 0x970 [0069.679] GetCurrentThreadId () returned 0x970 [0069.679] GetCurrentThreadId () returned 0x970 [0069.679] GetCurrentThreadId () returned 0x970 [0069.679] GetCurrentThreadId () returned 0x970 [0069.679] GetCurrentThreadId () returned 0x970 [0069.679] GetCurrentThreadId () returned 0x970 [0069.679] GetCurrentThreadId () returned 0x970 [0069.679] GetCurrentThreadId () returned 0x970 [0069.679] GetCurrentThreadId () returned 0x970 [0069.679] GetCurrentThreadId () returned 0x970 [0069.679] GetCurrentThreadId () returned 0x970 [0069.679] GetCurrentThreadId () returned 0x970 [0069.679] GetCurrentThreadId () returned 0x970 [0069.679] GetCurrentThreadId () returned 0x970 [0069.679] GetCurrentThreadId () returned 0x970 [0069.679] GetCurrentThreadId () returned 0x970 [0069.680] GetCurrentThreadId () returned 0x970 [0069.680] GetCurrentThreadId () returned 0x970 [0069.680] GetCurrentThreadId () returned 0x970 [0069.680] GetCurrentThreadId () returned 0x970 [0069.680] GetCurrentThreadId () returned 0x970 [0069.680] GetCurrentThreadId () returned 0x970 [0069.680] GetCurrentThreadId () returned 0x970 [0069.680] GetCurrentThreadId () returned 0x970 [0069.680] GetCurrentThreadId () returned 0x970 [0069.680] GetCurrentThreadId () returned 0x970 [0069.680] GetCurrentThreadId () returned 0x970 [0069.680] GetCurrentThreadId () returned 0x970 [0069.680] GetCurrentThreadId () returned 0x970 [0069.680] GetCurrentThreadId () returned 0x970 [0069.680] GetCurrentThreadId () returned 0x970 [0069.680] GetCurrentThreadId () returned 0x970 [0069.680] GetCurrentThreadId () returned 0x970 [0069.680] GetCurrentThreadId () returned 0x970 [0069.680] GetCurrentThreadId () returned 0x970 [0069.680] GetCurrentThreadId () returned 0x970 [0069.680] GetCurrentThreadId () returned 0x970 [0069.680] GetCurrentThreadId () returned 0x970 [0069.680] GetCurrentThreadId () returned 0x970 [0069.680] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0069.680] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0069.680] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379d938, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0069.680] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0069.680] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0069.680] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379d938, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0069.680] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0069.680] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0069.680] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0069.680] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0069.680] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0069.680] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0069.680] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0069.680] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0069.680] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379d998, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0069.681] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0069.681] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0069.681] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379d998, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0069.681] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0069.681] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0069.681] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379d998, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0069.681] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x10, wMilliseconds=0x3b3)) [0069.681] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sU2S$Z>.zI8a064\"Hw6=4Tk)^RJs>27I", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0069.681] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sU2S$Z>.zI8a064\"Hw6=4Tk)^RJs>27I", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0069.681] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sU2S$Z>.zI8a064\"Hw6=4Tk)^RJs>27I", cchWideChar=32, lpMultiByteStr=0x2004ac8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sU2S$Z>.zI8a064\"Hw6=4Tk)^RJs>27I", lpUsedDefaultChar=0x0) returned 32 [0069.681] GetCurrentThreadId () returned 0x970 [0069.681] GetCurrentThreadId () returned 0x970 [0069.681] GetCurrentThreadId () returned 0x970 [0069.681] GetCurrentThreadId () returned 0x970 [0069.681] GetCurrentThreadId () returned 0x970 [0069.681] GetCurrentThreadId () returned 0x970 [0069.688] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0069.688] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0069.689] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x37b2d48, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0069.689] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ec248, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0069.689] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ec248, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAH7zyoRDrA+JM5zczeKYOOo6U2CywQ1VW0xLW45qb4YU786U2E31+RLjYPPMzzOhY+jkBdgdsupHFotxJw18i8giSrX1la+N2qGcUxylXRx+mW17LbfUAZ0SNYmORj8ktQkRxpObZbT9GqcgRrTBLpqFO4ZKW1E0ImDcB/bCQiGr02RK0nrCauzkKK4tC9bxcMJOvd53VFYLntwFk51YF2mnQhCOt1TpJw==") returned 232 [0069.689] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x10, wMilliseconds=0x3c2)) [0069.689] GetCurrentThreadId () returned 0x970 [0069.689] GetCurrentThreadId () returned 0x970 [0069.689] GetCurrentThreadId () returned 0x970 [0069.689] GetCurrentThreadId () returned 0x970 [0069.689] GetCurrentThreadId () returned 0x970 [0069.689] GetCurrentThreadId () returned 0x970 [0069.689] GetCurrentThreadId () returned 0x970 [0069.689] GetCurrentThreadId () returned 0x970 [0069.689] GetCurrentThreadId () returned 0x970 [0069.689] GetCurrentThreadId () returned 0x970 [0069.689] GetCurrentThreadId () returned 0x970 [0069.689] GetCurrentThreadId () returned 0x970 [0069.689] GetCurrentThreadId () returned 0x970 [0069.689] GetCurrentThreadId () returned 0x970 [0069.689] GetCurrentThreadId () returned 0x970 [0069.689] GetCurrentThreadId () returned 0x970 [0069.689] GetCurrentThreadId () returned 0x970 [0069.689] GetCurrentThreadId () returned 0x970 [0069.689] GetCurrentThreadId () returned 0x970 [0069.689] GetCurrentThreadId () returned 0x970 [0069.689] GetCurrentThreadId () returned 0x970 [0069.689] GetCurrentThreadId () returned 0x970 [0069.689] GetCurrentThreadId () returned 0x970 [0069.689] GetCurrentThreadId () returned 0x970 [0069.689] GetCurrentThreadId () returned 0x970 [0069.689] GetCurrentThreadId () returned 0x970 [0069.689] GetCurrentThreadId () returned 0x970 [0069.689] GetCurrentThreadId () returned 0x970 [0069.689] GetCurrentThreadId () returned 0x970 [0069.689] GetCurrentThreadId () returned 0x970 [0069.689] GetCurrentThreadId () returned 0x970 [0069.689] GetCurrentThreadId () returned 0x970 [0069.689] GetCurrentThreadId () returned 0x970 [0069.689] GetCurrentThreadId () returned 0x970 [0069.689] GetCurrentThreadId () returned 0x970 [0069.689] GetCurrentThreadId () returned 0x970 [0069.689] GetCurrentThreadId () returned 0x970 [0069.689] GetCurrentThreadId () returned 0x970 [0069.690] GetCurrentThreadId () returned 0x970 [0069.690] GetCurrentThreadId () returned 0x970 [0069.690] GetCurrentThreadId () returned 0x970 [0069.690] GetCurrentThreadId () returned 0x970 [0069.690] GetCurrentThreadId () returned 0x970 [0069.690] GetCurrentThreadId () returned 0x970 [0069.690] GetCurrentThreadId () returned 0x970 [0069.690] GetCurrentThreadId () returned 0x970 [0069.690] GetCurrentThreadId () returned 0x970 [0069.690] GetCurrentThreadId () returned 0x970 [0069.690] GetCurrentThreadId () returned 0x970 [0069.690] GetCurrentThreadId () returned 0x970 [0069.690] GetCurrentThreadId () returned 0x970 [0069.690] GetCurrentThreadId () returned 0x970 [0069.690] GetCurrentThreadId () returned 0x970 [0069.690] GetCurrentThreadId () returned 0x970 [0069.690] GetCurrentThreadId () returned 0x970 [0069.690] GetCurrentThreadId () returned 0x970 [0069.690] GetCurrentThreadId () returned 0x970 [0069.690] GetCurrentThreadId () returned 0x970 [0069.690] GetCurrentThreadId () returned 0x970 [0069.690] GetCurrentThreadId () returned 0x970 [0069.690] GetCurrentThreadId () returned 0x970 [0069.690] GetCurrentThreadId () returned 0x970 [0069.690] GetCurrentThreadId () returned 0x970 [0069.690] GetCurrentThreadId () returned 0x970 [0069.690] GetCurrentThreadId () returned 0x970 [0069.690] GetCurrentThreadId () returned 0x970 [0069.690] GetCurrentThreadId () returned 0x970 [0069.690] GetCurrentThreadId () returned 0x970 [0069.690] GetCurrentThreadId () returned 0x970 [0069.690] GetCurrentThreadId () returned 0x970 [0069.690] GetCurrentThreadId () returned 0x970 [0069.690] GetCurrentThreadId () returned 0x970 [0069.690] GetCurrentThreadId () returned 0x970 [0069.690] GetCurrentThreadId () returned 0x970 [0069.690] GetCurrentThreadId () returned 0x970 [0069.690] GetCurrentThreadId () returned 0x970 [0069.690] GetCurrentThreadId () returned 0x970 [0069.690] GetCurrentThreadId () returned 0x970 [0069.690] GetCurrentThreadId () returned 0x970 [0069.690] GetCurrentThreadId () returned 0x970 [0069.690] GetCurrentThreadId () returned 0x970 [0069.690] GetCurrentThreadId () returned 0x970 [0069.690] GetCurrentThreadId () returned 0x970 [0069.691] GetCurrentThreadId () returned 0x970 [0069.691] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAH7zyoRDrA+JM5zczeKYOOo6U2CywQ1VW0xLW45qb4YU786U2E31+RLjYPPMzzOhY+jkBdgdsupHFotxJw18i8giSrX1la+N2qGcUxylXRx+mW17LbfUAZ0SNYmORj8ktQkRxpObZbT9GqcgRrTBLpqFO4ZKW1E0ImDcB/bCQiGr02RK0nrCauzkKK4tC9bxcMJOvd53VFYLntwFk51YF2mnQhCOt1TpJw==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0069.691] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAH7zyoRDrA+JM5zczeKYOOo6U2CywQ1VW0xLW45qb4YU786U2E31+RLjYPPMzzOhY+jkBdgdsupHFotxJw18i8giSrX1la+N2qGcUxylXRx+mW17LbfUAZ0SNYmORj8ktQkRxpObZbT9GqcgRrTBLpqFO4ZKW1E0ImDcB/bCQiGr02RK0nrCauzkKK4tC9bxcMJOvd53VFYLntwFk51YF2mnQhCOt1TpJw==", cchWideChar=245, lpMultiByteStr=0x353a10c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAH7zyoRDrA+JM5zczeKYOOo6U2CywQ1VW0xLW45qb4YU786U2E31+RLjYPPMzzOhY+jkBdgdsupHFotxJw18i8giSrX1la+N2qGcUxylXRx+mW17LbfUAZ0SNYmORj8ktQkRxpObZbT9GqcgRrTBLpqFO4ZKW1E0ImDcB/bCQiGr02RK0nrCauzkKK4tC9bxcMJOvd53VFYLntwFk51YF2mnQhCOt1TpJw==", lpUsedDefaultChar=0x0) returned 245 [0069.691] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0069.691] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0069.691] CloseHandle (hObject=0x158) returned 1 [0069.691] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_buttongraphic.png")) returned 0 [0069.691] GetLastError () returned 0x5 [0069.691] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_buttongraphic.png")) returned 0x20 [0069.691] SetLastError (dwErrCode=0x5) [0069.691] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=18995473188) returned 1 [0069.691] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Файл зашифрован [NavigationUp_SelectionSubpicture.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\Файл зашифрован [navigationup_selectionsubpicture.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0069.693] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0069.693] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0069.693] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0069.693] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0069.693] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0069.693] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0069.693] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0069.693] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0069.693] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0069.693] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0069.693] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0069.693] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0069.693] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0069.693] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0069.693] SetEndOfFile (hFile=0x158) returned 1 [0069.693] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0069.694] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0069.694] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0069.694] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0069.694] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0069.695] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0069.695] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i^Ub\"$7LdZZlWDXv\"@*/LS80=K-qz6LO", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0069.695] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i^Ub\"$7LdZZlWDXv\"@*/LS80=K-qz6LO", cchWideChar=32, lpMultiByteStr=0x20377cc, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="i^Ub\"$7LdZZlWDXv\"@*/LS80=K-qz6LO", lpUsedDefaultChar=0x0) returned 32 [0069.695] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0069.695] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0069.695] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_SelectionSubpicture.png", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef8434f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef8434f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 0x295098 [0069.695] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0069.695] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0069.695] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_selectionsubpicture.png")) returned 0x20 [0069.695] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_selectionsubpicture.png")) returned 0x20 [0069.695] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_selectionsubpicture.png")) returned 0x20 [0069.695] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_selectionsubpicture.png")) returned 0x20 [0069.696] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_selectionsubpicture.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef8434f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef8434f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09)) returned 1 [0069.696] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0069.696] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0069.696] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_selectionsubpicture.png")) returned 0x20 [0069.696] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_selectionsubpicture.png")) returned 0x20 [0069.696] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0069.696] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0069.696] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0069.696] SetEndOfFile (hFile=0x158) returned 1 [0069.705] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0069.705] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x203783c, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0069.706] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0069.706] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x203713c, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0069.706] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x203713c, cbMultiByte=36, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="NavigationUp_SelectionSubpicture.pngpngg") returned 36 [0069.706] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0069.706] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x203783c, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0069.706] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0069.706] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0069.706] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0xc09 [0069.706] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0069.706] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0069.706] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0069.706] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0069.706] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x203783c, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0069.706] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0069.707] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x203713c, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0069.707] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x203713c, cbMultiByte=36, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="NavigationUp_SelectionSubpicture.pngre.pngpngg") returned 36 [0069.707] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0069.707] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x203783c, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0069.707] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0069.708] CharToOemA (in: pSrc="NavigationUp_SelectionSubpicture.png", pDst=0x203713c | out: pDst="NavigationUp_SelectionSubpicture.png") returned 1 [0069.708] WriteFile (in: hFile=0x158, lpBuffer=0x203713c*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x203713c*, lpNumberOfBytesWritten=0x18e048*=0x24, lpOverlapped=0x0) returned 1 [0069.708] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0069.708] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0069.708] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0069.708] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=18997144474) returned 1 [0069.708] ReadFile (in: hFile=0x11c, lpBuffer=0x3b549f0, nNumberOfBytesToRead=0xc09, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b549f0*, lpNumberOfBytesRead=0x18dd7c*=0xc09, lpOverlapped=0x0) returned 1 [0069.710] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0069.710] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=18997323674) returned 1 [0069.718] WriteFile (in: hFile=0x158, lpBuffer=0x379ad98*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379ad98*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0069.719] ReadFile (in: hFile=0x11c, lpBuffer=0x3b549f0, nNumberOfBytesToRead=0xc09, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3b549f0*, lpNumberOfBytesRead=0x18de38*=0xc09, lpOverlapped=0x0) returned 1 [0069.719] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x5f [0069.719] WriteFile (in: hFile=0x158, lpBuffer=0x3b96e10*, nNumberOfBytesToWrite=0xc09, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3b96e10*, lpNumberOfBytesWritten=0x18de10*=0xc09, lpOverlapped=0x0) returned 1 [0069.719] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0xc68 [0069.719] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0069.719] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0069.719] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0069.719] SetFilePointer (in: hFile=0x158, lDistanceToMove=36, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x42 [0069.719] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0xc72 [0069.720] CloseHandle (hObject=0x11c) returned 1 [0069.720] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xc72 [0069.720] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xc72 [0069.720] SetFilePointer (in: hFile=0x158, lDistanceToMove=3186, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xc72 [0069.720] SetFilePointer (in: hFile=0x158, lDistanceToMove=3186, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0xc72 [0069.720] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xc72 [0069.720] SetFilePointer (in: hFile=0x158, lDistanceToMove=3186, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0xc72 [0069.720] SetEndOfFile (hFile=0x158) returned 1 [0069.720] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xc72 [0069.720] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xc72 [0069.720] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0069.720] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x203713c, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0069.720] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0069.720] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x203783c, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0069.720] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x203783c, cbMultiByte=36, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="NavigationUp_SelectionSubpicture.pngఉ") returned 36 [0069.721] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0069.721] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x203713c, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0069.721] WriteFile (in: hFile=0x158, lpBuffer=0x3b384c8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3b384c8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0069.721] CharToOemA (in: pSrc="NavigationUp_SelectionSubpicture.png", pDst=0x203783c | out: pDst="NavigationUp_SelectionSubpicture.png") returned 1 [0069.721] WriteFile (in: hFile=0x158, lpBuffer=0x203783c*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x203783c*, lpNumberOfBytesWritten=0x18efcc*=0x24, lpOverlapped=0x0) returned 1 [0069.721] WriteFile (in: hFile=0x158, lpBuffer=0x379ade8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379ade8*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0069.721] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0069.721] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0069.721] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xccf [0069.721] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xccf [0069.721] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0069.721] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0069.721] DeleteFileW (lpFileName="") returned 0 [0069.721] GetLastError () returned 0x3 [0069.721] GetFileAttributesW (lpFileName="") returned 0xffffffff [0069.722] SetLastError (dwErrCode=0x3) [0069.722] FlushFileBuffers (hFile=0x158) returned 1 [0069.725] GetCurrentThreadId () returned 0x970 [0069.725] GetCurrentThreadId () returned 0x970 [0069.725] GetCurrentThreadId () returned 0x970 [0069.725] GetCurrentThreadId () returned 0x970 [0069.725] GetCurrentThreadId () returned 0x970 [0069.725] GetCurrentThreadId () returned 0x970 [0069.725] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xd86 [0069.725] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xd86 [0069.726] SetFilePointer (in: hFile=0x158, lDistanceToMove=3462, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xd86 [0069.726] CloseHandle (hObject=0x158) returned 1 [0069.726] GetCurrentThreadId () returned 0x970 [0069.726] GetCurrentThreadId () returned 0x970 [0069.726] GetCurrentThreadId () returned 0x970 [0069.726] GetCurrentThreadId () returned 0x970 [0069.726] GetCurrentThreadId () returned 0x970 [0069.726] GetCurrentThreadId () returned 0x970 [0069.726] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Файл зашифрован [NavigationUp_SelectionSubpicture.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\Файл зашифрован [navigationup_selectionsubpicture.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0069.726] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd86 [0069.726] SetFilePointer (in: hFile=0x158, lDistanceToMove=3334, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd06 [0069.726] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0069.726] GetFileType (hFile=0x158) returned 0x1 [0069.726] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x10, wMilliseconds=0x3e2)) [0069.726] GetCurrentThreadId () returned 0x970 [0069.726] GetCurrentThreadId () returned 0x970 [0069.726] GetCurrentThreadId () returned 0x970 [0069.726] GetCurrentThreadId () returned 0x970 [0069.726] GetCurrentThreadId () returned 0x970 [0069.726] GetCurrentThreadId () returned 0x970 [0069.726] GetCurrentThreadId () returned 0x970 [0069.726] GetCurrentThreadId () returned 0x970 [0069.726] GetCurrentThreadId () returned 0x970 [0069.726] GetCurrentThreadId () returned 0x970 [0069.727] GetCurrentThreadId () returned 0x970 [0069.727] GetCurrentThreadId () returned 0x970 [0069.727] GetCurrentThreadId () returned 0x970 [0069.727] GetCurrentThreadId () returned 0x970 [0069.727] GetCurrentThreadId () returned 0x970 [0069.727] GetCurrentThreadId () returned 0x970 [0069.727] GetCurrentThreadId () returned 0x970 [0069.727] GetCurrentThreadId () returned 0x970 [0069.727] GetCurrentThreadId () returned 0x970 [0069.727] GetCurrentThreadId () returned 0x970 [0069.727] GetCurrentThreadId () returned 0x970 [0069.727] GetCurrentThreadId () returned 0x970 [0069.727] GetCurrentThreadId () returned 0x970 [0069.727] GetCurrentThreadId () returned 0x970 [0069.727] GetCurrentThreadId () returned 0x970 [0069.727] GetCurrentThreadId () returned 0x970 [0069.727] GetCurrentThreadId () returned 0x970 [0069.727] GetCurrentThreadId () returned 0x970 [0069.727] GetCurrentThreadId () returned 0x970 [0069.727] GetCurrentThreadId () returned 0x970 [0069.727] GetCurrentThreadId () returned 0x970 [0069.727] GetCurrentThreadId () returned 0x970 [0069.727] GetCurrentThreadId () returned 0x970 [0069.727] GetCurrentThreadId () returned 0x970 [0069.727] GetCurrentThreadId () returned 0x970 [0069.727] GetCurrentThreadId () returned 0x970 [0069.727] GetCurrentThreadId () returned 0x970 [0069.727] GetCurrentThreadId () returned 0x970 [0069.727] GetCurrentThreadId () returned 0x970 [0069.727] GetCurrentThreadId () returned 0x970 [0069.727] GetCurrentThreadId () returned 0x970 [0069.727] GetCurrentThreadId () returned 0x970 [0069.727] GetCurrentThreadId () returned 0x970 [0069.727] GetCurrentThreadId () returned 0x970 [0069.727] GetCurrentThreadId () returned 0x970 [0069.727] GetCurrentThreadId () returned 0x970 [0069.727] GetCurrentThreadId () returned 0x970 [0069.727] GetCurrentThreadId () returned 0x970 [0069.727] GetCurrentThreadId () returned 0x970 [0069.728] GetCurrentThreadId () returned 0x970 [0069.728] GetCurrentThreadId () returned 0x970 [0069.728] GetCurrentThreadId () returned 0x970 [0069.728] GetCurrentThreadId () returned 0x970 [0069.728] GetCurrentThreadId () returned 0x970 [0069.728] GetCurrentThreadId () returned 0x970 [0069.728] GetCurrentThreadId () returned 0x970 [0069.728] GetCurrentThreadId () returned 0x970 [0069.728] GetCurrentThreadId () returned 0x970 [0069.728] GetCurrentThreadId () returned 0x970 [0069.728] GetCurrentThreadId () returned 0x970 [0069.728] GetCurrentThreadId () returned 0x970 [0069.728] GetCurrentThreadId () returned 0x970 [0069.728] GetCurrentThreadId () returned 0x970 [0069.728] GetCurrentThreadId () returned 0x970 [0069.728] GetCurrentThreadId () returned 0x970 [0069.728] GetCurrentThreadId () returned 0x970 [0069.728] GetCurrentThreadId () returned 0x970 [0069.728] GetCurrentThreadId () returned 0x970 [0069.728] GetCurrentThreadId () returned 0x970 [0069.728] GetCurrentThreadId () returned 0x970 [0069.728] GetCurrentThreadId () returned 0x970 [0069.728] GetCurrentThreadId () returned 0x970 [0069.728] GetCurrentThreadId () returned 0x970 [0069.728] GetCurrentThreadId () returned 0x970 [0069.728] GetCurrentThreadId () returned 0x970 [0069.728] GetCurrentThreadId () returned 0x970 [0069.728] GetCurrentThreadId () returned 0x970 [0069.728] GetCurrentThreadId () returned 0x970 [0069.728] GetCurrentThreadId () returned 0x970 [0069.728] GetCurrentThreadId () returned 0x970 [0069.728] GetCurrentThreadId () returned 0x970 [0069.728] GetCurrentThreadId () returned 0x970 [0069.728] GetCurrentThreadId () returned 0x970 [0069.728] GetCurrentThreadId () returned 0x970 [0069.728] GetCurrentThreadId () returned 0x970 [0069.728] GetCurrentThreadId () returned 0x970 [0069.728] GetCurrentThreadId () returned 0x970 [0069.728] GetCurrentThreadId () returned 0x970 [0069.728] GetCurrentThreadId () returned 0x970 [0069.728] GetCurrentThreadId () returned 0x970 [0069.728] GetCurrentThreadId () returned 0x970 [0069.728] GetCurrentThreadId () returned 0x970 [0069.729] GetCurrentThreadId () returned 0x970 [0069.729] GetCurrentThreadId () returned 0x970 [0069.729] GetCurrentThreadId () returned 0x970 [0069.729] GetCurrentThreadId () returned 0x970 [0069.729] GetCurrentThreadId () returned 0x970 [0069.729] GetCurrentThreadId () returned 0x970 [0069.729] GetCurrentThreadId () returned 0x970 [0069.729] GetCurrentThreadId () returned 0x970 [0069.729] GetCurrentThreadId () returned 0x970 [0069.729] GetCurrentThreadId () returned 0x970 [0069.729] GetCurrentThreadId () returned 0x970 [0069.729] GetCurrentThreadId () returned 0x970 [0069.729] GetCurrentThreadId () returned 0x970 [0069.729] GetCurrentThreadId () returned 0x970 [0069.729] GetCurrentThreadId () returned 0x970 [0069.729] GetCurrentThreadId () returned 0x970 [0069.729] GetCurrentThreadId () returned 0x970 [0069.729] GetCurrentThreadId () returned 0x970 [0069.729] GetCurrentThreadId () returned 0x970 [0069.729] GetCurrentThreadId () returned 0x970 [0069.729] GetCurrentThreadId () returned 0x970 [0069.729] GetCurrentThreadId () returned 0x970 [0069.729] GetCurrentThreadId () returned 0x970 [0069.729] GetCurrentThreadId () returned 0x970 [0069.729] GetCurrentThreadId () returned 0x970 [0069.729] GetCurrentThreadId () returned 0x970 [0069.729] GetCurrentThreadId () returned 0x970 [0069.729] GetCurrentThreadId () returned 0x970 [0069.729] GetCurrentThreadId () returned 0x970 [0069.729] GetCurrentThreadId () returned 0x970 [0069.729] GetCurrentThreadId () returned 0x970 [0069.729] GetCurrentThreadId () returned 0x970 [0069.729] GetCurrentThreadId () returned 0x970 [0069.729] GetCurrentThreadId () returned 0x970 [0069.729] GetCurrentThreadId () returned 0x970 [0069.729] GetCurrentThreadId () returned 0x970 [0069.729] GetCurrentThreadId () returned 0x970 [0069.729] GetCurrentThreadId () returned 0x970 [0069.729] GetCurrentThreadId () returned 0x970 [0069.729] GetCurrentThreadId () returned 0x970 [0069.729] GetCurrentThreadId () returned 0x970 [0069.729] GetCurrentThreadId () returned 0x970 [0069.729] GetCurrentThreadId () returned 0x970 [0069.730] GetCurrentThreadId () returned 0x970 [0069.730] GetCurrentThreadId () returned 0x970 [0069.730] GetCurrentThreadId () returned 0x970 [0069.730] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0069.730] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0069.730] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379d998, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0069.730] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0069.730] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0069.730] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379d998, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0069.730] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0069.730] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0069.730] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0069.730] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0069.730] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0069.730] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0069.730] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0069.730] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0069.730] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379d9f8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0069.730] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0069.730] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0069.730] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379d9f8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0069.730] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0069.730] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0069.730] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379d9f8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0069.730] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x11, wMilliseconds=0x9)) [0069.730] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="i^Ub\"$7LdZZlWDXv\"@*/LS80=K-qz6LO", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0069.730] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="i^Ub\"$7LdZZlWDXv\"@*/LS80=K-qz6LO", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0069.730] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="i^Ub\"$7LdZZlWDXv\"@*/LS80=K-qz6LO", cchWideChar=32, lpMultiByteStr=0x2004af8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="i^Ub\"$7LdZZlWDXv\"@*/LS80=K-qz6LO", lpUsedDefaultChar=0x0) returned 32 [0069.730] GetCurrentThreadId () returned 0x970 [0069.731] GetCurrentThreadId () returned 0x970 [0069.731] GetCurrentThreadId () returned 0x970 [0069.731] GetCurrentThreadId () returned 0x970 [0069.731] GetCurrentThreadId () returned 0x970 [0069.731] GetCurrentThreadId () returned 0x970 [0069.738] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0069.738] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0069.738] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x37b2d48, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0069.738] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ec448, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0069.738] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ec448, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAACQ4nN/ZSLqY5iAFSjqPMrksmWI12jkKUfwLk7+2WOVd0wrDhgAkyF5sKqEqFdi5tryNRcji3mvJDU7CmSGLfbeg7NxoRZp6GtM+09Vtod/tmXoKP2uiqj2FaztYS4lHKHCVSvBC4wErewNDTTJ7jwKI7reghk3QZvfYsmdaDmKUZmi/Pgs7n3FY8Uc1LMnm5EVs8gAZkG2DGnsGzVPJmMAoEwK59tjkAw==") returned 232 [0069.738] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x11, wMilliseconds=0x9)) [0069.738] GetCurrentThreadId () returned 0x970 [0069.738] GetCurrentThreadId () returned 0x970 [0069.738] GetCurrentThreadId () returned 0x970 [0069.738] GetCurrentThreadId () returned 0x970 [0069.738] GetCurrentThreadId () returned 0x970 [0069.738] GetCurrentThreadId () returned 0x970 [0069.738] GetCurrentThreadId () returned 0x970 [0069.738] GetCurrentThreadId () returned 0x970 [0069.738] GetCurrentThreadId () returned 0x970 [0069.738] GetCurrentThreadId () returned 0x970 [0069.738] GetCurrentThreadId () returned 0x970 [0069.738] GetCurrentThreadId () returned 0x970 [0069.738] GetCurrentThreadId () returned 0x970 [0069.739] GetCurrentThreadId () returned 0x970 [0069.739] GetCurrentThreadId () returned 0x970 [0069.739] GetCurrentThreadId () returned 0x970 [0069.739] GetCurrentThreadId () returned 0x970 [0069.739] GetCurrentThreadId () returned 0x970 [0069.739] GetCurrentThreadId () returned 0x970 [0069.739] GetCurrentThreadId () returned 0x970 [0069.739] GetCurrentThreadId () returned 0x970 [0069.739] GetCurrentThreadId () returned 0x970 [0069.739] GetCurrentThreadId () returned 0x970 [0069.739] GetCurrentThreadId () returned 0x970 [0069.739] GetCurrentThreadId () returned 0x970 [0069.739] GetCurrentThreadId () returned 0x970 [0069.739] GetCurrentThreadId () returned 0x970 [0069.739] GetCurrentThreadId () returned 0x970 [0069.739] GetCurrentThreadId () returned 0x970 [0069.739] GetCurrentThreadId () returned 0x970 [0069.739] GetCurrentThreadId () returned 0x970 [0069.739] GetCurrentThreadId () returned 0x970 [0069.739] GetCurrentThreadId () returned 0x970 [0069.739] GetCurrentThreadId () returned 0x970 [0069.739] GetCurrentThreadId () returned 0x970 [0069.739] GetCurrentThreadId () returned 0x970 [0069.739] GetCurrentThreadId () returned 0x970 [0069.739] GetCurrentThreadId () returned 0x970 [0069.739] GetCurrentThreadId () returned 0x970 [0069.739] GetCurrentThreadId () returned 0x970 [0069.739] GetCurrentThreadId () returned 0x970 [0069.739] GetCurrentThreadId () returned 0x970 [0069.739] GetCurrentThreadId () returned 0x970 [0069.739] GetCurrentThreadId () returned 0x970 [0069.739] GetCurrentThreadId () returned 0x970 [0069.739] GetCurrentThreadId () returned 0x970 [0069.739] GetCurrentThreadId () returned 0x970 [0069.739] GetCurrentThreadId () returned 0x970 [0069.739] GetCurrentThreadId () returned 0x970 [0069.739] GetCurrentThreadId () returned 0x970 [0069.739] GetCurrentThreadId () returned 0x970 [0069.739] GetCurrentThreadId () returned 0x970 [0069.739] GetCurrentThreadId () returned 0x970 [0069.739] GetCurrentThreadId () returned 0x970 [0069.739] GetCurrentThreadId () returned 0x970 [0069.739] GetCurrentThreadId () returned 0x970 [0069.739] GetCurrentThreadId () returned 0x970 [0069.740] GetCurrentThreadId () returned 0x970 [0069.740] GetCurrentThreadId () returned 0x970 [0069.740] GetCurrentThreadId () returned 0x970 [0069.740] GetCurrentThreadId () returned 0x970 [0069.740] GetCurrentThreadId () returned 0x970 [0069.740] GetCurrentThreadId () returned 0x970 [0069.740] GetCurrentThreadId () returned 0x970 [0069.740] GetCurrentThreadId () returned 0x970 [0069.740] GetCurrentThreadId () returned 0x970 [0069.740] GetCurrentThreadId () returned 0x970 [0069.740] GetCurrentThreadId () returned 0x970 [0069.740] GetCurrentThreadId () returned 0x970 [0069.740] GetCurrentThreadId () returned 0x970 [0069.740] GetCurrentThreadId () returned 0x970 [0069.740] GetCurrentThreadId () returned 0x970 [0069.740] GetCurrentThreadId () returned 0x970 [0069.740] GetCurrentThreadId () returned 0x970 [0069.740] GetCurrentThreadId () returned 0x970 [0069.740] GetCurrentThreadId () returned 0x970 [0069.740] GetCurrentThreadId () returned 0x970 [0069.740] GetCurrentThreadId () returned 0x970 [0069.740] GetCurrentThreadId () returned 0x970 [0069.740] GetCurrentThreadId () returned 0x970 [0069.740] GetCurrentThreadId () returned 0x970 [0069.740] GetCurrentThreadId () returned 0x970 [0069.740] GetCurrentThreadId () returned 0x970 [0069.740] GetCurrentThreadId () returned 0x970 [0069.740] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAACQ4nN/ZSLqY5iAFSjqPMrksmWI12jkKUfwLk7+2WOVd0wrDhgAkyF5sKqEqFdi5tryNRcji3mvJDU7CmSGLfbeg7NxoRZp6GtM+09Vtod/tmXoKP2uiqj2FaztYS4lHKHCVSvBC4wErewNDTTJ7jwKI7reghk3QZvfYsmdaDmKUZmi/Pgs7n3FY8Uc1LMnm5EVs8gAZkG2DGnsGzVPJmMAoEwK59tjkAw==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0069.740] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAACQ4nN/ZSLqY5iAFSjqPMrksmWI12jkKUfwLk7+2WOVd0wrDhgAkyF5sKqEqFdi5tryNRcji3mvJDU7CmSGLfbeg7NxoRZp6GtM+09Vtod/tmXoKP2uiqj2FaztYS4lHKHCVSvBC4wErewNDTTJ7jwKI7reghk3QZvfYsmdaDmKUZmi/Pgs7n3FY8Uc1LMnm5EVs8gAZkG2DGnsGzVPJmMAoEwK59tjkAw==", cchWideChar=245, lpMultiByteStr=0x353a10c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAACQ4nN/ZSLqY5iAFSjqPMrksmWI12jkKUfwLk7+2WOVd0wrDhgAkyF5sKqEqFdi5tryNRcji3mvJDU7CmSGLfbeg7NxoRZp6GtM+09Vtod/tmXoKP2uiqj2FaztYS4lHKHCVSvBC4wErewNDTTJ7jwKI7reghk3QZvfYsmdaDmKUZmi/Pgs7n3FY8Uc1LMnm5EVs8gAZkG2DGnsGzVPJmMAoEwK59tjkAw==", lpUsedDefaultChar=0x0) returned 245 [0069.740] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0069.740] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0069.741] CloseHandle (hObject=0x158) returned 1 [0069.741] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_selectionsubpicture.png")) returned 0 [0069.741] GetLastError () returned 0x5 [0069.741] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_selectionsubpicture.png")) returned 0x20 [0069.741] SetLastError (dwErrCode=0x5) [0069.741] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=19000437835) returned 1 [0069.741] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\Файл зашифрован [1047x576black.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\Файл зашифрован [1047x576black.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0069.742] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0069.742] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0069.742] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0069.742] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0069.742] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0069.742] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0069.743] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0069.743] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0069.743] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0069.743] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0069.743] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0069.743] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0069.743] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0069.743] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0069.743] SetEndOfFile (hFile=0x158) returned 1 [0069.743] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0069.743] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0069.743] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0069.743] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0069.743] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0069.744] WriteFile (in: hFile=0x158, lpBuffer=0x35f035c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f035c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0069.744] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f9*=}L.Th:<{0:cd?*IOKa$S.$INjm?!", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0069.744] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f9*=}L.Th:<{0:cd?*IOKa$S.$INjm?!", cchWideChar=32, lpMultiByteStr=0x2037874, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="f9*=}L.Th:<{0:cd?*IOKa$S.$INjm?!", lpUsedDefaultChar=0x0) returned 32 [0069.744] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0069.744] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0069.744] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fcc1ca4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fcc1ca4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 0x295098 [0069.745] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0069.745] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0069.745] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\1047x576black.png")) returned 0x20 [0069.745] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\1047x576black.png")) returned 0x20 [0069.745] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\1047x576black.png")) returned 0x20 [0069.745] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\1047x576black.png")) returned 0x20 [0069.745] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\1047x576black.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fcc1ca4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fcc1ca4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da)) returned 1 [0069.745] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0069.745] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0069.745] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\1047x576black.png")) returned 0x20 [0069.745] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\1047x576black.png")) returned 0x20 [0069.745] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0069.745] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0069.745] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0069.745] SetEndOfFile (hFile=0x158) returned 1 [0069.746] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0069.746] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x1ff899c, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x0) returned 17 [0069.746] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0069.746] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x1ff88ac, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x0) returned 17 [0069.746] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff88ac, cbMultiByte=17, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="1047x576black.pngubpicture.pngre.pngpngg") returned 17 [0069.747] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0069.747] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x1ff899c, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x0) returned 17 [0069.747] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\1047x576black.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0069.747] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0069.747] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x11da [0069.747] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0069.747] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0069.747] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0069.747] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0069.747] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x1ff899c, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x0) returned 17 [0069.747] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0069.747] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x1ff88ac, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x0) returned 17 [0069.747] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff88ac, cbMultiByte=17, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="1047x576black.pngck.pngubpicture.pngre.pngpngg") returned 17 [0069.747] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0069.747] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x1ff899c, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x0) returned 17 [0069.748] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0069.748] CharToOemA (in: pSrc="1047x576black.png", pDst=0x1ff88ac | out: pDst="1047x576black.png") returned 1 [0069.748] WriteFile (in: hFile=0x158, lpBuffer=0x1ff88ac*, nNumberOfBytesToWrite=0x11, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1ff88ac*, lpNumberOfBytesWritten=0x18e048*=0x11, lpOverlapped=0x0) returned 1 [0069.748] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0069.749] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0069.749] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0069.749] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=19001222041) returned 1 [0069.749] ReadFile (in: hFile=0x11c, lpBuffer=0x3b549f0, nNumberOfBytesToRead=0x11da, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b549f0*, lpNumberOfBytesRead=0x18dd7c*=0x11da, lpOverlapped=0x0) returned 1 [0069.750] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0069.750] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=19001372666) returned 1 [0069.759] WriteFile (in: hFile=0x158, lpBuffer=0x379acd8*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379acd8*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0069.759] ReadFile (in: hFile=0x11c, lpBuffer=0x3b549f0, nNumberOfBytesToRead=0x11da, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3b549f0*, lpNumberOfBytesRead=0x18de38*=0x11da, lpOverlapped=0x0) returned 1 [0069.759] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x4c [0069.759] WriteFile (in: hFile=0x158, lpBuffer=0x3b97410*, nNumberOfBytesToWrite=0x11da, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3b97410*, lpNumberOfBytesWritten=0x18de10*=0x11da, lpOverlapped=0x0) returned 1 [0069.760] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x1226 [0069.760] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0069.760] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0069.760] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0069.760] SetFilePointer (in: hFile=0x158, lDistanceToMove=17, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2f [0069.760] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x1230 [0069.760] CloseHandle (hObject=0x11c) returned 1 [0069.760] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1230 [0069.760] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1230 [0069.760] SetFilePointer (in: hFile=0x158, lDistanceToMove=4656, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1230 [0069.760] SetFilePointer (in: hFile=0x158, lDistanceToMove=4656, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x1230 [0069.760] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1230 [0069.760] SetFilePointer (in: hFile=0x158, lDistanceToMove=4656, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x1230 [0069.760] SetEndOfFile (hFile=0x158) returned 1 [0069.761] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1230 [0069.761] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1230 [0069.761] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0069.761] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x1ff88ac, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x0) returned 17 [0069.761] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0069.761] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x1ff899c, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x0) returned 17 [0069.761] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff899c, cbMultiByte=17, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="1047x576black.png\x18믉`믑`") returned 17 [0069.761] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0069.761] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x1ff88ac, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x0) returned 17 [0069.761] WriteFile (in: hFile=0x158, lpBuffer=0x3b384c8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3b384c8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0069.762] CharToOemA (in: pSrc="1047x576black.png", pDst=0x1ff899c | out: pDst="1047x576black.png") returned 1 [0069.762] WriteFile (in: hFile=0x158, lpBuffer=0x1ff899c*, nNumberOfBytesToWrite=0x11, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1ff899c*, lpNumberOfBytesWritten=0x18efcc*=0x11, lpOverlapped=0x0) returned 1 [0069.762] WriteFile (in: hFile=0x158, lpBuffer=0x379ae18*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379ae18*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0069.762] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0069.762] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0069.762] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x127a [0069.762] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x127a [0069.762] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0069.762] WriteFile (in: hFile=0x158, lpBuffer=0x35f035c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f035c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0069.762] DeleteFileW (lpFileName="") returned 0 [0069.762] GetLastError () returned 0x3 [0069.762] GetFileAttributesW (lpFileName="") returned 0xffffffff [0069.762] SetLastError (dwErrCode=0x3) [0069.762] FlushFileBuffers (hFile=0x158) returned 1 [0069.766] GetCurrentThreadId () returned 0x970 [0069.766] GetCurrentThreadId () returned 0x970 [0069.766] GetCurrentThreadId () returned 0x970 [0069.766] GetCurrentThreadId () returned 0x970 [0069.766] GetCurrentThreadId () returned 0x970 [0069.766] GetCurrentThreadId () returned 0x970 [0069.766] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x1331 [0069.766] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x1331 [0069.766] SetFilePointer (in: hFile=0x158, lDistanceToMove=4913, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x1331 [0069.766] CloseHandle (hObject=0x158) returned 1 [0069.766] GetCurrentThreadId () returned 0x970 [0069.766] GetCurrentThreadId () returned 0x970 [0069.766] GetCurrentThreadId () returned 0x970 [0069.766] GetCurrentThreadId () returned 0x970 [0069.767] GetCurrentThreadId () returned 0x970 [0069.767] GetCurrentThreadId () returned 0x970 [0069.767] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\Файл зашифрован [1047x576black.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\Файл зашифрован [1047x576black.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0069.767] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1331 [0069.767] SetFilePointer (in: hFile=0x158, lDistanceToMove=4785, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x12b1 [0069.767] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0069.767] GetFileType (hFile=0x158) returned 0x1 [0069.767] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x11, wMilliseconds=0x28)) [0069.767] GetCurrentThreadId () returned 0x970 [0069.767] GetCurrentThreadId () returned 0x970 [0069.767] GetCurrentThreadId () returned 0x970 [0069.767] GetCurrentThreadId () returned 0x970 [0069.767] GetCurrentThreadId () returned 0x970 [0069.767] GetCurrentThreadId () returned 0x970 [0069.767] GetCurrentThreadId () returned 0x970 [0069.767] GetCurrentThreadId () returned 0x970 [0069.767] GetCurrentThreadId () returned 0x970 [0069.767] GetCurrentThreadId () returned 0x970 [0069.767] GetCurrentThreadId () returned 0x970 [0069.767] GetCurrentThreadId () returned 0x970 [0069.767] GetCurrentThreadId () returned 0x970 [0069.767] GetCurrentThreadId () returned 0x970 [0069.767] GetCurrentThreadId () returned 0x970 [0069.767] GetCurrentThreadId () returned 0x970 [0069.767] GetCurrentThreadId () returned 0x970 [0069.767] GetCurrentThreadId () returned 0x970 [0069.767] GetCurrentThreadId () returned 0x970 [0069.767] GetCurrentThreadId () returned 0x970 [0069.767] GetCurrentThreadId () returned 0x970 [0069.767] GetCurrentThreadId () returned 0x970 [0069.767] GetCurrentThreadId () returned 0x970 [0069.767] GetCurrentThreadId () returned 0x970 [0069.767] GetCurrentThreadId () returned 0x970 [0069.768] GetCurrentThreadId () returned 0x970 [0069.768] GetCurrentThreadId () returned 0x970 [0069.768] GetCurrentThreadId () returned 0x970 [0069.768] GetCurrentThreadId () returned 0x970 [0069.768] GetCurrentThreadId () returned 0x970 [0069.768] GetCurrentThreadId () returned 0x970 [0069.768] GetCurrentThreadId () returned 0x970 [0069.768] GetCurrentThreadId () returned 0x970 [0069.768] GetCurrentThreadId () returned 0x970 [0069.768] GetCurrentThreadId () returned 0x970 [0069.768] GetCurrentThreadId () returned 0x970 [0069.768] GetCurrentThreadId () returned 0x970 [0069.768] GetCurrentThreadId () returned 0x970 [0069.768] GetCurrentThreadId () returned 0x970 [0069.768] GetCurrentThreadId () returned 0x970 [0069.768] GetCurrentThreadId () returned 0x970 [0069.768] GetCurrentThreadId () returned 0x970 [0069.768] GetCurrentThreadId () returned 0x970 [0069.768] GetCurrentThreadId () returned 0x970 [0069.768] GetCurrentThreadId () returned 0x970 [0069.768] GetCurrentThreadId () returned 0x970 [0069.768] GetCurrentThreadId () returned 0x970 [0069.768] GetCurrentThreadId () returned 0x970 [0069.768] GetCurrentThreadId () returned 0x970 [0069.768] GetCurrentThreadId () returned 0x970 [0069.768] GetCurrentThreadId () returned 0x970 [0069.768] GetCurrentThreadId () returned 0x970 [0069.768] GetCurrentThreadId () returned 0x970 [0069.768] GetCurrentThreadId () returned 0x970 [0069.768] GetCurrentThreadId () returned 0x970 [0069.768] GetCurrentThreadId () returned 0x970 [0069.768] GetCurrentThreadId () returned 0x970 [0069.768] GetCurrentThreadId () returned 0x970 [0069.768] GetCurrentThreadId () returned 0x970 [0069.768] GetCurrentThreadId () returned 0x970 [0069.768] GetCurrentThreadId () returned 0x970 [0069.768] GetCurrentThreadId () returned 0x970 [0069.768] GetCurrentThreadId () returned 0x970 [0069.768] GetCurrentThreadId () returned 0x970 [0069.768] GetCurrentThreadId () returned 0x970 [0069.768] GetCurrentThreadId () returned 0x970 [0069.768] GetCurrentThreadId () returned 0x970 [0069.768] GetCurrentThreadId () returned 0x970 [0069.768] GetCurrentThreadId () returned 0x970 [0069.768] GetCurrentThreadId () returned 0x970 [0069.769] GetCurrentThreadId () returned 0x970 [0069.769] GetCurrentThreadId () returned 0x970 [0069.769] GetCurrentThreadId () returned 0x970 [0069.769] GetCurrentThreadId () returned 0x970 [0069.769] GetCurrentThreadId () returned 0x970 [0069.769] GetCurrentThreadId () returned 0x970 [0069.769] GetCurrentThreadId () returned 0x970 [0069.769] GetCurrentThreadId () returned 0x970 [0069.769] GetCurrentThreadId () returned 0x970 [0069.769] GetCurrentThreadId () returned 0x970 [0069.769] GetCurrentThreadId () returned 0x970 [0069.769] GetCurrentThreadId () returned 0x970 [0069.769] GetCurrentThreadId () returned 0x970 [0069.769] GetCurrentThreadId () returned 0x970 [0069.769] GetCurrentThreadId () returned 0x970 [0069.769] GetCurrentThreadId () returned 0x970 [0069.769] GetCurrentThreadId () returned 0x970 [0069.769] GetCurrentThreadId () returned 0x970 [0069.769] GetCurrentThreadId () returned 0x970 [0069.769] GetCurrentThreadId () returned 0x970 [0069.769] GetCurrentThreadId () returned 0x970 [0069.769] GetCurrentThreadId () returned 0x970 [0069.769] GetCurrentThreadId () returned 0x970 [0069.769] GetCurrentThreadId () returned 0x970 [0069.769] GetCurrentThreadId () returned 0x970 [0069.769] GetCurrentThreadId () returned 0x970 [0069.769] GetCurrentThreadId () returned 0x970 [0069.769] GetCurrentThreadId () returned 0x970 [0069.769] GetCurrentThreadId () returned 0x970 [0069.769] GetCurrentThreadId () returned 0x970 [0069.769] GetCurrentThreadId () returned 0x970 [0069.769] GetCurrentThreadId () returned 0x970 [0069.769] GetCurrentThreadId () returned 0x970 [0069.769] GetCurrentThreadId () returned 0x970 [0069.769] GetCurrentThreadId () returned 0x970 [0069.769] GetCurrentThreadId () returned 0x970 [0069.769] GetCurrentThreadId () returned 0x970 [0069.769] GetCurrentThreadId () returned 0x970 [0069.769] GetCurrentThreadId () returned 0x970 [0069.769] GetCurrentThreadId () returned 0x970 [0069.769] GetCurrentThreadId () returned 0x970 [0069.769] GetCurrentThreadId () returned 0x970 [0069.769] GetCurrentThreadId () returned 0x970 [0069.769] GetCurrentThreadId () returned 0x970 [0069.770] GetCurrentThreadId () returned 0x970 [0069.770] GetCurrentThreadId () returned 0x970 [0069.770] GetCurrentThreadId () returned 0x970 [0069.770] GetCurrentThreadId () returned 0x970 [0069.770] GetCurrentThreadId () returned 0x970 [0069.770] GetCurrentThreadId () returned 0x970 [0069.770] GetCurrentThreadId () returned 0x970 [0069.770] GetCurrentThreadId () returned 0x970 [0069.770] GetCurrentThreadId () returned 0x970 [0069.770] GetCurrentThreadId () returned 0x970 [0069.770] GetCurrentThreadId () returned 0x970 [0069.770] GetCurrentThreadId () returned 0x970 [0069.770] GetCurrentThreadId () returned 0x970 [0069.770] GetCurrentThreadId () returned 0x970 [0069.770] GetCurrentThreadId () returned 0x970 [0069.770] GetCurrentThreadId () returned 0x970 [0069.770] GetCurrentThreadId () returned 0x970 [0069.770] GetCurrentThreadId () returned 0x970 [0069.770] GetCurrentThreadId () returned 0x970 [0069.770] GetCurrentThreadId () returned 0x970 [0069.770] GetCurrentThreadId () returned 0x970 [0069.770] GetCurrentThreadId () returned 0x970 [0069.770] GetCurrentThreadId () returned 0x970 [0069.770] GetCurrentThreadId () returned 0x970 [0069.770] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0069.770] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0069.770] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379d9f8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0069.770] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0069.770] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0069.770] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379d9f8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0069.770] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0069.770] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0069.770] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0069.770] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0069.770] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0069.770] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0069.770] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0069.770] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0069.770] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379da58, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0069.771] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0069.771] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0069.771] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379da58, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0069.771] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0069.771] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0069.771] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379da58, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0069.771] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x11, wMilliseconds=0x28)) [0069.771] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="f9*=}L.Th:<{0:cd?*IOKa$S.$INjm?!", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0069.771] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="f9*=}L.Th:<{0:cd?*IOKa$S.$INjm?!", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0069.771] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="f9*=}L.Th:<{0:cd?*IOKa$S.$INjm?!", cchWideChar=32, lpMultiByteStr=0x2004b28, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="f9*=}L.Th:<{0:cd?*IOKa$S.$INjm?!", lpUsedDefaultChar=0x0) returned 32 [0069.771] GetCurrentThreadId () returned 0x970 [0069.771] GetCurrentThreadId () returned 0x970 [0069.771] GetCurrentThreadId () returned 0x970 [0069.771] GetCurrentThreadId () returned 0x970 [0069.771] GetCurrentThreadId () returned 0x970 [0069.771] GetCurrentThreadId () returned 0x970 [0069.778] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0069.778] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0069.778] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x37b2d98, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0069.778] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ec348, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0069.779] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ec348, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAHTjl0I76c6o+m6wK2nx/gwdvn7kHjlsU+R4oiCRDG11A+1i48dHbNxMonya6o1MngDoSf4JdejKkFVcryqYOxDx8C6ViTzIks4grH4z1rur3hf6opFej/xbeOlwJI2nFyFXXOl8lPRmv71qWbtRTIbggvd8Y3D52QUMeu4rq99Simq/+doXyufi4YYzg4LxoGQLrM1rXMyMS1eskOOKa7DgidJIkR4+Pg==") returned 232 [0069.779] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x11, wMilliseconds=0x38)) [0069.779] GetCurrentThreadId () returned 0x970 [0069.779] GetCurrentThreadId () returned 0x970 [0069.779] GetCurrentThreadId () returned 0x970 [0069.779] GetCurrentThreadId () returned 0x970 [0069.779] GetCurrentThreadId () returned 0x970 [0069.779] GetCurrentThreadId () returned 0x970 [0069.779] GetCurrentThreadId () returned 0x970 [0069.779] GetCurrentThreadId () returned 0x970 [0069.779] GetCurrentThreadId () returned 0x970 [0069.779] GetCurrentThreadId () returned 0x970 [0069.779] GetCurrentThreadId () returned 0x970 [0069.779] GetCurrentThreadId () returned 0x970 [0069.779] GetCurrentThreadId () returned 0x970 [0069.779] GetCurrentThreadId () returned 0x970 [0069.779] GetCurrentThreadId () returned 0x970 [0069.779] GetCurrentThreadId () returned 0x970 [0069.779] GetCurrentThreadId () returned 0x970 [0069.779] GetCurrentThreadId () returned 0x970 [0069.779] GetCurrentThreadId () returned 0x970 [0069.779] GetCurrentThreadId () returned 0x970 [0069.779] GetCurrentThreadId () returned 0x970 [0069.779] GetCurrentThreadId () returned 0x970 [0069.779] GetCurrentThreadId () returned 0x970 [0069.779] GetCurrentThreadId () returned 0x970 [0069.779] GetCurrentThreadId () returned 0x970 [0069.779] GetCurrentThreadId () returned 0x970 [0069.779] GetCurrentThreadId () returned 0x970 [0069.779] GetCurrentThreadId () returned 0x970 [0069.779] GetCurrentThreadId () returned 0x970 [0069.779] GetCurrentThreadId () returned 0x970 [0069.779] GetCurrentThreadId () returned 0x970 [0069.779] GetCurrentThreadId () returned 0x970 [0069.779] GetCurrentThreadId () returned 0x970 [0069.779] GetCurrentThreadId () returned 0x970 [0069.779] GetCurrentThreadId () returned 0x970 [0069.779] GetCurrentThreadId () returned 0x970 [0069.779] GetCurrentThreadId () returned 0x970 [0069.779] GetCurrentThreadId () returned 0x970 [0069.779] GetCurrentThreadId () returned 0x970 [0069.779] GetCurrentThreadId () returned 0x970 [0069.779] GetCurrentThreadId () returned 0x970 [0069.779] GetCurrentThreadId () returned 0x970 [0069.780] GetCurrentThreadId () returned 0x970 [0069.780] GetCurrentThreadId () returned 0x970 [0069.780] GetCurrentThreadId () returned 0x970 [0069.780] GetCurrentThreadId () returned 0x970 [0069.780] GetCurrentThreadId () returned 0x970 [0069.780] GetCurrentThreadId () returned 0x970 [0069.780] GetCurrentThreadId () returned 0x970 [0069.780] GetCurrentThreadId () returned 0x970 [0069.780] GetCurrentThreadId () returned 0x970 [0069.780] GetCurrentThreadId () returned 0x970 [0069.780] GetCurrentThreadId () returned 0x970 [0069.780] GetCurrentThreadId () returned 0x970 [0069.780] GetCurrentThreadId () returned 0x970 [0069.780] GetCurrentThreadId () returned 0x970 [0069.780] GetCurrentThreadId () returned 0x970 [0069.780] GetCurrentThreadId () returned 0x970 [0069.780] GetCurrentThreadId () returned 0x970 [0069.780] GetCurrentThreadId () returned 0x970 [0069.780] GetCurrentThreadId () returned 0x970 [0069.780] GetCurrentThreadId () returned 0x970 [0069.780] GetCurrentThreadId () returned 0x970 [0069.780] GetCurrentThreadId () returned 0x970 [0069.780] GetCurrentThreadId () returned 0x970 [0069.780] GetCurrentThreadId () returned 0x970 [0069.780] GetCurrentThreadId () returned 0x970 [0069.780] GetCurrentThreadId () returned 0x970 [0069.780] GetCurrentThreadId () returned 0x970 [0069.780] GetCurrentThreadId () returned 0x970 [0069.780] GetCurrentThreadId () returned 0x970 [0069.780] GetCurrentThreadId () returned 0x970 [0069.780] GetCurrentThreadId () returned 0x970 [0069.780] GetCurrentThreadId () returned 0x970 [0069.780] GetCurrentThreadId () returned 0x970 [0069.780] GetCurrentThreadId () returned 0x970 [0069.780] GetCurrentThreadId () returned 0x970 [0069.780] GetCurrentThreadId () returned 0x970 [0069.780] GetCurrentThreadId () returned 0x970 [0069.780] GetCurrentThreadId () returned 0x970 [0069.780] GetCurrentThreadId () returned 0x970 [0069.780] GetCurrentThreadId () returned 0x970 [0069.780] GetCurrentThreadId () returned 0x970 [0069.780] GetCurrentThreadId () returned 0x970 [0069.780] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAHTjl0I76c6o+m6wK2nx/gwdvn7kHjlsU+R4oiCRDG11A+1i48dHbNxMonya6o1MngDoSf4JdejKkFVcryqYOxDx8C6ViTzIks4grH4z1rur3hf6opFej/xbeOlwJI2nFyFXXOl8lPRmv71qWbtRTIbggvd8Y3D52QUMeu4rq99Simq/+doXyufi4YYzg4LxoGQLrM1rXMyMS1eskOOKa7DgidJIkR4+Pg==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0069.780] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAHTjl0I76c6o+m6wK2nx/gwdvn7kHjlsU+R4oiCRDG11A+1i48dHbNxMonya6o1MngDoSf4JdejKkFVcryqYOxDx8C6ViTzIks4grH4z1rur3hf6opFej/xbeOlwJI2nFyFXXOl8lPRmv71qWbtRTIbggvd8Y3D52QUMeu4rq99Simq/+doXyufi4YYzg4LxoGQLrM1rXMyMS1eskOOKa7DgidJIkR4+Pg==", cchWideChar=245, lpMultiByteStr=0x353a10c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAHTjl0I76c6o+m6wK2nx/gwdvn7kHjlsU+R4oiCRDG11A+1i48dHbNxMonya6o1MngDoSf4JdejKkFVcryqYOxDx8C6ViTzIks4grH4z1rur3hf6opFej/xbeOlwJI2nFyFXXOl8lPRmv71qWbtRTIbggvd8Y3D52QUMeu4rq99Simq/+doXyufi4YYzg4LxoGQLrM1rXMyMS1eskOOKa7DgidJIkR4+Pg==", lpUsedDefaultChar=0x0) returned 245 [0069.781] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0069.781] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0069.781] CloseHandle (hObject=0x158) returned 1 [0069.781] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\1047x576black.png")) returned 0 [0069.781] GetLastError () returned 0x5 [0069.781] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\1047x576black.png")) returned 0x20 [0069.781] SetLastError (dwErrCode=0x5) [0069.781] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=19004463081) returned 1 [0069.781] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\Файл зашифрован [15x15dot.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\Файл зашифрован [15x15dot.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0069.782] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0069.782] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0069.782] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0069.782] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0069.782] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0069.782] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0069.782] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0069.782] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0069.782] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0069.782] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0069.782] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0069.782] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0069.782] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0069.782] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0069.783] SetEndOfFile (hFile=0x158) returned 1 [0069.783] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0069.783] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0069.783] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0069.783] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0069.783] WriteFile (in: hFile=0x158, lpBuffer=0x3777058*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777058*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0069.784] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0069.784] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=",Y3F9f(peJ)8>QUMx6C*5*,XQ^u~qV4h", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0069.784] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=",Y3F9f(peJ)8>QUMx6C*5*,XQ^u~qV4h", cchWideChar=32, lpMultiByteStr=0x2037804, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=",Y3F9f(peJ)8>QUMx6C*5*,XQ^u~qV4h", lpUsedDefaultChar=0x0) returned 32 [0069.784] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0069.784] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0069.784] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fce7e01, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fce7e01, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0x0, dwReserved1=0x0, cFileName="15x15dot.png", cAlternateFileName="")) returned 0x295098 [0069.784] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0069.784] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0069.784] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\15x15dot.png")) returned 0x20 [0069.785] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\15x15dot.png")) returned 0x20 [0069.785] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\15x15dot.png")) returned 0x20 [0069.785] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\15x15dot.png")) returned 0x20 [0069.785] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\15x15dot.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fce7e01, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fce7e01, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05)) returned 1 [0069.785] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0069.785] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0069.785] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\15x15dot.png")) returned 0x20 [0069.785] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\15x15dot.png")) returned 0x20 [0069.785] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0069.785] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0069.785] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0069.785] SetEndOfFile (hFile=0x158) returned 1 [0069.786] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0069.786] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x1fe478c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="15x15dot.png", lpUsedDefaultChar=0x0) returned 12 [0069.786] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0069.786] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x1fe658c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="15x15dot.png", lpUsedDefaultChar=0x0) returned 12 [0069.786] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe658c, cbMultiByte=12, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="15x15dot.pngk.pngubpicture.pngre.pngpngg") returned 12 [0069.786] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0069.786] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x1fe478c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="15x15dot.png", lpUsedDefaultChar=0x0) returned 12 [0069.786] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\15x15dot.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0069.787] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0069.787] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0xb05 [0069.787] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0069.787] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0069.787] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0069.787] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0069.787] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x1fe478c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="15x15dot.png", lpUsedDefaultChar=0x0) returned 12 [0069.787] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0069.787] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x1fe658c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="15x15dot.png", lpUsedDefaultChar=0x0) returned 12 [0069.787] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe658c, cbMultiByte=12, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="15x15dot.pngot.pngk.pngubpicture.pngre.pngpngg") returned 12 [0069.787] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0069.787] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x1fe478c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="15x15dot.png", lpUsedDefaultChar=0x0) returned 12 [0069.787] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0069.788] CharToOemA (in: pSrc="15x15dot.png", pDst=0x1fe658c | out: pDst="15x15dot.png") returned 1 [0069.788] WriteFile (in: hFile=0x158, lpBuffer=0x1fe658c*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe658c*, lpNumberOfBytesWritten=0x18e048*=0xc, lpOverlapped=0x0) returned 1 [0069.788] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0069.788] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0069.788] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0069.788] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=19005193946) returned 1 [0069.789] ReadFile (in: hFile=0x11c, lpBuffer=0x3b549f0, nNumberOfBytesToRead=0xb05, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b549f0*, lpNumberOfBytesRead=0x18dd7c*=0xb05, lpOverlapped=0x0) returned 1 [0069.790] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0069.790] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=19005338465) returned 1 [0069.799] WriteFile (in: hFile=0x158, lpBuffer=0x379ad68*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379ad68*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0069.799] ReadFile (in: hFile=0x11c, lpBuffer=0x3b549f0, nNumberOfBytesToRead=0xb05, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3b549f0*, lpNumberOfBytesRead=0x18de38*=0xb05, lpOverlapped=0x0) returned 1 [0069.799] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x47 [0069.799] WriteFile (in: hFile=0x158, lpBuffer=0x3b96d10*, nNumberOfBytesToWrite=0xb05, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3b96d10*, lpNumberOfBytesWritten=0x18de10*=0xb05, lpOverlapped=0x0) returned 1 [0069.800] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0xb4c [0069.800] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0069.800] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0069.800] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0069.800] SetFilePointer (in: hFile=0x158, lDistanceToMove=12, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2a [0069.800] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0xb56 [0069.800] CloseHandle (hObject=0x11c) returned 1 [0069.800] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xb56 [0069.800] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xb56 [0069.800] SetFilePointer (in: hFile=0x158, lDistanceToMove=2902, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xb56 [0069.800] SetFilePointer (in: hFile=0x158, lDistanceToMove=2902, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0xb56 [0069.800] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xb56 [0069.800] SetFilePointer (in: hFile=0x158, lDistanceToMove=2902, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0xb56 [0069.801] SetEndOfFile (hFile=0x158) returned 1 [0069.801] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xb56 [0069.801] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xb56 [0069.801] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0069.801] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x1fe478c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="15x15dot.png", lpUsedDefaultChar=0x0) returned 12 [0069.801] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0069.801] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x1fe47cc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="15x15dot.png", lpUsedDefaultChar=0x0) returned 12 [0069.801] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe47cc, cbMultiByte=12, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="15x15dot.pngꞗ@涤(\x18믉`믑`") returned 12 [0069.801] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0069.801] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x1fe478c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="15x15dot.png", lpUsedDefaultChar=0x0) returned 12 [0069.801] WriteFile (in: hFile=0x158, lpBuffer=0x3b384c8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3b384c8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0069.801] CharToOemA (in: pSrc="15x15dot.png", pDst=0x1fe47cc | out: pDst="15x15dot.png") returned 1 [0069.801] WriteFile (in: hFile=0x158, lpBuffer=0x1fe47cc*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe47cc*, lpNumberOfBytesWritten=0x18efcc*=0xc, lpOverlapped=0x0) returned 1 [0069.801] WriteFile (in: hFile=0x158, lpBuffer=0x379ad88*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379ad88*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0069.801] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0069.802] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0069.802] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xb9b [0069.802] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xb9b [0069.802] WriteFile (in: hFile=0x158, lpBuffer=0x3777058*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777058*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0069.802] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0069.802] DeleteFileW (lpFileName="") returned 0 [0069.802] GetLastError () returned 0x3 [0069.802] GetFileAttributesW (lpFileName="") returned 0xffffffff [0069.802] SetLastError (dwErrCode=0x3) [0069.802] FlushFileBuffers (hFile=0x158) returned 1 [0069.805] GetCurrentThreadId () returned 0x970 [0069.805] GetCurrentThreadId () returned 0x970 [0069.805] GetCurrentThreadId () returned 0x970 [0069.805] GetCurrentThreadId () returned 0x970 [0069.805] GetCurrentThreadId () returned 0x970 [0069.805] GetCurrentThreadId () returned 0x970 [0069.805] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xc52 [0069.805] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xc52 [0069.805] SetFilePointer (in: hFile=0x158, lDistanceToMove=3154, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xc52 [0069.805] CloseHandle (hObject=0x158) returned 1 [0069.806] GetCurrentThreadId () returned 0x970 [0069.806] GetCurrentThreadId () returned 0x970 [0069.806] GetCurrentThreadId () returned 0x970 [0069.806] GetCurrentThreadId () returned 0x970 [0069.806] GetCurrentThreadId () returned 0x970 [0069.806] GetCurrentThreadId () returned 0x970 [0069.806] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\Файл зашифрован [15x15dot.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\Файл зашифрован [15x15dot.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0069.806] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc52 [0069.806] SetFilePointer (in: hFile=0x158, lDistanceToMove=3026, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbd2 [0069.806] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0069.806] GetFileType (hFile=0x158) returned 0x1 [0069.806] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x11, wMilliseconds=0x48)) [0069.806] GetCurrentThreadId () returned 0x970 [0069.806] GetCurrentThreadId () returned 0x970 [0069.806] GetCurrentThreadId () returned 0x970 [0069.806] GetCurrentThreadId () returned 0x970 [0069.806] GetCurrentThreadId () returned 0x970 [0069.806] GetCurrentThreadId () returned 0x970 [0069.806] GetCurrentThreadId () returned 0x970 [0069.806] GetCurrentThreadId () returned 0x970 [0069.806] GetCurrentThreadId () returned 0x970 [0069.806] GetCurrentThreadId () returned 0x970 [0069.806] GetCurrentThreadId () returned 0x970 [0069.806] GetCurrentThreadId () returned 0x970 [0069.806] GetCurrentThreadId () returned 0x970 [0069.806] GetCurrentThreadId () returned 0x970 [0069.806] GetCurrentThreadId () returned 0x970 [0069.806] GetCurrentThreadId () returned 0x970 [0069.806] GetCurrentThreadId () returned 0x970 [0069.806] GetCurrentThreadId () returned 0x970 [0069.806] GetCurrentThreadId () returned 0x970 [0069.807] GetCurrentThreadId () returned 0x970 [0069.807] GetCurrentThreadId () returned 0x970 [0069.807] GetCurrentThreadId () returned 0x970 [0069.807] GetCurrentThreadId () returned 0x970 [0069.807] GetCurrentThreadId () returned 0x970 [0069.807] GetCurrentThreadId () returned 0x970 [0069.807] GetCurrentThreadId () returned 0x970 [0069.807] GetCurrentThreadId () returned 0x970 [0069.807] GetCurrentThreadId () returned 0x970 [0069.807] GetCurrentThreadId () returned 0x970 [0069.807] GetCurrentThreadId () returned 0x970 [0069.807] GetCurrentThreadId () returned 0x970 [0069.807] GetCurrentThreadId () returned 0x970 [0069.807] GetCurrentThreadId () returned 0x970 [0069.807] GetCurrentThreadId () returned 0x970 [0069.807] GetCurrentThreadId () returned 0x970 [0069.807] GetCurrentThreadId () returned 0x970 [0069.807] GetCurrentThreadId () returned 0x970 [0069.807] GetCurrentThreadId () returned 0x970 [0069.807] GetCurrentThreadId () returned 0x970 [0069.807] GetCurrentThreadId () returned 0x970 [0069.807] GetCurrentThreadId () returned 0x970 [0069.807] GetCurrentThreadId () returned 0x970 [0069.807] GetCurrentThreadId () returned 0x970 [0069.807] GetCurrentThreadId () returned 0x970 [0069.807] GetCurrentThreadId () returned 0x970 [0069.807] GetCurrentThreadId () returned 0x970 [0069.807] GetCurrentThreadId () returned 0x970 [0069.807] GetCurrentThreadId () returned 0x970 [0069.807] GetCurrentThreadId () returned 0x970 [0069.807] GetCurrentThreadId () returned 0x970 [0069.807] GetCurrentThreadId () returned 0x970 [0069.807] GetCurrentThreadId () returned 0x970 [0069.807] GetCurrentThreadId () returned 0x970 [0069.807] GetCurrentThreadId () returned 0x970 [0069.807] GetCurrentThreadId () returned 0x970 [0069.807] GetCurrentThreadId () returned 0x970 [0069.807] GetCurrentThreadId () returned 0x970 [0069.807] GetCurrentThreadId () returned 0x970 [0069.807] GetCurrentThreadId () returned 0x970 [0069.807] GetCurrentThreadId () returned 0x970 [0069.807] GetCurrentThreadId () returned 0x970 [0069.807] GetCurrentThreadId () returned 0x970 [0069.807] GetCurrentThreadId () returned 0x970 [0069.807] GetCurrentThreadId () returned 0x970 [0069.808] GetCurrentThreadId () returned 0x970 [0069.808] GetCurrentThreadId () returned 0x970 [0069.808] GetCurrentThreadId () returned 0x970 [0069.808] GetCurrentThreadId () returned 0x970 [0069.808] GetCurrentThreadId () returned 0x970 [0069.808] GetCurrentThreadId () returned 0x970 [0069.808] GetCurrentThreadId () returned 0x970 [0069.808] GetCurrentThreadId () returned 0x970 [0069.808] GetCurrentThreadId () returned 0x970 [0069.808] GetCurrentThreadId () returned 0x970 [0069.808] GetCurrentThreadId () returned 0x970 [0069.808] GetCurrentThreadId () returned 0x970 [0069.808] GetCurrentThreadId () returned 0x970 [0069.808] GetCurrentThreadId () returned 0x970 [0069.808] GetCurrentThreadId () returned 0x970 [0069.808] GetCurrentThreadId () returned 0x970 [0069.808] GetCurrentThreadId () returned 0x970 [0069.808] GetCurrentThreadId () returned 0x970 [0069.808] GetCurrentThreadId () returned 0x970 [0069.808] GetCurrentThreadId () returned 0x970 [0069.808] GetCurrentThreadId () returned 0x970 [0069.808] GetCurrentThreadId () returned 0x970 [0069.808] GetCurrentThreadId () returned 0x970 [0069.808] GetCurrentThreadId () returned 0x970 [0069.808] GetCurrentThreadId () returned 0x970 [0069.808] GetCurrentThreadId () returned 0x970 [0069.808] GetCurrentThreadId () returned 0x970 [0069.808] GetCurrentThreadId () returned 0x970 [0069.808] GetCurrentThreadId () returned 0x970 [0069.808] GetCurrentThreadId () returned 0x970 [0069.808] GetCurrentThreadId () returned 0x970 [0069.808] GetCurrentThreadId () returned 0x970 [0069.808] GetCurrentThreadId () returned 0x970 [0069.808] GetCurrentThreadId () returned 0x970 [0069.808] GetCurrentThreadId () returned 0x970 [0069.808] GetCurrentThreadId () returned 0x970 [0069.808] GetCurrentThreadId () returned 0x970 [0069.808] GetCurrentThreadId () returned 0x970 [0069.808] GetCurrentThreadId () returned 0x970 [0069.808] GetCurrentThreadId () returned 0x970 [0069.808] GetCurrentThreadId () returned 0x970 [0069.808] GetCurrentThreadId () returned 0x970 [0069.808] GetCurrentThreadId () returned 0x970 [0069.808] GetCurrentThreadId () returned 0x970 [0069.809] GetCurrentThreadId () returned 0x970 [0069.809] GetCurrentThreadId () returned 0x970 [0069.809] GetCurrentThreadId () returned 0x970 [0069.809] GetCurrentThreadId () returned 0x970 [0069.809] GetCurrentThreadId () returned 0x970 [0069.809] GetCurrentThreadId () returned 0x970 [0069.809] GetCurrentThreadId () returned 0x970 [0069.809] GetCurrentThreadId () returned 0x970 [0069.809] GetCurrentThreadId () returned 0x970 [0069.809] GetCurrentThreadId () returned 0x970 [0069.809] GetCurrentThreadId () returned 0x970 [0069.809] GetCurrentThreadId () returned 0x970 [0069.809] GetCurrentThreadId () returned 0x970 [0069.809] GetCurrentThreadId () returned 0x970 [0069.809] GetCurrentThreadId () returned 0x970 [0069.809] GetCurrentThreadId () returned 0x970 [0069.809] GetCurrentThreadId () returned 0x970 [0069.809] GetCurrentThreadId () returned 0x970 [0069.809] GetCurrentThreadId () returned 0x970 [0069.809] GetCurrentThreadId () returned 0x970 [0069.809] GetCurrentThreadId () returned 0x970 [0069.809] GetCurrentThreadId () returned 0x970 [0069.809] GetCurrentThreadId () returned 0x970 [0069.809] GetCurrentThreadId () returned 0x970 [0069.809] GetCurrentThreadId () returned 0x970 [0069.809] GetCurrentThreadId () returned 0x970 [0069.809] GetCurrentThreadId () returned 0x970 [0069.809] GetCurrentThreadId () returned 0x970 [0069.809] GetCurrentThreadId () returned 0x970 [0069.809] GetCurrentThreadId () returned 0x970 [0069.809] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0069.809] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0069.809] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379da58, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0069.809] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0069.809] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0069.809] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379da58, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0069.809] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0069.809] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0069.809] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0069.809] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0069.810] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0069.810] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0069.810] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0069.810] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0069.810] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379dab8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0069.810] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0069.810] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0069.810] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379dab8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0069.810] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0069.810] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0069.810] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379dab8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0069.810] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x11, wMilliseconds=0x57)) [0069.810] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr=",Y3F9f(peJ)8>QUMx6C*5*,XQ^u~qV4h", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0069.810] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr=",Y3F9f(peJ)8>QUMx6C*5*,XQ^u~qV4h", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0069.810] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr=",Y3F9f(peJ)8>QUMx6C*5*,XQ^u~qV4h", cchWideChar=32, lpMultiByteStr=0x2004bb8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=",Y3F9f(peJ)8>QUMx6C*5*,XQ^u~qV4h", lpUsedDefaultChar=0x0) returned 32 [0069.810] GetCurrentThreadId () returned 0x970 [0069.810] GetCurrentThreadId () returned 0x970 [0069.810] GetCurrentThreadId () returned 0x970 [0069.810] GetCurrentThreadId () returned 0x970 [0069.810] GetCurrentThreadId () returned 0x970 [0069.810] GetCurrentThreadId () returned 0x970 [0069.818] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0069.818] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0069.818] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x37b2f78, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0069.818] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ec348, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0069.818] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ec348, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAHjOzEq5UP1hIxCgRAt3y6HnE70sjJHrcR+SNAcqf1qHeZUZTsP7GAFtsYnWtBKK/cIeReeRwCPulfOKFPAjc11QlMPCNeE+AEC5mq89CSYwuaZJq8cZqK4HIaYuDab9QS1Apbd38gCsAo7O+Xif7MEeRrUSukxH3lzEa1fzmKesxXjr7qKSiOWJZ6m59Mut9stDCHIwvhGaF/KVbt1ZZzCiIHh9H6hIpQ==") returned 232 [0069.818] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x11, wMilliseconds=0x57)) [0069.818] GetCurrentThreadId () returned 0x970 [0069.818] GetCurrentThreadId () returned 0x970 [0069.818] GetCurrentThreadId () returned 0x970 [0069.818] GetCurrentThreadId () returned 0x970 [0069.818] GetCurrentThreadId () returned 0x970 [0069.818] GetCurrentThreadId () returned 0x970 [0069.818] GetCurrentThreadId () returned 0x970 [0069.818] GetCurrentThreadId () returned 0x970 [0069.818] GetCurrentThreadId () returned 0x970 [0069.818] GetCurrentThreadId () returned 0x970 [0069.818] GetCurrentThreadId () returned 0x970 [0069.818] GetCurrentThreadId () returned 0x970 [0069.818] GetCurrentThreadId () returned 0x970 [0069.818] GetCurrentThreadId () returned 0x970 [0069.818] GetCurrentThreadId () returned 0x970 [0069.818] GetCurrentThreadId () returned 0x970 [0069.818] GetCurrentThreadId () returned 0x970 [0069.818] GetCurrentThreadId () returned 0x970 [0069.818] GetCurrentThreadId () returned 0x970 [0069.818] GetCurrentThreadId () returned 0x970 [0069.818] GetCurrentThreadId () returned 0x970 [0069.818] GetCurrentThreadId () returned 0x970 [0069.818] GetCurrentThreadId () returned 0x970 [0069.818] GetCurrentThreadId () returned 0x970 [0069.818] GetCurrentThreadId () returned 0x970 [0069.818] GetCurrentThreadId () returned 0x970 [0069.818] GetCurrentThreadId () returned 0x970 [0069.818] GetCurrentThreadId () returned 0x970 [0069.818] GetCurrentThreadId () returned 0x970 [0069.818] GetCurrentThreadId () returned 0x970 [0069.818] GetCurrentThreadId () returned 0x970 [0069.818] GetCurrentThreadId () returned 0x970 [0069.818] GetCurrentThreadId () returned 0x970 [0069.819] GetCurrentThreadId () returned 0x970 [0069.819] GetCurrentThreadId () returned 0x970 [0069.819] GetCurrentThreadId () returned 0x970 [0069.819] GetCurrentThreadId () returned 0x970 [0069.819] GetCurrentThreadId () returned 0x970 [0069.819] GetCurrentThreadId () returned 0x970 [0069.819] GetCurrentThreadId () returned 0x970 [0069.819] GetCurrentThreadId () returned 0x970 [0069.819] GetCurrentThreadId () returned 0x970 [0069.819] GetCurrentThreadId () returned 0x970 [0069.819] GetCurrentThreadId () returned 0x970 [0069.819] GetCurrentThreadId () returned 0x970 [0069.819] GetCurrentThreadId () returned 0x970 [0069.819] GetCurrentThreadId () returned 0x970 [0069.819] GetCurrentThreadId () returned 0x970 [0069.819] GetCurrentThreadId () returned 0x970 [0069.819] GetCurrentThreadId () returned 0x970 [0069.819] GetCurrentThreadId () returned 0x970 [0069.819] GetCurrentThreadId () returned 0x970 [0069.819] GetCurrentThreadId () returned 0x970 [0069.819] GetCurrentThreadId () returned 0x970 [0069.819] GetCurrentThreadId () returned 0x970 [0069.819] GetCurrentThreadId () returned 0x970 [0069.819] GetCurrentThreadId () returned 0x970 [0069.819] GetCurrentThreadId () returned 0x970 [0069.819] GetCurrentThreadId () returned 0x970 [0069.819] GetCurrentThreadId () returned 0x970 [0069.819] GetCurrentThreadId () returned 0x970 [0069.819] GetCurrentThreadId () returned 0x970 [0069.819] GetCurrentThreadId () returned 0x970 [0069.819] GetCurrentThreadId () returned 0x970 [0069.819] GetCurrentThreadId () returned 0x970 [0069.819] GetCurrentThreadId () returned 0x970 [0069.819] GetCurrentThreadId () returned 0x970 [0069.819] GetCurrentThreadId () returned 0x970 [0069.819] GetCurrentThreadId () returned 0x970 [0069.819] GetCurrentThreadId () returned 0x970 [0069.819] GetCurrentThreadId () returned 0x970 [0069.819] GetCurrentThreadId () returned 0x970 [0069.819] GetCurrentThreadId () returned 0x970 [0069.819] GetCurrentThreadId () returned 0x970 [0069.819] GetCurrentThreadId () returned 0x970 [0069.819] GetCurrentThreadId () returned 0x970 [0069.819] GetCurrentThreadId () returned 0x970 [0069.820] GetCurrentThreadId () returned 0x970 [0069.820] GetCurrentThreadId () returned 0x970 [0069.820] GetCurrentThreadId () returned 0x970 [0069.820] GetCurrentThreadId () returned 0x970 [0069.820] GetCurrentThreadId () returned 0x970 [0069.820] GetCurrentThreadId () returned 0x970 [0069.820] GetCurrentThreadId () returned 0x970 [0069.820] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAHjOzEq5UP1hIxCgRAt3y6HnE70sjJHrcR+SNAcqf1qHeZUZTsP7GAFtsYnWtBKK/cIeReeRwCPulfOKFPAjc11QlMPCNeE+AEC5mq89CSYwuaZJq8cZqK4HIaYuDab9QS1Apbd38gCsAo7O+Xif7MEeRrUSukxH3lzEa1fzmKesxXjr7qKSiOWJZ6m59Mut9stDCHIwvhGaF/KVbt1ZZzCiIHh9H6hIpQ==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0069.820] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAHjOzEq5UP1hIxCgRAt3y6HnE70sjJHrcR+SNAcqf1qHeZUZTsP7GAFtsYnWtBKK/cIeReeRwCPulfOKFPAjc11QlMPCNeE+AEC5mq89CSYwuaZJq8cZqK4HIaYuDab9QS1Apbd38gCsAo7O+Xif7MEeRrUSukxH3lzEa1fzmKesxXjr7qKSiOWJZ6m59Mut9stDCHIwvhGaF/KVbt1ZZzCiIHh9H6hIpQ==", cchWideChar=245, lpMultiByteStr=0x353a10c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAHjOzEq5UP1hIxCgRAt3y6HnE70sjJHrcR+SNAcqf1qHeZUZTsP7GAFtsYnWtBKK/cIeReeRwCPulfOKFPAjc11QlMPCNeE+AEC5mq89CSYwuaZJq8cZqK4HIaYuDab9QS1Apbd38gCsAo7O+Xif7MEeRrUSukxH3lzEa1fzmKesxXjr7qKSiOWJZ6m59Mut9stDCHIwvhGaF/KVbt1ZZzCiIHh9H6hIpQ==", lpUsedDefaultChar=0x0) returned 245 [0069.820] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0069.820] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0069.820] CloseHandle (hObject=0x158) returned 1 [0069.820] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\15x15dot.png")) returned 0 [0069.820] GetLastError () returned 0x5 [0069.820] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\15x15dot.png")) returned 0x20 [0069.820] SetLastError (dwErrCode=0x5) [0069.820] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=19008385512) returned 1 [0069.820] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\Файл зашифрован [decorative_rule.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\Файл зашифрован [decorative_rule.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0069.821] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0069.821] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0069.821] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0069.821] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0069.821] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0069.821] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0069.821] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0069.821] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0069.821] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0069.822] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0069.822] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0069.822] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0069.822] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0069.822] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0069.822] SetEndOfFile (hFile=0x158) returned 1 [0069.822] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0069.822] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0069.822] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0069.822] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0069.822] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0069.823] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0069.823] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1i2?ZPyf}FQ", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0070.605] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FQCs>\"^.kz/DE5=F0S/1>1i2?ZPyf}FQ", cchWideChar=32, lpMultiByteStr=0x2037c2c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FQCs>\"^.kz/DE5=F0S/1>1i2?ZPyf}FQ", lpUsedDefaultChar=0x0) returned 32 [0070.605] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0070.605] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0070.605] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x702b532c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x702b532c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dda33b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PreviousMenuButtonIconSubpi.png", cAlternateFileName="")) returned 0x295098 [0070.605] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0070.605] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0070.605] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttoniconsubpi.png")) returned 0x20 [0070.606] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttoniconsubpi.png")) returned 0x20 [0070.606] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttoniconsubpi.png")) returned 0x20 [0070.606] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttoniconsubpi.png")) returned 0x20 [0070.606] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttoniconsubpi.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x702b532c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x702b532c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dda33b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc0a)) returned 1 [0070.606] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0070.606] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0070.606] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttoniconsubpi.png")) returned 0x20 [0070.606] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttoniconsubpi.png")) returned 0x20 [0070.606] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0070.606] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0070.606] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0070.606] SetEndOfFile (hFile=0x158) returned 1 [0070.607] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PreviousMenuButtonIconSubpi.png", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0070.607] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PreviousMenuButtonIconSubpi.png", cchWideChar=31, lpMultiByteStr=0x2004c7c, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PreviousMenuButtonIconSubpi.png", lpUsedDefaultChar=0x0) returned 31 [0070.607] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PreviousMenuButtonIconSubpi.png", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0070.607] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PreviousMenuButtonIconSubpi.png", cchWideChar=31, lpMultiByteStr=0x200473c, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PreviousMenuButtonIconSubpi.png", lpUsedDefaultChar=0x0) returned 31 [0070.607] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x200473c, cbMultiByte=31, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="PreviousMenuButtonIconSubpi.pnge.pngpngg") returned 31 [0070.607] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PreviousMenuButtonIconSubpi.png", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0070.608] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PreviousMenuButtonIconSubpi.png", cchWideChar=31, lpMultiByteStr=0x2004c7c, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PreviousMenuButtonIconSubpi.png", lpUsedDefaultChar=0x0) returned 31 [0070.608] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttoniconsubpi.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0070.608] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0070.608] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0xc0a [0070.608] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0070.608] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0070.608] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0070.608] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PreviousMenuButtonIconSubpi.png", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0070.608] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PreviousMenuButtonIconSubpi.png", cchWideChar=31, lpMultiByteStr=0x2004c7c, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PreviousMenuButtonIconSubpi.png", lpUsedDefaultChar=0x0) returned 31 [0070.608] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PreviousMenuButtonIconSubpi.png", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0070.608] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PreviousMenuButtonIconSubpi.png", cchWideChar=31, lpMultiByteStr=0x200473c, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PreviousMenuButtonIconSubpi.png", lpUsedDefaultChar=0x0) returned 31 [0070.608] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x200473c, cbMultiByte=31, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="PreviousMenuButtonIconSubpi.pngpi.pnge.pngpngg") returned 31 [0070.608] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PreviousMenuButtonIconSubpi.png", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0070.608] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PreviousMenuButtonIconSubpi.png", cchWideChar=31, lpMultiByteStr=0x2004c7c, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PreviousMenuButtonIconSubpi.png", lpUsedDefaultChar=0x0) returned 31 [0070.608] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0070.609] CharToOemA (in: pSrc="PreviousMenuButtonIconSubpi.png", pDst=0x200473c | out: pDst="PreviousMenuButtonIconSubpi.png") returned 1 [0070.609] WriteFile (in: hFile=0x158, lpBuffer=0x200473c*, nNumberOfBytesToWrite=0x1f, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x200473c*, lpNumberOfBytesWritten=0x18e048*=0x1f, lpOverlapped=0x0) returned 1 [0070.609] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0070.610] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0070.610] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0070.610] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=19087320650) returned 1 [0070.610] ReadFile (in: hFile=0x11c, lpBuffer=0x3b549f0, nNumberOfBytesToRead=0xc0a, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b549f0*, lpNumberOfBytesRead=0x18dd7c*=0xc0a, lpOverlapped=0x0) returned 1 [0070.612] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0070.612] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=19087519583) returned 1 [0070.621] WriteFile (in: hFile=0x158, lpBuffer=0x379acf0*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379acf0*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0070.621] ReadFile (in: hFile=0x11c, lpBuffer=0x3b549f0, nNumberOfBytesToRead=0xc0a, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3b549f0*, lpNumberOfBytesRead=0x18de38*=0xc0a, lpOverlapped=0x0) returned 1 [0070.621] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x5a [0070.621] WriteFile (in: hFile=0x158, lpBuffer=0x3b96e10*, nNumberOfBytesToWrite=0xc0a, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3b96e10*, lpNumberOfBytesWritten=0x18de10*=0xc0a, lpOverlapped=0x0) returned 1 [0070.621] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0xc64 [0070.621] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0070.621] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0070.621] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0070.621] SetFilePointer (in: hFile=0x158, lDistanceToMove=31, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x3d [0070.621] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0xc6e [0070.622] CloseHandle (hObject=0x11c) returned 1 [0070.622] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xc6e [0070.622] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xc6e [0070.622] SetFilePointer (in: hFile=0x158, lDistanceToMove=3182, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xc6e [0070.622] SetFilePointer (in: hFile=0x158, lDistanceToMove=3182, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0xc6e [0070.622] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xc6e [0070.622] SetFilePointer (in: hFile=0x158, lDistanceToMove=3182, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0xc6e [0070.622] SetEndOfFile (hFile=0x158) returned 1 [0070.622] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xc6e [0070.622] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xc6e [0070.622] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PreviousMenuButtonIconSubpi.png", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0070.622] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PreviousMenuButtonIconSubpi.png", cchWideChar=31, lpMultiByteStr=0x200473c, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PreviousMenuButtonIconSubpi.png", lpUsedDefaultChar=0x0) returned 31 [0070.622] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PreviousMenuButtonIconSubpi.png", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0070.622] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PreviousMenuButtonIconSubpi.png", cchWideChar=31, lpMultiByteStr=0x2004c7c, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PreviousMenuButtonIconSubpi.png", lpUsedDefaultChar=0x0) returned 31 [0070.622] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x2004c7c, cbMultiByte=31, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="PreviousMenuButtonIconSubpi.png㫋輁㺱ద") returned 31 [0070.623] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PreviousMenuButtonIconSubpi.png", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0070.623] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PreviousMenuButtonIconSubpi.png", cchWideChar=31, lpMultiByteStr=0x200473c, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PreviousMenuButtonIconSubpi.png", lpUsedDefaultChar=0x0) returned 31 [0070.623] WriteFile (in: hFile=0x158, lpBuffer=0x3b384c8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3b384c8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0070.623] CharToOemA (in: pSrc="PreviousMenuButtonIconSubpi.png", pDst=0x2004c7c | out: pDst="PreviousMenuButtonIconSubpi.png") returned 1 [0070.623] WriteFile (in: hFile=0x158, lpBuffer=0x2004c7c*, nNumberOfBytesToWrite=0x1f, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x2004c7c*, lpNumberOfBytesWritten=0x18efcc*=0x1f, lpOverlapped=0x0) returned 1 [0070.623] WriteFile (in: hFile=0x158, lpBuffer=0x379ad88*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379ad88*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0070.623] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0070.623] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0070.623] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xcc6 [0070.623] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xcc6 [0070.623] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0070.623] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0070.623] DeleteFileW (lpFileName="") returned 0 [0070.623] GetLastError () returned 0x3 [0070.623] GetFileAttributesW (lpFileName="") returned 0xffffffff [0070.623] SetLastError (dwErrCode=0x3) [0070.623] FlushFileBuffers (hFile=0x158) returned 1 [0070.626] GetCurrentThreadId () returned 0x970 [0070.626] GetCurrentThreadId () returned 0x970 [0070.626] GetCurrentThreadId () returned 0x970 [0070.626] GetCurrentThreadId () returned 0x970 [0070.627] GetCurrentThreadId () returned 0x970 [0070.627] GetCurrentThreadId () returned 0x970 [0070.627] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xd7d [0070.627] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xd7d [0070.627] SetFilePointer (in: hFile=0x158, lDistanceToMove=3453, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xd7d [0070.627] CloseHandle (hObject=0x158) returned 1 [0070.627] GetCurrentThreadId () returned 0x970 [0070.627] GetCurrentThreadId () returned 0x970 [0070.627] GetCurrentThreadId () returned 0x970 [0070.627] GetCurrentThreadId () returned 0x970 [0070.627] GetCurrentThreadId () returned 0x970 [0070.627] GetCurrentThreadId () returned 0x970 [0070.627] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Файл зашифрован [PreviousMenuButtonIconSubpi.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\Файл зашифрован [previousmenubuttoniconsubpi.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0070.627] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd7d [0070.627] SetFilePointer (in: hFile=0x158, lDistanceToMove=3325, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xcfd [0070.627] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0070.628] GetFileType (hFile=0x158) returned 0x1 [0070.628] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x11, wMilliseconds=0x382)) [0070.628] GetCurrentThreadId () returned 0x970 [0070.628] GetCurrentThreadId () returned 0x970 [0070.628] GetCurrentThreadId () returned 0x970 [0070.628] GetCurrentThreadId () returned 0x970 [0070.628] GetCurrentThreadId () returned 0x970 [0070.628] GetCurrentThreadId () returned 0x970 [0070.628] GetCurrentThreadId () returned 0x970 [0070.628] GetCurrentThreadId () returned 0x970 [0070.628] GetCurrentThreadId () returned 0x970 [0070.628] GetCurrentThreadId () returned 0x970 [0070.628] GetCurrentThreadId () returned 0x970 [0070.628] GetCurrentThreadId () returned 0x970 [0070.628] GetCurrentThreadId () returned 0x970 [0070.628] GetCurrentThreadId () returned 0x970 [0070.628] GetCurrentThreadId () returned 0x970 [0070.628] GetCurrentThreadId () returned 0x970 [0070.628] GetCurrentThreadId () returned 0x970 [0070.628] GetCurrentThreadId () returned 0x970 [0070.628] GetCurrentThreadId () returned 0x970 [0070.628] GetCurrentThreadId () returned 0x970 [0070.628] GetCurrentThreadId () returned 0x970 [0070.628] GetCurrentThreadId () returned 0x970 [0070.628] GetCurrentThreadId () returned 0x970 [0070.628] GetCurrentThreadId () returned 0x970 [0070.628] GetCurrentThreadId () returned 0x970 [0070.628] GetCurrentThreadId () returned 0x970 [0070.628] GetCurrentThreadId () returned 0x970 [0070.628] GetCurrentThreadId () returned 0x970 [0070.628] GetCurrentThreadId () returned 0x970 [0070.628] GetCurrentThreadId () returned 0x970 [0070.628] GetCurrentThreadId () returned 0x970 [0070.628] GetCurrentThreadId () returned 0x970 [0070.628] GetCurrentThreadId () returned 0x970 [0070.628] GetCurrentThreadId () returned 0x970 [0070.628] GetCurrentThreadId () returned 0x970 [0070.628] GetCurrentThreadId () returned 0x970 [0070.628] GetCurrentThreadId () returned 0x970 [0070.628] GetCurrentThreadId () returned 0x970 [0070.628] GetCurrentThreadId () returned 0x970 [0070.628] GetCurrentThreadId () returned 0x970 [0070.629] GetCurrentThreadId () returned 0x970 [0070.629] GetCurrentThreadId () returned 0x970 [0070.629] GetCurrentThreadId () returned 0x970 [0070.629] GetCurrentThreadId () returned 0x970 [0070.629] GetCurrentThreadId () returned 0x970 [0070.629] GetCurrentThreadId () returned 0x970 [0070.629] GetCurrentThreadId () returned 0x970 [0070.629] GetCurrentThreadId () returned 0x970 [0070.629] GetCurrentThreadId () returned 0x970 [0070.629] GetCurrentThreadId () returned 0x970 [0070.629] GetCurrentThreadId () returned 0x970 [0070.629] GetCurrentThreadId () returned 0x970 [0070.629] GetCurrentThreadId () returned 0x970 [0070.629] GetCurrentThreadId () returned 0x970 [0070.629] GetCurrentThreadId () returned 0x970 [0070.629] GetCurrentThreadId () returned 0x970 [0070.629] GetCurrentThreadId () returned 0x970 [0070.629] GetCurrentThreadId () returned 0x970 [0070.629] GetCurrentThreadId () returned 0x970 [0070.629] GetCurrentThreadId () returned 0x970 [0070.629] GetCurrentThreadId () returned 0x970 [0070.629] GetCurrentThreadId () returned 0x970 [0070.629] GetCurrentThreadId () returned 0x970 [0070.629] GetCurrentThreadId () returned 0x970 [0070.629] GetCurrentThreadId () returned 0x970 [0070.629] GetCurrentThreadId () returned 0x970 [0070.629] GetCurrentThreadId () returned 0x970 [0070.629] GetCurrentThreadId () returned 0x970 [0070.629] GetCurrentThreadId () returned 0x970 [0070.629] GetCurrentThreadId () returned 0x970 [0070.629] GetCurrentThreadId () returned 0x970 [0070.629] GetCurrentThreadId () returned 0x970 [0070.629] GetCurrentThreadId () returned 0x970 [0070.629] GetCurrentThreadId () returned 0x970 [0070.629] GetCurrentThreadId () returned 0x970 [0070.629] GetCurrentThreadId () returned 0x970 [0070.629] GetCurrentThreadId () returned 0x970 [0070.629] GetCurrentThreadId () returned 0x970 [0070.629] GetCurrentThreadId () returned 0x970 [0070.629] GetCurrentThreadId () returned 0x970 [0070.629] GetCurrentThreadId () returned 0x970 [0070.629] GetCurrentThreadId () returned 0x970 [0070.629] GetCurrentThreadId () returned 0x970 [0070.630] GetCurrentThreadId () returned 0x970 [0070.630] GetCurrentThreadId () returned 0x970 [0070.630] GetCurrentThreadId () returned 0x970 [0070.630] GetCurrentThreadId () returned 0x970 [0070.630] GetCurrentThreadId () returned 0x970 [0070.630] GetCurrentThreadId () returned 0x970 [0070.630] GetCurrentThreadId () returned 0x970 [0070.630] GetCurrentThreadId () returned 0x970 [0070.630] GetCurrentThreadId () returned 0x970 [0070.630] GetCurrentThreadId () returned 0x970 [0070.630] GetCurrentThreadId () returned 0x970 [0070.630] GetCurrentThreadId () returned 0x970 [0070.630] GetCurrentThreadId () returned 0x970 [0070.630] GetCurrentThreadId () returned 0x970 [0070.630] GetCurrentThreadId () returned 0x970 [0070.630] GetCurrentThreadId () returned 0x970 [0070.630] GetCurrentThreadId () returned 0x970 [0070.630] GetCurrentThreadId () returned 0x970 [0070.630] GetCurrentThreadId () returned 0x970 [0070.630] GetCurrentThreadId () returned 0x970 [0070.630] GetCurrentThreadId () returned 0x970 [0070.630] GetCurrentThreadId () returned 0x970 [0070.630] GetCurrentThreadId () returned 0x970 [0070.630] GetCurrentThreadId () returned 0x970 [0070.630] GetCurrentThreadId () returned 0x970 [0070.630] GetCurrentThreadId () returned 0x970 [0070.630] GetCurrentThreadId () returned 0x970 [0070.630] GetCurrentThreadId () returned 0x970 [0070.630] GetCurrentThreadId () returned 0x970 [0070.630] GetCurrentThreadId () returned 0x970 [0070.630] GetCurrentThreadId () returned 0x970 [0070.630] GetCurrentThreadId () returned 0x970 [0070.630] GetCurrentThreadId () returned 0x970 [0070.630] GetCurrentThreadId () returned 0x970 [0070.630] GetCurrentThreadId () returned 0x970 [0070.630] GetCurrentThreadId () returned 0x970 [0070.630] GetCurrentThreadId () returned 0x970 [0070.630] GetCurrentThreadId () returned 0x970 [0070.630] GetCurrentThreadId () returned 0x970 [0070.630] GetCurrentThreadId () returned 0x970 [0070.630] GetCurrentThreadId () returned 0x970 [0070.630] GetCurrentThreadId () returned 0x970 [0070.630] GetCurrentThreadId () returned 0x970 [0070.630] GetCurrentThreadId () returned 0x970 [0070.630] GetCurrentThreadId () returned 0x970 [0070.631] GetCurrentThreadId () returned 0x970 [0070.631] GetCurrentThreadId () returned 0x970 [0070.631] GetCurrentThreadId () returned 0x970 [0070.631] GetCurrentThreadId () returned 0x970 [0070.631] GetCurrentThreadId () returned 0x970 [0070.631] GetCurrentThreadId () returned 0x970 [0070.631] GetCurrentThreadId () returned 0x970 [0070.631] GetCurrentThreadId () returned 0x970 [0070.631] GetCurrentThreadId () returned 0x970 [0070.631] GetCurrentThreadId () returned 0x970 [0070.631] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0070.631] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0070.631] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379e118, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0070.631] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0070.631] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0070.631] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379e118, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0070.631] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0070.631] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0070.631] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0070.631] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0070.631] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0070.631] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0070.631] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0070.631] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0070.631] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379e178, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0070.631] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0070.631] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0070.631] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379e178, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0070.631] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0070.631] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0070.631] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379e178, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0070.631] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x11, wMilliseconds=0x382)) [0070.631] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="FQCs>\"^.kz/DE5=F0S/1>1i2?ZPyf}FQ", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0070.631] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="FQCs>\"^.kz/DE5=F0S/1>1i2?ZPyf}FQ", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0070.632] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="FQCs>\"^.kz/DE5=F0S/1>1i2?ZPyf}FQ", cchWideChar=32, lpMultiByteStr=0x2004eb8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FQCs>\"^.kz/DE5=F0S/1>1i2?ZPyf}FQ", lpUsedDefaultChar=0x0) returned 32 [0070.632] GetCurrentThreadId () returned 0x970 [0070.632] GetCurrentThreadId () returned 0x970 [0070.632] GetCurrentThreadId () returned 0x970 [0070.632] GetCurrentThreadId () returned 0x970 [0070.632] GetCurrentThreadId () returned 0x970 [0070.632] GetCurrentThreadId () returned 0x970 [0070.639] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0070.639] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0070.639] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x37b40f8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0070.639] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eca48, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0070.639] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eca48, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAABMim7+wAGbAR99/LmFO85QIX2FJm5eyqQW1u3e9KtVYH5Ryhxq7roLoimzy9oqVXAns3b+oYD7uCG64uymyrRjQ7YqVF0gyf2ytdIuxmUH7hVPA5DIGk32vk1Sf+T10/3l7my6H2FrIPJf1Xa3BF7GeCIubP3SfEKwnBU9MlN+ni5Ly4L1nniRliBs+1UsbdN60cVy1rfukoCTC04phgFj+wXQogoITdA==") returned 232 [0070.639] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x11, wMilliseconds=0x392)) [0070.639] GetCurrentThreadId () returned 0x970 [0070.639] GetCurrentThreadId () returned 0x970 [0070.639] GetCurrentThreadId () returned 0x970 [0070.639] GetCurrentThreadId () returned 0x970 [0070.640] GetCurrentThreadId () returned 0x970 [0070.640] GetCurrentThreadId () returned 0x970 [0070.640] GetCurrentThreadId () returned 0x970 [0070.640] GetCurrentThreadId () returned 0x970 [0070.640] GetCurrentThreadId () returned 0x970 [0070.640] GetCurrentThreadId () returned 0x970 [0070.640] GetCurrentThreadId () returned 0x970 [0070.640] GetCurrentThreadId () returned 0x970 [0070.640] GetCurrentThreadId () returned 0x970 [0070.640] GetCurrentThreadId () returned 0x970 [0070.640] GetCurrentThreadId () returned 0x970 [0070.640] GetCurrentThreadId () returned 0x970 [0070.640] GetCurrentThreadId () returned 0x970 [0070.640] GetCurrentThreadId () returned 0x970 [0070.640] GetCurrentThreadId () returned 0x970 [0070.640] GetCurrentThreadId () returned 0x970 [0070.640] GetCurrentThreadId () returned 0x970 [0070.640] GetCurrentThreadId () returned 0x970 [0070.640] GetCurrentThreadId () returned 0x970 [0070.640] GetCurrentThreadId () returned 0x970 [0070.640] GetCurrentThreadId () returned 0x970 [0070.640] GetCurrentThreadId () returned 0x970 [0070.640] GetCurrentThreadId () returned 0x970 [0070.640] GetCurrentThreadId () returned 0x970 [0070.640] GetCurrentThreadId () returned 0x970 [0070.640] GetCurrentThreadId () returned 0x970 [0070.640] GetCurrentThreadId () returned 0x970 [0070.640] GetCurrentThreadId () returned 0x970 [0070.640] GetCurrentThreadId () returned 0x970 [0070.640] GetCurrentThreadId () returned 0x970 [0070.640] GetCurrentThreadId () returned 0x970 [0070.640] GetCurrentThreadId () returned 0x970 [0070.640] GetCurrentThreadId () returned 0x970 [0070.640] GetCurrentThreadId () returned 0x970 [0070.640] GetCurrentThreadId () returned 0x970 [0070.640] GetCurrentThreadId () returned 0x970 [0070.640] GetCurrentThreadId () returned 0x970 [0070.640] GetCurrentThreadId () returned 0x970 [0070.640] GetCurrentThreadId () returned 0x970 [0070.640] GetCurrentThreadId () returned 0x970 [0070.640] GetCurrentThreadId () returned 0x970 [0070.640] GetCurrentThreadId () returned 0x970 [0070.640] GetCurrentThreadId () returned 0x970 [0070.640] GetCurrentThreadId () returned 0x970 [0070.641] GetCurrentThreadId () returned 0x970 [0070.641] GetCurrentThreadId () returned 0x970 [0070.641] GetCurrentThreadId () returned 0x970 [0070.641] GetCurrentThreadId () returned 0x970 [0070.641] GetCurrentThreadId () returned 0x970 [0070.641] GetCurrentThreadId () returned 0x970 [0070.641] GetCurrentThreadId () returned 0x970 [0070.641] GetCurrentThreadId () returned 0x970 [0070.641] GetCurrentThreadId () returned 0x970 [0070.641] GetCurrentThreadId () returned 0x970 [0070.641] GetCurrentThreadId () returned 0x970 [0070.641] GetCurrentThreadId () returned 0x970 [0070.641] GetCurrentThreadId () returned 0x970 [0070.641] GetCurrentThreadId () returned 0x970 [0070.641] GetCurrentThreadId () returned 0x970 [0070.641] GetCurrentThreadId () returned 0x970 [0070.641] GetCurrentThreadId () returned 0x970 [0070.641] GetCurrentThreadId () returned 0x970 [0070.641] GetCurrentThreadId () returned 0x970 [0070.641] GetCurrentThreadId () returned 0x970 [0070.641] GetCurrentThreadId () returned 0x970 [0070.641] GetCurrentThreadId () returned 0x970 [0070.641] GetCurrentThreadId () returned 0x970 [0070.641] GetCurrentThreadId () returned 0x970 [0070.641] GetCurrentThreadId () returned 0x970 [0070.641] GetCurrentThreadId () returned 0x970 [0070.641] GetCurrentThreadId () returned 0x970 [0070.641] GetCurrentThreadId () returned 0x970 [0070.641] GetCurrentThreadId () returned 0x970 [0070.641] GetCurrentThreadId () returned 0x970 [0070.641] GetCurrentThreadId () returned 0x970 [0070.641] GetCurrentThreadId () returned 0x970 [0070.641] GetCurrentThreadId () returned 0x970 [0070.641] GetCurrentThreadId () returned 0x970 [0070.641] GetCurrentThreadId () returned 0x970 [0070.642] GetCurrentThreadId () returned 0x970 [0070.642] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAABMim7+wAGbAR99/LmFO85QIX2FJm5eyqQW1u3e9KtVYH5Ryhxq7roLoimzy9oqVXAns3b+oYD7uCG64uymyrRjQ7YqVF0gyf2ytdIuxmUH7hVPA5DIGk32vk1Sf+T10/3l7my6H2FrIPJf1Xa3BF7GeCIubP3SfEKwnBU9MlN+ni5Ly4L1nniRliBs+1UsbdN60cVy1rfukoCTC04phgFj+wXQogoITdA==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0070.642] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAABMim7+wAGbAR99/LmFO85QIX2FJm5eyqQW1u3e9KtVYH5Ryhxq7roLoimzy9oqVXAns3b+oYD7uCG64uymyrRjQ7YqVF0gyf2ytdIuxmUH7hVPA5DIGk32vk1Sf+T10/3l7my6H2FrIPJf1Xa3BF7GeCIubP3SfEKwnBU9MlN+ni5Ly4L1nniRliBs+1UsbdN60cVy1rfukoCTC04phgFj+wXQogoITdA==", cchWideChar=245, lpMultiByteStr=0x353a76c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAABMim7+wAGbAR99/LmFO85QIX2FJm5eyqQW1u3e9KtVYH5Ryhxq7roLoimzy9oqVXAns3b+oYD7uCG64uymyrRjQ7YqVF0gyf2ytdIuxmUH7hVPA5DIGk32vk1Sf+T10/3l7my6H2FrIPJf1Xa3BF7GeCIubP3SfEKwnBU9MlN+ni5Ly4L1nniRliBs+1UsbdN60cVy1rfukoCTC04phgFj+wXQogoITdA==", lpUsedDefaultChar=0x0) returned 245 [0070.642] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0070.642] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0070.642] CloseHandle (hObject=0x158) returned 1 [0070.642] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttoniconsubpi.png")) returned 0 [0070.642] GetLastError () returned 0x5 [0070.642] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttoniconsubpi.png")) returned 0x20 [0070.642] SetLastError (dwErrCode=0x5) [0070.642] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=19090574981) returned 1 [0070.642] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Файл зашифрован [redmenu.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\Файл зашифрован [redmenu.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0070.643] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0070.643] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0070.643] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0070.643] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0070.643] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0070.643] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0070.643] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0070.643] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0070.643] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0070.643] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0070.643] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0070.643] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0070.644] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0070.644] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0070.644] SetEndOfFile (hFile=0x158) returned 1 [0070.644] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0070.644] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0070.644] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0070.644] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0070.644] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0070.645] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0070.645] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="*xG7Js#{b:7O+()j<", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0071.311] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HeBP4YR{XPc)+K3RA0\"Ob>{b:7O+()j<", cchWideChar=32, lpMultiByteStr=0x2037fac, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HeBP4YR{XPc)+K3RA0\"Ob>{b:7O+()j<", lpUsedDefaultChar=0x0) returned 32 [0071.311] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0071.311] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0071.311] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x722d79a4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x722d79a4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea22689, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x643e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_frame-shadow.png", cAlternateFileName="")) returned 0x295098 [0071.311] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0071.311] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0071.311] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-shadow.png")) returned 0x20 [0071.311] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-shadow.png")) returned 0x20 [0071.311] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-shadow.png")) returned 0x20 [0071.311] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-shadow.png")) returned 0x20 [0071.312] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-shadow.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x722d79a4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x722d79a4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea22689, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x643e)) returned 1 [0071.312] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0071.312] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0071.312] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-shadow.png")) returned 0x20 [0071.312] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-shadow.png")) returned 0x20 [0071.312] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0071.312] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0071.312] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0071.312] SetEndOfFile (hFile=0x158) returned 1 [0071.313] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_frame-shadow.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0071.313] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_frame-shadow.png", cchWideChar=21, lpMultiByteStr=0x1ff885c, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_frame-shadow.png", lpUsedDefaultChar=0x0) returned 21 [0071.313] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_frame-shadow.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0071.313] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_frame-shadow.png", cchWideChar=21, lpMultiByteStr=0x1ff8974, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_frame-shadow.png", lpUsedDefaultChar=0x0) returned 21 [0071.313] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff8974, cbMultiByte=21, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="Pets_frame-shadow.pngpng.pngt.pngpngpngg") returned 21 [0071.313] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_frame-shadow.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0071.313] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_frame-shadow.png", cchWideChar=21, lpMultiByteStr=0x1ff885c, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_frame-shadow.png", lpUsedDefaultChar=0x0) returned 21 [0071.313] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-shadow.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0071.313] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0071.313] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x643e [0071.313] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0071.313] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0071.314] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0071.314] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_frame-shadow.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0071.314] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_frame-shadow.png", cchWideChar=21, lpMultiByteStr=0x1ff885c, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_frame-shadow.png", lpUsedDefaultChar=0x0) returned 21 [0071.314] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_frame-shadow.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0071.314] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_frame-shadow.png", cchWideChar=21, lpMultiByteStr=0x1ff8974, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_frame-shadow.png", lpUsedDefaultChar=0x0) returned 21 [0071.314] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff8974, cbMultiByte=21, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="Pets_frame-shadow.pngow.pngpng.pngt.pngpngpngg") returned 21 [0071.314] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_frame-shadow.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0071.314] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_frame-shadow.png", cchWideChar=21, lpMultiByteStr=0x1ff885c, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_frame-shadow.png", lpUsedDefaultChar=0x0) returned 21 [0071.314] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0071.315] CharToOemA (in: pSrc="Pets_frame-shadow.png", pDst=0x1ff8974 | out: pDst="Pets_frame-shadow.png") returned 1 [0071.315] WriteFile (in: hFile=0x158, lpBuffer=0x1ff8974*, nNumberOfBytesToWrite=0x15, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1ff8974*, lpNumberOfBytesWritten=0x18e048*=0x15, lpOverlapped=0x0) returned 1 [0071.315] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0071.315] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0071.315] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0071.315] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=19157868517) returned 1 [0071.315] ReadFile (in: hFile=0x11c, lpBuffer=0x3b549f0, nNumberOfBytesToRead=0x643e, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b549f0*, lpNumberOfBytesRead=0x18dd7c*=0x643e, lpOverlapped=0x0) returned 1 [0071.317] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0071.317] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=19158080557) returned 1 [0071.326] WriteFile (in: hFile=0x158, lpBuffer=0x379acc0*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379acc0*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0071.326] ReadFile (in: hFile=0x11c, lpBuffer=0x3b549f0, nNumberOfBytesToRead=0x643e, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3b549f0*, lpNumberOfBytesRead=0x18de38*=0x643e, lpOverlapped=0x0) returned 1 [0071.327] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x50 [0071.327] WriteFile (in: hFile=0x158, lpBuffer=0x37bea30*, nNumberOfBytesToWrite=0x643e, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x37bea30*, lpNumberOfBytesWritten=0x18de10*=0x643e, lpOverlapped=0x0) returned 1 [0071.328] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x648e [0071.328] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0071.328] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0071.328] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0071.328] SetFilePointer (in: hFile=0x158, lDistanceToMove=21, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x33 [0071.328] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x6498 [0071.328] CloseHandle (hObject=0x11c) returned 1 [0071.329] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x6498 [0071.329] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x6498 [0071.329] SetFilePointer (in: hFile=0x158, lDistanceToMove=25752, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x6498 [0071.329] SetFilePointer (in: hFile=0x158, lDistanceToMove=25752, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x6498 [0071.329] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x6498 [0071.329] SetFilePointer (in: hFile=0x158, lDistanceToMove=25752, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x6498 [0071.329] SetEndOfFile (hFile=0x158) returned 1 [0071.329] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x6498 [0071.329] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x6498 [0071.329] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_frame-shadow.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0071.329] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_frame-shadow.png", cchWideChar=21, lpMultiByteStr=0x1ff8974, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_frame-shadow.png", lpUsedDefaultChar=0x0) returned 21 [0071.329] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_frame-shadow.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0071.329] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_frame-shadow.png", cchWideChar=21, lpMultiByteStr=0x1ff885c, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_frame-shadow.png", lpUsedDefaultChar=0x0) returned 21 [0071.329] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff885c, cbMultiByte=21, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="Pets_frame-shadow.png`") returned 21 [0071.329] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_frame-shadow.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0071.329] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_frame-shadow.png", cchWideChar=21, lpMultiByteStr=0x1ff8974, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_frame-shadow.png", lpUsedDefaultChar=0x0) returned 21 [0071.329] WriteFile (in: hFile=0x158, lpBuffer=0x3b384c8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3b384c8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0071.330] CharToOemA (in: pSrc="Pets_frame-shadow.png", pDst=0x1ff885c | out: pDst="Pets_frame-shadow.png") returned 1 [0071.330] WriteFile (in: hFile=0x158, lpBuffer=0x1ff885c*, nNumberOfBytesToWrite=0x15, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1ff885c*, lpNumberOfBytesWritten=0x18efcc*=0x15, lpOverlapped=0x0) returned 1 [0071.330] WriteFile (in: hFile=0x158, lpBuffer=0x379ade8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379ade8*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0071.330] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0071.330] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0071.330] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x64e6 [0071.330] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x64e6 [0071.330] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0071.330] WriteFile (in: hFile=0x158, lpBuffer=0x35f035c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f035c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0071.330] DeleteFileW (lpFileName="") returned 0 [0071.330] GetLastError () returned 0x3 [0071.330] GetFileAttributesW (lpFileName="") returned 0xffffffff [0071.330] SetLastError (dwErrCode=0x3) [0071.330] FlushFileBuffers (hFile=0x158) returned 1 [0071.334] GetCurrentThreadId () returned 0x970 [0071.334] GetCurrentThreadId () returned 0x970 [0071.334] GetCurrentThreadId () returned 0x970 [0071.334] GetCurrentThreadId () returned 0x970 [0071.334] GetCurrentThreadId () returned 0x970 [0071.334] GetCurrentThreadId () returned 0x970 [0071.334] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x659d [0071.334] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x659d [0071.334] SetFilePointer (in: hFile=0x158, lDistanceToMove=26013, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x659d [0071.334] CloseHandle (hObject=0x158) returned 1 [0071.334] GetCurrentThreadId () returned 0x970 [0071.334] GetCurrentThreadId () returned 0x970 [0071.334] GetCurrentThreadId () returned 0x970 [0071.334] GetCurrentThreadId () returned 0x970 [0071.334] GetCurrentThreadId () returned 0x970 [0071.334] GetCurrentThreadId () returned 0x970 [0071.334] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Файл зашифрован [Pets_frame-shadow.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\Файл зашифрован [pets_frame-shadow.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0071.334] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x659d [0071.334] SetFilePointer (in: hFile=0x158, lDistanceToMove=25885, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x651d [0071.334] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0071.334] GetFileType (hFile=0x158) returned 0x1 [0071.335] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x12, wMilliseconds=0x258)) [0071.335] GetCurrentThreadId () returned 0x970 [0071.335] GetCurrentThreadId () returned 0x970 [0071.335] GetCurrentThreadId () returned 0x970 [0071.335] GetCurrentThreadId () returned 0x970 [0071.335] GetCurrentThreadId () returned 0x970 [0071.335] GetCurrentThreadId () returned 0x970 [0071.335] GetCurrentThreadId () returned 0x970 [0071.335] GetCurrentThreadId () returned 0x970 [0071.335] GetCurrentThreadId () returned 0x970 [0071.335] GetCurrentThreadId () returned 0x970 [0071.335] GetCurrentThreadId () returned 0x970 [0071.335] GetCurrentThreadId () returned 0x970 [0071.335] GetCurrentThreadId () returned 0x970 [0071.335] GetCurrentThreadId () returned 0x970 [0071.335] GetCurrentThreadId () returned 0x970 [0071.335] GetCurrentThreadId () returned 0x970 [0071.335] GetCurrentThreadId () returned 0x970 [0071.335] GetCurrentThreadId () returned 0x970 [0071.335] GetCurrentThreadId () returned 0x970 [0071.335] GetCurrentThreadId () returned 0x970 [0071.335] GetCurrentThreadId () returned 0x970 [0071.335] GetCurrentThreadId () returned 0x970 [0071.335] GetCurrentThreadId () returned 0x970 [0071.335] GetCurrentThreadId () returned 0x970 [0071.335] GetCurrentThreadId () returned 0x970 [0071.335] GetCurrentThreadId () returned 0x970 [0071.335] GetCurrentThreadId () returned 0x970 [0071.335] GetCurrentThreadId () returned 0x970 [0071.335] GetCurrentThreadId () returned 0x970 [0071.335] GetCurrentThreadId () returned 0x970 [0071.335] GetCurrentThreadId () returned 0x970 [0071.335] GetCurrentThreadId () returned 0x970 [0071.335] GetCurrentThreadId () returned 0x970 [0071.335] GetCurrentThreadId () returned 0x970 [0071.335] GetCurrentThreadId () returned 0x970 [0071.335] GetCurrentThreadId () returned 0x970 [0071.335] GetCurrentThreadId () returned 0x970 [0071.335] GetCurrentThreadId () returned 0x970 [0071.335] GetCurrentThreadId () returned 0x970 [0071.335] GetCurrentThreadId () returned 0x970 [0071.335] GetCurrentThreadId () returned 0x970 [0071.335] GetCurrentThreadId () returned 0x970 [0071.336] GetCurrentThreadId () returned 0x970 [0071.336] GetCurrentThreadId () returned 0x970 [0071.336] GetCurrentThreadId () returned 0x970 [0071.336] GetCurrentThreadId () returned 0x970 [0071.336] GetCurrentThreadId () returned 0x970 [0071.336] GetCurrentThreadId () returned 0x970 [0071.336] GetCurrentThreadId () returned 0x970 [0071.336] GetCurrentThreadId () returned 0x970 [0071.336] GetCurrentThreadId () returned 0x970 [0071.336] GetCurrentThreadId () returned 0x970 [0071.336] GetCurrentThreadId () returned 0x970 [0071.336] GetCurrentThreadId () returned 0x970 [0071.336] GetCurrentThreadId () returned 0x970 [0071.336] GetCurrentThreadId () returned 0x970 [0071.336] GetCurrentThreadId () returned 0x970 [0071.336] GetCurrentThreadId () returned 0x970 [0071.336] GetCurrentThreadId () returned 0x970 [0071.336] GetCurrentThreadId () returned 0x970 [0071.336] GetCurrentThreadId () returned 0x970 [0071.336] GetCurrentThreadId () returned 0x970 [0071.336] GetCurrentThreadId () returned 0x970 [0071.336] GetCurrentThreadId () returned 0x970 [0071.336] GetCurrentThreadId () returned 0x970 [0071.336] GetCurrentThreadId () returned 0x970 [0071.336] GetCurrentThreadId () returned 0x970 [0071.336] GetCurrentThreadId () returned 0x970 [0071.336] GetCurrentThreadId () returned 0x970 [0071.336] GetCurrentThreadId () returned 0x970 [0071.336] GetCurrentThreadId () returned 0x970 [0071.336] GetCurrentThreadId () returned 0x970 [0071.336] GetCurrentThreadId () returned 0x970 [0071.336] GetCurrentThreadId () returned 0x970 [0071.336] GetCurrentThreadId () returned 0x970 [0071.336] GetCurrentThreadId () returned 0x970 [0071.336] GetCurrentThreadId () returned 0x970 [0071.336] GetCurrentThreadId () returned 0x970 [0071.336] GetCurrentThreadId () returned 0x970 [0071.336] GetCurrentThreadId () returned 0x970 [0071.336] GetCurrentThreadId () returned 0x970 [0071.336] GetCurrentThreadId () returned 0x970 [0071.336] GetCurrentThreadId () returned 0x970 [0071.336] GetCurrentThreadId () returned 0x970 [0071.336] GetCurrentThreadId () returned 0x970 [0071.336] GetCurrentThreadId () returned 0x970 [0071.337] GetCurrentThreadId () returned 0x970 [0071.337] GetCurrentThreadId () returned 0x970 [0071.337] GetCurrentThreadId () returned 0x970 [0071.337] GetCurrentThreadId () returned 0x970 [0071.337] GetCurrentThreadId () returned 0x970 [0071.337] GetCurrentThreadId () returned 0x970 [0071.337] GetCurrentThreadId () returned 0x970 [0071.337] GetCurrentThreadId () returned 0x970 [0071.337] GetCurrentThreadId () returned 0x970 [0071.337] GetCurrentThreadId () returned 0x970 [0071.337] GetCurrentThreadId () returned 0x970 [0071.337] GetCurrentThreadId () returned 0x970 [0071.337] GetCurrentThreadId () returned 0x970 [0071.337] GetCurrentThreadId () returned 0x970 [0071.337] GetCurrentThreadId () returned 0x970 [0071.337] GetCurrentThreadId () returned 0x970 [0071.337] GetCurrentThreadId () returned 0x970 [0071.337] GetCurrentThreadId () returned 0x970 [0071.337] GetCurrentThreadId () returned 0x970 [0071.337] GetCurrentThreadId () returned 0x970 [0071.337] GetCurrentThreadId () returned 0x970 [0071.337] GetCurrentThreadId () returned 0x970 [0071.337] GetCurrentThreadId () returned 0x970 [0071.337] GetCurrentThreadId () returned 0x970 [0071.337] GetCurrentThreadId () returned 0x970 [0071.337] GetCurrentThreadId () returned 0x970 [0071.337] GetCurrentThreadId () returned 0x970 [0071.337] GetCurrentThreadId () returned 0x970 [0071.337] GetCurrentThreadId () returned 0x970 [0071.337] GetCurrentThreadId () returned 0x970 [0071.337] GetCurrentThreadId () returned 0x970 [0071.337] GetCurrentThreadId () returned 0x970 [0071.337] GetCurrentThreadId () returned 0x970 [0071.337] GetCurrentThreadId () returned 0x970 [0071.337] GetCurrentThreadId () returned 0x970 [0071.337] GetCurrentThreadId () returned 0x970 [0071.338] GetCurrentThreadId () returned 0x970 [0071.338] GetCurrentThreadId () returned 0x970 [0071.338] GetCurrentThreadId () returned 0x970 [0071.338] GetCurrentThreadId () returned 0x970 [0071.338] GetCurrentThreadId () returned 0x970 [0071.338] GetCurrentThreadId () returned 0x970 [0071.338] GetCurrentThreadId () returned 0x970 [0071.338] GetCurrentThreadId () returned 0x970 [0071.338] GetCurrentThreadId () returned 0x970 [0071.338] GetCurrentThreadId () returned 0x970 [0071.338] GetCurrentThreadId () returned 0x970 [0071.338] GetCurrentThreadId () returned 0x970 [0071.338] GetCurrentThreadId () returned 0x970 [0071.338] GetCurrentThreadId () returned 0x970 [0071.338] GetCurrentThreadId () returned 0x970 [0071.338] GetCurrentThreadId () returned 0x970 [0071.338] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.338] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.338] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379e718, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0071.338] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.338] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.338] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379e718, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0071.338] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.338] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.338] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0071.338] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.338] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.338] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0071.338] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.338] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.338] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379e778, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0071.338] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.338] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.338] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379e778, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0071.338] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.338] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.339] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379e778, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0071.339] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x12, wMilliseconds=0x268)) [0071.339] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HeBP4YR{XPc)+K3RA0\"Ob>{b:7O+()j<", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0071.339] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HeBP4YR{XPc)+K3RA0\"Ob>{b:7O+()j<", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0071.339] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HeBP4YR{XPc)+K3RA0\"Ob>{b:7O+()j<", cchWideChar=32, lpMultiByteStr=0x20051b8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HeBP4YR{XPc)+K3RA0\"Ob>{b:7O+()j<", lpUsedDefaultChar=0x0) returned 32 [0071.339] GetCurrentThreadId () returned 0x970 [0071.339] GetCurrentThreadId () returned 0x970 [0071.339] GetCurrentThreadId () returned 0x970 [0071.339] GetCurrentThreadId () returned 0x970 [0071.339] GetCurrentThreadId () returned 0x970 [0071.339] GetCurrentThreadId () returned 0x970 [0071.346] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0071.346] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0071.346] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x37b4f58, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0071.346] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ec848, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0071.346] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ec848, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAADEaWqf/068LE/TJFzsnpLjTuA30harKbKc3VrLsBzkj1So1GBrixhYNiOp8Sw4bzsowi9oKxvqYajlavv4kmr1954Wrs4yLqEqASWCjmR00VQKcJmWyhOPhOatrT5yC8KM4IpKgKQyv2GnQRHx+r9Qg/smnn1jij6mPAmUrq0ruy2iL4sUIjd1y86LHriCUYxCTVTBP9DZh8qdqOc3Vgcnark03U0MVPw==") returned 232 [0071.346] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x12, wMilliseconds=0x268)) [0071.347] GetCurrentThreadId () returned 0x970 [0071.347] GetCurrentThreadId () returned 0x970 [0071.347] GetCurrentThreadId () returned 0x970 [0071.347] GetCurrentThreadId () returned 0x970 [0071.347] GetCurrentThreadId () returned 0x970 [0071.347] GetCurrentThreadId () returned 0x970 [0071.347] GetCurrentThreadId () returned 0x970 [0071.347] GetCurrentThreadId () returned 0x970 [0071.347] GetCurrentThreadId () returned 0x970 [0071.347] GetCurrentThreadId () returned 0x970 [0071.347] GetCurrentThreadId () returned 0x970 [0071.347] GetCurrentThreadId () returned 0x970 [0071.347] GetCurrentThreadId () returned 0x970 [0071.347] GetCurrentThreadId () returned 0x970 [0071.347] GetCurrentThreadId () returned 0x970 [0071.347] GetCurrentThreadId () returned 0x970 [0071.347] GetCurrentThreadId () returned 0x970 [0071.347] GetCurrentThreadId () returned 0x970 [0071.347] GetCurrentThreadId () returned 0x970 [0071.347] GetCurrentThreadId () returned 0x970 [0071.347] GetCurrentThreadId () returned 0x970 [0071.347] GetCurrentThreadId () returned 0x970 [0071.347] GetCurrentThreadId () returned 0x970 [0071.347] GetCurrentThreadId () returned 0x970 [0071.347] GetCurrentThreadId () returned 0x970 [0071.347] GetCurrentThreadId () returned 0x970 [0071.347] GetCurrentThreadId () returned 0x970 [0071.347] GetCurrentThreadId () returned 0x970 [0071.347] GetCurrentThreadId () returned 0x970 [0071.347] GetCurrentThreadId () returned 0x970 [0071.347] GetCurrentThreadId () returned 0x970 [0071.347] GetCurrentThreadId () returned 0x970 [0071.347] GetCurrentThreadId () returned 0x970 [0071.347] GetCurrentThreadId () returned 0x970 [0071.347] GetCurrentThreadId () returned 0x970 [0071.347] GetCurrentThreadId () returned 0x970 [0071.347] GetCurrentThreadId () returned 0x970 [0071.347] GetCurrentThreadId () returned 0x970 [0071.347] GetCurrentThreadId () returned 0x970 [0071.347] GetCurrentThreadId () returned 0x970 [0071.347] GetCurrentThreadId () returned 0x970 [0071.347] GetCurrentThreadId () returned 0x970 [0071.347] GetCurrentThreadId () returned 0x970 [0071.347] GetCurrentThreadId () returned 0x970 [0071.348] GetCurrentThreadId () returned 0x970 [0071.348] GetCurrentThreadId () returned 0x970 [0071.348] GetCurrentThreadId () returned 0x970 [0071.348] GetCurrentThreadId () returned 0x970 [0071.348] GetCurrentThreadId () returned 0x970 [0071.348] GetCurrentThreadId () returned 0x970 [0071.348] GetCurrentThreadId () returned 0x970 [0071.348] GetCurrentThreadId () returned 0x970 [0071.348] GetCurrentThreadId () returned 0x970 [0071.348] GetCurrentThreadId () returned 0x970 [0071.348] GetCurrentThreadId () returned 0x970 [0071.348] GetCurrentThreadId () returned 0x970 [0071.348] GetCurrentThreadId () returned 0x970 [0071.348] GetCurrentThreadId () returned 0x970 [0071.348] GetCurrentThreadId () returned 0x970 [0071.348] GetCurrentThreadId () returned 0x970 [0071.348] GetCurrentThreadId () returned 0x970 [0071.348] GetCurrentThreadId () returned 0x970 [0071.348] GetCurrentThreadId () returned 0x970 [0071.348] GetCurrentThreadId () returned 0x970 [0071.348] GetCurrentThreadId () returned 0x970 [0071.348] GetCurrentThreadId () returned 0x970 [0071.348] GetCurrentThreadId () returned 0x970 [0071.348] GetCurrentThreadId () returned 0x970 [0071.348] GetCurrentThreadId () returned 0x970 [0071.348] GetCurrentThreadId () returned 0x970 [0071.348] GetCurrentThreadId () returned 0x970 [0071.348] GetCurrentThreadId () returned 0x970 [0071.348] GetCurrentThreadId () returned 0x970 [0071.348] GetCurrentThreadId () returned 0x970 [0071.348] GetCurrentThreadId () returned 0x970 [0071.348] GetCurrentThreadId () returned 0x970 [0071.348] GetCurrentThreadId () returned 0x970 [0071.348] GetCurrentThreadId () returned 0x970 [0071.348] GetCurrentThreadId () returned 0x970 [0071.348] GetCurrentThreadId () returned 0x970 [0071.348] GetCurrentThreadId () returned 0x970 [0071.348] GetCurrentThreadId () returned 0x970 [0071.348] GetCurrentThreadId () returned 0x970 [0071.348] GetCurrentThreadId () returned 0x970 [0071.348] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAADEaWqf/068LE/TJFzsnpLjTuA30harKbKc3VrLsBzkj1So1GBrixhYNiOp8Sw4bzsowi9oKxvqYajlavv4kmr1954Wrs4yLqEqASWCjmR00VQKcJmWyhOPhOatrT5yC8KM4IpKgKQyv2GnQRHx+r9Qg/smnn1jij6mPAmUrq0ruy2iL4sUIjd1y86LHriCUYxCTVTBP9DZh8qdqOc3Vgcnark03U0MVPw==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0071.348] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAADEaWqf/068LE/TJFzsnpLjTuA30harKbKc3VrLsBzkj1So1GBrixhYNiOp8Sw4bzsowi9oKxvqYajlavv4kmr1954Wrs4yLqEqASWCjmR00VQKcJmWyhOPhOatrT5yC8KM4IpKgKQyv2GnQRHx+r9Qg/smnn1jij6mPAmUrq0ruy2iL4sUIjd1y86LHriCUYxCTVTBP9DZh8qdqOc3Vgcnark03U0MVPw==", cchWideChar=245, lpMultiByteStr=0x353a65c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAADEaWqf/068LE/TJFzsnpLjTuA30harKbKc3VrLsBzkj1So1GBrixhYNiOp8Sw4bzsowi9oKxvqYajlavv4kmr1954Wrs4yLqEqASWCjmR00VQKcJmWyhOPhOatrT5yC8KM4IpKgKQyv2GnQRHx+r9Qg/smnn1jij6mPAmUrq0ruy2iL4sUIjd1y86LHriCUYxCTVTBP9DZh8qdqOc3Vgcnark03U0MVPw==", lpUsedDefaultChar=0x0) returned 245 [0071.349] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0071.349] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0071.349] CloseHandle (hObject=0x158) returned 1 [0071.349] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-shadow.png")) returned 0 [0071.349] GetLastError () returned 0x5 [0071.349] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-shadow.png")) returned 0x20 [0071.349] SetLastError (dwErrCode=0x5) [0071.349] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=19161279986) returned 1 [0071.349] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Файл зашифрован [Pets_image-frame-backglow.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\Файл зашифрован [pets_image-frame-backglow.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0071.350] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0071.350] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0071.350] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0071.350] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0071.351] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0071.351] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0071.351] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0071.351] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0071.351] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0071.351] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0071.351] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0071.351] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0071.351] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0071.351] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0071.351] SetEndOfFile (hFile=0x158) returned 1 [0071.351] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0071.351] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0071.352] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0071.352] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0071.352] WriteFile (in: hFile=0x158, lpBuffer=0x3777058*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777058*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0071.353] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0071.353] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="7brAXvrQm3Acg-:mgOMC@\"pqKpX\"ZFg~", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0071.353] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="7brAXvrQm3Acg-:mgOMC@\"pqKpX\"ZFg~", cchWideChar=32, lpMultiByteStr=0x2037fe4, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7brAXvrQm3Acg-:mgOMC@\"pqKpX\"ZFg~", lpUsedDefaultChar=0x0) returned 32 [0071.354] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0071.354] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0071.354] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-backglow.png", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x724eccba, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x724eccba, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea487e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1816, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_image-frame-backglow.png", cAlternateFileName="")) returned 0x295098 [0071.354] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0071.354] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0071.354] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-backglow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-backglow.png")) returned 0x20 [0071.354] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-backglow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-backglow.png")) returned 0x20 [0071.354] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-backglow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-backglow.png")) returned 0x20 [0071.354] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-backglow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-backglow.png")) returned 0x20 [0071.354] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-backglow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-backglow.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x724eccba, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x724eccba, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea487e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1816)) returned 1 [0071.355] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0071.355] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0071.355] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-backglow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-backglow.png")) returned 0x20 [0071.355] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-backglow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-backglow.png")) returned 0x20 [0071.355] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0071.355] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0071.355] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0071.355] SetEndOfFile (hFile=0x158) returned 1 [0071.356] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_image-frame-backglow.png", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0071.356] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_image-frame-backglow.png", cchWideChar=29, lpMultiByteStr=0x2004b5c, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_image-frame-backglow.png", lpUsedDefaultChar=0x0) returned 29 [0071.356] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_image-frame-backglow.png", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0071.356] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_image-frame-backglow.png", cchWideChar=29, lpMultiByteStr=0x2004e2c, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_image-frame-backglow.png", lpUsedDefaultChar=0x0) returned 29 [0071.356] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x2004e2c, cbMultiByte=29, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="Pets_image-frame-backglow.png.pngpngpngg") returned 29 [0071.356] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_image-frame-backglow.png", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0071.356] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_image-frame-backglow.png", cchWideChar=29, lpMultiByteStr=0x2004b5c, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_image-frame-backglow.png", lpUsedDefaultChar=0x0) returned 29 [0071.357] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-backglow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-backglow.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0071.357] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0071.357] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x1816 [0071.357] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0071.357] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0071.357] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0071.357] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_image-frame-backglow.png", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0071.357] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_image-frame-backglow.png", cchWideChar=29, lpMultiByteStr=0x2004b5c, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_image-frame-backglow.png", lpUsedDefaultChar=0x0) returned 29 [0071.358] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_image-frame-backglow.png", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0071.358] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_image-frame-backglow.png", cchWideChar=29, lpMultiByteStr=0x2004e2c, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_image-frame-backglow.png", lpUsedDefaultChar=0x0) returned 29 [0071.358] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x2004e2c, cbMultiByte=29, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="Pets_image-frame-backglow.pngow.png.pngpngpngg") returned 29 [0071.358] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_image-frame-backglow.png", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0071.358] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_image-frame-backglow.png", cchWideChar=29, lpMultiByteStr=0x2004b5c, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_image-frame-backglow.png", lpUsedDefaultChar=0x0) returned 29 [0071.358] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0071.359] CharToOemA (in: pSrc="Pets_image-frame-backglow.png", pDst=0x2004e2c | out: pDst="Pets_image-frame-backglow.png") returned 1 [0071.359] WriteFile (in: hFile=0x158, lpBuffer=0x2004e2c*, nNumberOfBytesToWrite=0x1d, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x2004e2c*, lpNumberOfBytesWritten=0x18e048*=0x1d, lpOverlapped=0x0) returned 1 [0071.359] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0071.359] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0071.359] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0071.360] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=19162299555) returned 1 [0071.360] ReadFile (in: hFile=0x11c, lpBuffer=0x3b549f0, nNumberOfBytesToRead=0x1816, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b549f0*, lpNumberOfBytesRead=0x18dd7c*=0x1816, lpOverlapped=0x0) returned 1 [0071.361] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0071.361] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=19162483226) returned 1 [0071.372] WriteFile (in: hFile=0x158, lpBuffer=0x379ae40*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379ae40*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0071.373] ReadFile (in: hFile=0x11c, lpBuffer=0x3b549f0, nNumberOfBytesToRead=0x1816, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3b549f0*, lpNumberOfBytesRead=0x18de38*=0x1816, lpOverlapped=0x0) returned 1 [0071.373] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x58 [0071.373] WriteFile (in: hFile=0x158, lpBuffer=0x3b97a10*, nNumberOfBytesToWrite=0x1816, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3b97a10*, lpNumberOfBytesWritten=0x18de10*=0x1816, lpOverlapped=0x0) returned 1 [0071.373] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x186e [0071.373] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0071.373] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0071.373] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0071.374] SetFilePointer (in: hFile=0x158, lDistanceToMove=29, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x3b [0071.374] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x1878 [0071.374] CloseHandle (hObject=0x11c) returned 1 [0071.374] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1878 [0071.374] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1878 [0071.374] SetFilePointer (in: hFile=0x158, lDistanceToMove=6264, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1878 [0071.374] SetFilePointer (in: hFile=0x158, lDistanceToMove=6264, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x1878 [0071.374] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1878 [0071.374] SetFilePointer (in: hFile=0x158, lDistanceToMove=6264, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x1878 [0071.374] SetEndOfFile (hFile=0x158) returned 1 [0071.375] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1878 [0071.375] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1878 [0071.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_image-frame-backglow.png", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0071.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_image-frame-backglow.png", cchWideChar=29, lpMultiByteStr=0x2004e2c, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_image-frame-backglow.png", lpUsedDefaultChar=0x0) returned 29 [0071.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_image-frame-backglow.png", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0071.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_image-frame-backglow.png", cchWideChar=29, lpMultiByteStr=0x2004b5c, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_image-frame-backglow.png", lpUsedDefaultChar=0x0) returned 29 [0071.375] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x2004b5c, cbMultiByte=29, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="Pets_image-frame-backglow.pngc䃌㫋¡棳ᠲ") returned 29 [0071.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_image-frame-backglow.png", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0071.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_image-frame-backglow.png", cchWideChar=29, lpMultiByteStr=0x2004e2c, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_image-frame-backglow.png", lpUsedDefaultChar=0x0) returned 29 [0071.375] WriteFile (in: hFile=0x158, lpBuffer=0x3b384c8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3b384c8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0071.375] CharToOemA (in: pSrc="Pets_image-frame-backglow.png", pDst=0x2004b5c | out: pDst="Pets_image-frame-backglow.png") returned 1 [0071.375] WriteFile (in: hFile=0x158, lpBuffer=0x2004b5c*, nNumberOfBytesToWrite=0x1d, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x2004b5c*, lpNumberOfBytesWritten=0x18efcc*=0x1d, lpOverlapped=0x0) returned 1 [0071.376] WriteFile (in: hFile=0x158, lpBuffer=0x379ae18*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379ae18*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0071.376] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0071.376] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0071.376] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x18ce [0071.376] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x18ce [0071.376] WriteFile (in: hFile=0x158, lpBuffer=0x3777058*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777058*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0071.376] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0071.376] DeleteFileW (lpFileName="") returned 0 [0071.376] GetLastError () returned 0x3 [0071.376] GetFileAttributesW (lpFileName="") returned 0xffffffff [0071.377] SetLastError (dwErrCode=0x3) [0071.377] FlushFileBuffers (hFile=0x158) returned 1 [0071.381] GetCurrentThreadId () returned 0x970 [0071.381] GetCurrentThreadId () returned 0x970 [0071.381] GetCurrentThreadId () returned 0x970 [0071.381] GetCurrentThreadId () returned 0x970 [0071.381] GetCurrentThreadId () returned 0x970 [0071.381] GetCurrentThreadId () returned 0x970 [0071.381] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x1985 [0071.381] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x1985 [0071.381] SetFilePointer (in: hFile=0x158, lDistanceToMove=6533, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x1985 [0071.381] CloseHandle (hObject=0x158) returned 1 [0071.382] GetCurrentThreadId () returned 0x970 [0071.382] GetCurrentThreadId () returned 0x970 [0071.382] GetCurrentThreadId () returned 0x970 [0071.382] GetCurrentThreadId () returned 0x970 [0071.382] GetCurrentThreadId () returned 0x970 [0071.382] GetCurrentThreadId () returned 0x970 [0071.382] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Файл зашифрован [Pets_image-frame-backglow.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\Файл зашифрован [pets_image-frame-backglow.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0071.382] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1985 [0071.382] SetFilePointer (in: hFile=0x158, lDistanceToMove=6405, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1905 [0071.382] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0071.382] GetFileType (hFile=0x158) returned 0x1 [0071.382] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x12, wMilliseconds=0x287)) [0071.382] GetCurrentThreadId () returned 0x970 [0071.382] GetCurrentThreadId () returned 0x970 [0071.382] GetCurrentThreadId () returned 0x970 [0071.382] GetCurrentThreadId () returned 0x970 [0071.382] GetCurrentThreadId () returned 0x970 [0071.382] GetCurrentThreadId () returned 0x970 [0071.382] GetCurrentThreadId () returned 0x970 [0071.382] GetCurrentThreadId () returned 0x970 [0071.382] GetCurrentThreadId () returned 0x970 [0071.382] GetCurrentThreadId () returned 0x970 [0071.383] GetCurrentThreadId () returned 0x970 [0071.383] GetCurrentThreadId () returned 0x970 [0071.383] GetCurrentThreadId () returned 0x970 [0071.383] GetCurrentThreadId () returned 0x970 [0071.383] GetCurrentThreadId () returned 0x970 [0071.383] GetCurrentThreadId () returned 0x970 [0071.383] GetCurrentThreadId () returned 0x970 [0071.383] GetCurrentThreadId () returned 0x970 [0071.383] GetCurrentThreadId () returned 0x970 [0071.383] GetCurrentThreadId () returned 0x970 [0071.383] GetCurrentThreadId () returned 0x970 [0071.383] GetCurrentThreadId () returned 0x970 [0071.383] GetCurrentThreadId () returned 0x970 [0071.383] GetCurrentThreadId () returned 0x970 [0071.383] GetCurrentThreadId () returned 0x970 [0071.383] GetCurrentThreadId () returned 0x970 [0071.383] GetCurrentThreadId () returned 0x970 [0071.383] GetCurrentThreadId () returned 0x970 [0071.383] GetCurrentThreadId () returned 0x970 [0071.383] GetCurrentThreadId () returned 0x970 [0071.383] GetCurrentThreadId () returned 0x970 [0071.383] GetCurrentThreadId () returned 0x970 [0071.383] GetCurrentThreadId () returned 0x970 [0071.383] GetCurrentThreadId () returned 0x970 [0071.383] GetCurrentThreadId () returned 0x970 [0071.383] GetCurrentThreadId () returned 0x970 [0071.383] GetCurrentThreadId () returned 0x970 [0071.383] GetCurrentThreadId () returned 0x970 [0071.383] GetCurrentThreadId () returned 0x970 [0071.383] GetCurrentThreadId () returned 0x970 [0071.383] GetCurrentThreadId () returned 0x970 [0071.383] GetCurrentThreadId () returned 0x970 [0071.383] GetCurrentThreadId () returned 0x970 [0071.383] GetCurrentThreadId () returned 0x970 [0071.383] GetCurrentThreadId () returned 0x970 [0071.383] GetCurrentThreadId () returned 0x970 [0071.383] GetCurrentThreadId () returned 0x970 [0071.383] GetCurrentThreadId () returned 0x970 [0071.383] GetCurrentThreadId () returned 0x970 [0071.384] GetCurrentThreadId () returned 0x970 [0071.384] GetCurrentThreadId () returned 0x970 [0071.384] GetCurrentThreadId () returned 0x970 [0071.384] GetCurrentThreadId () returned 0x970 [0071.384] GetCurrentThreadId () returned 0x970 [0071.384] GetCurrentThreadId () returned 0x970 [0071.384] GetCurrentThreadId () returned 0x970 [0071.384] GetCurrentThreadId () returned 0x970 [0071.384] GetCurrentThreadId () returned 0x970 [0071.384] GetCurrentThreadId () returned 0x970 [0071.384] GetCurrentThreadId () returned 0x970 [0071.384] GetCurrentThreadId () returned 0x970 [0071.384] GetCurrentThreadId () returned 0x970 [0071.384] GetCurrentThreadId () returned 0x970 [0071.384] GetCurrentThreadId () returned 0x970 [0071.384] GetCurrentThreadId () returned 0x970 [0071.384] GetCurrentThreadId () returned 0x970 [0071.384] GetCurrentThreadId () returned 0x970 [0071.384] GetCurrentThreadId () returned 0x970 [0071.384] GetCurrentThreadId () returned 0x970 [0071.384] GetCurrentThreadId () returned 0x970 [0071.384] GetCurrentThreadId () returned 0x970 [0071.384] GetCurrentThreadId () returned 0x970 [0071.384] GetCurrentThreadId () returned 0x970 [0071.384] GetCurrentThreadId () returned 0x970 [0071.384] GetCurrentThreadId () returned 0x970 [0071.384] GetCurrentThreadId () returned 0x970 [0071.384] GetCurrentThreadId () returned 0x970 [0071.384] GetCurrentThreadId () returned 0x970 [0071.384] GetCurrentThreadId () returned 0x970 [0071.384] GetCurrentThreadId () returned 0x970 [0071.384] GetCurrentThreadId () returned 0x970 [0071.384] GetCurrentThreadId () returned 0x970 [0071.384] GetCurrentThreadId () returned 0x970 [0071.384] GetCurrentThreadId () returned 0x970 [0071.384] GetCurrentThreadId () returned 0x970 [0071.384] GetCurrentThreadId () returned 0x970 [0071.385] GetCurrentThreadId () returned 0x970 [0071.385] GetCurrentThreadId () returned 0x970 [0071.385] GetCurrentThreadId () returned 0x970 [0071.385] GetCurrentThreadId () returned 0x970 [0071.385] GetCurrentThreadId () returned 0x970 [0071.385] GetCurrentThreadId () returned 0x970 [0071.385] GetCurrentThreadId () returned 0x970 [0071.385] GetCurrentThreadId () returned 0x970 [0071.385] GetCurrentThreadId () returned 0x970 [0071.385] GetCurrentThreadId () returned 0x970 [0071.385] GetCurrentThreadId () returned 0x970 [0071.385] GetCurrentThreadId () returned 0x970 [0071.385] GetCurrentThreadId () returned 0x970 [0071.385] GetCurrentThreadId () returned 0x970 [0071.385] GetCurrentThreadId () returned 0x970 [0071.385] GetCurrentThreadId () returned 0x970 [0071.385] GetCurrentThreadId () returned 0x970 [0071.385] GetCurrentThreadId () returned 0x970 [0071.385] GetCurrentThreadId () returned 0x970 [0071.385] GetCurrentThreadId () returned 0x970 [0071.385] GetCurrentThreadId () returned 0x970 [0071.385] GetCurrentThreadId () returned 0x970 [0071.385] GetCurrentThreadId () returned 0x970 [0071.385] GetCurrentThreadId () returned 0x970 [0071.385] GetCurrentThreadId () returned 0x970 [0071.385] GetCurrentThreadId () returned 0x970 [0071.385] GetCurrentThreadId () returned 0x970 [0071.385] GetCurrentThreadId () returned 0x970 [0071.385] GetCurrentThreadId () returned 0x970 [0071.385] GetCurrentThreadId () returned 0x970 [0071.385] GetCurrentThreadId () returned 0x970 [0071.385] GetCurrentThreadId () returned 0x970 [0071.385] GetCurrentThreadId () returned 0x970 [0071.385] GetCurrentThreadId () returned 0x970 [0071.385] GetCurrentThreadId () returned 0x970 [0071.385] GetCurrentThreadId () returned 0x970 [0071.385] GetCurrentThreadId () returned 0x970 [0071.385] GetCurrentThreadId () returned 0x970 [0071.385] GetCurrentThreadId () returned 0x970 [0071.385] GetCurrentThreadId () returned 0x970 [0071.386] GetCurrentThreadId () returned 0x970 [0071.386] GetCurrentThreadId () returned 0x970 [0071.386] GetCurrentThreadId () returned 0x970 [0071.386] GetCurrentThreadId () returned 0x970 [0071.386] GetCurrentThreadId () returned 0x970 [0071.386] GetCurrentThreadId () returned 0x970 [0071.386] GetCurrentThreadId () returned 0x970 [0071.386] GetCurrentThreadId () returned 0x970 [0071.386] GetCurrentThreadId () returned 0x970 [0071.386] GetCurrentThreadId () returned 0x970 [0071.386] GetCurrentThreadId () returned 0x970 [0071.386] GetCurrentThreadId () returned 0x970 [0071.386] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.386] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.386] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379e778, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0071.386] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.386] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.386] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379e778, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0071.386] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.386] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.386] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0071.386] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.386] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.386] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0071.386] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.386] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.386] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379e7d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0071.386] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.386] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.386] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379e7d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0071.386] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.386] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.386] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379e7d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0071.387] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x12, wMilliseconds=0x297)) [0071.387] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="7brAXvrQm3Acg-:mgOMC@\"pqKpX\"ZFg~", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0071.387] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="7brAXvrQm3Acg-:mgOMC@\"pqKpX\"ZFg~", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0071.387] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="7brAXvrQm3Acg-:mgOMC@\"pqKpX\"ZFg~", cchWideChar=32, lpMultiByteStr=0x20051e8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7brAXvrQm3Acg-:mgOMC@\"pqKpX\"ZFg~", lpUsedDefaultChar=0x0) returned 32 [0071.387] GetCurrentThreadId () returned 0x970 [0071.387] GetCurrentThreadId () returned 0x970 [0071.387] GetCurrentThreadId () returned 0x970 [0071.387] GetCurrentThreadId () returned 0x970 [0071.387] GetCurrentThreadId () returned 0x970 [0071.387] GetCurrentThreadId () returned 0x970 [0071.395] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0071.395] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0071.395] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x37b50e8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0071.395] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ec848, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0071.395] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ec848, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAF6XLyCN3zAYaUNCx1V6VcIdH1mfh5iL7zAvu0t/61k/eTIHmYilp2x0oyCrYsaZ/V8HBeIOhIjc1aPTSUnqVmy30CCW8Nmw4zZTur5V8/WO40B2Qpd8gkgq4SjJVGIaCjEpgl0H5//ganI7y3Y6d+JX8h5pQEWTHwyw26XrXdQErAlr/c6eq6tkKYF40tSZEA+HqCLogUDGXN1+6IyfK4BbhcJM0R5tNA==") returned 232 [0071.395] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x12, wMilliseconds=0x297)) [0071.395] GetCurrentThreadId () returned 0x970 [0071.396] GetCurrentThreadId () returned 0x970 [0071.396] GetCurrentThreadId () returned 0x970 [0071.396] GetCurrentThreadId () returned 0x970 [0071.396] GetCurrentThreadId () returned 0x970 [0071.396] GetCurrentThreadId () returned 0x970 [0071.396] GetCurrentThreadId () returned 0x970 [0071.396] GetCurrentThreadId () returned 0x970 [0071.396] GetCurrentThreadId () returned 0x970 [0071.396] GetCurrentThreadId () returned 0x970 [0071.396] GetCurrentThreadId () returned 0x970 [0071.396] GetCurrentThreadId () returned 0x970 [0071.396] GetCurrentThreadId () returned 0x970 [0071.396] GetCurrentThreadId () returned 0x970 [0071.396] GetCurrentThreadId () returned 0x970 [0071.396] GetCurrentThreadId () returned 0x970 [0071.396] GetCurrentThreadId () returned 0x970 [0071.396] GetCurrentThreadId () returned 0x970 [0071.396] GetCurrentThreadId () returned 0x970 [0071.396] GetCurrentThreadId () returned 0x970 [0071.396] GetCurrentThreadId () returned 0x970 [0071.396] GetCurrentThreadId () returned 0x970 [0071.396] GetCurrentThreadId () returned 0x970 [0071.396] GetCurrentThreadId () returned 0x970 [0071.396] GetCurrentThreadId () returned 0x970 [0071.396] GetCurrentThreadId () returned 0x970 [0071.396] GetCurrentThreadId () returned 0x970 [0071.396] GetCurrentThreadId () returned 0x970 [0071.396] GetCurrentThreadId () returned 0x970 [0071.396] GetCurrentThreadId () returned 0x970 [0071.396] GetCurrentThreadId () returned 0x970 [0071.396] GetCurrentThreadId () returned 0x970 [0071.396] GetCurrentThreadId () returned 0x970 [0071.396] GetCurrentThreadId () returned 0x970 [0071.396] GetCurrentThreadId () returned 0x970 [0071.396] GetCurrentThreadId () returned 0x970 [0071.396] GetCurrentThreadId () returned 0x970 [0071.396] GetCurrentThreadId () returned 0x970 [0071.396] GetCurrentThreadId () returned 0x970 [0071.396] GetCurrentThreadId () returned 0x970 [0071.396] GetCurrentThreadId () returned 0x970 [0071.396] GetCurrentThreadId () returned 0x970 [0071.397] GetCurrentThreadId () returned 0x970 [0071.397] GetCurrentThreadId () returned 0x970 [0071.397] GetCurrentThreadId () returned 0x970 [0071.397] GetCurrentThreadId () returned 0x970 [0071.397] GetCurrentThreadId () returned 0x970 [0071.397] GetCurrentThreadId () returned 0x970 [0071.397] GetCurrentThreadId () returned 0x970 [0071.397] GetCurrentThreadId () returned 0x970 [0071.397] GetCurrentThreadId () returned 0x970 [0071.397] GetCurrentThreadId () returned 0x970 [0071.397] GetCurrentThreadId () returned 0x970 [0071.397] GetCurrentThreadId () returned 0x970 [0071.397] GetCurrentThreadId () returned 0x970 [0071.397] GetCurrentThreadId () returned 0x970 [0071.397] GetCurrentThreadId () returned 0x970 [0071.397] GetCurrentThreadId () returned 0x970 [0071.397] GetCurrentThreadId () returned 0x970 [0071.397] GetCurrentThreadId () returned 0x970 [0071.397] GetCurrentThreadId () returned 0x970 [0071.397] GetCurrentThreadId () returned 0x970 [0071.397] GetCurrentThreadId () returned 0x970 [0071.397] GetCurrentThreadId () returned 0x970 [0071.397] GetCurrentThreadId () returned 0x970 [0071.397] GetCurrentThreadId () returned 0x970 [0071.397] GetCurrentThreadId () returned 0x970 [0071.397] GetCurrentThreadId () returned 0x970 [0071.397] GetCurrentThreadId () returned 0x970 [0071.397] GetCurrentThreadId () returned 0x970 [0071.397] GetCurrentThreadId () returned 0x970 [0071.397] GetCurrentThreadId () returned 0x970 [0071.397] GetCurrentThreadId () returned 0x970 [0071.397] GetCurrentThreadId () returned 0x970 [0071.397] GetCurrentThreadId () returned 0x970 [0071.397] GetCurrentThreadId () returned 0x970 [0071.397] GetCurrentThreadId () returned 0x970 [0071.397] GetCurrentThreadId () returned 0x970 [0071.397] GetCurrentThreadId () returned 0x970 [0071.397] GetCurrentThreadId () returned 0x970 [0071.397] GetCurrentThreadId () returned 0x970 [0071.397] GetCurrentThreadId () returned 0x970 [0071.397] GetCurrentThreadId () returned 0x970 [0071.398] GetCurrentThreadId () returned 0x970 [0071.398] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAF6XLyCN3zAYaUNCx1V6VcIdH1mfh5iL7zAvu0t/61k/eTIHmYilp2x0oyCrYsaZ/V8HBeIOhIjc1aPTSUnqVmy30CCW8Nmw4zZTur5V8/WO40B2Qpd8gkgq4SjJVGIaCjEpgl0H5//ganI7y3Y6d+JX8h5pQEWTHwyw26XrXdQErAlr/c6eq6tkKYF40tSZEA+HqCLogUDGXN1+6IyfK4BbhcJM0R5tNA==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0071.398] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAF6XLyCN3zAYaUNCx1V6VcIdH1mfh5iL7zAvu0t/61k/eTIHmYilp2x0oyCrYsaZ/V8HBeIOhIjc1aPTSUnqVmy30CCW8Nmw4zZTur5V8/WO40B2Qpd8gkgq4SjJVGIaCjEpgl0H5//ganI7y3Y6d+JX8h5pQEWTHwyw26XrXdQErAlr/c6eq6tkKYF40tSZEA+HqCLogUDGXN1+6IyfK4BbhcJM0R5tNA==", cchWideChar=245, lpMultiByteStr=0x353a65c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAF6XLyCN3zAYaUNCx1V6VcIdH1mfh5iL7zAvu0t/61k/eTIHmYilp2x0oyCrYsaZ/V8HBeIOhIjc1aPTSUnqVmy30CCW8Nmw4zZTur5V8/WO40B2Qpd8gkgq4SjJVGIaCjEpgl0H5//ganI7y3Y6d+JX8h5pQEWTHwyw26XrXdQErAlr/c6eq6tkKYF40tSZEA+HqCLogUDGXN1+6IyfK4BbhcJM0R5tNA==", lpUsedDefaultChar=0x0) returned 245 [0071.398] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0071.398] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0071.398] CloseHandle (hObject=0x158) returned 1 [0071.398] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-backglow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-backglow.png")) returned 0 [0071.398] GetLastError () returned 0x5 [0071.398] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-backglow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-backglow.png")) returned 0x20 [0071.398] SetLastError (dwErrCode=0x5) [0071.398] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=19166183177) returned 1 [0071.398] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Файл зашифрован [Pets_image-frame-border.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\Файл зашифрован [pets_image-frame-border.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0071.399] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0071.399] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0071.399] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0071.399] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0071.399] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0071.400] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0071.400] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0071.400] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0071.400] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0071.400] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0071.400] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0071.400] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0071.400] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0071.400] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0071.400] SetEndOfFile (hFile=0x158) returned 1 [0071.400] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0071.400] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0071.400] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0071.401] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0071.401] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0071.402] WriteFile (in: hFile=0x158, lpBuffer=0x35f035c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f035c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0071.402] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="%>+v?5u*PfZdcG0O*e@/Uf.N/yMCuXAb", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0071.402] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="%>+v?5u*PfZdcG0O*e@/Uf.N/yMCuXAb", cchWideChar=32, lpMultiByteStr=0x203801c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="%>+v?5u*PfZdcG0O*e@/Uf.N/yMCuXAb", lpUsedDefaultChar=0x0) returned 32 [0071.402] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0071.402] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0071.402] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x724eccba, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x724eccba, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea487e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1f0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_image-frame-border.png", cAlternateFileName="")) returned 0x295098 [0071.402] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0071.402] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0071.403] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-border.png")) returned 0x20 [0071.403] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-border.png")) returned 0x20 [0071.403] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-border.png")) returned 0x20 [0071.403] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-border.png")) returned 0x20 [0071.403] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-border.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x724eccba, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x724eccba, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea487e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1f0a)) returned 1 [0071.403] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0071.403] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0071.403] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-border.png")) returned 0x20 [0071.403] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-border.png")) returned 0x20 [0071.404] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0071.404] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0071.404] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0071.404] SetEndOfFile (hFile=0x158) returned 1 [0071.405] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_image-frame-border.png", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0071.405] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_image-frame-border.png", cchWideChar=27, lpMultiByteStr=0x2004c7c, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_image-frame-border.png", lpUsedDefaultChar=0x0) returned 27 [0071.405] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_image-frame-border.png", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0071.405] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_image-frame-border.png", cchWideChar=27, lpMultiByteStr=0x2004dfc, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_image-frame-border.png", lpUsedDefaultChar=0x0) returned 27 [0071.405] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x2004dfc, cbMultiByte=27, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="Pets_image-frame-border.pngng.pngpngpngg") returned 27 [0071.405] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_image-frame-border.png", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0071.405] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_image-frame-border.png", cchWideChar=27, lpMultiByteStr=0x2004c7c, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_image-frame-border.png", lpUsedDefaultChar=0x0) returned 27 [0071.405] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-border.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0071.406] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0071.406] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x1f0a [0071.406] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0071.406] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0071.406] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0071.406] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_image-frame-border.png", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0071.406] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_image-frame-border.png", cchWideChar=27, lpMultiByteStr=0x2004c7c, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_image-frame-border.png", lpUsedDefaultChar=0x0) returned 27 [0071.406] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_image-frame-border.png", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0071.406] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_image-frame-border.png", cchWideChar=27, lpMultiByteStr=0x2004dfc, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_image-frame-border.png", lpUsedDefaultChar=0x0) returned 27 [0071.406] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x2004dfc, cbMultiByte=27, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="Pets_image-frame-border.pnger.pngng.pngpngpngg") returned 27 [0071.406] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_image-frame-border.png", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0071.406] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_image-frame-border.png", cchWideChar=27, lpMultiByteStr=0x2004c7c, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_image-frame-border.png", lpUsedDefaultChar=0x0) returned 27 [0071.407] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0071.408] CharToOemA (in: pSrc="Pets_image-frame-border.png", pDst=0x2004dfc | out: pDst="Pets_image-frame-border.png") returned 1 [0071.408] WriteFile (in: hFile=0x158, lpBuffer=0x2004dfc*, nNumberOfBytesToWrite=0x1b, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x2004dfc*, lpNumberOfBytesWritten=0x18e048*=0x1b, lpOverlapped=0x0) returned 1 [0071.408] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0071.408] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0071.408] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0071.408] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=19167153148) returned 1 [0071.408] ReadFile (in: hFile=0x11c, lpBuffer=0x3b549f0, nNumberOfBytesToRead=0x1f0a, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b549f0*, lpNumberOfBytesRead=0x18dd7c*=0x1f0a, lpOverlapped=0x0) returned 1 [0071.410] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0071.410] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=19168125414) returned 1 [0071.430] WriteFile (in: hFile=0x158, lpBuffer=0x379ac90*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379ac90*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0071.430] ReadFile (in: hFile=0x11c, lpBuffer=0x3b549f0, nNumberOfBytesToRead=0x1f0a, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3b549f0*, lpNumberOfBytesRead=0x18de38*=0x1f0a, lpOverlapped=0x0) returned 1 [0071.430] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x56 [0071.430] WriteFile (in: hFile=0x158, lpBuffer=0x3b98110*, nNumberOfBytesToWrite=0x1f0a, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3b98110*, lpNumberOfBytesWritten=0x18de10*=0x1f0a, lpOverlapped=0x0) returned 1 [0071.431] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x1f60 [0071.431] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0071.431] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0071.431] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0071.431] SetFilePointer (in: hFile=0x158, lDistanceToMove=27, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x39 [0071.431] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x1f6a [0071.431] CloseHandle (hObject=0x11c) returned 1 [0071.431] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1f6a [0071.431] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1f6a [0071.431] SetFilePointer (in: hFile=0x158, lDistanceToMove=8042, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1f6a [0071.431] SetFilePointer (in: hFile=0x158, lDistanceToMove=8042, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x1f6a [0071.432] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1f6a [0071.432] SetFilePointer (in: hFile=0x158, lDistanceToMove=8042, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x1f6a [0071.432] SetEndOfFile (hFile=0x158) returned 1 [0071.432] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1f6a [0071.432] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1f6a [0071.432] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_image-frame-border.png", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0071.432] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_image-frame-border.png", cchWideChar=27, lpMultiByteStr=0x2004dfc, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_image-frame-border.png", lpUsedDefaultChar=0x0) returned 27 [0071.432] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_image-frame-border.png", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0071.432] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_image-frame-border.png", cchWideChar=27, lpMultiByteStr=0x2004c7c, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_image-frame-border.png", lpUsedDefaultChar=0x0) returned 27 [0071.432] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x2004c7c, cbMultiByte=27, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="Pets_image-frame-border.png\x14\x01c䃌㫋ạἦ") returned 27 [0071.432] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_image-frame-border.png", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0071.432] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_image-frame-border.png", cchWideChar=27, lpMultiByteStr=0x2004dfc, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_image-frame-border.png", lpUsedDefaultChar=0x0) returned 27 [0071.432] WriteFile (in: hFile=0x158, lpBuffer=0x3b384c8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3b384c8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0071.432] CharToOemA (in: pSrc="Pets_image-frame-border.png", pDst=0x2004c7c | out: pDst="Pets_image-frame-border.png") returned 1 [0071.432] WriteFile (in: hFile=0x158, lpBuffer=0x2004c7c*, nNumberOfBytesToWrite=0x1b, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x2004c7c*, lpNumberOfBytesWritten=0x18efcc*=0x1b, lpOverlapped=0x0) returned 1 [0071.433] WriteFile (in: hFile=0x158, lpBuffer=0x379ad88*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379ad88*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0071.433] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0071.433] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0071.433] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1fbe [0071.433] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1fbe [0071.433] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0071.433] WriteFile (in: hFile=0x158, lpBuffer=0x35f035c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f035c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0071.433] DeleteFileW (lpFileName="") returned 0 [0071.433] GetLastError () returned 0x3 [0071.433] GetFileAttributesW (lpFileName="") returned 0xffffffff [0071.433] SetLastError (dwErrCode=0x3) [0071.433] FlushFileBuffers (hFile=0x158) returned 1 [0071.442] GetCurrentThreadId () returned 0x970 [0071.442] GetCurrentThreadId () returned 0x970 [0071.442] GetCurrentThreadId () returned 0x970 [0071.442] GetCurrentThreadId () returned 0x970 [0071.442] GetCurrentThreadId () returned 0x970 [0071.442] GetCurrentThreadId () returned 0x970 [0071.442] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x2075 [0071.443] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x2075 [0071.443] SetFilePointer (in: hFile=0x158, lDistanceToMove=8309, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x2075 [0071.443] CloseHandle (hObject=0x158) returned 1 [0071.443] GetCurrentThreadId () returned 0x970 [0071.443] GetCurrentThreadId () returned 0x970 [0071.443] GetCurrentThreadId () returned 0x970 [0071.443] GetCurrentThreadId () returned 0x970 [0071.443] GetCurrentThreadId () returned 0x970 [0071.443] GetCurrentThreadId () returned 0x970 [0071.443] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Файл зашифрован [Pets_image-frame-border.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\Файл зашифрован [pets_image-frame-border.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0071.443] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2075 [0071.443] SetFilePointer (in: hFile=0x158, lDistanceToMove=8181, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1ff5 [0071.443] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0071.443] GetFileType (hFile=0x158) returned 0x1 [0071.443] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x12, wMilliseconds=0x2c6)) [0071.443] GetCurrentThreadId () returned 0x970 [0071.443] GetCurrentThreadId () returned 0x970 [0071.443] GetCurrentThreadId () returned 0x970 [0071.444] GetCurrentThreadId () returned 0x970 [0071.444] GetCurrentThreadId () returned 0x970 [0071.444] GetCurrentThreadId () returned 0x970 [0071.444] GetCurrentThreadId () returned 0x970 [0071.444] GetCurrentThreadId () returned 0x970 [0071.444] GetCurrentThreadId () returned 0x970 [0071.444] GetCurrentThreadId () returned 0x970 [0071.444] GetCurrentThreadId () returned 0x970 [0071.444] GetCurrentThreadId () returned 0x970 [0071.444] GetCurrentThreadId () returned 0x970 [0071.444] GetCurrentThreadId () returned 0x970 [0071.444] GetCurrentThreadId () returned 0x970 [0071.444] GetCurrentThreadId () returned 0x970 [0071.444] GetCurrentThreadId () returned 0x970 [0071.444] GetCurrentThreadId () returned 0x970 [0071.444] GetCurrentThreadId () returned 0x970 [0071.444] GetCurrentThreadId () returned 0x970 [0071.444] GetCurrentThreadId () returned 0x970 [0071.444] GetCurrentThreadId () returned 0x970 [0071.444] GetCurrentThreadId () returned 0x970 [0071.444] GetCurrentThreadId () returned 0x970 [0071.444] GetCurrentThreadId () returned 0x970 [0071.444] GetCurrentThreadId () returned 0x970 [0071.444] GetCurrentThreadId () returned 0x970 [0071.444] GetCurrentThreadId () returned 0x970 [0071.444] GetCurrentThreadId () returned 0x970 [0071.444] GetCurrentThreadId () returned 0x970 [0071.444] GetCurrentThreadId () returned 0x970 [0071.444] GetCurrentThreadId () returned 0x970 [0071.444] GetCurrentThreadId () returned 0x970 [0071.444] GetCurrentThreadId () returned 0x970 [0071.444] GetCurrentThreadId () returned 0x970 [0071.444] GetCurrentThreadId () returned 0x970 [0071.444] GetCurrentThreadId () returned 0x970 [0071.444] GetCurrentThreadId () returned 0x970 [0071.444] GetCurrentThreadId () returned 0x970 [0071.444] GetCurrentThreadId () returned 0x970 [0071.444] GetCurrentThreadId () returned 0x970 [0071.444] GetCurrentThreadId () returned 0x970 [0071.444] GetCurrentThreadId () returned 0x970 [0071.444] GetCurrentThreadId () returned 0x970 [0071.445] GetCurrentThreadId () returned 0x970 [0071.445] GetCurrentThreadId () returned 0x970 [0071.445] GetCurrentThreadId () returned 0x970 [0071.445] GetCurrentThreadId () returned 0x970 [0071.445] GetCurrentThreadId () returned 0x970 [0071.445] GetCurrentThreadId () returned 0x970 [0071.445] GetCurrentThreadId () returned 0x970 [0071.445] GetCurrentThreadId () returned 0x970 [0071.445] GetCurrentThreadId () returned 0x970 [0071.445] GetCurrentThreadId () returned 0x970 [0071.445] GetCurrentThreadId () returned 0x970 [0071.445] GetCurrentThreadId () returned 0x970 [0071.445] GetCurrentThreadId () returned 0x970 [0071.445] GetCurrentThreadId () returned 0x970 [0071.445] GetCurrentThreadId () returned 0x970 [0071.445] GetCurrentThreadId () returned 0x970 [0071.445] GetCurrentThreadId () returned 0x970 [0071.445] GetCurrentThreadId () returned 0x970 [0071.445] GetCurrentThreadId () returned 0x970 [0071.445] GetCurrentThreadId () returned 0x970 [0071.445] GetCurrentThreadId () returned 0x970 [0071.445] GetCurrentThreadId () returned 0x970 [0071.445] GetCurrentThreadId () returned 0x970 [0071.445] GetCurrentThreadId () returned 0x970 [0071.445] GetCurrentThreadId () returned 0x970 [0071.445] GetCurrentThreadId () returned 0x970 [0071.445] GetCurrentThreadId () returned 0x970 [0071.445] GetCurrentThreadId () returned 0x970 [0071.445] GetCurrentThreadId () returned 0x970 [0071.445] GetCurrentThreadId () returned 0x970 [0071.445] GetCurrentThreadId () returned 0x970 [0071.445] GetCurrentThreadId () returned 0x970 [0071.445] GetCurrentThreadId () returned 0x970 [0071.445] GetCurrentThreadId () returned 0x970 [0071.445] GetCurrentThreadId () returned 0x970 [0071.445] GetCurrentThreadId () returned 0x970 [0071.445] GetCurrentThreadId () returned 0x970 [0071.445] GetCurrentThreadId () returned 0x970 [0071.445] GetCurrentThreadId () returned 0x970 [0071.445] GetCurrentThreadId () returned 0x970 [0071.445] GetCurrentThreadId () returned 0x970 [0071.445] GetCurrentThreadId () returned 0x970 [0071.446] GetCurrentThreadId () returned 0x970 [0071.446] GetCurrentThreadId () returned 0x970 [0071.446] GetCurrentThreadId () returned 0x970 [0071.446] GetCurrentThreadId () returned 0x970 [0071.446] GetCurrentThreadId () returned 0x970 [0071.446] GetCurrentThreadId () returned 0x970 [0071.446] GetCurrentThreadId () returned 0x970 [0071.446] GetCurrentThreadId () returned 0x970 [0071.446] GetCurrentThreadId () returned 0x970 [0071.446] GetCurrentThreadId () returned 0x970 [0071.446] GetCurrentThreadId () returned 0x970 [0071.446] GetCurrentThreadId () returned 0x970 [0071.446] GetCurrentThreadId () returned 0x970 [0071.446] GetCurrentThreadId () returned 0x970 [0071.446] GetCurrentThreadId () returned 0x970 [0071.446] GetCurrentThreadId () returned 0x970 [0071.446] GetCurrentThreadId () returned 0x970 [0071.446] GetCurrentThreadId () returned 0x970 [0071.446] GetCurrentThreadId () returned 0x970 [0071.446] GetCurrentThreadId () returned 0x970 [0071.446] GetCurrentThreadId () returned 0x970 [0071.446] GetCurrentThreadId () returned 0x970 [0071.446] GetCurrentThreadId () returned 0x970 [0071.446] GetCurrentThreadId () returned 0x970 [0071.446] GetCurrentThreadId () returned 0x970 [0071.446] GetCurrentThreadId () returned 0x970 [0071.446] GetCurrentThreadId () returned 0x970 [0071.446] GetCurrentThreadId () returned 0x970 [0071.446] GetCurrentThreadId () returned 0x970 [0071.446] GetCurrentThreadId () returned 0x970 [0071.446] GetCurrentThreadId () returned 0x970 [0071.446] GetCurrentThreadId () returned 0x970 [0071.446] GetCurrentThreadId () returned 0x970 [0071.446] GetCurrentThreadId () returned 0x970 [0071.446] GetCurrentThreadId () returned 0x970 [0071.446] GetCurrentThreadId () returned 0x970 [0071.446] GetCurrentThreadId () returned 0x970 [0071.446] GetCurrentThreadId () returned 0x970 [0071.446] GetCurrentThreadId () returned 0x970 [0071.446] GetCurrentThreadId () returned 0x970 [0071.446] GetCurrentThreadId () returned 0x970 [0071.446] GetCurrentThreadId () returned 0x970 [0071.446] GetCurrentThreadId () returned 0x970 [0071.447] GetCurrentThreadId () returned 0x970 [0071.447] GetCurrentThreadId () returned 0x970 [0071.447] GetCurrentThreadId () returned 0x970 [0071.447] GetCurrentThreadId () returned 0x970 [0071.447] GetCurrentThreadId () returned 0x970 [0071.447] GetCurrentThreadId () returned 0x970 [0071.447] GetCurrentThreadId () returned 0x970 [0071.447] GetCurrentThreadId () returned 0x970 [0071.447] GetCurrentThreadId () returned 0x970 [0071.447] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.447] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.447] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379e7d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0071.447] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.447] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.447] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379e7d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0071.447] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.447] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.447] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0071.447] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.447] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.447] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0071.447] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.447] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.447] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379e838, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0071.447] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.447] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.447] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379e838, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0071.447] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.447] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.447] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379e838, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0071.447] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x12, wMilliseconds=0x2d5)) [0071.447] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="%>+v?5u*PfZdcG0O*e@/Uf.N/yMCuXAb", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0071.447] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="%>+v?5u*PfZdcG0O*e@/Uf.N/yMCuXAb", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0071.448] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="%>+v?5u*PfZdcG0O*e@/Uf.N/yMCuXAb", cchWideChar=32, lpMultiByteStr=0x2005218, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="%>+v?5u*PfZdcG0O*e@/Uf.N/yMCuXAb", lpUsedDefaultChar=0x0) returned 32 [0071.448] GetCurrentThreadId () returned 0x970 [0071.448] GetCurrentThreadId () returned 0x970 [0071.448] GetCurrentThreadId () returned 0x970 [0071.448] GetCurrentThreadId () returned 0x970 [0071.448] GetCurrentThreadId () returned 0x970 [0071.448] GetCurrentThreadId () returned 0x970 [0071.455] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0071.455] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0071.455] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x37b5098, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0071.455] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ec848, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0071.455] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ec848, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAABi6H/WBh2lAhrZLGeet9bfQ0x6QM63z7+EhscjKwBxIpliDmrhfQdAQaxjs1dO1Ubg8R1Ji2A4kg3Rx6XN+OSY1cDgoFFHL0bz51th0biCKJO48sDCrLLpBpeov0JKgilB6mQb8FnONUCrDcMPjYdiWaHbUZayr7gHrPZ6cyugACI0M3QQwNRsLiGMA+207dL7MfGB0GFgU8cVXF4KMmI/84JwpmZS0Gg==") returned 232 [0071.455] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x12, wMilliseconds=0x2d5)) [0071.455] GetCurrentThreadId () returned 0x970 [0071.455] GetCurrentThreadId () returned 0x970 [0071.455] GetCurrentThreadId () returned 0x970 [0071.455] GetCurrentThreadId () returned 0x970 [0071.455] GetCurrentThreadId () returned 0x970 [0071.456] GetCurrentThreadId () returned 0x970 [0071.456] GetCurrentThreadId () returned 0x970 [0071.456] GetCurrentThreadId () returned 0x970 [0071.456] GetCurrentThreadId () returned 0x970 [0071.456] GetCurrentThreadId () returned 0x970 [0071.456] GetCurrentThreadId () returned 0x970 [0071.456] GetCurrentThreadId () returned 0x970 [0071.456] GetCurrentThreadId () returned 0x970 [0071.456] GetCurrentThreadId () returned 0x970 [0071.456] GetCurrentThreadId () returned 0x970 [0071.456] GetCurrentThreadId () returned 0x970 [0071.456] GetCurrentThreadId () returned 0x970 [0071.456] GetCurrentThreadId () returned 0x970 [0071.456] GetCurrentThreadId () returned 0x970 [0071.456] GetCurrentThreadId () returned 0x970 [0071.456] GetCurrentThreadId () returned 0x970 [0071.456] GetCurrentThreadId () returned 0x970 [0071.456] GetCurrentThreadId () returned 0x970 [0071.456] GetCurrentThreadId () returned 0x970 [0071.456] GetCurrentThreadId () returned 0x970 [0071.456] GetCurrentThreadId () returned 0x970 [0071.456] GetCurrentThreadId () returned 0x970 [0071.456] GetCurrentThreadId () returned 0x970 [0071.456] GetCurrentThreadId () returned 0x970 [0071.456] GetCurrentThreadId () returned 0x970 [0071.456] GetCurrentThreadId () returned 0x970 [0071.456] GetCurrentThreadId () returned 0x970 [0071.456] GetCurrentThreadId () returned 0x970 [0071.456] GetCurrentThreadId () returned 0x970 [0071.456] GetCurrentThreadId () returned 0x970 [0071.456] GetCurrentThreadId () returned 0x970 [0071.456] GetCurrentThreadId () returned 0x970 [0071.456] GetCurrentThreadId () returned 0x970 [0071.456] GetCurrentThreadId () returned 0x970 [0071.456] GetCurrentThreadId () returned 0x970 [0071.456] GetCurrentThreadId () returned 0x970 [0071.456] GetCurrentThreadId () returned 0x970 [0071.456] GetCurrentThreadId () returned 0x970 [0071.456] GetCurrentThreadId () returned 0x970 [0071.456] GetCurrentThreadId () returned 0x970 [0071.456] GetCurrentThreadId () returned 0x970 [0071.456] GetCurrentThreadId () returned 0x970 [0071.456] GetCurrentThreadId () returned 0x970 [0071.456] GetCurrentThreadId () returned 0x970 [0071.457] GetCurrentThreadId () returned 0x970 [0071.457] GetCurrentThreadId () returned 0x970 [0071.457] GetCurrentThreadId () returned 0x970 [0071.457] GetCurrentThreadId () returned 0x970 [0071.457] GetCurrentThreadId () returned 0x970 [0071.457] GetCurrentThreadId () returned 0x970 [0071.457] GetCurrentThreadId () returned 0x970 [0071.457] GetCurrentThreadId () returned 0x970 [0071.457] GetCurrentThreadId () returned 0x970 [0071.457] GetCurrentThreadId () returned 0x970 [0071.457] GetCurrentThreadId () returned 0x970 [0071.457] GetCurrentThreadId () returned 0x970 [0071.457] GetCurrentThreadId () returned 0x970 [0071.457] GetCurrentThreadId () returned 0x970 [0071.457] GetCurrentThreadId () returned 0x970 [0071.457] GetCurrentThreadId () returned 0x970 [0071.457] GetCurrentThreadId () returned 0x970 [0071.457] GetCurrentThreadId () returned 0x970 [0071.457] GetCurrentThreadId () returned 0x970 [0071.457] GetCurrentThreadId () returned 0x970 [0071.457] GetCurrentThreadId () returned 0x970 [0071.457] GetCurrentThreadId () returned 0x970 [0071.457] GetCurrentThreadId () returned 0x970 [0071.457] GetCurrentThreadId () returned 0x970 [0071.457] GetCurrentThreadId () returned 0x970 [0071.457] GetCurrentThreadId () returned 0x970 [0071.457] GetCurrentThreadId () returned 0x970 [0071.457] GetCurrentThreadId () returned 0x970 [0071.457] GetCurrentThreadId () returned 0x970 [0071.457] GetCurrentThreadId () returned 0x970 [0071.457] GetCurrentThreadId () returned 0x970 [0071.457] GetCurrentThreadId () returned 0x970 [0071.457] GetCurrentThreadId () returned 0x970 [0071.457] GetCurrentThreadId () returned 0x970 [0071.457] GetCurrentThreadId () returned 0x970 [0071.457] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAABi6H/WBh2lAhrZLGeet9bfQ0x6QM63z7+EhscjKwBxIpliDmrhfQdAQaxjs1dO1Ubg8R1Ji2A4kg3Rx6XN+OSY1cDgoFFHL0bz51th0biCKJO48sDCrLLpBpeov0JKgilB6mQb8FnONUCrDcMPjYdiWaHbUZayr7gHrPZ6cyugACI0M3QQwNRsLiGMA+207dL7MfGB0GFgU8cVXF4KMmI/84JwpmZS0Gg==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0071.457] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAABi6H/WBh2lAhrZLGeet9bfQ0x6QM63z7+EhscjKwBxIpliDmrhfQdAQaxjs1dO1Ubg8R1Ji2A4kg3Rx6XN+OSY1cDgoFFHL0bz51th0biCKJO48sDCrLLpBpeov0JKgilB6mQb8FnONUCrDcMPjYdiWaHbUZayr7gHrPZ6cyugACI0M3QQwNRsLiGMA+207dL7MfGB0GFgU8cVXF4KMmI/84JwpmZS0Gg==", cchWideChar=245, lpMultiByteStr=0x353a65c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAABi6H/WBh2lAhrZLGeet9bfQ0x6QM63z7+EhscjKwBxIpliDmrhfQdAQaxjs1dO1Ubg8R1Ji2A4kg3Rx6XN+OSY1cDgoFFHL0bz51th0biCKJO48sDCrLLpBpeov0JKgilB6mQb8FnONUCrDcMPjYdiWaHbUZayr7gHrPZ6cyugACI0M3QQwNRsLiGMA+207dL7MfGB0GFgU8cVXF4KMmI/84JwpmZS0Gg==", lpUsedDefaultChar=0x0) returned 245 [0071.457] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0071.458] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0071.465] CloseHandle (hObject=0x158) returned 1 [0071.465] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-border.png")) returned 0 [0071.465] GetLastError () returned 0x5 [0071.465] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-border.png")) returned 0x20 [0071.465] SetLastError (dwErrCode=0x5) [0071.465] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=19172867816) returned 1 [0071.465] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Файл зашифрован [Pets_image-frame-ImageMask.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\Файл зашифрован [pets_image-frame-imagemask.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0071.466] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0071.466] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0071.466] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0071.466] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0071.466] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0071.466] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0071.466] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0071.466] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0071.466] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0071.466] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0071.467] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0071.467] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0071.467] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0071.467] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0071.467] SetEndOfFile (hFile=0x158) returned 1 [0071.467] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0071.467] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0071.467] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0071.467] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0071.467] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0071.468] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0071.468] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="7@*.W9sM*Q-E2t8-6d<\\lU>7yOx6?.N>", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0071.468] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="7@*.W9sM*Q-E2t8-6d<\\lU>7yOx6?.N>", cchWideChar=32, lpMultiByteStr=0x2038054, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7@*.W9sM*Q-E2t8-6d<\\lU>7yOx6?.N>", lpUsedDefaultChar=0x0) returned 32 [0071.468] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0071.468] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0071.468] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x724c6b5d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x724c6b5d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea487e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1146, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_image-frame-ImageMask.png", cAlternateFileName="")) returned 0x295098 [0071.468] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0071.469] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0071.469] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-imagemask.png")) returned 0x20 [0071.469] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-imagemask.png")) returned 0x20 [0071.469] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-imagemask.png")) returned 0x20 [0071.470] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-imagemask.png")) returned 0x20 [0071.470] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-imagemask.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x724c6b5d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x724c6b5d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea487e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1146)) returned 1 [0071.470] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0071.470] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0071.470] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-imagemask.png")) returned 0x20 [0071.470] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-imagemask.png")) returned 0x20 [0071.470] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0071.470] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0071.470] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0071.470] SetEndOfFile (hFile=0x158) returned 1 [0071.471] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_image-frame-ImageMask.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0071.471] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_image-frame-ImageMask.png", cchWideChar=30, lpMultiByteStr=0x2004dcc, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_image-frame-ImageMask.png", lpUsedDefaultChar=0x0) returned 30 [0071.471] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_image-frame-ImageMask.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0071.471] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_image-frame-ImageMask.png", cchWideChar=30, lpMultiByteStr=0x20049dc, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_image-frame-ImageMask.png", lpUsedDefaultChar=0x0) returned 30 [0071.471] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x20049dc, cbMultiByte=30, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="Pets_image-frame-ImageMask.pngpngpngpngg") returned 30 [0071.471] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_image-frame-ImageMask.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0071.471] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_image-frame-ImageMask.png", cchWideChar=30, lpMultiByteStr=0x2004dcc, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_image-frame-ImageMask.png", lpUsedDefaultChar=0x0) returned 30 [0071.471] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-imagemask.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0071.471] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0071.472] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x1146 [0071.472] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0071.472] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0071.472] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0071.472] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_image-frame-ImageMask.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0071.472] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_image-frame-ImageMask.png", cchWideChar=30, lpMultiByteStr=0x2004dcc, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_image-frame-ImageMask.png", lpUsedDefaultChar=0x0) returned 30 [0071.472] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_image-frame-ImageMask.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0071.472] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_image-frame-ImageMask.png", cchWideChar=30, lpMultiByteStr=0x20049dc, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_image-frame-ImageMask.png", lpUsedDefaultChar=0x0) returned 30 [0071.472] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x20049dc, cbMultiByte=30, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="Pets_image-frame-ImageMask.pngsk.pngpngpngpngg") returned 30 [0071.472] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_image-frame-ImageMask.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0071.472] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_image-frame-ImageMask.png", cchWideChar=30, lpMultiByteStr=0x2004dcc, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_image-frame-ImageMask.png", lpUsedDefaultChar=0x0) returned 30 [0071.472] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0071.473] CharToOemA (in: pSrc="Pets_image-frame-ImageMask.png", pDst=0x20049dc | out: pDst="Pets_image-frame-ImageMask.png") returned 1 [0071.473] WriteFile (in: hFile=0x158, lpBuffer=0x20049dc*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x20049dc*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0071.473] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0071.473] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0071.473] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0071.473] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=19173691161) returned 1 [0071.474] ReadFile (in: hFile=0x11c, lpBuffer=0x3b549f0, nNumberOfBytesToRead=0x1146, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b549f0*, lpNumberOfBytesRead=0x18dd7c*=0x1146, lpOverlapped=0x0) returned 1 [0071.475] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0071.475] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=19173837504) returned 1 [0071.484] WriteFile (in: hFile=0x158, lpBuffer=0x379ae58*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379ae58*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0071.484] ReadFile (in: hFile=0x11c, lpBuffer=0x3b549f0, nNumberOfBytesToRead=0x1146, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3b549f0*, lpNumberOfBytesRead=0x18de38*=0x1146, lpOverlapped=0x0) returned 1 [0071.484] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x59 [0071.484] WriteFile (in: hFile=0x158, lpBuffer=0x3b97410*, nNumberOfBytesToWrite=0x1146, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3b97410*, lpNumberOfBytesWritten=0x18de10*=0x1146, lpOverlapped=0x0) returned 1 [0071.484] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x119f [0071.484] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0071.484] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0071.485] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0071.485] SetFilePointer (in: hFile=0x158, lDistanceToMove=30, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x3c [0071.485] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x11a9 [0071.485] CloseHandle (hObject=0x11c) returned 1 [0071.485] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x11a9 [0071.485] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x11a9 [0071.485] SetFilePointer (in: hFile=0x158, lDistanceToMove=4521, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x11a9 [0071.485] SetFilePointer (in: hFile=0x158, lDistanceToMove=4521, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x11a9 [0071.485] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x11a9 [0071.485] SetFilePointer (in: hFile=0x158, lDistanceToMove=4521, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x11a9 [0071.485] SetEndOfFile (hFile=0x158) returned 1 [0071.485] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x11a9 [0071.485] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x11a9 [0071.485] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_image-frame-ImageMask.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0071.486] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_image-frame-ImageMask.png", cchWideChar=30, lpMultiByteStr=0x20049dc, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_image-frame-ImageMask.png", lpUsedDefaultChar=0x0) returned 30 [0071.486] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_image-frame-ImageMask.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0071.486] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_image-frame-ImageMask.png", cchWideChar=30, lpMultiByteStr=0x2004dcc, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_image-frame-ImageMask.png", lpUsedDefaultChar=0x0) returned 30 [0071.486] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x2004dcc, cbMultiByte=30, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="Pets_image-frame-ImageMask.png䃌㫋㰾ⵉᅢ") returned 30 [0071.486] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_image-frame-ImageMask.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0071.486] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_image-frame-ImageMask.png", cchWideChar=30, lpMultiByteStr=0x20049dc, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_image-frame-ImageMask.png", lpUsedDefaultChar=0x0) returned 30 [0071.486] WriteFile (in: hFile=0x158, lpBuffer=0x3b384c8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3b384c8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0071.486] CharToOemA (in: pSrc="Pets_image-frame-ImageMask.png", pDst=0x2004dcc | out: pDst="Pets_image-frame-ImageMask.png") returned 1 [0071.486] WriteFile (in: hFile=0x158, lpBuffer=0x2004dcc*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x2004dcc*, lpNumberOfBytesWritten=0x18efcc*=0x1e, lpOverlapped=0x0) returned 1 [0071.486] WriteFile (in: hFile=0x158, lpBuffer=0x379ade8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379ade8*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0071.486] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0071.486] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0071.486] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1200 [0071.486] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1200 [0071.486] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0071.487] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0071.487] DeleteFileW (lpFileName="") returned 0 [0071.487] GetLastError () returned 0x3 [0071.487] GetFileAttributesW (lpFileName="") returned 0xffffffff [0071.487] SetLastError (dwErrCode=0x3) [0071.487] FlushFileBuffers (hFile=0x158) returned 1 [0071.489] GetCurrentThreadId () returned 0x970 [0071.489] GetCurrentThreadId () returned 0x970 [0071.489] GetCurrentThreadId () returned 0x970 [0071.490] GetCurrentThreadId () returned 0x970 [0071.490] GetCurrentThreadId () returned 0x970 [0071.490] GetCurrentThreadId () returned 0x970 [0071.490] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x12b7 [0071.490] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x12b7 [0071.490] SetFilePointer (in: hFile=0x158, lDistanceToMove=4791, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x12b7 [0071.490] CloseHandle (hObject=0x158) returned 1 [0071.490] GetCurrentThreadId () returned 0x970 [0071.490] GetCurrentThreadId () returned 0x970 [0071.490] GetCurrentThreadId () returned 0x970 [0071.490] GetCurrentThreadId () returned 0x970 [0071.490] GetCurrentThreadId () returned 0x970 [0071.490] GetCurrentThreadId () returned 0x970 [0071.490] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Файл зашифрован [Pets_image-frame-ImageMask.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\Файл зашифрован [pets_image-frame-imagemask.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0071.490] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12b7 [0071.490] SetFilePointer (in: hFile=0x158, lDistanceToMove=4663, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1237 [0071.490] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0071.490] GetFileType (hFile=0x158) returned 0x1 [0071.490] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x12, wMilliseconds=0x2f4)) [0071.490] GetCurrentThreadId () returned 0x970 [0071.491] GetCurrentThreadId () returned 0x970 [0071.491] GetCurrentThreadId () returned 0x970 [0071.491] GetCurrentThreadId () returned 0x970 [0071.491] GetCurrentThreadId () returned 0x970 [0071.491] GetCurrentThreadId () returned 0x970 [0071.491] GetCurrentThreadId () returned 0x970 [0071.491] GetCurrentThreadId () returned 0x970 [0071.491] GetCurrentThreadId () returned 0x970 [0071.491] GetCurrentThreadId () returned 0x970 [0071.491] GetCurrentThreadId () returned 0x970 [0071.491] GetCurrentThreadId () returned 0x970 [0071.491] GetCurrentThreadId () returned 0x970 [0071.491] GetCurrentThreadId () returned 0x970 [0071.491] GetCurrentThreadId () returned 0x970 [0071.491] GetCurrentThreadId () returned 0x970 [0071.491] GetCurrentThreadId () returned 0x970 [0071.491] GetCurrentThreadId () returned 0x970 [0071.491] GetCurrentThreadId () returned 0x970 [0071.491] GetCurrentThreadId () returned 0x970 [0071.491] GetCurrentThreadId () returned 0x970 [0071.491] GetCurrentThreadId () returned 0x970 [0071.491] GetCurrentThreadId () returned 0x970 [0071.491] GetCurrentThreadId () returned 0x970 [0071.491] GetCurrentThreadId () returned 0x970 [0071.491] GetCurrentThreadId () returned 0x970 [0071.491] GetCurrentThreadId () returned 0x970 [0071.491] GetCurrentThreadId () returned 0x970 [0071.491] GetCurrentThreadId () returned 0x970 [0071.491] GetCurrentThreadId () returned 0x970 [0071.491] GetCurrentThreadId () returned 0x970 [0071.491] GetCurrentThreadId () returned 0x970 [0071.491] GetCurrentThreadId () returned 0x970 [0071.491] GetCurrentThreadId () returned 0x970 [0071.491] GetCurrentThreadId () returned 0x970 [0071.491] GetCurrentThreadId () returned 0x970 [0071.491] GetCurrentThreadId () returned 0x970 [0071.491] GetCurrentThreadId () returned 0x970 [0071.491] GetCurrentThreadId () returned 0x970 [0071.491] GetCurrentThreadId () returned 0x970 [0071.491] GetCurrentThreadId () returned 0x970 [0071.492] GetCurrentThreadId () returned 0x970 [0071.492] GetCurrentThreadId () returned 0x970 [0071.492] GetCurrentThreadId () returned 0x970 [0071.492] GetCurrentThreadId () returned 0x970 [0071.492] GetCurrentThreadId () returned 0x970 [0071.492] GetCurrentThreadId () returned 0x970 [0071.492] GetCurrentThreadId () returned 0x970 [0071.492] GetCurrentThreadId () returned 0x970 [0071.492] GetCurrentThreadId () returned 0x970 [0071.492] GetCurrentThreadId () returned 0x970 [0071.492] GetCurrentThreadId () returned 0x970 [0071.492] GetCurrentThreadId () returned 0x970 [0071.492] GetCurrentThreadId () returned 0x970 [0071.492] GetCurrentThreadId () returned 0x970 [0071.492] GetCurrentThreadId () returned 0x970 [0071.492] GetCurrentThreadId () returned 0x970 [0071.492] GetCurrentThreadId () returned 0x970 [0071.492] GetCurrentThreadId () returned 0x970 [0071.492] GetCurrentThreadId () returned 0x970 [0071.492] GetCurrentThreadId () returned 0x970 [0071.492] GetCurrentThreadId () returned 0x970 [0071.492] GetCurrentThreadId () returned 0x970 [0071.492] GetCurrentThreadId () returned 0x970 [0071.492] GetCurrentThreadId () returned 0x970 [0071.492] GetCurrentThreadId () returned 0x970 [0071.492] GetCurrentThreadId () returned 0x970 [0071.492] GetCurrentThreadId () returned 0x970 [0071.492] GetCurrentThreadId () returned 0x970 [0071.492] GetCurrentThreadId () returned 0x970 [0071.492] GetCurrentThreadId () returned 0x970 [0071.492] GetCurrentThreadId () returned 0x970 [0071.492] GetCurrentThreadId () returned 0x970 [0071.492] GetCurrentThreadId () returned 0x970 [0071.492] GetCurrentThreadId () returned 0x970 [0071.492] GetCurrentThreadId () returned 0x970 [0071.492] GetCurrentThreadId () returned 0x970 [0071.492] GetCurrentThreadId () returned 0x970 [0071.492] GetCurrentThreadId () returned 0x970 [0071.492] GetCurrentThreadId () returned 0x970 [0071.492] GetCurrentThreadId () returned 0x970 [0071.492] GetCurrentThreadId () returned 0x970 [0071.493] GetCurrentThreadId () returned 0x970 [0071.493] GetCurrentThreadId () returned 0x970 [0071.493] GetCurrentThreadId () returned 0x970 [0071.493] GetCurrentThreadId () returned 0x970 [0071.493] GetCurrentThreadId () returned 0x970 [0071.493] GetCurrentThreadId () returned 0x970 [0071.493] GetCurrentThreadId () returned 0x970 [0071.493] GetCurrentThreadId () returned 0x970 [0071.493] GetCurrentThreadId () returned 0x970 [0071.493] GetCurrentThreadId () returned 0x970 [0071.493] GetCurrentThreadId () returned 0x970 [0071.493] GetCurrentThreadId () returned 0x970 [0071.493] GetCurrentThreadId () returned 0x970 [0071.493] GetCurrentThreadId () returned 0x970 [0071.493] GetCurrentThreadId () returned 0x970 [0071.493] GetCurrentThreadId () returned 0x970 [0071.493] GetCurrentThreadId () returned 0x970 [0071.493] GetCurrentThreadId () returned 0x970 [0071.493] GetCurrentThreadId () returned 0x970 [0071.493] GetCurrentThreadId () returned 0x970 [0071.493] GetCurrentThreadId () returned 0x970 [0071.493] GetCurrentThreadId () returned 0x970 [0071.493] GetCurrentThreadId () returned 0x970 [0071.493] GetCurrentThreadId () returned 0x970 [0071.493] GetCurrentThreadId () returned 0x970 [0071.493] GetCurrentThreadId () returned 0x970 [0071.493] GetCurrentThreadId () returned 0x970 [0071.493] GetCurrentThreadId () returned 0x970 [0071.493] GetCurrentThreadId () returned 0x970 [0071.493] GetCurrentThreadId () returned 0x970 [0071.493] GetCurrentThreadId () returned 0x970 [0071.493] GetCurrentThreadId () returned 0x970 [0071.493] GetCurrentThreadId () returned 0x970 [0071.493] GetCurrentThreadId () returned 0x970 [0071.493] GetCurrentThreadId () returned 0x970 [0071.493] GetCurrentThreadId () returned 0x970 [0071.493] GetCurrentThreadId () returned 0x970 [0071.493] GetCurrentThreadId () returned 0x970 [0071.494] GetCurrentThreadId () returned 0x970 [0071.494] GetCurrentThreadId () returned 0x970 [0071.494] GetCurrentThreadId () returned 0x970 [0071.494] GetCurrentThreadId () returned 0x970 [0071.494] GetCurrentThreadId () returned 0x970 [0071.494] GetCurrentThreadId () returned 0x970 [0071.494] GetCurrentThreadId () returned 0x970 [0071.494] GetCurrentThreadId () returned 0x970 [0071.494] GetCurrentThreadId () returned 0x970 [0071.494] GetCurrentThreadId () returned 0x970 [0071.494] GetCurrentThreadId () returned 0x970 [0071.494] GetCurrentThreadId () returned 0x970 [0071.494] GetCurrentThreadId () returned 0x970 [0071.494] GetCurrentThreadId () returned 0x970 [0071.494] GetCurrentThreadId () returned 0x970 [0071.494] GetCurrentThreadId () returned 0x970 [0071.494] GetCurrentThreadId () returned 0x970 [0071.494] GetCurrentThreadId () returned 0x970 [0071.494] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.494] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.494] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379e838, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0071.494] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.494] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.494] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379e838, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0071.494] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.494] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.494] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0071.494] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.494] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.494] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0071.494] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.494] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.494] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379e898, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0071.494] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.495] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.495] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379e898, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0071.495] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.495] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.495] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379e898, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0071.495] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x12, wMilliseconds=0x304)) [0071.495] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="7@*.W9sM*Q-E2t8-6d<\\lU>7yOx6?.N>", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0071.495] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="7@*.W9sM*Q-E2t8-6d<\\lU>7yOx6?.N>", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0071.495] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="7@*.W9sM*Q-E2t8-6d<\\lU>7yOx6?.N>", cchWideChar=32, lpMultiByteStr=0x2005248, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7@*.W9sM*Q-E2t8-6d<\\lU>7yOx6?.N>", lpUsedDefaultChar=0x0) returned 32 [0071.495] GetCurrentThreadId () returned 0x970 [0071.495] GetCurrentThreadId () returned 0x970 [0071.495] GetCurrentThreadId () returned 0x970 [0071.495] GetCurrentThreadId () returned 0x970 [0071.495] GetCurrentThreadId () returned 0x970 [0071.495] GetCurrentThreadId () returned 0x970 [0071.502] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0071.502] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0071.503] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x37b52c8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0071.503] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ece48, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0071.503] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ece48, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAED00A7HbxBbHFV66GXTXs2f/4MzOoMygXe6yDUGSf0cjqf8OmvTfKtaHMX5p/RfI+FqjPz787gmSFW0mf7Wr5QGjZPQM6ATzWKJSnSRLfQF/JqfH6j+6JXQAnmZo0OjvKNm3oZYAU1T3qvnEOgoTnywRT7cpbqNoGmv+PWEIoVvp49L4JMvghbM2+KBp918jPQIDEwN4B65nVBAjgOpXNbRxMORFwYs4g==") returned 232 [0071.503] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x12, wMilliseconds=0x304)) [0071.503] GetCurrentThreadId () returned 0x970 [0071.503] GetCurrentThreadId () returned 0x970 [0071.503] GetCurrentThreadId () returned 0x970 [0071.503] GetCurrentThreadId () returned 0x970 [0071.503] GetCurrentThreadId () returned 0x970 [0071.503] GetCurrentThreadId () returned 0x970 [0071.503] GetCurrentThreadId () returned 0x970 [0071.503] GetCurrentThreadId () returned 0x970 [0071.503] GetCurrentThreadId () returned 0x970 [0071.503] GetCurrentThreadId () returned 0x970 [0071.503] GetCurrentThreadId () returned 0x970 [0071.503] GetCurrentThreadId () returned 0x970 [0071.503] GetCurrentThreadId () returned 0x970 [0071.503] GetCurrentThreadId () returned 0x970 [0071.503] GetCurrentThreadId () returned 0x970 [0071.503] GetCurrentThreadId () returned 0x970 [0071.503] GetCurrentThreadId () returned 0x970 [0071.503] GetCurrentThreadId () returned 0x970 [0071.503] GetCurrentThreadId () returned 0x970 [0071.503] GetCurrentThreadId () returned 0x970 [0071.503] GetCurrentThreadId () returned 0x970 [0071.503] GetCurrentThreadId () returned 0x970 [0071.503] GetCurrentThreadId () returned 0x970 [0071.503] GetCurrentThreadId () returned 0x970 [0071.503] GetCurrentThreadId () returned 0x970 [0071.503] GetCurrentThreadId () returned 0x970 [0071.503] GetCurrentThreadId () returned 0x970 [0071.503] GetCurrentThreadId () returned 0x970 [0071.503] GetCurrentThreadId () returned 0x970 [0071.503] GetCurrentThreadId () returned 0x970 [0071.503] GetCurrentThreadId () returned 0x970 [0071.503] GetCurrentThreadId () returned 0x970 [0071.503] GetCurrentThreadId () returned 0x970 [0071.503] GetCurrentThreadId () returned 0x970 [0071.503] GetCurrentThreadId () returned 0x970 [0071.504] GetCurrentThreadId () returned 0x970 [0071.504] GetCurrentThreadId () returned 0x970 [0071.504] GetCurrentThreadId () returned 0x970 [0071.504] GetCurrentThreadId () returned 0x970 [0071.504] GetCurrentThreadId () returned 0x970 [0071.504] GetCurrentThreadId () returned 0x970 [0071.504] GetCurrentThreadId () returned 0x970 [0071.504] GetCurrentThreadId () returned 0x970 [0071.504] GetCurrentThreadId () returned 0x970 [0071.504] GetCurrentThreadId () returned 0x970 [0071.504] GetCurrentThreadId () returned 0x970 [0071.504] GetCurrentThreadId () returned 0x970 [0071.504] GetCurrentThreadId () returned 0x970 [0071.504] GetCurrentThreadId () returned 0x970 [0071.504] GetCurrentThreadId () returned 0x970 [0071.504] GetCurrentThreadId () returned 0x970 [0071.504] GetCurrentThreadId () returned 0x970 [0071.504] GetCurrentThreadId () returned 0x970 [0071.504] GetCurrentThreadId () returned 0x970 [0071.504] GetCurrentThreadId () returned 0x970 [0071.504] GetCurrentThreadId () returned 0x970 [0071.504] GetCurrentThreadId () returned 0x970 [0071.504] GetCurrentThreadId () returned 0x970 [0071.504] GetCurrentThreadId () returned 0x970 [0071.504] GetCurrentThreadId () returned 0x970 [0071.504] GetCurrentThreadId () returned 0x970 [0071.504] GetCurrentThreadId () returned 0x970 [0071.504] GetCurrentThreadId () returned 0x970 [0071.504] GetCurrentThreadId () returned 0x970 [0071.504] GetCurrentThreadId () returned 0x970 [0071.504] GetCurrentThreadId () returned 0x970 [0071.504] GetCurrentThreadId () returned 0x970 [0071.504] GetCurrentThreadId () returned 0x970 [0071.504] GetCurrentThreadId () returned 0x970 [0071.504] GetCurrentThreadId () returned 0x970 [0071.504] GetCurrentThreadId () returned 0x970 [0071.504] GetCurrentThreadId () returned 0x970 [0071.504] GetCurrentThreadId () returned 0x970 [0071.504] GetCurrentThreadId () returned 0x970 [0071.504] GetCurrentThreadId () returned 0x970 [0071.504] GetCurrentThreadId () returned 0x970 [0071.505] GetCurrentThreadId () returned 0x970 [0071.505] GetCurrentThreadId () returned 0x970 [0071.505] GetCurrentThreadId () returned 0x970 [0071.505] GetCurrentThreadId () returned 0x970 [0071.505] GetCurrentThreadId () returned 0x970 [0071.505] GetCurrentThreadId () returned 0x970 [0071.505] GetCurrentThreadId () returned 0x970 [0071.505] GetCurrentThreadId () returned 0x970 [0071.505] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAED00A7HbxBbHFV66GXTXs2f/4MzOoMygXe6yDUGSf0cjqf8OmvTfKtaHMX5p/RfI+FqjPz787gmSFW0mf7Wr5QGjZPQM6ATzWKJSnSRLfQF/JqfH6j+6JXQAnmZo0OjvKNm3oZYAU1T3qvnEOgoTnywRT7cpbqNoGmv+PWEIoVvp49L4JMvghbM2+KBp918jPQIDEwN4B65nVBAjgOpXNbRxMORFwYs4g==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0071.505] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAED00A7HbxBbHFV66GXTXs2f/4MzOoMygXe6yDUGSf0cjqf8OmvTfKtaHMX5p/RfI+FqjPz787gmSFW0mf7Wr5QGjZPQM6ATzWKJSnSRLfQF/JqfH6j+6JXQAnmZo0OjvKNm3oZYAU1T3qvnEOgoTnywRT7cpbqNoGmv+PWEIoVvp49L4JMvghbM2+KBp918jPQIDEwN4B65nVBAjgOpXNbRxMORFwYs4g==", cchWideChar=245, lpMultiByteStr=0x353a65c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAED00A7HbxBbHFV66GXTXs2f/4MzOoMygXe6yDUGSf0cjqf8OmvTfKtaHMX5p/RfI+FqjPz787gmSFW0mf7Wr5QGjZPQM6ATzWKJSnSRLfQF/JqfH6j+6JXQAnmZo0OjvKNm3oZYAU1T3qvnEOgoTnywRT7cpbqNoGmv+PWEIoVvp49L4JMvghbM2+KBp918jPQIDEwN4B65nVBAjgOpXNbRxMORFwYs4g==", lpUsedDefaultChar=0x0) returned 245 [0071.505] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0071.505] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0071.505] CloseHandle (hObject=0x158) returned 1 [0071.505] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-imagemask.png")) returned 0 [0071.505] GetLastError () returned 0x5 [0071.505] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-imagemask.png")) returned 0x20 [0071.505] SetLastError (dwErrCode=0x5) [0071.505] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=19176890077) returned 1 [0071.506] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Файл зашифрован [Pets_notes-txt-background.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\Файл зашифрован [pets_notes-txt-background.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0071.506] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0071.506] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0071.506] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0071.506] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0071.506] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0071.506] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0071.507] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0071.507] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0071.507] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0071.507] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0071.507] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0071.507] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0071.507] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0071.507] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0071.507] SetEndOfFile (hFile=0x158) returned 1 [0071.507] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0071.507] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0071.507] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0071.507] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0071.507] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0071.508] WriteFile (in: hFile=0x158, lpBuffer=0x35f035c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f035c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0071.508] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="QugSTxzzyinN~}\"Hd\"qM^Q/)!$tGA&?u", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0071.508] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="QugSTxzzyinN~}\"Hd\"qM^Q/)!$tGA&?u", cchWideChar=32, lpMultiByteStr=0x203808c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QugSTxzzyinN~}\"Hd\"qM^Q/)!$tGA&?u", lpUsedDefaultChar=0x0) returned 32 [0071.508] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0071.509] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0071.509] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7240848c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7240848c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea487e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1ed0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_notes-txt-background.png", cAlternateFileName="")) returned 0x295098 [0071.509] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0071.509] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0071.509] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_notes-txt-background.png")) returned 0x20 [0071.509] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_notes-txt-background.png")) returned 0x20 [0071.509] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_notes-txt-background.png")) returned 0x20 [0071.509] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_notes-txt-background.png")) returned 0x20 [0071.509] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_notes-txt-background.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7240848c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7240848c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea487e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1ed0)) returned 1 [0071.509] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0071.509] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0071.509] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_notes-txt-background.png")) returned 0x20 [0071.509] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_notes-txt-background.png")) returned 0x20 [0071.510] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0071.510] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0071.510] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0071.510] SetEndOfFile (hFile=0x158) returned 1 [0071.510] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_notes-txt-background.png", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0071.511] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_notes-txt-background.png", cchWideChar=29, lpMultiByteStr=0x2004eec, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_notes-txt-background.png", lpUsedDefaultChar=0x0) returned 29 [0071.511] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_notes-txt-background.png", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0071.511] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_notes-txt-background.png", cchWideChar=29, lpMultiByteStr=0x2004e2c, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_notes-txt-background.png", lpUsedDefaultChar=0x0) returned 29 [0071.511] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x2004e2c, cbMultiByte=29, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="Pets_notes-txt-background.pnggpngpngpngg") returned 29 [0071.511] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_notes-txt-background.png", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0071.511] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_notes-txt-background.png", cchWideChar=29, lpMultiByteStr=0x2004eec, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_notes-txt-background.png", lpUsedDefaultChar=0x0) returned 29 [0071.511] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_notes-txt-background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0071.511] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0071.511] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x1ed0 [0071.511] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0071.511] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0071.511] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0071.511] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_notes-txt-background.png", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0071.511] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_notes-txt-background.png", cchWideChar=29, lpMultiByteStr=0x2004eec, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_notes-txt-background.png", lpUsedDefaultChar=0x0) returned 29 [0071.512] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_notes-txt-background.png", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0071.512] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_notes-txt-background.png", cchWideChar=29, lpMultiByteStr=0x2004e2c, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_notes-txt-background.png", lpUsedDefaultChar=0x0) returned 29 [0071.512] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x2004e2c, cbMultiByte=29, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="Pets_notes-txt-background.pngnd.pnggpngpngpngg") returned 29 [0071.512] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_notes-txt-background.png", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0071.512] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_notes-txt-background.png", cchWideChar=29, lpMultiByteStr=0x2004eec, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_notes-txt-background.png", lpUsedDefaultChar=0x0) returned 29 [0071.512] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0071.513] CharToOemA (in: pSrc="Pets_notes-txt-background.png", pDst=0x2004e2c | out: pDst="Pets_notes-txt-background.png") returned 1 [0071.513] WriteFile (in: hFile=0x158, lpBuffer=0x2004e2c*, nNumberOfBytesToWrite=0x1d, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x2004e2c*, lpNumberOfBytesWritten=0x18e048*=0x1d, lpOverlapped=0x0) returned 1 [0071.513] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0071.513] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0071.513] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0071.513] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=19177651453) returned 1 [0071.513] ReadFile (in: hFile=0x11c, lpBuffer=0x3b549f0, nNumberOfBytesToRead=0x1ed0, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b549f0*, lpNumberOfBytesRead=0x18dd7c*=0x1ed0, lpOverlapped=0x0) returned 1 [0071.515] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0071.515] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=19177801062) returned 1 [0071.523] WriteFile (in: hFile=0x158, lpBuffer=0x379acf0*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379acf0*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0071.523] ReadFile (in: hFile=0x11c, lpBuffer=0x3b549f0, nNumberOfBytesToRead=0x1ed0, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3b549f0*, lpNumberOfBytesRead=0x18de38*=0x1ed0, lpOverlapped=0x0) returned 1 [0071.524] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x58 [0071.524] WriteFile (in: hFile=0x158, lpBuffer=0x3b98110*, nNumberOfBytesToWrite=0x1ed0, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3b98110*, lpNumberOfBytesWritten=0x18de10*=0x1ed0, lpOverlapped=0x0) returned 1 [0071.525] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x1f28 [0071.525] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0071.525] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0071.525] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0071.525] SetFilePointer (in: hFile=0x158, lDistanceToMove=29, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x3b [0071.525] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x1f32 [0071.525] CloseHandle (hObject=0x11c) returned 1 [0071.525] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1f32 [0071.525] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1f32 [0071.525] SetFilePointer (in: hFile=0x158, lDistanceToMove=7986, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1f32 [0071.525] SetFilePointer (in: hFile=0x158, lDistanceToMove=7986, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x1f32 [0071.526] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1f32 [0071.526] SetFilePointer (in: hFile=0x158, lDistanceToMove=7986, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x1f32 [0071.526] SetEndOfFile (hFile=0x158) returned 1 [0071.526] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1f32 [0071.526] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1f32 [0071.526] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_notes-txt-background.png", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0071.526] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_notes-txt-background.png", cchWideChar=29, lpMultiByteStr=0x2004e2c, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_notes-txt-background.png", lpUsedDefaultChar=0x0) returned 29 [0071.526] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_notes-txt-background.png", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0071.526] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_notes-txt-background.png", cchWideChar=29, lpMultiByteStr=0x2004eec, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_notes-txt-background.png", lpUsedDefaultChar=0x0) returned 29 [0071.526] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x2004eec, cbMultiByte=29, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="Pets_notes-txt-background.pngc䃌㫋퓍Ử") returned 29 [0071.526] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_notes-txt-background.png", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0071.526] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_notes-txt-background.png", cchWideChar=29, lpMultiByteStr=0x2004e2c, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pets_notes-txt-background.png", lpUsedDefaultChar=0x0) returned 29 [0071.526] WriteFile (in: hFile=0x158, lpBuffer=0x3b384c8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3b384c8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0071.526] CharToOemA (in: pSrc="Pets_notes-txt-background.png", pDst=0x2004eec | out: pDst="Pets_notes-txt-background.png") returned 1 [0071.526] WriteFile (in: hFile=0x158, lpBuffer=0x2004eec*, nNumberOfBytesToWrite=0x1d, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x2004eec*, lpNumberOfBytesWritten=0x18efcc*=0x1d, lpOverlapped=0x0) returned 1 [0071.527] WriteFile (in: hFile=0x158, lpBuffer=0x379ae18*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379ae18*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0071.527] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0071.527] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0071.527] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1f88 [0071.527] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1f88 [0071.527] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0071.527] WriteFile (in: hFile=0x158, lpBuffer=0x35f035c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f035c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0071.527] DeleteFileW (lpFileName="") returned 0 [0071.527] GetLastError () returned 0x3 [0071.527] GetFileAttributesW (lpFileName="") returned 0xffffffff [0071.527] SetLastError (dwErrCode=0x3) [0071.527] FlushFileBuffers (hFile=0x158) returned 1 [0071.530] GetCurrentThreadId () returned 0x970 [0071.530] GetCurrentThreadId () returned 0x970 [0071.530] GetCurrentThreadId () returned 0x970 [0071.530] GetCurrentThreadId () returned 0x970 [0071.530] GetCurrentThreadId () returned 0x970 [0071.530] GetCurrentThreadId () returned 0x970 [0071.530] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x203f [0071.530] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x203f [0071.530] SetFilePointer (in: hFile=0x158, lDistanceToMove=8255, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x203f [0071.530] CloseHandle (hObject=0x158) returned 1 [0071.530] GetCurrentThreadId () returned 0x970 [0071.530] GetCurrentThreadId () returned 0x970 [0071.530] GetCurrentThreadId () returned 0x970 [0071.530] GetCurrentThreadId () returned 0x970 [0071.530] GetCurrentThreadId () returned 0x970 [0071.531] GetCurrentThreadId () returned 0x970 [0071.531] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Файл зашифрован [Pets_notes-txt-background.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\Файл зашифрован [pets_notes-txt-background.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0071.531] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x203f [0071.531] SetFilePointer (in: hFile=0x158, lDistanceToMove=8127, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1fbf [0071.531] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0071.531] GetFileType (hFile=0x158) returned 0x1 [0071.531] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x12, wMilliseconds=0x323)) [0071.531] GetCurrentThreadId () returned 0x970 [0071.531] GetCurrentThreadId () returned 0x970 [0071.531] GetCurrentThreadId () returned 0x970 [0071.531] GetCurrentThreadId () returned 0x970 [0071.531] GetCurrentThreadId () returned 0x970 [0071.531] GetCurrentThreadId () returned 0x970 [0071.531] GetCurrentThreadId () returned 0x970 [0071.531] GetCurrentThreadId () returned 0x970 [0071.531] GetCurrentThreadId () returned 0x970 [0071.531] GetCurrentThreadId () returned 0x970 [0071.531] GetCurrentThreadId () returned 0x970 [0071.531] GetCurrentThreadId () returned 0x970 [0071.531] GetCurrentThreadId () returned 0x970 [0071.531] GetCurrentThreadId () returned 0x970 [0071.531] GetCurrentThreadId () returned 0x970 [0071.531] GetCurrentThreadId () returned 0x970 [0071.531] GetCurrentThreadId () returned 0x970 [0071.531] GetCurrentThreadId () returned 0x970 [0071.531] GetCurrentThreadId () returned 0x970 [0071.531] GetCurrentThreadId () returned 0x970 [0071.531] GetCurrentThreadId () returned 0x970 [0071.532] GetCurrentThreadId () returned 0x970 [0071.532] GetCurrentThreadId () returned 0x970 [0071.532] GetCurrentThreadId () returned 0x970 [0071.532] GetCurrentThreadId () returned 0x970 [0071.532] GetCurrentThreadId () returned 0x970 [0071.532] GetCurrentThreadId () returned 0x970 [0071.532] GetCurrentThreadId () returned 0x970 [0071.532] GetCurrentThreadId () returned 0x970 [0071.532] GetCurrentThreadId () returned 0x970 [0071.532] GetCurrentThreadId () returned 0x970 [0071.532] GetCurrentThreadId () returned 0x970 [0071.532] GetCurrentThreadId () returned 0x970 [0071.532] GetCurrentThreadId () returned 0x970 [0071.532] GetCurrentThreadId () returned 0x970 [0071.532] GetCurrentThreadId () returned 0x970 [0071.532] GetCurrentThreadId () returned 0x970 [0071.532] GetCurrentThreadId () returned 0x970 [0071.532] GetCurrentThreadId () returned 0x970 [0071.532] GetCurrentThreadId () returned 0x970 [0071.532] GetCurrentThreadId () returned 0x970 [0071.532] GetCurrentThreadId () returned 0x970 [0071.532] GetCurrentThreadId () returned 0x970 [0071.532] GetCurrentThreadId () returned 0x970 [0071.532] GetCurrentThreadId () returned 0x970 [0071.532] GetCurrentThreadId () returned 0x970 [0071.532] GetCurrentThreadId () returned 0x970 [0071.532] GetCurrentThreadId () returned 0x970 [0071.532] GetCurrentThreadId () returned 0x970 [0071.532] GetCurrentThreadId () returned 0x970 [0071.532] GetCurrentThreadId () returned 0x970 [0071.532] GetCurrentThreadId () returned 0x970 [0071.532] GetCurrentThreadId () returned 0x970 [0071.532] GetCurrentThreadId () returned 0x970 [0071.532] GetCurrentThreadId () returned 0x970 [0071.532] GetCurrentThreadId () returned 0x970 [0071.532] GetCurrentThreadId () returned 0x970 [0071.532] GetCurrentThreadId () returned 0x970 [0071.532] GetCurrentThreadId () returned 0x970 [0071.532] GetCurrentThreadId () returned 0x970 [0071.532] GetCurrentThreadId () returned 0x970 [0071.532] GetCurrentThreadId () returned 0x970 [0071.533] GetCurrentThreadId () returned 0x970 [0071.533] GetCurrentThreadId () returned 0x970 [0071.533] GetCurrentThreadId () returned 0x970 [0071.533] GetCurrentThreadId () returned 0x970 [0071.533] GetCurrentThreadId () returned 0x970 [0071.533] GetCurrentThreadId () returned 0x970 [0071.533] GetCurrentThreadId () returned 0x970 [0071.533] GetCurrentThreadId () returned 0x970 [0071.533] GetCurrentThreadId () returned 0x970 [0071.533] GetCurrentThreadId () returned 0x970 [0071.533] GetCurrentThreadId () returned 0x970 [0071.533] GetCurrentThreadId () returned 0x970 [0071.533] GetCurrentThreadId () returned 0x970 [0071.533] GetCurrentThreadId () returned 0x970 [0071.533] GetCurrentThreadId () returned 0x970 [0071.533] GetCurrentThreadId () returned 0x970 [0071.533] GetCurrentThreadId () returned 0x970 [0071.533] GetCurrentThreadId () returned 0x970 [0071.533] GetCurrentThreadId () returned 0x970 [0071.533] GetCurrentThreadId () returned 0x970 [0071.533] GetCurrentThreadId () returned 0x970 [0071.533] GetCurrentThreadId () returned 0x970 [0071.533] GetCurrentThreadId () returned 0x970 [0071.533] GetCurrentThreadId () returned 0x970 [0071.533] GetCurrentThreadId () returned 0x970 [0071.533] GetCurrentThreadId () returned 0x970 [0071.533] GetCurrentThreadId () returned 0x970 [0071.533] GetCurrentThreadId () returned 0x970 [0071.533] GetCurrentThreadId () returned 0x970 [0071.533] GetCurrentThreadId () returned 0x970 [0071.533] GetCurrentThreadId () returned 0x970 [0071.533] GetCurrentThreadId () returned 0x970 [0071.533] GetCurrentThreadId () returned 0x970 [0071.533] GetCurrentThreadId () returned 0x970 [0071.533] GetCurrentThreadId () returned 0x970 [0071.533] GetCurrentThreadId () returned 0x970 [0071.533] GetCurrentThreadId () returned 0x970 [0071.533] GetCurrentThreadId () returned 0x970 [0071.533] GetCurrentThreadId () returned 0x970 [0071.533] GetCurrentThreadId () returned 0x970 [0071.533] GetCurrentThreadId () returned 0x970 [0071.534] GetCurrentThreadId () returned 0x970 [0071.534] GetCurrentThreadId () returned 0x970 [0071.534] GetCurrentThreadId () returned 0x970 [0071.534] GetCurrentThreadId () returned 0x970 [0071.534] GetCurrentThreadId () returned 0x970 [0071.534] GetCurrentThreadId () returned 0x970 [0071.534] GetCurrentThreadId () returned 0x970 [0071.534] GetCurrentThreadId () returned 0x970 [0071.534] GetCurrentThreadId () returned 0x970 [0071.534] GetCurrentThreadId () returned 0x970 [0071.534] GetCurrentThreadId () returned 0x970 [0071.534] GetCurrentThreadId () returned 0x970 [0071.534] GetCurrentThreadId () returned 0x970 [0071.534] GetCurrentThreadId () returned 0x970 [0071.534] GetCurrentThreadId () returned 0x970 [0071.534] GetCurrentThreadId () returned 0x970 [0071.534] GetCurrentThreadId () returned 0x970 [0071.534] GetCurrentThreadId () returned 0x970 [0071.534] GetCurrentThreadId () returned 0x970 [0071.534] GetCurrentThreadId () returned 0x970 [0071.534] GetCurrentThreadId () returned 0x970 [0071.534] GetCurrentThreadId () returned 0x970 [0071.534] GetCurrentThreadId () returned 0x970 [0071.534] GetCurrentThreadId () returned 0x970 [0071.534] GetCurrentThreadId () returned 0x970 [0071.534] GetCurrentThreadId () returned 0x970 [0071.534] GetCurrentThreadId () returned 0x970 [0071.534] GetCurrentThreadId () returned 0x970 [0071.534] GetCurrentThreadId () returned 0x970 [0071.534] GetCurrentThreadId () returned 0x970 [0071.534] GetCurrentThreadId () returned 0x970 [0071.534] GetCurrentThreadId () returned 0x970 [0071.534] GetCurrentThreadId () returned 0x970 [0071.534] GetCurrentThreadId () returned 0x970 [0071.534] GetCurrentThreadId () returned 0x970 [0071.534] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.534] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.534] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379e898, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0071.534] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379e898, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0071.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0071.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0071.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379e8f8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0071.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379e8f8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0071.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379e8f8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0071.535] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x12, wMilliseconds=0x323)) [0071.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QugSTxzzyinN~}\"Hd\"qM^Q/)!$tGA&?u", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0071.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QugSTxzzyinN~}\"Hd\"qM^Q/)!$tGA&?u", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0071.536] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QugSTxzzyinN~}\"Hd\"qM^Q/)!$tGA&?u", cchWideChar=32, lpMultiByteStr=0x2005278, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QugSTxzzyinN~}\"Hd\"qM^Q/)!$tGA&?u", lpUsedDefaultChar=0x0) returned 32 [0071.536] GetCurrentThreadId () returned 0x970 [0071.536] GetCurrentThreadId () returned 0x970 [0071.536] GetCurrentThreadId () returned 0x970 [0071.536] GetCurrentThreadId () returned 0x970 [0071.536] GetCurrentThreadId () returned 0x970 [0071.536] GetCurrentThreadId () returned 0x970 [0071.544] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0071.544] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0071.544] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x37b54a8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0071.544] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ecd48, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0071.544] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ecd48, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAACq/ub+yhmddrmj9xsCwK5u5MdpUc4S8q09T9IDZx1F/3xEeMhnjNh3tfWkSTutJNL74SSyF2Q9yxa4Yxnl350qT1zgY80PeSJpzw/7zA1nRU77+m6Q1a+qcy2hC/d+23E1CfC7iSlVeQneIZTpRbzvzuFl16VArlm+Xx8hkIAPT9RB1PV9EzsaKZjlmeVEz6FsQe6fwH2fVsaYeEwA3feWEJ/u56w0MnA==") returned 232 [0071.544] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x12, wMilliseconds=0x333)) [0071.544] GetCurrentThreadId () returned 0x970 [0071.544] GetCurrentThreadId () returned 0x970 [0071.544] GetCurrentThreadId () returned 0x970 [0071.544] GetCurrentThreadId () returned 0x970 [0071.544] GetCurrentThreadId () returned 0x970 [0071.544] GetCurrentThreadId () returned 0x970 [0071.544] GetCurrentThreadId () returned 0x970 [0071.544] GetCurrentThreadId () returned 0x970 [0071.544] GetCurrentThreadId () returned 0x970 [0071.544] GetCurrentThreadId () returned 0x970 [0071.544] GetCurrentThreadId () returned 0x970 [0071.544] GetCurrentThreadId () returned 0x970 [0071.544] GetCurrentThreadId () returned 0x970 [0071.544] GetCurrentThreadId () returned 0x970 [0071.544] GetCurrentThreadId () returned 0x970 [0071.544] GetCurrentThreadId () returned 0x970 [0071.544] GetCurrentThreadId () returned 0x970 [0071.544] GetCurrentThreadId () returned 0x970 [0071.544] GetCurrentThreadId () returned 0x970 [0071.544] GetCurrentThreadId () returned 0x970 [0071.544] GetCurrentThreadId () returned 0x970 [0071.544] GetCurrentThreadId () returned 0x970 [0071.544] GetCurrentThreadId () returned 0x970 [0071.544] GetCurrentThreadId () returned 0x970 [0071.544] GetCurrentThreadId () returned 0x970 [0071.544] GetCurrentThreadId () returned 0x970 [0071.545] GetCurrentThreadId () returned 0x970 [0071.545] GetCurrentThreadId () returned 0x970 [0071.545] GetCurrentThreadId () returned 0x970 [0071.545] GetCurrentThreadId () returned 0x970 [0071.545] GetCurrentThreadId () returned 0x970 [0071.545] GetCurrentThreadId () returned 0x970 [0071.545] GetCurrentThreadId () returned 0x970 [0071.545] GetCurrentThreadId () returned 0x970 [0071.545] GetCurrentThreadId () returned 0x970 [0071.545] GetCurrentThreadId () returned 0x970 [0071.545] GetCurrentThreadId () returned 0x970 [0071.545] GetCurrentThreadId () returned 0x970 [0071.545] GetCurrentThreadId () returned 0x970 [0071.545] GetCurrentThreadId () returned 0x970 [0071.545] GetCurrentThreadId () returned 0x970 [0071.545] GetCurrentThreadId () returned 0x970 [0071.545] GetCurrentThreadId () returned 0x970 [0071.545] GetCurrentThreadId () returned 0x970 [0071.545] GetCurrentThreadId () returned 0x970 [0071.545] GetCurrentThreadId () returned 0x970 [0071.545] GetCurrentThreadId () returned 0x970 [0071.545] GetCurrentThreadId () returned 0x970 [0071.545] GetCurrentThreadId () returned 0x970 [0071.545] GetCurrentThreadId () returned 0x970 [0071.545] GetCurrentThreadId () returned 0x970 [0071.545] GetCurrentThreadId () returned 0x970 [0071.545] GetCurrentThreadId () returned 0x970 [0071.545] GetCurrentThreadId () returned 0x970 [0071.545] GetCurrentThreadId () returned 0x970 [0071.545] GetCurrentThreadId () returned 0x970 [0071.545] GetCurrentThreadId () returned 0x970 [0071.545] GetCurrentThreadId () returned 0x970 [0071.545] GetCurrentThreadId () returned 0x970 [0071.545] GetCurrentThreadId () returned 0x970 [0071.545] GetCurrentThreadId () returned 0x970 [0071.545] GetCurrentThreadId () returned 0x970 [0071.545] GetCurrentThreadId () returned 0x970 [0071.545] GetCurrentThreadId () returned 0x970 [0071.545] GetCurrentThreadId () returned 0x970 [0071.545] GetCurrentThreadId () returned 0x970 [0071.546] GetCurrentThreadId () returned 0x970 [0071.546] GetCurrentThreadId () returned 0x970 [0071.546] GetCurrentThreadId () returned 0x970 [0071.546] GetCurrentThreadId () returned 0x970 [0071.546] GetCurrentThreadId () returned 0x970 [0071.546] GetCurrentThreadId () returned 0x970 [0071.546] GetCurrentThreadId () returned 0x970 [0071.546] GetCurrentThreadId () returned 0x970 [0071.546] GetCurrentThreadId () returned 0x970 [0071.546] GetCurrentThreadId () returned 0x970 [0071.546] GetCurrentThreadId () returned 0x970 [0071.546] GetCurrentThreadId () returned 0x970 [0071.546] GetCurrentThreadId () returned 0x970 [0071.546] GetCurrentThreadId () returned 0x970 [0071.546] GetCurrentThreadId () returned 0x970 [0071.546] GetCurrentThreadId () returned 0x970 [0071.546] GetCurrentThreadId () returned 0x970 [0071.546] GetCurrentThreadId () returned 0x970 [0071.546] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAACq/ub+yhmddrmj9xsCwK5u5MdpUc4S8q09T9IDZx1F/3xEeMhnjNh3tfWkSTutJNL74SSyF2Q9yxa4Yxnl350qT1zgY80PeSJpzw/7zA1nRU77+m6Q1a+qcy2hC/d+23E1CfC7iSlVeQneIZTpRbzvzuFl16VArlm+Xx8hkIAPT9RB1PV9EzsaKZjlmeVEz6FsQe6fwH2fVsaYeEwA3feWEJ/u56w0MnA==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0071.546] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAACq/ub+yhmddrmj9xsCwK5u5MdpUc4S8q09T9IDZx1F/3xEeMhnjNh3tfWkSTutJNL74SSyF2Q9yxa4Yxnl350qT1zgY80PeSJpzw/7zA1nRU77+m6Q1a+qcy2hC/d+23E1CfC7iSlVeQneIZTpRbzvzuFl16VArlm+Xx8hkIAPT9RB1PV9EzsaKZjlmeVEz6FsQe6fwH2fVsaYeEwA3feWEJ/u56w0MnA==", cchWideChar=245, lpMultiByteStr=0x353a65c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAACq/ub+yhmddrmj9xsCwK5u5MdpUc4S8q09T9IDZx1F/3xEeMhnjNh3tfWkSTutJNL74SSyF2Q9yxa4Yxnl350qT1zgY80PeSJpzw/7zA1nRU77+m6Q1a+qcy2hC/d+23E1CfC7iSlVeQneIZTpRbzvzuFl16VArlm+Xx8hkIAPT9RB1PV9EzsaKZjlmeVEz6FsQe6fwH2fVsaYeEwA3feWEJ/u56w0MnA==", lpUsedDefaultChar=0x0) returned 245 [0071.546] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0071.546] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0071.546] CloseHandle (hObject=0x158) returned 1 [0071.546] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_notes-txt-background.png")) returned 0 [0071.547] GetLastError () returned 0x5 [0071.547] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_notes-txt-background.png")) returned 0x20 [0071.547] SetLastError (dwErrCode=0x5) [0071.547] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=19181018220) returned 1 [0071.547] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Файл зашифрован [rollinghills.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\Файл зашифрован [rollinghills.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0071.547] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0071.547] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0071.547] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0071.547] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0071.548] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0071.548] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0071.548] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0071.548] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0071.548] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0071.548] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0071.548] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0071.548] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0071.548] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0071.548] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0071.548] SetEndOfFile (hFile=0x158) returned 1 [0071.548] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0071.548] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0071.548] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0071.548] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0071.548] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0071.549] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0071.549] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="EKmEjC~u=F5TMNTiImvx>iTG>r\\SZ.gM", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0071.549] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="EKmEjC~u=F5TMNTiImvx>iTG>r\\SZ.gM", cchWideChar=32, lpMultiByteStr=0x2038134, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EKmEjC~u=F5TMNTiImvx>iTG>r\\SZ.gM", lpUsedDefaultChar=0x0) returned 32 [0071.550] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0071.550] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0071.550] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71fdde60, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71fdde60, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea487e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x41ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="rollinghills.png", cAlternateFileName="")) returned 0x295098 [0071.550] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0071.550] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0071.550] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\rollinghills.png")) returned 0x20 [0071.550] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\rollinghills.png")) returned 0x20 [0071.550] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\rollinghills.png")) returned 0x20 [0071.550] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\rollinghills.png")) returned 0x20 [0071.550] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\rollinghills.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71fdde60, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71fdde60, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea487e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x41ca)) returned 1 [0071.550] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0071.550] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0071.550] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\rollinghills.png")) returned 0x20 [0071.551] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\rollinghills.png")) returned 0x20 [0071.551] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0071.551] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0071.551] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0071.551] SetEndOfFile (hFile=0x158) returned 1 [0071.552] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="rollinghills.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0071.552] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="rollinghills.png", cchWideChar=16, lpMultiByteStr=0x1ff88fc, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rollinghills.png", lpUsedDefaultChar=0x0) returned 16 [0071.552] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="rollinghills.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0071.552] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="rollinghills.png", cchWideChar=16, lpMultiByteStr=0x1ff8a14, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rollinghills.png", lpUsedDefaultChar=0x0) returned 16 [0071.552] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff8a14, cbMultiByte=16, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="rollinghills.pngund.pngnd.pnggpngpngpngg") returned 16 [0071.552] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="rollinghills.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0071.552] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="rollinghills.png", cchWideChar=16, lpMultiByteStr=0x1ff88fc, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rollinghills.png", lpUsedDefaultChar=0x0) returned 16 [0071.552] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\rollinghills.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0071.552] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0071.552] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x41ca [0071.552] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0071.552] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0071.552] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0071.553] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="rollinghills.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0071.553] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="rollinghills.png", cchWideChar=16, lpMultiByteStr=0x1ff88fc, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rollinghills.png", lpUsedDefaultChar=0x0) returned 16 [0071.553] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="rollinghills.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0071.553] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="rollinghills.png", cchWideChar=16, lpMultiByteStr=0x1ff8a14, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rollinghills.png", lpUsedDefaultChar=0x0) returned 16 [0071.553] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff8a14, cbMultiByte=16, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="rollinghills.pngls.pngund.pngnd.pnggpngpngpngg") returned 16 [0071.553] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="rollinghills.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0071.553] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="rollinghills.png", cchWideChar=16, lpMultiByteStr=0x1ff88fc, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rollinghills.png", lpUsedDefaultChar=0x0) returned 16 [0071.553] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0071.554] CharToOemA (in: pSrc="rollinghills.png", pDst=0x1ff8a14 | out: pDst="rollinghills.png") returned 1 [0071.554] WriteFile (in: hFile=0x158, lpBuffer=0x1ff8a14*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1ff8a14*, lpNumberOfBytesWritten=0x18e048*=0x10, lpOverlapped=0x0) returned 1 [0071.554] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0071.554] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0071.554] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0071.554] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=19181762322) returned 1 [0071.554] ReadFile (in: hFile=0x11c, lpBuffer=0x3b549f0, nNumberOfBytesToRead=0x41ca, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b549f0*, lpNumberOfBytesRead=0x18dd7c*=0x41ca, lpOverlapped=0x0) returned 1 [0071.556] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0071.556] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=19181954277) returned 1 [0071.565] WriteFile (in: hFile=0x158, lpBuffer=0x379adf8*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379adf8*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0071.565] ReadFile (in: hFile=0x11c, lpBuffer=0x3b549f0, nNumberOfBytesToRead=0x41ca, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3b549f0*, lpNumberOfBytesRead=0x18de38*=0x41ca, lpOverlapped=0x0) returned 1 [0071.565] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x4b [0071.566] WriteFile (in: hFile=0x158, lpBuffer=0x3b9a410*, nNumberOfBytesToWrite=0x41ca, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3b9a410*, lpNumberOfBytesWritten=0x18de10*=0x41ca, lpOverlapped=0x0) returned 1 [0071.566] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x4215 [0071.566] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0071.566] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0071.566] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0071.566] SetFilePointer (in: hFile=0x158, lDistanceToMove=16, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2e [0071.566] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x421f [0071.566] CloseHandle (hObject=0x11c) returned 1 [0071.567] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x421f [0071.567] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x421f [0071.567] SetFilePointer (in: hFile=0x158, lDistanceToMove=16927, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x421f [0071.567] SetFilePointer (in: hFile=0x158, lDistanceToMove=16927, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x421f [0071.567] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x421f [0071.567] SetFilePointer (in: hFile=0x158, lDistanceToMove=16927, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x421f [0071.567] SetEndOfFile (hFile=0x158) returned 1 [0071.567] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x421f [0071.567] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x421f [0071.567] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="rollinghills.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0071.567] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="rollinghills.png", cchWideChar=16, lpMultiByteStr=0x1ff8a14, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rollinghills.png", lpUsedDefaultChar=0x0) returned 16 [0071.567] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="rollinghills.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0071.567] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="rollinghills.png", cchWideChar=16, lpMultiByteStr=0x1ff88fc, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rollinghills.png", lpUsedDefaultChar=0x0) returned 16 [0071.567] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff88fc, cbMultiByte=16, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="rollinghills.png\x18믉`믑`") returned 16 [0071.567] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="rollinghills.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0071.568] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="rollinghills.png", cchWideChar=16, lpMultiByteStr=0x1ff8a14, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rollinghills.png", lpUsedDefaultChar=0x0) returned 16 [0071.568] WriteFile (in: hFile=0x158, lpBuffer=0x3b384c8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3b384c8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0071.568] CharToOemA (in: pSrc="rollinghills.png", pDst=0x1ff88fc | out: pDst="rollinghills.png") returned 1 [0071.568] WriteFile (in: hFile=0x158, lpBuffer=0x1ff88fc*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1ff88fc*, lpNumberOfBytesWritten=0x18efcc*=0x10, lpOverlapped=0x0) returned 1 [0071.568] WriteFile (in: hFile=0x158, lpBuffer=0x379ad88*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379ad88*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0071.568] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0071.568] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0071.568] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x4268 [0071.568] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x4268 [0071.568] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0071.568] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0071.568] DeleteFileW (lpFileName="") returned 0 [0071.568] GetLastError () returned 0x3 [0071.568] GetFileAttributesW (lpFileName="") returned 0xffffffff [0071.568] SetLastError (dwErrCode=0x3) [0071.568] FlushFileBuffers (hFile=0x158) returned 1 [0071.571] GetCurrentThreadId () returned 0x970 [0071.571] GetCurrentThreadId () returned 0x970 [0071.571] GetCurrentThreadId () returned 0x970 [0071.571] GetCurrentThreadId () returned 0x970 [0071.571] GetCurrentThreadId () returned 0x970 [0071.571] GetCurrentThreadId () returned 0x970 [0071.571] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x431f [0071.571] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x431f [0071.571] SetFilePointer (in: hFile=0x158, lDistanceToMove=17183, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x431f [0071.571] CloseHandle (hObject=0x158) returned 1 [0071.571] GetCurrentThreadId () returned 0x970 [0071.571] GetCurrentThreadId () returned 0x970 [0071.571] GetCurrentThreadId () returned 0x970 [0071.571] GetCurrentThreadId () returned 0x970 [0071.572] GetCurrentThreadId () returned 0x970 [0071.572] GetCurrentThreadId () returned 0x970 [0071.572] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Файл зашифрован [rollinghills.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\Файл зашифрован [rollinghills.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0071.572] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x431f [0071.572] SetFilePointer (in: hFile=0x158, lDistanceToMove=17055, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x429f [0071.572] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0071.572] GetFileType (hFile=0x158) returned 0x1 [0071.572] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x12, wMilliseconds=0x352)) [0071.572] GetCurrentThreadId () returned 0x970 [0071.572] GetCurrentThreadId () returned 0x970 [0071.572] GetCurrentThreadId () returned 0x970 [0071.572] GetCurrentThreadId () returned 0x970 [0071.572] GetCurrentThreadId () returned 0x970 [0071.572] GetCurrentThreadId () returned 0x970 [0071.572] GetCurrentThreadId () returned 0x970 [0071.572] GetCurrentThreadId () returned 0x970 [0071.572] GetCurrentThreadId () returned 0x970 [0071.572] GetCurrentThreadId () returned 0x970 [0071.572] GetCurrentThreadId () returned 0x970 [0071.572] GetCurrentThreadId () returned 0x970 [0071.572] GetCurrentThreadId () returned 0x970 [0071.572] GetCurrentThreadId () returned 0x970 [0071.572] GetCurrentThreadId () returned 0x970 [0071.572] GetCurrentThreadId () returned 0x970 [0071.572] GetCurrentThreadId () returned 0x970 [0071.572] GetCurrentThreadId () returned 0x970 [0071.572] GetCurrentThreadId () returned 0x970 [0071.572] GetCurrentThreadId () returned 0x970 [0071.572] GetCurrentThreadId () returned 0x970 [0071.573] GetCurrentThreadId () returned 0x970 [0071.573] GetCurrentThreadId () returned 0x970 [0071.573] GetCurrentThreadId () returned 0x970 [0071.573] GetCurrentThreadId () returned 0x970 [0071.573] GetCurrentThreadId () returned 0x970 [0071.573] GetCurrentThreadId () returned 0x970 [0071.573] GetCurrentThreadId () returned 0x970 [0071.573] GetCurrentThreadId () returned 0x970 [0071.573] GetCurrentThreadId () returned 0x970 [0071.573] GetCurrentThreadId () returned 0x970 [0071.573] GetCurrentThreadId () returned 0x970 [0071.573] GetCurrentThreadId () returned 0x970 [0071.573] GetCurrentThreadId () returned 0x970 [0071.573] GetCurrentThreadId () returned 0x970 [0071.573] GetCurrentThreadId () returned 0x970 [0071.573] GetCurrentThreadId () returned 0x970 [0071.573] GetCurrentThreadId () returned 0x970 [0071.573] GetCurrentThreadId () returned 0x970 [0071.573] GetCurrentThreadId () returned 0x970 [0071.573] GetCurrentThreadId () returned 0x970 [0071.573] GetCurrentThreadId () returned 0x970 [0071.573] GetCurrentThreadId () returned 0x970 [0071.573] GetCurrentThreadId () returned 0x970 [0071.573] GetCurrentThreadId () returned 0x970 [0071.573] GetCurrentThreadId () returned 0x970 [0071.573] GetCurrentThreadId () returned 0x970 [0071.573] GetCurrentThreadId () returned 0x970 [0071.573] GetCurrentThreadId () returned 0x970 [0071.573] GetCurrentThreadId () returned 0x970 [0071.573] GetCurrentThreadId () returned 0x970 [0071.573] GetCurrentThreadId () returned 0x970 [0071.573] GetCurrentThreadId () returned 0x970 [0071.573] GetCurrentThreadId () returned 0x970 [0071.573] GetCurrentThreadId () returned 0x970 [0071.573] GetCurrentThreadId () returned 0x970 [0071.573] GetCurrentThreadId () returned 0x970 [0071.573] GetCurrentThreadId () returned 0x970 [0071.573] GetCurrentThreadId () returned 0x970 [0071.573] GetCurrentThreadId () returned 0x970 [0071.574] GetCurrentThreadId () returned 0x970 [0071.574] GetCurrentThreadId () returned 0x970 [0071.574] GetCurrentThreadId () returned 0x970 [0071.574] GetCurrentThreadId () returned 0x970 [0071.574] GetCurrentThreadId () returned 0x970 [0071.574] GetCurrentThreadId () returned 0x970 [0071.574] GetCurrentThreadId () returned 0x970 [0071.574] GetCurrentThreadId () returned 0x970 [0071.574] GetCurrentThreadId () returned 0x970 [0071.574] GetCurrentThreadId () returned 0x970 [0071.574] GetCurrentThreadId () returned 0x970 [0071.574] GetCurrentThreadId () returned 0x970 [0071.574] GetCurrentThreadId () returned 0x970 [0071.574] GetCurrentThreadId () returned 0x970 [0071.574] GetCurrentThreadId () returned 0x970 [0071.574] GetCurrentThreadId () returned 0x970 [0071.574] GetCurrentThreadId () returned 0x970 [0071.574] GetCurrentThreadId () returned 0x970 [0071.574] GetCurrentThreadId () returned 0x970 [0071.574] GetCurrentThreadId () returned 0x970 [0071.574] GetCurrentThreadId () returned 0x970 [0071.574] GetCurrentThreadId () returned 0x970 [0071.574] GetCurrentThreadId () returned 0x970 [0071.574] GetCurrentThreadId () returned 0x970 [0071.574] GetCurrentThreadId () returned 0x970 [0071.574] GetCurrentThreadId () returned 0x970 [0071.574] GetCurrentThreadId () returned 0x970 [0071.574] GetCurrentThreadId () returned 0x970 [0071.574] GetCurrentThreadId () returned 0x970 [0071.574] GetCurrentThreadId () returned 0x970 [0071.574] GetCurrentThreadId () returned 0x970 [0071.574] GetCurrentThreadId () returned 0x970 [0071.574] GetCurrentThreadId () returned 0x970 [0071.574] GetCurrentThreadId () returned 0x970 [0071.574] GetCurrentThreadId () returned 0x970 [0071.574] GetCurrentThreadId () returned 0x970 [0071.574] GetCurrentThreadId () returned 0x970 [0071.574] GetCurrentThreadId () returned 0x970 [0071.574] GetCurrentThreadId () returned 0x970 [0071.574] GetCurrentThreadId () returned 0x970 [0071.574] GetCurrentThreadId () returned 0x970 [0071.575] GetCurrentThreadId () returned 0x970 [0071.575] GetCurrentThreadId () returned 0x970 [0071.575] GetCurrentThreadId () returned 0x970 [0071.575] GetCurrentThreadId () returned 0x970 [0071.575] GetCurrentThreadId () returned 0x970 [0071.575] GetCurrentThreadId () returned 0x970 [0071.575] GetCurrentThreadId () returned 0x970 [0071.575] GetCurrentThreadId () returned 0x970 [0071.575] GetCurrentThreadId () returned 0x970 [0071.575] GetCurrentThreadId () returned 0x970 [0071.575] GetCurrentThreadId () returned 0x970 [0071.575] GetCurrentThreadId () returned 0x970 [0071.575] GetCurrentThreadId () returned 0x970 [0071.575] GetCurrentThreadId () returned 0x970 [0071.575] GetCurrentThreadId () returned 0x970 [0071.575] GetCurrentThreadId () returned 0x970 [0071.575] GetCurrentThreadId () returned 0x970 [0071.575] GetCurrentThreadId () returned 0x970 [0071.575] GetCurrentThreadId () returned 0x970 [0071.575] GetCurrentThreadId () returned 0x970 [0071.575] GetCurrentThreadId () returned 0x970 [0071.575] GetCurrentThreadId () returned 0x970 [0071.575] GetCurrentThreadId () returned 0x970 [0071.575] GetCurrentThreadId () returned 0x970 [0071.575] GetCurrentThreadId () returned 0x970 [0071.575] GetCurrentThreadId () returned 0x970 [0071.575] GetCurrentThreadId () returned 0x970 [0071.575] GetCurrentThreadId () returned 0x970 [0071.575] GetCurrentThreadId () returned 0x970 [0071.575] GetCurrentThreadId () returned 0x970 [0071.575] GetCurrentThreadId () returned 0x970 [0071.575] GetCurrentThreadId () returned 0x970 [0071.575] GetCurrentThreadId () returned 0x970 [0071.575] GetCurrentThreadId () returned 0x970 [0071.575] GetCurrentThreadId () returned 0x970 [0071.575] GetCurrentThreadId () returned 0x970 [0071.575] GetCurrentThreadId () returned 0x970 [0071.575] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.575] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.576] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379e8f8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0071.576] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.576] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.576] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379e8f8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0071.576] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.576] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.576] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0071.576] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.576] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.576] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0071.576] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.576] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.576] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379e958, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0071.576] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.576] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.576] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379e958, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0071.576] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.576] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.576] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379e958, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0071.576] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x12, wMilliseconds=0x352)) [0071.576] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EKmEjC~u=F5TMNTiImvx>iTG>r\\SZ.gM", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0071.576] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EKmEjC~u=F5TMNTiImvx>iTG>r\\SZ.gM", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0071.576] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EKmEjC~u=F5TMNTiImvx>iTG>r\\SZ.gM", cchWideChar=32, lpMultiByteStr=0x20052a8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EKmEjC~u=F5TMNTiImvx>iTG>r\\SZ.gM", lpUsedDefaultChar=0x0) returned 32 [0071.576] GetCurrentThreadId () returned 0x970 [0071.576] GetCurrentThreadId () returned 0x970 [0071.576] GetCurrentThreadId () returned 0x970 [0071.576] GetCurrentThreadId () returned 0x970 [0071.576] GetCurrentThreadId () returned 0x970 [0071.577] GetCurrentThreadId () returned 0x970 [0071.584] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0071.584] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0071.584] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x37b5318, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0071.584] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ecd48, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0071.584] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ecd48, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAFZYEf41klyRXaQv4YZ4CqN3d808Wnx+eD5SYn9vNDSieY/3bRItWt7kRrsG5DCnY0xBb756o1AveFINtSaC65mnrqQ860QEgE9CPlw1z5bn0Ok1KGpRCIhINXdKjgvr5xXMMfQli4uuErPQxI5/9lFt/R9dR/j9fCIj9PxaoE4DLoalMvJay20j95hKdayzjywYKXqY7TG4etGxAsorwk7NrlSjd2xwIA==") returned 232 [0071.584] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x12, wMilliseconds=0x352)) [0071.584] GetCurrentThreadId () returned 0x970 [0071.584] GetCurrentThreadId () returned 0x970 [0071.584] GetCurrentThreadId () returned 0x970 [0071.584] GetCurrentThreadId () returned 0x970 [0071.584] GetCurrentThreadId () returned 0x970 [0071.584] GetCurrentThreadId () returned 0x970 [0071.584] GetCurrentThreadId () returned 0x970 [0071.584] GetCurrentThreadId () returned 0x970 [0071.584] GetCurrentThreadId () returned 0x970 [0071.584] GetCurrentThreadId () returned 0x970 [0071.584] GetCurrentThreadId () returned 0x970 [0071.584] GetCurrentThreadId () returned 0x970 [0071.584] GetCurrentThreadId () returned 0x970 [0071.585] GetCurrentThreadId () returned 0x970 [0071.585] GetCurrentThreadId () returned 0x970 [0071.585] GetCurrentThreadId () returned 0x970 [0071.585] GetCurrentThreadId () returned 0x970 [0071.585] GetCurrentThreadId () returned 0x970 [0071.585] GetCurrentThreadId () returned 0x970 [0071.585] GetCurrentThreadId () returned 0x970 [0071.585] GetCurrentThreadId () returned 0x970 [0071.585] GetCurrentThreadId () returned 0x970 [0071.585] GetCurrentThreadId () returned 0x970 [0071.585] GetCurrentThreadId () returned 0x970 [0071.585] GetCurrentThreadId () returned 0x970 [0071.585] GetCurrentThreadId () returned 0x970 [0071.585] GetCurrentThreadId () returned 0x970 [0071.585] GetCurrentThreadId () returned 0x970 [0071.585] GetCurrentThreadId () returned 0x970 [0071.585] GetCurrentThreadId () returned 0x970 [0071.585] GetCurrentThreadId () returned 0x970 [0071.585] GetCurrentThreadId () returned 0x970 [0071.585] GetCurrentThreadId () returned 0x970 [0071.585] GetCurrentThreadId () returned 0x970 [0071.585] GetCurrentThreadId () returned 0x970 [0071.585] GetCurrentThreadId () returned 0x970 [0071.585] GetCurrentThreadId () returned 0x970 [0071.585] GetCurrentThreadId () returned 0x970 [0071.585] GetCurrentThreadId () returned 0x970 [0071.585] GetCurrentThreadId () returned 0x970 [0071.585] GetCurrentThreadId () returned 0x970 [0071.585] GetCurrentThreadId () returned 0x970 [0071.585] GetCurrentThreadId () returned 0x970 [0071.585] GetCurrentThreadId () returned 0x970 [0071.585] GetCurrentThreadId () returned 0x970 [0071.585] GetCurrentThreadId () returned 0x970 [0071.585] GetCurrentThreadId () returned 0x970 [0071.585] GetCurrentThreadId () returned 0x970 [0071.585] GetCurrentThreadId () returned 0x970 [0071.585] GetCurrentThreadId () returned 0x970 [0071.585] GetCurrentThreadId () returned 0x970 [0071.585] GetCurrentThreadId () returned 0x970 [0071.585] GetCurrentThreadId () returned 0x970 [0071.586] GetCurrentThreadId () returned 0x970 [0071.586] GetCurrentThreadId () returned 0x970 [0071.586] GetCurrentThreadId () returned 0x970 [0071.586] GetCurrentThreadId () returned 0x970 [0071.586] GetCurrentThreadId () returned 0x970 [0071.586] GetCurrentThreadId () returned 0x970 [0071.586] GetCurrentThreadId () returned 0x970 [0071.586] GetCurrentThreadId () returned 0x970 [0071.586] GetCurrentThreadId () returned 0x970 [0071.586] GetCurrentThreadId () returned 0x970 [0071.586] GetCurrentThreadId () returned 0x970 [0071.586] GetCurrentThreadId () returned 0x970 [0071.586] GetCurrentThreadId () returned 0x970 [0071.586] GetCurrentThreadId () returned 0x970 [0071.586] GetCurrentThreadId () returned 0x970 [0071.586] GetCurrentThreadId () returned 0x970 [0071.586] GetCurrentThreadId () returned 0x970 [0071.586] GetCurrentThreadId () returned 0x970 [0071.586] GetCurrentThreadId () returned 0x970 [0071.586] GetCurrentThreadId () returned 0x970 [0071.586] GetCurrentThreadId () returned 0x970 [0071.586] GetCurrentThreadId () returned 0x970 [0071.586] GetCurrentThreadId () returned 0x970 [0071.586] GetCurrentThreadId () returned 0x970 [0071.586] GetCurrentThreadId () returned 0x970 [0071.586] GetCurrentThreadId () returned 0x970 [0071.586] GetCurrentThreadId () returned 0x970 [0071.586] GetCurrentThreadId () returned 0x970 [0071.586] GetCurrentThreadId () returned 0x970 [0071.586] GetCurrentThreadId () returned 0x970 [0071.586] GetCurrentThreadId () returned 0x970 [0071.586] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAFZYEf41klyRXaQv4YZ4CqN3d808Wnx+eD5SYn9vNDSieY/3bRItWt7kRrsG5DCnY0xBb756o1AveFINtSaC65mnrqQ860QEgE9CPlw1z5bn0Ok1KGpRCIhINXdKjgvr5xXMMfQli4uuErPQxI5/9lFt/R9dR/j9fCIj9PxaoE4DLoalMvJay20j95hKdayzjywYKXqY7TG4etGxAsorwk7NrlSjd2xwIA==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0071.586] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAFZYEf41klyRXaQv4YZ4CqN3d808Wnx+eD5SYn9vNDSieY/3bRItWt7kRrsG5DCnY0xBb756o1AveFINtSaC65mnrqQ860QEgE9CPlw1z5bn0Ok1KGpRCIhINXdKjgvr5xXMMfQli4uuErPQxI5/9lFt/R9dR/j9fCIj9PxaoE4DLoalMvJay20j95hKdayzjywYKXqY7TG4etGxAsorwk7NrlSjd2xwIA==", cchWideChar=245, lpMultiByteStr=0x353a65c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAFZYEf41klyRXaQv4YZ4CqN3d808Wnx+eD5SYn9vNDSieY/3bRItWt7kRrsG5DCnY0xBb756o1AveFINtSaC65mnrqQ860QEgE9CPlw1z5bn0Ok1KGpRCIhINXdKjgvr5xXMMfQli4uuErPQxI5/9lFt/R9dR/j9fCIj9PxaoE4DLoalMvJay20j95hKdayzjywYKXqY7TG4etGxAsorwk7NrlSjd2xwIA==", lpUsedDefaultChar=0x0) returned 245 [0071.587] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0071.587] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0071.587] CloseHandle (hObject=0x158) returned 1 [0071.587] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\rollinghills.png")) returned 0 [0071.587] GetLastError () returned 0x5 [0071.587] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\rollinghills.png")) returned 0x20 [0071.587] SetLastError (dwErrCode=0x5) [0071.587] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=19185065315) returned 1 [0071.587] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Файл зашифрован [photoedge_buttongraphic.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\Файл зашифрован [photoedge_buttongraphic.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0071.588] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0071.588] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0071.588] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0071.588] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0071.588] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0071.588] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0071.588] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0071.588] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0071.588] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0071.588] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0071.588] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0071.588] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0071.588] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0071.589] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0071.589] SetEndOfFile (hFile=0x158) returned 1 [0071.589] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0071.589] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0071.589] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0071.589] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0071.589] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0071.590] WriteFile (in: hFile=0x158, lpBuffer=0x35f035c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f035c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0071.590] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="pI}%gJt", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0072.724] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="edy(a^2hI#H9@:DK5##C-lX6N6\"A->Jt", cchWideChar=32, lpMultiByteStr=0x203847c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="edy(a^2hI#H9@:DK5##C-lX6N6\"A->Jt", lpUsedDefaultChar=0x0) returned 32 [0072.724] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0072.724] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0072.724] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_item.png", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f38881e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f38881e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee4ccd1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="push_item.png", cAlternateFileName="")) returned 0x295098 [0072.724] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0072.725] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0072.725] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_item.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_item.png")) returned 0x20 [0072.725] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_item.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_item.png")) returned 0x20 [0072.725] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_item.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_item.png")) returned 0x20 [0072.725] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_item.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_item.png")) returned 0x20 [0072.725] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_item.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_item.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f38881e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f38881e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee4ccd1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb70)) returned 1 [0072.725] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0072.725] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0072.725] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_item.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_item.png")) returned 0x20 [0072.725] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_item.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_item.png")) returned 0x20 [0072.726] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0072.726] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0072.726] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0072.726] SetEndOfFile (hFile=0x158) returned 1 [0072.727] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="push_item.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0072.727] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="push_item.png", cchWideChar=13, lpMultiByteStr=0x1fe398c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="push_item.png", lpUsedDefaultChar=0x0) returned 13 [0072.727] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="push_item.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0072.727] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="push_item.png", cchWideChar=13, lpMultiByteStr=0x1fe44ac, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="push_item.png", lpUsedDefaultChar=0x0) returned 13 [0072.727] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe44ac, cbMultiByte=13, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="push_item.pngpngre.pngture.pngre.pngpngg") returned 13 [0072.727] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="push_item.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0072.727] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="push_item.png", cchWideChar=13, lpMultiByteStr=0x1fe398c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="push_item.png", lpUsedDefaultChar=0x0) returned 13 [0072.727] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_item.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_item.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0072.727] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0072.727] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0xb70 [0072.727] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0072.727] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0072.727] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0072.727] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="push_item.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0072.728] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="push_item.png", cchWideChar=13, lpMultiByteStr=0x1fe398c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="push_item.png", lpUsedDefaultChar=0x0) returned 13 [0072.728] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="push_item.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0072.728] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="push_item.png", cchWideChar=13, lpMultiByteStr=0x1fe44ac, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="push_item.png", lpUsedDefaultChar=0x0) returned 13 [0072.728] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe44ac, cbMultiByte=13, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="push_item.pngem.pngpngre.pngture.pngre.pngpngg") returned 13 [0072.728] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="push_item.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0072.728] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="push_item.png", cchWideChar=13, lpMultiByteStr=0x1fe398c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="push_item.png", lpUsedDefaultChar=0x0) returned 13 [0072.728] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0072.729] CharToOemA (in: pSrc="push_item.png", pDst=0x1fe44ac | out: pDst="push_item.png") returned 1 [0072.729] WriteFile (in: hFile=0x158, lpBuffer=0x1fe44ac*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe44ac*, lpNumberOfBytesWritten=0x18e048*=0xd, lpOverlapped=0x0) returned 1 [0072.729] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0072.729] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0072.729] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0072.729] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=19299254142) returned 1 [0072.729] ReadFile (in: hFile=0x11c, lpBuffer=0x3b5bc20, nNumberOfBytesToRead=0xb70, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b5bc20*, lpNumberOfBytesRead=0x18dd7c*=0xb70, lpOverlapped=0x0) returned 1 [0072.749] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0072.749] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=19301254992) returned 1 [0072.758] WriteFile (in: hFile=0x158, lpBuffer=0x379ae28*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379ae28*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0072.758] ReadFile (in: hFile=0x11c, lpBuffer=0x3b5bc20, nNumberOfBytesToRead=0xb70, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3b5bc20*, lpNumberOfBytesRead=0x18de38*=0xb70, lpOverlapped=0x0) returned 1 [0072.758] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x48 [0072.758] WriteFile (in: hFile=0x158, lpBuffer=0x3b9e040*, nNumberOfBytesToWrite=0xb70, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3b9e040*, lpNumberOfBytesWritten=0x18de10*=0xb70, lpOverlapped=0x0) returned 1 [0072.759] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0xbb8 [0072.759] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0072.759] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0072.759] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0072.759] SetFilePointer (in: hFile=0x158, lDistanceToMove=13, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2b [0072.759] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0xbc2 [0072.759] CloseHandle (hObject=0x11c) returned 1 [0072.759] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xbc2 [0072.759] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xbc2 [0072.759] SetFilePointer (in: hFile=0x158, lDistanceToMove=3010, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xbc2 [0072.759] SetFilePointer (in: hFile=0x158, lDistanceToMove=3010, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0xbc2 [0072.759] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xbc2 [0072.759] SetFilePointer (in: hFile=0x158, lDistanceToMove=3010, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0xbc2 [0072.760] SetEndOfFile (hFile=0x158) returned 1 [0072.760] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xbc2 [0072.760] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xbc2 [0072.760] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="push_item.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0072.760] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="push_item.png", cchWideChar=13, lpMultiByteStr=0x1fe398c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="push_item.png", lpUsedDefaultChar=0x0) returned 13 [0072.760] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="push_item.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0072.760] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="push_item.png", cchWideChar=13, lpMultiByteStr=0x1fe428c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="push_item.png", lpUsedDefaultChar=0x0) returned 13 [0072.760] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe428c, cbMultiByte=13, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="push_item.png@涤(\x18믉`믑`") returned 13 [0072.760] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="push_item.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0072.760] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="push_item.png", cchWideChar=13, lpMultiByteStr=0x1fe398c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="push_item.png", lpUsedDefaultChar=0x0) returned 13 [0072.760] WriteFile (in: hFile=0x158, lpBuffer=0x3b3f6f8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3b3f6f8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0072.760] CharToOemA (in: pSrc="push_item.png", pDst=0x1fe428c | out: pDst="push_item.png") returned 1 [0072.760] WriteFile (in: hFile=0x158, lpBuffer=0x1fe428c*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe428c*, lpNumberOfBytesWritten=0x18efcc*=0xd, lpOverlapped=0x0) returned 1 [0072.760] WriteFile (in: hFile=0x158, lpBuffer=0x379ae18*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379ae18*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0072.760] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0072.761] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0072.761] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xc08 [0072.761] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xc08 [0072.761] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0072.761] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0072.761] DeleteFileW (lpFileName="") returned 0 [0072.761] GetLastError () returned 0x3 [0072.761] GetFileAttributesW (lpFileName="") returned 0xffffffff [0072.761] SetLastError (dwErrCode=0x3) [0072.761] FlushFileBuffers (hFile=0x158) returned 1 [0072.804] GetCurrentThreadId () returned 0x970 [0072.804] GetCurrentThreadId () returned 0x970 [0072.804] GetCurrentThreadId () returned 0x970 [0072.804] GetCurrentThreadId () returned 0x970 [0072.804] GetCurrentThreadId () returned 0x970 [0072.804] GetCurrentThreadId () returned 0x970 [0072.804] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xcbf [0072.804] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xcbf [0072.805] SetFilePointer (in: hFile=0x158, lDistanceToMove=3263, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xcbf [0072.805] CloseHandle (hObject=0x158) returned 1 [0072.805] GetCurrentThreadId () returned 0x970 [0072.805] GetCurrentThreadId () returned 0x970 [0072.805] GetCurrentThreadId () returned 0x970 [0072.805] GetCurrentThreadId () returned 0x970 [0072.805] GetCurrentThreadId () returned 0x970 [0072.805] GetCurrentThreadId () returned 0x970 [0072.805] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\Файл зашифрован [push_item.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\Файл зашифрован [push_item.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0072.805] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xcbf [0072.805] SetFilePointer (in: hFile=0x158, lDistanceToMove=3135, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc3f [0072.805] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0072.805] GetFileType (hFile=0x158) returned 0x1 [0072.805] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x14, wMilliseconds=0x52)) [0072.805] GetCurrentThreadId () returned 0x970 [0072.805] GetCurrentThreadId () returned 0x970 [0072.805] GetCurrentThreadId () returned 0x970 [0072.805] GetCurrentThreadId () returned 0x970 [0072.805] GetCurrentThreadId () returned 0x970 [0072.805] GetCurrentThreadId () returned 0x970 [0072.805] GetCurrentThreadId () returned 0x970 [0072.805] GetCurrentThreadId () returned 0x970 [0072.805] GetCurrentThreadId () returned 0x970 [0072.805] GetCurrentThreadId () returned 0x970 [0072.806] GetCurrentThreadId () returned 0x970 [0072.806] GetCurrentThreadId () returned 0x970 [0072.806] GetCurrentThreadId () returned 0x970 [0072.806] GetCurrentThreadId () returned 0x970 [0072.806] GetCurrentThreadId () returned 0x970 [0072.806] GetCurrentThreadId () returned 0x970 [0072.806] GetCurrentThreadId () returned 0x970 [0072.806] GetCurrentThreadId () returned 0x970 [0072.806] GetCurrentThreadId () returned 0x970 [0072.806] GetCurrentThreadId () returned 0x970 [0072.806] GetCurrentThreadId () returned 0x970 [0072.806] GetCurrentThreadId () returned 0x970 [0072.806] GetCurrentThreadId () returned 0x970 [0072.806] GetCurrentThreadId () returned 0x970 [0072.806] GetCurrentThreadId () returned 0x970 [0072.806] GetCurrentThreadId () returned 0x970 [0072.806] GetCurrentThreadId () returned 0x970 [0072.806] GetCurrentThreadId () returned 0x970 [0072.806] GetCurrentThreadId () returned 0x970 [0072.806] GetCurrentThreadId () returned 0x970 [0072.806] GetCurrentThreadId () returned 0x970 [0072.806] GetCurrentThreadId () returned 0x970 [0072.806] GetCurrentThreadId () returned 0x970 [0072.806] GetCurrentThreadId () returned 0x970 [0072.806] GetCurrentThreadId () returned 0x970 [0072.806] GetCurrentThreadId () returned 0x970 [0072.806] GetCurrentThreadId () returned 0x970 [0072.806] GetCurrentThreadId () returned 0x970 [0072.806] GetCurrentThreadId () returned 0x970 [0072.806] GetCurrentThreadId () returned 0x970 [0072.806] GetCurrentThreadId () returned 0x970 [0072.806] GetCurrentThreadId () returned 0x970 [0072.806] GetCurrentThreadId () returned 0x970 [0072.806] GetCurrentThreadId () returned 0x970 [0072.806] GetCurrentThreadId () returned 0x970 [0072.806] GetCurrentThreadId () returned 0x970 [0072.806] GetCurrentThreadId () returned 0x970 [0072.806] GetCurrentThreadId () returned 0x970 [0072.806] GetCurrentThreadId () returned 0x970 [0072.806] GetCurrentThreadId () returned 0x970 [0072.806] GetCurrentThreadId () returned 0x970 [0072.806] GetCurrentThreadId () returned 0x970 [0072.806] GetCurrentThreadId () returned 0x970 [0072.806] GetCurrentThreadId () returned 0x970 [0072.806] GetCurrentThreadId () returned 0x970 [0072.807] GetCurrentThreadId () returned 0x970 [0072.807] GetCurrentThreadId () returned 0x970 [0072.807] GetCurrentThreadId () returned 0x970 [0072.807] GetCurrentThreadId () returned 0x970 [0072.807] GetCurrentThreadId () returned 0x970 [0072.807] GetCurrentThreadId () returned 0x970 [0072.807] GetCurrentThreadId () returned 0x970 [0072.807] GetCurrentThreadId () returned 0x970 [0072.807] GetCurrentThreadId () returned 0x970 [0072.807] GetCurrentThreadId () returned 0x970 [0072.807] GetCurrentThreadId () returned 0x970 [0072.807] GetCurrentThreadId () returned 0x970 [0072.807] GetCurrentThreadId () returned 0x970 [0072.807] GetCurrentThreadId () returned 0x970 [0072.807] GetCurrentThreadId () returned 0x970 [0072.807] GetCurrentThreadId () returned 0x970 [0072.807] GetCurrentThreadId () returned 0x970 [0072.807] GetCurrentThreadId () returned 0x970 [0072.807] GetCurrentThreadId () returned 0x970 [0072.807] GetCurrentThreadId () returned 0x970 [0072.807] GetCurrentThreadId () returned 0x970 [0072.807] GetCurrentThreadId () returned 0x970 [0072.807] GetCurrentThreadId () returned 0x970 [0072.807] GetCurrentThreadId () returned 0x970 [0072.807] GetCurrentThreadId () returned 0x970 [0072.807] GetCurrentThreadId () returned 0x970 [0072.807] GetCurrentThreadId () returned 0x970 [0072.807] GetCurrentThreadId () returned 0x970 [0072.807] GetCurrentThreadId () returned 0x970 [0072.807] GetCurrentThreadId () returned 0x970 [0072.807] GetCurrentThreadId () returned 0x970 [0072.807] GetCurrentThreadId () returned 0x970 [0072.807] GetCurrentThreadId () returned 0x970 [0072.807] GetCurrentThreadId () returned 0x970 [0072.807] GetCurrentThreadId () returned 0x970 [0072.807] GetCurrentThreadId () returned 0x970 [0072.807] GetCurrentThreadId () returned 0x970 [0072.807] GetCurrentThreadId () returned 0x970 [0072.807] GetCurrentThreadId () returned 0x970 [0072.807] GetCurrentThreadId () returned 0x970 [0072.807] GetCurrentThreadId () returned 0x970 [0072.807] GetCurrentThreadId () returned 0x970 [0072.807] GetCurrentThreadId () returned 0x970 [0072.807] GetCurrentThreadId () returned 0x970 [0072.807] GetCurrentThreadId () returned 0x970 [0072.808] GetCurrentThreadId () returned 0x970 [0072.808] GetCurrentThreadId () returned 0x970 [0072.808] GetCurrentThreadId () returned 0x970 [0072.808] GetCurrentThreadId () returned 0x970 [0072.808] GetCurrentThreadId () returned 0x970 [0072.808] GetCurrentThreadId () returned 0x970 [0072.808] GetCurrentThreadId () returned 0x970 [0072.808] GetCurrentThreadId () returned 0x970 [0072.808] GetCurrentThreadId () returned 0x970 [0072.808] GetCurrentThreadId () returned 0x970 [0072.808] GetCurrentThreadId () returned 0x970 [0072.808] GetCurrentThreadId () returned 0x970 [0072.808] GetCurrentThreadId () returned 0x970 [0072.808] GetCurrentThreadId () returned 0x970 [0072.808] GetCurrentThreadId () returned 0x970 [0072.808] GetCurrentThreadId () returned 0x970 [0072.808] GetCurrentThreadId () returned 0x970 [0072.808] GetCurrentThreadId () returned 0x970 [0072.808] GetCurrentThreadId () returned 0x970 [0072.808] GetCurrentThreadId () returned 0x970 [0072.808] GetCurrentThreadId () returned 0x970 [0072.808] GetCurrentThreadId () returned 0x970 [0072.808] GetCurrentThreadId () returned 0x970 [0072.808] GetCurrentThreadId () returned 0x970 [0072.808] GetCurrentThreadId () returned 0x970 [0072.808] GetCurrentThreadId () returned 0x970 [0072.808] GetCurrentThreadId () returned 0x970 [0072.808] GetCurrentThreadId () returned 0x970 [0072.808] GetCurrentThreadId () returned 0x970 [0072.808] GetCurrentThreadId () returned 0x970 [0072.808] GetCurrentThreadId () returned 0x970 [0072.808] GetCurrentThreadId () returned 0x970 [0072.808] GetCurrentThreadId () returned 0x970 [0072.808] GetCurrentThreadId () returned 0x970 [0072.808] GetCurrentThreadId () returned 0x970 [0072.808] GetCurrentThreadId () returned 0x970 [0072.808] GetCurrentThreadId () returned 0x970 [0072.808] GetCurrentThreadId () returned 0x970 [0072.808] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0072.808] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0072.808] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379ef58, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0072.808] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0072.808] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0072.809] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379ef58, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0072.809] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0072.809] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0072.809] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0072.809] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0072.809] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0072.809] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0072.809] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0072.809] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0072.809] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379efb8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0072.809] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0072.809] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0072.809] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379efb8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0072.809] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0072.809] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0072.809] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379efb8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0072.809] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x14, wMilliseconds=0x52)) [0072.809] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="edy(a^2hI#H9@:DK5##C-lX6N6\"A->Jt", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0072.809] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="edy(a^2hI#H9@:DK5##C-lX6N6\"A->Jt", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0072.809] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="edy(a^2hI#H9@:DK5##C-lX6N6\"A->Jt", cchWideChar=32, lpMultiByteStr=0x2005638, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="edy(a^2hI#H9@:DK5##C-lX6N6\"A->Jt", lpUsedDefaultChar=0x0) returned 32 [0072.809] GetCurrentThreadId () returned 0x970 [0072.809] GetCurrentThreadId () returned 0x970 [0072.809] GetCurrentThreadId () returned 0x970 [0072.809] GetCurrentThreadId () returned 0x970 [0072.809] GetCurrentThreadId () returned 0x970 [0072.809] GetCurrentThreadId () returned 0x970 [0072.817] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0072.817] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0072.817] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x37b63f8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0072.817] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ed248, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0072.817] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ed248, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAAQrg+lxb01jY1h8gdsqIabVWie/QxRhJOr5CRcP9dqEHWvGkM9Ej0NXqpSZBhApK97maavLnmwwSQi+iGN73uhNq6cIW8NeY6nZvgZgH64HATYV+G7sD2xsMwJf0kwVhHx+sfUk1LM/pGwxzBkuqu/tFY70PSvW0PBQ9M0PCRoLIOvkN663RXZ8LW/+MyJScz45Y/JzU+65CSDGiR1oXNbHT4czg2Pk1w==") returned 232 [0072.817] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x14, wMilliseconds=0x52)) [0072.817] GetCurrentThreadId () returned 0x970 [0072.817] GetCurrentThreadId () returned 0x970 [0072.817] GetCurrentThreadId () returned 0x970 [0072.817] GetCurrentThreadId () returned 0x970 [0072.817] GetCurrentThreadId () returned 0x970 [0072.817] GetCurrentThreadId () returned 0x970 [0072.817] GetCurrentThreadId () returned 0x970 [0072.817] GetCurrentThreadId () returned 0x970 [0072.817] GetCurrentThreadId () returned 0x970 [0072.817] GetCurrentThreadId () returned 0x970 [0072.817] GetCurrentThreadId () returned 0x970 [0072.817] GetCurrentThreadId () returned 0x970 [0072.817] GetCurrentThreadId () returned 0x970 [0072.817] GetCurrentThreadId () returned 0x970 [0072.818] GetCurrentThreadId () returned 0x970 [0072.818] GetCurrentThreadId () returned 0x970 [0072.818] GetCurrentThreadId () returned 0x970 [0072.818] GetCurrentThreadId () returned 0x970 [0072.818] GetCurrentThreadId () returned 0x970 [0072.818] GetCurrentThreadId () returned 0x970 [0072.818] GetCurrentThreadId () returned 0x970 [0072.818] GetCurrentThreadId () returned 0x970 [0072.818] GetCurrentThreadId () returned 0x970 [0072.818] GetCurrentThreadId () returned 0x970 [0072.818] GetCurrentThreadId () returned 0x970 [0072.818] GetCurrentThreadId () returned 0x970 [0072.818] GetCurrentThreadId () returned 0x970 [0072.818] GetCurrentThreadId () returned 0x970 [0072.818] GetCurrentThreadId () returned 0x970 [0072.818] GetCurrentThreadId () returned 0x970 [0072.818] GetCurrentThreadId () returned 0x970 [0072.818] GetCurrentThreadId () returned 0x970 [0072.818] GetCurrentThreadId () returned 0x970 [0072.818] GetCurrentThreadId () returned 0x970 [0072.818] GetCurrentThreadId () returned 0x970 [0072.818] GetCurrentThreadId () returned 0x970 [0072.818] GetCurrentThreadId () returned 0x970 [0072.818] GetCurrentThreadId () returned 0x970 [0072.818] GetCurrentThreadId () returned 0x970 [0072.818] GetCurrentThreadId () returned 0x970 [0072.818] GetCurrentThreadId () returned 0x970 [0072.818] GetCurrentThreadId () returned 0x970 [0072.818] GetCurrentThreadId () returned 0x970 [0072.818] GetCurrentThreadId () returned 0x970 [0072.818] GetCurrentThreadId () returned 0x970 [0072.818] GetCurrentThreadId () returned 0x970 [0072.818] GetCurrentThreadId () returned 0x970 [0072.818] GetCurrentThreadId () returned 0x970 [0072.818] GetCurrentThreadId () returned 0x970 [0072.818] GetCurrentThreadId () returned 0x970 [0072.818] GetCurrentThreadId () returned 0x970 [0072.818] GetCurrentThreadId () returned 0x970 [0072.818] GetCurrentThreadId () returned 0x970 [0072.818] GetCurrentThreadId () returned 0x970 [0072.818] GetCurrentThreadId () returned 0x970 [0072.818] GetCurrentThreadId () returned 0x970 [0072.818] GetCurrentThreadId () returned 0x970 [0072.818] GetCurrentThreadId () returned 0x970 [0072.818] GetCurrentThreadId () returned 0x970 [0072.819] GetCurrentThreadId () returned 0x970 [0072.819] GetCurrentThreadId () returned 0x970 [0072.819] GetCurrentThreadId () returned 0x970 [0072.819] GetCurrentThreadId () returned 0x970 [0072.819] GetCurrentThreadId () returned 0x970 [0072.819] GetCurrentThreadId () returned 0x970 [0072.819] GetCurrentThreadId () returned 0x970 [0072.819] GetCurrentThreadId () returned 0x970 [0072.819] GetCurrentThreadId () returned 0x970 [0072.819] GetCurrentThreadId () returned 0x970 [0072.819] GetCurrentThreadId () returned 0x970 [0072.819] GetCurrentThreadId () returned 0x970 [0072.819] GetCurrentThreadId () returned 0x970 [0072.819] GetCurrentThreadId () returned 0x970 [0072.819] GetCurrentThreadId () returned 0x970 [0072.819] GetCurrentThreadId () returned 0x970 [0072.819] GetCurrentThreadId () returned 0x970 [0072.819] GetCurrentThreadId () returned 0x970 [0072.819] GetCurrentThreadId () returned 0x970 [0072.819] GetCurrentThreadId () returned 0x970 [0072.819] GetCurrentThreadId () returned 0x970 [0072.819] GetCurrentThreadId () returned 0x970 [0072.819] GetCurrentThreadId () returned 0x970 [0072.819] GetCurrentThreadId () returned 0x970 [0072.819] GetCurrentThreadId () returned 0x970 [0072.819] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAAQrg+lxb01jY1h8gdsqIabVWie/QxRhJOr5CRcP9dqEHWvGkM9Ej0NXqpSZBhApK97maavLnmwwSQi+iGN73uhNq6cIW8NeY6nZvgZgH64HATYV+G7sD2xsMwJf0kwVhHx+sfUk1LM/pGwxzBkuqu/tFY70PSvW0PBQ9M0PCRoLIOvkN663RXZ8LW/+MyJScz45Y/JzU+65CSDGiR1oXNbHT4czg2Pk1w==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0072.819] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAAQrg+lxb01jY1h8gdsqIabVWie/QxRhJOr5CRcP9dqEHWvGkM9Ej0NXqpSZBhApK97maavLnmwwSQi+iGN73uhNq6cIW8NeY6nZvgZgH64HATYV+G7sD2xsMwJf0kwVhHx+sfUk1LM/pGwxzBkuqu/tFY70PSvW0PBQ9M0PCRoLIOvkN663RXZ8LW/+MyJScz45Y/JzU+65CSDGiR1oXNbHT4czg2Pk1w==", cchWideChar=245, lpMultiByteStr=0x353a87c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAAQrg+lxb01jY1h8gdsqIabVWie/QxRhJOr5CRcP9dqEHWvGkM9Ej0NXqpSZBhApK97maavLnmwwSQi+iGN73uhNq6cIW8NeY6nZvgZgH64HATYV+G7sD2xsMwJf0kwVhHx+sfUk1LM/pGwxzBkuqu/tFY70PSvW0PBQ9M0PCRoLIOvkN663RXZ8LW/+MyJScz45Y/JzU+65CSDGiR1oXNbHT4czg2Pk1w==", lpUsedDefaultChar=0x0) returned 245 [0072.819] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0072.819] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0072.819] CloseHandle (hObject=0x158) returned 1 [0072.820] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_item.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_item.png")) returned 0 [0072.820] GetLastError () returned 0x5 [0072.820] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_item.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_item.png")) returned 0x20 [0072.820] SetLastError (dwErrCode=0x5) [0072.820] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=19308331870) returned 1 [0072.820] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\Файл зашифрован [push_title.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\Файл зашифрован [push_title.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0072.820] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0072.820] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0072.821] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0072.821] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0072.821] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0072.821] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0072.821] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0072.821] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0072.821] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0072.821] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0072.821] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0072.821] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0072.821] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0072.821] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0072.821] SetEndOfFile (hFile=0x158) returned 1 [0072.821] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0072.821] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0072.821] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0072.822] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0072.822] WriteFile (in: hFile=0x158, lpBuffer=0x3777058*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777058*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0072.823] WriteFile (in: hFile=0x158, lpBuffer=0x35f035c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f035c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0072.823] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=")}hg?E&cydENqrVrsOJD^ZF5e&BA+wYq", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0072.823] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=")}hg?E&cydENqrVrsOJD^ZF5e&BA+wYq", cchWideChar=32, lpMultiByteStr=0x20384b4, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=")}hg?E&cydENqrVrsOJD^ZF5e&BA+wYq", lpUsedDefaultChar=0x0) returned 32 [0072.823] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0072.823] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0072.823] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_title.png", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f3ae97b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f3ae97b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee4ccd1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="push_title.png", cAlternateFileName="")) returned 0x295098 [0072.823] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0072.823] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0072.823] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_title.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_title.png")) returned 0x20 [0072.823] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_title.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_title.png")) returned 0x20 [0072.823] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_title.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_title.png")) returned 0x20 [0072.823] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_title.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_title.png")) returned 0x20 [0072.823] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_title.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_title.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f3ae97b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f3ae97b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee4ccd1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbb8)) returned 1 [0072.824] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0072.824] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0072.824] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_title.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_title.png")) returned 0x20 [0072.824] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_title.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_title.png")) returned 0x20 [0072.824] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0072.824] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0072.824] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0072.824] SetEndOfFile (hFile=0x158) returned 1 [0072.825] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="push_title.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0072.825] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="push_title.png", cchWideChar=14, lpMultiByteStr=0x1fe354c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="push_title.png", lpUsedDefaultChar=0x0) returned 14 [0072.825] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="push_title.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0072.825] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="push_title.png", cchWideChar=14, lpMultiByteStr=0x1fe37ac, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="push_title.png", lpUsedDefaultChar=0x0) returned 14 [0072.825] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe37ac, cbMultiByte=14, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="push_title.pngngre.pngture.pngre.pngpngg") returned 14 [0072.825] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="push_title.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0072.825] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="push_title.png", cchWideChar=14, lpMultiByteStr=0x1fe354c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="push_title.png", lpUsedDefaultChar=0x0) returned 14 [0072.825] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_title.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_title.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0072.825] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0072.825] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0xbb8 [0072.825] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0072.825] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0072.826] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0072.826] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="push_title.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0072.826] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="push_title.png", cchWideChar=14, lpMultiByteStr=0x1fe354c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="push_title.png", lpUsedDefaultChar=0x0) returned 14 [0072.826] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="push_title.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0072.826] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="push_title.png", cchWideChar=14, lpMultiByteStr=0x1fe37ac, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="push_title.png", lpUsedDefaultChar=0x0) returned 14 [0072.826] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe37ac, cbMultiByte=14, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="push_title.pngle.pngngre.pngture.pngre.pngpngg") returned 14 [0072.826] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="push_title.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0072.826] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="push_title.png", cchWideChar=14, lpMultiByteStr=0x1fe354c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="push_title.png", lpUsedDefaultChar=0x0) returned 14 [0072.826] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0072.827] CharToOemA (in: pSrc="push_title.png", pDst=0x1fe37ac | out: pDst="push_title.png") returned 1 [0072.827] WriteFile (in: hFile=0x158, lpBuffer=0x1fe37ac*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe37ac*, lpNumberOfBytesWritten=0x18e048*=0xe, lpOverlapped=0x0) returned 1 [0072.827] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0072.827] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0072.827] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0072.827] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=19309064890) returned 1 [0072.827] ReadFile (in: hFile=0x11c, lpBuffer=0x3b5bc20, nNumberOfBytesToRead=0xbb8, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b5bc20*, lpNumberOfBytesRead=0x18dd7c*=0xbb8, lpOverlapped=0x0) returned 1 [0072.829] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0072.829] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=19309211741) returned 1 [0072.837] WriteFile (in: hFile=0x158, lpBuffer=0x379ae58*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379ae58*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0072.838] ReadFile (in: hFile=0x11c, lpBuffer=0x3b5bc20, nNumberOfBytesToRead=0xbb8, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3b5bc20*, lpNumberOfBytesRead=0x18de38*=0xbb8, lpOverlapped=0x0) returned 1 [0072.838] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x49 [0072.838] WriteFile (in: hFile=0x158, lpBuffer=0x3b9e040*, nNumberOfBytesToWrite=0xbb8, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3b9e040*, lpNumberOfBytesWritten=0x18de10*=0xbb8, lpOverlapped=0x0) returned 1 [0072.838] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0xc01 [0072.838] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0072.838] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0072.838] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0072.839] SetFilePointer (in: hFile=0x158, lDistanceToMove=14, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2c [0072.839] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0xc0b [0072.839] CloseHandle (hObject=0x11c) returned 1 [0072.839] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xc0b [0072.839] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xc0b [0072.839] SetFilePointer (in: hFile=0x158, lDistanceToMove=3083, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xc0b [0072.839] SetFilePointer (in: hFile=0x158, lDistanceToMove=3083, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0xc0b [0072.839] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xc0b [0072.839] SetFilePointer (in: hFile=0x158, lDistanceToMove=3083, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0xc0b [0072.839] SetEndOfFile (hFile=0x158) returned 1 [0072.839] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xc0b [0072.839] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xc0b [0072.840] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="push_title.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0072.840] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="push_title.png", cchWideChar=14, lpMultiByteStr=0x1fe354c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="push_title.png", lpUsedDefaultChar=0x0) returned 14 [0072.840] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="push_title.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0072.840] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="push_title.png", cchWideChar=14, lpMultiByteStr=0x1fe374c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="push_title.png", lpUsedDefaultChar=0x0) returned 14 [0072.840] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe374c, cbMultiByte=14, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="push_title.png⏬'\x18믉`믑`") returned 14 [0072.840] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="push_title.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0072.840] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="push_title.png", cchWideChar=14, lpMultiByteStr=0x1fe354c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="push_title.png", lpUsedDefaultChar=0x0) returned 14 [0072.840] WriteFile (in: hFile=0x158, lpBuffer=0x3b3f6f8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3b3f6f8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0072.840] CharToOemA (in: pSrc="push_title.png", pDst=0x1fe374c | out: pDst="push_title.png") returned 1 [0072.840] WriteFile (in: hFile=0x158, lpBuffer=0x1fe374c*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe374c*, lpNumberOfBytesWritten=0x18efcc*=0xe, lpOverlapped=0x0) returned 1 [0072.840] WriteFile (in: hFile=0x158, lpBuffer=0x379ad88*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379ad88*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0072.840] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0072.840] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0072.841] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xc52 [0072.841] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xc52 [0072.841] WriteFile (in: hFile=0x158, lpBuffer=0x3777058*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777058*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0072.841] WriteFile (in: hFile=0x158, lpBuffer=0x35f035c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f035c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0072.841] DeleteFileW (lpFileName="") returned 0 [0072.841] GetLastError () returned 0x3 [0072.841] GetFileAttributesW (lpFileName="") returned 0xffffffff [0072.841] SetLastError (dwErrCode=0x3) [0072.841] FlushFileBuffers (hFile=0x158) returned 1 [0072.843] GetCurrentThreadId () returned 0x970 [0072.844] GetCurrentThreadId () returned 0x970 [0072.844] GetCurrentThreadId () returned 0x970 [0072.844] GetCurrentThreadId () returned 0x970 [0072.844] GetCurrentThreadId () returned 0x970 [0072.844] GetCurrentThreadId () returned 0x970 [0072.844] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xd09 [0072.844] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xd09 [0072.844] SetFilePointer (in: hFile=0x158, lDistanceToMove=3337, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xd09 [0072.844] CloseHandle (hObject=0x158) returned 1 [0072.844] GetCurrentThreadId () returned 0x970 [0072.844] GetCurrentThreadId () returned 0x970 [0072.844] GetCurrentThreadId () returned 0x970 [0072.844] GetCurrentThreadId () returned 0x970 [0072.844] GetCurrentThreadId () returned 0x970 [0072.844] GetCurrentThreadId () returned 0x970 [0072.844] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\Файл зашифрован [push_title.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\Файл зашифрован [push_title.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0072.844] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd09 [0072.844] SetFilePointer (in: hFile=0x158, lDistanceToMove=3209, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc89 [0072.844] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0072.844] GetFileType (hFile=0x158) returned 0x1 [0072.844] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x14, wMilliseconds=0x72)) [0072.845] GetCurrentThreadId () returned 0x970 [0072.845] GetCurrentThreadId () returned 0x970 [0072.845] GetCurrentThreadId () returned 0x970 [0072.845] GetCurrentThreadId () returned 0x970 [0072.845] GetCurrentThreadId () returned 0x970 [0072.845] GetCurrentThreadId () returned 0x970 [0072.845] GetCurrentThreadId () returned 0x970 [0072.845] GetCurrentThreadId () returned 0x970 [0072.845] GetCurrentThreadId () returned 0x970 [0072.845] GetCurrentThreadId () returned 0x970 [0072.845] GetCurrentThreadId () returned 0x970 [0072.845] GetCurrentThreadId () returned 0x970 [0072.845] GetCurrentThreadId () returned 0x970 [0072.845] GetCurrentThreadId () returned 0x970 [0072.845] GetCurrentThreadId () returned 0x970 [0072.845] GetCurrentThreadId () returned 0x970 [0072.845] GetCurrentThreadId () returned 0x970 [0072.845] GetCurrentThreadId () returned 0x970 [0072.845] GetCurrentThreadId () returned 0x970 [0072.845] GetCurrentThreadId () returned 0x970 [0072.845] GetCurrentThreadId () returned 0x970 [0072.845] GetCurrentThreadId () returned 0x970 [0072.845] GetCurrentThreadId () returned 0x970 [0072.845] GetCurrentThreadId () returned 0x970 [0072.845] GetCurrentThreadId () returned 0x970 [0072.845] GetCurrentThreadId () returned 0x970 [0072.845] GetCurrentThreadId () returned 0x970 [0072.845] GetCurrentThreadId () returned 0x970 [0072.845] GetCurrentThreadId () returned 0x970 [0072.845] GetCurrentThreadId () returned 0x970 [0072.845] GetCurrentThreadId () returned 0x970 [0072.845] GetCurrentThreadId () returned 0x970 [0072.845] GetCurrentThreadId () returned 0x970 [0072.845] GetCurrentThreadId () returned 0x970 [0072.845] GetCurrentThreadId () returned 0x970 [0072.845] GetCurrentThreadId () returned 0x970 [0072.845] GetCurrentThreadId () returned 0x970 [0072.845] GetCurrentThreadId () returned 0x970 [0072.845] GetCurrentThreadId () returned 0x970 [0072.845] GetCurrentThreadId () returned 0x970 [0072.845] GetCurrentThreadId () returned 0x970 [0072.845] GetCurrentThreadId () returned 0x970 [0072.845] GetCurrentThreadId () returned 0x970 [0072.845] GetCurrentThreadId () returned 0x970 [0072.845] GetCurrentThreadId () returned 0x970 [0072.846] GetCurrentThreadId () returned 0x970 [0072.846] GetCurrentThreadId () returned 0x970 [0072.846] GetCurrentThreadId () returned 0x970 [0072.846] GetCurrentThreadId () returned 0x970 [0072.846] GetCurrentThreadId () returned 0x970 [0072.846] GetCurrentThreadId () returned 0x970 [0072.846] GetCurrentThreadId () returned 0x970 [0072.846] GetCurrentThreadId () returned 0x970 [0072.846] GetCurrentThreadId () returned 0x970 [0072.846] GetCurrentThreadId () returned 0x970 [0072.846] GetCurrentThreadId () returned 0x970 [0072.846] GetCurrentThreadId () returned 0x970 [0072.846] GetCurrentThreadId () returned 0x970 [0072.846] GetCurrentThreadId () returned 0x970 [0072.846] GetCurrentThreadId () returned 0x970 [0072.846] GetCurrentThreadId () returned 0x970 [0072.846] GetCurrentThreadId () returned 0x970 [0072.846] GetCurrentThreadId () returned 0x970 [0072.846] GetCurrentThreadId () returned 0x970 [0072.846] GetCurrentThreadId () returned 0x970 [0072.846] GetCurrentThreadId () returned 0x970 [0072.846] GetCurrentThreadId () returned 0x970 [0072.846] GetCurrentThreadId () returned 0x970 [0072.846] GetCurrentThreadId () returned 0x970 [0072.846] GetCurrentThreadId () returned 0x970 [0072.846] GetCurrentThreadId () returned 0x970 [0072.846] GetCurrentThreadId () returned 0x970 [0072.846] GetCurrentThreadId () returned 0x970 [0072.846] GetCurrentThreadId () returned 0x970 [0072.846] GetCurrentThreadId () returned 0x970 [0072.846] GetCurrentThreadId () returned 0x970 [0072.846] GetCurrentThreadId () returned 0x970 [0072.846] GetCurrentThreadId () returned 0x970 [0072.846] GetCurrentThreadId () returned 0x970 [0072.846] GetCurrentThreadId () returned 0x970 [0072.846] GetCurrentThreadId () returned 0x970 [0072.846] GetCurrentThreadId () returned 0x970 [0072.846] GetCurrentThreadId () returned 0x970 [0072.846] GetCurrentThreadId () returned 0x970 [0072.846] GetCurrentThreadId () returned 0x970 [0072.846] GetCurrentThreadId () returned 0x970 [0072.846] GetCurrentThreadId () returned 0x970 [0072.846] GetCurrentThreadId () returned 0x970 [0072.846] GetCurrentThreadId () returned 0x970 [0072.846] GetCurrentThreadId () returned 0x970 [0072.847] GetCurrentThreadId () returned 0x970 [0072.847] GetCurrentThreadId () returned 0x970 [0072.847] GetCurrentThreadId () returned 0x970 [0072.847] GetCurrentThreadId () returned 0x970 [0072.847] GetCurrentThreadId () returned 0x970 [0072.847] GetCurrentThreadId () returned 0x970 [0072.847] GetCurrentThreadId () returned 0x970 [0072.847] GetCurrentThreadId () returned 0x970 [0072.847] GetCurrentThreadId () returned 0x970 [0072.847] GetCurrentThreadId () returned 0x970 [0072.847] GetCurrentThreadId () returned 0x970 [0072.847] GetCurrentThreadId () returned 0x970 [0072.847] GetCurrentThreadId () returned 0x970 [0072.847] GetCurrentThreadId () returned 0x970 [0072.847] GetCurrentThreadId () returned 0x970 [0072.847] GetCurrentThreadId () returned 0x970 [0072.847] GetCurrentThreadId () returned 0x970 [0072.847] GetCurrentThreadId () returned 0x970 [0072.847] GetCurrentThreadId () returned 0x970 [0072.847] GetCurrentThreadId () returned 0x970 [0072.847] GetCurrentThreadId () returned 0x970 [0072.847] GetCurrentThreadId () returned 0x970 [0072.847] GetCurrentThreadId () returned 0x970 [0072.847] GetCurrentThreadId () returned 0x970 [0072.847] GetCurrentThreadId () returned 0x970 [0072.847] GetCurrentThreadId () returned 0x970 [0072.847] GetCurrentThreadId () returned 0x970 [0072.847] GetCurrentThreadId () returned 0x970 [0072.847] GetCurrentThreadId () returned 0x970 [0072.847] GetCurrentThreadId () returned 0x970 [0072.847] GetCurrentThreadId () returned 0x970 [0072.847] GetCurrentThreadId () returned 0x970 [0072.847] GetCurrentThreadId () returned 0x970 [0072.847] GetCurrentThreadId () returned 0x970 [0072.847] GetCurrentThreadId () returned 0x970 [0072.847] GetCurrentThreadId () returned 0x970 [0072.847] GetCurrentThreadId () returned 0x970 [0072.847] GetCurrentThreadId () returned 0x970 [0072.847] GetCurrentThreadId () returned 0x970 [0072.847] GetCurrentThreadId () returned 0x970 [0072.847] GetCurrentThreadId () returned 0x970 [0072.847] GetCurrentThreadId () returned 0x970 [0072.847] GetCurrentThreadId () returned 0x970 [0072.847] GetCurrentThreadId () returned 0x970 [0072.847] GetCurrentThreadId () returned 0x970 [0072.847] GetCurrentThreadId () returned 0x970 [0072.848] GetCurrentThreadId () returned 0x970 [0072.848] GetCurrentThreadId () returned 0x970 [0072.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0072.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0072.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379efb8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0072.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0072.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0072.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379efb8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0072.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0072.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0072.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0072.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0072.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0072.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0072.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0072.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0072.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379f018, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0072.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0072.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0072.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379f018, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0072.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0072.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0072.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379f018, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0072.848] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x14, wMilliseconds=0x72)) [0072.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr=")}hg?E&cydENqrVrsOJD^ZF5e&BA+wYq", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0072.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr=")}hg?E&cydENqrVrsOJD^ZF5e&BA+wYq", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0072.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr=")}hg?E&cydENqrVrsOJD^ZF5e&BA+wYq", cchWideChar=32, lpMultiByteStr=0x2005668, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=")}hg?E&cydENqrVrsOJD^ZF5e&BA+wYq", lpUsedDefaultChar=0x0) returned 32 [0072.848] GetCurrentThreadId () returned 0x970 [0072.848] GetCurrentThreadId () returned 0x970 [0072.848] GetCurrentThreadId () returned 0x970 [0072.848] GetCurrentThreadId () returned 0x970 [0072.849] GetCurrentThreadId () returned 0x970 [0072.849] GetCurrentThreadId () returned 0x970 [0072.863] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0072.863] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0072.863] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x37b64e8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0072.863] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ed248, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0072.863] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ed248, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAAoJXS0hAL8wC8xxJpWh5MPUn7B6gqP4tRKB2hON8coUq1xdyv3wpk/vhVseqn/Uugv5V0kSX6+HWz+oIV+MWwc58jaBqDKjNcGAYVLFAYVALNWZ5I+IZV3zBGHO5kTn59y4QsS3GPdmNYLEU4Nm9aV4exvJsDqpPCaCrE8A9EYVeWwGEheXO68xkTt2sYrC6P9T7Nf5t/TUfqyu6LthroO0/v5KSZghhA==") returned 232 [0072.863] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x14, wMilliseconds=0x81)) [0072.863] GetCurrentThreadId () returned 0x970 [0072.863] GetCurrentThreadId () returned 0x970 [0072.863] GetCurrentThreadId () returned 0x970 [0072.863] GetCurrentThreadId () returned 0x970 [0072.863] GetCurrentThreadId () returned 0x970 [0072.864] GetCurrentThreadId () returned 0x970 [0072.864] GetCurrentThreadId () returned 0x970 [0072.864] GetCurrentThreadId () returned 0x970 [0072.864] GetCurrentThreadId () returned 0x970 [0072.864] GetCurrentThreadId () returned 0x970 [0072.864] GetCurrentThreadId () returned 0x970 [0072.864] GetCurrentThreadId () returned 0x970 [0072.864] GetCurrentThreadId () returned 0x970 [0072.864] GetCurrentThreadId () returned 0x970 [0072.864] GetCurrentThreadId () returned 0x970 [0072.864] GetCurrentThreadId () returned 0x970 [0072.864] GetCurrentThreadId () returned 0x970 [0072.864] GetCurrentThreadId () returned 0x970 [0072.864] GetCurrentThreadId () returned 0x970 [0072.864] GetCurrentThreadId () returned 0x970 [0072.864] GetCurrentThreadId () returned 0x970 [0072.864] GetCurrentThreadId () returned 0x970 [0072.864] GetCurrentThreadId () returned 0x970 [0072.864] GetCurrentThreadId () returned 0x970 [0072.864] GetCurrentThreadId () returned 0x970 [0072.864] GetCurrentThreadId () returned 0x970 [0072.864] GetCurrentThreadId () returned 0x970 [0072.864] GetCurrentThreadId () returned 0x970 [0072.864] GetCurrentThreadId () returned 0x970 [0072.864] GetCurrentThreadId () returned 0x970 [0072.864] GetCurrentThreadId () returned 0x970 [0072.864] GetCurrentThreadId () returned 0x970 [0072.864] GetCurrentThreadId () returned 0x970 [0072.864] GetCurrentThreadId () returned 0x970 [0072.864] GetCurrentThreadId () returned 0x970 [0072.864] GetCurrentThreadId () returned 0x970 [0072.864] GetCurrentThreadId () returned 0x970 [0072.864] GetCurrentThreadId () returned 0x970 [0072.864] GetCurrentThreadId () returned 0x970 [0072.864] GetCurrentThreadId () returned 0x970 [0072.864] GetCurrentThreadId () returned 0x970 [0072.864] GetCurrentThreadId () returned 0x970 [0072.864] GetCurrentThreadId () returned 0x970 [0072.864] GetCurrentThreadId () returned 0x970 [0072.864] GetCurrentThreadId () returned 0x970 [0072.864] GetCurrentThreadId () returned 0x970 [0072.864] GetCurrentThreadId () returned 0x970 [0072.864] GetCurrentThreadId () returned 0x970 [0072.864] GetCurrentThreadId () returned 0x970 [0072.864] GetCurrentThreadId () returned 0x970 [0072.865] GetCurrentThreadId () returned 0x970 [0072.865] GetCurrentThreadId () returned 0x970 [0072.865] GetCurrentThreadId () returned 0x970 [0072.865] GetCurrentThreadId () returned 0x970 [0072.865] GetCurrentThreadId () returned 0x970 [0072.865] GetCurrentThreadId () returned 0x970 [0072.865] GetCurrentThreadId () returned 0x970 [0072.865] GetCurrentThreadId () returned 0x970 [0072.865] GetCurrentThreadId () returned 0x970 [0072.865] GetCurrentThreadId () returned 0x970 [0072.865] GetCurrentThreadId () returned 0x970 [0072.865] GetCurrentThreadId () returned 0x970 [0072.865] GetCurrentThreadId () returned 0x970 [0072.865] GetCurrentThreadId () returned 0x970 [0072.865] GetCurrentThreadId () returned 0x970 [0072.865] GetCurrentThreadId () returned 0x970 [0072.865] GetCurrentThreadId () returned 0x970 [0072.865] GetCurrentThreadId () returned 0x970 [0072.865] GetCurrentThreadId () returned 0x970 [0072.865] GetCurrentThreadId () returned 0x970 [0072.865] GetCurrentThreadId () returned 0x970 [0072.865] GetCurrentThreadId () returned 0x970 [0072.865] GetCurrentThreadId () returned 0x970 [0072.865] GetCurrentThreadId () returned 0x970 [0072.865] GetCurrentThreadId () returned 0x970 [0072.865] GetCurrentThreadId () returned 0x970 [0072.865] GetCurrentThreadId () returned 0x970 [0072.865] GetCurrentThreadId () returned 0x970 [0072.865] GetCurrentThreadId () returned 0x970 [0072.865] GetCurrentThreadId () returned 0x970 [0072.865] GetCurrentThreadId () returned 0x970 [0072.865] GetCurrentThreadId () returned 0x970 [0072.865] GetCurrentThreadId () returned 0x970 [0072.865] GetCurrentThreadId () returned 0x970 [0072.865] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAAoJXS0hAL8wC8xxJpWh5MPUn7B6gqP4tRKB2hON8coUq1xdyv3wpk/vhVseqn/Uugv5V0kSX6+HWz+oIV+MWwc58jaBqDKjNcGAYVLFAYVALNWZ5I+IZV3zBGHO5kTn59y4QsS3GPdmNYLEU4Nm9aV4exvJsDqpPCaCrE8A9EYVeWwGEheXO68xkTt2sYrC6P9T7Nf5t/TUfqyu6LthroO0/v5KSZghhA==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0072.865] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAAoJXS0hAL8wC8xxJpWh5MPUn7B6gqP4tRKB2hON8coUq1xdyv3wpk/vhVseqn/Uugv5V0kSX6+HWz+oIV+MWwc58jaBqDKjNcGAYVLFAYVALNWZ5I+IZV3zBGHO5kTn59y4QsS3GPdmNYLEU4Nm9aV4exvJsDqpPCaCrE8A9EYVeWwGEheXO68xkTt2sYrC6P9T7Nf5t/TUfqyu6LthroO0/v5KSZghhA==", cchWideChar=245, lpMultiByteStr=0x353a87c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAAoJXS0hAL8wC8xxJpWh5MPUn7B6gqP4tRKB2hON8coUq1xdyv3wpk/vhVseqn/Uugv5V0kSX6+HWz+oIV+MWwc58jaBqDKjNcGAYVLFAYVALNWZ5I+IZV3zBGHO5kTn59y4QsS3GPdmNYLEU4Nm9aV4exvJsDqpPCaCrE8A9EYVeWwGEheXO68xkTt2sYrC6P9T7Nf5t/TUfqyu6LthroO0/v5KSZghhA==", lpUsedDefaultChar=0x0) returned 245 [0072.865] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0072.866] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0072.866] CloseHandle (hObject=0x158) returned 1 [0072.866] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_title.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_title.png")) returned 0 [0072.866] GetLastError () returned 0x5 [0072.866] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_title.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_title.png")) returned 0x20 [0072.866] SetLastError (dwErrCode=0x5) [0072.866] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=19312959297) returned 1 [0072.866] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\Файл зашифрован [1047x576black.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\Файл зашифрован [1047x576black.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0072.867] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0072.867] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0072.867] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0072.868] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0072.868] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0072.868] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0072.868] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0072.868] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0072.868] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0072.868] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0072.868] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0072.868] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0072.868] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0072.868] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0072.868] SetEndOfFile (hFile=0x158) returned 1 [0072.868] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0072.868] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0072.868] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0072.868] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0072.869] WriteFile (in: hFile=0x158, lpBuffer=0x3777058*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777058*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0072.869] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0072.870] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="\"j+#CaiO>4lfzc-LApZWL}Ef}(0kv-)<", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0072.870] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="\"j+#CaiO>4lfzc-LApZWL}Ef}(0kv-)<", cchWideChar=32, lpMultiByteStr=0x203855c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\"j+#CaiO>4lfzc-LApZWL}Ef}(0kv-)<", lpUsedDefaultChar=0x0) returned 32 [0072.870] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0072.870] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0072.870] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576black.png", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f955d49, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f955d49, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 0x295098 [0072.870] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0072.870] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0072.870] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576black.png")) returned 0x20 [0072.870] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576black.png")) returned 0x20 [0072.870] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576black.png")) returned 0x20 [0072.870] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576black.png")) returned 0x20 [0072.870] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576black.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f955d49, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f955d49, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da)) returned 1 [0072.870] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0072.870] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0072.870] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576black.png")) returned 0x20 [0072.870] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576black.png")) returned 0x20 [0072.871] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0072.871] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0072.871] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0072.871] SetEndOfFile (hFile=0x158) returned 1 [0072.872] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0072.872] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x1ff89ec, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x0) returned 17 [0072.872] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0072.872] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x1ff89c4, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x0) returned 17 [0072.872] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff89c4, cbMultiByte=17, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="1047x576black.pnge.pngture.pngre.pngpngg") returned 17 [0072.872] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0072.872] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x1ff89ec, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x0) returned 17 [0072.872] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576black.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0072.872] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0072.872] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x11da [0072.872] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0072.872] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0072.873] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0072.873] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0072.873] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x1ff89ec, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x0) returned 17 [0072.873] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0072.873] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x1ff89c4, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x0) returned 17 [0072.873] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff89c4, cbMultiByte=17, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="1047x576black.pngck.pnge.pngture.pngre.pngpngg") returned 17 [0072.873] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0072.873] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x1ff89ec, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x0) returned 17 [0072.873] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0072.874] CharToOemA (in: pSrc="1047x576black.png", pDst=0x1ff89c4 | out: pDst="1047x576black.png") returned 1 [0072.874] WriteFile (in: hFile=0x158, lpBuffer=0x1ff89c4*, nNumberOfBytesToWrite=0x11, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1ff89c4*, lpNumberOfBytesWritten=0x18e048*=0x11, lpOverlapped=0x0) returned 1 [0072.874] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0072.874] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0072.874] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0072.874] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=19313766040) returned 1 [0072.874] ReadFile (in: hFile=0x11c, lpBuffer=0x3b5bc20, nNumberOfBytesToRead=0x11da, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b5bc20*, lpNumberOfBytesRead=0x18dd7c*=0x11da, lpOverlapped=0x0) returned 1 [0072.879] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0072.879] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=19314238468) returned 1 [0072.888] WriteFile (in: hFile=0x158, lpBuffer=0x379ad50*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379ad50*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0072.888] ReadFile (in: hFile=0x11c, lpBuffer=0x3b5bc20, nNumberOfBytesToRead=0x11da, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3b5bc20*, lpNumberOfBytesRead=0x18de38*=0x11da, lpOverlapped=0x0) returned 1 [0072.888] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x4c [0072.888] WriteFile (in: hFile=0x158, lpBuffer=0x3b9e640*, nNumberOfBytesToWrite=0x11da, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3b9e640*, lpNumberOfBytesWritten=0x18de10*=0x11da, lpOverlapped=0x0) returned 1 [0072.888] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x1226 [0072.889] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0072.889] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0072.889] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0072.889] SetFilePointer (in: hFile=0x158, lDistanceToMove=17, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2f [0072.889] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x1230 [0072.889] CloseHandle (hObject=0x11c) returned 1 [0072.889] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1230 [0072.889] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1230 [0072.889] SetFilePointer (in: hFile=0x158, lDistanceToMove=4656, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1230 [0072.889] SetFilePointer (in: hFile=0x158, lDistanceToMove=4656, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x1230 [0072.889] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1230 [0072.889] SetFilePointer (in: hFile=0x158, lDistanceToMove=4656, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x1230 [0072.889] SetEndOfFile (hFile=0x158) returned 1 [0072.889] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1230 [0072.890] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1230 [0072.890] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0072.890] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x1ff89c4, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x0) returned 17 [0072.890] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0072.890] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x1ff89ec, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x0) returned 17 [0072.890] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff89ec, cbMultiByte=17, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="1047x576black.png\x18믉`믑`") returned 17 [0072.890] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0072.890] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x1ff89c4, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x0) returned 17 [0072.890] WriteFile (in: hFile=0x158, lpBuffer=0x3b3f6f8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3b3f6f8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0072.890] CharToOemA (in: pSrc="1047x576black.png", pDst=0x1ff89ec | out: pDst="1047x576black.png") returned 1 [0072.890] WriteFile (in: hFile=0x158, lpBuffer=0x1ff89ec*, nNumberOfBytesToWrite=0x11, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1ff89ec*, lpNumberOfBytesWritten=0x18efcc*=0x11, lpOverlapped=0x0) returned 1 [0072.890] WriteFile (in: hFile=0x158, lpBuffer=0x379ade8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379ade8*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0072.890] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0072.891] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0072.891] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x127a [0072.891] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x127a [0072.891] WriteFile (in: hFile=0x158, lpBuffer=0x3777058*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777058*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0072.891] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0072.891] DeleteFileW (lpFileName="") returned 0 [0072.891] GetLastError () returned 0x3 [0072.891] GetFileAttributesW (lpFileName="") returned 0xffffffff [0072.891] SetLastError (dwErrCode=0x3) [0072.891] FlushFileBuffers (hFile=0x158) returned 1 [0072.902] GetCurrentThreadId () returned 0x970 [0072.902] GetCurrentThreadId () returned 0x970 [0072.902] GetCurrentThreadId () returned 0x970 [0072.902] GetCurrentThreadId () returned 0x970 [0072.902] GetCurrentThreadId () returned 0x970 [0072.902] GetCurrentThreadId () returned 0x970 [0072.902] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x1331 [0072.902] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x1331 [0072.902] SetFilePointer (in: hFile=0x158, lDistanceToMove=4913, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x1331 [0072.902] CloseHandle (hObject=0x158) returned 1 [0072.902] GetCurrentThreadId () returned 0x970 [0072.902] GetCurrentThreadId () returned 0x970 [0072.902] GetCurrentThreadId () returned 0x970 [0072.902] GetCurrentThreadId () returned 0x970 [0072.902] GetCurrentThreadId () returned 0x970 [0072.902] GetCurrentThreadId () returned 0x970 [0072.902] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\Файл зашифрован [1047x576black.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\Файл зашифрован [1047x576black.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0072.902] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1331 [0072.903] SetFilePointer (in: hFile=0x158, lDistanceToMove=4785, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x12b1 [0072.903] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0072.903] GetFileType (hFile=0x158) returned 0x1 [0072.903] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x14, wMilliseconds=0xb0)) [0072.903] GetCurrentThreadId () returned 0x970 [0072.903] GetCurrentThreadId () returned 0x970 [0072.903] GetCurrentThreadId () returned 0x970 [0072.903] GetCurrentThreadId () returned 0x970 [0072.903] GetCurrentThreadId () returned 0x970 [0072.903] GetCurrentThreadId () returned 0x970 [0072.903] GetCurrentThreadId () returned 0x970 [0072.903] GetCurrentThreadId () returned 0x970 [0072.903] GetCurrentThreadId () returned 0x970 [0072.903] GetCurrentThreadId () returned 0x970 [0072.903] GetCurrentThreadId () returned 0x970 [0072.903] GetCurrentThreadId () returned 0x970 [0072.903] GetCurrentThreadId () returned 0x970 [0072.903] GetCurrentThreadId () returned 0x970 [0072.903] GetCurrentThreadId () returned 0x970 [0072.903] GetCurrentThreadId () returned 0x970 [0072.903] GetCurrentThreadId () returned 0x970 [0072.903] GetCurrentThreadId () returned 0x970 [0072.903] GetCurrentThreadId () returned 0x970 [0072.903] GetCurrentThreadId () returned 0x970 [0072.903] GetCurrentThreadId () returned 0x970 [0072.903] GetCurrentThreadId () returned 0x970 [0072.903] GetCurrentThreadId () returned 0x970 [0072.903] GetCurrentThreadId () returned 0x970 [0072.903] GetCurrentThreadId () returned 0x970 [0072.903] GetCurrentThreadId () returned 0x970 [0072.903] GetCurrentThreadId () returned 0x970 [0072.903] GetCurrentThreadId () returned 0x970 [0072.903] GetCurrentThreadId () returned 0x970 [0072.903] GetCurrentThreadId () returned 0x970 [0072.903] GetCurrentThreadId () returned 0x970 [0072.903] GetCurrentThreadId () returned 0x970 [0072.903] GetCurrentThreadId () returned 0x970 [0072.903] GetCurrentThreadId () returned 0x970 [0072.903] GetCurrentThreadId () returned 0x970 [0072.904] GetCurrentThreadId () returned 0x970 [0072.904] GetCurrentThreadId () returned 0x970 [0072.904] GetCurrentThreadId () returned 0x970 [0072.904] GetCurrentThreadId () returned 0x970 [0072.904] GetCurrentThreadId () returned 0x970 [0072.904] GetCurrentThreadId () returned 0x970 [0072.904] GetCurrentThreadId () returned 0x970 [0072.904] GetCurrentThreadId () returned 0x970 [0072.904] GetCurrentThreadId () returned 0x970 [0072.904] GetCurrentThreadId () returned 0x970 [0072.904] GetCurrentThreadId () returned 0x970 [0072.904] GetCurrentThreadId () returned 0x970 [0072.904] GetCurrentThreadId () returned 0x970 [0072.904] GetCurrentThreadId () returned 0x970 [0072.904] GetCurrentThreadId () returned 0x970 [0072.904] GetCurrentThreadId () returned 0x970 [0072.904] GetCurrentThreadId () returned 0x970 [0072.904] GetCurrentThreadId () returned 0x970 [0072.904] GetCurrentThreadId () returned 0x970 [0072.904] GetCurrentThreadId () returned 0x970 [0072.904] GetCurrentThreadId () returned 0x970 [0072.904] GetCurrentThreadId () returned 0x970 [0072.904] GetCurrentThreadId () returned 0x970 [0072.904] GetCurrentThreadId () returned 0x970 [0072.904] GetCurrentThreadId () returned 0x970 [0072.904] GetCurrentThreadId () returned 0x970 [0072.904] GetCurrentThreadId () returned 0x970 [0072.904] GetCurrentThreadId () returned 0x970 [0072.904] GetCurrentThreadId () returned 0x970 [0072.904] GetCurrentThreadId () returned 0x970 [0072.904] GetCurrentThreadId () returned 0x970 [0072.904] GetCurrentThreadId () returned 0x970 [0072.904] GetCurrentThreadId () returned 0x970 [0072.904] GetCurrentThreadId () returned 0x970 [0072.904] GetCurrentThreadId () returned 0x970 [0072.904] GetCurrentThreadId () returned 0x970 [0072.904] GetCurrentThreadId () returned 0x970 [0072.904] GetCurrentThreadId () returned 0x970 [0072.904] GetCurrentThreadId () returned 0x970 [0072.904] GetCurrentThreadId () returned 0x970 [0072.904] GetCurrentThreadId () returned 0x970 [0072.904] GetCurrentThreadId () returned 0x970 [0072.904] GetCurrentThreadId () returned 0x970 [0072.904] GetCurrentThreadId () returned 0x970 [0072.904] GetCurrentThreadId () returned 0x970 [0072.904] GetCurrentThreadId () returned 0x970 [0072.905] GetCurrentThreadId () returned 0x970 [0072.905] GetCurrentThreadId () returned 0x970 [0072.905] GetCurrentThreadId () returned 0x970 [0072.905] GetCurrentThreadId () returned 0x970 [0072.905] GetCurrentThreadId () returned 0x970 [0072.905] GetCurrentThreadId () returned 0x970 [0072.905] GetCurrentThreadId () returned 0x970 [0072.905] GetCurrentThreadId () returned 0x970 [0072.905] GetCurrentThreadId () returned 0x970 [0072.905] GetCurrentThreadId () returned 0x970 [0072.905] GetCurrentThreadId () returned 0x970 [0072.905] GetCurrentThreadId () returned 0x970 [0072.905] GetCurrentThreadId () returned 0x970 [0072.905] GetCurrentThreadId () returned 0x970 [0072.905] GetCurrentThreadId () returned 0x970 [0072.905] GetCurrentThreadId () returned 0x970 [0072.905] GetCurrentThreadId () returned 0x970 [0072.905] GetCurrentThreadId () returned 0x970 [0072.905] GetCurrentThreadId () returned 0x970 [0072.905] GetCurrentThreadId () returned 0x970 [0072.905] GetCurrentThreadId () returned 0x970 [0072.905] GetCurrentThreadId () returned 0x970 [0072.905] GetCurrentThreadId () returned 0x970 [0072.905] GetCurrentThreadId () returned 0x970 [0072.905] GetCurrentThreadId () returned 0x970 [0072.905] GetCurrentThreadId () returned 0x970 [0072.905] GetCurrentThreadId () returned 0x970 [0072.905] GetCurrentThreadId () returned 0x970 [0072.905] GetCurrentThreadId () returned 0x970 [0072.905] GetCurrentThreadId () returned 0x970 [0072.905] GetCurrentThreadId () returned 0x970 [0072.905] GetCurrentThreadId () returned 0x970 [0072.905] GetCurrentThreadId () returned 0x970 [0072.905] GetCurrentThreadId () returned 0x970 [0072.905] GetCurrentThreadId () returned 0x970 [0072.905] GetCurrentThreadId () returned 0x970 [0072.905] GetCurrentThreadId () returned 0x970 [0072.905] GetCurrentThreadId () returned 0x970 [0072.905] GetCurrentThreadId () returned 0x970 [0072.905] GetCurrentThreadId () returned 0x970 [0072.905] GetCurrentThreadId () returned 0x970 [0072.905] GetCurrentThreadId () returned 0x970 [0072.905] GetCurrentThreadId () returned 0x970 [0072.905] GetCurrentThreadId () returned 0x970 [0072.906] GetCurrentThreadId () returned 0x970 [0072.906] GetCurrentThreadId () returned 0x970 [0072.906] GetCurrentThreadId () returned 0x970 [0072.906] GetCurrentThreadId () returned 0x970 [0072.906] GetCurrentThreadId () returned 0x970 [0072.906] GetCurrentThreadId () returned 0x970 [0072.906] GetCurrentThreadId () returned 0x970 [0072.906] GetCurrentThreadId () returned 0x970 [0072.906] GetCurrentThreadId () returned 0x970 [0072.906] GetCurrentThreadId () returned 0x970 [0072.906] GetCurrentThreadId () returned 0x970 [0072.906] GetCurrentThreadId () returned 0x970 [0072.906] GetCurrentThreadId () returned 0x970 [0072.906] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0072.906] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0072.906] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379f018, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0072.906] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0072.906] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0072.906] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379f018, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0072.906] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0072.906] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0072.906] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0072.906] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0072.906] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0072.906] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0072.906] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0072.906] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0072.906] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379f078, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0072.906] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0072.906] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0072.906] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379f078, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0072.906] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0072.906] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0072.906] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379f078, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0072.906] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x14, wMilliseconds=0xb0)) [0072.906] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="\"j+#CaiO>4lfzc-LApZWL}Ef}(0kv-)<", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0072.907] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="\"j+#CaiO>4lfzc-LApZWL}Ef}(0kv-)<", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0072.907] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="\"j+#CaiO>4lfzc-LApZWL}Ef}(0kv-)<", cchWideChar=32, lpMultiByteStr=0x2004948, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\"j+#CaiO>4lfzc-LApZWL}Ef}(0kv-)<", lpUsedDefaultChar=0x0) returned 32 [0072.907] GetCurrentThreadId () returned 0x970 [0072.907] GetCurrentThreadId () returned 0x970 [0072.907] GetCurrentThreadId () returned 0x970 [0072.907] GetCurrentThreadId () returned 0x970 [0072.907] GetCurrentThreadId () returned 0x970 [0072.907] GetCurrentThreadId () returned 0x970 [0072.914] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0072.914] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0072.914] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x37b65d8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0072.914] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ed248, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0072.914] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ed248, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAFwdEX1rCsPQuNinaxMIZG5gR7B4bPjIAxQNbvL6b8YF8jh/yxHjSPYhz+5rezeQiZKLpmyX4rnhBwwzzewj7qSDmLWzpYW3VHSGtGapY+t8KToWb2CIUDvbe+QdQ3+N5F/M4fpliz5DNxsBnBC+34nwiUp49WBjSbKg2MLKS1unIepUgnHF1Lexjj+E0KG/dKepiRuj9cok6mQoivrU6aeoFXDEnv7hLg==") returned 232 [0072.914] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x14, wMilliseconds=0xc0)) [0072.914] GetCurrentThreadId () returned 0x970 [0072.914] GetCurrentThreadId () returned 0x970 [0072.914] GetCurrentThreadId () returned 0x970 [0072.915] GetCurrentThreadId () returned 0x970 [0072.915] GetCurrentThreadId () returned 0x970 [0072.915] GetCurrentThreadId () returned 0x970 [0072.915] GetCurrentThreadId () returned 0x970 [0072.915] GetCurrentThreadId () returned 0x970 [0072.915] GetCurrentThreadId () returned 0x970 [0072.915] GetCurrentThreadId () returned 0x970 [0072.915] GetCurrentThreadId () returned 0x970 [0072.915] GetCurrentThreadId () returned 0x970 [0072.915] GetCurrentThreadId () returned 0x970 [0072.915] GetCurrentThreadId () returned 0x970 [0072.915] GetCurrentThreadId () returned 0x970 [0072.915] GetCurrentThreadId () returned 0x970 [0072.915] GetCurrentThreadId () returned 0x970 [0072.915] GetCurrentThreadId () returned 0x970 [0072.915] GetCurrentThreadId () returned 0x970 [0072.915] GetCurrentThreadId () returned 0x970 [0072.915] GetCurrentThreadId () returned 0x970 [0072.915] GetCurrentThreadId () returned 0x970 [0072.915] GetCurrentThreadId () returned 0x970 [0072.915] GetCurrentThreadId () returned 0x970 [0072.915] GetCurrentThreadId () returned 0x970 [0072.915] GetCurrentThreadId () returned 0x970 [0072.915] GetCurrentThreadId () returned 0x970 [0072.915] GetCurrentThreadId () returned 0x970 [0072.915] GetCurrentThreadId () returned 0x970 [0072.915] GetCurrentThreadId () returned 0x970 [0072.915] GetCurrentThreadId () returned 0x970 [0072.915] GetCurrentThreadId () returned 0x970 [0072.915] GetCurrentThreadId () returned 0x970 [0072.915] GetCurrentThreadId () returned 0x970 [0072.915] GetCurrentThreadId () returned 0x970 [0072.915] GetCurrentThreadId () returned 0x970 [0072.915] GetCurrentThreadId () returned 0x970 [0072.915] GetCurrentThreadId () returned 0x970 [0072.915] GetCurrentThreadId () returned 0x970 [0072.915] GetCurrentThreadId () returned 0x970 [0072.915] GetCurrentThreadId () returned 0x970 [0072.915] GetCurrentThreadId () returned 0x970 [0072.915] GetCurrentThreadId () returned 0x970 [0072.915] GetCurrentThreadId () returned 0x970 [0072.915] GetCurrentThreadId () returned 0x970 [0072.915] GetCurrentThreadId () returned 0x970 [0072.915] GetCurrentThreadId () returned 0x970 [0072.915] GetCurrentThreadId () returned 0x970 [0072.915] GetCurrentThreadId () returned 0x970 [0072.916] GetCurrentThreadId () returned 0x970 [0072.916] GetCurrentThreadId () returned 0x970 [0072.916] GetCurrentThreadId () returned 0x970 [0072.916] GetCurrentThreadId () returned 0x970 [0072.916] GetCurrentThreadId () returned 0x970 [0072.916] GetCurrentThreadId () returned 0x970 [0072.916] GetCurrentThreadId () returned 0x970 [0072.916] GetCurrentThreadId () returned 0x970 [0072.916] GetCurrentThreadId () returned 0x970 [0072.916] GetCurrentThreadId () returned 0x970 [0072.916] GetCurrentThreadId () returned 0x970 [0072.916] GetCurrentThreadId () returned 0x970 [0072.916] GetCurrentThreadId () returned 0x970 [0072.916] GetCurrentThreadId () returned 0x970 [0072.916] GetCurrentThreadId () returned 0x970 [0072.916] GetCurrentThreadId () returned 0x970 [0072.916] GetCurrentThreadId () returned 0x970 [0072.916] GetCurrentThreadId () returned 0x970 [0072.916] GetCurrentThreadId () returned 0x970 [0072.916] GetCurrentThreadId () returned 0x970 [0072.916] GetCurrentThreadId () returned 0x970 [0072.916] GetCurrentThreadId () returned 0x970 [0072.916] GetCurrentThreadId () returned 0x970 [0072.916] GetCurrentThreadId () returned 0x970 [0072.916] GetCurrentThreadId () returned 0x970 [0072.916] GetCurrentThreadId () returned 0x970 [0072.916] GetCurrentThreadId () returned 0x970 [0072.916] GetCurrentThreadId () returned 0x970 [0072.916] GetCurrentThreadId () returned 0x970 [0072.916] GetCurrentThreadId () returned 0x970 [0072.916] GetCurrentThreadId () returned 0x970 [0072.916] GetCurrentThreadId () returned 0x970 [0072.916] GetCurrentThreadId () returned 0x970 [0072.916] GetCurrentThreadId () returned 0x970 [0072.916] GetCurrentThreadId () returned 0x970 [0072.916] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAFwdEX1rCsPQuNinaxMIZG5gR7B4bPjIAxQNbvL6b8YF8jh/yxHjSPYhz+5rezeQiZKLpmyX4rnhBwwzzewj7qSDmLWzpYW3VHSGtGapY+t8KToWb2CIUDvbe+QdQ3+N5F/M4fpliz5DNxsBnBC+34nwiUp49WBjSbKg2MLKS1unIepUgnHF1Lexjj+E0KG/dKepiRuj9cok6mQoivrU6aeoFXDEnv7hLg==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0072.916] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAFwdEX1rCsPQuNinaxMIZG5gR7B4bPjIAxQNbvL6b8YF8jh/yxHjSPYhz+5rezeQiZKLpmyX4rnhBwwzzewj7qSDmLWzpYW3VHSGtGapY+t8KToWb2CIUDvbe+QdQ3+N5F/M4fpliz5DNxsBnBC+34nwiUp49WBjSbKg2MLKS1unIepUgnHF1Lexjj+E0KG/dKepiRuj9cok6mQoivrU6aeoFXDEnv7hLg==", cchWideChar=245, lpMultiByteStr=0x353a87c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAFwdEX1rCsPQuNinaxMIZG5gR7B4bPjIAxQNbvL6b8YF8jh/yxHjSPYhz+5rezeQiZKLpmyX4rnhBwwzzewj7qSDmLWzpYW3VHSGtGapY+t8KToWb2CIUDvbe+QdQ3+N5F/M4fpliz5DNxsBnBC+34nwiUp49WBjSbKg2MLKS1unIepUgnHF1Lexjj+E0KG/dKepiRuj9cok6mQoivrU6aeoFXDEnv7hLg==", lpUsedDefaultChar=0x0) returned 245 [0072.916] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0072.917] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0072.917] CloseHandle (hObject=0x158) returned 1 [0072.917] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576black.png")) returned 0 [0072.917] GetLastError () returned 0x5 [0072.917] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576black.png")) returned 0x20 [0072.917] SetLastError (dwErrCode=0x5) [0072.917] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=19318047703) returned 1 [0072.917] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\Файл зашифрован [1047x576_91n92.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\Файл зашифрован [1047x576_91n92.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0072.918] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0072.918] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0072.918] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0072.918] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0072.918] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0072.918] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0072.918] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0072.918] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0072.918] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0072.918] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0072.918] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0072.918] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0072.918] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0072.918] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0072.918] SetEndOfFile (hFile=0x158) returned 1 [0072.918] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0072.919] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0072.919] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0072.919] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0072.919] WriteFile (in: hFile=0x158, lpBuffer=0x3777058*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777058*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0072.920] WriteFile (in: hFile=0x158, lpBuffer=0x35f035c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f035c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0072.920] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="!}wF91qm3!(o<:)tL,lSNfIqP65kaVM/", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0072.920] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="!}wF91qm3!(o<:)tL,lSNfIqP65kaVM/", cchWideChar=32, lpMultiByteStr=0x20384ec, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="!}wF91qm3!(o<:)tL,lSNfIqP65kaVM/", lpUsedDefaultChar=0x0) returned 32 [0072.920] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0072.920] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0072.920] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576_91n92.png", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f9c8160, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f9c8160, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1928, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576_91n92.png", cAlternateFileName="")) returned 0x295098 [0072.920] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0072.920] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0072.920] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576_91n92.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576_91n92.png")) returned 0x20 [0072.920] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576_91n92.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576_91n92.png")) returned 0x20 [0072.920] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576_91n92.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576_91n92.png")) returned 0x20 [0072.920] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576_91n92.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576_91n92.png")) returned 0x20 [0072.920] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576_91n92.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576_91n92.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f9c8160, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f9c8160, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1928)) returned 1 [0072.921] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0072.921] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0072.921] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576_91n92.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576_91n92.png")) returned 0x20 [0072.921] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576_91n92.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576_91n92.png")) returned 0x20 [0072.921] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0072.921] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0072.921] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0072.921] SetEndOfFile (hFile=0x158) returned 1 [0072.922] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576_91n92.png", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0072.922] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576_91n92.png", cchWideChar=18, lpMultiByteStr=0x1ff899c, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576_91n92.png", lpUsedDefaultChar=0x0) returned 18 [0072.922] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576_91n92.png", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0072.922] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576_91n92.png", cchWideChar=18, lpMultiByteStr=0x1ff88ac, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576_91n92.png", lpUsedDefaultChar=0x0) returned 18 [0072.922] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff88ac, cbMultiByte=18, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="1047x576_91n92.png.pngture.pngre.pngpngg") returned 18 [0072.922] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576_91n92.png", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0072.922] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576_91n92.png", cchWideChar=18, lpMultiByteStr=0x1ff899c, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576_91n92.png", lpUsedDefaultChar=0x0) returned 18 [0072.922] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576_91n92.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576_91n92.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0072.922] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0072.922] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x1928 [0072.922] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0072.922] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0072.923] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0072.923] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576_91n92.png", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0072.923] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576_91n92.png", cchWideChar=18, lpMultiByteStr=0x1ff899c, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576_91n92.png", lpUsedDefaultChar=0x0) returned 18 [0072.923] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576_91n92.png", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0072.923] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576_91n92.png", cchWideChar=18, lpMultiByteStr=0x1ff88ac, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576_91n92.png", lpUsedDefaultChar=0x0) returned 18 [0072.923] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff88ac, cbMultiByte=18, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="1047x576_91n92.png92.png.pngture.pngre.pngpngg") returned 18 [0072.923] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576_91n92.png", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0072.923] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576_91n92.png", cchWideChar=18, lpMultiByteStr=0x1ff899c, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576_91n92.png", lpUsedDefaultChar=0x0) returned 18 [0072.923] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0072.924] CharToOemA (in: pSrc="1047x576_91n92.png", pDst=0x1ff88ac | out: pDst="1047x576_91n92.png") returned 1 [0072.924] WriteFile (in: hFile=0x158, lpBuffer=0x1ff88ac*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1ff88ac*, lpNumberOfBytesWritten=0x18e048*=0x12, lpOverlapped=0x0) returned 1 [0072.924] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0072.924] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0072.924] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0072.924] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=19318765926) returned 1 [0072.924] ReadFile (in: hFile=0x11c, lpBuffer=0x3b5bc20, nNumberOfBytesToRead=0x1928, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b5bc20*, lpNumberOfBytesRead=0x18dd7c*=0x1928, lpOverlapped=0x0) returned 1 [0072.926] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0072.926] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=19318916691) returned 1 [0072.934] WriteFile (in: hFile=0x158, lpBuffer=0x379ac90*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379ac90*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0072.935] ReadFile (in: hFile=0x11c, lpBuffer=0x3b5bc20, nNumberOfBytesToRead=0x1928, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3b5bc20*, lpNumberOfBytesRead=0x18de38*=0x1928, lpOverlapped=0x0) returned 1 [0072.935] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x4d [0072.935] WriteFile (in: hFile=0x158, lpBuffer=0x37bea30*, nNumberOfBytesToWrite=0x1928, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x37bea30*, lpNumberOfBytesWritten=0x18de10*=0x1928, lpOverlapped=0x0) returned 1 [0072.935] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x1975 [0072.935] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0072.935] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0072.935] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0072.936] SetFilePointer (in: hFile=0x158, lDistanceToMove=18, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x30 [0072.936] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x197f [0072.936] CloseHandle (hObject=0x11c) returned 1 [0072.936] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x197f [0072.936] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x197f [0072.936] SetFilePointer (in: hFile=0x158, lDistanceToMove=6527, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x197f [0072.936] SetFilePointer (in: hFile=0x158, lDistanceToMove=6527, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x197f [0072.936] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x197f [0072.936] SetFilePointer (in: hFile=0x158, lDistanceToMove=6527, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x197f [0072.936] SetEndOfFile (hFile=0x158) returned 1 [0072.936] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x197f [0072.936] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x197f [0072.936] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576_91n92.png", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0072.936] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576_91n92.png", cchWideChar=18, lpMultiByteStr=0x1ff88ac, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576_91n92.png", lpUsedDefaultChar=0x0) returned 18 [0072.936] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576_91n92.png", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0072.937] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576_91n92.png", cchWideChar=18, lpMultiByteStr=0x1ff899c, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576_91n92.png", lpUsedDefaultChar=0x0) returned 18 [0072.937] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff899c, cbMultiByte=18, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="1047x576_91n92.png믉`믑`") returned 18 [0072.937] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576_91n92.png", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0072.937] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576_91n92.png", cchWideChar=18, lpMultiByteStr=0x1ff88ac, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576_91n92.png", lpUsedDefaultChar=0x0) returned 18 [0072.937] WriteFile (in: hFile=0x158, lpBuffer=0x3b3f6f8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3b3f6f8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0072.937] CharToOemA (in: pSrc="1047x576_91n92.png", pDst=0x1ff899c | out: pDst="1047x576_91n92.png") returned 1 [0072.937] WriteFile (in: hFile=0x158, lpBuffer=0x1ff899c*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1ff899c*, lpNumberOfBytesWritten=0x18efcc*=0x12, lpOverlapped=0x0) returned 1 [0072.937] WriteFile (in: hFile=0x158, lpBuffer=0x379ae18*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379ae18*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0072.937] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0072.937] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0072.937] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x19ca [0072.937] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x19ca [0072.937] WriteFile (in: hFile=0x158, lpBuffer=0x3777058*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777058*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0072.937] WriteFile (in: hFile=0x158, lpBuffer=0x35f035c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f035c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0072.937] DeleteFileW (lpFileName="") returned 0 [0072.938] GetLastError () returned 0x3 [0072.938] GetFileAttributesW (lpFileName="") returned 0xffffffff [0072.938] SetLastError (dwErrCode=0x3) [0072.938] FlushFileBuffers (hFile=0x158) returned 1 [0072.991] GetCurrentThreadId () returned 0x970 [0072.991] GetCurrentThreadId () returned 0x970 [0072.991] GetCurrentThreadId () returned 0x970 [0072.991] GetCurrentThreadId () returned 0x970 [0072.991] GetCurrentThreadId () returned 0x970 [0072.991] GetCurrentThreadId () returned 0x970 [0072.991] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x1a81 [0072.991] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x1a81 [0072.991] SetFilePointer (in: hFile=0x158, lDistanceToMove=6785, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x1a81 [0072.991] CloseHandle (hObject=0x158) returned 1 [0072.992] GetCurrentThreadId () returned 0x970 [0072.992] GetCurrentThreadId () returned 0x970 [0072.992] GetCurrentThreadId () returned 0x970 [0072.992] GetCurrentThreadId () returned 0x970 [0072.992] GetCurrentThreadId () returned 0x970 [0072.992] GetCurrentThreadId () returned 0x970 [0072.992] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\Файл зашифрован [1047x576_91n92.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\Файл зашифрован [1047x576_91n92.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0072.992] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1a81 [0072.992] SetFilePointer (in: hFile=0x158, lDistanceToMove=6657, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1a01 [0072.992] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0072.992] GetFileType (hFile=0x158) returned 0x1 [0072.992] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x14, wMilliseconds=0x10e)) [0072.992] GetCurrentThreadId () returned 0x970 [0072.992] GetCurrentThreadId () returned 0x970 [0072.992] GetCurrentThreadId () returned 0x970 [0072.992] GetCurrentThreadId () returned 0x970 [0072.992] GetCurrentThreadId () returned 0x970 [0072.992] GetCurrentThreadId () returned 0x970 [0072.992] GetCurrentThreadId () returned 0x970 [0072.992] GetCurrentThreadId () returned 0x970 [0072.992] GetCurrentThreadId () returned 0x970 [0072.992] GetCurrentThreadId () returned 0x970 [0072.992] GetCurrentThreadId () returned 0x970 [0072.992] GetCurrentThreadId () returned 0x970 [0072.992] GetCurrentThreadId () returned 0x970 [0072.992] GetCurrentThreadId () returned 0x970 [0072.992] GetCurrentThreadId () returned 0x970 [0072.992] GetCurrentThreadId () returned 0x970 [0072.992] GetCurrentThreadId () returned 0x970 [0072.992] GetCurrentThreadId () returned 0x970 [0072.992] GetCurrentThreadId () returned 0x970 [0072.993] GetCurrentThreadId () returned 0x970 [0072.993] GetCurrentThreadId () returned 0x970 [0072.993] GetCurrentThreadId () returned 0x970 [0072.993] GetCurrentThreadId () returned 0x970 [0072.993] GetCurrentThreadId () returned 0x970 [0072.993] GetCurrentThreadId () returned 0x970 [0072.993] GetCurrentThreadId () returned 0x970 [0072.993] GetCurrentThreadId () returned 0x970 [0072.993] GetCurrentThreadId () returned 0x970 [0072.993] GetCurrentThreadId () returned 0x970 [0072.993] GetCurrentThreadId () returned 0x970 [0072.993] GetCurrentThreadId () returned 0x970 [0072.993] GetCurrentThreadId () returned 0x970 [0072.993] GetCurrentThreadId () returned 0x970 [0072.993] GetCurrentThreadId () returned 0x970 [0072.993] GetCurrentThreadId () returned 0x970 [0072.993] GetCurrentThreadId () returned 0x970 [0072.993] GetCurrentThreadId () returned 0x970 [0072.993] GetCurrentThreadId () returned 0x970 [0072.993] GetCurrentThreadId () returned 0x970 [0072.993] GetCurrentThreadId () returned 0x970 [0072.993] GetCurrentThreadId () returned 0x970 [0072.993] GetCurrentThreadId () returned 0x970 [0072.993] GetCurrentThreadId () returned 0x970 [0072.993] GetCurrentThreadId () returned 0x970 [0072.993] GetCurrentThreadId () returned 0x970 [0072.993] GetCurrentThreadId () returned 0x970 [0072.993] GetCurrentThreadId () returned 0x970 [0072.993] GetCurrentThreadId () returned 0x970 [0072.993] GetCurrentThreadId () returned 0x970 [0072.993] GetCurrentThreadId () returned 0x970 [0072.993] GetCurrentThreadId () returned 0x970 [0072.993] GetCurrentThreadId () returned 0x970 [0072.993] GetCurrentThreadId () returned 0x970 [0072.993] GetCurrentThreadId () returned 0x970 [0072.993] GetCurrentThreadId () returned 0x970 [0072.993] GetCurrentThreadId () returned 0x970 [0072.993] GetCurrentThreadId () returned 0x970 [0072.993] GetCurrentThreadId () returned 0x970 [0072.993] GetCurrentThreadId () returned 0x970 [0072.993] GetCurrentThreadId () returned 0x970 [0072.993] GetCurrentThreadId () returned 0x970 [0072.993] GetCurrentThreadId () returned 0x970 [0072.993] GetCurrentThreadId () returned 0x970 [0072.993] GetCurrentThreadId () returned 0x970 [0072.994] GetCurrentThreadId () returned 0x970 [0072.994] GetCurrentThreadId () returned 0x970 [0072.994] GetCurrentThreadId () returned 0x970 [0072.994] GetCurrentThreadId () returned 0x970 [0072.994] GetCurrentThreadId () returned 0x970 [0072.994] GetCurrentThreadId () returned 0x970 [0072.994] GetCurrentThreadId () returned 0x970 [0072.994] GetCurrentThreadId () returned 0x970 [0072.994] GetCurrentThreadId () returned 0x970 [0072.994] GetCurrentThreadId () returned 0x970 [0072.994] GetCurrentThreadId () returned 0x970 [0072.994] GetCurrentThreadId () returned 0x970 [0072.994] GetCurrentThreadId () returned 0x970 [0072.994] GetCurrentThreadId () returned 0x970 [0072.994] GetCurrentThreadId () returned 0x970 [0072.994] GetCurrentThreadId () returned 0x970 [0072.994] GetCurrentThreadId () returned 0x970 [0072.994] GetCurrentThreadId () returned 0x970 [0072.994] GetCurrentThreadId () returned 0x970 [0072.994] GetCurrentThreadId () returned 0x970 [0072.994] GetCurrentThreadId () returned 0x970 [0072.994] GetCurrentThreadId () returned 0x970 [0072.994] GetCurrentThreadId () returned 0x970 [0072.994] GetCurrentThreadId () returned 0x970 [0072.994] GetCurrentThreadId () returned 0x970 [0072.994] GetCurrentThreadId () returned 0x970 [0072.994] GetCurrentThreadId () returned 0x970 [0072.994] GetCurrentThreadId () returned 0x970 [0072.994] GetCurrentThreadId () returned 0x970 [0072.994] GetCurrentThreadId () returned 0x970 [0072.994] GetCurrentThreadId () returned 0x970 [0072.994] GetCurrentThreadId () returned 0x970 [0072.994] GetCurrentThreadId () returned 0x970 [0072.994] GetCurrentThreadId () returned 0x970 [0072.994] GetCurrentThreadId () returned 0x970 [0072.994] GetCurrentThreadId () returned 0x970 [0072.994] GetCurrentThreadId () returned 0x970 [0072.994] GetCurrentThreadId () returned 0x970 [0072.994] GetCurrentThreadId () returned 0x970 [0072.994] GetCurrentThreadId () returned 0x970 [0072.994] GetCurrentThreadId () returned 0x970 [0072.994] GetCurrentThreadId () returned 0x970 [0072.994] GetCurrentThreadId () returned 0x970 [0072.994] GetCurrentThreadId () returned 0x970 [0072.994] GetCurrentThreadId () returned 0x970 [0072.995] GetCurrentThreadId () returned 0x970 [0072.995] GetCurrentThreadId () returned 0x970 [0072.995] GetCurrentThreadId () returned 0x970 [0072.995] GetCurrentThreadId () returned 0x970 [0072.995] GetCurrentThreadId () returned 0x970 [0072.995] GetCurrentThreadId () returned 0x970 [0072.995] GetCurrentThreadId () returned 0x970 [0072.995] GetCurrentThreadId () returned 0x970 [0072.995] GetCurrentThreadId () returned 0x970 [0072.995] GetCurrentThreadId () returned 0x970 [0072.995] GetCurrentThreadId () returned 0x970 [0072.995] GetCurrentThreadId () returned 0x970 [0072.995] GetCurrentThreadId () returned 0x970 [0072.995] GetCurrentThreadId () returned 0x970 [0072.995] GetCurrentThreadId () returned 0x970 [0072.995] GetCurrentThreadId () returned 0x970 [0072.995] GetCurrentThreadId () returned 0x970 [0072.995] GetCurrentThreadId () returned 0x970 [0072.995] GetCurrentThreadId () returned 0x970 [0072.995] GetCurrentThreadId () returned 0x970 [0072.995] GetCurrentThreadId () returned 0x970 [0072.995] GetCurrentThreadId () returned 0x970 [0072.995] GetCurrentThreadId () returned 0x970 [0072.995] GetCurrentThreadId () returned 0x970 [0072.995] GetCurrentThreadId () returned 0x970 [0072.995] GetCurrentThreadId () returned 0x970 [0072.995] GetCurrentThreadId () returned 0x970 [0072.995] GetCurrentThreadId () returned 0x970 [0072.995] GetCurrentThreadId () returned 0x970 [0072.995] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0072.995] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0072.995] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379f078, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0072.995] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0072.995] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0072.995] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379f078, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0072.995] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0072.995] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0072.995] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0072.995] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0072.995] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0072.995] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0072.996] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0072.996] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0072.996] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379f0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0072.996] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0072.996] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0072.996] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379f0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0072.996] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0072.996] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0072.996] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379f0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0072.996] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x14, wMilliseconds=0x10e)) [0072.996] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="!}wF91qm3!(o<:)tL,lSNfIqP65kaVM/", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0072.996] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="!}wF91qm3!(o<:)tL,lSNfIqP65kaVM/", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0072.996] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="!}wF91qm3!(o<:)tL,lSNfIqP65kaVM/", cchWideChar=32, lpMultiByteStr=0x2005668, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="!}wF91qm3!(o<:)tL,lSNfIqP65kaVM/", lpUsedDefaultChar=0x0) returned 32 [0072.996] GetCurrentThreadId () returned 0x970 [0072.996] GetCurrentThreadId () returned 0x970 [0072.996] GetCurrentThreadId () returned 0x970 [0072.996] GetCurrentThreadId () returned 0x970 [0072.996] GetCurrentThreadId () returned 0x970 [0072.996] GetCurrentThreadId () returned 0x970 [0073.004] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0073.004] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0073.004] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x37b66c8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0073.004] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ed248, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0073.004] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ed248, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAGHuAzzDumLg+RDlmoF79p8h+y45oO8KTxLX1Ga9JyNneIfs8Agpd6ph6CvFBkJII/2PekNpR6UUO3xA65T11WbCCD15T10BUPyi7SO8CFBrbbi1D+qBsrKT/mMLTXMOIklqJABqHXYdF4TNt2++PKQ6v/fkyRmLt2J55aombjOGCExce01/OyMxL4+dTHicEX56tpicGiOVqp8Es1dTXTxwu+uaOxLqMQ==") returned 232 [0073.004] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x14, wMilliseconds=0x10e)) [0073.004] GetCurrentThreadId () returned 0x970 [0073.004] GetCurrentThreadId () returned 0x970 [0073.004] GetCurrentThreadId () returned 0x970 [0073.004] GetCurrentThreadId () returned 0x970 [0073.004] GetCurrentThreadId () returned 0x970 [0073.004] GetCurrentThreadId () returned 0x970 [0073.004] GetCurrentThreadId () returned 0x970 [0073.004] GetCurrentThreadId () returned 0x970 [0073.004] GetCurrentThreadId () returned 0x970 [0073.004] GetCurrentThreadId () returned 0x970 [0073.004] GetCurrentThreadId () returned 0x970 [0073.004] GetCurrentThreadId () returned 0x970 [0073.004] GetCurrentThreadId () returned 0x970 [0073.004] GetCurrentThreadId () returned 0x970 [0073.004] GetCurrentThreadId () returned 0x970 [0073.004] GetCurrentThreadId () returned 0x970 [0073.004] GetCurrentThreadId () returned 0x970 [0073.004] GetCurrentThreadId () returned 0x970 [0073.004] GetCurrentThreadId () returned 0x970 [0073.004] GetCurrentThreadId () returned 0x970 [0073.004] GetCurrentThreadId () returned 0x970 [0073.004] GetCurrentThreadId () returned 0x970 [0073.004] GetCurrentThreadId () returned 0x970 [0073.004] GetCurrentThreadId () returned 0x970 [0073.004] GetCurrentThreadId () returned 0x970 [0073.004] GetCurrentThreadId () returned 0x970 [0073.004] GetCurrentThreadId () returned 0x970 [0073.004] GetCurrentThreadId () returned 0x970 [0073.004] GetCurrentThreadId () returned 0x970 [0073.004] GetCurrentThreadId () returned 0x970 [0073.004] GetCurrentThreadId () returned 0x970 [0073.004] GetCurrentThreadId () returned 0x970 [0073.004] GetCurrentThreadId () returned 0x970 [0073.004] GetCurrentThreadId () returned 0x970 [0073.004] GetCurrentThreadId () returned 0x970 [0073.005] GetCurrentThreadId () returned 0x970 [0073.005] GetCurrentThreadId () returned 0x970 [0073.005] GetCurrentThreadId () returned 0x970 [0073.005] GetCurrentThreadId () returned 0x970 [0073.005] GetCurrentThreadId () returned 0x970 [0073.005] GetCurrentThreadId () returned 0x970 [0073.005] GetCurrentThreadId () returned 0x970 [0073.005] GetCurrentThreadId () returned 0x970 [0073.005] GetCurrentThreadId () returned 0x970 [0073.005] GetCurrentThreadId () returned 0x970 [0073.005] GetCurrentThreadId () returned 0x970 [0073.005] GetCurrentThreadId () returned 0x970 [0073.005] GetCurrentThreadId () returned 0x970 [0073.005] GetCurrentThreadId () returned 0x970 [0073.005] GetCurrentThreadId () returned 0x970 [0073.005] GetCurrentThreadId () returned 0x970 [0073.005] GetCurrentThreadId () returned 0x970 [0073.005] GetCurrentThreadId () returned 0x970 [0073.005] GetCurrentThreadId () returned 0x970 [0073.005] GetCurrentThreadId () returned 0x970 [0073.005] GetCurrentThreadId () returned 0x970 [0073.005] GetCurrentThreadId () returned 0x970 [0073.005] GetCurrentThreadId () returned 0x970 [0073.005] GetCurrentThreadId () returned 0x970 [0073.005] GetCurrentThreadId () returned 0x970 [0073.005] GetCurrentThreadId () returned 0x970 [0073.005] GetCurrentThreadId () returned 0x970 [0073.005] GetCurrentThreadId () returned 0x970 [0073.005] GetCurrentThreadId () returned 0x970 [0073.005] GetCurrentThreadId () returned 0x970 [0073.005] GetCurrentThreadId () returned 0x970 [0073.005] GetCurrentThreadId () returned 0x970 [0073.005] GetCurrentThreadId () returned 0x970 [0073.005] GetCurrentThreadId () returned 0x970 [0073.005] GetCurrentThreadId () returned 0x970 [0073.005] GetCurrentThreadId () returned 0x970 [0073.005] GetCurrentThreadId () returned 0x970 [0073.005] GetCurrentThreadId () returned 0x970 [0073.005] GetCurrentThreadId () returned 0x970 [0073.005] GetCurrentThreadId () returned 0x970 [0073.005] GetCurrentThreadId () returned 0x970 [0073.005] GetCurrentThreadId () returned 0x970 [0073.005] GetCurrentThreadId () returned 0x970 [0073.005] GetCurrentThreadId () returned 0x970 [0073.005] GetCurrentThreadId () returned 0x970 [0073.006] GetCurrentThreadId () returned 0x970 [0073.006] GetCurrentThreadId () returned 0x970 [0073.006] GetCurrentThreadId () returned 0x970 [0073.006] GetCurrentThreadId () returned 0x970 [0073.006] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAGHuAzzDumLg+RDlmoF79p8h+y45oO8KTxLX1Ga9JyNneIfs8Agpd6ph6CvFBkJII/2PekNpR6UUO3xA65T11WbCCD15T10BUPyi7SO8CFBrbbi1D+qBsrKT/mMLTXMOIklqJABqHXYdF4TNt2++PKQ6v/fkyRmLt2J55aombjOGCExce01/OyMxL4+dTHicEX56tpicGiOVqp8Es1dTXTxwu+uaOxLqMQ==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0073.006] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAGHuAzzDumLg+RDlmoF79p8h+y45oO8KTxLX1Ga9JyNneIfs8Agpd6ph6CvFBkJII/2PekNpR6UUO3xA65T11WbCCD15T10BUPyi7SO8CFBrbbi1D+qBsrKT/mMLTXMOIklqJABqHXYdF4TNt2++PKQ6v/fkyRmLt2J55aombjOGCExce01/OyMxL4+dTHicEX56tpicGiOVqp8Es1dTXTxwu+uaOxLqMQ==", cchWideChar=245, lpMultiByteStr=0x353a87c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAGHuAzzDumLg+RDlmoF79p8h+y45oO8KTxLX1Ga9JyNneIfs8Agpd6ph6CvFBkJII/2PekNpR6UUO3xA65T11WbCCD15T10BUPyi7SO8CFBrbbi1D+qBsrKT/mMLTXMOIklqJABqHXYdF4TNt2++PKQ6v/fkyRmLt2J55aombjOGCExce01/OyMxL4+dTHicEX56tpicGiOVqp8Es1dTXTxwu+uaOxLqMQ==", lpUsedDefaultChar=0x0) returned 245 [0073.006] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0073.009] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0073.009] CloseHandle (hObject=0x158) returned 1 [0073.009] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576_91n92.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576_91n92.png")) returned 0 [0073.009] GetLastError () returned 0x5 [0073.010] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576_91n92.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576_91n92.png")) returned 0x20 [0073.010] SetLastError (dwErrCode=0x5) [0073.010] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=19327305665) returned 1 [0073.010] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\Файл зашифрован [15x15dot.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\Файл зашифрован [15x15dot.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0073.010] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0073.010] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0073.010] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0073.010] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0073.010] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0073.010] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0073.011] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0073.011] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0073.011] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0073.011] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0073.011] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0073.011] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0073.011] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0073.011] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0073.011] SetEndOfFile (hFile=0x158) returned 1 [0073.011] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0073.011] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0073.011] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0073.011] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0073.011] WriteFile (in: hFile=0x158, lpBuffer=0x3777058*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777058*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0073.012] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0073.012] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Gb:z&xpB:1$qpo(*q}rFQ-S^*!1toS+V", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0073.012] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Gb:z&xpB:1$qpo(*q}rFQ-S^*!1toS+V", cchWideChar=32, lpMultiByteStr=0x2038604, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Gb:z&xpB:1$qpo(*q}rFQ-S^*!1toS+V", lpUsedDefaultChar=0x0) returned 32 [0073.012] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0073.012] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0073.012] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f9ee2bd, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f9ee2bd, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eee5249, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0x0, dwReserved1=0x0, cFileName="15x15dot.png", cAlternateFileName="")) returned 0x295098 [0073.013] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0073.013] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0073.013] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\15x15dot.png")) returned 0x20 [0073.013] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\15x15dot.png")) returned 0x20 [0073.013] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\15x15dot.png")) returned 0x20 [0073.013] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\15x15dot.png")) returned 0x20 [0073.013] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\15x15dot.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f9ee2bd, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f9ee2bd, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eee5249, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05)) returned 1 [0073.013] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0073.013] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0073.013] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\15x15dot.png")) returned 0x20 [0073.013] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\15x15dot.png")) returned 0x20 [0073.013] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0073.013] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0073.013] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0073.013] SetEndOfFile (hFile=0x158) returned 1 [0073.014] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0073.014] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x1fe398c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="15x15dot.png", lpUsedDefaultChar=0x0) returned 12 [0073.014] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0073.014] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x1fe3c4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="15x15dot.png", lpUsedDefaultChar=0x0) returned 12 [0073.014] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe3c4c, cbMultiByte=12, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="15x15dot.png92.png.pngture.pngre.pngpngg") returned 12 [0073.014] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0073.015] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x1fe398c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="15x15dot.png", lpUsedDefaultChar=0x0) returned 12 [0073.015] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\15x15dot.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0073.015] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0073.015] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0xb05 [0073.015] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0073.015] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0073.015] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0073.015] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0073.015] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x1fe398c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="15x15dot.png", lpUsedDefaultChar=0x0) returned 12 [0073.015] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0073.015] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x1fe3c4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="15x15dot.png", lpUsedDefaultChar=0x0) returned 12 [0073.015] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe3c4c, cbMultiByte=12, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="15x15dot.pngot.png92.png.pngture.pngre.pngpngg") returned 12 [0073.015] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0073.015] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x1fe398c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="15x15dot.png", lpUsedDefaultChar=0x0) returned 12 [0073.016] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0073.016] CharToOemA (in: pSrc="15x15dot.png", pDst=0x1fe3c4c | out: pDst="15x15dot.png") returned 1 [0073.016] WriteFile (in: hFile=0x158, lpBuffer=0x1fe3c4c*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe3c4c*, lpNumberOfBytesWritten=0x18e048*=0xc, lpOverlapped=0x0) returned 1 [0073.016] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0073.017] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0073.017] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0073.017] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=19328020640) returned 1 [0073.017] ReadFile (in: hFile=0x11c, lpBuffer=0x3b5bc20, nNumberOfBytesToRead=0xb05, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b5bc20*, lpNumberOfBytesRead=0x18dd7c*=0xb05, lpOverlapped=0x0) returned 1 [0073.018] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0073.018] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=19328165133) returned 1 [0073.027] WriteFile (in: hFile=0x158, lpBuffer=0x379acd8*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379acd8*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0073.027] ReadFile (in: hFile=0x11c, lpBuffer=0x3b5bc20, nNumberOfBytesToRead=0xb05, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3b5bc20*, lpNumberOfBytesRead=0x18de38*=0xb05, lpOverlapped=0x0) returned 1 [0073.028] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x47 [0073.028] WriteFile (in: hFile=0x158, lpBuffer=0x3b9df40*, nNumberOfBytesToWrite=0xb05, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3b9df40*, lpNumberOfBytesWritten=0x18de10*=0xb05, lpOverlapped=0x0) returned 1 [0073.028] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0xb4c [0073.028] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0073.028] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0073.028] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0073.028] SetFilePointer (in: hFile=0x158, lDistanceToMove=12, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2a [0073.028] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0xb56 [0073.028] CloseHandle (hObject=0x11c) returned 1 [0073.028] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xb56 [0073.028] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xb56 [0073.029] SetFilePointer (in: hFile=0x158, lDistanceToMove=2902, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xb56 [0073.029] SetFilePointer (in: hFile=0x158, lDistanceToMove=2902, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0xb56 [0073.029] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xb56 [0073.029] SetFilePointer (in: hFile=0x158, lDistanceToMove=2902, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0xb56 [0073.029] SetEndOfFile (hFile=0x158) returned 1 [0073.029] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xb56 [0073.029] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xb56 [0073.029] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0073.029] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x1fe398c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="15x15dot.png", lpUsedDefaultChar=0x0) returned 12 [0073.029] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0073.029] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x1fe3a2c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="15x15dot.png", lpUsedDefaultChar=0x0) returned 12 [0073.029] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe3a2c, cbMultiByte=12, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="15x15dot.pngꞗ@涤(\x18믉`믑`") returned 12 [0073.029] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0073.029] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x1fe398c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="15x15dot.png", lpUsedDefaultChar=0x0) returned 12 [0073.029] WriteFile (in: hFile=0x158, lpBuffer=0x3b3f6f8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3b3f6f8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0073.029] CharToOemA (in: pSrc="15x15dot.png", pDst=0x1fe3a2c | out: pDst="15x15dot.png") returned 1 [0073.029] WriteFile (in: hFile=0x158, lpBuffer=0x1fe3a2c*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe3a2c*, lpNumberOfBytesWritten=0x18efcc*=0xc, lpOverlapped=0x0) returned 1 [0073.030] WriteFile (in: hFile=0x158, lpBuffer=0x379ad88*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379ad88*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0073.030] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0073.030] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0073.030] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xb9b [0073.030] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xb9b [0073.030] WriteFile (in: hFile=0x158, lpBuffer=0x3777058*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777058*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0073.030] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0073.030] DeleteFileW (lpFileName="") returned 0 [0073.030] GetLastError () returned 0x3 [0073.030] GetFileAttributesW (lpFileName="") returned 0xffffffff [0073.030] SetLastError (dwErrCode=0x3) [0073.030] FlushFileBuffers (hFile=0x158) returned 1 [0073.043] GetCurrentThreadId () returned 0x970 [0073.043] GetCurrentThreadId () returned 0x970 [0073.043] GetCurrentThreadId () returned 0x970 [0073.043] GetCurrentThreadId () returned 0x970 [0073.043] GetCurrentThreadId () returned 0x970 [0073.043] GetCurrentThreadId () returned 0x970 [0073.043] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xc52 [0073.043] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xc52 [0073.043] SetFilePointer (in: hFile=0x158, lDistanceToMove=3154, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xc52 [0073.043] CloseHandle (hObject=0x158) returned 1 [0073.043] GetCurrentThreadId () returned 0x970 [0073.043] GetCurrentThreadId () returned 0x970 [0073.043] GetCurrentThreadId () returned 0x970 [0073.043] GetCurrentThreadId () returned 0x970 [0073.043] GetCurrentThreadId () returned 0x970 [0073.043] GetCurrentThreadId () returned 0x970 [0073.043] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\Файл зашифрован [15x15dot.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\Файл зашифрован [15x15dot.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0073.043] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc52 [0073.044] SetFilePointer (in: hFile=0x158, lDistanceToMove=3026, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbd2 [0073.044] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0073.044] GetFileType (hFile=0x158) returned 0x1 [0073.044] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x14, wMilliseconds=0x13c)) [0073.044] GetCurrentThreadId () returned 0x970 [0073.044] GetCurrentThreadId () returned 0x970 [0073.044] GetCurrentThreadId () returned 0x970 [0073.044] GetCurrentThreadId () returned 0x970 [0073.044] GetCurrentThreadId () returned 0x970 [0073.044] GetCurrentThreadId () returned 0x970 [0073.044] GetCurrentThreadId () returned 0x970 [0073.044] GetCurrentThreadId () returned 0x970 [0073.044] GetCurrentThreadId () returned 0x970 [0073.044] GetCurrentThreadId () returned 0x970 [0073.044] GetCurrentThreadId () returned 0x970 [0073.044] GetCurrentThreadId () returned 0x970 [0073.044] GetCurrentThreadId () returned 0x970 [0073.044] GetCurrentThreadId () returned 0x970 [0073.044] GetCurrentThreadId () returned 0x970 [0073.044] GetCurrentThreadId () returned 0x970 [0073.044] GetCurrentThreadId () returned 0x970 [0073.044] GetCurrentThreadId () returned 0x970 [0073.044] GetCurrentThreadId () returned 0x970 [0073.044] GetCurrentThreadId () returned 0x970 [0073.044] GetCurrentThreadId () returned 0x970 [0073.044] GetCurrentThreadId () returned 0x970 [0073.044] GetCurrentThreadId () returned 0x970 [0073.044] GetCurrentThreadId () returned 0x970 [0073.044] GetCurrentThreadId () returned 0x970 [0073.044] GetCurrentThreadId () returned 0x970 [0073.044] GetCurrentThreadId () returned 0x970 [0073.044] GetCurrentThreadId () returned 0x970 [0073.044] GetCurrentThreadId () returned 0x970 [0073.044] GetCurrentThreadId () returned 0x970 [0073.044] GetCurrentThreadId () returned 0x970 [0073.044] GetCurrentThreadId () returned 0x970 [0073.044] GetCurrentThreadId () returned 0x970 [0073.044] GetCurrentThreadId () returned 0x970 [0073.044] GetCurrentThreadId () returned 0x970 [0073.045] GetCurrentThreadId () returned 0x970 [0073.045] GetCurrentThreadId () returned 0x970 [0073.045] GetCurrentThreadId () returned 0x970 [0073.045] GetCurrentThreadId () returned 0x970 [0073.045] GetCurrentThreadId () returned 0x970 [0073.045] GetCurrentThreadId () returned 0x970 [0073.045] GetCurrentThreadId () returned 0x970 [0073.045] GetCurrentThreadId () returned 0x970 [0073.045] GetCurrentThreadId () returned 0x970 [0073.045] GetCurrentThreadId () returned 0x970 [0073.045] GetCurrentThreadId () returned 0x970 [0073.045] GetCurrentThreadId () returned 0x970 [0073.045] GetCurrentThreadId () returned 0x970 [0073.045] GetCurrentThreadId () returned 0x970 [0073.045] GetCurrentThreadId () returned 0x970 [0073.045] GetCurrentThreadId () returned 0x970 [0073.045] GetCurrentThreadId () returned 0x970 [0073.045] GetCurrentThreadId () returned 0x970 [0073.045] GetCurrentThreadId () returned 0x970 [0073.045] GetCurrentThreadId () returned 0x970 [0073.045] GetCurrentThreadId () returned 0x970 [0073.045] GetCurrentThreadId () returned 0x970 [0073.045] GetCurrentThreadId () returned 0x970 [0073.045] GetCurrentThreadId () returned 0x970 [0073.045] GetCurrentThreadId () returned 0x970 [0073.045] GetCurrentThreadId () returned 0x970 [0073.045] GetCurrentThreadId () returned 0x970 [0073.045] GetCurrentThreadId () returned 0x970 [0073.045] GetCurrentThreadId () returned 0x970 [0073.045] GetCurrentThreadId () returned 0x970 [0073.045] GetCurrentThreadId () returned 0x970 [0073.045] GetCurrentThreadId () returned 0x970 [0073.045] GetCurrentThreadId () returned 0x970 [0073.045] GetCurrentThreadId () returned 0x970 [0073.045] GetCurrentThreadId () returned 0x970 [0073.045] GetCurrentThreadId () returned 0x970 [0073.045] GetCurrentThreadId () returned 0x970 [0073.045] GetCurrentThreadId () returned 0x970 [0073.045] GetCurrentThreadId () returned 0x970 [0073.045] GetCurrentThreadId () returned 0x970 [0073.045] GetCurrentThreadId () returned 0x970 [0073.045] GetCurrentThreadId () returned 0x970 [0073.045] GetCurrentThreadId () returned 0x970 [0073.045] GetCurrentThreadId () returned 0x970 [0073.045] GetCurrentThreadId () returned 0x970 [0073.046] GetCurrentThreadId () returned 0x970 [0073.046] GetCurrentThreadId () returned 0x970 [0073.046] GetCurrentThreadId () returned 0x970 [0073.046] GetCurrentThreadId () returned 0x970 [0073.046] GetCurrentThreadId () returned 0x970 [0073.046] GetCurrentThreadId () returned 0x970 [0073.046] GetCurrentThreadId () returned 0x970 [0073.046] GetCurrentThreadId () returned 0x970 [0073.046] GetCurrentThreadId () returned 0x970 [0073.046] GetCurrentThreadId () returned 0x970 [0073.046] GetCurrentThreadId () returned 0x970 [0073.046] GetCurrentThreadId () returned 0x970 [0073.046] GetCurrentThreadId () returned 0x970 [0073.046] GetCurrentThreadId () returned 0x970 [0073.046] GetCurrentThreadId () returned 0x970 [0073.046] GetCurrentThreadId () returned 0x970 [0073.046] GetCurrentThreadId () returned 0x970 [0073.046] GetCurrentThreadId () returned 0x970 [0073.046] GetCurrentThreadId () returned 0x970 [0073.046] GetCurrentThreadId () returned 0x970 [0073.046] GetCurrentThreadId () returned 0x970 [0073.046] GetCurrentThreadId () returned 0x970 [0073.046] GetCurrentThreadId () returned 0x970 [0073.046] GetCurrentThreadId () returned 0x970 [0073.046] GetCurrentThreadId () returned 0x970 [0073.046] GetCurrentThreadId () returned 0x970 [0073.046] GetCurrentThreadId () returned 0x970 [0073.046] GetCurrentThreadId () returned 0x970 [0073.046] GetCurrentThreadId () returned 0x970 [0073.046] GetCurrentThreadId () returned 0x970 [0073.046] GetCurrentThreadId () returned 0x970 [0073.046] GetCurrentThreadId () returned 0x970 [0073.046] GetCurrentThreadId () returned 0x970 [0073.046] GetCurrentThreadId () returned 0x970 [0073.046] GetCurrentThreadId () returned 0x970 [0073.046] GetCurrentThreadId () returned 0x970 [0073.046] GetCurrentThreadId () returned 0x970 [0073.046] GetCurrentThreadId () returned 0x970 [0073.046] GetCurrentThreadId () returned 0x970 [0073.046] GetCurrentThreadId () returned 0x970 [0073.046] GetCurrentThreadId () returned 0x970 [0073.046] GetCurrentThreadId () returned 0x970 [0073.046] GetCurrentThreadId () returned 0x970 [0073.046] GetCurrentThreadId () returned 0x970 [0073.046] GetCurrentThreadId () returned 0x970 [0073.047] GetCurrentThreadId () returned 0x970 [0073.047] GetCurrentThreadId () returned 0x970 [0073.047] GetCurrentThreadId () returned 0x970 [0073.047] GetCurrentThreadId () returned 0x970 [0073.047] GetCurrentThreadId () returned 0x970 [0073.047] GetCurrentThreadId () returned 0x970 [0073.047] GetCurrentThreadId () returned 0x970 [0073.047] GetCurrentThreadId () returned 0x970 [0073.047] GetCurrentThreadId () returned 0x970 [0073.047] GetCurrentThreadId () returned 0x970 [0073.047] GetCurrentThreadId () returned 0x970 [0073.047] GetCurrentThreadId () returned 0x970 [0073.047] GetCurrentThreadId () returned 0x970 [0073.047] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.047] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.047] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379f0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0073.047] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.047] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.047] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379f0d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0073.047] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.047] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.047] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0073.047] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.047] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.047] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0073.047] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.047] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.047] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379f138, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0073.047] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.047] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.047] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379f138, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0073.047] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.047] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.047] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379f138, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0073.047] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x14, wMilliseconds=0x13c)) [0073.047] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gb:z&xpB:1$qpo(*q}rFQ-S^*!1toS+V", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0073.048] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gb:z&xpB:1$qpo(*q}rFQ-S^*!1toS+V", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0073.048] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gb:z&xpB:1$qpo(*q}rFQ-S^*!1toS+V", cchWideChar=32, lpMultiByteStr=0x20056f8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Gb:z&xpB:1$qpo(*q}rFQ-S^*!1toS+V", lpUsedDefaultChar=0x0) returned 32 [0073.048] GetCurrentThreadId () returned 0x970 [0073.048] GetCurrentThreadId () returned 0x970 [0073.048] GetCurrentThreadId () returned 0x970 [0073.048] GetCurrentThreadId () returned 0x970 [0073.048] GetCurrentThreadId () returned 0x970 [0073.048] GetCurrentThreadId () returned 0x970 [0073.056] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0073.056] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0073.056] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x37b67b8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0073.056] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ed248, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0073.056] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ed248, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAGesYZNwcZnKseiWuJvPNAPSSvOL5WxZ1E0FEToMhbvYxRQGom3n071Wm6ejUdGSLDns01r4Csl+kvow/Gsku6enjiaEbCb0Q4AG+hz0xaIq1RmUSqu0JR4Q936w/dnqApPdcxE0PrTo/CsIB5zuQOiBdXwjww/+hwj9XYYYmpR1aj/r4OCpes0UzP2+iAyyFmjfUxIrJoTJABwbcBJ50lOwdL2HRs4++g==") returned 232 [0073.056] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x14, wMilliseconds=0x14c)) [0073.056] GetCurrentThreadId () returned 0x970 [0073.056] GetCurrentThreadId () returned 0x970 [0073.056] GetCurrentThreadId () returned 0x970 [0073.056] GetCurrentThreadId () returned 0x970 [0073.057] GetCurrentThreadId () returned 0x970 [0073.057] GetCurrentThreadId () returned 0x970 [0073.057] GetCurrentThreadId () returned 0x970 [0073.057] GetCurrentThreadId () returned 0x970 [0073.057] GetCurrentThreadId () returned 0x970 [0073.057] GetCurrentThreadId () returned 0x970 [0073.057] GetCurrentThreadId () returned 0x970 [0073.057] GetCurrentThreadId () returned 0x970 [0073.057] GetCurrentThreadId () returned 0x970 [0073.057] GetCurrentThreadId () returned 0x970 [0073.057] GetCurrentThreadId () returned 0x970 [0073.057] GetCurrentThreadId () returned 0x970 [0073.057] GetCurrentThreadId () returned 0x970 [0073.057] GetCurrentThreadId () returned 0x970 [0073.057] GetCurrentThreadId () returned 0x970 [0073.057] GetCurrentThreadId () returned 0x970 [0073.057] GetCurrentThreadId () returned 0x970 [0073.057] GetCurrentThreadId () returned 0x970 [0073.057] GetCurrentThreadId () returned 0x970 [0073.057] GetCurrentThreadId () returned 0x970 [0073.057] GetCurrentThreadId () returned 0x970 [0073.057] GetCurrentThreadId () returned 0x970 [0073.057] GetCurrentThreadId () returned 0x970 [0073.057] GetCurrentThreadId () returned 0x970 [0073.057] GetCurrentThreadId () returned 0x970 [0073.057] GetCurrentThreadId () returned 0x970 [0073.057] GetCurrentThreadId () returned 0x970 [0073.057] GetCurrentThreadId () returned 0x970 [0073.057] GetCurrentThreadId () returned 0x970 [0073.057] GetCurrentThreadId () returned 0x970 [0073.057] GetCurrentThreadId () returned 0x970 [0073.057] GetCurrentThreadId () returned 0x970 [0073.057] GetCurrentThreadId () returned 0x970 [0073.057] GetCurrentThreadId () returned 0x970 [0073.057] GetCurrentThreadId () returned 0x970 [0073.057] GetCurrentThreadId () returned 0x970 [0073.057] GetCurrentThreadId () returned 0x970 [0073.057] GetCurrentThreadId () returned 0x970 [0073.057] GetCurrentThreadId () returned 0x970 [0073.058] GetCurrentThreadId () returned 0x970 [0073.058] GetCurrentThreadId () returned 0x970 [0073.058] GetCurrentThreadId () returned 0x970 [0073.058] GetCurrentThreadId () returned 0x970 [0073.058] GetCurrentThreadId () returned 0x970 [0073.058] GetCurrentThreadId () returned 0x970 [0073.058] GetCurrentThreadId () returned 0x970 [0073.058] GetCurrentThreadId () returned 0x970 [0073.058] GetCurrentThreadId () returned 0x970 [0073.058] GetCurrentThreadId () returned 0x970 [0073.058] GetCurrentThreadId () returned 0x970 [0073.058] GetCurrentThreadId () returned 0x970 [0073.058] GetCurrentThreadId () returned 0x970 [0073.058] GetCurrentThreadId () returned 0x970 [0073.058] GetCurrentThreadId () returned 0x970 [0073.058] GetCurrentThreadId () returned 0x970 [0073.058] GetCurrentThreadId () returned 0x970 [0073.058] GetCurrentThreadId () returned 0x970 [0073.058] GetCurrentThreadId () returned 0x970 [0073.058] GetCurrentThreadId () returned 0x970 [0073.058] GetCurrentThreadId () returned 0x970 [0073.058] GetCurrentThreadId () returned 0x970 [0073.058] GetCurrentThreadId () returned 0x970 [0073.058] GetCurrentThreadId () returned 0x970 [0073.058] GetCurrentThreadId () returned 0x970 [0073.058] GetCurrentThreadId () returned 0x970 [0073.058] GetCurrentThreadId () returned 0x970 [0073.058] GetCurrentThreadId () returned 0x970 [0073.058] GetCurrentThreadId () returned 0x970 [0073.058] GetCurrentThreadId () returned 0x970 [0073.058] GetCurrentThreadId () returned 0x970 [0073.058] GetCurrentThreadId () returned 0x970 [0073.058] GetCurrentThreadId () returned 0x970 [0073.058] GetCurrentThreadId () returned 0x970 [0073.058] GetCurrentThreadId () returned 0x970 [0073.058] GetCurrentThreadId () returned 0x970 [0073.058] GetCurrentThreadId () returned 0x970 [0073.058] GetCurrentThreadId () returned 0x970 [0073.058] GetCurrentThreadId () returned 0x970 [0073.059] GetCurrentThreadId () returned 0x970 [0073.059] GetCurrentThreadId () returned 0x970 [0073.059] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAGesYZNwcZnKseiWuJvPNAPSSvOL5WxZ1E0FEToMhbvYxRQGom3n071Wm6ejUdGSLDns01r4Csl+kvow/Gsku6enjiaEbCb0Q4AG+hz0xaIq1RmUSqu0JR4Q936w/dnqApPdcxE0PrTo/CsIB5zuQOiBdXwjww/+hwj9XYYYmpR1aj/r4OCpes0UzP2+iAyyFmjfUxIrJoTJABwbcBJ50lOwdL2HRs4++g==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0073.059] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAGesYZNwcZnKseiWuJvPNAPSSvOL5WxZ1E0FEToMhbvYxRQGom3n071Wm6ejUdGSLDns01r4Csl+kvow/Gsku6enjiaEbCb0Q4AG+hz0xaIq1RmUSqu0JR4Q936w/dnqApPdcxE0PrTo/CsIB5zuQOiBdXwjww/+hwj9XYYYmpR1aj/r4OCpes0UzP2+iAyyFmjfUxIrJoTJABwbcBJ50lOwdL2HRs4++g==", cchWideChar=245, lpMultiByteStr=0x353a87c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAGesYZNwcZnKseiWuJvPNAPSSvOL5WxZ1E0FEToMhbvYxRQGom3n071Wm6ejUdGSLDns01r4Csl+kvow/Gsku6enjiaEbCb0Q4AG+hz0xaIq1RmUSqu0JR4Q936w/dnqApPdcxE0PrTo/CsIB5zuQOiBdXwjww/+hwj9XYYYmpR1aj/r4OCpes0UzP2+iAyyFmjfUxIrJoTJABwbcBJ50lOwdL2HRs4++g==", lpUsedDefaultChar=0x0) returned 245 [0073.059] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0073.059] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0073.059] CloseHandle (hObject=0x158) returned 1 [0073.059] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\15x15dot.png")) returned 0 [0073.060] GetLastError () returned 0x5 [0073.060] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\15x15dot.png")) returned 0x20 [0073.060] SetLastError (dwErrCode=0x5) [0073.060] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=19332316191) returned 1 [0073.060] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\Файл зашифрован [720x480icongraphic.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\Файл зашифрован [720x480icongraphic.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0073.060] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0073.060] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0073.061] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0073.061] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0073.061] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0073.061] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0073.061] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0073.061] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0073.061] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0073.061] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0073.061] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0073.061] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0073.061] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0073.061] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0073.061] SetEndOfFile (hFile=0x158) returned 1 [0073.061] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0073.062] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0073.062] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0073.062] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0073.062] WriteFile (in: hFile=0x158, lpBuffer=0x3777058*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777058*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0073.063] WriteFile (in: hFile=0x158, lpBuffer=0x35f035c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f035c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0073.063] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="=B6RU(:8dIsD^T@Az#+bP6^G79JvXw4%", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0073.063] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="=B6RU(:8dIsD^T@Az#+bP6^G79JvXw4%", cchWideChar=32, lpMultiByteStr=0x20385cc, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="=B6RU(:8dIsD^T@Az#+bP6^G79JvXw4%", lpUsedDefaultChar=0x0) returned 32 [0073.063] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0073.063] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0073.063] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f9a2003, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f9a2003, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x15f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="720x480icongraphic.png", cAlternateFileName="")) returned 0x295098 [0073.063] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0073.063] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0073.063] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\720x480icongraphic.png")) returned 0x20 [0073.064] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\720x480icongraphic.png")) returned 0x20 [0073.064] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\720x480icongraphic.png")) returned 0x20 [0073.064] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\720x480icongraphic.png")) returned 0x20 [0073.064] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\720x480icongraphic.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f9a2003, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f9a2003, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x15f4)) returned 1 [0073.064] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0073.064] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0073.064] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\720x480icongraphic.png")) returned 0x20 [0073.064] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\720x480icongraphic.png")) returned 0x20 [0073.064] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0073.064] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0073.064] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0073.064] SetEndOfFile (hFile=0x158) returned 1 [0073.065] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="720x480icongraphic.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0073.065] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="720x480icongraphic.png", cchWideChar=22, lpMultiByteStr=0x1ff8974, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="720x480icongraphic.png", lpUsedDefaultChar=0x0) returned 22 [0073.065] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="720x480icongraphic.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0073.065] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="720x480icongraphic.png", cchWideChar=22, lpMultiByteStr=0x1ff89c4, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="720x480icongraphic.png", lpUsedDefaultChar=0x0) returned 22 [0073.065] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff89c4, cbMultiByte=22, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="720x480icongraphic.pngture.pngre.pngpngg") returned 22 [0073.065] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="720x480icongraphic.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0073.065] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="720x480icongraphic.png", cchWideChar=22, lpMultiByteStr=0x1ff8974, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="720x480icongraphic.png", lpUsedDefaultChar=0x0) returned 22 [0073.065] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\720x480icongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0073.066] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0073.066] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x15f4 [0073.066] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0073.066] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0073.066] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0073.066] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="720x480icongraphic.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0073.066] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="720x480icongraphic.png", cchWideChar=22, lpMultiByteStr=0x1ff8974, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="720x480icongraphic.png", lpUsedDefaultChar=0x0) returned 22 [0073.066] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="720x480icongraphic.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0073.066] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="720x480icongraphic.png", cchWideChar=22, lpMultiByteStr=0x1ff89c4, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="720x480icongraphic.png", lpUsedDefaultChar=0x0) returned 22 [0073.066] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff89c4, cbMultiByte=22, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="720x480icongraphic.pngic.pngture.pngre.pngpngg") returned 22 [0073.066] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="720x480icongraphic.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0073.066] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="720x480icongraphic.png", cchWideChar=22, lpMultiByteStr=0x1ff8974, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="720x480icongraphic.png", lpUsedDefaultChar=0x0) returned 22 [0073.066] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0073.067] CharToOemA (in: pSrc="720x480icongraphic.png", pDst=0x1ff89c4 | out: pDst="720x480icongraphic.png") returned 1 [0073.067] WriteFile (in: hFile=0x158, lpBuffer=0x1ff89c4*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1ff89c4*, lpNumberOfBytesWritten=0x18e048*=0x16, lpOverlapped=0x0) returned 1 [0073.067] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0073.067] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0073.067] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0073.068] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=19333099330) returned 1 [0073.068] ReadFile (in: hFile=0x11c, lpBuffer=0x3b5bc20, nNumberOfBytesToRead=0x15f4, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b5bc20*, lpNumberOfBytesRead=0x18dd7c*=0x15f4, lpOverlapped=0x0) returned 1 [0073.069] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0073.069] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=19333250480) returned 1 [0073.078] WriteFile (in: hFile=0x158, lpBuffer=0x379adf8*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379adf8*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0073.078] ReadFile (in: hFile=0x11c, lpBuffer=0x3b5bc20, nNumberOfBytesToRead=0x15f4, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3b5bc20*, lpNumberOfBytesRead=0x18de38*=0x15f4, lpOverlapped=0x0) returned 1 [0073.078] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x51 [0073.078] WriteFile (in: hFile=0x158, lpBuffer=0x37bea30*, nNumberOfBytesToWrite=0x15f4, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x37bea30*, lpNumberOfBytesWritten=0x18de10*=0x15f4, lpOverlapped=0x0) returned 1 [0073.078] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x1645 [0073.079] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0073.079] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0073.079] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0073.079] SetFilePointer (in: hFile=0x158, lDistanceToMove=22, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x34 [0073.079] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x164f [0073.079] CloseHandle (hObject=0x11c) returned 1 [0073.079] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x164f [0073.079] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x164f [0073.079] SetFilePointer (in: hFile=0x158, lDistanceToMove=5711, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x164f [0073.079] SetFilePointer (in: hFile=0x158, lDistanceToMove=5711, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x164f [0073.079] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x164f [0073.079] SetFilePointer (in: hFile=0x158, lDistanceToMove=5711, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x164f [0073.079] SetEndOfFile (hFile=0x158) returned 1 [0073.079] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x164f [0073.080] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x164f [0073.080] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="720x480icongraphic.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0073.080] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="720x480icongraphic.png", cchWideChar=22, lpMultiByteStr=0x1ff89c4, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="720x480icongraphic.png", lpUsedDefaultChar=0x0) returned 22 [0073.080] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="720x480icongraphic.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0073.080] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="720x480icongraphic.png", cchWideChar=22, lpMultiByteStr=0x1ff8974, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="720x480icongraphic.png", lpUsedDefaultChar=0x0) returned 22 [0073.080] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff8974, cbMultiByte=22, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="720x480icongraphic.png") returned 22 [0073.080] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="720x480icongraphic.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0073.080] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="720x480icongraphic.png", cchWideChar=22, lpMultiByteStr=0x1ff89c4, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="720x480icongraphic.png", lpUsedDefaultChar=0x0) returned 22 [0073.080] WriteFile (in: hFile=0x158, lpBuffer=0x3b3f6f8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3b3f6f8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0073.080] CharToOemA (in: pSrc="720x480icongraphic.png", pDst=0x1ff8974 | out: pDst="720x480icongraphic.png") returned 1 [0073.080] WriteFile (in: hFile=0x158, lpBuffer=0x1ff8974*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1ff8974*, lpNumberOfBytesWritten=0x18efcc*=0x16, lpOverlapped=0x0) returned 1 [0073.080] WriteFile (in: hFile=0x158, lpBuffer=0x379ade8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379ade8*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0073.080] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0073.080] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0073.080] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x169e [0073.080] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x169e [0073.081] WriteFile (in: hFile=0x158, lpBuffer=0x3777058*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777058*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0073.081] WriteFile (in: hFile=0x158, lpBuffer=0x35f035c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f035c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0073.081] DeleteFileW (lpFileName="") returned 0 [0073.081] GetLastError () returned 0x3 [0073.081] GetFileAttributesW (lpFileName="") returned 0xffffffff [0073.081] SetLastError (dwErrCode=0x3) [0073.081] FlushFileBuffers (hFile=0x158) returned 1 [0073.085] GetCurrentThreadId () returned 0x970 [0073.085] GetCurrentThreadId () returned 0x970 [0073.085] GetCurrentThreadId () returned 0x970 [0073.085] GetCurrentThreadId () returned 0x970 [0073.085] GetCurrentThreadId () returned 0x970 [0073.085] GetCurrentThreadId () returned 0x970 [0073.085] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x1755 [0073.085] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x1755 [0073.085] SetFilePointer (in: hFile=0x158, lDistanceToMove=5973, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x1755 [0073.085] CloseHandle (hObject=0x158) returned 1 [0073.085] GetCurrentThreadId () returned 0x970 [0073.085] GetCurrentThreadId () returned 0x970 [0073.085] GetCurrentThreadId () returned 0x970 [0073.085] GetCurrentThreadId () returned 0x970 [0073.085] GetCurrentThreadId () returned 0x970 [0073.085] GetCurrentThreadId () returned 0x970 [0073.085] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\Файл зашифрован [720x480icongraphic.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\Файл зашифрован [720x480icongraphic.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0073.085] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1755 [0073.085] SetFilePointer (in: hFile=0x158, lDistanceToMove=5845, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x16d5 [0073.086] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0073.086] GetFileType (hFile=0x158) returned 0x1 [0073.086] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x14, wMilliseconds=0x16b)) [0073.086] GetCurrentThreadId () returned 0x970 [0073.086] GetCurrentThreadId () returned 0x970 [0073.086] GetCurrentThreadId () returned 0x970 [0073.086] GetCurrentThreadId () returned 0x970 [0073.086] GetCurrentThreadId () returned 0x970 [0073.086] GetCurrentThreadId () returned 0x970 [0073.086] GetCurrentThreadId () returned 0x970 [0073.086] GetCurrentThreadId () returned 0x970 [0073.086] GetCurrentThreadId () returned 0x970 [0073.086] GetCurrentThreadId () returned 0x970 [0073.086] GetCurrentThreadId () returned 0x970 [0073.086] GetCurrentThreadId () returned 0x970 [0073.086] GetCurrentThreadId () returned 0x970 [0073.086] GetCurrentThreadId () returned 0x970 [0073.086] GetCurrentThreadId () returned 0x970 [0073.086] GetCurrentThreadId () returned 0x970 [0073.086] GetCurrentThreadId () returned 0x970 [0073.086] GetCurrentThreadId () returned 0x970 [0073.086] GetCurrentThreadId () returned 0x970 [0073.086] GetCurrentThreadId () returned 0x970 [0073.086] GetCurrentThreadId () returned 0x970 [0073.086] GetCurrentThreadId () returned 0x970 [0073.086] GetCurrentThreadId () returned 0x970 [0073.086] GetCurrentThreadId () returned 0x970 [0073.086] GetCurrentThreadId () returned 0x970 [0073.086] GetCurrentThreadId () returned 0x970 [0073.086] GetCurrentThreadId () returned 0x970 [0073.086] GetCurrentThreadId () returned 0x970 [0073.086] GetCurrentThreadId () returned 0x970 [0073.086] GetCurrentThreadId () returned 0x970 [0073.086] GetCurrentThreadId () returned 0x970 [0073.086] GetCurrentThreadId () returned 0x970 [0073.086] GetCurrentThreadId () returned 0x970 [0073.086] GetCurrentThreadId () returned 0x970 [0073.086] GetCurrentThreadId () returned 0x970 [0073.086] GetCurrentThreadId () returned 0x970 [0073.086] GetCurrentThreadId () returned 0x970 [0073.086] GetCurrentThreadId () returned 0x970 [0073.086] GetCurrentThreadId () returned 0x970 [0073.087] GetCurrentThreadId () returned 0x970 [0073.087] GetCurrentThreadId () returned 0x970 [0073.087] GetCurrentThreadId () returned 0x970 [0073.087] GetCurrentThreadId () returned 0x970 [0073.087] GetCurrentThreadId () returned 0x970 [0073.087] GetCurrentThreadId () returned 0x970 [0073.087] GetCurrentThreadId () returned 0x970 [0073.087] GetCurrentThreadId () returned 0x970 [0073.087] GetCurrentThreadId () returned 0x970 [0073.087] GetCurrentThreadId () returned 0x970 [0073.087] GetCurrentThreadId () returned 0x970 [0073.087] GetCurrentThreadId () returned 0x970 [0073.087] GetCurrentThreadId () returned 0x970 [0073.087] GetCurrentThreadId () returned 0x970 [0073.087] GetCurrentThreadId () returned 0x970 [0073.087] GetCurrentThreadId () returned 0x970 [0073.087] GetCurrentThreadId () returned 0x970 [0073.087] GetCurrentThreadId () returned 0x970 [0073.087] GetCurrentThreadId () returned 0x970 [0073.087] GetCurrentThreadId () returned 0x970 [0073.087] GetCurrentThreadId () returned 0x970 [0073.087] GetCurrentThreadId () returned 0x970 [0073.087] GetCurrentThreadId () returned 0x970 [0073.087] GetCurrentThreadId () returned 0x970 [0073.087] GetCurrentThreadId () returned 0x970 [0073.087] GetCurrentThreadId () returned 0x970 [0073.087] GetCurrentThreadId () returned 0x970 [0073.087] GetCurrentThreadId () returned 0x970 [0073.087] GetCurrentThreadId () returned 0x970 [0073.087] GetCurrentThreadId () returned 0x970 [0073.087] GetCurrentThreadId () returned 0x970 [0073.087] GetCurrentThreadId () returned 0x970 [0073.087] GetCurrentThreadId () returned 0x970 [0073.087] GetCurrentThreadId () returned 0x970 [0073.087] GetCurrentThreadId () returned 0x970 [0073.087] GetCurrentThreadId () returned 0x970 [0073.087] GetCurrentThreadId () returned 0x970 [0073.087] GetCurrentThreadId () returned 0x970 [0073.087] GetCurrentThreadId () returned 0x970 [0073.087] GetCurrentThreadId () returned 0x970 [0073.087] GetCurrentThreadId () returned 0x970 [0073.087] GetCurrentThreadId () returned 0x970 [0073.087] GetCurrentThreadId () returned 0x970 [0073.087] GetCurrentThreadId () returned 0x970 [0073.087] GetCurrentThreadId () returned 0x970 [0073.088] GetCurrentThreadId () returned 0x970 [0073.088] GetCurrentThreadId () returned 0x970 [0073.088] GetCurrentThreadId () returned 0x970 [0073.088] GetCurrentThreadId () returned 0x970 [0073.088] GetCurrentThreadId () returned 0x970 [0073.088] GetCurrentThreadId () returned 0x970 [0073.088] GetCurrentThreadId () returned 0x970 [0073.088] GetCurrentThreadId () returned 0x970 [0073.088] GetCurrentThreadId () returned 0x970 [0073.088] GetCurrentThreadId () returned 0x970 [0073.088] GetCurrentThreadId () returned 0x970 [0073.088] GetCurrentThreadId () returned 0x970 [0073.088] GetCurrentThreadId () returned 0x970 [0073.088] GetCurrentThreadId () returned 0x970 [0073.088] GetCurrentThreadId () returned 0x970 [0073.088] GetCurrentThreadId () returned 0x970 [0073.088] GetCurrentThreadId () returned 0x970 [0073.088] GetCurrentThreadId () returned 0x970 [0073.088] GetCurrentThreadId () returned 0x970 [0073.088] GetCurrentThreadId () returned 0x970 [0073.088] GetCurrentThreadId () returned 0x970 [0073.088] GetCurrentThreadId () returned 0x970 [0073.088] GetCurrentThreadId () returned 0x970 [0073.088] GetCurrentThreadId () returned 0x970 [0073.088] GetCurrentThreadId () returned 0x970 [0073.088] GetCurrentThreadId () returned 0x970 [0073.088] GetCurrentThreadId () returned 0x970 [0073.088] GetCurrentThreadId () returned 0x970 [0073.088] GetCurrentThreadId () returned 0x970 [0073.088] GetCurrentThreadId () returned 0x970 [0073.088] GetCurrentThreadId () returned 0x970 [0073.088] GetCurrentThreadId () returned 0x970 [0073.088] GetCurrentThreadId () returned 0x970 [0073.088] GetCurrentThreadId () returned 0x970 [0073.088] GetCurrentThreadId () returned 0x970 [0073.088] GetCurrentThreadId () returned 0x970 [0073.088] GetCurrentThreadId () returned 0x970 [0073.088] GetCurrentThreadId () returned 0x970 [0073.088] GetCurrentThreadId () returned 0x970 [0073.088] GetCurrentThreadId () returned 0x970 [0073.088] GetCurrentThreadId () returned 0x970 [0073.088] GetCurrentThreadId () returned 0x970 [0073.088] GetCurrentThreadId () returned 0x970 [0073.088] GetCurrentThreadId () returned 0x970 [0073.088] GetCurrentThreadId () returned 0x970 [0073.088] GetCurrentThreadId () returned 0x970 [0073.089] GetCurrentThreadId () returned 0x970 [0073.089] GetCurrentThreadId () returned 0x970 [0073.089] GetCurrentThreadId () returned 0x970 [0073.089] GetCurrentThreadId () returned 0x970 [0073.089] GetCurrentThreadId () returned 0x970 [0073.089] GetCurrentThreadId () returned 0x970 [0073.089] GetCurrentThreadId () returned 0x970 [0073.089] GetCurrentThreadId () returned 0x970 [0073.089] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.089] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.089] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379f138, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0073.089] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.089] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.089] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379f138, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0073.089] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.089] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.089] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0073.089] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.089] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.089] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0073.089] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.089] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.089] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379f198, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0073.089] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.089] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.089] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379f198, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0073.089] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.089] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.089] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379f198, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0073.089] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x14, wMilliseconds=0x16b)) [0073.089] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="=B6RU(:8dIsD^T@Az#+bP6^G79JvXw4%", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0073.089] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="=B6RU(:8dIsD^T@Az#+bP6^G79JvXw4%", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0073.089] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="=B6RU(:8dIsD^T@Az#+bP6^G79JvXw4%", cchWideChar=32, lpMultiByteStr=0x2005668, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="=B6RU(:8dIsD^T@Az#+bP6^G79JvXw4%", lpUsedDefaultChar=0x0) returned 32 [0073.090] GetCurrentThreadId () returned 0x970 [0073.090] GetCurrentThreadId () returned 0x970 [0073.090] GetCurrentThreadId () returned 0x970 [0073.090] GetCurrentThreadId () returned 0x970 [0073.090] GetCurrentThreadId () returned 0x970 [0073.090] GetCurrentThreadId () returned 0x970 [0073.097] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0073.097] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0073.097] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x37b68a8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0073.097] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ed248, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0073.097] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ed248, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAD+ngfas1i+Ln4ogGmb3EYpeM6i7ljNKWOmvL1a4yd/rPZHiyUh7H2oar8tY/nk4T7Y8NQsI2jLupNowUXyMuSDWxmTTITfv1ZGHoQDH1WxCFg2r+MMcHDEucDxfmwh1t8AbTe6YzpCBiRgsSx1zhi2AJSvM375RQWR5rWuaWX3M82/hrXDfK5VMtiUaPesPaBhIyLca0S29dmy/OCQU0zz12Y/aOaPJ1Q==") returned 232 [0073.097] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x14, wMilliseconds=0x16b)) [0073.097] GetCurrentThreadId () returned 0x970 [0073.097] GetCurrentThreadId () returned 0x970 [0073.097] GetCurrentThreadId () returned 0x970 [0073.097] GetCurrentThreadId () returned 0x970 [0073.097] GetCurrentThreadId () returned 0x970 [0073.097] GetCurrentThreadId () returned 0x970 [0073.097] GetCurrentThreadId () returned 0x970 [0073.097] GetCurrentThreadId () returned 0x970 [0073.097] GetCurrentThreadId () returned 0x970 [0073.097] GetCurrentThreadId () returned 0x970 [0073.097] GetCurrentThreadId () returned 0x970 [0073.098] GetCurrentThreadId () returned 0x970 [0073.098] GetCurrentThreadId () returned 0x970 [0073.098] GetCurrentThreadId () returned 0x970 [0073.098] GetCurrentThreadId () returned 0x970 [0073.098] GetCurrentThreadId () returned 0x970 [0073.098] GetCurrentThreadId () returned 0x970 [0073.098] GetCurrentThreadId () returned 0x970 [0073.098] GetCurrentThreadId () returned 0x970 [0073.098] GetCurrentThreadId () returned 0x970 [0073.098] GetCurrentThreadId () returned 0x970 [0073.098] GetCurrentThreadId () returned 0x970 [0073.098] GetCurrentThreadId () returned 0x970 [0073.098] GetCurrentThreadId () returned 0x970 [0073.098] GetCurrentThreadId () returned 0x970 [0073.098] GetCurrentThreadId () returned 0x970 [0073.098] GetCurrentThreadId () returned 0x970 [0073.098] GetCurrentThreadId () returned 0x970 [0073.098] GetCurrentThreadId () returned 0x970 [0073.098] GetCurrentThreadId () returned 0x970 [0073.098] GetCurrentThreadId () returned 0x970 [0073.098] GetCurrentThreadId () returned 0x970 [0073.098] GetCurrentThreadId () returned 0x970 [0073.098] GetCurrentThreadId () returned 0x970 [0073.098] GetCurrentThreadId () returned 0x970 [0073.098] GetCurrentThreadId () returned 0x970 [0073.098] GetCurrentThreadId () returned 0x970 [0073.098] GetCurrentThreadId () returned 0x970 [0073.098] GetCurrentThreadId () returned 0x970 [0073.098] GetCurrentThreadId () returned 0x970 [0073.098] GetCurrentThreadId () returned 0x970 [0073.098] GetCurrentThreadId () returned 0x970 [0073.098] GetCurrentThreadId () returned 0x970 [0073.098] GetCurrentThreadId () returned 0x970 [0073.098] GetCurrentThreadId () returned 0x970 [0073.098] GetCurrentThreadId () returned 0x970 [0073.098] GetCurrentThreadId () returned 0x970 [0073.098] GetCurrentThreadId () returned 0x970 [0073.098] GetCurrentThreadId () returned 0x970 [0073.098] GetCurrentThreadId () returned 0x970 [0073.098] GetCurrentThreadId () returned 0x970 [0073.098] GetCurrentThreadId () returned 0x970 [0073.098] GetCurrentThreadId () returned 0x970 [0073.098] GetCurrentThreadId () returned 0x970 [0073.098] GetCurrentThreadId () returned 0x970 [0073.098] GetCurrentThreadId () returned 0x970 [0073.098] GetCurrentThreadId () returned 0x970 [0073.099] GetCurrentThreadId () returned 0x970 [0073.099] GetCurrentThreadId () returned 0x970 [0073.099] GetCurrentThreadId () returned 0x970 [0073.099] GetCurrentThreadId () returned 0x970 [0073.099] GetCurrentThreadId () returned 0x970 [0073.099] GetCurrentThreadId () returned 0x970 [0073.099] GetCurrentThreadId () returned 0x970 [0073.099] GetCurrentThreadId () returned 0x970 [0073.099] GetCurrentThreadId () returned 0x970 [0073.099] GetCurrentThreadId () returned 0x970 [0073.099] GetCurrentThreadId () returned 0x970 [0073.099] GetCurrentThreadId () returned 0x970 [0073.099] GetCurrentThreadId () returned 0x970 [0073.099] GetCurrentThreadId () returned 0x970 [0073.099] GetCurrentThreadId () returned 0x970 [0073.099] GetCurrentThreadId () returned 0x970 [0073.099] GetCurrentThreadId () returned 0x970 [0073.099] GetCurrentThreadId () returned 0x970 [0073.099] GetCurrentThreadId () returned 0x970 [0073.099] GetCurrentThreadId () returned 0x970 [0073.099] GetCurrentThreadId () returned 0x970 [0073.099] GetCurrentThreadId () returned 0x970 [0073.099] GetCurrentThreadId () returned 0x970 [0073.099] GetCurrentThreadId () returned 0x970 [0073.099] GetCurrentThreadId () returned 0x970 [0073.099] GetCurrentThreadId () returned 0x970 [0073.099] GetCurrentThreadId () returned 0x970 [0073.099] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAD+ngfas1i+Ln4ogGmb3EYpeM6i7ljNKWOmvL1a4yd/rPZHiyUh7H2oar8tY/nk4T7Y8NQsI2jLupNowUXyMuSDWxmTTITfv1ZGHoQDH1WxCFg2r+MMcHDEucDxfmwh1t8AbTe6YzpCBiRgsSx1zhi2AJSvM375RQWR5rWuaWX3M82/hrXDfK5VMtiUaPesPaBhIyLca0S29dmy/OCQU0zz12Y/aOaPJ1Q==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0073.099] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAD+ngfas1i+Ln4ogGmb3EYpeM6i7ljNKWOmvL1a4yd/rPZHiyUh7H2oar8tY/nk4T7Y8NQsI2jLupNowUXyMuSDWxmTTITfv1ZGHoQDH1WxCFg2r+MMcHDEucDxfmwh1t8AbTe6YzpCBiRgsSx1zhi2AJSvM375RQWR5rWuaWX3M82/hrXDfK5VMtiUaPesPaBhIyLca0S29dmy/OCQU0zz12Y/aOaPJ1Q==", cchWideChar=245, lpMultiByteStr=0x353a87c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAD+ngfas1i+Ln4ogGmb3EYpeM6i7ljNKWOmvL1a4yd/rPZHiyUh7H2oar8tY/nk4T7Y8NQsI2jLupNowUXyMuSDWxmTTITfv1ZGHoQDH1WxCFg2r+MMcHDEucDxfmwh1t8AbTe6YzpCBiRgsSx1zhi2AJSvM375RQWR5rWuaWX3M82/hrXDfK5VMtiUaPesPaBhIyLca0S29dmy/OCQU0zz12Y/aOaPJ1Q==", lpUsedDefaultChar=0x0) returned 245 [0073.099] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0073.099] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0073.099] CloseHandle (hObject=0x158) returned 1 [0073.100] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\720x480icongraphic.png")) returned 0 [0073.100] GetLastError () returned 0x5 [0073.100] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\720x480icongraphic.png")) returned 0x20 [0073.100] SetLastError (dwErrCode=0x5) [0073.100] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=19336332005) returned 1 [0073.100] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\Файл зашифрован [NavigationLeft_ButtonGraphic.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\Файл зашифрован [navigationleft_buttongraphic.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0073.100] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0073.100] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0073.101] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0073.101] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0073.101] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0073.101] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0073.101] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0073.101] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0073.101] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0073.101] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0073.101] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0073.101] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0073.101] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0073.101] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0073.101] SetEndOfFile (hFile=0x158) returned 1 [0073.101] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0073.101] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0073.101] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0073.102] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0073.102] WriteFile (in: hFile=0x158, lpBuffer=0x3777058*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777058*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0073.102] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0073.103] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="XB$+KRi6=3^D^5U*xLs\"}UmWNMA=S9#-", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0073.103] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="XB$+KRi6=3^D^5U*xLs\"}UmWNMA=S9#-", cchWideChar=32, lpMultiByteStr=0x20382f4, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="XB$+KRi6=3^D^5U*xLs\"}UmWNMA=S9#-", lpUsedDefaultChar=0x0) returned 32 [0073.103] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0073.103] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0073.103] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa86831, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fa86831, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 0x295098 [0073.103] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0073.103] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0073.103] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_buttongraphic.png")) returned 0x20 [0073.103] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_buttongraphic.png")) returned 0x20 [0073.103] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_buttongraphic.png")) returned 0x20 [0073.103] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_buttongraphic.png")) returned 0x20 [0073.103] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_buttongraphic.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa86831, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fa86831, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0)) returned 1 [0073.103] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0073.103] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0073.103] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_buttongraphic.png")) returned 0x20 [0073.103] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_buttongraphic.png")) returned 0x20 [0073.104] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0073.104] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0073.104] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0073.104] SetEndOfFile (hFile=0x158) returned 1 [0073.104] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0073.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x203863c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 32 [0073.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0073.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x20381dc, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 32 [0073.105] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x20381dc, cbMultiByte=32, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="NavigationLeft_ButtonGraphic.png.pngpngg") returned 32 [0073.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0073.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x203863c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 32 [0073.105] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0073.105] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0073.105] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x13e0 [0073.105] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0073.105] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0073.105] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0073.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0073.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x203863c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 32 [0073.106] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0073.106] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x20381dc, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 32 [0073.106] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x20381dc, cbMultiByte=32, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="NavigationLeft_ButtonGraphic.pngic.png.pngpngg") returned 32 [0073.106] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0073.106] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x203863c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 32 [0073.106] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0073.107] CharToOemA (in: pSrc="NavigationLeft_ButtonGraphic.png", pDst=0x20381dc | out: pDst="NavigationLeft_ButtonGraphic.png") returned 1 [0073.107] WriteFile (in: hFile=0x158, lpBuffer=0x20381dc*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x20381dc*, lpNumberOfBytesWritten=0x18e048*=0x20, lpOverlapped=0x0) returned 1 [0073.107] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0073.107] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0073.107] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0073.107] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=19337050547) returned 1 [0073.107] ReadFile (in: hFile=0x11c, lpBuffer=0x3b5bc20, nNumberOfBytesToRead=0x13e0, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b5bc20*, lpNumberOfBytesRead=0x18dd7c*=0x13e0, lpOverlapped=0x0) returned 1 [0073.109] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0073.109] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=19337214237) returned 1 [0073.118] WriteFile (in: hFile=0x158, lpBuffer=0x379adc8*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379adc8*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0073.118] ReadFile (in: hFile=0x11c, lpBuffer=0x3b5bc20, nNumberOfBytesToRead=0x13e0, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3b5bc20*, lpNumberOfBytesRead=0x18de38*=0x13e0, lpOverlapped=0x0) returned 1 [0073.118] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x5b [0073.118] WriteFile (in: hFile=0x158, lpBuffer=0x3b9e840*, nNumberOfBytesToWrite=0x13e0, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3b9e840*, lpNumberOfBytesWritten=0x18de10*=0x13e0, lpOverlapped=0x0) returned 1 [0073.118] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x143b [0073.118] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0073.119] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0073.119] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0073.119] SetFilePointer (in: hFile=0x158, lDistanceToMove=32, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x3e [0073.119] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x1445 [0073.119] CloseHandle (hObject=0x11c) returned 1 [0073.119] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1445 [0073.119] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1445 [0073.119] SetFilePointer (in: hFile=0x158, lDistanceToMove=5189, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1445 [0073.119] SetFilePointer (in: hFile=0x158, lDistanceToMove=5189, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x1445 [0073.119] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1445 [0073.119] SetFilePointer (in: hFile=0x158, lDistanceToMove=5189, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x1445 [0073.119] SetEndOfFile (hFile=0x158) returned 1 [0073.120] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1445 [0073.120] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1445 [0073.120] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0073.120] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x20381dc, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 32 [0073.120] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0073.120] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x203863c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 32 [0073.120] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x203863c, cbMultiByte=32, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="NavigationLeft_ButtonGraphic.png?㵓ᏼ") returned 32 [0073.120] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0073.120] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x20381dc, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 32 [0073.120] WriteFile (in: hFile=0x158, lpBuffer=0x3b3f6f8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3b3f6f8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0073.120] CharToOemA (in: pSrc="NavigationLeft_ButtonGraphic.png", pDst=0x203863c | out: pDst="NavigationLeft_ButtonGraphic.png") returned 1 [0073.120] WriteFile (in: hFile=0x158, lpBuffer=0x203863c*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x203863c*, lpNumberOfBytesWritten=0x18efcc*=0x20, lpOverlapped=0x0) returned 1 [0073.120] WriteFile (in: hFile=0x158, lpBuffer=0x379ae18*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379ae18*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0073.120] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0073.120] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0073.121] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x149e [0073.121] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x149e [0073.121] WriteFile (in: hFile=0x158, lpBuffer=0x3777058*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777058*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0073.121] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0073.121] DeleteFileW (lpFileName="") returned 0 [0073.121] GetLastError () returned 0x3 [0073.121] GetFileAttributesW (lpFileName="") returned 0xffffffff [0073.121] SetLastError (dwErrCode=0x3) [0073.121] FlushFileBuffers (hFile=0x158) returned 1 [0073.125] GetCurrentThreadId () returned 0x970 [0073.125] GetCurrentThreadId () returned 0x970 [0073.125] GetCurrentThreadId () returned 0x970 [0073.125] GetCurrentThreadId () returned 0x970 [0073.125] GetCurrentThreadId () returned 0x970 [0073.126] GetCurrentThreadId () returned 0x970 [0073.126] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x1555 [0073.126] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x1555 [0073.126] SetFilePointer (in: hFile=0x158, lDistanceToMove=5461, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x1555 [0073.126] CloseHandle (hObject=0x158) returned 1 [0073.126] GetCurrentThreadId () returned 0x970 [0073.126] GetCurrentThreadId () returned 0x970 [0073.126] GetCurrentThreadId () returned 0x970 [0073.126] GetCurrentThreadId () returned 0x970 [0073.126] GetCurrentThreadId () returned 0x970 [0073.126] GetCurrentThreadId () returned 0x970 [0073.126] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\Файл зашифрован [NavigationLeft_ButtonGraphic.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\Файл зашифрован [navigationleft_buttongraphic.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0073.126] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1555 [0073.126] SetFilePointer (in: hFile=0x158, lDistanceToMove=5333, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x14d5 [0073.126] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0073.126] GetFileType (hFile=0x158) returned 0x1 [0073.126] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x14, wMilliseconds=0x18a)) [0073.126] GetCurrentThreadId () returned 0x970 [0073.126] GetCurrentThreadId () returned 0x970 [0073.126] GetCurrentThreadId () returned 0x970 [0073.127] GetCurrentThreadId () returned 0x970 [0073.127] GetCurrentThreadId () returned 0x970 [0073.127] GetCurrentThreadId () returned 0x970 [0073.127] GetCurrentThreadId () returned 0x970 [0073.127] GetCurrentThreadId () returned 0x970 [0073.127] GetCurrentThreadId () returned 0x970 [0073.127] GetCurrentThreadId () returned 0x970 [0073.127] GetCurrentThreadId () returned 0x970 [0073.127] GetCurrentThreadId () returned 0x970 [0073.127] GetCurrentThreadId () returned 0x970 [0073.127] GetCurrentThreadId () returned 0x970 [0073.127] GetCurrentThreadId () returned 0x970 [0073.127] GetCurrentThreadId () returned 0x970 [0073.127] GetCurrentThreadId () returned 0x970 [0073.127] GetCurrentThreadId () returned 0x970 [0073.127] GetCurrentThreadId () returned 0x970 [0073.127] GetCurrentThreadId () returned 0x970 [0073.127] GetCurrentThreadId () returned 0x970 [0073.127] GetCurrentThreadId () returned 0x970 [0073.127] GetCurrentThreadId () returned 0x970 [0073.127] GetCurrentThreadId () returned 0x970 [0073.127] GetCurrentThreadId () returned 0x970 [0073.127] GetCurrentThreadId () returned 0x970 [0073.127] GetCurrentThreadId () returned 0x970 [0073.127] GetCurrentThreadId () returned 0x970 [0073.127] GetCurrentThreadId () returned 0x970 [0073.127] GetCurrentThreadId () returned 0x970 [0073.127] GetCurrentThreadId () returned 0x970 [0073.127] GetCurrentThreadId () returned 0x970 [0073.127] GetCurrentThreadId () returned 0x970 [0073.127] GetCurrentThreadId () returned 0x970 [0073.127] GetCurrentThreadId () returned 0x970 [0073.127] GetCurrentThreadId () returned 0x970 [0073.127] GetCurrentThreadId () returned 0x970 [0073.127] GetCurrentThreadId () returned 0x970 [0073.127] GetCurrentThreadId () returned 0x970 [0073.127] GetCurrentThreadId () returned 0x970 [0073.127] GetCurrentThreadId () returned 0x970 [0073.127] GetCurrentThreadId () returned 0x970 [0073.127] GetCurrentThreadId () returned 0x970 [0073.127] GetCurrentThreadId () returned 0x970 [0073.127] GetCurrentThreadId () returned 0x970 [0073.127] GetCurrentThreadId () returned 0x970 [0073.127] GetCurrentThreadId () returned 0x970 [0073.127] GetCurrentThreadId () returned 0x970 [0073.128] GetCurrentThreadId () returned 0x970 [0073.128] GetCurrentThreadId () returned 0x970 [0073.128] GetCurrentThreadId () returned 0x970 [0073.128] GetCurrentThreadId () returned 0x970 [0073.128] GetCurrentThreadId () returned 0x970 [0073.128] GetCurrentThreadId () returned 0x970 [0073.128] GetCurrentThreadId () returned 0x970 [0073.128] GetCurrentThreadId () returned 0x970 [0073.128] GetCurrentThreadId () returned 0x970 [0073.128] GetCurrentThreadId () returned 0x970 [0073.128] GetCurrentThreadId () returned 0x970 [0073.128] GetCurrentThreadId () returned 0x970 [0073.128] GetCurrentThreadId () returned 0x970 [0073.128] GetCurrentThreadId () returned 0x970 [0073.128] GetCurrentThreadId () returned 0x970 [0073.128] GetCurrentThreadId () returned 0x970 [0073.128] GetCurrentThreadId () returned 0x970 [0073.128] GetCurrentThreadId () returned 0x970 [0073.128] GetCurrentThreadId () returned 0x970 [0073.128] GetCurrentThreadId () returned 0x970 [0073.128] GetCurrentThreadId () returned 0x970 [0073.128] GetCurrentThreadId () returned 0x970 [0073.128] GetCurrentThreadId () returned 0x970 [0073.128] GetCurrentThreadId () returned 0x970 [0073.128] GetCurrentThreadId () returned 0x970 [0073.128] GetCurrentThreadId () returned 0x970 [0073.128] GetCurrentThreadId () returned 0x970 [0073.128] GetCurrentThreadId () returned 0x970 [0073.128] GetCurrentThreadId () returned 0x970 [0073.128] GetCurrentThreadId () returned 0x970 [0073.128] GetCurrentThreadId () returned 0x970 [0073.128] GetCurrentThreadId () returned 0x970 [0073.128] GetCurrentThreadId () returned 0x970 [0073.128] GetCurrentThreadId () returned 0x970 [0073.128] GetCurrentThreadId () returned 0x970 [0073.128] GetCurrentThreadId () returned 0x970 [0073.128] GetCurrentThreadId () returned 0x970 [0073.128] GetCurrentThreadId () returned 0x970 [0073.128] GetCurrentThreadId () returned 0x970 [0073.128] GetCurrentThreadId () returned 0x970 [0073.128] GetCurrentThreadId () returned 0x970 [0073.129] GetCurrentThreadId () returned 0x970 [0073.129] GetCurrentThreadId () returned 0x970 [0073.129] GetCurrentThreadId () returned 0x970 [0073.129] GetCurrentThreadId () returned 0x970 [0073.129] GetCurrentThreadId () returned 0x970 [0073.129] GetCurrentThreadId () returned 0x970 [0073.129] GetCurrentThreadId () returned 0x970 [0073.129] GetCurrentThreadId () returned 0x970 [0073.129] GetCurrentThreadId () returned 0x970 [0073.129] GetCurrentThreadId () returned 0x970 [0073.129] GetCurrentThreadId () returned 0x970 [0073.129] GetCurrentThreadId () returned 0x970 [0073.129] GetCurrentThreadId () returned 0x970 [0073.129] GetCurrentThreadId () returned 0x970 [0073.129] GetCurrentThreadId () returned 0x970 [0073.129] GetCurrentThreadId () returned 0x970 [0073.129] GetCurrentThreadId () returned 0x970 [0073.129] GetCurrentThreadId () returned 0x970 [0073.129] GetCurrentThreadId () returned 0x970 [0073.129] GetCurrentThreadId () returned 0x970 [0073.129] GetCurrentThreadId () returned 0x970 [0073.129] GetCurrentThreadId () returned 0x970 [0073.129] GetCurrentThreadId () returned 0x970 [0073.129] GetCurrentThreadId () returned 0x970 [0073.129] GetCurrentThreadId () returned 0x970 [0073.129] GetCurrentThreadId () returned 0x970 [0073.129] GetCurrentThreadId () returned 0x970 [0073.129] GetCurrentThreadId () returned 0x970 [0073.129] GetCurrentThreadId () returned 0x970 [0073.129] GetCurrentThreadId () returned 0x970 [0073.129] GetCurrentThreadId () returned 0x970 [0073.129] GetCurrentThreadId () returned 0x970 [0073.129] GetCurrentThreadId () returned 0x970 [0073.129] GetCurrentThreadId () returned 0x970 [0073.129] GetCurrentThreadId () returned 0x970 [0073.129] GetCurrentThreadId () returned 0x970 [0073.129] GetCurrentThreadId () returned 0x970 [0073.129] GetCurrentThreadId () returned 0x970 [0073.129] GetCurrentThreadId () returned 0x970 [0073.129] GetCurrentThreadId () returned 0x970 [0073.129] GetCurrentThreadId () returned 0x970 [0073.129] GetCurrentThreadId () returned 0x970 [0073.130] GetCurrentThreadId () returned 0x970 [0073.130] GetCurrentThreadId () returned 0x970 [0073.130] GetCurrentThreadId () returned 0x970 [0073.130] GetCurrentThreadId () returned 0x970 [0073.130] GetCurrentThreadId () returned 0x970 [0073.130] GetCurrentThreadId () returned 0x970 [0073.130] GetCurrentThreadId () returned 0x970 [0073.130] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.130] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.130] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379f198, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0073.130] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.130] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.130] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379f198, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0073.130] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.130] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.130] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0073.130] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.130] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.130] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0073.130] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.130] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.130] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379f1f8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0073.130] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.130] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.130] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379f1f8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0073.130] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.130] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.130] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379f1f8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0073.130] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x14, wMilliseconds=0x18a)) [0073.130] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="XB$+KRi6=3^D^5U*xLs\"}UmWNMA=S9#-", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0073.130] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="XB$+KRi6=3^D^5U*xLs\"}UmWNMA=S9#-", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0073.130] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="XB$+KRi6=3^D^5U*xLs\"}UmWNMA=S9#-", cchWideChar=32, lpMultiByteStr=0x20056f8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="XB$+KRi6=3^D^5U*xLs\"}UmWNMA=S9#-", lpUsedDefaultChar=0x0) returned 32 [0073.131] GetCurrentThreadId () returned 0x970 [0073.131] GetCurrentThreadId () returned 0x970 [0073.131] GetCurrentThreadId () returned 0x970 [0073.131] GetCurrentThreadId () returned 0x970 [0073.131] GetCurrentThreadId () returned 0x970 [0073.131] GetCurrentThreadId () returned 0x970 [0073.139] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0073.139] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0073.139] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x37b6a38, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0073.139] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ed248, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0073.139] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ed248, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAABKXtFQ9Izy86y1RJbKlGpnq4F2VqyARpmly+e4VCepbD8HXvBeBbwvjctmIYscw2EpyOyem/oR1d5UU2FgLPO3n29y/Ds5WpnO72/yOGp6J1ljcLb3iWhOZZnHNcvcpgc6jHtK7u7HbiL6JwkYxlT0oa6KVdi02qdfCU/UNvS2rnelJYStK3pDvrkink8Oz3C+qlkNIPYJM9T7i7zKO0iCUiWVd/s/Rtw==") returned 232 [0073.139] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x14, wMilliseconds=0x19a)) [0073.139] GetCurrentThreadId () returned 0x970 [0073.139] GetCurrentThreadId () returned 0x970 [0073.139] GetCurrentThreadId () returned 0x970 [0073.139] GetCurrentThreadId () returned 0x970 [0073.139] GetCurrentThreadId () returned 0x970 [0073.139] GetCurrentThreadId () returned 0x970 [0073.139] GetCurrentThreadId () returned 0x970 [0073.139] GetCurrentThreadId () returned 0x970 [0073.139] GetCurrentThreadId () returned 0x970 [0073.139] GetCurrentThreadId () returned 0x970 [0073.139] GetCurrentThreadId () returned 0x970 [0073.139] GetCurrentThreadId () returned 0x970 [0073.139] GetCurrentThreadId () returned 0x970 [0073.139] GetCurrentThreadId () returned 0x970 [0073.139] GetCurrentThreadId () returned 0x970 [0073.139] GetCurrentThreadId () returned 0x970 [0073.139] GetCurrentThreadId () returned 0x970 [0073.139] GetCurrentThreadId () returned 0x970 [0073.139] GetCurrentThreadId () returned 0x970 [0073.139] GetCurrentThreadId () returned 0x970 [0073.139] GetCurrentThreadId () returned 0x970 [0073.139] GetCurrentThreadId () returned 0x970 [0073.139] GetCurrentThreadId () returned 0x970 [0073.139] GetCurrentThreadId () returned 0x970 [0073.139] GetCurrentThreadId () returned 0x970 [0073.139] GetCurrentThreadId () returned 0x970 [0073.139] GetCurrentThreadId () returned 0x970 [0073.139] GetCurrentThreadId () returned 0x970 [0073.140] GetCurrentThreadId () returned 0x970 [0073.140] GetCurrentThreadId () returned 0x970 [0073.140] GetCurrentThreadId () returned 0x970 [0073.140] GetCurrentThreadId () returned 0x970 [0073.140] GetCurrentThreadId () returned 0x970 [0073.140] GetCurrentThreadId () returned 0x970 [0073.140] GetCurrentThreadId () returned 0x970 [0073.140] GetCurrentThreadId () returned 0x970 [0073.140] GetCurrentThreadId () returned 0x970 [0073.140] GetCurrentThreadId () returned 0x970 [0073.140] GetCurrentThreadId () returned 0x970 [0073.140] GetCurrentThreadId () returned 0x970 [0073.140] GetCurrentThreadId () returned 0x970 [0073.140] GetCurrentThreadId () returned 0x970 [0073.140] GetCurrentThreadId () returned 0x970 [0073.140] GetCurrentThreadId () returned 0x970 [0073.140] GetCurrentThreadId () returned 0x970 [0073.140] GetCurrentThreadId () returned 0x970 [0073.140] GetCurrentThreadId () returned 0x970 [0073.140] GetCurrentThreadId () returned 0x970 [0073.140] GetCurrentThreadId () returned 0x970 [0073.140] GetCurrentThreadId () returned 0x970 [0073.140] GetCurrentThreadId () returned 0x970 [0073.140] GetCurrentThreadId () returned 0x970 [0073.140] GetCurrentThreadId () returned 0x970 [0073.140] GetCurrentThreadId () returned 0x970 [0073.140] GetCurrentThreadId () returned 0x970 [0073.140] GetCurrentThreadId () returned 0x970 [0073.140] GetCurrentThreadId () returned 0x970 [0073.140] GetCurrentThreadId () returned 0x970 [0073.140] GetCurrentThreadId () returned 0x970 [0073.140] GetCurrentThreadId () returned 0x970 [0073.140] GetCurrentThreadId () returned 0x970 [0073.140] GetCurrentThreadId () returned 0x970 [0073.140] GetCurrentThreadId () returned 0x970 [0073.140] GetCurrentThreadId () returned 0x970 [0073.140] GetCurrentThreadId () returned 0x970 [0073.140] GetCurrentThreadId () returned 0x970 [0073.140] GetCurrentThreadId () returned 0x970 [0073.140] GetCurrentThreadId () returned 0x970 [0073.140] GetCurrentThreadId () returned 0x970 [0073.140] GetCurrentThreadId () returned 0x970 [0073.140] GetCurrentThreadId () returned 0x970 [0073.140] GetCurrentThreadId () returned 0x970 [0073.140] GetCurrentThreadId () returned 0x970 [0073.140] GetCurrentThreadId () returned 0x970 [0073.141] GetCurrentThreadId () returned 0x970 [0073.141] GetCurrentThreadId () returned 0x970 [0073.141] GetCurrentThreadId () returned 0x970 [0073.141] GetCurrentThreadId () returned 0x970 [0073.141] GetCurrentThreadId () returned 0x970 [0073.141] GetCurrentThreadId () returned 0x970 [0073.141] GetCurrentThreadId () returned 0x970 [0073.141] GetCurrentThreadId () returned 0x970 [0073.141] GetCurrentThreadId () returned 0x970 [0073.141] GetCurrentThreadId () returned 0x970 [0073.141] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAABKXtFQ9Izy86y1RJbKlGpnq4F2VqyARpmly+e4VCepbD8HXvBeBbwvjctmIYscw2EpyOyem/oR1d5UU2FgLPO3n29y/Ds5WpnO72/yOGp6J1ljcLb3iWhOZZnHNcvcpgc6jHtK7u7HbiL6JwkYxlT0oa6KVdi02qdfCU/UNvS2rnelJYStK3pDvrkink8Oz3C+qlkNIPYJM9T7i7zKO0iCUiWVd/s/Rtw==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0073.141] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAABKXtFQ9Izy86y1RJbKlGpnq4F2VqyARpmly+e4VCepbD8HXvBeBbwvjctmIYscw2EpyOyem/oR1d5UU2FgLPO3n29y/Ds5WpnO72/yOGp6J1ljcLb3iWhOZZnHNcvcpgc6jHtK7u7HbiL6JwkYxlT0oa6KVdi02qdfCU/UNvS2rnelJYStK3pDvrkink8Oz3C+qlkNIPYJM9T7i7zKO0iCUiWVd/s/Rtw==", cchWideChar=245, lpMultiByteStr=0x353aa9c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAABKXtFQ9Izy86y1RJbKlGpnq4F2VqyARpmly+e4VCepbD8HXvBeBbwvjctmIYscw2EpyOyem/oR1d5UU2FgLPO3n29y/Ds5WpnO72/yOGp6J1ljcLb3iWhOZZnHNcvcpgc6jHtK7u7HbiL6JwkYxlT0oa6KVdi02qdfCU/UNvS2rnelJYStK3pDvrkink8Oz3C+qlkNIPYJM9T7i7zKO0iCUiWVd/s/Rtw==", lpUsedDefaultChar=0x0) returned 245 [0073.141] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0073.141] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0073.141] CloseHandle (hObject=0x158) returned 1 [0073.141] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_buttongraphic.png")) returned 0 [0073.141] GetLastError () returned 0x5 [0073.141] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_buttongraphic.png")) returned 0x20 [0073.142] SetLastError (dwErrCode=0x5) [0073.142] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=19340501164) returned 1 [0073.142] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\Файл зашифрован [NavigationLeft_SelectionSubpicture.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\Файл зашифрован [navigationleft_selectionsubpicture.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0073.142] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0073.142] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0073.142] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0073.142] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0073.142] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0073.142] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0073.142] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0073.143] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0073.143] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0073.143] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0073.143] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0073.143] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0073.143] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0073.143] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0073.143] SetEndOfFile (hFile=0x158) returned 1 [0073.143] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0073.143] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0073.143] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0073.143] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0073.143] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0073.144] WriteFile (in: hFile=0x158, lpBuffer=0x35f035c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f035c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0073.144] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b:jhRhWfDaNc0l10RdDzA.mPO53BU>0}", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0073.144] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b:jhRhWfDaNc0l10RdDzA.mPO53BU>0}", cchWideChar=32, lpMultiByteStr=0x2038524, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b:jhRhWfDaNc0l10RdDzA.mPO53BU>0}", lpUsedDefaultChar=0x0) returned 32 [0073.144] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0073.144] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0073.144] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa3a577, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fa3a577, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 0x295098 [0073.145] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0073.145] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0073.145] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_selectionsubpicture.png")) returned 0x20 [0073.145] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_selectionsubpicture.png")) returned 0x20 [0073.145] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_selectionsubpicture.png")) returned 0x20 [0073.145] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_selectionsubpicture.png")) returned 0x20 [0073.145] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_selectionsubpicture.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa3a577, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fa3a577, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a)) returned 1 [0073.145] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0073.145] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0073.145] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_selectionsubpicture.png")) returned 0x20 [0073.145] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_selectionsubpicture.png")) returned 0x20 [0073.145] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0073.145] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0073.145] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0073.145] SetEndOfFile (hFile=0x158) returned 1 [0073.146] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0073.146] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x20381a4, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 38 [0073.147] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0073.147] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x2038594, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 38 [0073.147] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x2038594, cbMultiByte=38, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="NavigationLeft_SelectionSubpicture.pnggg") returned 38 [0073.147] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0073.147] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x20381a4, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 38 [0073.147] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0073.147] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0073.147] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0xc3a [0073.147] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0073.147] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0073.147] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0073.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0073.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x20381a4, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 38 [0073.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0073.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x2038594, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 38 [0073.148] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x2038594, cbMultiByte=38, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="NavigationLeft_SelectionSubpicture.pngre.pnggg") returned 38 [0073.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0073.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x20381a4, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 38 [0073.148] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0073.149] CharToOemA (in: pSrc="NavigationLeft_SelectionSubpicture.png", pDst=0x2038594 | out: pDst="NavigationLeft_SelectionSubpicture.png") returned 1 [0073.149] WriteFile (in: hFile=0x158, lpBuffer=0x2038594*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x2038594*, lpNumberOfBytesWritten=0x18e048*=0x26, lpOverlapped=0x0) returned 1 [0073.149] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0073.149] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0073.149] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0073.149] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=19341260422) returned 1 [0073.149] ReadFile (in: hFile=0x11c, lpBuffer=0x3b5bc20, nNumberOfBytesToRead=0xc3a, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b5bc20*, lpNumberOfBytesRead=0x18dd7c*=0xc3a, lpOverlapped=0x0) returned 1 [0073.151] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0073.151] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=19341475520) returned 1 [0073.160] WriteFile (in: hFile=0x158, lpBuffer=0x379aca8*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379aca8*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0073.161] ReadFile (in: hFile=0x11c, lpBuffer=0x3b5bc20, nNumberOfBytesToRead=0xc3a, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3b5bc20*, lpNumberOfBytesRead=0x18de38*=0xc3a, lpOverlapped=0x0) returned 1 [0073.161] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x61 [0073.161] WriteFile (in: hFile=0x158, lpBuffer=0x3b9e140*, nNumberOfBytesToWrite=0xc3a, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3b9e140*, lpNumberOfBytesWritten=0x18de10*=0xc3a, lpOverlapped=0x0) returned 1 [0073.161] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0xc9b [0073.161] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0073.161] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0073.161] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0073.161] SetFilePointer (in: hFile=0x158, lDistanceToMove=38, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x44 [0073.161] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0xca5 [0073.161] CloseHandle (hObject=0x11c) returned 1 [0073.162] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xca5 [0073.162] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xca5 [0073.162] SetFilePointer (in: hFile=0x158, lDistanceToMove=3237, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xca5 [0073.162] SetFilePointer (in: hFile=0x158, lDistanceToMove=3237, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0xca5 [0073.162] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xca5 [0073.163] SetFilePointer (in: hFile=0x158, lDistanceToMove=3237, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0xca5 [0073.163] SetEndOfFile (hFile=0x158) returned 1 [0073.163] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xca5 [0073.163] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xca5 [0073.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0073.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x2038594, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 38 [0073.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0073.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x20381a4, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 38 [0073.163] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x20381a4, cbMultiByte=38, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="NavigationLeft_SelectionSubpicture.png&") returned 38 [0073.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0073.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x2038594, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 38 [0073.163] WriteFile (in: hFile=0x158, lpBuffer=0x3b3f6f8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3b3f6f8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0073.164] CharToOemA (in: pSrc="NavigationLeft_SelectionSubpicture.png", pDst=0x20381a4 | out: pDst="NavigationLeft_SelectionSubpicture.png") returned 1 [0073.164] WriteFile (in: hFile=0x158, lpBuffer=0x20381a4*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x20381a4*, lpNumberOfBytesWritten=0x18efcc*=0x26, lpOverlapped=0x0) returned 1 [0073.164] WriteFile (in: hFile=0x158, lpBuffer=0x379ad88*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379ad88*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0073.164] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0073.164] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0073.164] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xd04 [0073.164] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xd04 [0073.164] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0073.164] WriteFile (in: hFile=0x158, lpBuffer=0x35f035c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f035c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0073.164] DeleteFileW (lpFileName="") returned 0 [0073.164] GetLastError () returned 0x3 [0073.164] GetFileAttributesW (lpFileName="") returned 0xffffffff [0073.164] SetLastError (dwErrCode=0x3) [0073.164] FlushFileBuffers (hFile=0x158) returned 1 [0073.167] GetCurrentThreadId () returned 0x970 [0073.167] GetCurrentThreadId () returned 0x970 [0073.167] GetCurrentThreadId () returned 0x970 [0073.167] GetCurrentThreadId () returned 0x970 [0073.167] GetCurrentThreadId () returned 0x970 [0073.167] GetCurrentThreadId () returned 0x970 [0073.167] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xdbb [0073.167] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xdbb [0073.167] SetFilePointer (in: hFile=0x158, lDistanceToMove=3515, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xdbb [0073.167] CloseHandle (hObject=0x158) returned 1 [0073.167] GetCurrentThreadId () returned 0x970 [0073.167] GetCurrentThreadId () returned 0x970 [0073.167] GetCurrentThreadId () returned 0x970 [0073.167] GetCurrentThreadId () returned 0x970 [0073.167] GetCurrentThreadId () returned 0x970 [0073.167] GetCurrentThreadId () returned 0x970 [0073.167] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\Файл зашифрован [NavigationLeft_SelectionSubpicture.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\Файл зашифрован [navigationleft_selectionsubpicture.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0073.168] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdbb [0073.168] SetFilePointer (in: hFile=0x158, lDistanceToMove=3387, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd3b [0073.168] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0073.168] GetFileType (hFile=0x158) returned 0x1 [0073.168] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x14, wMilliseconds=0x1b9)) [0073.168] GetCurrentThreadId () returned 0x970 [0073.168] GetCurrentThreadId () returned 0x970 [0073.168] GetCurrentThreadId () returned 0x970 [0073.168] GetCurrentThreadId () returned 0x970 [0073.168] GetCurrentThreadId () returned 0x970 [0073.168] GetCurrentThreadId () returned 0x970 [0073.168] GetCurrentThreadId () returned 0x970 [0073.168] GetCurrentThreadId () returned 0x970 [0073.168] GetCurrentThreadId () returned 0x970 [0073.168] GetCurrentThreadId () returned 0x970 [0073.168] GetCurrentThreadId () returned 0x970 [0073.168] GetCurrentThreadId () returned 0x970 [0073.168] GetCurrentThreadId () returned 0x970 [0073.168] GetCurrentThreadId () returned 0x970 [0073.168] GetCurrentThreadId () returned 0x970 [0073.168] GetCurrentThreadId () returned 0x970 [0073.168] GetCurrentThreadId () returned 0x970 [0073.168] GetCurrentThreadId () returned 0x970 [0073.168] GetCurrentThreadId () returned 0x970 [0073.168] GetCurrentThreadId () returned 0x970 [0073.168] GetCurrentThreadId () returned 0x970 [0073.168] GetCurrentThreadId () returned 0x970 [0073.168] GetCurrentThreadId () returned 0x970 [0073.168] GetCurrentThreadId () returned 0x970 [0073.168] GetCurrentThreadId () returned 0x970 [0073.168] GetCurrentThreadId () returned 0x970 [0073.168] GetCurrentThreadId () returned 0x970 [0073.168] GetCurrentThreadId () returned 0x970 [0073.168] GetCurrentThreadId () returned 0x970 [0073.168] GetCurrentThreadId () returned 0x970 [0073.168] GetCurrentThreadId () returned 0x970 [0073.169] GetCurrentThreadId () returned 0x970 [0073.169] GetCurrentThreadId () returned 0x970 [0073.169] GetCurrentThreadId () returned 0x970 [0073.169] GetCurrentThreadId () returned 0x970 [0073.169] GetCurrentThreadId () returned 0x970 [0073.169] GetCurrentThreadId () returned 0x970 [0073.169] GetCurrentThreadId () returned 0x970 [0073.169] GetCurrentThreadId () returned 0x970 [0073.169] GetCurrentThreadId () returned 0x970 [0073.169] GetCurrentThreadId () returned 0x970 [0073.169] GetCurrentThreadId () returned 0x970 [0073.169] GetCurrentThreadId () returned 0x970 [0073.169] GetCurrentThreadId () returned 0x970 [0073.169] GetCurrentThreadId () returned 0x970 [0073.169] GetCurrentThreadId () returned 0x970 [0073.169] GetCurrentThreadId () returned 0x970 [0073.169] GetCurrentThreadId () returned 0x970 [0073.169] GetCurrentThreadId () returned 0x970 [0073.169] GetCurrentThreadId () returned 0x970 [0073.169] GetCurrentThreadId () returned 0x970 [0073.169] GetCurrentThreadId () returned 0x970 [0073.169] GetCurrentThreadId () returned 0x970 [0073.169] GetCurrentThreadId () returned 0x970 [0073.169] GetCurrentThreadId () returned 0x970 [0073.169] GetCurrentThreadId () returned 0x970 [0073.169] GetCurrentThreadId () returned 0x970 [0073.169] GetCurrentThreadId () returned 0x970 [0073.169] GetCurrentThreadId () returned 0x970 [0073.169] GetCurrentThreadId () returned 0x970 [0073.169] GetCurrentThreadId () returned 0x970 [0073.169] GetCurrentThreadId () returned 0x970 [0073.169] GetCurrentThreadId () returned 0x970 [0073.169] GetCurrentThreadId () returned 0x970 [0073.169] GetCurrentThreadId () returned 0x970 [0073.169] GetCurrentThreadId () returned 0x970 [0073.169] GetCurrentThreadId () returned 0x970 [0073.169] GetCurrentThreadId () returned 0x970 [0073.169] GetCurrentThreadId () returned 0x970 [0073.169] GetCurrentThreadId () returned 0x970 [0073.169] GetCurrentThreadId () returned 0x970 [0073.169] GetCurrentThreadId () returned 0x970 [0073.169] GetCurrentThreadId () returned 0x970 [0073.169] GetCurrentThreadId () returned 0x970 [0073.169] GetCurrentThreadId () returned 0x970 [0073.170] GetCurrentThreadId () returned 0x970 [0073.170] GetCurrentThreadId () returned 0x970 [0073.170] GetCurrentThreadId () returned 0x970 [0073.170] GetCurrentThreadId () returned 0x970 [0073.170] GetCurrentThreadId () returned 0x970 [0073.170] GetCurrentThreadId () returned 0x970 [0073.170] GetCurrentThreadId () returned 0x970 [0073.170] GetCurrentThreadId () returned 0x970 [0073.170] GetCurrentThreadId () returned 0x970 [0073.170] GetCurrentThreadId () returned 0x970 [0073.170] GetCurrentThreadId () returned 0x970 [0073.170] GetCurrentThreadId () returned 0x970 [0073.170] GetCurrentThreadId () returned 0x970 [0073.170] GetCurrentThreadId () returned 0x970 [0073.170] GetCurrentThreadId () returned 0x970 [0073.170] GetCurrentThreadId () returned 0x970 [0073.170] GetCurrentThreadId () returned 0x970 [0073.170] GetCurrentThreadId () returned 0x970 [0073.170] GetCurrentThreadId () returned 0x970 [0073.170] GetCurrentThreadId () returned 0x970 [0073.170] GetCurrentThreadId () returned 0x970 [0073.170] GetCurrentThreadId () returned 0x970 [0073.170] GetCurrentThreadId () returned 0x970 [0073.170] GetCurrentThreadId () returned 0x970 [0073.170] GetCurrentThreadId () returned 0x970 [0073.170] GetCurrentThreadId () returned 0x970 [0073.170] GetCurrentThreadId () returned 0x970 [0073.170] GetCurrentThreadId () returned 0x970 [0073.170] GetCurrentThreadId () returned 0x970 [0073.170] GetCurrentThreadId () returned 0x970 [0073.170] GetCurrentThreadId () returned 0x970 [0073.170] GetCurrentThreadId () returned 0x970 [0073.170] GetCurrentThreadId () returned 0x970 [0073.170] GetCurrentThreadId () returned 0x970 [0073.170] GetCurrentThreadId () returned 0x970 [0073.170] GetCurrentThreadId () returned 0x970 [0073.170] GetCurrentThreadId () returned 0x970 [0073.170] GetCurrentThreadId () returned 0x970 [0073.170] GetCurrentThreadId () returned 0x970 [0073.170] GetCurrentThreadId () returned 0x970 [0073.170] GetCurrentThreadId () returned 0x970 [0073.170] GetCurrentThreadId () returned 0x970 [0073.170] GetCurrentThreadId () returned 0x970 [0073.170] GetCurrentThreadId () returned 0x970 [0073.170] GetCurrentThreadId () returned 0x970 [0073.170] GetCurrentThreadId () returned 0x970 [0073.171] GetCurrentThreadId () returned 0x970 [0073.171] GetCurrentThreadId () returned 0x970 [0073.171] GetCurrentThreadId () returned 0x970 [0073.171] GetCurrentThreadId () returned 0x970 [0073.171] GetCurrentThreadId () returned 0x970 [0073.171] GetCurrentThreadId () returned 0x970 [0073.171] GetCurrentThreadId () returned 0x970 [0073.171] GetCurrentThreadId () returned 0x970 [0073.171] GetCurrentThreadId () returned 0x970 [0073.171] GetCurrentThreadId () returned 0x970 [0073.171] GetCurrentThreadId () returned 0x970 [0073.171] GetCurrentThreadId () returned 0x970 [0073.171] GetCurrentThreadId () returned 0x970 [0073.171] GetCurrentThreadId () returned 0x970 [0073.171] GetCurrentThreadId () returned 0x970 [0073.171] GetCurrentThreadId () returned 0x970 [0073.171] GetCurrentThreadId () returned 0x970 [0073.171] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.171] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.171] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379f1f8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0073.171] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.171] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.171] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379f1f8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0073.171] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.171] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.171] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0073.171] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.171] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.171] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0073.171] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.171] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.171] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379f258, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0073.171] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.171] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.171] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379f258, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0073.171] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.171] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.172] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379f258, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0073.172] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x14, wMilliseconds=0x1b9)) [0073.172] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="b:jhRhWfDaNc0l10RdDzA.mPO53BU>0}", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0073.172] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="b:jhRhWfDaNc0l10RdDzA.mPO53BU>0}", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0073.172] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="b:jhRhWfDaNc0l10RdDzA.mPO53BU>0}", cchWideChar=32, lpMultiByteStr=0x2005728, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b:jhRhWfDaNc0l10RdDzA.mPO53BU>0}", lpUsedDefaultChar=0x0) returned 32 [0073.172] GetCurrentThreadId () returned 0x970 [0073.172] GetCurrentThreadId () returned 0x970 [0073.172] GetCurrentThreadId () returned 0x970 [0073.172] GetCurrentThreadId () returned 0x970 [0073.172] GetCurrentThreadId () returned 0x970 [0073.172] GetCurrentThreadId () returned 0x970 [0073.179] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0073.179] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0073.179] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x37b6b28, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0073.179] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ed248, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0073.179] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ed248, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAB8HTryRXCSrw8hfaF5o5oVd8WzAOpH02RIMyrB4l9ykYXUMWpMjjHo6bjalcXqePwR3L4/0i1N93A/uoiMtKT+kcZmxK8iOK8Y+gFoarkRSa6Q84Rh/eMWTlEAJyQQPkpdrhD4T/Pg3TvMWd9kVeVhyy3Io6VpqzhWWtMYSrRreKj4C2JUD0ZLHxGGRvEdTsACDKCSGfVO+l5+72vp8cP5xzUXI22WbQA==") returned 232 [0073.179] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x14, wMilliseconds=0x1c9)) [0073.179] GetCurrentThreadId () returned 0x970 [0073.179] GetCurrentThreadId () returned 0x970 [0073.179] GetCurrentThreadId () returned 0x970 [0073.180] GetCurrentThreadId () returned 0x970 [0073.180] GetCurrentThreadId () returned 0x970 [0073.180] GetCurrentThreadId () returned 0x970 [0073.180] GetCurrentThreadId () returned 0x970 [0073.180] GetCurrentThreadId () returned 0x970 [0073.180] GetCurrentThreadId () returned 0x970 [0073.180] GetCurrentThreadId () returned 0x970 [0073.180] GetCurrentThreadId () returned 0x970 [0073.180] GetCurrentThreadId () returned 0x970 [0073.180] GetCurrentThreadId () returned 0x970 [0073.180] GetCurrentThreadId () returned 0x970 [0073.180] GetCurrentThreadId () returned 0x970 [0073.180] GetCurrentThreadId () returned 0x970 [0073.180] GetCurrentThreadId () returned 0x970 [0073.180] GetCurrentThreadId () returned 0x970 [0073.180] GetCurrentThreadId () returned 0x970 [0073.180] GetCurrentThreadId () returned 0x970 [0073.180] GetCurrentThreadId () returned 0x970 [0073.180] GetCurrentThreadId () returned 0x970 [0073.180] GetCurrentThreadId () returned 0x970 [0073.180] GetCurrentThreadId () returned 0x970 [0073.180] GetCurrentThreadId () returned 0x970 [0073.180] GetCurrentThreadId () returned 0x970 [0073.180] GetCurrentThreadId () returned 0x970 [0073.180] GetCurrentThreadId () returned 0x970 [0073.180] GetCurrentThreadId () returned 0x970 [0073.180] GetCurrentThreadId () returned 0x970 [0073.180] GetCurrentThreadId () returned 0x970 [0073.180] GetCurrentThreadId () returned 0x970 [0073.180] GetCurrentThreadId () returned 0x970 [0073.180] GetCurrentThreadId () returned 0x970 [0073.180] GetCurrentThreadId () returned 0x970 [0073.180] GetCurrentThreadId () returned 0x970 [0073.180] GetCurrentThreadId () returned 0x970 [0073.180] GetCurrentThreadId () returned 0x970 [0073.180] GetCurrentThreadId () returned 0x970 [0073.180] GetCurrentThreadId () returned 0x970 [0073.180] GetCurrentThreadId () returned 0x970 [0073.180] GetCurrentThreadId () returned 0x970 [0073.180] GetCurrentThreadId () returned 0x970 [0073.180] GetCurrentThreadId () returned 0x970 [0073.180] GetCurrentThreadId () returned 0x970 [0073.180] GetCurrentThreadId () returned 0x970 [0073.180] GetCurrentThreadId () returned 0x970 [0073.180] GetCurrentThreadId () returned 0x970 [0073.180] GetCurrentThreadId () returned 0x970 [0073.180] GetCurrentThreadId () returned 0x970 [0073.180] GetCurrentThreadId () returned 0x970 [0073.181] GetCurrentThreadId () returned 0x970 [0073.181] GetCurrentThreadId () returned 0x970 [0073.181] GetCurrentThreadId () returned 0x970 [0073.181] GetCurrentThreadId () returned 0x970 [0073.181] GetCurrentThreadId () returned 0x970 [0073.181] GetCurrentThreadId () returned 0x970 [0073.181] GetCurrentThreadId () returned 0x970 [0073.181] GetCurrentThreadId () returned 0x970 [0073.181] GetCurrentThreadId () returned 0x970 [0073.181] GetCurrentThreadId () returned 0x970 [0073.181] GetCurrentThreadId () returned 0x970 [0073.181] GetCurrentThreadId () returned 0x970 [0073.181] GetCurrentThreadId () returned 0x970 [0073.181] GetCurrentThreadId () returned 0x970 [0073.181] GetCurrentThreadId () returned 0x970 [0073.181] GetCurrentThreadId () returned 0x970 [0073.181] GetCurrentThreadId () returned 0x970 [0073.181] GetCurrentThreadId () returned 0x970 [0073.181] GetCurrentThreadId () returned 0x970 [0073.181] GetCurrentThreadId () returned 0x970 [0073.181] GetCurrentThreadId () returned 0x970 [0073.181] GetCurrentThreadId () returned 0x970 [0073.181] GetCurrentThreadId () returned 0x970 [0073.181] GetCurrentThreadId () returned 0x970 [0073.181] GetCurrentThreadId () returned 0x970 [0073.181] GetCurrentThreadId () returned 0x970 [0073.181] GetCurrentThreadId () returned 0x970 [0073.181] GetCurrentThreadId () returned 0x970 [0073.181] GetCurrentThreadId () returned 0x970 [0073.181] GetCurrentThreadId () returned 0x970 [0073.181] GetCurrentThreadId () returned 0x970 [0073.181] GetCurrentThreadId () returned 0x970 [0073.181] GetCurrentThreadId () returned 0x970 [0073.181] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAB8HTryRXCSrw8hfaF5o5oVd8WzAOpH02RIMyrB4l9ykYXUMWpMjjHo6bjalcXqePwR3L4/0i1N93A/uoiMtKT+kcZmxK8iOK8Y+gFoarkRSa6Q84Rh/eMWTlEAJyQQPkpdrhD4T/Pg3TvMWd9kVeVhyy3Io6VpqzhWWtMYSrRreKj4C2JUD0ZLHxGGRvEdTsACDKCSGfVO+l5+72vp8cP5xzUXI22WbQA==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0073.181] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAB8HTryRXCSrw8hfaF5o5oVd8WzAOpH02RIMyrB4l9ykYXUMWpMjjHo6bjalcXqePwR3L4/0i1N93A/uoiMtKT+kcZmxK8iOK8Y+gFoarkRSa6Q84Rh/eMWTlEAJyQQPkpdrhD4T/Pg3TvMWd9kVeVhyy3Io6VpqzhWWtMYSrRreKj4C2JUD0ZLHxGGRvEdTsACDKCSGfVO+l5+72vp8cP5xzUXI22WbQA==", cchWideChar=245, lpMultiByteStr=0x353a98c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAB8HTryRXCSrw8hfaF5o5oVd8WzAOpH02RIMyrB4l9ykYXUMWpMjjHo6bjalcXqePwR3L4/0i1N93A/uoiMtKT+kcZmxK8iOK8Y+gFoarkRSa6Q84Rh/eMWTlEAJyQQPkpdrhD4T/Pg3TvMWd9kVeVhyy3Io6VpqzhWWtMYSrRreKj4C2JUD0ZLHxGGRvEdTsACDKCSGfVO+l5+72vp8cP5xzUXI22WbQA==", lpUsedDefaultChar=0x0) returned 245 [0073.181] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0073.182] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0073.182] CloseHandle (hObject=0x158) returned 1 [0073.182] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_selectionsubpicture.png")) returned 0 [0073.182] GetLastError () returned 0x5 [0073.182] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_selectionsubpicture.png")) returned 0x20 [0073.182] SetLastError (dwErrCode=0x5) [0073.182] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=19344557202) returned 1 [0073.182] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\Файл зашифрован [NavigationRight_ButtonGraphic.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\Файл зашифрован [navigationright_buttongraphic.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0073.183] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0073.183] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0073.183] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0073.183] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0073.183] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0073.183] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0073.183] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0073.183] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0073.183] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0073.183] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0073.183] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0073.183] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0073.183] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0073.183] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0073.183] SetEndOfFile (hFile=0x158) returned 1 [0073.184] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0073.184] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0073.184] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0073.184] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0073.184] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0073.185] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0073.185] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="LFbU)?:<8?5pzRUQL=$sa\\:&jO#+X%vA", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0073.185] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="LFbU)?:<8?5pzRUQL=$sa\\:&jO#+X%vA", cchWideChar=32, lpMultiByteStr=0x203863c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LFbU)?:<8?5pzRUQL=$sa\\:&jO#+X%vA", lpUsedDefaultChar=0x0) returned 32 [0073.185] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0073.185] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0073.185] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa606d4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fa606d4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 0x295098 [0073.185] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0073.185] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0073.185] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_buttongraphic.png")) returned 0x20 [0073.185] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_buttongraphic.png")) returned 0x20 [0073.185] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_buttongraphic.png")) returned 0x20 [0073.185] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_buttongraphic.png")) returned 0x20 [0073.185] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_buttongraphic.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa606d4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fa606d4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1)) returned 1 [0073.186] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0073.186] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0073.186] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_buttongraphic.png")) returned 0x20 [0073.186] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_buttongraphic.png")) returned 0x20 [0073.186] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0073.186] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0073.186] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0073.186] SetEndOfFile (hFile=0x158) returned 1 [0073.187] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0073.187] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x20386e4, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 33 [0073.187] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0073.187] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x20381dc, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 33 [0073.187] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x20381dc, cbMultiByte=33, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="NavigationRight_ButtonGraphic.pnge.pnggg") returned 33 [0073.187] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0073.187] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x20386e4, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 33 [0073.187] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0073.187] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0073.187] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x13a1 [0073.187] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0073.187] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0073.187] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0073.188] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0073.188] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x20386e4, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 33 [0073.188] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0073.188] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x20381dc, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 33 [0073.188] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x20381dc, cbMultiByte=33, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="NavigationRight_ButtonGraphic.pngic.pnge.pnggg") returned 33 [0073.188] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0073.188] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x20386e4, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 33 [0073.188] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0073.189] CharToOemA (in: pSrc="NavigationRight_ButtonGraphic.png", pDst=0x20381dc | out: pDst="NavigationRight_ButtonGraphic.png") returned 1 [0073.189] WriteFile (in: hFile=0x158, lpBuffer=0x20381dc*, nNumberOfBytesToWrite=0x21, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x20381dc*, lpNumberOfBytesWritten=0x18e048*=0x21, lpOverlapped=0x0) returned 1 [0073.189] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0073.189] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0073.189] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0073.189] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=19345257811) returned 1 [0073.189] ReadFile (in: hFile=0x11c, lpBuffer=0x3b5bc20, nNumberOfBytesToRead=0x13a1, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b5bc20*, lpNumberOfBytesRead=0x18dd7c*=0x13a1, lpOverlapped=0x0) returned 1 [0073.191] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0073.191] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=19345476236) returned 1 [0073.201] WriteFile (in: hFile=0x158, lpBuffer=0x379ad38*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379ad38*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0073.201] ReadFile (in: hFile=0x11c, lpBuffer=0x3b5bc20, nNumberOfBytesToRead=0x13a1, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3b5bc20*, lpNumberOfBytesRead=0x18de38*=0x13a1, lpOverlapped=0x0) returned 1 [0073.201] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x5c [0073.202] WriteFile (in: hFile=0x158, lpBuffer=0x3b9e840*, nNumberOfBytesToWrite=0x13a1, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3b9e840*, lpNumberOfBytesWritten=0x18de10*=0x13a1, lpOverlapped=0x0) returned 1 [0073.202] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x13fd [0073.202] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0073.202] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0073.202] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0073.202] SetFilePointer (in: hFile=0x158, lDistanceToMove=33, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x3f [0073.202] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x1407 [0073.202] CloseHandle (hObject=0x11c) returned 1 [0073.202] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1407 [0073.203] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1407 [0073.203] SetFilePointer (in: hFile=0x158, lDistanceToMove=5127, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1407 [0073.203] SetFilePointer (in: hFile=0x158, lDistanceToMove=5127, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x1407 [0073.203] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1407 [0073.203] SetFilePointer (in: hFile=0x158, lDistanceToMove=5127, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x1407 [0073.203] SetEndOfFile (hFile=0x158) returned 1 [0073.212] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1407 [0073.212] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1407 [0073.212] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0073.212] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x20381dc, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 33 [0073.212] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0073.212] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x20386e4, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 33 [0073.212] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x20386e4, cbMultiByte=33, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="NavigationRight_ButtonGraphic.pngⵠᎽ") returned 33 [0073.212] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0073.212] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x20381dc, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 33 [0073.212] WriteFile (in: hFile=0x158, lpBuffer=0x3b3f6f8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3b3f6f8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0073.212] CharToOemA (in: pSrc="NavigationRight_ButtonGraphic.png", pDst=0x20386e4 | out: pDst="NavigationRight_ButtonGraphic.png") returned 1 [0073.212] WriteFile (in: hFile=0x158, lpBuffer=0x20386e4*, nNumberOfBytesToWrite=0x21, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x20386e4*, lpNumberOfBytesWritten=0x18efcc*=0x21, lpOverlapped=0x0) returned 1 [0073.212] WriteFile (in: hFile=0x158, lpBuffer=0x379ade8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379ade8*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0073.213] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0073.213] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0073.213] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1461 [0073.213] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1461 [0073.213] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0073.213] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0073.213] DeleteFileW (lpFileName="") returned 0 [0073.213] GetLastError () returned 0x3 [0073.213] GetFileAttributesW (lpFileName="") returned 0xffffffff [0073.213] SetLastError (dwErrCode=0x3) [0073.213] FlushFileBuffers (hFile=0x158) returned 1 [0073.280] GetCurrentThreadId () returned 0x970 [0073.280] GetCurrentThreadId () returned 0x970 [0073.280] GetCurrentThreadId () returned 0x970 [0073.280] GetCurrentThreadId () returned 0x970 [0073.280] GetCurrentThreadId () returned 0x970 [0073.280] GetCurrentThreadId () returned 0x970 [0073.280] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x1518 [0073.280] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x1518 [0073.280] SetFilePointer (in: hFile=0x158, lDistanceToMove=5400, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x1518 [0073.280] CloseHandle (hObject=0x158) returned 1 [0073.281] GetCurrentThreadId () returned 0x970 [0073.281] GetCurrentThreadId () returned 0x970 [0073.281] GetCurrentThreadId () returned 0x970 [0073.281] GetCurrentThreadId () returned 0x970 [0073.281] GetCurrentThreadId () returned 0x970 [0073.281] GetCurrentThreadId () returned 0x970 [0073.281] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\Файл зашифрован [NavigationRight_ButtonGraphic.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\Файл зашифрован [navigationright_buttongraphic.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0073.281] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1518 [0073.281] SetFilePointer (in: hFile=0x158, lDistanceToMove=5272, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1498 [0073.281] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0073.281] GetFileType (hFile=0x158) returned 0x1 [0073.281] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x14, wMilliseconds=0x226)) [0073.281] GetCurrentThreadId () returned 0x970 [0073.281] GetCurrentThreadId () returned 0x970 [0073.281] GetCurrentThreadId () returned 0x970 [0073.281] GetCurrentThreadId () returned 0x970 [0073.281] GetCurrentThreadId () returned 0x970 [0073.281] GetCurrentThreadId () returned 0x970 [0073.281] GetCurrentThreadId () returned 0x970 [0073.281] GetCurrentThreadId () returned 0x970 [0073.281] GetCurrentThreadId () returned 0x970 [0073.281] GetCurrentThreadId () returned 0x970 [0073.281] GetCurrentThreadId () returned 0x970 [0073.282] GetCurrentThreadId () returned 0x970 [0073.282] GetCurrentThreadId () returned 0x970 [0073.282] GetCurrentThreadId () returned 0x970 [0073.282] GetCurrentThreadId () returned 0x970 [0073.282] GetCurrentThreadId () returned 0x970 [0073.282] GetCurrentThreadId () returned 0x970 [0073.282] GetCurrentThreadId () returned 0x970 [0073.282] GetCurrentThreadId () returned 0x970 [0073.282] GetCurrentThreadId () returned 0x970 [0073.282] GetCurrentThreadId () returned 0x970 [0073.282] GetCurrentThreadId () returned 0x970 [0073.282] GetCurrentThreadId () returned 0x970 [0073.282] GetCurrentThreadId () returned 0x970 [0073.282] GetCurrentThreadId () returned 0x970 [0073.282] GetCurrentThreadId () returned 0x970 [0073.282] GetCurrentThreadId () returned 0x970 [0073.282] GetCurrentThreadId () returned 0x970 [0073.282] GetCurrentThreadId () returned 0x970 [0073.282] GetCurrentThreadId () returned 0x970 [0073.282] GetCurrentThreadId () returned 0x970 [0073.282] GetCurrentThreadId () returned 0x970 [0073.282] GetCurrentThreadId () returned 0x970 [0073.282] GetCurrentThreadId () returned 0x970 [0073.282] GetCurrentThreadId () returned 0x970 [0073.282] GetCurrentThreadId () returned 0x970 [0073.282] GetCurrentThreadId () returned 0x970 [0073.282] GetCurrentThreadId () returned 0x970 [0073.282] GetCurrentThreadId () returned 0x970 [0073.282] GetCurrentThreadId () returned 0x970 [0073.282] GetCurrentThreadId () returned 0x970 [0073.282] GetCurrentThreadId () returned 0x970 [0073.282] GetCurrentThreadId () returned 0x970 [0073.282] GetCurrentThreadId () returned 0x970 [0073.282] GetCurrentThreadId () returned 0x970 [0073.282] GetCurrentThreadId () returned 0x970 [0073.282] GetCurrentThreadId () returned 0x970 [0073.283] GetCurrentThreadId () returned 0x970 [0073.283] GetCurrentThreadId () returned 0x970 [0073.283] GetCurrentThreadId () returned 0x970 [0073.283] GetCurrentThreadId () returned 0x970 [0073.283] GetCurrentThreadId () returned 0x970 [0073.283] GetCurrentThreadId () returned 0x970 [0073.283] GetCurrentThreadId () returned 0x970 [0073.283] GetCurrentThreadId () returned 0x970 [0073.283] GetCurrentThreadId () returned 0x970 [0073.283] GetCurrentThreadId () returned 0x970 [0073.283] GetCurrentThreadId () returned 0x970 [0073.283] GetCurrentThreadId () returned 0x970 [0073.283] GetCurrentThreadId () returned 0x970 [0073.283] GetCurrentThreadId () returned 0x970 [0073.283] GetCurrentThreadId () returned 0x970 [0073.283] GetCurrentThreadId () returned 0x970 [0073.283] GetCurrentThreadId () returned 0x970 [0073.283] GetCurrentThreadId () returned 0x970 [0073.283] GetCurrentThreadId () returned 0x970 [0073.283] GetCurrentThreadId () returned 0x970 [0073.283] GetCurrentThreadId () returned 0x970 [0073.283] GetCurrentThreadId () returned 0x970 [0073.283] GetCurrentThreadId () returned 0x970 [0073.283] GetCurrentThreadId () returned 0x970 [0073.283] GetCurrentThreadId () returned 0x970 [0073.283] GetCurrentThreadId () returned 0x970 [0073.283] GetCurrentThreadId () returned 0x970 [0073.283] GetCurrentThreadId () returned 0x970 [0073.283] GetCurrentThreadId () returned 0x970 [0073.283] GetCurrentThreadId () returned 0x970 [0073.283] GetCurrentThreadId () returned 0x970 [0073.283] GetCurrentThreadId () returned 0x970 [0073.283] GetCurrentThreadId () returned 0x970 [0073.283] GetCurrentThreadId () returned 0x970 [0073.283] GetCurrentThreadId () returned 0x970 [0073.283] GetCurrentThreadId () returned 0x970 [0073.284] GetCurrentThreadId () returned 0x970 [0073.284] GetCurrentThreadId () returned 0x970 [0073.284] GetCurrentThreadId () returned 0x970 [0073.284] GetCurrentThreadId () returned 0x970 [0073.284] GetCurrentThreadId () returned 0x970 [0073.284] GetCurrentThreadId () returned 0x970 [0073.284] GetCurrentThreadId () returned 0x970 [0073.284] GetCurrentThreadId () returned 0x970 [0073.284] GetCurrentThreadId () returned 0x970 [0073.284] GetCurrentThreadId () returned 0x970 [0073.284] GetCurrentThreadId () returned 0x970 [0073.284] GetCurrentThreadId () returned 0x970 [0073.284] GetCurrentThreadId () returned 0x970 [0073.284] GetCurrentThreadId () returned 0x970 [0073.284] GetCurrentThreadId () returned 0x970 [0073.284] GetCurrentThreadId () returned 0x970 [0073.284] GetCurrentThreadId () returned 0x970 [0073.284] GetCurrentThreadId () returned 0x970 [0073.284] GetCurrentThreadId () returned 0x970 [0073.284] GetCurrentThreadId () returned 0x970 [0073.284] GetCurrentThreadId () returned 0x970 [0073.284] GetCurrentThreadId () returned 0x970 [0073.284] GetCurrentThreadId () returned 0x970 [0073.284] GetCurrentThreadId () returned 0x970 [0073.284] GetCurrentThreadId () returned 0x970 [0073.284] GetCurrentThreadId () returned 0x970 [0073.284] GetCurrentThreadId () returned 0x970 [0073.284] GetCurrentThreadId () returned 0x970 [0073.284] GetCurrentThreadId () returned 0x970 [0073.284] GetCurrentThreadId () returned 0x970 [0073.284] GetCurrentThreadId () returned 0x970 [0073.284] GetCurrentThreadId () returned 0x970 [0073.284] GetCurrentThreadId () returned 0x970 [0073.284] GetCurrentThreadId () returned 0x970 [0073.284] GetCurrentThreadId () returned 0x970 [0073.284] GetCurrentThreadId () returned 0x970 [0073.284] GetCurrentThreadId () returned 0x970 [0073.284] GetCurrentThreadId () returned 0x970 [0073.284] GetCurrentThreadId () returned 0x970 [0073.284] GetCurrentThreadId () returned 0x970 [0073.284] GetCurrentThreadId () returned 0x970 [0073.285] GetCurrentThreadId () returned 0x970 [0073.285] GetCurrentThreadId () returned 0x970 [0073.285] GetCurrentThreadId () returned 0x970 [0073.285] GetCurrentThreadId () returned 0x970 [0073.285] GetCurrentThreadId () returned 0x970 [0073.285] GetCurrentThreadId () returned 0x970 [0073.285] GetCurrentThreadId () returned 0x970 [0073.285] GetCurrentThreadId () returned 0x970 [0073.285] GetCurrentThreadId () returned 0x970 [0073.285] GetCurrentThreadId () returned 0x970 [0073.285] GetCurrentThreadId () returned 0x970 [0073.285] GetCurrentThreadId () returned 0x970 [0073.285] GetCurrentThreadId () returned 0x970 [0073.285] GetCurrentThreadId () returned 0x970 [0073.285] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.285] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.285] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379f258, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0073.285] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.285] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.285] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379f258, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0073.285] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.285] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.285] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0073.285] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.285] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.285] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0073.285] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.285] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.285] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379f2b8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0073.285] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.285] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.285] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379f2b8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0073.286] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.286] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.286] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379f2b8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0073.286] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x14, wMilliseconds=0x226)) [0073.286] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LFbU)?:<8?5pzRUQL=$sa\\:&jO#+X%vA", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0073.286] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LFbU)?:<8?5pzRUQL=$sa\\:&jO#+X%vA", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0073.286] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LFbU)?:<8?5pzRUQL=$sa\\:&jO#+X%vA", cchWideChar=32, lpMultiByteStr=0x2005758, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LFbU)?:<8?5pzRUQL=$sa\\:&jO#+X%vA", lpUsedDefaultChar=0x0) returned 32 [0073.286] GetCurrentThreadId () returned 0x970 [0073.286] GetCurrentThreadId () returned 0x970 [0073.286] GetCurrentThreadId () returned 0x970 [0073.286] GetCurrentThreadId () returned 0x970 [0073.286] GetCurrentThreadId () returned 0x970 [0073.286] GetCurrentThreadId () returned 0x970 [0073.293] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0073.293] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0073.294] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x37b6c18, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0073.294] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ed248, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0073.294] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ed248, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAEKhk99nhwoGKmFCg6xILS+8GKV9ib4cP0nhiRS6xwb28p51qsalRymuD9G1XtR8U1vxLRWMNJRuvyUxwahx//Nnguc7bLq917rB5tasIm+h01q5pCXzzW3lt+JyVGOf9H+cF02PJLm5jnWsGnBTXTfvl/SFYKhO6mi68IArTmRf1kMUK0L6MjSZ7UFwaWTM36gnPTle1CF0289m+7pmn2gMhE9Ashxqbg==") returned 232 [0073.294] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x14, wMilliseconds=0x236)) [0073.294] GetCurrentThreadId () returned 0x970 [0073.294] GetCurrentThreadId () returned 0x970 [0073.294] GetCurrentThreadId () returned 0x970 [0073.294] GetCurrentThreadId () returned 0x970 [0073.294] GetCurrentThreadId () returned 0x970 [0073.294] GetCurrentThreadId () returned 0x970 [0073.294] GetCurrentThreadId () returned 0x970 [0073.294] GetCurrentThreadId () returned 0x970 [0073.294] GetCurrentThreadId () returned 0x970 [0073.294] GetCurrentThreadId () returned 0x970 [0073.294] GetCurrentThreadId () returned 0x970 [0073.294] GetCurrentThreadId () returned 0x970 [0073.294] GetCurrentThreadId () returned 0x970 [0073.294] GetCurrentThreadId () returned 0x970 [0073.294] GetCurrentThreadId () returned 0x970 [0073.294] GetCurrentThreadId () returned 0x970 [0073.294] GetCurrentThreadId () returned 0x970 [0073.294] GetCurrentThreadId () returned 0x970 [0073.294] GetCurrentThreadId () returned 0x970 [0073.294] GetCurrentThreadId () returned 0x970 [0073.294] GetCurrentThreadId () returned 0x970 [0073.294] GetCurrentThreadId () returned 0x970 [0073.294] GetCurrentThreadId () returned 0x970 [0073.294] GetCurrentThreadId () returned 0x970 [0073.294] GetCurrentThreadId () returned 0x970 [0073.294] GetCurrentThreadId () returned 0x970 [0073.294] GetCurrentThreadId () returned 0x970 [0073.294] GetCurrentThreadId () returned 0x970 [0073.294] GetCurrentThreadId () returned 0x970 [0073.294] GetCurrentThreadId () returned 0x970 [0073.294] GetCurrentThreadId () returned 0x970 [0073.294] GetCurrentThreadId () returned 0x970 [0073.294] GetCurrentThreadId () returned 0x970 [0073.294] GetCurrentThreadId () returned 0x970 [0073.294] GetCurrentThreadId () returned 0x970 [0073.294] GetCurrentThreadId () returned 0x970 [0073.295] GetCurrentThreadId () returned 0x970 [0073.295] GetCurrentThreadId () returned 0x970 [0073.295] GetCurrentThreadId () returned 0x970 [0073.295] GetCurrentThreadId () returned 0x970 [0073.295] GetCurrentThreadId () returned 0x970 [0073.295] GetCurrentThreadId () returned 0x970 [0073.295] GetCurrentThreadId () returned 0x970 [0073.295] GetCurrentThreadId () returned 0x970 [0073.295] GetCurrentThreadId () returned 0x970 [0073.295] GetCurrentThreadId () returned 0x970 [0073.295] GetCurrentThreadId () returned 0x970 [0073.295] GetCurrentThreadId () returned 0x970 [0073.295] GetCurrentThreadId () returned 0x970 [0073.295] GetCurrentThreadId () returned 0x970 [0073.295] GetCurrentThreadId () returned 0x970 [0073.295] GetCurrentThreadId () returned 0x970 [0073.295] GetCurrentThreadId () returned 0x970 [0073.295] GetCurrentThreadId () returned 0x970 [0073.295] GetCurrentThreadId () returned 0x970 [0073.295] GetCurrentThreadId () returned 0x970 [0073.295] GetCurrentThreadId () returned 0x970 [0073.295] GetCurrentThreadId () returned 0x970 [0073.295] GetCurrentThreadId () returned 0x970 [0073.295] GetCurrentThreadId () returned 0x970 [0073.295] GetCurrentThreadId () returned 0x970 [0073.295] GetCurrentThreadId () returned 0x970 [0073.295] GetCurrentThreadId () returned 0x970 [0073.295] GetCurrentThreadId () returned 0x970 [0073.295] GetCurrentThreadId () returned 0x970 [0073.295] GetCurrentThreadId () returned 0x970 [0073.295] GetCurrentThreadId () returned 0x970 [0073.295] GetCurrentThreadId () returned 0x970 [0073.295] GetCurrentThreadId () returned 0x970 [0073.295] GetCurrentThreadId () returned 0x970 [0073.295] GetCurrentThreadId () returned 0x970 [0073.295] GetCurrentThreadId () returned 0x970 [0073.295] GetCurrentThreadId () returned 0x970 [0073.295] GetCurrentThreadId () returned 0x970 [0073.295] GetCurrentThreadId () returned 0x970 [0073.295] GetCurrentThreadId () returned 0x970 [0073.295] GetCurrentThreadId () returned 0x970 [0073.295] GetCurrentThreadId () returned 0x970 [0073.296] GetCurrentThreadId () returned 0x970 [0073.296] GetCurrentThreadId () returned 0x970 [0073.296] GetCurrentThreadId () returned 0x970 [0073.296] GetCurrentThreadId () returned 0x970 [0073.296] GetCurrentThreadId () returned 0x970 [0073.296] GetCurrentThreadId () returned 0x970 [0073.296] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAEKhk99nhwoGKmFCg6xILS+8GKV9ib4cP0nhiRS6xwb28p51qsalRymuD9G1XtR8U1vxLRWMNJRuvyUxwahx//Nnguc7bLq917rB5tasIm+h01q5pCXzzW3lt+JyVGOf9H+cF02PJLm5jnWsGnBTXTfvl/SFYKhO6mi68IArTmRf1kMUK0L6MjSZ7UFwaWTM36gnPTle1CF0289m+7pmn2gMhE9Ashxqbg==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0073.296] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAEKhk99nhwoGKmFCg6xILS+8GKV9ib4cP0nhiRS6xwb28p51qsalRymuD9G1XtR8U1vxLRWMNJRuvyUxwahx//Nnguc7bLq917rB5tasIm+h01q5pCXzzW3lt+JyVGOf9H+cF02PJLm5jnWsGnBTXTfvl/SFYKhO6mi68IArTmRf1kMUK0L6MjSZ7UFwaWTM36gnPTle1CF0289m+7pmn2gMhE9Ashxqbg==", cchWideChar=245, lpMultiByteStr=0x353abac, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAEKhk99nhwoGKmFCg6xILS+8GKV9ib4cP0nhiRS6xwb28p51qsalRymuD9G1XtR8U1vxLRWMNJRuvyUxwahx//Nnguc7bLq917rB5tasIm+h01q5pCXzzW3lt+JyVGOf9H+cF02PJLm5jnWsGnBTXTfvl/SFYKhO6mi68IArTmRf1kMUK0L6MjSZ7UFwaWTM36gnPTle1CF0289m+7pmn2gMhE9Ashxqbg==", lpUsedDefaultChar=0x0) returned 245 [0073.296] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0073.296] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0073.296] CloseHandle (hObject=0x158) returned 1 [0073.296] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_buttongraphic.png")) returned 0 [0073.296] GetLastError () returned 0x5 [0073.296] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_buttongraphic.png")) returned 0x20 [0073.296] SetLastError (dwErrCode=0x5) [0073.296] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=19355996422) returned 1 [0073.297] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\Файл зашифрован [NavigationRight_SelectionSubpicture.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\Файл зашифрован [navigationright_selectionsubpicture.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0073.298] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0073.298] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0073.298] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0073.298] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0073.298] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0073.298] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0073.298] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0073.298] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0073.298] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0073.298] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0073.298] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0073.299] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0073.299] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0073.299] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0073.299] SetEndOfFile (hFile=0x158) returned 1 [0073.299] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0073.299] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0073.299] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0073.299] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0073.299] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0073.300] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0073.300] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M)XqU%)R6q+bfI/4@R=b8<)z+(\"#GU1n", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0073.300] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M)XqU%)R6q+bfI/4@R=b8<)z+(\"#GU1n", cchWideChar=32, lpMultiByteStr=0x20381a4, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M)XqU%)R6q+bfI/4@R=b8<)z+(\"#GU1n", lpUsedDefaultChar=0x0) returned 32 [0073.300] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0073.300] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0073.300] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa1441a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fa1441a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 0x295098 [0073.300] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0073.300] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0073.300] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_selectionsubpicture.png")) returned 0x20 [0073.301] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_selectionsubpicture.png")) returned 0x20 [0073.301] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_selectionsubpicture.png")) returned 0x20 [0073.301] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_selectionsubpicture.png")) returned 0x20 [0073.301] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_selectionsubpicture.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa1441a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fa1441a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e)) returned 1 [0073.301] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0073.301] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0073.301] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_selectionsubpicture.png")) returned 0x20 [0073.301] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_selectionsubpicture.png")) returned 0x20 [0073.301] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0073.301] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0073.301] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0073.301] SetEndOfFile (hFile=0x158) returned 1 [0073.302] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0073.302] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x20386ac, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0073.302] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0073.302] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x2038594, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0073.302] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x2038594, cbMultiByte=39, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="NavigationRight_SelectionSubpicture.pngg") returned 39 [0073.302] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0073.303] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x20386ac, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0073.303] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0073.303] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0073.303] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0xc2e [0073.303] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0073.303] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0073.303] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0073.303] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0073.303] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x20386ac, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0073.303] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0073.303] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x2038594, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0073.303] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x2038594, cbMultiByte=39, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="NavigationRight_SelectionSubpicture.pngre.pngg") returned 39 [0073.304] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0073.304] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x20386ac, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0073.304] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0073.304] CharToOemA (in: pSrc="NavigationRight_SelectionSubpicture.png", pDst=0x2038594 | out: pDst="NavigationRight_SelectionSubpicture.png") returned 1 [0073.304] WriteFile (in: hFile=0x158, lpBuffer=0x2038594*, nNumberOfBytesToWrite=0x27, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x2038594*, lpNumberOfBytesWritten=0x18e048*=0x27, lpOverlapped=0x0) returned 1 [0073.305] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0073.305] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0073.305] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0073.305] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=19356836406) returned 1 [0073.305] ReadFile (in: hFile=0x11c, lpBuffer=0x3b5bc20, nNumberOfBytesToRead=0xc2e, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b5bc20*, lpNumberOfBytesRead=0x18dd7c*=0xc2e, lpOverlapped=0x0) returned 1 [0073.307] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0073.307] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=19357056396) returned 1 [0073.317] WriteFile (in: hFile=0x158, lpBuffer=0x379ae28*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379ae28*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0073.317] ReadFile (in: hFile=0x11c, lpBuffer=0x3b5bc20, nNumberOfBytesToRead=0xc2e, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3b5bc20*, lpNumberOfBytesRead=0x18de38*=0xc2e, lpOverlapped=0x0) returned 1 [0073.317] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x62 [0073.317] WriteFile (in: hFile=0x158, lpBuffer=0x3b9e140*, nNumberOfBytesToWrite=0xc2e, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3b9e140*, lpNumberOfBytesWritten=0x18de10*=0xc2e, lpOverlapped=0x0) returned 1 [0073.317] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0xc90 [0073.318] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0073.318] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0073.318] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0073.318] SetFilePointer (in: hFile=0x158, lDistanceToMove=39, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x45 [0073.318] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0xc9a [0073.318] CloseHandle (hObject=0x11c) returned 1 [0073.318] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xc9a [0073.319] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xc9a [0073.319] SetFilePointer (in: hFile=0x158, lDistanceToMove=3226, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xc9a [0073.319] SetFilePointer (in: hFile=0x158, lDistanceToMove=3226, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0xc9a [0073.319] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xc9a [0073.319] SetFilePointer (in: hFile=0x158, lDistanceToMove=3226, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0xc9a [0073.319] SetEndOfFile (hFile=0x158) returned 1 [0073.319] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xc9a [0073.319] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xc9a [0073.319] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0073.319] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x2038594, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0073.319] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0073.319] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x20386ac, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0073.319] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x20386ac, cbMultiByte=39, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="NavigationRight_SelectionSubpicture.png") returned 39 [0073.319] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0073.319] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x2038594, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0073.319] WriteFile (in: hFile=0x158, lpBuffer=0x3b3f6f8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3b3f6f8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0073.320] CharToOemA (in: pSrc="NavigationRight_SelectionSubpicture.png", pDst=0x20386ac | out: pDst="NavigationRight_SelectionSubpicture.png") returned 1 [0073.320] WriteFile (in: hFile=0x158, lpBuffer=0x20386ac*, nNumberOfBytesToWrite=0x27, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x20386ac*, lpNumberOfBytesWritten=0x18efcc*=0x27, lpOverlapped=0x0) returned 1 [0073.320] WriteFile (in: hFile=0x158, lpBuffer=0x379ae18*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379ae18*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0073.320] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0073.320] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0073.320] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xcfa [0073.320] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xcfa [0073.320] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0073.320] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0073.320] DeleteFileW (lpFileName="") returned 0 [0073.320] GetLastError () returned 0x3 [0073.320] GetFileAttributesW (lpFileName="") returned 0xffffffff [0073.320] SetLastError (dwErrCode=0x3) [0073.320] FlushFileBuffers (hFile=0x158) returned 1 [0073.323] GetCurrentThreadId () returned 0x970 [0073.323] GetCurrentThreadId () returned 0x970 [0073.323] GetCurrentThreadId () returned 0x970 [0073.323] GetCurrentThreadId () returned 0x970 [0073.323] GetCurrentThreadId () returned 0x970 [0073.323] GetCurrentThreadId () returned 0x970 [0073.323] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xdb1 [0073.323] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xdb1 [0073.323] SetFilePointer (in: hFile=0x158, lDistanceToMove=3505, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xdb1 [0073.323] CloseHandle (hObject=0x158) returned 1 [0073.323] GetCurrentThreadId () returned 0x970 [0073.323] GetCurrentThreadId () returned 0x970 [0073.323] GetCurrentThreadId () returned 0x970 [0073.323] GetCurrentThreadId () returned 0x970 [0073.323] GetCurrentThreadId () returned 0x970 [0073.323] GetCurrentThreadId () returned 0x970 [0073.323] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\Файл зашифрован [NavigationRight_SelectionSubpicture.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\Файл зашифрован [navigationright_selectionsubpicture.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0073.323] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdb1 [0073.323] SetFilePointer (in: hFile=0x158, lDistanceToMove=3377, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd31 [0073.323] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0073.324] GetFileType (hFile=0x158) returned 0x1 [0073.324] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x14, wMilliseconds=0x255)) [0073.324] GetCurrentThreadId () returned 0x970 [0073.324] GetCurrentThreadId () returned 0x970 [0073.324] GetCurrentThreadId () returned 0x970 [0073.324] GetCurrentThreadId () returned 0x970 [0073.324] GetCurrentThreadId () returned 0x970 [0073.324] GetCurrentThreadId () returned 0x970 [0073.324] GetCurrentThreadId () returned 0x970 [0073.324] GetCurrentThreadId () returned 0x970 [0073.324] GetCurrentThreadId () returned 0x970 [0073.324] GetCurrentThreadId () returned 0x970 [0073.324] GetCurrentThreadId () returned 0x970 [0073.324] GetCurrentThreadId () returned 0x970 [0073.324] GetCurrentThreadId () returned 0x970 [0073.324] GetCurrentThreadId () returned 0x970 [0073.324] GetCurrentThreadId () returned 0x970 [0073.324] GetCurrentThreadId () returned 0x970 [0073.324] GetCurrentThreadId () returned 0x970 [0073.324] GetCurrentThreadId () returned 0x970 [0073.324] GetCurrentThreadId () returned 0x970 [0073.324] GetCurrentThreadId () returned 0x970 [0073.324] GetCurrentThreadId () returned 0x970 [0073.324] GetCurrentThreadId () returned 0x970 [0073.324] GetCurrentThreadId () returned 0x970 [0073.324] GetCurrentThreadId () returned 0x970 [0073.324] GetCurrentThreadId () returned 0x970 [0073.324] GetCurrentThreadId () returned 0x970 [0073.324] GetCurrentThreadId () returned 0x970 [0073.324] GetCurrentThreadId () returned 0x970 [0073.324] GetCurrentThreadId () returned 0x970 [0073.324] GetCurrentThreadId () returned 0x970 [0073.324] GetCurrentThreadId () returned 0x970 [0073.324] GetCurrentThreadId () returned 0x970 [0073.324] GetCurrentThreadId () returned 0x970 [0073.324] GetCurrentThreadId () returned 0x970 [0073.324] GetCurrentThreadId () returned 0x970 [0073.324] GetCurrentThreadId () returned 0x970 [0073.324] GetCurrentThreadId () returned 0x970 [0073.325] GetCurrentThreadId () returned 0x970 [0073.325] GetCurrentThreadId () returned 0x970 [0073.325] GetCurrentThreadId () returned 0x970 [0073.325] GetCurrentThreadId () returned 0x970 [0073.325] GetCurrentThreadId () returned 0x970 [0073.325] GetCurrentThreadId () returned 0x970 [0073.325] GetCurrentThreadId () returned 0x970 [0073.325] GetCurrentThreadId () returned 0x970 [0073.325] GetCurrentThreadId () returned 0x970 [0073.325] GetCurrentThreadId () returned 0x970 [0073.325] GetCurrentThreadId () returned 0x970 [0073.325] GetCurrentThreadId () returned 0x970 [0073.325] GetCurrentThreadId () returned 0x970 [0073.325] GetCurrentThreadId () returned 0x970 [0073.325] GetCurrentThreadId () returned 0x970 [0073.325] GetCurrentThreadId () returned 0x970 [0073.325] GetCurrentThreadId () returned 0x970 [0073.325] GetCurrentThreadId () returned 0x970 [0073.325] GetCurrentThreadId () returned 0x970 [0073.325] GetCurrentThreadId () returned 0x970 [0073.325] GetCurrentThreadId () returned 0x970 [0073.325] GetCurrentThreadId () returned 0x970 [0073.325] GetCurrentThreadId () returned 0x970 [0073.325] GetCurrentThreadId () returned 0x970 [0073.325] GetCurrentThreadId () returned 0x970 [0073.325] GetCurrentThreadId () returned 0x970 [0073.325] GetCurrentThreadId () returned 0x970 [0073.325] GetCurrentThreadId () returned 0x970 [0073.325] GetCurrentThreadId () returned 0x970 [0073.325] GetCurrentThreadId () returned 0x970 [0073.325] GetCurrentThreadId () returned 0x970 [0073.325] GetCurrentThreadId () returned 0x970 [0073.325] GetCurrentThreadId () returned 0x970 [0073.325] GetCurrentThreadId () returned 0x970 [0073.325] GetCurrentThreadId () returned 0x970 [0073.325] GetCurrentThreadId () returned 0x970 [0073.325] GetCurrentThreadId () returned 0x970 [0073.325] GetCurrentThreadId () returned 0x970 [0073.325] GetCurrentThreadId () returned 0x970 [0073.325] GetCurrentThreadId () returned 0x970 [0073.325] GetCurrentThreadId () returned 0x970 [0073.325] GetCurrentThreadId () returned 0x970 [0073.325] GetCurrentThreadId () returned 0x970 [0073.325] GetCurrentThreadId () returned 0x970 [0073.326] GetCurrentThreadId () returned 0x970 [0073.326] GetCurrentThreadId () returned 0x970 [0073.326] GetCurrentThreadId () returned 0x970 [0073.326] GetCurrentThreadId () returned 0x970 [0073.326] GetCurrentThreadId () returned 0x970 [0073.326] GetCurrentThreadId () returned 0x970 [0073.326] GetCurrentThreadId () returned 0x970 [0073.326] GetCurrentThreadId () returned 0x970 [0073.326] GetCurrentThreadId () returned 0x970 [0073.326] GetCurrentThreadId () returned 0x970 [0073.326] GetCurrentThreadId () returned 0x970 [0073.326] GetCurrentThreadId () returned 0x970 [0073.326] GetCurrentThreadId () returned 0x970 [0073.326] GetCurrentThreadId () returned 0x970 [0073.326] GetCurrentThreadId () returned 0x970 [0073.326] GetCurrentThreadId () returned 0x970 [0073.326] GetCurrentThreadId () returned 0x970 [0073.326] GetCurrentThreadId () returned 0x970 [0073.326] GetCurrentThreadId () returned 0x970 [0073.326] GetCurrentThreadId () returned 0x970 [0073.326] GetCurrentThreadId () returned 0x970 [0073.326] GetCurrentThreadId () returned 0x970 [0073.326] GetCurrentThreadId () returned 0x970 [0073.326] GetCurrentThreadId () returned 0x970 [0073.326] GetCurrentThreadId () returned 0x970 [0073.326] GetCurrentThreadId () returned 0x970 [0073.326] GetCurrentThreadId () returned 0x970 [0073.326] GetCurrentThreadId () returned 0x970 [0073.326] GetCurrentThreadId () returned 0x970 [0073.326] GetCurrentThreadId () returned 0x970 [0073.326] GetCurrentThreadId () returned 0x970 [0073.326] GetCurrentThreadId () returned 0x970 [0073.326] GetCurrentThreadId () returned 0x970 [0073.326] GetCurrentThreadId () returned 0x970 [0073.326] GetCurrentThreadId () returned 0x970 [0073.326] GetCurrentThreadId () returned 0x970 [0073.326] GetCurrentThreadId () returned 0x970 [0073.326] GetCurrentThreadId () returned 0x970 [0073.326] GetCurrentThreadId () returned 0x970 [0073.326] GetCurrentThreadId () returned 0x970 [0073.327] GetCurrentThreadId () returned 0x970 [0073.327] GetCurrentThreadId () returned 0x970 [0073.327] GetCurrentThreadId () returned 0x970 [0073.327] GetCurrentThreadId () returned 0x970 [0073.327] GetCurrentThreadId () returned 0x970 [0073.327] GetCurrentThreadId () returned 0x970 [0073.327] GetCurrentThreadId () returned 0x970 [0073.327] GetCurrentThreadId () returned 0x970 [0073.327] GetCurrentThreadId () returned 0x970 [0073.327] GetCurrentThreadId () returned 0x970 [0073.327] GetCurrentThreadId () returned 0x970 [0073.327] GetCurrentThreadId () returned 0x970 [0073.327] GetCurrentThreadId () returned 0x970 [0073.327] GetCurrentThreadId () returned 0x970 [0073.327] GetCurrentThreadId () returned 0x970 [0073.327] GetCurrentThreadId () returned 0x970 [0073.327] GetCurrentThreadId () returned 0x970 [0073.327] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.327] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.327] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379f2b8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0073.327] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.327] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.327] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379f2b8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0073.327] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.327] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.327] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0073.327] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.327] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.327] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0073.328] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.328] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.328] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379f318, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0073.328] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.328] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.328] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379f318, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0073.328] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.328] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.328] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379f318, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0073.328] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x14, wMilliseconds=0x255)) [0073.328] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="M)XqU%)R6q+bfI/4@R=b8<)z+(\"#GU1n", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0073.328] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="M)XqU%)R6q+bfI/4@R=b8<)z+(\"#GU1n", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0073.328] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="M)XqU%)R6q+bfI/4@R=b8<)z+(\"#GU1n", cchWideChar=32, lpMultiByteStr=0x2005788, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M)XqU%)R6q+bfI/4@R=b8<)z+(\"#GU1n", lpUsedDefaultChar=0x0) returned 32 [0073.328] GetCurrentThreadId () returned 0x970 [0073.328] GetCurrentThreadId () returned 0x970 [0073.328] GetCurrentThreadId () returned 0x970 [0073.328] GetCurrentThreadId () returned 0x970 [0073.328] GetCurrentThreadId () returned 0x970 [0073.328] GetCurrentThreadId () returned 0x970 [0073.336] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0073.336] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0073.336] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x37b6d08, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0073.336] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ed248, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0073.336] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ed248, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAABkfBB//93rLjatLZSS1+kXvwcrBtMsEV38s2fEmxYKN9uMXeccMBJHV66xjCfrZZGyNFVuh6HyYF/eHeHQrbrJqm/BD+iArOwRJUXsGaX/AHdA6I5axzhnUdaL72o/q/ZbitIo6qPPgRfOnD495UypRInXwzp0hPwx6PeNb+QwsXXazBqz2p8KDARMbkTT5g2iQ66nJS5IrO3Xy9OuY+BgEctZk+H2Ktw==") returned 232 [0073.336] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x14, wMilliseconds=0x265)) [0073.336] GetCurrentThreadId () returned 0x970 [0073.336] GetCurrentThreadId () returned 0x970 [0073.336] GetCurrentThreadId () returned 0x970 [0073.336] GetCurrentThreadId () returned 0x970 [0073.336] GetCurrentThreadId () returned 0x970 [0073.337] GetCurrentThreadId () returned 0x970 [0073.337] GetCurrentThreadId () returned 0x970 [0073.337] GetCurrentThreadId () returned 0x970 [0073.337] GetCurrentThreadId () returned 0x970 [0073.337] GetCurrentThreadId () returned 0x970 [0073.337] GetCurrentThreadId () returned 0x970 [0073.337] GetCurrentThreadId () returned 0x970 [0073.337] GetCurrentThreadId () returned 0x970 [0073.337] GetCurrentThreadId () returned 0x970 [0073.337] GetCurrentThreadId () returned 0x970 [0073.337] GetCurrentThreadId () returned 0x970 [0073.337] GetCurrentThreadId () returned 0x970 [0073.337] GetCurrentThreadId () returned 0x970 [0073.337] GetCurrentThreadId () returned 0x970 [0073.337] GetCurrentThreadId () returned 0x970 [0073.337] GetCurrentThreadId () returned 0x970 [0073.337] GetCurrentThreadId () returned 0x970 [0073.337] GetCurrentThreadId () returned 0x970 [0073.337] GetCurrentThreadId () returned 0x970 [0073.337] GetCurrentThreadId () returned 0x970 [0073.337] GetCurrentThreadId () returned 0x970 [0073.337] GetCurrentThreadId () returned 0x970 [0073.337] GetCurrentThreadId () returned 0x970 [0073.337] GetCurrentThreadId () returned 0x970 [0073.337] GetCurrentThreadId () returned 0x970 [0073.337] GetCurrentThreadId () returned 0x970 [0073.337] GetCurrentThreadId () returned 0x970 [0073.337] GetCurrentThreadId () returned 0x970 [0073.337] GetCurrentThreadId () returned 0x970 [0073.337] GetCurrentThreadId () returned 0x970 [0073.337] GetCurrentThreadId () returned 0x970 [0073.337] GetCurrentThreadId () returned 0x970 [0073.337] GetCurrentThreadId () returned 0x970 [0073.337] GetCurrentThreadId () returned 0x970 [0073.337] GetCurrentThreadId () returned 0x970 [0073.337] GetCurrentThreadId () returned 0x970 [0073.337] GetCurrentThreadId () returned 0x970 [0073.337] GetCurrentThreadId () returned 0x970 [0073.337] GetCurrentThreadId () returned 0x970 [0073.337] GetCurrentThreadId () returned 0x970 [0073.337] GetCurrentThreadId () returned 0x970 [0073.337] GetCurrentThreadId () returned 0x970 [0073.337] GetCurrentThreadId () returned 0x970 [0073.337] GetCurrentThreadId () returned 0x970 [0073.338] GetCurrentThreadId () returned 0x970 [0073.338] GetCurrentThreadId () returned 0x970 [0073.338] GetCurrentThreadId () returned 0x970 [0073.338] GetCurrentThreadId () returned 0x970 [0073.338] GetCurrentThreadId () returned 0x970 [0073.338] GetCurrentThreadId () returned 0x970 [0073.338] GetCurrentThreadId () returned 0x970 [0073.338] GetCurrentThreadId () returned 0x970 [0073.338] GetCurrentThreadId () returned 0x970 [0073.338] GetCurrentThreadId () returned 0x970 [0073.338] GetCurrentThreadId () returned 0x970 [0073.338] GetCurrentThreadId () returned 0x970 [0073.338] GetCurrentThreadId () returned 0x970 [0073.338] GetCurrentThreadId () returned 0x970 [0073.338] GetCurrentThreadId () returned 0x970 [0073.338] GetCurrentThreadId () returned 0x970 [0073.338] GetCurrentThreadId () returned 0x970 [0073.338] GetCurrentThreadId () returned 0x970 [0073.338] GetCurrentThreadId () returned 0x970 [0073.338] GetCurrentThreadId () returned 0x970 [0073.338] GetCurrentThreadId () returned 0x970 [0073.338] GetCurrentThreadId () returned 0x970 [0073.338] GetCurrentThreadId () returned 0x970 [0073.338] GetCurrentThreadId () returned 0x970 [0073.338] GetCurrentThreadId () returned 0x970 [0073.338] GetCurrentThreadId () returned 0x970 [0073.338] GetCurrentThreadId () returned 0x970 [0073.338] GetCurrentThreadId () returned 0x970 [0073.338] GetCurrentThreadId () returned 0x970 [0073.338] GetCurrentThreadId () returned 0x970 [0073.338] GetCurrentThreadId () returned 0x970 [0073.338] GetCurrentThreadId () returned 0x970 [0073.338] GetCurrentThreadId () returned 0x970 [0073.338] GetCurrentThreadId () returned 0x970 [0073.338] GetCurrentThreadId () returned 0x970 [0073.338] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAABkfBB//93rLjatLZSS1+kXvwcrBtMsEV38s2fEmxYKN9uMXeccMBJHV66xjCfrZZGyNFVuh6HyYF/eHeHQrbrJqm/BD+iArOwRJUXsGaX/AHdA6I5axzhnUdaL72o/q/ZbitIo6qPPgRfOnD495UypRInXwzp0hPwx6PeNb+QwsXXazBqz2p8KDARMbkTT5g2iQ66nJS5IrO3Xy9OuY+BgEctZk+H2Ktw==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0073.338] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAABkfBB//93rLjatLZSS1+kXvwcrBtMsEV38s2fEmxYKN9uMXeccMBJHV66xjCfrZZGyNFVuh6HyYF/eHeHQrbrJqm/BD+iArOwRJUXsGaX/AHdA6I5axzhnUdaL72o/q/ZbitIo6qPPgRfOnD495UypRInXwzp0hPwx6PeNb+QwsXXazBqz2p8KDARMbkTT5g2iQ66nJS5IrO3Xy9OuY+BgEctZk+H2Ktw==", cchWideChar=245, lpMultiByteStr=0x353acbc, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAABkfBB//93rLjatLZSS1+kXvwcrBtMsEV38s2fEmxYKN9uMXeccMBJHV66xjCfrZZGyNFVuh6HyYF/eHeHQrbrJqm/BD+iArOwRJUXsGaX/AHdA6I5axzhnUdaL72o/q/ZbitIo6qPPgRfOnD495UypRInXwzp0hPwx6PeNb+QwsXXazBqz2p8KDARMbkTT5g2iQ66nJS5IrO3Xy9OuY+BgEctZk+H2Ktw==", lpUsedDefaultChar=0x0) returned 245 [0073.338] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0073.339] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0073.339] CloseHandle (hObject=0x158) returned 1 [0073.339] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_selectionsubpicture.png")) returned 0 [0073.339] GetLastError () returned 0x5 [0073.339] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_selectionsubpicture.png")) returned 0x20 [0073.339] SetLastError (dwErrCode=0x5) [0073.339] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=19360255422) returned 1 [0073.339] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\Файл зашифрован [NavigationUp_ButtonGraphic.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\Файл зашифрован [navigationup_buttongraphic.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0073.340] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0073.340] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0073.340] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0073.340] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0073.340] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0073.340] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0073.340] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0073.340] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0073.340] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0073.340] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0073.340] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0073.340] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0073.340] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0073.340] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0073.340] SetEndOfFile (hFile=0x158) returned 1 [0073.341] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0073.341] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0073.341] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0073.341] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0073.341] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0073.342] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0073.342] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="8GN+xP/8WH~PbVEwzc9LrF%l6dqXJaFo", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0073.342] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="8GN+xP/8WH~PbVEwzc9LrF%l6dqXJaFo", cchWideChar=32, lpMultiByteStr=0x20386e4, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8GN+xP/8WH~PbVEwzc9LrF%l6dqXJaFo", lpUsedDefaultChar=0x0) returned 32 [0073.342] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0073.342] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0073.342] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f9ee2bd, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f9ee2bd, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 0x295098 [0073.342] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0073.342] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0073.342] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_buttongraphic.png")) returned 0x20 [0073.342] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_buttongraphic.png")) returned 0x20 [0073.342] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_buttongraphic.png")) returned 0x20 [0073.343] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_buttongraphic.png")) returned 0x20 [0073.343] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_buttongraphic.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f9ee2bd, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f9ee2bd, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b)) returned 1 [0073.343] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0073.343] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0073.343] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_buttongraphic.png")) returned 0x20 [0073.343] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_buttongraphic.png")) returned 0x20 [0073.343] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0073.343] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0073.343] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0073.343] SetEndOfFile (hFile=0x158) returned 1 [0073.344] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0073.344] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x200560c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0073.344] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0073.345] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x200563c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0073.345] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x200563c, cbMultiByte=30, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="NavigationUp_ButtonGraphic.pngpngre.pngg") returned 30 [0073.345] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0073.345] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x200560c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0073.345] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0073.345] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0073.345] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x135b [0073.345] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0073.345] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0073.345] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0073.345] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0073.345] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x200560c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0073.345] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0073.346] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x200563c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0073.346] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x200563c, cbMultiByte=30, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="NavigationUp_ButtonGraphic.pngic.pngpngre.pngg") returned 30 [0073.346] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0073.346] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x200560c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0073.346] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0073.347] CharToOemA (in: pSrc="NavigationUp_ButtonGraphic.png", pDst=0x200563c | out: pDst="NavigationUp_ButtonGraphic.png") returned 1 [0073.347] WriteFile (in: hFile=0x158, lpBuffer=0x200563c*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x200563c*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0073.347] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0073.347] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0073.347] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0073.347] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=19361044474) returned 1 [0073.347] ReadFile (in: hFile=0x11c, lpBuffer=0x3b5bc20, nNumberOfBytesToRead=0x135b, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b5bc20*, lpNumberOfBytesRead=0x18dd7c*=0x135b, lpOverlapped=0x0) returned 1 [0073.352] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0073.352] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=19361549860) returned 1 [0073.361] WriteFile (in: hFile=0x158, lpBuffer=0x379ad68*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379ad68*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0073.361] ReadFile (in: hFile=0x11c, lpBuffer=0x3b5bc20, nNumberOfBytesToRead=0x135b, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3b5bc20*, lpNumberOfBytesRead=0x18de38*=0x135b, lpOverlapped=0x0) returned 1 [0073.361] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x59 [0073.361] WriteFile (in: hFile=0x158, lpBuffer=0x3b9e840*, nNumberOfBytesToWrite=0x135b, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3b9e840*, lpNumberOfBytesWritten=0x18de10*=0x135b, lpOverlapped=0x0) returned 1 [0073.362] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x13b4 [0073.362] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0073.362] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0073.362] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0073.362] SetFilePointer (in: hFile=0x158, lDistanceToMove=30, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x3c [0073.362] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x13be [0073.362] CloseHandle (hObject=0x11c) returned 1 [0073.362] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x13be [0073.362] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x13be [0073.362] SetFilePointer (in: hFile=0x158, lDistanceToMove=5054, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x13be [0073.363] SetFilePointer (in: hFile=0x158, lDistanceToMove=5054, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x13be [0073.363] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x13be [0073.363] SetFilePointer (in: hFile=0x158, lDistanceToMove=5054, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x13be [0073.363] SetEndOfFile (hFile=0x158) returned 1 [0073.363] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x13be [0073.363] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x13be [0073.363] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0073.363] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x200563c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0073.363] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0073.363] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x200560c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0073.363] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x200560c, cbMultiByte=30, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="NavigationUp_ButtonGraphic.png䃌㫋ÆǏ፷") returned 30 [0073.363] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0073.363] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x200563c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0073.363] WriteFile (in: hFile=0x158, lpBuffer=0x3b3f6f8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3b3f6f8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0073.363] CharToOemA (in: pSrc="NavigationUp_ButtonGraphic.png", pDst=0x200560c | out: pDst="NavigationUp_ButtonGraphic.png") returned 1 [0073.363] WriteFile (in: hFile=0x158, lpBuffer=0x200560c*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x200560c*, lpNumberOfBytesWritten=0x18efcc*=0x1e, lpOverlapped=0x0) returned 1 [0073.364] WriteFile (in: hFile=0x158, lpBuffer=0x379ad88*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379ad88*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0073.364] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0073.364] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0073.364] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1415 [0073.364] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1415 [0073.364] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0073.364] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0073.364] DeleteFileW (lpFileName="") returned 0 [0073.364] GetLastError () returned 0x3 [0073.364] GetFileAttributesW (lpFileName="") returned 0xffffffff [0073.364] SetLastError (dwErrCode=0x3) [0073.364] FlushFileBuffers (hFile=0x158) returned 1 [0073.367] GetCurrentThreadId () returned 0x970 [0073.367] GetCurrentThreadId () returned 0x970 [0073.367] GetCurrentThreadId () returned 0x970 [0073.367] GetCurrentThreadId () returned 0x970 [0073.367] GetCurrentThreadId () returned 0x970 [0073.367] GetCurrentThreadId () returned 0x970 [0073.367] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x14cc [0073.368] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x14cc [0073.368] SetFilePointer (in: hFile=0x158, lDistanceToMove=5324, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x14cc [0073.368] CloseHandle (hObject=0x158) returned 1 [0073.368] GetCurrentThreadId () returned 0x970 [0073.368] GetCurrentThreadId () returned 0x970 [0073.368] GetCurrentThreadId () returned 0x970 [0073.368] GetCurrentThreadId () returned 0x970 [0073.368] GetCurrentThreadId () returned 0x970 [0073.368] GetCurrentThreadId () returned 0x970 [0073.368] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\Файл зашифрован [NavigationUp_ButtonGraphic.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\Файл зашифрован [navigationup_buttongraphic.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0073.368] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14cc [0073.368] SetFilePointer (in: hFile=0x158, lDistanceToMove=5196, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x144c [0073.368] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0073.368] GetFileType (hFile=0x158) returned 0x1 [0073.368] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x14, wMilliseconds=0x284)) [0073.368] GetCurrentThreadId () returned 0x970 [0073.368] GetCurrentThreadId () returned 0x970 [0073.368] GetCurrentThreadId () returned 0x970 [0073.368] GetCurrentThreadId () returned 0x970 [0073.368] GetCurrentThreadId () returned 0x970 [0073.368] GetCurrentThreadId () returned 0x970 [0073.369] GetCurrentThreadId () returned 0x970 [0073.369] GetCurrentThreadId () returned 0x970 [0073.369] GetCurrentThreadId () returned 0x970 [0073.369] GetCurrentThreadId () returned 0x970 [0073.369] GetCurrentThreadId () returned 0x970 [0073.369] GetCurrentThreadId () returned 0x970 [0073.369] GetCurrentThreadId () returned 0x970 [0073.369] GetCurrentThreadId () returned 0x970 [0073.369] GetCurrentThreadId () returned 0x970 [0073.369] GetCurrentThreadId () returned 0x970 [0073.369] GetCurrentThreadId () returned 0x970 [0073.369] GetCurrentThreadId () returned 0x970 [0073.369] GetCurrentThreadId () returned 0x970 [0073.369] GetCurrentThreadId () returned 0x970 [0073.369] GetCurrentThreadId () returned 0x970 [0073.369] GetCurrentThreadId () returned 0x970 [0073.369] GetCurrentThreadId () returned 0x970 [0073.369] GetCurrentThreadId () returned 0x970 [0073.369] GetCurrentThreadId () returned 0x970 [0073.369] GetCurrentThreadId () returned 0x970 [0073.369] GetCurrentThreadId () returned 0x970 [0073.369] GetCurrentThreadId () returned 0x970 [0073.369] GetCurrentThreadId () returned 0x970 [0073.369] GetCurrentThreadId () returned 0x970 [0073.369] GetCurrentThreadId () returned 0x970 [0073.369] GetCurrentThreadId () returned 0x970 [0073.369] GetCurrentThreadId () returned 0x970 [0073.369] GetCurrentThreadId () returned 0x970 [0073.369] GetCurrentThreadId () returned 0x970 [0073.369] GetCurrentThreadId () returned 0x970 [0073.369] GetCurrentThreadId () returned 0x970 [0073.369] GetCurrentThreadId () returned 0x970 [0073.369] GetCurrentThreadId () returned 0x970 [0073.369] GetCurrentThreadId () returned 0x970 [0073.369] GetCurrentThreadId () returned 0x970 [0073.369] GetCurrentThreadId () returned 0x970 [0073.369] GetCurrentThreadId () returned 0x970 [0073.369] GetCurrentThreadId () returned 0x970 [0073.369] GetCurrentThreadId () returned 0x970 [0073.369] GetCurrentThreadId () returned 0x970 [0073.369] GetCurrentThreadId () returned 0x970 [0073.369] GetCurrentThreadId () returned 0x970 [0073.369] GetCurrentThreadId () returned 0x970 [0073.369] GetCurrentThreadId () returned 0x970 [0073.369] GetCurrentThreadId () returned 0x970 [0073.370] GetCurrentThreadId () returned 0x970 [0073.370] GetCurrentThreadId () returned 0x970 [0073.370] GetCurrentThreadId () returned 0x970 [0073.370] GetCurrentThreadId () returned 0x970 [0073.370] GetCurrentThreadId () returned 0x970 [0073.370] GetCurrentThreadId () returned 0x970 [0073.370] GetCurrentThreadId () returned 0x970 [0073.370] GetCurrentThreadId () returned 0x970 [0073.370] GetCurrentThreadId () returned 0x970 [0073.370] GetCurrentThreadId () returned 0x970 [0073.370] GetCurrentThreadId () returned 0x970 [0073.370] GetCurrentThreadId () returned 0x970 [0073.370] GetCurrentThreadId () returned 0x970 [0073.370] GetCurrentThreadId () returned 0x970 [0073.370] GetCurrentThreadId () returned 0x970 [0073.370] GetCurrentThreadId () returned 0x970 [0073.370] GetCurrentThreadId () returned 0x970 [0073.370] GetCurrentThreadId () returned 0x970 [0073.370] GetCurrentThreadId () returned 0x970 [0073.370] GetCurrentThreadId () returned 0x970 [0073.370] GetCurrentThreadId () returned 0x970 [0073.370] GetCurrentThreadId () returned 0x970 [0073.370] GetCurrentThreadId () returned 0x970 [0073.370] GetCurrentThreadId () returned 0x970 [0073.370] GetCurrentThreadId () returned 0x970 [0073.370] GetCurrentThreadId () returned 0x970 [0073.370] GetCurrentThreadId () returned 0x970 [0073.370] GetCurrentThreadId () returned 0x970 [0073.370] GetCurrentThreadId () returned 0x970 [0073.370] GetCurrentThreadId () returned 0x970 [0073.370] GetCurrentThreadId () returned 0x970 [0073.370] GetCurrentThreadId () returned 0x970 [0073.370] GetCurrentThreadId () returned 0x970 [0073.370] GetCurrentThreadId () returned 0x970 [0073.370] GetCurrentThreadId () returned 0x970 [0073.370] GetCurrentThreadId () returned 0x970 [0073.370] GetCurrentThreadId () returned 0x970 [0073.370] GetCurrentThreadId () returned 0x970 [0073.370] GetCurrentThreadId () returned 0x970 [0073.370] GetCurrentThreadId () returned 0x970 [0073.370] GetCurrentThreadId () returned 0x970 [0073.370] GetCurrentThreadId () returned 0x970 [0073.370] GetCurrentThreadId () returned 0x970 [0073.370] GetCurrentThreadId () returned 0x970 [0073.370] GetCurrentThreadId () returned 0x970 [0073.371] GetCurrentThreadId () returned 0x970 [0073.371] GetCurrentThreadId () returned 0x970 [0073.371] GetCurrentThreadId () returned 0x970 [0073.371] GetCurrentThreadId () returned 0x970 [0073.371] GetCurrentThreadId () returned 0x970 [0073.371] GetCurrentThreadId () returned 0x970 [0073.371] GetCurrentThreadId () returned 0x970 [0073.371] GetCurrentThreadId () returned 0x970 [0073.371] GetCurrentThreadId () returned 0x970 [0073.371] GetCurrentThreadId () returned 0x970 [0073.371] GetCurrentThreadId () returned 0x970 [0073.371] GetCurrentThreadId () returned 0x970 [0073.371] GetCurrentThreadId () returned 0x970 [0073.371] GetCurrentThreadId () returned 0x970 [0073.371] GetCurrentThreadId () returned 0x970 [0073.371] GetCurrentThreadId () returned 0x970 [0073.371] GetCurrentThreadId () returned 0x970 [0073.371] GetCurrentThreadId () returned 0x970 [0073.371] GetCurrentThreadId () returned 0x970 [0073.371] GetCurrentThreadId () returned 0x970 [0073.371] GetCurrentThreadId () returned 0x970 [0073.371] GetCurrentThreadId () returned 0x970 [0073.371] GetCurrentThreadId () returned 0x970 [0073.371] GetCurrentThreadId () returned 0x970 [0073.371] GetCurrentThreadId () returned 0x970 [0073.371] GetCurrentThreadId () returned 0x970 [0073.371] GetCurrentThreadId () returned 0x970 [0073.371] GetCurrentThreadId () returned 0x970 [0073.371] GetCurrentThreadId () returned 0x970 [0073.371] GetCurrentThreadId () returned 0x970 [0073.371] GetCurrentThreadId () returned 0x970 [0073.371] GetCurrentThreadId () returned 0x970 [0073.371] GetCurrentThreadId () returned 0x970 [0073.371] GetCurrentThreadId () returned 0x970 [0073.371] GetCurrentThreadId () returned 0x970 [0073.371] GetCurrentThreadId () returned 0x970 [0073.371] GetCurrentThreadId () returned 0x970 [0073.371] GetCurrentThreadId () returned 0x970 [0073.371] GetCurrentThreadId () returned 0x970 [0073.371] GetCurrentThreadId () returned 0x970 [0073.371] GetCurrentThreadId () returned 0x970 [0073.371] GetCurrentThreadId () returned 0x970 [0073.371] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.371] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.371] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379f318, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0073.372] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.372] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.372] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379f318, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0073.372] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.372] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.372] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0073.372] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.372] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.372] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0073.372] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.372] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.372] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379f378, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0073.372] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.372] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.372] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379f378, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0073.372] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.372] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.372] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379f378, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0073.372] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x14, wMilliseconds=0x284)) [0073.372] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8GN+xP/8WH~PbVEwzc9LrF%l6dqXJaFo", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0073.372] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8GN+xP/8WH~PbVEwzc9LrF%l6dqXJaFo", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0073.372] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8GN+xP/8WH~PbVEwzc9LrF%l6dqXJaFo", cchWideChar=32, lpMultiByteStr=0x20057b8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8GN+xP/8WH~PbVEwzc9LrF%l6dqXJaFo", lpUsedDefaultChar=0x0) returned 32 [0073.372] GetCurrentThreadId () returned 0x970 [0073.372] GetCurrentThreadId () returned 0x970 [0073.372] GetCurrentThreadId () returned 0x970 [0073.372] GetCurrentThreadId () returned 0x970 [0073.372] GetCurrentThreadId () returned 0x970 [0073.372] GetCurrentThreadId () returned 0x970 [0073.380] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0073.380] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0073.380] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x37b6df8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0073.380] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ed348, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0073.380] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ed348, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAADI3K7M1Nho0S9ADFBpzN5lLnJrdOfCH7qQstCOA6SHx+5b8NyKo9HDG9cV1N+0JKT5Ae3yTOySLUk/JBiToZGaY5fHKLB38ioXx0L64hp3Ffs2HY0/+0vmP4MzWQTqRXLaNE8f+SfTioquqItFe3MkPpB6PlGsleF5Ml8MWC0dSqM94e9VfYuDXp3OCVQ94YeEP+k2nuhb9fh7BWeXAyWK04Drpns7O0w==") returned 232 [0073.380] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x14, wMilliseconds=0x284)) [0073.380] GetCurrentThreadId () returned 0x970 [0073.380] GetCurrentThreadId () returned 0x970 [0073.380] GetCurrentThreadId () returned 0x970 [0073.380] GetCurrentThreadId () returned 0x970 [0073.380] GetCurrentThreadId () returned 0x970 [0073.380] GetCurrentThreadId () returned 0x970 [0073.380] GetCurrentThreadId () returned 0x970 [0073.380] GetCurrentThreadId () returned 0x970 [0073.380] GetCurrentThreadId () returned 0x970 [0073.380] GetCurrentThreadId () returned 0x970 [0073.380] GetCurrentThreadId () returned 0x970 [0073.380] GetCurrentThreadId () returned 0x970 [0073.380] GetCurrentThreadId () returned 0x970 [0073.380] GetCurrentThreadId () returned 0x970 [0073.380] GetCurrentThreadId () returned 0x970 [0073.380] GetCurrentThreadId () returned 0x970 [0073.380] GetCurrentThreadId () returned 0x970 [0073.380] GetCurrentThreadId () returned 0x970 [0073.381] GetCurrentThreadId () returned 0x970 [0073.381] GetCurrentThreadId () returned 0x970 [0073.381] GetCurrentThreadId () returned 0x970 [0073.381] GetCurrentThreadId () returned 0x970 [0073.381] GetCurrentThreadId () returned 0x970 [0073.381] GetCurrentThreadId () returned 0x970 [0073.381] GetCurrentThreadId () returned 0x970 [0073.381] GetCurrentThreadId () returned 0x970 [0073.381] GetCurrentThreadId () returned 0x970 [0073.381] GetCurrentThreadId () returned 0x970 [0073.381] GetCurrentThreadId () returned 0x970 [0073.381] GetCurrentThreadId () returned 0x970 [0073.381] GetCurrentThreadId () returned 0x970 [0073.381] GetCurrentThreadId () returned 0x970 [0073.381] GetCurrentThreadId () returned 0x970 [0073.381] GetCurrentThreadId () returned 0x970 [0073.381] GetCurrentThreadId () returned 0x970 [0073.381] GetCurrentThreadId () returned 0x970 [0073.381] GetCurrentThreadId () returned 0x970 [0073.381] GetCurrentThreadId () returned 0x970 [0073.381] GetCurrentThreadId () returned 0x970 [0073.381] GetCurrentThreadId () returned 0x970 [0073.381] GetCurrentThreadId () returned 0x970 [0073.381] GetCurrentThreadId () returned 0x970 [0073.381] GetCurrentThreadId () returned 0x970 [0073.381] GetCurrentThreadId () returned 0x970 [0073.381] GetCurrentThreadId () returned 0x970 [0073.381] GetCurrentThreadId () returned 0x970 [0073.381] GetCurrentThreadId () returned 0x970 [0073.381] GetCurrentThreadId () returned 0x970 [0073.381] GetCurrentThreadId () returned 0x970 [0073.381] GetCurrentThreadId () returned 0x970 [0073.381] GetCurrentThreadId () returned 0x970 [0073.381] GetCurrentThreadId () returned 0x970 [0073.381] GetCurrentThreadId () returned 0x970 [0073.381] GetCurrentThreadId () returned 0x970 [0073.381] GetCurrentThreadId () returned 0x970 [0073.381] GetCurrentThreadId () returned 0x970 [0073.381] GetCurrentThreadId () returned 0x970 [0073.381] GetCurrentThreadId () returned 0x970 [0073.381] GetCurrentThreadId () returned 0x970 [0073.381] GetCurrentThreadId () returned 0x970 [0073.381] GetCurrentThreadId () returned 0x970 [0073.381] GetCurrentThreadId () returned 0x970 [0073.381] GetCurrentThreadId () returned 0x970 [0073.381] GetCurrentThreadId () returned 0x970 [0073.382] GetCurrentThreadId () returned 0x970 [0073.382] GetCurrentThreadId () returned 0x970 [0073.382] GetCurrentThreadId () returned 0x970 [0073.382] GetCurrentThreadId () returned 0x970 [0073.382] GetCurrentThreadId () returned 0x970 [0073.382] GetCurrentThreadId () returned 0x970 [0073.382] GetCurrentThreadId () returned 0x970 [0073.382] GetCurrentThreadId () returned 0x970 [0073.382] GetCurrentThreadId () returned 0x970 [0073.382] GetCurrentThreadId () returned 0x970 [0073.382] GetCurrentThreadId () returned 0x970 [0073.382] GetCurrentThreadId () returned 0x970 [0073.382] GetCurrentThreadId () returned 0x970 [0073.382] GetCurrentThreadId () returned 0x970 [0073.382] GetCurrentThreadId () returned 0x970 [0073.382] GetCurrentThreadId () returned 0x970 [0073.382] GetCurrentThreadId () returned 0x970 [0073.382] GetCurrentThreadId () returned 0x970 [0073.382] GetCurrentThreadId () returned 0x970 [0073.382] GetCurrentThreadId () returned 0x970 [0073.382] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAADI3K7M1Nho0S9ADFBpzN5lLnJrdOfCH7qQstCOA6SHx+5b8NyKo9HDG9cV1N+0JKT5Ae3yTOySLUk/JBiToZGaY5fHKLB38ioXx0L64hp3Ffs2HY0/+0vmP4MzWQTqRXLaNE8f+SfTioquqItFe3MkPpB6PlGsleF5Ml8MWC0dSqM94e9VfYuDXp3OCVQ94YeEP+k2nuhb9fh7BWeXAyWK04Drpns7O0w==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0073.382] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAADI3K7M1Nho0S9ADFBpzN5lLnJrdOfCH7qQstCOA6SHx+5b8NyKo9HDG9cV1N+0JKT5Ae3yTOySLUk/JBiToZGaY5fHKLB38ioXx0L64hp3Ffs2HY0/+0vmP4MzWQTqRXLaNE8f+SfTioquqItFe3MkPpB6PlGsleF5Ml8MWC0dSqM94e9VfYuDXp3OCVQ94YeEP+k2nuhb9fh7BWeXAyWK04Drpns7O0w==", cchWideChar=245, lpMultiByteStr=0x353adcc, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAADI3K7M1Nho0S9ADFBpzN5lLnJrdOfCH7qQstCOA6SHx+5b8NyKo9HDG9cV1N+0JKT5Ae3yTOySLUk/JBiToZGaY5fHKLB38ioXx0L64hp3Ffs2HY0/+0vmP4MzWQTqRXLaNE8f+SfTioquqItFe3MkPpB6PlGsleF5Ml8MWC0dSqM94e9VfYuDXp3OCVQ94YeEP+k2nuhb9fh7BWeXAyWK04Drpns7O0w==", lpUsedDefaultChar=0x0) returned 245 [0073.382] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0073.382] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0073.382] CloseHandle (hObject=0x158) returned 1 [0073.382] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_buttongraphic.png")) returned 0 [0073.383] GetLastError () returned 0x5 [0073.383] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_buttongraphic.png")) returned 0x20 [0073.383] SetLastError (dwErrCode=0x5) [0073.383] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=19364619821) returned 1 [0073.383] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\Файл зашифрован [NavigationUp_SelectionSubpicture.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\Файл зашифрован [navigationup_selectionsubpicture.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0073.383] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0073.383] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0073.383] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0073.383] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0073.384] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0073.384] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0073.384] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0073.384] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0073.384] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0073.384] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0073.384] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0073.384] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0073.384] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0073.384] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0073.384] SetEndOfFile (hFile=0x158) returned 1 [0073.384] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0073.384] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0073.384] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0073.384] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0073.384] WriteFile (in: hFile=0x158, lpBuffer=0x3777058*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777058*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0073.385] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0073.385] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d(A#ey):nN@c?@ZR1viWe72EM.NhXgn!", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0073.385] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d(A#ey):nN@c?@ZR1viWe72EM.NhXgn!", cchWideChar=32, lpMultiByteStr=0x20386ac, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="d(A#ey):nN@c?@ZR1viWe72EM.NhXgn!", lpUsedDefaultChar=0x0) returned 32 [0073.386] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0073.386] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0073.386] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa3a577, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fa3a577, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 0x295098 [0073.386] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0073.386] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0073.386] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_selectionsubpicture.png")) returned 0x20 [0073.386] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_selectionsubpicture.png")) returned 0x20 [0073.386] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_selectionsubpicture.png")) returned 0x20 [0073.386] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_selectionsubpicture.png")) returned 0x20 [0073.386] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_selectionsubpicture.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa3a577, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fa3a577, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09)) returned 1 [0073.386] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0073.386] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0073.386] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_selectionsubpicture.png")) returned 0x20 [0073.386] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_selectionsubpicture.png")) returned 0x20 [0073.386] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0073.387] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0073.387] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0073.387] SetEndOfFile (hFile=0x158) returned 1 [0073.387] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0073.387] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x2038754, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0073.388] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0073.388] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x2038594, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0073.388] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x2038594, cbMultiByte=36, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="NavigationUp_SelectionSubpicture.pngpngg") returned 36 [0073.388] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0073.388] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x2038754, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0073.388] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0073.388] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0073.388] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0xc09 [0073.388] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0073.388] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0073.388] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0073.388] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0073.388] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x2038754, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0073.388] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0073.388] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x2038594, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0073.389] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x2038594, cbMultiByte=36, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="NavigationUp_SelectionSubpicture.pngre.pngpngg") returned 36 [0073.389] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0073.389] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x2038754, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0073.389] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0073.390] CharToOemA (in: pSrc="NavigationUp_SelectionSubpicture.png", pDst=0x2038594 | out: pDst="NavigationUp_SelectionSubpicture.png") returned 1 [0073.390] WriteFile (in: hFile=0x158, lpBuffer=0x2038594*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x2038594*, lpNumberOfBytesWritten=0x18e048*=0x24, lpOverlapped=0x0) returned 1 [0073.390] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0073.390] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0073.390] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0073.390] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=19365358248) returned 1 [0073.390] ReadFile (in: hFile=0x11c, lpBuffer=0x3b5bc20, nNumberOfBytesToRead=0xc09, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b5bc20*, lpNumberOfBytesRead=0x18dd7c*=0xc09, lpOverlapped=0x0) returned 1 [0073.423] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0073.423] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=19368691077) returned 1 [0073.434] WriteFile (in: hFile=0x158, lpBuffer=0x379ad50*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379ad50*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0073.434] ReadFile (in: hFile=0x11c, lpBuffer=0x3b5bc20, nNumberOfBytesToRead=0xc09, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3b5bc20*, lpNumberOfBytesRead=0x18de38*=0xc09, lpOverlapped=0x0) returned 1 [0073.435] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x5f [0073.435] WriteFile (in: hFile=0x158, lpBuffer=0x3b9e040*, nNumberOfBytesToWrite=0xc09, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3b9e040*, lpNumberOfBytesWritten=0x18de10*=0xc09, lpOverlapped=0x0) returned 1 [0073.435] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0xc68 [0073.435] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0073.435] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0073.435] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0073.435] SetFilePointer (in: hFile=0x158, lDistanceToMove=36, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x42 [0073.435] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0xc72 [0073.435] CloseHandle (hObject=0x11c) returned 1 [0073.435] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xc72 [0073.436] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xc72 [0073.436] SetFilePointer (in: hFile=0x158, lDistanceToMove=3186, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xc72 [0073.436] SetFilePointer (in: hFile=0x158, lDistanceToMove=3186, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0xc72 [0073.436] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xc72 [0073.436] SetFilePointer (in: hFile=0x158, lDistanceToMove=3186, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0xc72 [0073.436] SetEndOfFile (hFile=0x158) returned 1 [0073.436] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xc72 [0073.436] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xc72 [0073.436] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0073.436] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x2038594, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0073.436] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0073.436] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x2038754, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0073.436] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x2038754, cbMultiByte=36, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="NavigationUp_SelectionSubpicture.pngఉ") returned 36 [0073.436] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0073.436] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x2038594, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0073.436] WriteFile (in: hFile=0x158, lpBuffer=0x3b3f6f8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3b3f6f8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0073.437] CharToOemA (in: pSrc="NavigationUp_SelectionSubpicture.png", pDst=0x2038754 | out: pDst="NavigationUp_SelectionSubpicture.png") returned 1 [0073.437] WriteFile (in: hFile=0x158, lpBuffer=0x2038754*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x2038754*, lpNumberOfBytesWritten=0x18efcc*=0x24, lpOverlapped=0x0) returned 1 [0073.437] WriteFile (in: hFile=0x158, lpBuffer=0x379ade8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379ade8*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0073.437] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0073.437] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0073.437] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xccf [0073.437] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xccf [0073.437] WriteFile (in: hFile=0x158, lpBuffer=0x3777058*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777058*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0073.438] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0073.438] DeleteFileW (lpFileName="") returned 0 [0073.438] GetLastError () returned 0x3 [0073.438] GetFileAttributesW (lpFileName="") returned 0xffffffff [0073.438] SetLastError (dwErrCode=0x3) [0073.438] FlushFileBuffers (hFile=0x158) returned 1 [0073.446] GetCurrentThreadId () returned 0x970 [0073.446] GetCurrentThreadId () returned 0x970 [0073.446] GetCurrentThreadId () returned 0x970 [0073.446] GetCurrentThreadId () returned 0x970 [0073.446] GetCurrentThreadId () returned 0x970 [0073.446] GetCurrentThreadId () returned 0x970 [0073.446] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xd86 [0073.446] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xd86 [0073.446] SetFilePointer (in: hFile=0x158, lDistanceToMove=3462, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xd86 [0073.446] CloseHandle (hObject=0x158) returned 1 [0073.446] GetCurrentThreadId () returned 0x970 [0073.446] GetCurrentThreadId () returned 0x970 [0073.446] GetCurrentThreadId () returned 0x970 [0073.446] GetCurrentThreadId () returned 0x970 [0073.446] GetCurrentThreadId () returned 0x970 [0073.446] GetCurrentThreadId () returned 0x970 [0073.446] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\Файл зашифрован [NavigationUp_SelectionSubpicture.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\Файл зашифрован [navigationup_selectionsubpicture.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0073.447] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd86 [0073.447] SetFilePointer (in: hFile=0x158, lDistanceToMove=3334, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd06 [0073.447] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0073.447] GetFileType (hFile=0x158) returned 0x1 [0073.447] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x14, wMilliseconds=0x2d2)) [0073.447] GetCurrentThreadId () returned 0x970 [0073.447] GetCurrentThreadId () returned 0x970 [0073.447] GetCurrentThreadId () returned 0x970 [0073.447] GetCurrentThreadId () returned 0x970 [0073.447] GetCurrentThreadId () returned 0x970 [0073.447] GetCurrentThreadId () returned 0x970 [0073.447] GetCurrentThreadId () returned 0x970 [0073.447] GetCurrentThreadId () returned 0x970 [0073.447] GetCurrentThreadId () returned 0x970 [0073.447] GetCurrentThreadId () returned 0x970 [0073.447] GetCurrentThreadId () returned 0x970 [0073.447] GetCurrentThreadId () returned 0x970 [0073.447] GetCurrentThreadId () returned 0x970 [0073.447] GetCurrentThreadId () returned 0x970 [0073.447] GetCurrentThreadId () returned 0x970 [0073.447] GetCurrentThreadId () returned 0x970 [0073.447] GetCurrentThreadId () returned 0x970 [0073.447] GetCurrentThreadId () returned 0x970 [0073.447] GetCurrentThreadId () returned 0x970 [0073.447] GetCurrentThreadId () returned 0x970 [0073.447] GetCurrentThreadId () returned 0x970 [0073.448] GetCurrentThreadId () returned 0x970 [0073.448] GetCurrentThreadId () returned 0x970 [0073.448] GetCurrentThreadId () returned 0x970 [0073.448] GetCurrentThreadId () returned 0x970 [0073.448] GetCurrentThreadId () returned 0x970 [0073.448] GetCurrentThreadId () returned 0x970 [0073.448] GetCurrentThreadId () returned 0x970 [0073.448] GetCurrentThreadId () returned 0x970 [0073.448] GetCurrentThreadId () returned 0x970 [0073.448] GetCurrentThreadId () returned 0x970 [0073.448] GetCurrentThreadId () returned 0x970 [0073.448] GetCurrentThreadId () returned 0x970 [0073.448] GetCurrentThreadId () returned 0x970 [0073.448] GetCurrentThreadId () returned 0x970 [0073.448] GetCurrentThreadId () returned 0x970 [0073.448] GetCurrentThreadId () returned 0x970 [0073.448] GetCurrentThreadId () returned 0x970 [0073.448] GetCurrentThreadId () returned 0x970 [0073.448] GetCurrentThreadId () returned 0x970 [0073.448] GetCurrentThreadId () returned 0x970 [0073.448] GetCurrentThreadId () returned 0x970 [0073.448] GetCurrentThreadId () returned 0x970 [0073.448] GetCurrentThreadId () returned 0x970 [0073.448] GetCurrentThreadId () returned 0x970 [0073.448] GetCurrentThreadId () returned 0x970 [0073.448] GetCurrentThreadId () returned 0x970 [0073.448] GetCurrentThreadId () returned 0x970 [0073.448] GetCurrentThreadId () returned 0x970 [0073.448] GetCurrentThreadId () returned 0x970 [0073.448] GetCurrentThreadId () returned 0x970 [0073.448] GetCurrentThreadId () returned 0x970 [0073.448] GetCurrentThreadId () returned 0x970 [0073.448] GetCurrentThreadId () returned 0x970 [0073.448] GetCurrentThreadId () returned 0x970 [0073.448] GetCurrentThreadId () returned 0x970 [0073.448] GetCurrentThreadId () returned 0x970 [0073.449] GetCurrentThreadId () returned 0x970 [0073.449] GetCurrentThreadId () returned 0x970 [0073.449] GetCurrentThreadId () returned 0x970 [0073.449] GetCurrentThreadId () returned 0x970 [0073.449] GetCurrentThreadId () returned 0x970 [0073.449] GetCurrentThreadId () returned 0x970 [0073.449] GetCurrentThreadId () returned 0x970 [0073.449] GetCurrentThreadId () returned 0x970 [0073.449] GetCurrentThreadId () returned 0x970 [0073.449] GetCurrentThreadId () returned 0x970 [0073.449] GetCurrentThreadId () returned 0x970 [0073.449] GetCurrentThreadId () returned 0x970 [0073.449] GetCurrentThreadId () returned 0x970 [0073.449] GetCurrentThreadId () returned 0x970 [0073.449] GetCurrentThreadId () returned 0x970 [0073.449] GetCurrentThreadId () returned 0x970 [0073.449] GetCurrentThreadId () returned 0x970 [0073.449] GetCurrentThreadId () returned 0x970 [0073.449] GetCurrentThreadId () returned 0x970 [0073.449] GetCurrentThreadId () returned 0x970 [0073.449] GetCurrentThreadId () returned 0x970 [0073.449] GetCurrentThreadId () returned 0x970 [0073.449] GetCurrentThreadId () returned 0x970 [0073.449] GetCurrentThreadId () returned 0x970 [0073.449] GetCurrentThreadId () returned 0x970 [0073.449] GetCurrentThreadId () returned 0x970 [0073.449] GetCurrentThreadId () returned 0x970 [0073.449] GetCurrentThreadId () returned 0x970 [0073.449] GetCurrentThreadId () returned 0x970 [0073.449] GetCurrentThreadId () returned 0x970 [0073.449] GetCurrentThreadId () returned 0x970 [0073.449] GetCurrentThreadId () returned 0x970 [0073.449] GetCurrentThreadId () returned 0x970 [0073.449] GetCurrentThreadId () returned 0x970 [0073.449] GetCurrentThreadId () returned 0x970 [0073.450] GetCurrentThreadId () returned 0x970 [0073.450] GetCurrentThreadId () returned 0x970 [0073.450] GetCurrentThreadId () returned 0x970 [0073.450] GetCurrentThreadId () returned 0x970 [0073.450] GetCurrentThreadId () returned 0x970 [0073.450] GetCurrentThreadId () returned 0x970 [0073.450] GetCurrentThreadId () returned 0x970 [0073.450] GetCurrentThreadId () returned 0x970 [0073.450] GetCurrentThreadId () returned 0x970 [0073.450] GetCurrentThreadId () returned 0x970 [0073.450] GetCurrentThreadId () returned 0x970 [0073.450] GetCurrentThreadId () returned 0x970 [0073.450] GetCurrentThreadId () returned 0x970 [0073.450] GetCurrentThreadId () returned 0x970 [0073.450] GetCurrentThreadId () returned 0x970 [0073.450] GetCurrentThreadId () returned 0x970 [0073.450] GetCurrentThreadId () returned 0x970 [0073.450] GetCurrentThreadId () returned 0x970 [0073.450] GetCurrentThreadId () returned 0x970 [0073.450] GetCurrentThreadId () returned 0x970 [0073.450] GetCurrentThreadId () returned 0x970 [0073.450] GetCurrentThreadId () returned 0x970 [0073.450] GetCurrentThreadId () returned 0x970 [0073.450] GetCurrentThreadId () returned 0x970 [0073.450] GetCurrentThreadId () returned 0x970 [0073.450] GetCurrentThreadId () returned 0x970 [0073.450] GetCurrentThreadId () returned 0x970 [0073.450] GetCurrentThreadId () returned 0x970 [0073.450] GetCurrentThreadId () returned 0x970 [0073.450] GetCurrentThreadId () returned 0x970 [0073.450] GetCurrentThreadId () returned 0x970 [0073.450] GetCurrentThreadId () returned 0x970 [0073.450] GetCurrentThreadId () returned 0x970 [0073.450] GetCurrentThreadId () returned 0x970 [0073.450] GetCurrentThreadId () returned 0x970 [0073.450] GetCurrentThreadId () returned 0x970 [0073.451] GetCurrentThreadId () returned 0x970 [0073.451] GetCurrentThreadId () returned 0x970 [0073.451] GetCurrentThreadId () returned 0x970 [0073.451] GetCurrentThreadId () returned 0x970 [0073.451] GetCurrentThreadId () returned 0x970 [0073.451] GetCurrentThreadId () returned 0x970 [0073.451] GetCurrentThreadId () returned 0x970 [0073.451] GetCurrentThreadId () returned 0x970 [0073.451] GetCurrentThreadId () returned 0x970 [0073.451] GetCurrentThreadId () returned 0x970 [0073.451] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.451] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.451] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379f378, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0073.451] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.451] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.451] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379f378, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0073.451] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.451] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.451] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0073.451] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.451] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.451] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0073.451] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.451] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.451] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379f3d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0073.451] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.451] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.451] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379f3d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0073.452] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.452] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.452] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379f3d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0073.452] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x14, wMilliseconds=0x2d2)) [0073.452] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="d(A#ey):nN@c?@ZR1viWe72EM.NhXgn!", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0073.452] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="d(A#ey):nN@c?@ZR1viWe72EM.NhXgn!", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0073.452] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="d(A#ey):nN@c?@ZR1viWe72EM.NhXgn!", cchWideChar=32, lpMultiByteStr=0x20057e8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="d(A#ey):nN@c?@ZR1viWe72EM.NhXgn!", lpUsedDefaultChar=0x0) returned 32 [0073.452] GetCurrentThreadId () returned 0x970 [0073.452] GetCurrentThreadId () returned 0x970 [0073.452] GetCurrentThreadId () returned 0x970 [0073.452] GetCurrentThreadId () returned 0x970 [0073.452] GetCurrentThreadId () returned 0x970 [0073.452] GetCurrentThreadId () returned 0x970 [0073.462] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0073.462] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0073.462] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x37b6df8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0073.462] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ed048, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0073.462] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ed048, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAEeTvvgD3cV+cPiM27WuriubjFwMC77k6aNW74H7vNz3EcyWVSqhv72SUdp2u6JvPOBf7yaOg3rZfWODgWLkSA+rkBdXU4IyM0Y76XLBSbxTCIGHs8xbra6xotoq7M57oS6/Nljn0BcQ9LHFHLVmM8cUzg1NYpbPgtugsfW/L3Zd/GCmB3laY5Iatqc3cO1C7TujS2xendc5Fur1VCtuituHp4wigDHB8Q==") returned 232 [0073.462] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x14, wMilliseconds=0x2e2)) [0073.462] GetCurrentThreadId () returned 0x970 [0073.462] GetCurrentThreadId () returned 0x970 [0073.462] GetCurrentThreadId () returned 0x970 [0073.462] GetCurrentThreadId () returned 0x970 [0073.462] GetCurrentThreadId () returned 0x970 [0073.462] GetCurrentThreadId () returned 0x970 [0073.462] GetCurrentThreadId () returned 0x970 [0073.462] GetCurrentThreadId () returned 0x970 [0073.462] GetCurrentThreadId () returned 0x970 [0073.462] GetCurrentThreadId () returned 0x970 [0073.463] GetCurrentThreadId () returned 0x970 [0073.463] GetCurrentThreadId () returned 0x970 [0073.463] GetCurrentThreadId () returned 0x970 [0073.463] GetCurrentThreadId () returned 0x970 [0073.463] GetCurrentThreadId () returned 0x970 [0073.463] GetCurrentThreadId () returned 0x970 [0073.463] GetCurrentThreadId () returned 0x970 [0073.463] GetCurrentThreadId () returned 0x970 [0073.463] GetCurrentThreadId () returned 0x970 [0073.463] GetCurrentThreadId () returned 0x970 [0073.463] GetCurrentThreadId () returned 0x970 [0073.463] GetCurrentThreadId () returned 0x970 [0073.463] GetCurrentThreadId () returned 0x970 [0073.463] GetCurrentThreadId () returned 0x970 [0073.463] GetCurrentThreadId () returned 0x970 [0073.463] GetCurrentThreadId () returned 0x970 [0073.463] GetCurrentThreadId () returned 0x970 [0073.463] GetCurrentThreadId () returned 0x970 [0073.463] GetCurrentThreadId () returned 0x970 [0073.463] GetCurrentThreadId () returned 0x970 [0073.463] GetCurrentThreadId () returned 0x970 [0073.463] GetCurrentThreadId () returned 0x970 [0073.463] GetCurrentThreadId () returned 0x970 [0073.463] GetCurrentThreadId () returned 0x970 [0073.463] GetCurrentThreadId () returned 0x970 [0073.463] GetCurrentThreadId () returned 0x970 [0073.463] GetCurrentThreadId () returned 0x970 [0073.463] GetCurrentThreadId () returned 0x970 [0073.463] GetCurrentThreadId () returned 0x970 [0073.463] GetCurrentThreadId () returned 0x970 [0073.463] GetCurrentThreadId () returned 0x970 [0073.463] GetCurrentThreadId () returned 0x970 [0073.463] GetCurrentThreadId () returned 0x970 [0073.463] GetCurrentThreadId () returned 0x970 [0073.463] GetCurrentThreadId () returned 0x970 [0073.463] GetCurrentThreadId () returned 0x970 [0073.463] GetCurrentThreadId () returned 0x970 [0073.464] GetCurrentThreadId () returned 0x970 [0073.464] GetCurrentThreadId () returned 0x970 [0073.464] GetCurrentThreadId () returned 0x970 [0073.464] GetCurrentThreadId () returned 0x970 [0073.464] GetCurrentThreadId () returned 0x970 [0073.464] GetCurrentThreadId () returned 0x970 [0073.464] GetCurrentThreadId () returned 0x970 [0073.464] GetCurrentThreadId () returned 0x970 [0073.464] GetCurrentThreadId () returned 0x970 [0073.464] GetCurrentThreadId () returned 0x970 [0073.464] GetCurrentThreadId () returned 0x970 [0073.464] GetCurrentThreadId () returned 0x970 [0073.464] GetCurrentThreadId () returned 0x970 [0073.464] GetCurrentThreadId () returned 0x970 [0073.464] GetCurrentThreadId () returned 0x970 [0073.464] GetCurrentThreadId () returned 0x970 [0073.464] GetCurrentThreadId () returned 0x970 [0073.464] GetCurrentThreadId () returned 0x970 [0073.464] GetCurrentThreadId () returned 0x970 [0073.464] GetCurrentThreadId () returned 0x970 [0073.464] GetCurrentThreadId () returned 0x970 [0073.464] GetCurrentThreadId () returned 0x970 [0073.464] GetCurrentThreadId () returned 0x970 [0073.464] GetCurrentThreadId () returned 0x970 [0073.464] GetCurrentThreadId () returned 0x970 [0073.464] GetCurrentThreadId () returned 0x970 [0073.464] GetCurrentThreadId () returned 0x970 [0073.464] GetCurrentThreadId () returned 0x970 [0073.464] GetCurrentThreadId () returned 0x970 [0073.464] GetCurrentThreadId () returned 0x970 [0073.464] GetCurrentThreadId () returned 0x970 [0073.464] GetCurrentThreadId () returned 0x970 [0073.464] GetCurrentThreadId () returned 0x970 [0073.465] GetCurrentThreadId () returned 0x970 [0073.465] GetCurrentThreadId () returned 0x970 [0073.465] GetCurrentThreadId () returned 0x970 [0073.465] GetCurrentThreadId () returned 0x970 [0073.465] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAEeTvvgD3cV+cPiM27WuriubjFwMC77k6aNW74H7vNz3EcyWVSqhv72SUdp2u6JvPOBf7yaOg3rZfWODgWLkSA+rkBdXU4IyM0Y76XLBSbxTCIGHs8xbra6xotoq7M57oS6/Nljn0BcQ9LHFHLVmM8cUzg1NYpbPgtugsfW/L3Zd/GCmB3laY5Iatqc3cO1C7TujS2xendc5Fur1VCtuituHp4wigDHB8Q==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0073.465] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAEeTvvgD3cV+cPiM27WuriubjFwMC77k6aNW74H7vNz3EcyWVSqhv72SUdp2u6JvPOBf7yaOg3rZfWODgWLkSA+rkBdXU4IyM0Y76XLBSbxTCIGHs8xbra6xotoq7M57oS6/Nljn0BcQ9LHFHLVmM8cUzg1NYpbPgtugsfW/L3Zd/GCmB3laY5Iatqc3cO1C7TujS2xendc5Fur1VCtuituHp4wigDHB8Q==", cchWideChar=245, lpMultiByteStr=0x353aedc, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAEeTvvgD3cV+cPiM27WuriubjFwMC77k6aNW74H7vNz3EcyWVSqhv72SUdp2u6JvPOBf7yaOg3rZfWODgWLkSA+rkBdXU4IyM0Y76XLBSbxTCIGHs8xbra6xotoq7M57oS6/Nljn0BcQ9LHFHLVmM8cUzg1NYpbPgtugsfW/L3Zd/GCmB3laY5Iatqc3cO1C7TujS2xendc5Fur1VCtuituHp4wigDHB8Q==", lpUsedDefaultChar=0x0) returned 245 [0073.465] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0073.465] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0073.465] CloseHandle (hObject=0x158) returned 1 [0073.465] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_selectionsubpicture.png")) returned 0 [0073.466] GetLastError () returned 0x5 [0073.466] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_selectionsubpicture.png")) returned 0x20 [0073.466] SetLastError (dwErrCode=0x5) [0073.466] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=19372933798) returned 1 [0073.466] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\Файл зашифрован [reflect.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\Файл зашифрован [reflect.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0073.467] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0073.467] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0073.467] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0073.467] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0073.467] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0073.467] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0073.467] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0073.467] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0073.467] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0073.467] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0073.467] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0073.467] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0073.467] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0073.468] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0073.468] SetEndOfFile (hFile=0x158) returned 1 [0073.468] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0073.468] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0073.468] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0073.468] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0073.468] WriteFile (in: hFile=0x158, lpBuffer=0x3777058*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777058*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0073.469] WriteFile (in: hFile=0x158, lpBuffer=0x35f035c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f035c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0073.470] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="^\":6LSNGoSh1pPw++7ZD22U*p(D", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0074.609] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TZ>X&>WOV\"R5>oSh1pPw++7ZD22U*p(D", cchWideChar=32, lpMultiByteStr=0x2038c24, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TZ>X&>WOV\"R5>oSh1pPw++7ZD22U*p(D", lpUsedDefaultChar=0x0) returned 32 [0074.609] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0074.609] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0074.609] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\scene_button_style_default_Thumbnail.bmp", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e91e8b0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e91e8b0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f204eff, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="scene_button_style_default_Thumbnail.bmp", cAlternateFileName="")) returned 0x295098 [0074.609] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0074.609] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0074.609] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\scene_button_style_default_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\scene_button_style_default_thumbnail.bmp")) returned 0x20 [0074.610] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\scene_button_style_default_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\scene_button_style_default_thumbnail.bmp")) returned 0x20 [0074.610] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\scene_button_style_default_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\scene_button_style_default_thumbnail.bmp")) returned 0x20 [0074.610] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\scene_button_style_default_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\scene_button_style_default_thumbnail.bmp")) returned 0x20 [0074.610] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\scene_button_style_default_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\scene_button_style_default_thumbnail.bmp"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e91e8b0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e91e8b0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f204eff, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0)) returned 1 [0074.610] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0074.610] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0074.610] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\scene_button_style_default_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\scene_button_style_default_thumbnail.bmp")) returned 0x20 [0074.610] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\scene_button_style_default_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\scene_button_style_default_thumbnail.bmp")) returned 0x20 [0074.610] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0074.610] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0074.610] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0074.610] SetEndOfFile (hFile=0x158) returned 1 [0074.611] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="scene_button_style_default_Thumbnail.bmp", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0074.611] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="scene_button_style_default_Thumbnail.bmp", cchWideChar=40, lpMultiByteStr=0x201c52c, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="scene_button_style_default_Thumbnail.bmp", lpUsedDefaultChar=0x0) returned 40 [0074.611] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="scene_button_style_default_Thumbnail.bmp", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0074.611] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="scene_button_style_default_Thumbnail.bmp", cchWideChar=40, lpMultiByteStr=0x201c6ec, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="scene_button_style_default_Thumbnail.bmp", lpUsedDefaultChar=0x0) returned 40 [0074.611] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x201c6ec, cbMultiByte=40, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="scene_button_style_default_Thumbnail.bmp") returned 40 [0074.612] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="scene_button_style_default_Thumbnail.bmp", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0074.612] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="scene_button_style_default_Thumbnail.bmp", cchWideChar=40, lpMultiByteStr=0x201c52c, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="scene_button_style_default_Thumbnail.bmp", lpUsedDefaultChar=0x0) returned 40 [0074.612] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\scene_button_style_default_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\scene_button_style_default_thumbnail.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0074.612] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0074.612] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x13d0 [0074.612] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0074.612] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0074.612] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0074.612] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="scene_button_style_default_Thumbnail.bmp", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0074.612] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="scene_button_style_default_Thumbnail.bmp", cchWideChar=40, lpMultiByteStr=0x201c52c, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="scene_button_style_default_Thumbnail.bmp", lpUsedDefaultChar=0x0) returned 40 [0074.612] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="scene_button_style_default_Thumbnail.bmp", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0074.612] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="scene_button_style_default_Thumbnail.bmp", cchWideChar=40, lpMultiByteStr=0x201c6ec, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="scene_button_style_default_Thumbnail.bmp", lpUsedDefaultChar=0x0) returned 40 [0074.613] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x201c6ec, cbMultiByte=40, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="scene_button_style_default_Thumbnail.bmpil.bmp") returned 40 [0074.613] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="scene_button_style_default_Thumbnail.bmp", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0074.613] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="scene_button_style_default_Thumbnail.bmp", cchWideChar=40, lpMultiByteStr=0x201c52c, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="scene_button_style_default_Thumbnail.bmp", lpUsedDefaultChar=0x0) returned 40 [0074.613] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0074.614] CharToOemA (in: pSrc="scene_button_style_default_Thumbnail.bmp", pDst=0x201c6ec | out: pDst="scene_button_style_default_Thumbnail.bmp") returned 1 [0074.614] WriteFile (in: hFile=0x158, lpBuffer=0x201c6ec*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x201c6ec*, lpNumberOfBytesWritten=0x18e048*=0x28, lpOverlapped=0x0) returned 1 [0074.614] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0074.614] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0074.614] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0074.615] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=19487805712) returned 1 [0074.615] ReadFile (in: hFile=0x11c, lpBuffer=0x3b62f50, nNumberOfBytesToRead=0x13d0, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b62f50*, lpNumberOfBytesRead=0x18dd7c*=0x13d0, lpOverlapped=0x0) returned 1 [0074.616] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0074.616] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=19487971622) returned 1 [0074.626] WriteFile (in: hFile=0x158, lpBuffer=0x379aca8*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379aca8*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0074.626] ReadFile (in: hFile=0x11c, lpBuffer=0x3b62f50, nNumberOfBytesToRead=0x13d0, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3b62f50*, lpNumberOfBytesRead=0x18de38*=0x13d0, lpOverlapped=0x0) returned 1 [0074.627] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x63 [0074.627] WriteFile (in: hFile=0x158, lpBuffer=0x3b95b40*, nNumberOfBytesToWrite=0x13d0, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3b95b40*, lpNumberOfBytesWritten=0x18de10*=0x13d0, lpOverlapped=0x0) returned 1 [0074.627] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x1433 [0074.627] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0074.627] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0074.627] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0074.627] SetFilePointer (in: hFile=0x158, lDistanceToMove=40, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x46 [0074.627] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x143d [0074.628] CloseHandle (hObject=0x11c) returned 1 [0074.628] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x143d [0074.628] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x143d [0074.628] SetFilePointer (in: hFile=0x158, lDistanceToMove=5181, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x143d [0074.628] SetFilePointer (in: hFile=0x158, lDistanceToMove=5181, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x143d [0074.628] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x143d [0074.628] SetFilePointer (in: hFile=0x158, lDistanceToMove=5181, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x143d [0074.628] SetEndOfFile (hFile=0x158) returned 1 [0074.628] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x143d [0074.628] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x143d [0074.629] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="scene_button_style_default_Thumbnail.bmp", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0074.629] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="scene_button_style_default_Thumbnail.bmp", cchWideChar=40, lpMultiByteStr=0x201c6ec, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="scene_button_style_default_Thumbnail.bmp", lpUsedDefaultChar=0x0) returned 40 [0074.629] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="scene_button_style_default_Thumbnail.bmp", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0074.629] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="scene_button_style_default_Thumbnail.bmp", cchWideChar=40, lpMultiByteStr=0x201c52c, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="scene_button_style_default_Thumbnail.bmp", lpUsedDefaultChar=0x0) returned 40 [0074.629] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x201c52c, cbMultiByte=40, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="scene_button_style_default_Thumbnail.bmp") returned 40 [0074.629] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="scene_button_style_default_Thumbnail.bmp", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0074.629] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="scene_button_style_default_Thumbnail.bmp", cchWideChar=40, lpMultiByteStr=0x201c6ec, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="scene_button_style_default_Thumbnail.bmp", lpUsedDefaultChar=0x0) returned 40 [0074.629] WriteFile (in: hFile=0x158, lpBuffer=0x3b46a28*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3b46a28*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0074.629] CharToOemA (in: pSrc="scene_button_style_default_Thumbnail.bmp", pDst=0x201c52c | out: pDst="scene_button_style_default_Thumbnail.bmp") returned 1 [0074.629] WriteFile (in: hFile=0x158, lpBuffer=0x201c52c*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x201c52c*, lpNumberOfBytesWritten=0x18efcc*=0x28, lpOverlapped=0x0) returned 1 [0074.629] WriteFile (in: hFile=0x158, lpBuffer=0x379ade8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379ade8*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0074.629] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0074.629] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0074.630] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x149e [0074.630] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x149e [0074.630] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0074.630] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0074.630] DeleteFileW (lpFileName="") returned 0 [0074.630] GetLastError () returned 0x3 [0074.630] GetFileAttributesW (lpFileName="") returned 0xffffffff [0074.630] SetLastError (dwErrCode=0x3) [0074.630] FlushFileBuffers (hFile=0x158) returned 1 [0074.632] GetCurrentThreadId () returned 0x970 [0074.632] GetCurrentThreadId () returned 0x970 [0074.632] GetCurrentThreadId () returned 0x970 [0074.632] GetCurrentThreadId () returned 0x970 [0074.632] GetCurrentThreadId () returned 0x970 [0074.633] GetCurrentThreadId () returned 0x970 [0074.633] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x1555 [0074.633] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x1555 [0074.633] SetFilePointer (in: hFile=0x158, lDistanceToMove=5461, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x1555 [0074.633] CloseHandle (hObject=0x158) returned 1 [0074.633] GetCurrentThreadId () returned 0x970 [0074.633] GetCurrentThreadId () returned 0x970 [0074.633] GetCurrentThreadId () returned 0x970 [0074.633] GetCurrentThreadId () returned 0x970 [0074.633] GetCurrentThreadId () returned 0x970 [0074.633] GetCurrentThreadId () returned 0x970 [0074.633] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Файл зашифрован [scene_button_style_default_Thumbnail.bmp].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\Файл зашифрован [scene_button_style_default_thumbnail.bmp].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0074.633] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1555 [0074.633] SetFilePointer (in: hFile=0x158, lDistanceToMove=5333, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x14d5 [0074.633] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0074.633] GetFileType (hFile=0x158) returned 0x1 [0074.633] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x15, wMilliseconds=0x38c)) [0074.634] GetCurrentThreadId () returned 0x970 [0074.634] GetCurrentThreadId () returned 0x970 [0074.634] GetCurrentThreadId () returned 0x970 [0074.634] GetCurrentThreadId () returned 0x970 [0074.634] GetCurrentThreadId () returned 0x970 [0074.634] GetCurrentThreadId () returned 0x970 [0074.634] GetCurrentThreadId () returned 0x970 [0074.634] GetCurrentThreadId () returned 0x970 [0074.634] GetCurrentThreadId () returned 0x970 [0074.634] GetCurrentThreadId () returned 0x970 [0074.634] GetCurrentThreadId () returned 0x970 [0074.634] GetCurrentThreadId () returned 0x970 [0074.634] GetCurrentThreadId () returned 0x970 [0074.634] GetCurrentThreadId () returned 0x970 [0074.634] GetCurrentThreadId () returned 0x970 [0074.634] GetCurrentThreadId () returned 0x970 [0074.634] GetCurrentThreadId () returned 0x970 [0074.634] GetCurrentThreadId () returned 0x970 [0074.634] GetCurrentThreadId () returned 0x970 [0074.634] GetCurrentThreadId () returned 0x970 [0074.634] GetCurrentThreadId () returned 0x970 [0074.634] GetCurrentThreadId () returned 0x970 [0074.634] GetCurrentThreadId () returned 0x970 [0074.634] GetCurrentThreadId () returned 0x970 [0074.634] GetCurrentThreadId () returned 0x970 [0074.634] GetCurrentThreadId () returned 0x970 [0074.634] GetCurrentThreadId () returned 0x970 [0074.634] GetCurrentThreadId () returned 0x970 [0074.634] GetCurrentThreadId () returned 0x970 [0074.634] GetCurrentThreadId () returned 0x970 [0074.634] GetCurrentThreadId () returned 0x970 [0074.634] GetCurrentThreadId () returned 0x970 [0074.634] GetCurrentThreadId () returned 0x970 [0074.634] GetCurrentThreadId () returned 0x970 [0074.634] GetCurrentThreadId () returned 0x970 [0074.634] GetCurrentThreadId () returned 0x970 [0074.634] GetCurrentThreadId () returned 0x970 [0074.634] GetCurrentThreadId () returned 0x970 [0074.634] GetCurrentThreadId () returned 0x970 [0074.634] GetCurrentThreadId () returned 0x970 [0074.635] GetCurrentThreadId () returned 0x970 [0074.635] GetCurrentThreadId () returned 0x970 [0074.635] GetCurrentThreadId () returned 0x970 [0074.635] GetCurrentThreadId () returned 0x970 [0074.635] GetCurrentThreadId () returned 0x970 [0074.635] GetCurrentThreadId () returned 0x970 [0074.635] GetCurrentThreadId () returned 0x970 [0074.635] GetCurrentThreadId () returned 0x970 [0074.635] GetCurrentThreadId () returned 0x970 [0074.635] GetCurrentThreadId () returned 0x970 [0074.635] GetCurrentThreadId () returned 0x970 [0074.635] GetCurrentThreadId () returned 0x970 [0074.635] GetCurrentThreadId () returned 0x970 [0074.635] GetCurrentThreadId () returned 0x970 [0074.635] GetCurrentThreadId () returned 0x970 [0074.635] GetCurrentThreadId () returned 0x970 [0074.635] GetCurrentThreadId () returned 0x970 [0074.635] GetCurrentThreadId () returned 0x970 [0074.635] GetCurrentThreadId () returned 0x970 [0074.635] GetCurrentThreadId () returned 0x970 [0074.635] GetCurrentThreadId () returned 0x970 [0074.635] GetCurrentThreadId () returned 0x970 [0074.635] GetCurrentThreadId () returned 0x970 [0074.635] GetCurrentThreadId () returned 0x970 [0074.635] GetCurrentThreadId () returned 0x970 [0074.635] GetCurrentThreadId () returned 0x970 [0074.635] GetCurrentThreadId () returned 0x970 [0074.635] GetCurrentThreadId () returned 0x970 [0074.635] GetCurrentThreadId () returned 0x970 [0074.635] GetCurrentThreadId () returned 0x970 [0074.635] GetCurrentThreadId () returned 0x970 [0074.635] GetCurrentThreadId () returned 0x970 [0074.635] GetCurrentThreadId () returned 0x970 [0074.635] GetCurrentThreadId () returned 0x970 [0074.635] GetCurrentThreadId () returned 0x970 [0074.635] GetCurrentThreadId () returned 0x970 [0074.636] GetCurrentThreadId () returned 0x970 [0074.636] GetCurrentThreadId () returned 0x970 [0074.636] GetCurrentThreadId () returned 0x970 [0074.636] GetCurrentThreadId () returned 0x970 [0074.636] GetCurrentThreadId () returned 0x970 [0074.636] GetCurrentThreadId () returned 0x970 [0074.636] GetCurrentThreadId () returned 0x970 [0074.636] GetCurrentThreadId () returned 0x970 [0074.636] GetCurrentThreadId () returned 0x970 [0074.636] GetCurrentThreadId () returned 0x970 [0074.636] GetCurrentThreadId () returned 0x970 [0074.636] GetCurrentThreadId () returned 0x970 [0074.636] GetCurrentThreadId () returned 0x970 [0074.636] GetCurrentThreadId () returned 0x970 [0074.636] GetCurrentThreadId () returned 0x970 [0074.636] GetCurrentThreadId () returned 0x970 [0074.636] GetCurrentThreadId () returned 0x970 [0074.636] GetCurrentThreadId () returned 0x970 [0074.636] GetCurrentThreadId () returned 0x970 [0074.636] GetCurrentThreadId () returned 0x970 [0074.636] GetCurrentThreadId () returned 0x970 [0074.636] GetCurrentThreadId () returned 0x970 [0074.636] GetCurrentThreadId () returned 0x970 [0074.636] GetCurrentThreadId () returned 0x970 [0074.636] GetCurrentThreadId () returned 0x970 [0074.636] GetCurrentThreadId () returned 0x970 [0074.636] GetCurrentThreadId () returned 0x970 [0074.636] GetCurrentThreadId () returned 0x970 [0074.636] GetCurrentThreadId () returned 0x970 [0074.636] GetCurrentThreadId () returned 0x970 [0074.636] GetCurrentThreadId () returned 0x970 [0074.636] GetCurrentThreadId () returned 0x970 [0074.636] GetCurrentThreadId () returned 0x970 [0074.636] GetCurrentThreadId () returned 0x970 [0074.636] GetCurrentThreadId () returned 0x970 [0074.636] GetCurrentThreadId () returned 0x970 [0074.636] GetCurrentThreadId () returned 0x970 [0074.637] GetCurrentThreadId () returned 0x970 [0074.637] GetCurrentThreadId () returned 0x970 [0074.637] GetCurrentThreadId () returned 0x970 [0074.637] GetCurrentThreadId () returned 0x970 [0074.637] GetCurrentThreadId () returned 0x970 [0074.637] GetCurrentThreadId () returned 0x970 [0074.637] GetCurrentThreadId () returned 0x970 [0074.637] GetCurrentThreadId () returned 0x970 [0074.637] GetCurrentThreadId () returned 0x970 [0074.637] GetCurrentThreadId () returned 0x970 [0074.637] GetCurrentThreadId () returned 0x970 [0074.637] GetCurrentThreadId () returned 0x970 [0074.637] GetCurrentThreadId () returned 0x970 [0074.637] GetCurrentThreadId () returned 0x970 [0074.637] GetCurrentThreadId () returned 0x970 [0074.637] GetCurrentThreadId () returned 0x970 [0074.637] GetCurrentThreadId () returned 0x970 [0074.637] GetCurrentThreadId () returned 0x970 [0074.637] GetCurrentThreadId () returned 0x970 [0074.637] GetCurrentThreadId () returned 0x970 [0074.637] GetCurrentThreadId () returned 0x970 [0074.637] GetCurrentThreadId () returned 0x970 [0074.637] GetCurrentThreadId () returned 0x970 [0074.637] GetCurrentThreadId () returned 0x970 [0074.637] GetCurrentThreadId () returned 0x970 [0074.637] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0074.637] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0074.637] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379fc78, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0074.637] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0074.637] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0074.637] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379fc78, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0074.637] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0074.638] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0074.638] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0074.638] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0074.638] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0074.638] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0074.638] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0074.638] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0074.638] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379fcd8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0074.638] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0074.638] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0074.638] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379fcd8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0074.638] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0074.638] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0074.638] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379fcd8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0074.638] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x15, wMilliseconds=0x38c)) [0074.638] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TZ>X&>WOV\"R5>oSh1pPw++7ZD22U*p(D", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0074.638] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TZ>X&>WOV\"R5>oSh1pPw++7ZD22U*p(D", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0074.638] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TZ>X&>WOV\"R5>oSh1pPw++7ZD22U*p(D", cchWideChar=32, lpMultiByteStr=0x2005c68, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TZ>X&>WOV\"R5>oSh1pPw++7ZD22U*p(D", lpUsedDefaultChar=0x0) returned 32 [0074.638] GetCurrentThreadId () returned 0x970 [0074.638] GetCurrentThreadId () returned 0x970 [0074.638] GetCurrentThreadId () returned 0x970 [0074.638] GetCurrentThreadId () returned 0x970 [0074.638] GetCurrentThreadId () returned 0x970 [0074.638] GetCurrentThreadId () returned 0x970 [0074.647] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0074.647] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0074.647] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3b3f458, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0074.647] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ed548, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0074.647] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ed548, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAHYIi9xCFe4QrN3TllryadanxuSLU9TyyePFOc+Wl7l6Sp4cU9Whi8bFtlFxZDlrBfeWEKRVEu8I/hKQKdbipQ0oOF7lKpT/2O8fvmUMJAJOzjX1LxhXQ8qqK0iaTY/wth8Ic0ZHQOk44dm94x4rySrXMoOSVJ8qepae70tzRYzTWHT87dXR65PUB++IFCo/Uh2gIHsdD+0Qbrje+J+oLJWAh/rXdGSh7A==") returned 232 [0074.647] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x15, wMilliseconds=0x39b)) [0074.647] GetCurrentThreadId () returned 0x970 [0074.647] GetCurrentThreadId () returned 0x970 [0074.647] GetCurrentThreadId () returned 0x970 [0074.647] GetCurrentThreadId () returned 0x970 [0074.647] GetCurrentThreadId () returned 0x970 [0074.647] GetCurrentThreadId () returned 0x970 [0074.647] GetCurrentThreadId () returned 0x970 [0074.647] GetCurrentThreadId () returned 0x970 [0074.647] GetCurrentThreadId () returned 0x970 [0074.647] GetCurrentThreadId () returned 0x970 [0074.648] GetCurrentThreadId () returned 0x970 [0074.648] GetCurrentThreadId () returned 0x970 [0074.648] GetCurrentThreadId () returned 0x970 [0074.648] GetCurrentThreadId () returned 0x970 [0074.648] GetCurrentThreadId () returned 0x970 [0074.648] GetCurrentThreadId () returned 0x970 [0074.648] GetCurrentThreadId () returned 0x970 [0074.648] GetCurrentThreadId () returned 0x970 [0074.648] GetCurrentThreadId () returned 0x970 [0074.648] GetCurrentThreadId () returned 0x970 [0074.648] GetCurrentThreadId () returned 0x970 [0074.648] GetCurrentThreadId () returned 0x970 [0074.648] GetCurrentThreadId () returned 0x970 [0074.648] GetCurrentThreadId () returned 0x970 [0074.648] GetCurrentThreadId () returned 0x970 [0074.648] GetCurrentThreadId () returned 0x970 [0074.648] GetCurrentThreadId () returned 0x970 [0074.648] GetCurrentThreadId () returned 0x970 [0074.648] GetCurrentThreadId () returned 0x970 [0074.648] GetCurrentThreadId () returned 0x970 [0074.648] GetCurrentThreadId () returned 0x970 [0074.648] GetCurrentThreadId () returned 0x970 [0074.648] GetCurrentThreadId () returned 0x970 [0074.648] GetCurrentThreadId () returned 0x970 [0074.648] GetCurrentThreadId () returned 0x970 [0074.648] GetCurrentThreadId () returned 0x970 [0074.648] GetCurrentThreadId () returned 0x970 [0074.648] GetCurrentThreadId () returned 0x970 [0074.648] GetCurrentThreadId () returned 0x970 [0074.648] GetCurrentThreadId () returned 0x970 [0074.648] GetCurrentThreadId () returned 0x970 [0074.648] GetCurrentThreadId () returned 0x970 [0074.648] GetCurrentThreadId () returned 0x970 [0074.648] GetCurrentThreadId () returned 0x970 [0074.648] GetCurrentThreadId () returned 0x970 [0074.648] GetCurrentThreadId () returned 0x970 [0074.649] GetCurrentThreadId () returned 0x970 [0074.649] GetCurrentThreadId () returned 0x970 [0074.649] GetCurrentThreadId () returned 0x970 [0074.649] GetCurrentThreadId () returned 0x970 [0074.649] GetCurrentThreadId () returned 0x970 [0074.649] GetCurrentThreadId () returned 0x970 [0074.649] GetCurrentThreadId () returned 0x970 [0074.649] GetCurrentThreadId () returned 0x970 [0074.649] GetCurrentThreadId () returned 0x970 [0074.649] GetCurrentThreadId () returned 0x970 [0074.649] GetCurrentThreadId () returned 0x970 [0074.649] GetCurrentThreadId () returned 0x970 [0074.649] GetCurrentThreadId () returned 0x970 [0074.649] GetCurrentThreadId () returned 0x970 [0074.649] GetCurrentThreadId () returned 0x970 [0074.649] GetCurrentThreadId () returned 0x970 [0074.649] GetCurrentThreadId () returned 0x970 [0074.649] GetCurrentThreadId () returned 0x970 [0074.649] GetCurrentThreadId () returned 0x970 [0074.649] GetCurrentThreadId () returned 0x970 [0074.649] GetCurrentThreadId () returned 0x970 [0074.649] GetCurrentThreadId () returned 0x970 [0074.649] GetCurrentThreadId () returned 0x970 [0074.649] GetCurrentThreadId () returned 0x970 [0074.649] GetCurrentThreadId () returned 0x970 [0074.649] GetCurrentThreadId () returned 0x970 [0074.649] GetCurrentThreadId () returned 0x970 [0074.649] GetCurrentThreadId () returned 0x970 [0074.649] GetCurrentThreadId () returned 0x970 [0074.649] GetCurrentThreadId () returned 0x970 [0074.649] GetCurrentThreadId () returned 0x970 [0074.649] GetCurrentThreadId () returned 0x970 [0074.649] GetCurrentThreadId () returned 0x970 [0074.649] GetCurrentThreadId () returned 0x970 [0074.649] GetCurrentThreadId () returned 0x970 [0074.649] GetCurrentThreadId () returned 0x970 [0074.649] GetCurrentThreadId () returned 0x970 [0074.650] GetCurrentThreadId () returned 0x970 [0074.650] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAHYIi9xCFe4QrN3TllryadanxuSLU9TyyePFOc+Wl7l6Sp4cU9Whi8bFtlFxZDlrBfeWEKRVEu8I/hKQKdbipQ0oOF7lKpT/2O8fvmUMJAJOzjX1LxhXQ8qqK0iaTY/wth8Ic0ZHQOk44dm94x4rySrXMoOSVJ8qepae70tzRYzTWHT87dXR65PUB++IFCo/Uh2gIHsdD+0Qbrje+J+oLJWAh/rXdGSh7A==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0074.650] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAHYIi9xCFe4QrN3TllryadanxuSLU9TyyePFOc+Wl7l6Sp4cU9Whi8bFtlFxZDlrBfeWEKRVEu8I/hKQKdbipQ0oOF7lKpT/2O8fvmUMJAJOzjX1LxhXQ8qqK0iaTY/wth8Ic0ZHQOk44dm94x4rySrXMoOSVJ8qepae70tzRYzTWHT87dXR65PUB++IFCo/Uh2gIHsdD+0Qbrje+J+oLJWAh/rXdGSh7A==", cchWideChar=245, lpMultiByteStr=0x353b0fc, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAHYIi9xCFe4QrN3TllryadanxuSLU9TyyePFOc+Wl7l6Sp4cU9Whi8bFtlFxZDlrBfeWEKRVEu8I/hKQKdbipQ0oOF7lKpT/2O8fvmUMJAJOzjX1LxhXQ8qqK0iaTY/wth8Ic0ZHQOk44dm94x4rySrXMoOSVJ8qepae70tzRYzTWHT87dXR65PUB++IFCo/Uh2gIHsdD+0Qbrje+J+oLJWAh/rXdGSh7A==", lpUsedDefaultChar=0x0) returned 245 [0074.650] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0074.650] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0074.650] CloseHandle (hObject=0x158) returned 1 [0074.650] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\scene_button_style_default_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\scene_button_style_default_thumbnail.bmp")) returned 0 [0074.650] GetLastError () returned 0x5 [0074.650] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\scene_button_style_default_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\scene_button_style_default_thumbnail.bmp")) returned 0x20 [0074.650] SetLastError (dwErrCode=0x5) [0074.650] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=19491381557) returned 1 [0074.650] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Файл зашифрован [shadowonlyframe_buttongraphic.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\Файл зашифрован [shadowonlyframe_buttongraphic.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0074.651] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0074.651] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0074.651] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0074.651] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0074.651] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0074.651] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0074.651] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0074.651] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0074.651] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0074.651] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0074.652] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0074.652] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0074.652] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0074.652] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0074.652] SetEndOfFile (hFile=0x158) returned 1 [0074.652] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0074.652] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0074.652] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0074.652] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0074.652] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0074.653] WriteFile (in: hFile=0x158, lpBuffer=0x35f035c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f035c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0074.653] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3B-4dG!1pI-}juPgh/uIi1w5)5>xV,)\"", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0074.653] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3B-4dG!1pI-}juPgh/uIi1w5)5>xV,)\"", cchWideChar=32, lpMultiByteStr=0x2038c5c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3B-4dG!1pI-}juPgh/uIi1w5)5>xV,)\"", lpUsedDefaultChar=0x0) returned 32 [0074.653] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0074.653] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0074.653] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_buttongraphic.png", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e8d25f6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e8d25f6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f204eff, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xd86, dwReserved0=0x0, dwReserved1=0x0, cFileName="shadowonlyframe_buttongraphic.png", cAlternateFileName="")) returned 0x295098 [0074.653] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0074.653] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0074.653] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_buttongraphic.png")) returned 0x20 [0074.654] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_buttongraphic.png")) returned 0x20 [0074.654] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_buttongraphic.png")) returned 0x20 [0074.654] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_buttongraphic.png")) returned 0x20 [0074.654] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_buttongraphic.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e8d25f6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e8d25f6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f204eff, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xd86)) returned 1 [0074.654] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0074.654] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0074.654] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_buttongraphic.png")) returned 0x20 [0074.654] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_buttongraphic.png")) returned 0x20 [0074.654] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0074.654] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0074.654] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0074.654] SetEndOfFile (hFile=0x158) returned 1 [0074.655] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="shadowonlyframe_buttongraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0074.655] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="shadowonlyframe_buttongraphic.png", cchWideChar=33, lpMultiByteStr=0x2038ccc, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shadowonlyframe_buttongraphic.png", lpUsedDefaultChar=0x0) returned 33 [0074.655] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="shadowonlyframe_buttongraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0074.655] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="shadowonlyframe_buttongraphic.png", cchWideChar=33, lpMultiByteStr=0x2038a9c, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shadowonlyframe_buttongraphic.png", lpUsedDefaultChar=0x0) returned 33 [0074.655] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x2038a9c, cbMultiByte=33, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="shadowonlyframe_buttongraphic.pngpil.bmp") returned 33 [0074.655] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="shadowonlyframe_buttongraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0074.655] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="shadowonlyframe_buttongraphic.png", cchWideChar=33, lpMultiByteStr=0x2038ccc, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shadowonlyframe_buttongraphic.png", lpUsedDefaultChar=0x0) returned 33 [0074.656] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0074.656] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0074.656] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0xd86 [0074.656] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0074.656] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0074.656] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0074.656] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="shadowonlyframe_buttongraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0074.656] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="shadowonlyframe_buttongraphic.png", cchWideChar=33, lpMultiByteStr=0x2038ccc, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shadowonlyframe_buttongraphic.png", lpUsedDefaultChar=0x0) returned 33 [0074.656] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="shadowonlyframe_buttongraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0074.656] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="shadowonlyframe_buttongraphic.png", cchWideChar=33, lpMultiByteStr=0x2038a9c, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shadowonlyframe_buttongraphic.png", lpUsedDefaultChar=0x0) returned 33 [0074.656] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x2038a9c, cbMultiByte=33, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="shadowonlyframe_buttongraphic.pngic.pngpil.bmp") returned 33 [0074.656] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="shadowonlyframe_buttongraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0074.656] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="shadowonlyframe_buttongraphic.png", cchWideChar=33, lpMultiByteStr=0x2038ccc, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shadowonlyframe_buttongraphic.png", lpUsedDefaultChar=0x0) returned 33 [0074.656] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0074.657] CharToOemA (in: pSrc="shadowonlyframe_buttongraphic.png", pDst=0x2038a9c | out: pDst="shadowonlyframe_buttongraphic.png") returned 1 [0074.657] WriteFile (in: hFile=0x158, lpBuffer=0x2038a9c*, nNumberOfBytesToWrite=0x21, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x2038a9c*, lpNumberOfBytesWritten=0x18e048*=0x21, lpOverlapped=0x0) returned 1 [0074.657] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0074.658] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0074.658] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0074.658] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=19492117392) returned 1 [0074.658] ReadFile (in: hFile=0x11c, lpBuffer=0x3b62f50, nNumberOfBytesToRead=0xd86, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b62f50*, lpNumberOfBytesRead=0x18dd7c*=0xd86, lpOverlapped=0x0) returned 1 [0074.659] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0074.659] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=19492259857) returned 1 [0074.668] WriteFile (in: hFile=0x158, lpBuffer=0x379ad20*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379ad20*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0074.668] ReadFile (in: hFile=0x11c, lpBuffer=0x3b62f50, nNumberOfBytesToRead=0xd86, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3b62f50*, lpNumberOfBytesRead=0x18de38*=0xd86, lpOverlapped=0x0) returned 1 [0074.668] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x5c [0074.668] WriteFile (in: hFile=0x158, lpBuffer=0x3b95540*, nNumberOfBytesToWrite=0xd86, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3b95540*, lpNumberOfBytesWritten=0x18de10*=0xd86, lpOverlapped=0x0) returned 1 [0074.668] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0xde2 [0074.669] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0074.669] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0074.669] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0074.669] SetFilePointer (in: hFile=0x158, lDistanceToMove=33, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x3f [0074.669] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0xdec [0074.669] CloseHandle (hObject=0x11c) returned 1 [0074.669] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xdec [0074.669] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xdec [0074.669] SetFilePointer (in: hFile=0x158, lDistanceToMove=3564, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xdec [0074.669] SetFilePointer (in: hFile=0x158, lDistanceToMove=3564, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0xdec [0074.669] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xdec [0074.669] SetFilePointer (in: hFile=0x158, lDistanceToMove=3564, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0xdec [0074.669] SetEndOfFile (hFile=0x158) returned 1 [0074.669] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xdec [0074.670] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xdec [0074.670] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="shadowonlyframe_buttongraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0074.670] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="shadowonlyframe_buttongraphic.png", cchWideChar=33, lpMultiByteStr=0x2038a9c, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shadowonlyframe_buttongraphic.png", lpUsedDefaultChar=0x0) returned 33 [0074.670] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="shadowonlyframe_buttongraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0074.670] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="shadowonlyframe_buttongraphic.png", cchWideChar=33, lpMultiByteStr=0x2038ccc, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shadowonlyframe_buttongraphic.png", lpUsedDefaultChar=0x0) returned 33 [0074.670] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x2038ccc, cbMultiByte=33, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="shadowonlyframe_buttongraphic.png멦ජ") returned 33 [0074.670] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="shadowonlyframe_buttongraphic.png", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0074.670] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="shadowonlyframe_buttongraphic.png", cchWideChar=33, lpMultiByteStr=0x2038a9c, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shadowonlyframe_buttongraphic.png", lpUsedDefaultChar=0x0) returned 33 [0074.670] WriteFile (in: hFile=0x158, lpBuffer=0x3b46a28*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3b46a28*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0074.670] CharToOemA (in: pSrc="shadowonlyframe_buttongraphic.png", pDst=0x2038ccc | out: pDst="shadowonlyframe_buttongraphic.png") returned 1 [0074.670] WriteFile (in: hFile=0x158, lpBuffer=0x2038ccc*, nNumberOfBytesToWrite=0x21, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x2038ccc*, lpNumberOfBytesWritten=0x18efcc*=0x21, lpOverlapped=0x0) returned 1 [0074.670] WriteFile (in: hFile=0x158, lpBuffer=0x379ae18*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379ae18*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0074.670] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0074.670] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0074.670] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xe46 [0074.670] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xe46 [0074.671] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0074.671] WriteFile (in: hFile=0x158, lpBuffer=0x35f035c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f035c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0074.671] DeleteFileW (lpFileName="") returned 0 [0074.671] GetLastError () returned 0x3 [0074.671] GetFileAttributesW (lpFileName="") returned 0xffffffff [0074.671] SetLastError (dwErrCode=0x3) [0074.671] FlushFileBuffers (hFile=0x158) returned 1 [0074.674] GetCurrentThreadId () returned 0x970 [0074.674] GetCurrentThreadId () returned 0x970 [0074.674] GetCurrentThreadId () returned 0x970 [0074.674] GetCurrentThreadId () returned 0x970 [0074.674] GetCurrentThreadId () returned 0x970 [0074.674] GetCurrentThreadId () returned 0x970 [0074.674] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xefd [0074.674] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xefd [0074.674] SetFilePointer (in: hFile=0x158, lDistanceToMove=3837, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xefd [0074.674] CloseHandle (hObject=0x158) returned 1 [0074.674] GetCurrentThreadId () returned 0x970 [0074.674] GetCurrentThreadId () returned 0x970 [0074.674] GetCurrentThreadId () returned 0x970 [0074.674] GetCurrentThreadId () returned 0x970 [0074.674] GetCurrentThreadId () returned 0x970 [0074.674] GetCurrentThreadId () returned 0x970 [0074.674] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Файл зашифрован [shadowonlyframe_buttongraphic.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\Файл зашифрован [shadowonlyframe_buttongraphic.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0074.675] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xefd [0074.675] SetFilePointer (in: hFile=0x158, lDistanceToMove=3709, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe7d [0074.675] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0074.675] GetFileType (hFile=0x158) returned 0x1 [0074.675] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x15, wMilliseconds=0x3ab)) [0074.675] GetCurrentThreadId () returned 0x970 [0074.675] GetCurrentThreadId () returned 0x970 [0074.675] GetCurrentThreadId () returned 0x970 [0074.675] GetCurrentThreadId () returned 0x970 [0074.675] GetCurrentThreadId () returned 0x970 [0074.675] GetCurrentThreadId () returned 0x970 [0074.675] GetCurrentThreadId () returned 0x970 [0074.675] GetCurrentThreadId () returned 0x970 [0074.675] GetCurrentThreadId () returned 0x970 [0074.675] GetCurrentThreadId () returned 0x970 [0074.675] GetCurrentThreadId () returned 0x970 [0074.675] GetCurrentThreadId () returned 0x970 [0074.675] GetCurrentThreadId () returned 0x970 [0074.675] GetCurrentThreadId () returned 0x970 [0074.675] GetCurrentThreadId () returned 0x970 [0074.675] GetCurrentThreadId () returned 0x970 [0074.675] GetCurrentThreadId () returned 0x970 [0074.675] GetCurrentThreadId () returned 0x970 [0074.675] GetCurrentThreadId () returned 0x970 [0074.675] GetCurrentThreadId () returned 0x970 [0074.675] GetCurrentThreadId () returned 0x970 [0074.675] GetCurrentThreadId () returned 0x970 [0074.675] GetCurrentThreadId () returned 0x970 [0074.675] GetCurrentThreadId () returned 0x970 [0074.675] GetCurrentThreadId () returned 0x970 [0074.675] GetCurrentThreadId () returned 0x970 [0074.675] GetCurrentThreadId () returned 0x970 [0074.675] GetCurrentThreadId () returned 0x970 [0074.675] GetCurrentThreadId () returned 0x970 [0074.675] GetCurrentThreadId () returned 0x970 [0074.676] GetCurrentThreadId () returned 0x970 [0074.676] GetCurrentThreadId () returned 0x970 [0074.676] GetCurrentThreadId () returned 0x970 [0074.676] GetCurrentThreadId () returned 0x970 [0074.676] GetCurrentThreadId () returned 0x970 [0074.676] GetCurrentThreadId () returned 0x970 [0074.676] GetCurrentThreadId () returned 0x970 [0074.676] GetCurrentThreadId () returned 0x970 [0074.676] GetCurrentThreadId () returned 0x970 [0074.676] GetCurrentThreadId () returned 0x970 [0074.676] GetCurrentThreadId () returned 0x970 [0074.676] GetCurrentThreadId () returned 0x970 [0074.676] GetCurrentThreadId () returned 0x970 [0074.676] GetCurrentThreadId () returned 0x970 [0074.676] GetCurrentThreadId () returned 0x970 [0074.676] GetCurrentThreadId () returned 0x970 [0074.676] GetCurrentThreadId () returned 0x970 [0074.676] GetCurrentThreadId () returned 0x970 [0074.676] GetCurrentThreadId () returned 0x970 [0074.676] GetCurrentThreadId () returned 0x970 [0074.676] GetCurrentThreadId () returned 0x970 [0074.676] GetCurrentThreadId () returned 0x970 [0074.676] GetCurrentThreadId () returned 0x970 [0074.676] GetCurrentThreadId () returned 0x970 [0074.676] GetCurrentThreadId () returned 0x970 [0074.676] GetCurrentThreadId () returned 0x970 [0074.676] GetCurrentThreadId () returned 0x970 [0074.676] GetCurrentThreadId () returned 0x970 [0074.676] GetCurrentThreadId () returned 0x970 [0074.676] GetCurrentThreadId () returned 0x970 [0074.676] GetCurrentThreadId () returned 0x970 [0074.676] GetCurrentThreadId () returned 0x970 [0074.676] GetCurrentThreadId () returned 0x970 [0074.676] GetCurrentThreadId () returned 0x970 [0074.676] GetCurrentThreadId () returned 0x970 [0074.676] GetCurrentThreadId () returned 0x970 [0074.676] GetCurrentThreadId () returned 0x970 [0074.676] GetCurrentThreadId () returned 0x970 [0074.676] GetCurrentThreadId () returned 0x970 [0074.676] GetCurrentThreadId () returned 0x970 [0074.676] GetCurrentThreadId () returned 0x970 [0074.676] GetCurrentThreadId () returned 0x970 [0074.676] GetCurrentThreadId () returned 0x970 [0074.676] GetCurrentThreadId () returned 0x970 [0074.676] GetCurrentThreadId () returned 0x970 [0074.677] GetCurrentThreadId () returned 0x970 [0074.677] GetCurrentThreadId () returned 0x970 [0074.677] GetCurrentThreadId () returned 0x970 [0074.677] GetCurrentThreadId () returned 0x970 [0074.677] GetCurrentThreadId () returned 0x970 [0074.677] GetCurrentThreadId () returned 0x970 [0074.677] GetCurrentThreadId () returned 0x970 [0074.677] GetCurrentThreadId () returned 0x970 [0074.677] GetCurrentThreadId () returned 0x970 [0074.677] GetCurrentThreadId () returned 0x970 [0074.677] GetCurrentThreadId () returned 0x970 [0074.677] GetCurrentThreadId () returned 0x970 [0074.677] GetCurrentThreadId () returned 0x970 [0074.677] GetCurrentThreadId () returned 0x970 [0074.677] GetCurrentThreadId () returned 0x970 [0074.677] GetCurrentThreadId () returned 0x970 [0074.677] GetCurrentThreadId () returned 0x970 [0074.677] GetCurrentThreadId () returned 0x970 [0074.677] GetCurrentThreadId () returned 0x970 [0074.677] GetCurrentThreadId () returned 0x970 [0074.677] GetCurrentThreadId () returned 0x970 [0074.677] GetCurrentThreadId () returned 0x970 [0074.677] GetCurrentThreadId () returned 0x970 [0074.677] GetCurrentThreadId () returned 0x970 [0074.677] GetCurrentThreadId () returned 0x970 [0074.677] GetCurrentThreadId () returned 0x970 [0074.677] GetCurrentThreadId () returned 0x970 [0074.677] GetCurrentThreadId () returned 0x970 [0074.677] GetCurrentThreadId () returned 0x970 [0074.677] GetCurrentThreadId () returned 0x970 [0074.677] GetCurrentThreadId () returned 0x970 [0074.677] GetCurrentThreadId () returned 0x970 [0074.677] GetCurrentThreadId () returned 0x970 [0074.677] GetCurrentThreadId () returned 0x970 [0074.677] GetCurrentThreadId () returned 0x970 [0074.677] GetCurrentThreadId () returned 0x970 [0074.677] GetCurrentThreadId () returned 0x970 [0074.677] GetCurrentThreadId () returned 0x970 [0074.677] GetCurrentThreadId () returned 0x970 [0074.677] GetCurrentThreadId () returned 0x970 [0074.677] GetCurrentThreadId () returned 0x970 [0074.677] GetCurrentThreadId () returned 0x970 [0074.677] GetCurrentThreadId () returned 0x970 [0074.677] GetCurrentThreadId () returned 0x970 [0074.678] GetCurrentThreadId () returned 0x970 [0074.678] GetCurrentThreadId () returned 0x970 [0074.678] GetCurrentThreadId () returned 0x970 [0074.678] GetCurrentThreadId () returned 0x970 [0074.678] GetCurrentThreadId () returned 0x970 [0074.678] GetCurrentThreadId () returned 0x970 [0074.678] GetCurrentThreadId () returned 0x970 [0074.678] GetCurrentThreadId () returned 0x970 [0074.678] GetCurrentThreadId () returned 0x970 [0074.678] GetCurrentThreadId () returned 0x970 [0074.678] GetCurrentThreadId () returned 0x970 [0074.678] GetCurrentThreadId () returned 0x970 [0074.678] GetCurrentThreadId () returned 0x970 [0074.678] GetCurrentThreadId () returned 0x970 [0074.678] GetCurrentThreadId () returned 0x970 [0074.678] GetCurrentThreadId () returned 0x970 [0074.678] GetCurrentThreadId () returned 0x970 [0074.678] GetCurrentThreadId () returned 0x970 [0074.678] GetCurrentThreadId () returned 0x970 [0074.678] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0074.678] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0074.678] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379fcd8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0074.678] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0074.678] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0074.678] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379fcd8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0074.678] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0074.678] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0074.678] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0074.678] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0074.678] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0074.678] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0074.678] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0074.678] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0074.678] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379fd38, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0074.678] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0074.678] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0074.678] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379fd38, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0074.679] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0074.679] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0074.679] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379fd38, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0074.679] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x15, wMilliseconds=0x3ba)) [0074.679] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="3B-4dG!1pI-}juPgh/uIi1w5)5>xV,)\"", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0074.679] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="3B-4dG!1pI-}juPgh/uIi1w5)5>xV,)\"", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0074.679] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="3B-4dG!1pI-}juPgh/uIi1w5)5>xV,)\"", cchWideChar=32, lpMultiByteStr=0x2005c98, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3B-4dG!1pI-}juPgh/uIi1w5)5>xV,)\"", lpUsedDefaultChar=0x0) returned 32 [0074.679] GetCurrentThreadId () returned 0x970 [0074.679] GetCurrentThreadId () returned 0x970 [0074.679] GetCurrentThreadId () returned 0x970 [0074.679] GetCurrentThreadId () returned 0x970 [0074.679] GetCurrentThreadId () returned 0x970 [0074.679] GetCurrentThreadId () returned 0x970 [0074.687] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0074.687] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0074.687] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3b3f548, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0074.687] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ed448, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0074.687] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ed448, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAACwtSjAjeCmaQWqHDow0ID6VqOFgsF2YrsrfI1kknlbGDNtHsmVR6S7bTpEHuBISZh2LXtN66NOLT2Q6Ioyb1MQIgyXjE4pl4mYvzWjGQrFpyKBoAKzcVROBBKKYFZg3T+/w+h8dTmRcHQyAA14D2PssEb6GCkKeSPc7tC/yS9wjlmxCAzDsCnrrotkwzXA9fAZZyfeEalg2ZJwjmI/YgK8gBq5c3NhDSQ==") returned 232 [0074.687] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x15, wMilliseconds=0x3ba)) [0074.687] GetCurrentThreadId () returned 0x970 [0074.687] GetCurrentThreadId () returned 0x970 [0074.687] GetCurrentThreadId () returned 0x970 [0074.687] GetCurrentThreadId () returned 0x970 [0074.687] GetCurrentThreadId () returned 0x970 [0074.687] GetCurrentThreadId () returned 0x970 [0074.687] GetCurrentThreadId () returned 0x970 [0074.687] GetCurrentThreadId () returned 0x970 [0074.687] GetCurrentThreadId () returned 0x970 [0074.687] GetCurrentThreadId () returned 0x970 [0074.687] GetCurrentThreadId () returned 0x970 [0074.687] GetCurrentThreadId () returned 0x970 [0074.687] GetCurrentThreadId () returned 0x970 [0074.687] GetCurrentThreadId () returned 0x970 [0074.687] GetCurrentThreadId () returned 0x970 [0074.687] GetCurrentThreadId () returned 0x970 [0074.687] GetCurrentThreadId () returned 0x970 [0074.687] GetCurrentThreadId () returned 0x970 [0074.687] GetCurrentThreadId () returned 0x970 [0074.687] GetCurrentThreadId () returned 0x970 [0074.687] GetCurrentThreadId () returned 0x970 [0074.687] GetCurrentThreadId () returned 0x970 [0074.687] GetCurrentThreadId () returned 0x970 [0074.687] GetCurrentThreadId () returned 0x970 [0074.687] GetCurrentThreadId () returned 0x970 [0074.687] GetCurrentThreadId () returned 0x970 [0074.687] GetCurrentThreadId () returned 0x970 [0074.687] GetCurrentThreadId () returned 0x970 [0074.687] GetCurrentThreadId () returned 0x970 [0074.687] GetCurrentThreadId () returned 0x970 [0074.687] GetCurrentThreadId () returned 0x970 [0074.688] GetCurrentThreadId () returned 0x970 [0074.688] GetCurrentThreadId () returned 0x970 [0074.688] GetCurrentThreadId () returned 0x970 [0074.688] GetCurrentThreadId () returned 0x970 [0074.688] GetCurrentThreadId () returned 0x970 [0074.688] GetCurrentThreadId () returned 0x970 [0074.688] GetCurrentThreadId () returned 0x970 [0074.688] GetCurrentThreadId () returned 0x970 [0074.688] GetCurrentThreadId () returned 0x970 [0074.688] GetCurrentThreadId () returned 0x970 [0074.688] GetCurrentThreadId () returned 0x970 [0074.688] GetCurrentThreadId () returned 0x970 [0074.688] GetCurrentThreadId () returned 0x970 [0074.688] GetCurrentThreadId () returned 0x970 [0074.688] GetCurrentThreadId () returned 0x970 [0074.688] GetCurrentThreadId () returned 0x970 [0074.688] GetCurrentThreadId () returned 0x970 [0074.688] GetCurrentThreadId () returned 0x970 [0074.688] GetCurrentThreadId () returned 0x970 [0074.688] GetCurrentThreadId () returned 0x970 [0074.688] GetCurrentThreadId () returned 0x970 [0074.688] GetCurrentThreadId () returned 0x970 [0074.688] GetCurrentThreadId () returned 0x970 [0074.688] GetCurrentThreadId () returned 0x970 [0074.688] GetCurrentThreadId () returned 0x970 [0074.688] GetCurrentThreadId () returned 0x970 [0074.688] GetCurrentThreadId () returned 0x970 [0074.688] GetCurrentThreadId () returned 0x970 [0074.688] GetCurrentThreadId () returned 0x970 [0074.688] GetCurrentThreadId () returned 0x970 [0074.688] GetCurrentThreadId () returned 0x970 [0074.688] GetCurrentThreadId () returned 0x970 [0074.688] GetCurrentThreadId () returned 0x970 [0074.688] GetCurrentThreadId () returned 0x970 [0074.688] GetCurrentThreadId () returned 0x970 [0074.688] GetCurrentThreadId () returned 0x970 [0074.688] GetCurrentThreadId () returned 0x970 [0074.688] GetCurrentThreadId () returned 0x970 [0074.688] GetCurrentThreadId () returned 0x970 [0074.688] GetCurrentThreadId () returned 0x970 [0074.688] GetCurrentThreadId () returned 0x970 [0074.688] GetCurrentThreadId () returned 0x970 [0074.688] GetCurrentThreadId () returned 0x970 [0074.688] GetCurrentThreadId () returned 0x970 [0074.688] GetCurrentThreadId () returned 0x970 [0074.689] GetCurrentThreadId () returned 0x970 [0074.689] GetCurrentThreadId () returned 0x970 [0074.689] GetCurrentThreadId () returned 0x970 [0074.689] GetCurrentThreadId () returned 0x970 [0074.689] GetCurrentThreadId () returned 0x970 [0074.689] GetCurrentThreadId () returned 0x970 [0074.689] GetCurrentThreadId () returned 0x970 [0074.689] GetCurrentThreadId () returned 0x970 [0074.689] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAACwtSjAjeCmaQWqHDow0ID6VqOFgsF2YrsrfI1kknlbGDNtHsmVR6S7bTpEHuBISZh2LXtN66NOLT2Q6Ioyb1MQIgyXjE4pl4mYvzWjGQrFpyKBoAKzcVROBBKKYFZg3T+/w+h8dTmRcHQyAA14D2PssEb6GCkKeSPc7tC/yS9wjlmxCAzDsCnrrotkwzXA9fAZZyfeEalg2ZJwjmI/YgK8gBq5c3NhDSQ==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0074.689] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAACwtSjAjeCmaQWqHDow0ID6VqOFgsF2YrsrfI1kknlbGDNtHsmVR6S7bTpEHuBISZh2LXtN66NOLT2Q6Ioyb1MQIgyXjE4pl4mYvzWjGQrFpyKBoAKzcVROBBKKYFZg3T+/w+h8dTmRcHQyAA14D2PssEb6GCkKeSPc7tC/yS9wjlmxCAzDsCnrrotkwzXA9fAZZyfeEalg2ZJwjmI/YgK8gBq5c3NhDSQ==", cchWideChar=245, lpMultiByteStr=0x353b0fc, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAACwtSjAjeCmaQWqHDow0ID6VqOFgsF2YrsrfI1kknlbGDNtHsmVR6S7bTpEHuBISZh2LXtN66NOLT2Q6Ioyb1MQIgyXjE4pl4mYvzWjGQrFpyKBoAKzcVROBBKKYFZg3T+/w+h8dTmRcHQyAA14D2PssEb6GCkKeSPc7tC/yS9wjlmxCAzDsCnrrotkwzXA9fAZZyfeEalg2ZJwjmI/YgK8gBq5c3NhDSQ==", lpUsedDefaultChar=0x0) returned 245 [0074.689] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0074.689] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0074.689] CloseHandle (hObject=0x158) returned 1 [0074.689] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_buttongraphic.png")) returned 0 [0074.690] GetLastError () returned 0x5 [0074.690] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_buttongraphic.png")) returned 0x20 [0074.690] SetLastError (dwErrCode=0x5) [0074.690] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=19495313681) returned 1 [0074.690] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Файл зашифрован [shadowonlyframe_selectionsubpicture.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\Файл зашифрован [shadowonlyframe_selectionsubpicture.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0074.690] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0074.690] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0074.691] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0074.691] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0074.691] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0074.691] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0074.691] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0074.691] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0074.691] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0074.691] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0074.691] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0074.691] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0074.691] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0074.691] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0074.691] SetEndOfFile (hFile=0x158) returned 1 [0074.691] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0074.691] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0074.692] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0074.692] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0074.692] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0074.693] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0074.693] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="L=Zi/(e+cd$,INB,I.N(Z$^!$FxtBptn", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0074.693] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="L=Zi/(e+cd$,INB,I.N(Z$^!$FxtBptn", cchWideChar=32, lpMultiByteStr=0x2038c94, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="L=Zi/(e+cd$,INB,I.N(Z$^!$FxtBptn", lpUsedDefaultChar=0x0) returned 32 [0074.693] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0074.693] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0074.693] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_selectionsubpicture.png", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e8f8753, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e8f8753, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f204eff, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xd3e, dwReserved0=0x0, dwReserved1=0x0, cFileName="shadowonlyframe_selectionsubpicture.png", cAlternateFileName="")) returned 0x295098 [0074.693] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0074.693] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0074.693] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_selectionsubpicture.png")) returned 0x20 [0074.694] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_selectionsubpicture.png")) returned 0x20 [0074.694] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_selectionsubpicture.png")) returned 0x20 [0074.694] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_selectionsubpicture.png")) returned 0x20 [0074.694] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_selectionsubpicture.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e8f8753, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e8f8753, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f204eff, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xd3e)) returned 1 [0074.694] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0074.694] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0074.694] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_selectionsubpicture.png")) returned 0x20 [0074.694] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_selectionsubpicture.png")) returned 0x20 [0074.694] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0074.694] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0074.695] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0074.695] SetEndOfFile (hFile=0x158) returned 1 [0074.695] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="shadowonlyframe_selectionsubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0074.695] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="shadowonlyframe_selectionsubpicture.png", cchWideChar=39, lpMultiByteStr=0x2038d04, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shadowonlyframe_selectionsubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0074.695] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="shadowonlyframe_selectionsubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0074.695] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="shadowonlyframe_selectionsubpicture.png", cchWideChar=39, lpMultiByteStr=0x20378e4, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shadowonlyframe_selectionsubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0074.696] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x20378e4, cbMultiByte=39, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="shadowonlyframe_selectionsubpicture.pngp") returned 39 [0074.696] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="shadowonlyframe_selectionsubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0074.696] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="shadowonlyframe_selectionsubpicture.png", cchWideChar=39, lpMultiByteStr=0x2038d04, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shadowonlyframe_selectionsubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0074.696] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0074.696] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0074.696] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0xd3e [0074.696] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0074.696] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0074.696] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0074.696] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="shadowonlyframe_selectionsubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0074.696] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="shadowonlyframe_selectionsubpicture.png", cchWideChar=39, lpMultiByteStr=0x2038d04, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shadowonlyframe_selectionsubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0074.696] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="shadowonlyframe_selectionsubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0074.696] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="shadowonlyframe_selectionsubpicture.png", cchWideChar=39, lpMultiByteStr=0x20378e4, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shadowonlyframe_selectionsubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0074.696] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x20378e4, cbMultiByte=39, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="shadowonlyframe_selectionsubpicture.pngre.pngp") returned 39 [0074.697] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="shadowonlyframe_selectionsubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0074.697] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="shadowonlyframe_selectionsubpicture.png", cchWideChar=39, lpMultiByteStr=0x2038d04, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shadowonlyframe_selectionsubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0074.697] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0074.697] CharToOemA (in: pSrc="shadowonlyframe_selectionsubpicture.png", pDst=0x20378e4 | out: pDst="shadowonlyframe_selectionsubpicture.png") returned 1 [0074.698] WriteFile (in: hFile=0x158, lpBuffer=0x20378e4*, nNumberOfBytesToWrite=0x27, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x20378e4*, lpNumberOfBytesWritten=0x18e048*=0x27, lpOverlapped=0x0) returned 1 [0074.698] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0074.698] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0074.698] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0074.698] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=19496139439) returned 1 [0074.698] ReadFile (in: hFile=0x11c, lpBuffer=0x3b62f50, nNumberOfBytesToRead=0xd3e, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b62f50*, lpNumberOfBytesRead=0x18dd7c*=0xd3e, lpOverlapped=0x0) returned 1 [0074.702] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0074.702] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=19496539380) returned 1 [0074.711] WriteFile (in: hFile=0x158, lpBuffer=0x379acc0*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379acc0*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0074.711] ReadFile (in: hFile=0x11c, lpBuffer=0x3b62f50, nNumberOfBytesToRead=0xd3e, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3b62f50*, lpNumberOfBytesRead=0x18de38*=0xd3e, lpOverlapped=0x0) returned 1 [0074.711] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x62 [0074.712] WriteFile (in: hFile=0x158, lpBuffer=0x3b95540*, nNumberOfBytesToWrite=0xd3e, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3b95540*, lpNumberOfBytesWritten=0x18de10*=0xd3e, lpOverlapped=0x0) returned 1 [0074.712] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0xda0 [0074.712] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0074.712] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0074.712] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0074.712] SetFilePointer (in: hFile=0x158, lDistanceToMove=39, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x45 [0074.712] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0xdaa [0074.712] CloseHandle (hObject=0x11c) returned 1 [0074.712] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xdaa [0074.712] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xdaa [0074.712] SetFilePointer (in: hFile=0x158, lDistanceToMove=3498, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xdaa [0074.712] SetFilePointer (in: hFile=0x158, lDistanceToMove=3498, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0xdaa [0074.713] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xdaa [0074.713] SetFilePointer (in: hFile=0x158, lDistanceToMove=3498, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0xdaa [0074.713] SetEndOfFile (hFile=0x158) returned 1 [0074.713] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xdaa [0074.713] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xdaa [0074.713] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="shadowonlyframe_selectionsubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0074.713] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="shadowonlyframe_selectionsubpicture.png", cchWideChar=39, lpMultiByteStr=0x20378e4, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shadowonlyframe_selectionsubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0074.713] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="shadowonlyframe_selectionsubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0074.713] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="shadowonlyframe_selectionsubpicture.png", cchWideChar=39, lpMultiByteStr=0x2038d04, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shadowonlyframe_selectionsubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0074.713] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x2038d04, cbMultiByte=39, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="shadowonlyframe_selectionsubpicture.png") returned 39 [0074.713] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="shadowonlyframe_selectionsubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0074.713] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="shadowonlyframe_selectionsubpicture.png", cchWideChar=39, lpMultiByteStr=0x20378e4, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shadowonlyframe_selectionsubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0074.713] WriteFile (in: hFile=0x158, lpBuffer=0x3b46a28*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3b46a28*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0074.713] CharToOemA (in: pSrc="shadowonlyframe_selectionsubpicture.png", pDst=0x2038d04 | out: pDst="shadowonlyframe_selectionsubpicture.png") returned 1 [0074.713] WriteFile (in: hFile=0x158, lpBuffer=0x2038d04*, nNumberOfBytesToWrite=0x27, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x2038d04*, lpNumberOfBytesWritten=0x18efcc*=0x27, lpOverlapped=0x0) returned 1 [0074.713] WriteFile (in: hFile=0x158, lpBuffer=0x379ad88*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379ad88*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0074.714] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0074.714] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0074.714] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xe0a [0074.714] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xe0a [0074.714] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0074.714] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0074.714] DeleteFileW (lpFileName="") returned 0 [0074.714] GetLastError () returned 0x3 [0074.714] GetFileAttributesW (lpFileName="") returned 0xffffffff [0074.714] SetLastError (dwErrCode=0x3) [0074.714] FlushFileBuffers (hFile=0x158) returned 1 [0074.717] GetCurrentThreadId () returned 0x970 [0074.717] GetCurrentThreadId () returned 0x970 [0074.717] GetCurrentThreadId () returned 0x970 [0074.717] GetCurrentThreadId () returned 0x970 [0074.717] GetCurrentThreadId () returned 0x970 [0074.717] GetCurrentThreadId () returned 0x970 [0074.717] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xec1 [0074.717] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xec1 [0074.717] SetFilePointer (in: hFile=0x158, lDistanceToMove=3777, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xec1 [0074.717] CloseHandle (hObject=0x158) returned 1 [0074.717] GetCurrentThreadId () returned 0x970 [0074.717] GetCurrentThreadId () returned 0x970 [0074.717] GetCurrentThreadId () returned 0x970 [0074.717] GetCurrentThreadId () returned 0x970 [0074.717] GetCurrentThreadId () returned 0x970 [0074.717] GetCurrentThreadId () returned 0x970 [0074.717] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Файл зашифрован [shadowonlyframe_selectionsubpicture.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\Файл зашифрован [shadowonlyframe_selectionsubpicture.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0074.718] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xec1 [0074.718] SetFilePointer (in: hFile=0x158, lDistanceToMove=3649, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe41 [0074.718] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0074.718] GetFileType (hFile=0x158) returned 0x1 [0074.718] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x15, wMilliseconds=0x3da)) [0074.718] GetCurrentThreadId () returned 0x970 [0074.718] GetCurrentThreadId () returned 0x970 [0074.718] GetCurrentThreadId () returned 0x970 [0074.718] GetCurrentThreadId () returned 0x970 [0074.718] GetCurrentThreadId () returned 0x970 [0074.718] GetCurrentThreadId () returned 0x970 [0074.718] GetCurrentThreadId () returned 0x970 [0074.718] GetCurrentThreadId () returned 0x970 [0074.718] GetCurrentThreadId () returned 0x970 [0074.718] GetCurrentThreadId () returned 0x970 [0074.718] GetCurrentThreadId () returned 0x970 [0074.718] GetCurrentThreadId () returned 0x970 [0074.718] GetCurrentThreadId () returned 0x970 [0074.718] GetCurrentThreadId () returned 0x970 [0074.718] GetCurrentThreadId () returned 0x970 [0074.718] GetCurrentThreadId () returned 0x970 [0074.718] GetCurrentThreadId () returned 0x970 [0074.718] GetCurrentThreadId () returned 0x970 [0074.718] GetCurrentThreadId () returned 0x970 [0074.718] GetCurrentThreadId () returned 0x970 [0074.718] GetCurrentThreadId () returned 0x970 [0074.718] GetCurrentThreadId () returned 0x970 [0074.718] GetCurrentThreadId () returned 0x970 [0074.718] GetCurrentThreadId () returned 0x970 [0074.718] GetCurrentThreadId () returned 0x970 [0074.718] GetCurrentThreadId () returned 0x970 [0074.718] GetCurrentThreadId () returned 0x970 [0074.718] GetCurrentThreadId () returned 0x970 [0074.718] GetCurrentThreadId () returned 0x970 [0074.719] GetCurrentThreadId () returned 0x970 [0074.719] GetCurrentThreadId () returned 0x970 [0074.719] GetCurrentThreadId () returned 0x970 [0074.719] GetCurrentThreadId () returned 0x970 [0074.719] GetCurrentThreadId () returned 0x970 [0074.719] GetCurrentThreadId () returned 0x970 [0074.719] GetCurrentThreadId () returned 0x970 [0074.719] GetCurrentThreadId () returned 0x970 [0074.719] GetCurrentThreadId () returned 0x970 [0074.719] GetCurrentThreadId () returned 0x970 [0074.719] GetCurrentThreadId () returned 0x970 [0074.719] GetCurrentThreadId () returned 0x970 [0074.719] GetCurrentThreadId () returned 0x970 [0074.719] GetCurrentThreadId () returned 0x970 [0074.719] GetCurrentThreadId () returned 0x970 [0074.719] GetCurrentThreadId () returned 0x970 [0074.719] GetCurrentThreadId () returned 0x970 [0074.719] GetCurrentThreadId () returned 0x970 [0074.719] GetCurrentThreadId () returned 0x970 [0074.719] GetCurrentThreadId () returned 0x970 [0074.719] GetCurrentThreadId () returned 0x970 [0074.719] GetCurrentThreadId () returned 0x970 [0074.719] GetCurrentThreadId () returned 0x970 [0074.719] GetCurrentThreadId () returned 0x970 [0074.719] GetCurrentThreadId () returned 0x970 [0074.719] GetCurrentThreadId () returned 0x970 [0074.719] GetCurrentThreadId () returned 0x970 [0074.719] GetCurrentThreadId () returned 0x970 [0074.719] GetCurrentThreadId () returned 0x970 [0074.719] GetCurrentThreadId () returned 0x970 [0074.719] GetCurrentThreadId () returned 0x970 [0074.719] GetCurrentThreadId () returned 0x970 [0074.719] GetCurrentThreadId () returned 0x970 [0074.719] GetCurrentThreadId () returned 0x970 [0074.719] GetCurrentThreadId () returned 0x970 [0074.719] GetCurrentThreadId () returned 0x970 [0074.719] GetCurrentThreadId () returned 0x970 [0074.719] GetCurrentThreadId () returned 0x970 [0074.719] GetCurrentThreadId () returned 0x970 [0074.719] GetCurrentThreadId () returned 0x970 [0074.719] GetCurrentThreadId () returned 0x970 [0074.719] GetCurrentThreadId () returned 0x970 [0074.719] GetCurrentThreadId () returned 0x970 [0074.719] GetCurrentThreadId () returned 0x970 [0074.719] GetCurrentThreadId () returned 0x970 [0074.720] GetCurrentThreadId () returned 0x970 [0074.720] GetCurrentThreadId () returned 0x970 [0074.720] GetCurrentThreadId () returned 0x970 [0074.720] GetCurrentThreadId () returned 0x970 [0074.720] GetCurrentThreadId () returned 0x970 [0074.720] GetCurrentThreadId () returned 0x970 [0074.720] GetCurrentThreadId () returned 0x970 [0074.720] GetCurrentThreadId () returned 0x970 [0074.720] GetCurrentThreadId () returned 0x970 [0074.720] GetCurrentThreadId () returned 0x970 [0074.720] GetCurrentThreadId () returned 0x970 [0074.720] GetCurrentThreadId () returned 0x970 [0074.720] GetCurrentThreadId () returned 0x970 [0074.720] GetCurrentThreadId () returned 0x970 [0074.720] GetCurrentThreadId () returned 0x970 [0074.720] GetCurrentThreadId () returned 0x970 [0074.720] GetCurrentThreadId () returned 0x970 [0074.720] GetCurrentThreadId () returned 0x970 [0074.720] GetCurrentThreadId () returned 0x970 [0074.720] GetCurrentThreadId () returned 0x970 [0074.720] GetCurrentThreadId () returned 0x970 [0074.720] GetCurrentThreadId () returned 0x970 [0074.720] GetCurrentThreadId () returned 0x970 [0074.720] GetCurrentThreadId () returned 0x970 [0074.720] GetCurrentThreadId () returned 0x970 [0074.720] GetCurrentThreadId () returned 0x970 [0074.720] GetCurrentThreadId () returned 0x970 [0074.720] GetCurrentThreadId () returned 0x970 [0074.720] GetCurrentThreadId () returned 0x970 [0074.720] GetCurrentThreadId () returned 0x970 [0074.720] GetCurrentThreadId () returned 0x970 [0074.720] GetCurrentThreadId () returned 0x970 [0074.720] GetCurrentThreadId () returned 0x970 [0074.720] GetCurrentThreadId () returned 0x970 [0074.720] GetCurrentThreadId () returned 0x970 [0074.720] GetCurrentThreadId () returned 0x970 [0074.720] GetCurrentThreadId () returned 0x970 [0074.720] GetCurrentThreadId () returned 0x970 [0074.720] GetCurrentThreadId () returned 0x970 [0074.720] GetCurrentThreadId () returned 0x970 [0074.720] GetCurrentThreadId () returned 0x970 [0074.720] GetCurrentThreadId () returned 0x970 [0074.720] GetCurrentThreadId () returned 0x970 [0074.720] GetCurrentThreadId () returned 0x970 [0074.721] GetCurrentThreadId () returned 0x970 [0074.721] GetCurrentThreadId () returned 0x970 [0074.721] GetCurrentThreadId () returned 0x970 [0074.721] GetCurrentThreadId () returned 0x970 [0074.721] GetCurrentThreadId () returned 0x970 [0074.721] GetCurrentThreadId () returned 0x970 [0074.721] GetCurrentThreadId () returned 0x970 [0074.721] GetCurrentThreadId () returned 0x970 [0074.721] GetCurrentThreadId () returned 0x970 [0074.721] GetCurrentThreadId () returned 0x970 [0074.721] GetCurrentThreadId () returned 0x970 [0074.721] GetCurrentThreadId () returned 0x970 [0074.721] GetCurrentThreadId () returned 0x970 [0074.721] GetCurrentThreadId () returned 0x970 [0074.721] GetCurrentThreadId () returned 0x970 [0074.721] GetCurrentThreadId () returned 0x970 [0074.721] GetCurrentThreadId () returned 0x970 [0074.721] GetCurrentThreadId () returned 0x970 [0074.721] GetCurrentThreadId () returned 0x970 [0074.721] GetCurrentThreadId () returned 0x970 [0074.721] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0074.721] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0074.721] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379fd38, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0074.721] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0074.721] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0074.721] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379fd38, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0074.721] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0074.721] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0074.721] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0074.721] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0074.721] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0074.721] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0074.721] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0074.721] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0074.721] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379fd98, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0074.721] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0074.722] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0074.722] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379fd98, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0074.722] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0074.722] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0074.722] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379fd98, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0074.722] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x15, wMilliseconds=0x3da)) [0074.722] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="L=Zi/(e+cd$,INB,I.N(Z$^!$FxtBptn", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0074.722] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="L=Zi/(e+cd$,INB,I.N(Z$^!$FxtBptn", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0074.722] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="L=Zi/(e+cd$,INB,I.N(Z$^!$FxtBptn", cchWideChar=32, lpMultiByteStr=0x2005cc8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="L=Zi/(e+cd$,INB,I.N(Z$^!$FxtBptn", lpUsedDefaultChar=0x0) returned 32 [0074.722] GetCurrentThreadId () returned 0x970 [0074.722] GetCurrentThreadId () returned 0x970 [0074.722] GetCurrentThreadId () returned 0x970 [0074.722] GetCurrentThreadId () returned 0x970 [0074.722] GetCurrentThreadId () returned 0x970 [0074.722] GetCurrentThreadId () returned 0x970 [0074.729] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0074.729] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0074.729] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3b3f638, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0074.730] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ed648, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0074.730] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ed648, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAHGDp0o/7B3139cspvF27mjzknma14cyPkwxHFX4h4BHf70vYeQlF+5gCjbIh9pD6pb5Tf8HAFimi96PKD7UtCT/hEAkcUydqanMOVFI27ZfeqfJ4g6U14q/hAg1RomuAEHYHHq7sQl22Ajr5ruATAFYnswPDNwLWAFQbJlpf39cg6+74NBN0YGrOkYgymo8PWR+qxIdPMir+hCY3pyzhRs0Occq9VN5JQ==") returned 232 [0074.730] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x16, wMilliseconds=0x1)) [0074.730] GetCurrentThreadId () returned 0x970 [0074.730] GetCurrentThreadId () returned 0x970 [0074.730] GetCurrentThreadId () returned 0x970 [0074.730] GetCurrentThreadId () returned 0x970 [0074.730] GetCurrentThreadId () returned 0x970 [0074.730] GetCurrentThreadId () returned 0x970 [0074.730] GetCurrentThreadId () returned 0x970 [0074.730] GetCurrentThreadId () returned 0x970 [0074.730] GetCurrentThreadId () returned 0x970 [0074.730] GetCurrentThreadId () returned 0x970 [0074.730] GetCurrentThreadId () returned 0x970 [0074.730] GetCurrentThreadId () returned 0x970 [0074.730] GetCurrentThreadId () returned 0x970 [0074.730] GetCurrentThreadId () returned 0x970 [0074.730] GetCurrentThreadId () returned 0x970 [0074.730] GetCurrentThreadId () returned 0x970 [0074.730] GetCurrentThreadId () returned 0x970 [0074.730] GetCurrentThreadId () returned 0x970 [0074.730] GetCurrentThreadId () returned 0x970 [0074.730] GetCurrentThreadId () returned 0x970 [0074.730] GetCurrentThreadId () returned 0x970 [0074.730] GetCurrentThreadId () returned 0x970 [0074.730] GetCurrentThreadId () returned 0x970 [0074.730] GetCurrentThreadId () returned 0x970 [0074.730] GetCurrentThreadId () returned 0x970 [0074.730] GetCurrentThreadId () returned 0x970 [0074.730] GetCurrentThreadId () returned 0x970 [0074.730] GetCurrentThreadId () returned 0x970 [0074.730] GetCurrentThreadId () returned 0x970 [0074.730] GetCurrentThreadId () returned 0x970 [0074.730] GetCurrentThreadId () returned 0x970 [0074.730] GetCurrentThreadId () returned 0x970 [0074.730] GetCurrentThreadId () returned 0x970 [0074.730] GetCurrentThreadId () returned 0x970 [0074.730] GetCurrentThreadId () returned 0x970 [0074.730] GetCurrentThreadId () returned 0x970 [0074.730] GetCurrentThreadId () returned 0x970 [0074.730] GetCurrentThreadId () returned 0x970 [0074.730] GetCurrentThreadId () returned 0x970 [0074.731] GetCurrentThreadId () returned 0x970 [0074.731] GetCurrentThreadId () returned 0x970 [0074.731] GetCurrentThreadId () returned 0x970 [0074.731] GetCurrentThreadId () returned 0x970 [0074.731] GetCurrentThreadId () returned 0x970 [0074.731] GetCurrentThreadId () returned 0x970 [0074.731] GetCurrentThreadId () returned 0x970 [0074.731] GetCurrentThreadId () returned 0x970 [0074.731] GetCurrentThreadId () returned 0x970 [0074.731] GetCurrentThreadId () returned 0x970 [0074.731] GetCurrentThreadId () returned 0x970 [0074.731] GetCurrentThreadId () returned 0x970 [0074.731] GetCurrentThreadId () returned 0x970 [0074.731] GetCurrentThreadId () returned 0x970 [0074.731] GetCurrentThreadId () returned 0x970 [0074.731] GetCurrentThreadId () returned 0x970 [0074.731] GetCurrentThreadId () returned 0x970 [0074.731] GetCurrentThreadId () returned 0x970 [0074.731] GetCurrentThreadId () returned 0x970 [0074.731] GetCurrentThreadId () returned 0x970 [0074.731] GetCurrentThreadId () returned 0x970 [0074.731] GetCurrentThreadId () returned 0x970 [0074.731] GetCurrentThreadId () returned 0x970 [0074.731] GetCurrentThreadId () returned 0x970 [0074.731] GetCurrentThreadId () returned 0x970 [0074.731] GetCurrentThreadId () returned 0x970 [0074.731] GetCurrentThreadId () returned 0x970 [0074.731] GetCurrentThreadId () returned 0x970 [0074.731] GetCurrentThreadId () returned 0x970 [0074.731] GetCurrentThreadId () returned 0x970 [0074.731] GetCurrentThreadId () returned 0x970 [0074.731] GetCurrentThreadId () returned 0x970 [0074.731] GetCurrentThreadId () returned 0x970 [0074.731] GetCurrentThreadId () returned 0x970 [0074.731] GetCurrentThreadId () returned 0x970 [0074.731] GetCurrentThreadId () returned 0x970 [0074.731] GetCurrentThreadId () returned 0x970 [0074.731] GetCurrentThreadId () returned 0x970 [0074.731] GetCurrentThreadId () returned 0x970 [0074.731] GetCurrentThreadId () returned 0x970 [0074.731] GetCurrentThreadId () returned 0x970 [0074.731] GetCurrentThreadId () returned 0x970 [0074.731] GetCurrentThreadId () returned 0x970 [0074.731] GetCurrentThreadId () returned 0x970 [0074.732] GetCurrentThreadId () returned 0x970 [0074.732] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAHGDp0o/7B3139cspvF27mjzknma14cyPkwxHFX4h4BHf70vYeQlF+5gCjbIh9pD6pb5Tf8HAFimi96PKD7UtCT/hEAkcUydqanMOVFI27ZfeqfJ4g6U14q/hAg1RomuAEHYHHq7sQl22Ajr5ruATAFYnswPDNwLWAFQbJlpf39cg6+74NBN0YGrOkYgymo8PWR+qxIdPMir+hCY3pyzhRs0Occq9VN5JQ==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0074.732] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAHGDp0o/7B3139cspvF27mjzknma14cyPkwxHFX4h4BHf70vYeQlF+5gCjbIh9pD6pb5Tf8HAFimi96PKD7UtCT/hEAkcUydqanMOVFI27ZfeqfJ4g6U14q/hAg1RomuAEHYHHq7sQl22Ajr5ruATAFYnswPDNwLWAFQbJlpf39cg6+74NBN0YGrOkYgymo8PWR+qxIdPMir+hCY3pyzhRs0Occq9VN5JQ==", cchWideChar=245, lpMultiByteStr=0x353b0fc, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAHGDp0o/7B3139cspvF27mjzknma14cyPkwxHFX4h4BHf70vYeQlF+5gCjbIh9pD6pb5Tf8HAFimi96PKD7UtCT/hEAkcUydqanMOVFI27ZfeqfJ4g6U14q/hAg1RomuAEHYHHq7sQl22Ajr5ruATAFYnswPDNwLWAFQbJlpf39cg6+74NBN0YGrOkYgymo8PWR+qxIdPMir+hCY3pyzhRs0Occq9VN5JQ==", lpUsedDefaultChar=0x0) returned 245 [0074.732] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0074.732] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0074.732] CloseHandle (hObject=0x158) returned 1 [0074.732] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_selectionsubpicture.png")) returned 0 [0074.732] GetLastError () returned 0x5 [0074.732] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_selectionsubpicture.png")) returned 0x20 [0074.732] SetLastError (dwErrCode=0x5) [0074.732] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=19499589849) returned 1 [0074.733] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Файл зашифрован [shadowonlyframe_videoinset.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\Файл зашифрован [shadowonlyframe_videoinset.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0074.733] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0074.733] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0074.733] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0074.733] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0074.733] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0074.733] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0074.733] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0074.733] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0074.733] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0074.734] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0074.734] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0074.734] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0074.734] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0074.734] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0074.734] SetEndOfFile (hFile=0x158) returned 1 [0074.734] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0074.734] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0074.734] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0074.734] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0074.734] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0074.735] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0074.735] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="(YnpdA*{\\}VYf,OWd-T", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0075.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="+N\"t2xJfBcp+p@v7LOL$PZUb.sy1>d-T", cchWideChar=32, lpMultiByteStr=0x2039084, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="+N\"t2xJfBcp+p@v7LOL$PZUb.sy1>d-T", lpUsedDefaultChar=0x0) returned 32 [0075.375] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0075.375] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0075.375] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f6360a8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f6360a8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 0x295098 [0075.375] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0075.375] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0075.375] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_selectionsubpicture.png")) returned 0x20 [0075.375] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_selectionsubpicture.png")) returned 0x20 [0075.375] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_selectionsubpicture.png")) returned 0x20 [0075.375] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_selectionsubpicture.png")) returned 0x20 [0075.375] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_selectionsubpicture.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f6360a8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f6360a8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e)) returned 1 [0075.375] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0075.375] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0075.376] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_selectionsubpicture.png")) returned 0x20 [0075.376] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_selectionsubpicture.png")) returned 0x20 [0075.376] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0075.376] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0075.376] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0075.376] SetEndOfFile (hFile=0x158) returned 1 [0075.377] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0075.377] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x20390bc, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0075.377] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0075.377] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x2039014, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0075.377] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x2039014, cbMultiByte=39, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="NavigationRight_SelectionSubpicture.pngp") returned 39 [0075.377] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0075.377] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x20390bc, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0075.377] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0075.378] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0075.378] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0xc2e [0075.378] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0075.378] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0075.378] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0075.378] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0075.378] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x20390bc, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0075.378] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0075.378] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x2039014, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0075.378] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x2039014, cbMultiByte=39, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="NavigationRight_SelectionSubpicture.pngre.pngp") returned 39 [0075.378] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0075.378] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x20390bc, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0075.378] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0075.379] CharToOemA (in: pSrc="NavigationRight_SelectionSubpicture.png", pDst=0x2039014 | out: pDst="NavigationRight_SelectionSubpicture.png") returned 1 [0075.379] WriteFile (in: hFile=0x158, lpBuffer=0x2039014*, nNumberOfBytesToWrite=0x27, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x2039014*, lpNumberOfBytesWritten=0x18e048*=0x27, lpOverlapped=0x0) returned 1 [0075.379] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0075.379] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0075.379] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0075.380] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=19564297744) returned 1 [0075.380] ReadFile (in: hFile=0x11c, lpBuffer=0x3b62f50, nNumberOfBytesToRead=0xc2e, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b62f50*, lpNumberOfBytesRead=0x18dd7c*=0xc2e, lpOverlapped=0x0) returned 1 [0075.381] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0075.381] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=19564442098) returned 1 [0075.390] WriteFile (in: hFile=0x158, lpBuffer=0x379aca8*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379aca8*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0075.390] ReadFile (in: hFile=0x11c, lpBuffer=0x3b62f50, nNumberOfBytesToRead=0xc2e, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3b62f50*, lpNumberOfBytesRead=0x18de38*=0xc2e, lpOverlapped=0x0) returned 1 [0075.390] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x62 [0075.390] WriteFile (in: hFile=0x158, lpBuffer=0x3b95440*, nNumberOfBytesToWrite=0xc2e, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3b95440*, lpNumberOfBytesWritten=0x18de10*=0xc2e, lpOverlapped=0x0) returned 1 [0075.390] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0xc90 [0075.390] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0075.390] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0075.390] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0075.390] SetFilePointer (in: hFile=0x158, lDistanceToMove=39, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x45 [0075.391] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0xc9a [0075.391] CloseHandle (hObject=0x11c) returned 1 [0075.391] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xc9a [0075.391] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xc9a [0075.391] SetFilePointer (in: hFile=0x158, lDistanceToMove=3226, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xc9a [0075.391] SetFilePointer (in: hFile=0x158, lDistanceToMove=3226, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0xc9a [0075.391] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xc9a [0075.391] SetFilePointer (in: hFile=0x158, lDistanceToMove=3226, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0xc9a [0075.391] SetEndOfFile (hFile=0x158) returned 1 [0075.391] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xc9a [0075.391] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xc9a [0075.391] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0075.391] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x2039014, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0075.391] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0075.391] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x20390bc, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0075.392] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x20390bc, cbMultiByte=39, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="NavigationRight_SelectionSubpicture.png") returned 39 [0075.392] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0075.392] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x2039014, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 39 [0075.392] WriteFile (in: hFile=0x158, lpBuffer=0x3b46a28*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3b46a28*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0075.392] CharToOemA (in: pSrc="NavigationRight_SelectionSubpicture.png", pDst=0x20390bc | out: pDst="NavigationRight_SelectionSubpicture.png") returned 1 [0075.392] WriteFile (in: hFile=0x158, lpBuffer=0x20390bc*, nNumberOfBytesToWrite=0x27, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x20390bc*, lpNumberOfBytesWritten=0x18efcc*=0x27, lpOverlapped=0x0) returned 1 [0075.392] WriteFile (in: hFile=0x158, lpBuffer=0x379ade8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379ade8*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0075.392] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0075.392] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0075.392] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xcfa [0075.392] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xcfa [0075.392] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0075.392] WriteFile (in: hFile=0x158, lpBuffer=0x35f035c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f035c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0075.392] DeleteFileW (lpFileName="") returned 0 [0075.392] GetLastError () returned 0x3 [0075.393] GetFileAttributesW (lpFileName="") returned 0xffffffff [0075.393] SetLastError (dwErrCode=0x3) [0075.393] FlushFileBuffers (hFile=0x158) returned 1 [0075.395] GetCurrentThreadId () returned 0x970 [0075.395] GetCurrentThreadId () returned 0x970 [0075.395] GetCurrentThreadId () returned 0x970 [0075.395] GetCurrentThreadId () returned 0x970 [0075.395] GetCurrentThreadId () returned 0x970 [0075.395] GetCurrentThreadId () returned 0x970 [0075.395] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xdb1 [0075.395] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xdb1 [0075.395] SetFilePointer (in: hFile=0x158, lDistanceToMove=3505, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xdb1 [0075.395] CloseHandle (hObject=0x158) returned 1 [0075.395] GetCurrentThreadId () returned 0x970 [0075.395] GetCurrentThreadId () returned 0x970 [0075.396] GetCurrentThreadId () returned 0x970 [0075.396] GetCurrentThreadId () returned 0x970 [0075.396] GetCurrentThreadId () returned 0x970 [0075.396] GetCurrentThreadId () returned 0x970 [0075.396] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\Файл зашифрован [NavigationRight_SelectionSubpicture.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\Файл зашифрован [navigationright_selectionsubpicture.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0075.396] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdb1 [0075.396] SetFilePointer (in: hFile=0x158, lDistanceToMove=3377, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd31 [0075.396] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0075.396] GetFileType (hFile=0x158) returned 0x1 [0075.396] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x16, wMilliseconds=0x2a0)) [0075.396] GetCurrentThreadId () returned 0x970 [0075.396] GetCurrentThreadId () returned 0x970 [0075.396] GetCurrentThreadId () returned 0x970 [0075.396] GetCurrentThreadId () returned 0x970 [0075.396] GetCurrentThreadId () returned 0x970 [0075.396] GetCurrentThreadId () returned 0x970 [0075.396] GetCurrentThreadId () returned 0x970 [0075.396] GetCurrentThreadId () returned 0x970 [0075.396] GetCurrentThreadId () returned 0x970 [0075.396] GetCurrentThreadId () returned 0x970 [0075.396] GetCurrentThreadId () returned 0x970 [0075.396] GetCurrentThreadId () returned 0x970 [0075.396] GetCurrentThreadId () returned 0x970 [0075.396] GetCurrentThreadId () returned 0x970 [0075.396] GetCurrentThreadId () returned 0x970 [0075.396] GetCurrentThreadId () returned 0x970 [0075.396] GetCurrentThreadId () returned 0x970 [0075.396] GetCurrentThreadId () returned 0x970 [0075.396] GetCurrentThreadId () returned 0x970 [0075.396] GetCurrentThreadId () returned 0x970 [0075.396] GetCurrentThreadId () returned 0x970 [0075.397] GetCurrentThreadId () returned 0x970 [0075.397] GetCurrentThreadId () returned 0x970 [0075.397] GetCurrentThreadId () returned 0x970 [0075.397] GetCurrentThreadId () returned 0x970 [0075.397] GetCurrentThreadId () returned 0x970 [0075.397] GetCurrentThreadId () returned 0x970 [0075.397] GetCurrentThreadId () returned 0x970 [0075.397] GetCurrentThreadId () returned 0x970 [0075.397] GetCurrentThreadId () returned 0x970 [0075.397] GetCurrentThreadId () returned 0x970 [0075.397] GetCurrentThreadId () returned 0x970 [0075.397] GetCurrentThreadId () returned 0x970 [0075.397] GetCurrentThreadId () returned 0x970 [0075.397] GetCurrentThreadId () returned 0x970 [0075.397] GetCurrentThreadId () returned 0x970 [0075.397] GetCurrentThreadId () returned 0x970 [0075.397] GetCurrentThreadId () returned 0x970 [0075.397] GetCurrentThreadId () returned 0x970 [0075.397] GetCurrentThreadId () returned 0x970 [0075.397] GetCurrentThreadId () returned 0x970 [0075.397] GetCurrentThreadId () returned 0x970 [0075.397] GetCurrentThreadId () returned 0x970 [0075.397] GetCurrentThreadId () returned 0x970 [0075.397] GetCurrentThreadId () returned 0x970 [0075.397] GetCurrentThreadId () returned 0x970 [0075.397] GetCurrentThreadId () returned 0x970 [0075.397] GetCurrentThreadId () returned 0x970 [0075.397] GetCurrentThreadId () returned 0x970 [0075.397] GetCurrentThreadId () returned 0x970 [0075.397] GetCurrentThreadId () returned 0x970 [0075.397] GetCurrentThreadId () returned 0x970 [0075.397] GetCurrentThreadId () returned 0x970 [0075.397] GetCurrentThreadId () returned 0x970 [0075.397] GetCurrentThreadId () returned 0x970 [0075.397] GetCurrentThreadId () returned 0x970 [0075.397] GetCurrentThreadId () returned 0x970 [0075.397] GetCurrentThreadId () returned 0x970 [0075.397] GetCurrentThreadId () returned 0x970 [0075.397] GetCurrentThreadId () returned 0x970 [0075.397] GetCurrentThreadId () returned 0x970 [0075.397] GetCurrentThreadId () returned 0x970 [0075.397] GetCurrentThreadId () returned 0x970 [0075.397] GetCurrentThreadId () returned 0x970 [0075.397] GetCurrentThreadId () returned 0x970 [0075.398] GetCurrentThreadId () returned 0x970 [0075.398] GetCurrentThreadId () returned 0x970 [0075.398] GetCurrentThreadId () returned 0x970 [0075.398] GetCurrentThreadId () returned 0x970 [0075.398] GetCurrentThreadId () returned 0x970 [0075.398] GetCurrentThreadId () returned 0x970 [0075.398] GetCurrentThreadId () returned 0x970 [0075.398] GetCurrentThreadId () returned 0x970 [0075.398] GetCurrentThreadId () returned 0x970 [0075.398] GetCurrentThreadId () returned 0x970 [0075.398] GetCurrentThreadId () returned 0x970 [0075.398] GetCurrentThreadId () returned 0x970 [0075.398] GetCurrentThreadId () returned 0x970 [0075.398] GetCurrentThreadId () returned 0x970 [0075.398] GetCurrentThreadId () returned 0x970 [0075.398] GetCurrentThreadId () returned 0x970 [0075.398] GetCurrentThreadId () returned 0x970 [0075.398] GetCurrentThreadId () returned 0x970 [0075.398] GetCurrentThreadId () returned 0x970 [0075.398] GetCurrentThreadId () returned 0x970 [0075.398] GetCurrentThreadId () returned 0x970 [0075.398] GetCurrentThreadId () returned 0x970 [0075.398] GetCurrentThreadId () returned 0x970 [0075.398] GetCurrentThreadId () returned 0x970 [0075.398] GetCurrentThreadId () returned 0x970 [0075.398] GetCurrentThreadId () returned 0x970 [0075.398] GetCurrentThreadId () returned 0x970 [0075.398] GetCurrentThreadId () returned 0x970 [0075.398] GetCurrentThreadId () returned 0x970 [0075.398] GetCurrentThreadId () returned 0x970 [0075.398] GetCurrentThreadId () returned 0x970 [0075.398] GetCurrentThreadId () returned 0x970 [0075.398] GetCurrentThreadId () returned 0x970 [0075.398] GetCurrentThreadId () returned 0x970 [0075.398] GetCurrentThreadId () returned 0x970 [0075.398] GetCurrentThreadId () returned 0x970 [0075.398] GetCurrentThreadId () returned 0x970 [0075.398] GetCurrentThreadId () returned 0x970 [0075.398] GetCurrentThreadId () returned 0x970 [0075.398] GetCurrentThreadId () returned 0x970 [0075.398] GetCurrentThreadId () returned 0x970 [0075.398] GetCurrentThreadId () returned 0x970 [0075.398] GetCurrentThreadId () returned 0x970 [0075.398] GetCurrentThreadId () returned 0x970 [0075.398] GetCurrentThreadId () returned 0x970 [0075.398] GetCurrentThreadId () returned 0x970 [0075.399] GetCurrentThreadId () returned 0x970 [0075.399] GetCurrentThreadId () returned 0x970 [0075.399] GetCurrentThreadId () returned 0x970 [0075.399] GetCurrentThreadId () returned 0x970 [0075.399] GetCurrentThreadId () returned 0x970 [0075.399] GetCurrentThreadId () returned 0x970 [0075.399] GetCurrentThreadId () returned 0x970 [0075.399] GetCurrentThreadId () returned 0x970 [0075.399] GetCurrentThreadId () returned 0x970 [0075.399] GetCurrentThreadId () returned 0x970 [0075.399] GetCurrentThreadId () returned 0x970 [0075.399] GetCurrentThreadId () returned 0x970 [0075.399] GetCurrentThreadId () returned 0x970 [0075.399] GetCurrentThreadId () returned 0x970 [0075.399] GetCurrentThreadId () returned 0x970 [0075.399] GetCurrentThreadId () returned 0x970 [0075.399] GetCurrentThreadId () returned 0x970 [0075.399] GetCurrentThreadId () returned 0x970 [0075.399] GetCurrentThreadId () returned 0x970 [0075.399] GetCurrentThreadId () returned 0x970 [0075.399] GetCurrentThreadId () returned 0x970 [0075.399] GetCurrentThreadId () returned 0x970 [0075.399] GetCurrentThreadId () returned 0x970 [0075.399] GetCurrentThreadId () returned 0x970 [0075.399] GetCurrentThreadId () returned 0x970 [0075.399] GetCurrentThreadId () returned 0x970 [0075.399] GetCurrentThreadId () returned 0x970 [0075.399] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.399] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.399] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a0338, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0075.399] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.399] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.399] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a0338, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0075.399] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.399] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.399] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0075.399] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.399] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.399] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0075.400] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.400] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.400] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a0398, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0075.400] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.400] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.400] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a0398, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0075.400] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.400] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.400] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a0398, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0075.400] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x16, wMilliseconds=0x2a0)) [0075.400] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="+N\"t2xJfBcp+p@v7LOL$PZUb.sy1>d-T", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0075.400] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="+N\"t2xJfBcp+p@v7LOL$PZUb.sy1>d-T", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0075.400] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="+N\"t2xJfBcp+p@v7LOL$PZUb.sy1>d-T", cchWideChar=32, lpMultiByteStr=0x2005fc8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="+N\"t2xJfBcp+p@v7LOL$PZUb.sy1>d-T", lpUsedDefaultChar=0x0) returned 32 [0075.400] GetCurrentThreadId () returned 0x970 [0075.400] GetCurrentThreadId () returned 0x970 [0075.400] GetCurrentThreadId () returned 0x970 [0075.400] GetCurrentThreadId () returned 0x970 [0075.400] GetCurrentThreadId () returned 0x970 [0075.400] GetCurrentThreadId () returned 0x970 [0075.408] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0075.408] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0075.408] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3b40538, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0075.408] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ed848, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0075.408] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ed848, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAGxcyFQF7zVrNLFhYydknal3RjEIjcZtXHULmrvEPswWdIzqyWxjM2tKdVe9MSHPbfS8jJ28txEqBVSZEDqeaQVDJ3vkFcnBg2cMZNxRcdAByAFdw1yaGXKLr0tgRH8Ia6vkvJI0+SjLNgVrhXbh8+xunJv30Z181+gWumLB7DPsy+2+t2TfxY0PznMMNKPseS3Sue959oXklfqFgSWkxIx3qFrkDVHUrA==") returned 232 [0075.408] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x16, wMilliseconds=0x2a0)) [0075.408] GetCurrentThreadId () returned 0x970 [0075.408] GetCurrentThreadId () returned 0x970 [0075.408] GetCurrentThreadId () returned 0x970 [0075.408] GetCurrentThreadId () returned 0x970 [0075.408] GetCurrentThreadId () returned 0x970 [0075.408] GetCurrentThreadId () returned 0x970 [0075.408] GetCurrentThreadId () returned 0x970 [0075.408] GetCurrentThreadId () returned 0x970 [0075.408] GetCurrentThreadId () returned 0x970 [0075.408] GetCurrentThreadId () returned 0x970 [0075.408] GetCurrentThreadId () returned 0x970 [0075.408] GetCurrentThreadId () returned 0x970 [0075.408] GetCurrentThreadId () returned 0x970 [0075.408] GetCurrentThreadId () returned 0x970 [0075.408] GetCurrentThreadId () returned 0x970 [0075.408] GetCurrentThreadId () returned 0x970 [0075.408] GetCurrentThreadId () returned 0x970 [0075.408] GetCurrentThreadId () returned 0x970 [0075.408] GetCurrentThreadId () returned 0x970 [0075.409] GetCurrentThreadId () returned 0x970 [0075.409] GetCurrentThreadId () returned 0x970 [0075.409] GetCurrentThreadId () returned 0x970 [0075.409] GetCurrentThreadId () returned 0x970 [0075.409] GetCurrentThreadId () returned 0x970 [0075.409] GetCurrentThreadId () returned 0x970 [0075.409] GetCurrentThreadId () returned 0x970 [0075.409] GetCurrentThreadId () returned 0x970 [0075.409] GetCurrentThreadId () returned 0x970 [0075.409] GetCurrentThreadId () returned 0x970 [0075.409] GetCurrentThreadId () returned 0x970 [0075.409] GetCurrentThreadId () returned 0x970 [0075.409] GetCurrentThreadId () returned 0x970 [0075.409] GetCurrentThreadId () returned 0x970 [0075.409] GetCurrentThreadId () returned 0x970 [0075.409] GetCurrentThreadId () returned 0x970 [0075.409] GetCurrentThreadId () returned 0x970 [0075.409] GetCurrentThreadId () returned 0x970 [0075.409] GetCurrentThreadId () returned 0x970 [0075.409] GetCurrentThreadId () returned 0x970 [0075.409] GetCurrentThreadId () returned 0x970 [0075.409] GetCurrentThreadId () returned 0x970 [0075.409] GetCurrentThreadId () returned 0x970 [0075.409] GetCurrentThreadId () returned 0x970 [0075.409] GetCurrentThreadId () returned 0x970 [0075.409] GetCurrentThreadId () returned 0x970 [0075.409] GetCurrentThreadId () returned 0x970 [0075.409] GetCurrentThreadId () returned 0x970 [0075.409] GetCurrentThreadId () returned 0x970 [0075.409] GetCurrentThreadId () returned 0x970 [0075.409] GetCurrentThreadId () returned 0x970 [0075.409] GetCurrentThreadId () returned 0x970 [0075.409] GetCurrentThreadId () returned 0x970 [0075.409] GetCurrentThreadId () returned 0x970 [0075.409] GetCurrentThreadId () returned 0x970 [0075.409] GetCurrentThreadId () returned 0x970 [0075.409] GetCurrentThreadId () returned 0x970 [0075.409] GetCurrentThreadId () returned 0x970 [0075.409] GetCurrentThreadId () returned 0x970 [0075.409] GetCurrentThreadId () returned 0x970 [0075.409] GetCurrentThreadId () returned 0x970 [0075.409] GetCurrentThreadId () returned 0x970 [0075.409] GetCurrentThreadId () returned 0x970 [0075.409] GetCurrentThreadId () returned 0x970 [0075.410] GetCurrentThreadId () returned 0x970 [0075.410] GetCurrentThreadId () returned 0x970 [0075.410] GetCurrentThreadId () returned 0x970 [0075.410] GetCurrentThreadId () returned 0x970 [0075.410] GetCurrentThreadId () returned 0x970 [0075.410] GetCurrentThreadId () returned 0x970 [0075.410] GetCurrentThreadId () returned 0x970 [0075.410] GetCurrentThreadId () returned 0x970 [0075.410] GetCurrentThreadId () returned 0x970 [0075.410] GetCurrentThreadId () returned 0x970 [0075.410] GetCurrentThreadId () returned 0x970 [0075.410] GetCurrentThreadId () returned 0x970 [0075.410] GetCurrentThreadId () returned 0x970 [0075.410] GetCurrentThreadId () returned 0x970 [0075.410] GetCurrentThreadId () returned 0x970 [0075.410] GetCurrentThreadId () returned 0x970 [0075.410] GetCurrentThreadId () returned 0x970 [0075.410] GetCurrentThreadId () returned 0x970 [0075.410] GetCurrentThreadId () returned 0x970 [0075.410] GetCurrentThreadId () returned 0x970 [0075.410] GetCurrentThreadId () returned 0x970 [0075.410] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAGxcyFQF7zVrNLFhYydknal3RjEIjcZtXHULmrvEPswWdIzqyWxjM2tKdVe9MSHPbfS8jJ28txEqBVSZEDqeaQVDJ3vkFcnBg2cMZNxRcdAByAFdw1yaGXKLr0tgRH8Ia6vkvJI0+SjLNgVrhXbh8+xunJv30Z181+gWumLB7DPsy+2+t2TfxY0PznMMNKPseS3Sue959oXklfqFgSWkxIx3qFrkDVHUrA==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0075.410] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAGxcyFQF7zVrNLFhYydknal3RjEIjcZtXHULmrvEPswWdIzqyWxjM2tKdVe9MSHPbfS8jJ28txEqBVSZEDqeaQVDJ3vkFcnBg2cMZNxRcdAByAFdw1yaGXKLr0tgRH8Ia6vkvJI0+SjLNgVrhXbh8+xunJv30Z181+gWumLB7DPsy+2+t2TfxY0PznMMNKPseS3Sue959oXklfqFgSWkxIx3qFrkDVHUrA==", cchWideChar=245, lpMultiByteStr=0x353b64c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAGxcyFQF7zVrNLFhYydknal3RjEIjcZtXHULmrvEPswWdIzqyWxjM2tKdVe9MSHPbfS8jJ28txEqBVSZEDqeaQVDJ3vkFcnBg2cMZNxRcdAByAFdw1yaGXKLr0tgRH8Ia6vkvJI0+SjLNgVrhXbh8+xunJv30Z181+gWumLB7DPsy+2+t2TfxY0PznMMNKPseS3Sue959oXklfqFgSWkxIx3qFrkDVHUrA==", lpUsedDefaultChar=0x0) returned 245 [0075.410] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0075.410] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0075.410] CloseHandle (hObject=0x158) returned 1 [0075.410] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_selectionsubpicture.png")) returned 0 [0075.411] GetLastError () returned 0x5 [0075.411] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_selectionsubpicture.png")) returned 0x20 [0075.411] SetLastError (dwErrCode=0x5) [0075.411] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=19567418909) returned 1 [0075.411] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\Файл зашифрован [NavigationUp_ButtonGraphic.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\Файл зашифрован [navigationup_buttongraphic.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0075.411] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0075.411] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0075.411] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0075.411] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0075.412] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0075.412] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0075.412] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0075.412] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0075.412] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0075.412] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0075.412] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0075.412] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0075.412] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0075.412] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0075.412] SetEndOfFile (hFile=0x158) returned 1 [0075.412] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0075.412] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0075.412] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0075.412] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0075.412] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0075.413] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0075.413] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="\"AjXY!!oiRc9ho#m~=m3b@nTZX(", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0075.413] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="\"AjXY!!oiRc9ho#m~=m3b@nTZX(", cchWideChar=32, lpMultiByteStr=0x203816c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\"AjXY!!oiRc9ho#m~=m3b@nTZX(", lpUsedDefaultChar=0x0) returned 32 [0075.414] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0075.414] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0075.414] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f65c205, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f65c205, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 0x295098 [0075.414] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0075.414] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0075.414] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_buttongraphic.png")) returned 0x20 [0075.414] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_buttongraphic.png")) returned 0x20 [0075.414] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_buttongraphic.png")) returned 0x20 [0075.414] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_buttongraphic.png")) returned 0x20 [0075.414] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_buttongraphic.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f65c205, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f65c205, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b)) returned 1 [0075.414] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0075.414] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0075.414] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_buttongraphic.png")) returned 0x20 [0075.414] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_buttongraphic.png")) returned 0x20 [0075.414] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0075.414] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0075.415] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0075.415] SetEndOfFile (hFile=0x158) returned 1 [0075.415] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0075.415] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x2005e4c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0075.415] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0075.416] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x20055ac, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0075.416] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x20055ac, cbMultiByte=30, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="NavigationUp_ButtonGraphic.pngpngre.pngp") returned 30 [0075.416] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0075.416] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x2005e4c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0075.416] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0075.416] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0075.416] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x135b [0075.416] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0075.416] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0075.416] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0075.416] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0075.416] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x2005e4c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0075.416] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0075.416] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x20055ac, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0075.417] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x20055ac, cbMultiByte=30, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="NavigationUp_ButtonGraphic.pngic.pngpngre.pngp") returned 30 [0075.417] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0075.417] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x2005e4c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0075.417] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0075.418] CharToOemA (in: pSrc="NavigationUp_ButtonGraphic.png", pDst=0x20055ac | out: pDst="NavigationUp_ButtonGraphic.png") returned 1 [0075.418] WriteFile (in: hFile=0x158, lpBuffer=0x20055ac*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x20055ac*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0075.418] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0075.418] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0075.418] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0075.418] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=19568186086) returned 1 [0075.418] ReadFile (in: hFile=0x11c, lpBuffer=0x3b62f50, nNumberOfBytesToRead=0x135b, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b62f50*, lpNumberOfBytesRead=0x18dd7c*=0x135b, lpOverlapped=0x0) returned 1 [0075.420] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0075.420] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=19568371131) returned 1 [0075.429] WriteFile (in: hFile=0x158, lpBuffer=0x379adb0*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379adb0*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0075.429] ReadFile (in: hFile=0x11c, lpBuffer=0x3b62f50, nNumberOfBytesToRead=0x135b, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3b62f50*, lpNumberOfBytesRead=0x18de38*=0x135b, lpOverlapped=0x0) returned 1 [0075.429] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x59 [0075.429] WriteFile (in: hFile=0x158, lpBuffer=0x3b95b40*, nNumberOfBytesToWrite=0x135b, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3b95b40*, lpNumberOfBytesWritten=0x18de10*=0x135b, lpOverlapped=0x0) returned 1 [0075.430] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x13b4 [0075.430] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0075.430] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0075.430] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0075.430] SetFilePointer (in: hFile=0x158, lDistanceToMove=30, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x3c [0075.430] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x13be [0075.430] CloseHandle (hObject=0x11c) returned 1 [0075.430] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x13be [0075.430] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x13be [0075.430] SetFilePointer (in: hFile=0x158, lDistanceToMove=5054, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x13be [0075.430] SetFilePointer (in: hFile=0x158, lDistanceToMove=5054, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x13be [0075.430] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x13be [0075.431] SetFilePointer (in: hFile=0x158, lDistanceToMove=5054, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x13be [0075.431] SetEndOfFile (hFile=0x158) returned 1 [0075.431] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x13be [0075.431] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x13be [0075.431] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0075.431] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x20055ac, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0075.431] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0075.431] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x2005e4c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0075.431] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x2005e4c, cbMultiByte=30, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="NavigationUp_ButtonGraphic.png䃍㫋ÆǏ፷") returned 30 [0075.431] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0075.431] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x20055ac, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 30 [0075.431] WriteFile (in: hFile=0x158, lpBuffer=0x3b46a28*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3b46a28*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0075.431] CharToOemA (in: pSrc="NavigationUp_ButtonGraphic.png", pDst=0x2005e4c | out: pDst="NavigationUp_ButtonGraphic.png") returned 1 [0075.431] WriteFile (in: hFile=0x158, lpBuffer=0x2005e4c*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x2005e4c*, lpNumberOfBytesWritten=0x18efcc*=0x1e, lpOverlapped=0x0) returned 1 [0075.431] WriteFile (in: hFile=0x158, lpBuffer=0x379ae18*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379ae18*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0075.432] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0075.432] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0075.432] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1415 [0075.432] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1415 [0075.432] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0075.432] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0075.432] DeleteFileW (lpFileName="") returned 0 [0075.432] GetLastError () returned 0x3 [0075.432] GetFileAttributesW (lpFileName="") returned 0xffffffff [0075.432] SetLastError (dwErrCode=0x3) [0075.432] FlushFileBuffers (hFile=0x158) returned 1 [0075.435] GetCurrentThreadId () returned 0x970 [0075.435] GetCurrentThreadId () returned 0x970 [0075.435] GetCurrentThreadId () returned 0x970 [0075.435] GetCurrentThreadId () returned 0x970 [0075.435] GetCurrentThreadId () returned 0x970 [0075.435] GetCurrentThreadId () returned 0x970 [0075.435] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x14cc [0075.435] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x14cc [0075.435] SetFilePointer (in: hFile=0x158, lDistanceToMove=5324, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x14cc [0075.435] CloseHandle (hObject=0x158) returned 1 [0075.435] GetCurrentThreadId () returned 0x970 [0075.435] GetCurrentThreadId () returned 0x970 [0075.435] GetCurrentThreadId () returned 0x970 [0075.435] GetCurrentThreadId () returned 0x970 [0075.435] GetCurrentThreadId () returned 0x970 [0075.435] GetCurrentThreadId () returned 0x970 [0075.435] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\Файл зашифрован [NavigationUp_ButtonGraphic.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\Файл зашифрован [navigationup_buttongraphic.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0075.436] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14cc [0075.436] SetFilePointer (in: hFile=0x158, lDistanceToMove=5196, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x144c [0075.436] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0075.436] GetFileType (hFile=0x158) returned 0x1 [0075.436] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x16, wMilliseconds=0x2bf)) [0075.436] GetCurrentThreadId () returned 0x970 [0075.436] GetCurrentThreadId () returned 0x970 [0075.436] GetCurrentThreadId () returned 0x970 [0075.436] GetCurrentThreadId () returned 0x970 [0075.436] GetCurrentThreadId () returned 0x970 [0075.436] GetCurrentThreadId () returned 0x970 [0075.436] GetCurrentThreadId () returned 0x970 [0075.436] GetCurrentThreadId () returned 0x970 [0075.436] GetCurrentThreadId () returned 0x970 [0075.436] GetCurrentThreadId () returned 0x970 [0075.436] GetCurrentThreadId () returned 0x970 [0075.436] GetCurrentThreadId () returned 0x970 [0075.436] GetCurrentThreadId () returned 0x970 [0075.436] GetCurrentThreadId () returned 0x970 [0075.436] GetCurrentThreadId () returned 0x970 [0075.436] GetCurrentThreadId () returned 0x970 [0075.436] GetCurrentThreadId () returned 0x970 [0075.436] GetCurrentThreadId () returned 0x970 [0075.436] GetCurrentThreadId () returned 0x970 [0075.436] GetCurrentThreadId () returned 0x970 [0075.436] GetCurrentThreadId () returned 0x970 [0075.436] GetCurrentThreadId () returned 0x970 [0075.436] GetCurrentThreadId () returned 0x970 [0075.436] GetCurrentThreadId () returned 0x970 [0075.436] GetCurrentThreadId () returned 0x970 [0075.436] GetCurrentThreadId () returned 0x970 [0075.436] GetCurrentThreadId () returned 0x970 [0075.436] GetCurrentThreadId () returned 0x970 [0075.436] GetCurrentThreadId () returned 0x970 [0075.436] GetCurrentThreadId () returned 0x970 [0075.436] GetCurrentThreadId () returned 0x970 [0075.436] GetCurrentThreadId () returned 0x970 [0075.437] GetCurrentThreadId () returned 0x970 [0075.437] GetCurrentThreadId () returned 0x970 [0075.437] GetCurrentThreadId () returned 0x970 [0075.437] GetCurrentThreadId () returned 0x970 [0075.437] GetCurrentThreadId () returned 0x970 [0075.437] GetCurrentThreadId () returned 0x970 [0075.437] GetCurrentThreadId () returned 0x970 [0075.437] GetCurrentThreadId () returned 0x970 [0075.437] GetCurrentThreadId () returned 0x970 [0075.437] GetCurrentThreadId () returned 0x970 [0075.437] GetCurrentThreadId () returned 0x970 [0075.437] GetCurrentThreadId () returned 0x970 [0075.437] GetCurrentThreadId () returned 0x970 [0075.437] GetCurrentThreadId () returned 0x970 [0075.437] GetCurrentThreadId () returned 0x970 [0075.437] GetCurrentThreadId () returned 0x970 [0075.437] GetCurrentThreadId () returned 0x970 [0075.437] GetCurrentThreadId () returned 0x970 [0075.437] GetCurrentThreadId () returned 0x970 [0075.437] GetCurrentThreadId () returned 0x970 [0075.437] GetCurrentThreadId () returned 0x970 [0075.437] GetCurrentThreadId () returned 0x970 [0075.437] GetCurrentThreadId () returned 0x970 [0075.437] GetCurrentThreadId () returned 0x970 [0075.437] GetCurrentThreadId () returned 0x970 [0075.437] GetCurrentThreadId () returned 0x970 [0075.437] GetCurrentThreadId () returned 0x970 [0075.437] GetCurrentThreadId () returned 0x970 [0075.437] GetCurrentThreadId () returned 0x970 [0075.437] GetCurrentThreadId () returned 0x970 [0075.437] GetCurrentThreadId () returned 0x970 [0075.437] GetCurrentThreadId () returned 0x970 [0075.437] GetCurrentThreadId () returned 0x970 [0075.437] GetCurrentThreadId () returned 0x970 [0075.437] GetCurrentThreadId () returned 0x970 [0075.437] GetCurrentThreadId () returned 0x970 [0075.437] GetCurrentThreadId () returned 0x970 [0075.437] GetCurrentThreadId () returned 0x970 [0075.437] GetCurrentThreadId () returned 0x970 [0075.437] GetCurrentThreadId () returned 0x970 [0075.437] GetCurrentThreadId () returned 0x970 [0075.437] GetCurrentThreadId () returned 0x970 [0075.437] GetCurrentThreadId () returned 0x970 [0075.437] GetCurrentThreadId () returned 0x970 [0075.438] GetCurrentThreadId () returned 0x970 [0075.438] GetCurrentThreadId () returned 0x970 [0075.438] GetCurrentThreadId () returned 0x970 [0075.438] GetCurrentThreadId () returned 0x970 [0075.438] GetCurrentThreadId () returned 0x970 [0075.438] GetCurrentThreadId () returned 0x970 [0075.438] GetCurrentThreadId () returned 0x970 [0075.438] GetCurrentThreadId () returned 0x970 [0075.438] GetCurrentThreadId () returned 0x970 [0075.438] GetCurrentThreadId () returned 0x970 [0075.438] GetCurrentThreadId () returned 0x970 [0075.438] GetCurrentThreadId () returned 0x970 [0075.438] GetCurrentThreadId () returned 0x970 [0075.438] GetCurrentThreadId () returned 0x970 [0075.438] GetCurrentThreadId () returned 0x970 [0075.438] GetCurrentThreadId () returned 0x970 [0075.438] GetCurrentThreadId () returned 0x970 [0075.438] GetCurrentThreadId () returned 0x970 [0075.438] GetCurrentThreadId () returned 0x970 [0075.438] GetCurrentThreadId () returned 0x970 [0075.438] GetCurrentThreadId () returned 0x970 [0075.438] GetCurrentThreadId () returned 0x970 [0075.438] GetCurrentThreadId () returned 0x970 [0075.438] GetCurrentThreadId () returned 0x970 [0075.438] GetCurrentThreadId () returned 0x970 [0075.438] GetCurrentThreadId () returned 0x970 [0075.438] GetCurrentThreadId () returned 0x970 [0075.438] GetCurrentThreadId () returned 0x970 [0075.438] GetCurrentThreadId () returned 0x970 [0075.438] GetCurrentThreadId () returned 0x970 [0075.438] GetCurrentThreadId () returned 0x970 [0075.438] GetCurrentThreadId () returned 0x970 [0075.438] GetCurrentThreadId () returned 0x970 [0075.438] GetCurrentThreadId () returned 0x970 [0075.438] GetCurrentThreadId () returned 0x970 [0075.438] GetCurrentThreadId () returned 0x970 [0075.438] GetCurrentThreadId () returned 0x970 [0075.438] GetCurrentThreadId () returned 0x970 [0075.438] GetCurrentThreadId () returned 0x970 [0075.438] GetCurrentThreadId () returned 0x970 [0075.438] GetCurrentThreadId () returned 0x970 [0075.438] GetCurrentThreadId () returned 0x970 [0075.438] GetCurrentThreadId () returned 0x970 [0075.438] GetCurrentThreadId () returned 0x970 [0075.438] GetCurrentThreadId () returned 0x970 [0075.439] GetCurrentThreadId () returned 0x970 [0075.439] GetCurrentThreadId () returned 0x970 [0075.439] GetCurrentThreadId () returned 0x970 [0075.439] GetCurrentThreadId () returned 0x970 [0075.439] GetCurrentThreadId () returned 0x970 [0075.439] GetCurrentThreadId () returned 0x970 [0075.439] GetCurrentThreadId () returned 0x970 [0075.439] GetCurrentThreadId () returned 0x970 [0075.439] GetCurrentThreadId () returned 0x970 [0075.439] GetCurrentThreadId () returned 0x970 [0075.439] GetCurrentThreadId () returned 0x970 [0075.439] GetCurrentThreadId () returned 0x970 [0075.439] GetCurrentThreadId () returned 0x970 [0075.439] GetCurrentThreadId () returned 0x970 [0075.439] GetCurrentThreadId () returned 0x970 [0075.439] GetCurrentThreadId () returned 0x970 [0075.439] GetCurrentThreadId () returned 0x970 [0075.439] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.439] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.439] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a0398, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0075.439] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.439] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.439] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a0398, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0075.439] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.439] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.439] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0075.439] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.439] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.439] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0075.439] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.439] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.439] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a03f8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0075.439] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.439] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.439] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a03f8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0075.440] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.440] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.440] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a03f8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0075.440] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x16, wMilliseconds=0x2cf)) [0075.440] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="\"AjXY!!oiRc9ho#m~=m3b@nTZX(", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0075.440] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="\"AjXY!!oiRc9ho#m~=m3b@nTZX(", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0075.440] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="\"AjXY!!oiRc9ho#m~=m3b@nTZX(", cchWideChar=32, lpMultiByteStr=0x2005ff8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\"AjXY!!oiRc9ho#m~=m3b@nTZX(", lpUsedDefaultChar=0x0) returned 32 [0075.440] GetCurrentThreadId () returned 0x970 [0075.440] GetCurrentThreadId () returned 0x970 [0075.440] GetCurrentThreadId () returned 0x970 [0075.440] GetCurrentThreadId () returned 0x970 [0075.440] GetCurrentThreadId () returned 0x970 [0075.440] GetCurrentThreadId () returned 0x970 [0075.447] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0075.447] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0075.447] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3b40628, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0075.447] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ed848, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0075.447] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ed848, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAH4dYxkyCA24JS2o0l2PgXDnGIsmxU0f9temoCNS2v+3VF36M1YLrlb2A4Q2SfFlNS57FjkXTr5fyomhukKPYsPQRGKxSvAi3VK3Mn8qOFsDrzOe/ck0mVljywFmJ894hxDon4so+vkiPw36yGlmZawevoT/Ka0jF005ZHkOSmRKGov4VQP7P9GAY024VmF5BvZsRAOR7GZS/Ge0Kayx6ZJsrqrThiLbyw==") returned 232 [0075.447] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x16, wMilliseconds=0x2cf)) [0075.447] GetCurrentThreadId () returned 0x970 [0075.447] GetCurrentThreadId () returned 0x970 [0075.448] GetCurrentThreadId () returned 0x970 [0075.448] GetCurrentThreadId () returned 0x970 [0075.448] GetCurrentThreadId () returned 0x970 [0075.448] GetCurrentThreadId () returned 0x970 [0075.448] GetCurrentThreadId () returned 0x970 [0075.448] GetCurrentThreadId () returned 0x970 [0075.448] GetCurrentThreadId () returned 0x970 [0075.448] GetCurrentThreadId () returned 0x970 [0075.448] GetCurrentThreadId () returned 0x970 [0075.448] GetCurrentThreadId () returned 0x970 [0075.448] GetCurrentThreadId () returned 0x970 [0075.448] GetCurrentThreadId () returned 0x970 [0075.448] GetCurrentThreadId () returned 0x970 [0075.448] GetCurrentThreadId () returned 0x970 [0075.448] GetCurrentThreadId () returned 0x970 [0075.448] GetCurrentThreadId () returned 0x970 [0075.448] GetCurrentThreadId () returned 0x970 [0075.448] GetCurrentThreadId () returned 0x970 [0075.448] GetCurrentThreadId () returned 0x970 [0075.448] GetCurrentThreadId () returned 0x970 [0075.448] GetCurrentThreadId () returned 0x970 [0075.448] GetCurrentThreadId () returned 0x970 [0075.448] GetCurrentThreadId () returned 0x970 [0075.448] GetCurrentThreadId () returned 0x970 [0075.448] GetCurrentThreadId () returned 0x970 [0075.448] GetCurrentThreadId () returned 0x970 [0075.448] GetCurrentThreadId () returned 0x970 [0075.448] GetCurrentThreadId () returned 0x970 [0075.448] GetCurrentThreadId () returned 0x970 [0075.448] GetCurrentThreadId () returned 0x970 [0075.448] GetCurrentThreadId () returned 0x970 [0075.448] GetCurrentThreadId () returned 0x970 [0075.448] GetCurrentThreadId () returned 0x970 [0075.448] GetCurrentThreadId () returned 0x970 [0075.448] GetCurrentThreadId () returned 0x970 [0075.448] GetCurrentThreadId () returned 0x970 [0075.448] GetCurrentThreadId () returned 0x970 [0075.448] GetCurrentThreadId () returned 0x970 [0075.448] GetCurrentThreadId () returned 0x970 [0075.448] GetCurrentThreadId () returned 0x970 [0075.448] GetCurrentThreadId () returned 0x970 [0075.448] GetCurrentThreadId () returned 0x970 [0075.448] GetCurrentThreadId () returned 0x970 [0075.448] GetCurrentThreadId () returned 0x970 [0075.448] GetCurrentThreadId () returned 0x970 [0075.449] GetCurrentThreadId () returned 0x970 [0075.449] GetCurrentThreadId () returned 0x970 [0075.449] GetCurrentThreadId () returned 0x970 [0075.449] GetCurrentThreadId () returned 0x970 [0075.449] GetCurrentThreadId () returned 0x970 [0075.449] GetCurrentThreadId () returned 0x970 [0075.449] GetCurrentThreadId () returned 0x970 [0075.449] GetCurrentThreadId () returned 0x970 [0075.449] GetCurrentThreadId () returned 0x970 [0075.449] GetCurrentThreadId () returned 0x970 [0075.449] GetCurrentThreadId () returned 0x970 [0075.449] GetCurrentThreadId () returned 0x970 [0075.449] GetCurrentThreadId () returned 0x970 [0075.449] GetCurrentThreadId () returned 0x970 [0075.449] GetCurrentThreadId () returned 0x970 [0075.449] GetCurrentThreadId () returned 0x970 [0075.449] GetCurrentThreadId () returned 0x970 [0075.449] GetCurrentThreadId () returned 0x970 [0075.449] GetCurrentThreadId () returned 0x970 [0075.449] GetCurrentThreadId () returned 0x970 [0075.449] GetCurrentThreadId () returned 0x970 [0075.449] GetCurrentThreadId () returned 0x970 [0075.449] GetCurrentThreadId () returned 0x970 [0075.449] GetCurrentThreadId () returned 0x970 [0075.449] GetCurrentThreadId () returned 0x970 [0075.449] GetCurrentThreadId () returned 0x970 [0075.449] GetCurrentThreadId () returned 0x970 [0075.449] GetCurrentThreadId () returned 0x970 [0075.449] GetCurrentThreadId () returned 0x970 [0075.449] GetCurrentThreadId () returned 0x970 [0075.449] GetCurrentThreadId () returned 0x970 [0075.449] GetCurrentThreadId () returned 0x970 [0075.449] GetCurrentThreadId () returned 0x970 [0075.449] GetCurrentThreadId () returned 0x970 [0075.449] GetCurrentThreadId () returned 0x970 [0075.449] GetCurrentThreadId () returned 0x970 [0075.449] GetCurrentThreadId () returned 0x970 [0075.449] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAH4dYxkyCA24JS2o0l2PgXDnGIsmxU0f9temoCNS2v+3VF36M1YLrlb2A4Q2SfFlNS57FjkXTr5fyomhukKPYsPQRGKxSvAi3VK3Mn8qOFsDrzOe/ck0mVljywFmJ894hxDon4so+vkiPw36yGlmZawevoT/Ka0jF005ZHkOSmRKGov4VQP7P9GAY024VmF5BvZsRAOR7GZS/Ge0Kayx6ZJsrqrThiLbyw==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0075.449] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAH4dYxkyCA24JS2o0l2PgXDnGIsmxU0f9temoCNS2v+3VF36M1YLrlb2A4Q2SfFlNS57FjkXTr5fyomhukKPYsPQRGKxSvAi3VK3Mn8qOFsDrzOe/ck0mVljywFmJ894hxDon4so+vkiPw36yGlmZawevoT/Ka0jF005ZHkOSmRKGov4VQP7P9GAY024VmF5BvZsRAOR7GZS/Ge0Kayx6ZJsrqrThiLbyw==", cchWideChar=245, lpMultiByteStr=0x353b86c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAH4dYxkyCA24JS2o0l2PgXDnGIsmxU0f9temoCNS2v+3VF36M1YLrlb2A4Q2SfFlNS57FjkXTr5fyomhukKPYsPQRGKxSvAi3VK3Mn8qOFsDrzOe/ck0mVljywFmJ894hxDon4so+vkiPw36yGlmZawevoT/Ka0jF005ZHkOSmRKGov4VQP7P9GAY024VmF5BvZsRAOR7GZS/Ge0Kayx6ZJsrqrThiLbyw==", lpUsedDefaultChar=0x0) returned 245 [0075.449] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0075.450] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0075.450] CloseHandle (hObject=0x158) returned 1 [0075.450] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_buttongraphic.png")) returned 0 [0075.450] GetLastError () returned 0x5 [0075.450] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_buttongraphic.png")) returned 0x20 [0075.450] SetLastError (dwErrCode=0x5) [0075.450] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=19571357341) returned 1 [0075.450] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\Файл зашифрован [NavigationUp_SelectionSubpicture.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\Файл зашифрован [navigationup_selectionsubpicture.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0075.451] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0075.451] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0075.451] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0075.451] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0075.451] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0075.451] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0075.451] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0075.451] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0075.451] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0075.451] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0075.451] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0075.451] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0075.451] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0075.451] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0075.452] SetEndOfFile (hFile=0x158) returned 1 [0075.452] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0075.452] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0075.452] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0075.452] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0075.452] WriteFile (in: hFile=0x158, lpBuffer=0x3777058*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777058*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0075.453] WriteFile (in: hFile=0x158, lpBuffer=0x35f035c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f035c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0075.453] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="tscSO)h@r\\uzo>}b$:iD^-m%QdG", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0075.453] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="tscSO)h@r\\uzo>}b$:iD^-m%QdG", cchWideChar=32, lpMultiByteStr=0x20390bc, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tscSO)h@r\\uzo>}b$:iD^-m%QdG", lpUsedDefaultChar=0x0) returned 32 [0075.453] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0075.453] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0075.453] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f65c205, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f65c205, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 0x295098 [0075.453] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0075.453] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0075.453] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_selectionsubpicture.png")) returned 0x20 [0075.453] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_selectionsubpicture.png")) returned 0x20 [0075.454] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_selectionsubpicture.png")) returned 0x20 [0075.454] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_selectionsubpicture.png")) returned 0x20 [0075.454] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_selectionsubpicture.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f65c205, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f65c205, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09)) returned 1 [0075.454] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0075.454] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0075.454] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_selectionsubpicture.png")) returned 0x20 [0075.454] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_selectionsubpicture.png")) returned 0x20 [0075.454] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0075.454] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0075.454] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0075.454] SetEndOfFile (hFile=0x158) returned 1 [0075.455] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0075.455] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x20390f4, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0075.455] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0075.455] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x2039014, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0075.455] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x2039014, cbMultiByte=36, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="NavigationUp_SelectionSubpicture.pngpngp") returned 36 [0075.455] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0075.455] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x20390f4, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0075.455] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0075.456] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0075.456] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0xc09 [0075.456] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0075.456] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0075.456] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0075.456] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0075.456] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x20390f4, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0075.456] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0075.456] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x2039014, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0075.456] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x2039014, cbMultiByte=36, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="NavigationUp_SelectionSubpicture.pngre.pngpngp") returned 36 [0075.456] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0075.456] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x20390f4, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0075.456] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0075.457] CharToOemA (in: pSrc="NavigationUp_SelectionSubpicture.png", pDst=0x2039014 | out: pDst="NavigationUp_SelectionSubpicture.png") returned 1 [0075.457] WriteFile (in: hFile=0x158, lpBuffer=0x2039014*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x2039014*, lpNumberOfBytesWritten=0x18e048*=0x24, lpOverlapped=0x0) returned 1 [0075.457] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0075.457] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0075.458] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0075.458] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=19572105565) returned 1 [0075.458] ReadFile (in: hFile=0x11c, lpBuffer=0x3b62f50, nNumberOfBytesToRead=0xc09, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b62f50*, lpNumberOfBytesRead=0x18dd7c*=0xc09, lpOverlapped=0x0) returned 1 [0075.459] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0075.459] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=19572249685) returned 1 [0075.468] WriteFile (in: hFile=0x158, lpBuffer=0x379acd8*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379acd8*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0075.468] ReadFile (in: hFile=0x11c, lpBuffer=0x3b62f50, nNumberOfBytesToRead=0xc09, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3b62f50*, lpNumberOfBytesRead=0x18de38*=0xc09, lpOverlapped=0x0) returned 1 [0075.468] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x5f [0075.468] WriteFile (in: hFile=0x158, lpBuffer=0x3b95340*, nNumberOfBytesToWrite=0xc09, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3b95340*, lpNumberOfBytesWritten=0x18de10*=0xc09, lpOverlapped=0x0) returned 1 [0075.468] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0xc68 [0075.468] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0075.468] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0075.468] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0075.469] SetFilePointer (in: hFile=0x158, lDistanceToMove=36, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x42 [0075.469] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0xc72 [0075.469] CloseHandle (hObject=0x11c) returned 1 [0075.469] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xc72 [0075.469] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xc72 [0075.469] SetFilePointer (in: hFile=0x158, lDistanceToMove=3186, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xc72 [0075.469] SetFilePointer (in: hFile=0x158, lDistanceToMove=3186, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0xc72 [0075.469] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xc72 [0075.469] SetFilePointer (in: hFile=0x158, lDistanceToMove=3186, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0xc72 [0075.469] SetEndOfFile (hFile=0x158) returned 1 [0075.469] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xc72 [0075.469] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xc72 [0075.469] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0075.469] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x2039014, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0075.470] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0075.470] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x20390f4, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0075.470] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x20390f4, cbMultiByte=36, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="NavigationUp_SelectionSubpicture.pngఉ") returned 36 [0075.470] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0075.470] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x2039014, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 36 [0075.470] WriteFile (in: hFile=0x158, lpBuffer=0x3b46a28*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3b46a28*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0075.470] CharToOemA (in: pSrc="NavigationUp_SelectionSubpicture.png", pDst=0x20390f4 | out: pDst="NavigationUp_SelectionSubpicture.png") returned 1 [0075.470] WriteFile (in: hFile=0x158, lpBuffer=0x20390f4*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x20390f4*, lpNumberOfBytesWritten=0x18efcc*=0x24, lpOverlapped=0x0) returned 1 [0075.470] WriteFile (in: hFile=0x158, lpBuffer=0x379ad88*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379ad88*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0075.470] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0075.470] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0075.470] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xccf [0075.470] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xccf [0075.470] WriteFile (in: hFile=0x158, lpBuffer=0x3777058*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777058*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0075.470] WriteFile (in: hFile=0x158, lpBuffer=0x35f035c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f035c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0075.471] DeleteFileW (lpFileName="") returned 0 [0075.471] GetLastError () returned 0x3 [0075.471] GetFileAttributesW (lpFileName="") returned 0xffffffff [0075.471] SetLastError (dwErrCode=0x3) [0075.476] FlushFileBuffers (hFile=0x158) returned 1 [0075.479] GetCurrentThreadId () returned 0x970 [0075.479] GetCurrentThreadId () returned 0x970 [0075.479] GetCurrentThreadId () returned 0x970 [0075.479] GetCurrentThreadId () returned 0x970 [0075.479] GetCurrentThreadId () returned 0x970 [0075.479] GetCurrentThreadId () returned 0x970 [0075.479] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xd86 [0075.479] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xd86 [0075.479] SetFilePointer (in: hFile=0x158, lDistanceToMove=3462, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xd86 [0075.479] CloseHandle (hObject=0x158) returned 1 [0075.479] GetCurrentThreadId () returned 0x970 [0075.479] GetCurrentThreadId () returned 0x970 [0075.479] GetCurrentThreadId () returned 0x970 [0075.479] GetCurrentThreadId () returned 0x970 [0075.479] GetCurrentThreadId () returned 0x970 [0075.479] GetCurrentThreadId () returned 0x970 [0075.479] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\Файл зашифрован [NavigationUp_SelectionSubpicture.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\Файл зашифрован [navigationup_selectionsubpicture.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0075.480] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd86 [0075.480] SetFilePointer (in: hFile=0x158, lDistanceToMove=3334, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd06 [0075.480] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0075.480] GetFileType (hFile=0x158) returned 0x1 [0075.480] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x16, wMilliseconds=0x2ee)) [0075.480] GetCurrentThreadId () returned 0x970 [0075.480] GetCurrentThreadId () returned 0x970 [0075.480] GetCurrentThreadId () returned 0x970 [0075.480] GetCurrentThreadId () returned 0x970 [0075.480] GetCurrentThreadId () returned 0x970 [0075.480] GetCurrentThreadId () returned 0x970 [0075.480] GetCurrentThreadId () returned 0x970 [0075.480] GetCurrentThreadId () returned 0x970 [0075.480] GetCurrentThreadId () returned 0x970 [0075.480] GetCurrentThreadId () returned 0x970 [0075.480] GetCurrentThreadId () returned 0x970 [0075.480] GetCurrentThreadId () returned 0x970 [0075.480] GetCurrentThreadId () returned 0x970 [0075.480] GetCurrentThreadId () returned 0x970 [0075.480] GetCurrentThreadId () returned 0x970 [0075.480] GetCurrentThreadId () returned 0x970 [0075.480] GetCurrentThreadId () returned 0x970 [0075.480] GetCurrentThreadId () returned 0x970 [0075.480] GetCurrentThreadId () returned 0x970 [0075.480] GetCurrentThreadId () returned 0x970 [0075.480] GetCurrentThreadId () returned 0x970 [0075.480] GetCurrentThreadId () returned 0x970 [0075.480] GetCurrentThreadId () returned 0x970 [0075.480] GetCurrentThreadId () returned 0x970 [0075.480] GetCurrentThreadId () returned 0x970 [0075.480] GetCurrentThreadId () returned 0x970 [0075.480] GetCurrentThreadId () returned 0x970 [0075.480] GetCurrentThreadId () returned 0x970 [0075.480] GetCurrentThreadId () returned 0x970 [0075.480] GetCurrentThreadId () returned 0x970 [0075.480] GetCurrentThreadId () returned 0x970 [0075.481] GetCurrentThreadId () returned 0x970 [0075.481] GetCurrentThreadId () returned 0x970 [0075.481] GetCurrentThreadId () returned 0x970 [0075.481] GetCurrentThreadId () returned 0x970 [0075.481] GetCurrentThreadId () returned 0x970 [0075.481] GetCurrentThreadId () returned 0x970 [0075.481] GetCurrentThreadId () returned 0x970 [0075.481] GetCurrentThreadId () returned 0x970 [0075.481] GetCurrentThreadId () returned 0x970 [0075.481] GetCurrentThreadId () returned 0x970 [0075.481] GetCurrentThreadId () returned 0x970 [0075.481] GetCurrentThreadId () returned 0x970 [0075.481] GetCurrentThreadId () returned 0x970 [0075.481] GetCurrentThreadId () returned 0x970 [0075.481] GetCurrentThreadId () returned 0x970 [0075.481] GetCurrentThreadId () returned 0x970 [0075.481] GetCurrentThreadId () returned 0x970 [0075.481] GetCurrentThreadId () returned 0x970 [0075.481] GetCurrentThreadId () returned 0x970 [0075.481] GetCurrentThreadId () returned 0x970 [0075.481] GetCurrentThreadId () returned 0x970 [0075.481] GetCurrentThreadId () returned 0x970 [0075.481] GetCurrentThreadId () returned 0x970 [0075.481] GetCurrentThreadId () returned 0x970 [0075.481] GetCurrentThreadId () returned 0x970 [0075.481] GetCurrentThreadId () returned 0x970 [0075.481] GetCurrentThreadId () returned 0x970 [0075.481] GetCurrentThreadId () returned 0x970 [0075.481] GetCurrentThreadId () returned 0x970 [0075.481] GetCurrentThreadId () returned 0x970 [0075.481] GetCurrentThreadId () returned 0x970 [0075.481] GetCurrentThreadId () returned 0x970 [0075.481] GetCurrentThreadId () returned 0x970 [0075.481] GetCurrentThreadId () returned 0x970 [0075.481] GetCurrentThreadId () returned 0x970 [0075.481] GetCurrentThreadId () returned 0x970 [0075.481] GetCurrentThreadId () returned 0x970 [0075.481] GetCurrentThreadId () returned 0x970 [0075.481] GetCurrentThreadId () returned 0x970 [0075.481] GetCurrentThreadId () returned 0x970 [0075.481] GetCurrentThreadId () returned 0x970 [0075.481] GetCurrentThreadId () returned 0x970 [0075.481] GetCurrentThreadId () returned 0x970 [0075.481] GetCurrentThreadId () returned 0x970 [0075.482] GetCurrentThreadId () returned 0x970 [0075.482] GetCurrentThreadId () returned 0x970 [0075.482] GetCurrentThreadId () returned 0x970 [0075.482] GetCurrentThreadId () returned 0x970 [0075.482] GetCurrentThreadId () returned 0x970 [0075.482] GetCurrentThreadId () returned 0x970 [0075.482] GetCurrentThreadId () returned 0x970 [0075.482] GetCurrentThreadId () returned 0x970 [0075.482] GetCurrentThreadId () returned 0x970 [0075.482] GetCurrentThreadId () returned 0x970 [0075.482] GetCurrentThreadId () returned 0x970 [0075.482] GetCurrentThreadId () returned 0x970 [0075.482] GetCurrentThreadId () returned 0x970 [0075.482] GetCurrentThreadId () returned 0x970 [0075.482] GetCurrentThreadId () returned 0x970 [0075.482] GetCurrentThreadId () returned 0x970 [0075.482] GetCurrentThreadId () returned 0x970 [0075.482] GetCurrentThreadId () returned 0x970 [0075.482] GetCurrentThreadId () returned 0x970 [0075.482] GetCurrentThreadId () returned 0x970 [0075.482] GetCurrentThreadId () returned 0x970 [0075.482] GetCurrentThreadId () returned 0x970 [0075.482] GetCurrentThreadId () returned 0x970 [0075.482] GetCurrentThreadId () returned 0x970 [0075.482] GetCurrentThreadId () returned 0x970 [0075.482] GetCurrentThreadId () returned 0x970 [0075.482] GetCurrentThreadId () returned 0x970 [0075.482] GetCurrentThreadId () returned 0x970 [0075.482] GetCurrentThreadId () returned 0x970 [0075.482] GetCurrentThreadId () returned 0x970 [0075.482] GetCurrentThreadId () returned 0x970 [0075.482] GetCurrentThreadId () returned 0x970 [0075.482] GetCurrentThreadId () returned 0x970 [0075.482] GetCurrentThreadId () returned 0x970 [0075.482] GetCurrentThreadId () returned 0x970 [0075.482] GetCurrentThreadId () returned 0x970 [0075.482] GetCurrentThreadId () returned 0x970 [0075.482] GetCurrentThreadId () returned 0x970 [0075.482] GetCurrentThreadId () returned 0x970 [0075.482] GetCurrentThreadId () returned 0x970 [0075.482] GetCurrentThreadId () returned 0x970 [0075.482] GetCurrentThreadId () returned 0x970 [0075.482] GetCurrentThreadId () returned 0x970 [0075.482] GetCurrentThreadId () returned 0x970 [0075.482] GetCurrentThreadId () returned 0x970 [0075.483] GetCurrentThreadId () returned 0x970 [0075.483] GetCurrentThreadId () returned 0x970 [0075.483] GetCurrentThreadId () returned 0x970 [0075.483] GetCurrentThreadId () returned 0x970 [0075.483] GetCurrentThreadId () returned 0x970 [0075.483] GetCurrentThreadId () returned 0x970 [0075.483] GetCurrentThreadId () returned 0x970 [0075.483] GetCurrentThreadId () returned 0x970 [0075.483] GetCurrentThreadId () returned 0x970 [0075.483] GetCurrentThreadId () returned 0x970 [0075.483] GetCurrentThreadId () returned 0x970 [0075.483] GetCurrentThreadId () returned 0x970 [0075.483] GetCurrentThreadId () returned 0x970 [0075.483] GetCurrentThreadId () returned 0x970 [0075.483] GetCurrentThreadId () returned 0x970 [0075.483] GetCurrentThreadId () returned 0x970 [0075.483] GetCurrentThreadId () returned 0x970 [0075.483] GetCurrentThreadId () returned 0x970 [0075.483] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.483] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.483] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a03f8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0075.483] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.483] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.483] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a03f8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0075.483] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.483] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.483] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0075.483] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.483] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.483] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0075.483] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.483] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.483] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a0458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0075.483] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.483] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.483] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a0458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0075.483] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.484] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.484] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a0458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0075.484] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x16, wMilliseconds=0x2ee)) [0075.484] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tscSO)h@r\\uzo>}b$:iD^-m%QdG", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0075.484] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tscSO)h@r\\uzo>}b$:iD^-m%QdG", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0075.484] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tscSO)h@r\\uzo>}b$:iD^-m%QdG", cchWideChar=32, lpMultiByteStr=0x2006028, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tscSO)h@r\\uzo>}b$:iD^-m%QdG", lpUsedDefaultChar=0x0) returned 32 [0075.484] GetCurrentThreadId () returned 0x970 [0075.484] GetCurrentThreadId () returned 0x970 [0075.484] GetCurrentThreadId () returned 0x970 [0075.484] GetCurrentThreadId () returned 0x970 [0075.484] GetCurrentThreadId () returned 0x970 [0075.484] GetCurrentThreadId () returned 0x970 [0075.492] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0075.492] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0075.492] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3b40628, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0075.492] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ed848, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0075.492] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ed848, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAE8d1Vd1mSL4rIopiSPQcTt4QsfCEyzunKt1yh9oLlPMsqCC+9pT+lP4WMvdDkWmqcoDLncLfuQruUVEGQ1dV5Qiv9kUIWe0+haqsNb23U+WTmyOiFD0T5/qhldKY9JlTiGH6nfqnKselDUZUj+dyipMD6EDvE7nUXpPRcrS69j7YrjWKjzI74+V2s+gOOQcOkhI9K1XhqGT+H/Q8mpfOdLqvWGbGSGBiw==") returned 232 [0075.492] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x16, wMilliseconds=0x2fe)) [0075.492] GetCurrentThreadId () returned 0x970 [0075.492] GetCurrentThreadId () returned 0x970 [0075.492] GetCurrentThreadId () returned 0x970 [0075.492] GetCurrentThreadId () returned 0x970 [0075.492] GetCurrentThreadId () returned 0x970 [0075.492] GetCurrentThreadId () returned 0x970 [0075.492] GetCurrentThreadId () returned 0x970 [0075.492] GetCurrentThreadId () returned 0x970 [0075.492] GetCurrentThreadId () returned 0x970 [0075.492] GetCurrentThreadId () returned 0x970 [0075.492] GetCurrentThreadId () returned 0x970 [0075.492] GetCurrentThreadId () returned 0x970 [0075.492] GetCurrentThreadId () returned 0x970 [0075.492] GetCurrentThreadId () returned 0x970 [0075.492] GetCurrentThreadId () returned 0x970 [0075.492] GetCurrentThreadId () returned 0x970 [0075.492] GetCurrentThreadId () returned 0x970 [0075.492] GetCurrentThreadId () returned 0x970 [0075.492] GetCurrentThreadId () returned 0x970 [0075.492] GetCurrentThreadId () returned 0x970 [0075.492] GetCurrentThreadId () returned 0x970 [0075.492] GetCurrentThreadId () returned 0x970 [0075.492] GetCurrentThreadId () returned 0x970 [0075.492] GetCurrentThreadId () returned 0x970 [0075.492] GetCurrentThreadId () returned 0x970 [0075.492] GetCurrentThreadId () returned 0x970 [0075.492] GetCurrentThreadId () returned 0x970 [0075.492] GetCurrentThreadId () returned 0x970 [0075.492] GetCurrentThreadId () returned 0x970 [0075.492] GetCurrentThreadId () returned 0x970 [0075.492] GetCurrentThreadId () returned 0x970 [0075.492] GetCurrentThreadId () returned 0x970 [0075.492] GetCurrentThreadId () returned 0x970 [0075.492] GetCurrentThreadId () returned 0x970 [0075.492] GetCurrentThreadId () returned 0x970 [0075.493] GetCurrentThreadId () returned 0x970 [0075.493] GetCurrentThreadId () returned 0x970 [0075.493] GetCurrentThreadId () returned 0x970 [0075.493] GetCurrentThreadId () returned 0x970 [0075.493] GetCurrentThreadId () returned 0x970 [0075.493] GetCurrentThreadId () returned 0x970 [0075.493] GetCurrentThreadId () returned 0x970 [0075.493] GetCurrentThreadId () returned 0x970 [0075.493] GetCurrentThreadId () returned 0x970 [0075.493] GetCurrentThreadId () returned 0x970 [0075.493] GetCurrentThreadId () returned 0x970 [0075.493] GetCurrentThreadId () returned 0x970 [0075.493] GetCurrentThreadId () returned 0x970 [0075.493] GetCurrentThreadId () returned 0x970 [0075.493] GetCurrentThreadId () returned 0x970 [0075.493] GetCurrentThreadId () returned 0x970 [0075.493] GetCurrentThreadId () returned 0x970 [0075.493] GetCurrentThreadId () returned 0x970 [0075.493] GetCurrentThreadId () returned 0x970 [0075.493] GetCurrentThreadId () returned 0x970 [0075.493] GetCurrentThreadId () returned 0x970 [0075.493] GetCurrentThreadId () returned 0x970 [0075.493] GetCurrentThreadId () returned 0x970 [0075.493] GetCurrentThreadId () returned 0x970 [0075.493] GetCurrentThreadId () returned 0x970 [0075.493] GetCurrentThreadId () returned 0x970 [0075.493] GetCurrentThreadId () returned 0x970 [0075.493] GetCurrentThreadId () returned 0x970 [0075.493] GetCurrentThreadId () returned 0x970 [0075.493] GetCurrentThreadId () returned 0x970 [0075.493] GetCurrentThreadId () returned 0x970 [0075.493] GetCurrentThreadId () returned 0x970 [0075.493] GetCurrentThreadId () returned 0x970 [0075.493] GetCurrentThreadId () returned 0x970 [0075.493] GetCurrentThreadId () returned 0x970 [0075.493] GetCurrentThreadId () returned 0x970 [0075.493] GetCurrentThreadId () returned 0x970 [0075.493] GetCurrentThreadId () returned 0x970 [0075.493] GetCurrentThreadId () returned 0x970 [0075.493] GetCurrentThreadId () returned 0x970 [0075.493] GetCurrentThreadId () returned 0x970 [0075.493] GetCurrentThreadId () returned 0x970 [0075.493] GetCurrentThreadId () returned 0x970 [0075.493] GetCurrentThreadId () returned 0x970 [0075.493] GetCurrentThreadId () returned 0x970 [0075.494] GetCurrentThreadId () returned 0x970 [0075.494] GetCurrentThreadId () returned 0x970 [0075.494] GetCurrentThreadId () returned 0x970 [0075.494] GetCurrentThreadId () returned 0x970 [0075.494] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAE8d1Vd1mSL4rIopiSPQcTt4QsfCEyzunKt1yh9oLlPMsqCC+9pT+lP4WMvdDkWmqcoDLncLfuQruUVEGQ1dV5Qiv9kUIWe0+haqsNb23U+WTmyOiFD0T5/qhldKY9JlTiGH6nfqnKselDUZUj+dyipMD6EDvE7nUXpPRcrS69j7YrjWKjzI74+V2s+gOOQcOkhI9K1XhqGT+H/Q8mpfOdLqvWGbGSGBiw==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0075.494] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAE8d1Vd1mSL4rIopiSPQcTt4QsfCEyzunKt1yh9oLlPMsqCC+9pT+lP4WMvdDkWmqcoDLncLfuQruUVEGQ1dV5Qiv9kUIWe0+haqsNb23U+WTmyOiFD0T5/qhldKY9JlTiGH6nfqnKselDUZUj+dyipMD6EDvE7nUXpPRcrS69j7YrjWKjzI74+V2s+gOOQcOkhI9K1XhqGT+H/Q8mpfOdLqvWGbGSGBiw==", cchWideChar=245, lpMultiByteStr=0x353b75c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAE8d1Vd1mSL4rIopiSPQcTt4QsfCEyzunKt1yh9oLlPMsqCC+9pT+lP4WMvdDkWmqcoDLncLfuQruUVEGQ1dV5Qiv9kUIWe0+haqsNb23U+WTmyOiFD0T5/qhldKY9JlTiGH6nfqnKselDUZUj+dyipMD6EDvE7nUXpPRcrS69j7YrjWKjzI74+V2s+gOOQcOkhI9K1XhqGT+H/Q8mpfOdLqvWGbGSGBiw==", lpUsedDefaultChar=0x0) returned 245 [0075.494] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0075.494] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0075.494] CloseHandle (hObject=0x158) returned 1 [0075.494] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_selectionsubpicture.png")) returned 0 [0075.494] GetLastError () returned 0x5 [0075.494] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_selectionsubpicture.png")) returned 0x20 [0075.494] SetLastError (dwErrCode=0x5) [0075.494] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=19575781362) returned 1 [0075.501] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\Файл зашифрован [scenesscroll.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\Файл зашифрован [scenesscroll.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0075.502] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0075.502] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0075.502] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0075.502] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0075.502] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0075.502] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0075.502] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0075.502] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0075.503] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0075.503] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0075.503] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0075.503] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0075.503] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0075.503] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0075.503] SetEndOfFile (hFile=0x158) returned 1 [0075.503] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0075.503] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0075.503] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0075.503] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0075.503] WriteFile (in: hFile=0x158, lpBuffer=0x3777058*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777058*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0075.504] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0075.504] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PPE%x)Jk9wtiYz?d*2BLRysaL22l6~w>", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0075.504] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PPE%x)Jk9wtiYz?d*2BLRysaL22l6~w>", cchWideChar=32, lpMultiByteStr=0x203912c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPE%x)Jk9wtiYz?d*2BLRysaL22l6~w>", lpUsedDefaultChar=0x0) returned 32 [0075.504] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0075.505] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0075.505] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f52b71d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f52b71d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x17719, dwReserved0=0x0, dwReserved1=0x0, cFileName="scenesscroll.png", cAlternateFileName="")) returned 0x295098 [0075.505] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0075.505] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0075.505] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\scenesscroll.png")) returned 0x20 [0075.505] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\scenesscroll.png")) returned 0x20 [0075.505] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\scenesscroll.png")) returned 0x20 [0075.505] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\scenesscroll.png")) returned 0x20 [0075.505] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\scenesscroll.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f52b71d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f52b71d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x17719)) returned 1 [0075.505] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0075.505] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0075.505] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\scenesscroll.png")) returned 0x20 [0075.505] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\scenesscroll.png")) returned 0x20 [0075.505] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0075.505] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0075.506] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0075.506] SetEndOfFile (hFile=0x158) returned 1 [0075.506] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="scenesscroll.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0075.506] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="scenesscroll.png", cchWideChar=16, lpMultiByteStr=0x1ff89c4, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="scenesscroll.png", lpUsedDefaultChar=0x0) returned 16 [0075.506] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="scenesscroll.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0075.506] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="scenesscroll.png", cchWideChar=16, lpMultiByteStr=0x1ff894c, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="scenesscroll.png", lpUsedDefaultChar=0x0) returned 16 [0075.506] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff894c, cbMultiByte=16, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="scenesscroll.pngSubpicture.pngre.pngpngp") returned 16 [0075.507] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="scenesscroll.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0075.507] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="scenesscroll.png", cchWideChar=16, lpMultiByteStr=0x1ff89c4, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="scenesscroll.png", lpUsedDefaultChar=0x0) returned 16 [0075.507] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\scenesscroll.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0075.507] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0075.507] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x17719 [0075.507] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0075.507] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0075.507] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0075.507] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="scenesscroll.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0075.507] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="scenesscroll.png", cchWideChar=16, lpMultiByteStr=0x1ff89c4, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="scenesscroll.png", lpUsedDefaultChar=0x0) returned 16 [0075.507] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="scenesscroll.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0075.507] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="scenesscroll.png", cchWideChar=16, lpMultiByteStr=0x1ff894c, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="scenesscroll.png", lpUsedDefaultChar=0x0) returned 16 [0075.507] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff894c, cbMultiByte=16, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="scenesscroll.pngll.pngSubpicture.pngre.pngpngp") returned 16 [0075.508] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="scenesscroll.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0075.508] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="scenesscroll.png", cchWideChar=16, lpMultiByteStr=0x1ff89c4, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="scenesscroll.png", lpUsedDefaultChar=0x0) returned 16 [0075.508] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0075.508] CharToOemA (in: pSrc="scenesscroll.png", pDst=0x1ff894c | out: pDst="scenesscroll.png") returned 1 [0075.508] WriteFile (in: hFile=0x158, lpBuffer=0x1ff894c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1ff894c*, lpNumberOfBytesWritten=0x18e048*=0x10, lpOverlapped=0x0) returned 1 [0075.509] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0075.509] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0075.509] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0075.509] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=19577231484) returned 1 [0075.509] ReadFile (in: hFile=0x11c, lpBuffer=0x3b62f50, nNumberOfBytesToRead=0x17719, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b62f50*, lpNumberOfBytesRead=0x18dd7c*=0x17719, lpOverlapped=0x0) returned 1 [0075.512] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0075.512] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=19577512760) returned 1 [0075.520] WriteFile (in: hFile=0x158, lpBuffer=0x379acf0*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379acf0*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0075.521] ReadFile (in: hFile=0x11c, lpBuffer=0x3b62f50, nNumberOfBytesToRead=0x17719, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3b62f50*, lpNumberOfBytesRead=0x18de38*=0x17719, lpOverlapped=0x0) returned 1 [0075.523] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x4b [0075.523] WriteFile (in: hFile=0x158, lpBuffer=0x37dea90*, nNumberOfBytesToWrite=0x17719, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x37dea90*, lpNumberOfBytesWritten=0x18de10*=0x17719, lpOverlapped=0x0) returned 1 [0075.525] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x17764 [0075.525] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0075.525] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0075.525] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0075.526] SetFilePointer (in: hFile=0x158, lDistanceToMove=16, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2e [0075.526] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x1776e [0075.526] CloseHandle (hObject=0x11c) returned 1 [0075.526] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1776e [0075.526] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1776e [0075.526] SetFilePointer (in: hFile=0x158, lDistanceToMove=96110, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1776e [0075.526] SetFilePointer (in: hFile=0x158, lDistanceToMove=96110, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x1776e [0075.526] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1776e [0075.526] SetFilePointer (in: hFile=0x158, lDistanceToMove=96110, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x1776e [0075.526] SetEndOfFile (hFile=0x158) returned 1 [0075.526] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1776e [0075.526] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1776e [0075.526] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="scenesscroll.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0075.526] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="scenesscroll.png", cchWideChar=16, lpMultiByteStr=0x1ff894c, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="scenesscroll.png", lpUsedDefaultChar=0x0) returned 16 [0075.527] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="scenesscroll.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0075.527] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="scenesscroll.png", cchWideChar=16, lpMultiByteStr=0x1ff89c4, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="scenesscroll.png", lpUsedDefaultChar=0x0) returned 16 [0075.527] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff89c4, cbMultiByte=16, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="scenesscroll.png\x18믉`믑`") returned 16 [0075.527] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="scenesscroll.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0075.527] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="scenesscroll.png", cchWideChar=16, lpMultiByteStr=0x1ff894c, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="scenesscroll.png", lpUsedDefaultChar=0x0) returned 16 [0075.527] WriteFile (in: hFile=0x158, lpBuffer=0x3b46a28*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3b46a28*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0075.527] CharToOemA (in: pSrc="scenesscroll.png", pDst=0x1ff89c4 | out: pDst="scenesscroll.png") returned 1 [0075.527] WriteFile (in: hFile=0x158, lpBuffer=0x1ff89c4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1ff89c4*, lpNumberOfBytesWritten=0x18efcc*=0x10, lpOverlapped=0x0) returned 1 [0075.527] WriteFile (in: hFile=0x158, lpBuffer=0x379ade8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379ade8*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0075.527] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0075.527] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0075.527] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x177b7 [0075.527] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x177b7 [0075.527] WriteFile (in: hFile=0x158, lpBuffer=0x3777058*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777058*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0075.527] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0075.528] DeleteFileW (lpFileName="") returned 0 [0075.528] GetLastError () returned 0x3 [0075.528] GetFileAttributesW (lpFileName="") returned 0xffffffff [0075.528] SetLastError (dwErrCode=0x3) [0075.528] FlushFileBuffers (hFile=0x158) returned 1 [0075.531] GetCurrentThreadId () returned 0x970 [0075.531] GetCurrentThreadId () returned 0x970 [0075.531] GetCurrentThreadId () returned 0x970 [0075.531] GetCurrentThreadId () returned 0x970 [0075.531] GetCurrentThreadId () returned 0x970 [0075.531] GetCurrentThreadId () returned 0x970 [0075.531] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x1786e [0075.531] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x1786e [0075.531] SetFilePointer (in: hFile=0x158, lDistanceToMove=96366, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x1786e [0075.531] CloseHandle (hObject=0x158) returned 1 [0075.531] GetCurrentThreadId () returned 0x970 [0075.531] GetCurrentThreadId () returned 0x970 [0075.531] GetCurrentThreadId () returned 0x970 [0075.531] GetCurrentThreadId () returned 0x970 [0075.531] GetCurrentThreadId () returned 0x970 [0075.531] GetCurrentThreadId () returned 0x970 [0075.531] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\Файл зашифрован [scenesscroll.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\Файл зашифрован [scenesscroll.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0075.531] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1786e [0075.532] SetFilePointer (in: hFile=0x158, lDistanceToMove=96238, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x177ee [0075.532] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0075.532] GetFileType (hFile=0x158) returned 0x1 [0075.532] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x16, wMilliseconds=0x31d)) [0075.532] GetCurrentThreadId () returned 0x970 [0075.532] GetCurrentThreadId () returned 0x970 [0075.532] GetCurrentThreadId () returned 0x970 [0075.532] GetCurrentThreadId () returned 0x970 [0075.532] GetCurrentThreadId () returned 0x970 [0075.532] GetCurrentThreadId () returned 0x970 [0075.532] GetCurrentThreadId () returned 0x970 [0075.532] GetCurrentThreadId () returned 0x970 [0075.532] GetCurrentThreadId () returned 0x970 [0075.532] GetCurrentThreadId () returned 0x970 [0075.532] GetCurrentThreadId () returned 0x970 [0075.532] GetCurrentThreadId () returned 0x970 [0075.532] GetCurrentThreadId () returned 0x970 [0075.532] GetCurrentThreadId () returned 0x970 [0075.532] GetCurrentThreadId () returned 0x970 [0075.532] GetCurrentThreadId () returned 0x970 [0075.532] GetCurrentThreadId () returned 0x970 [0075.532] GetCurrentThreadId () returned 0x970 [0075.532] GetCurrentThreadId () returned 0x970 [0075.532] GetCurrentThreadId () returned 0x970 [0075.532] GetCurrentThreadId () returned 0x970 [0075.532] GetCurrentThreadId () returned 0x970 [0075.532] GetCurrentThreadId () returned 0x970 [0075.532] GetCurrentThreadId () returned 0x970 [0075.532] GetCurrentThreadId () returned 0x970 [0075.532] GetCurrentThreadId () returned 0x970 [0075.532] GetCurrentThreadId () returned 0x970 [0075.532] GetCurrentThreadId () returned 0x970 [0075.532] GetCurrentThreadId () returned 0x970 [0075.532] GetCurrentThreadId () returned 0x970 [0075.532] GetCurrentThreadId () returned 0x970 [0075.532] GetCurrentThreadId () returned 0x970 [0075.532] GetCurrentThreadId () returned 0x970 [0075.532] GetCurrentThreadId () returned 0x970 [0075.532] GetCurrentThreadId () returned 0x970 [0075.532] GetCurrentThreadId () returned 0x970 [0075.533] GetCurrentThreadId () returned 0x970 [0075.533] GetCurrentThreadId () returned 0x970 [0075.533] GetCurrentThreadId () returned 0x970 [0075.533] GetCurrentThreadId () returned 0x970 [0075.533] GetCurrentThreadId () returned 0x970 [0075.533] GetCurrentThreadId () returned 0x970 [0075.533] GetCurrentThreadId () returned 0x970 [0075.533] GetCurrentThreadId () returned 0x970 [0075.533] GetCurrentThreadId () returned 0x970 [0075.533] GetCurrentThreadId () returned 0x970 [0075.533] GetCurrentThreadId () returned 0x970 [0075.533] GetCurrentThreadId () returned 0x970 [0075.533] GetCurrentThreadId () returned 0x970 [0075.533] GetCurrentThreadId () returned 0x970 [0075.533] GetCurrentThreadId () returned 0x970 [0075.533] GetCurrentThreadId () returned 0x970 [0075.533] GetCurrentThreadId () returned 0x970 [0075.533] GetCurrentThreadId () returned 0x970 [0075.533] GetCurrentThreadId () returned 0x970 [0075.533] GetCurrentThreadId () returned 0x970 [0075.533] GetCurrentThreadId () returned 0x970 [0075.533] GetCurrentThreadId () returned 0x970 [0075.533] GetCurrentThreadId () returned 0x970 [0075.533] GetCurrentThreadId () returned 0x970 [0075.533] GetCurrentThreadId () returned 0x970 [0075.533] GetCurrentThreadId () returned 0x970 [0075.533] GetCurrentThreadId () returned 0x970 [0075.533] GetCurrentThreadId () returned 0x970 [0075.533] GetCurrentThreadId () returned 0x970 [0075.533] GetCurrentThreadId () returned 0x970 [0075.533] GetCurrentThreadId () returned 0x970 [0075.533] GetCurrentThreadId () returned 0x970 [0075.533] GetCurrentThreadId () returned 0x970 [0075.533] GetCurrentThreadId () returned 0x970 [0075.533] GetCurrentThreadId () returned 0x970 [0075.533] GetCurrentThreadId () returned 0x970 [0075.533] GetCurrentThreadId () returned 0x970 [0075.533] GetCurrentThreadId () returned 0x970 [0075.533] GetCurrentThreadId () returned 0x970 [0075.533] GetCurrentThreadId () returned 0x970 [0075.533] GetCurrentThreadId () returned 0x970 [0075.533] GetCurrentThreadId () returned 0x970 [0075.534] GetCurrentThreadId () returned 0x970 [0075.534] GetCurrentThreadId () returned 0x970 [0075.534] GetCurrentThreadId () returned 0x970 [0075.534] GetCurrentThreadId () returned 0x970 [0075.534] GetCurrentThreadId () returned 0x970 [0075.534] GetCurrentThreadId () returned 0x970 [0075.534] GetCurrentThreadId () returned 0x970 [0075.534] GetCurrentThreadId () returned 0x970 [0075.534] GetCurrentThreadId () returned 0x970 [0075.534] GetCurrentThreadId () returned 0x970 [0075.534] GetCurrentThreadId () returned 0x970 [0075.534] GetCurrentThreadId () returned 0x970 [0075.534] GetCurrentThreadId () returned 0x970 [0075.534] GetCurrentThreadId () returned 0x970 [0075.534] GetCurrentThreadId () returned 0x970 [0075.534] GetCurrentThreadId () returned 0x970 [0075.534] GetCurrentThreadId () returned 0x970 [0075.534] GetCurrentThreadId () returned 0x970 [0075.534] GetCurrentThreadId () returned 0x970 [0075.534] GetCurrentThreadId () returned 0x970 [0075.534] GetCurrentThreadId () returned 0x970 [0075.534] GetCurrentThreadId () returned 0x970 [0075.534] GetCurrentThreadId () returned 0x970 [0075.534] GetCurrentThreadId () returned 0x970 [0075.534] GetCurrentThreadId () returned 0x970 [0075.534] GetCurrentThreadId () returned 0x970 [0075.534] GetCurrentThreadId () returned 0x970 [0075.534] GetCurrentThreadId () returned 0x970 [0075.534] GetCurrentThreadId () returned 0x970 [0075.534] GetCurrentThreadId () returned 0x970 [0075.534] GetCurrentThreadId () returned 0x970 [0075.534] GetCurrentThreadId () returned 0x970 [0075.534] GetCurrentThreadId () returned 0x970 [0075.534] GetCurrentThreadId () returned 0x970 [0075.534] GetCurrentThreadId () returned 0x970 [0075.534] GetCurrentThreadId () returned 0x970 [0075.534] GetCurrentThreadId () returned 0x970 [0075.534] GetCurrentThreadId () returned 0x970 [0075.534] GetCurrentThreadId () returned 0x970 [0075.534] GetCurrentThreadId () returned 0x970 [0075.534] GetCurrentThreadId () returned 0x970 [0075.534] GetCurrentThreadId () returned 0x970 [0075.534] GetCurrentThreadId () returned 0x970 [0075.534] GetCurrentThreadId () returned 0x970 [0075.534] GetCurrentThreadId () returned 0x970 [0075.535] GetCurrentThreadId () returned 0x970 [0075.535] GetCurrentThreadId () returned 0x970 [0075.535] GetCurrentThreadId () returned 0x970 [0075.535] GetCurrentThreadId () returned 0x970 [0075.535] GetCurrentThreadId () returned 0x970 [0075.535] GetCurrentThreadId () returned 0x970 [0075.535] GetCurrentThreadId () returned 0x970 [0075.535] GetCurrentThreadId () returned 0x970 [0075.535] GetCurrentThreadId () returned 0x970 [0075.535] GetCurrentThreadId () returned 0x970 [0075.535] GetCurrentThreadId () returned 0x970 [0075.535] GetCurrentThreadId () returned 0x970 [0075.535] GetCurrentThreadId () returned 0x970 [0075.535] GetCurrentThreadId () returned 0x970 [0075.535] GetCurrentThreadId () returned 0x970 [0075.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a0458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0075.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a0458, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0075.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0075.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0075.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a04b8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0075.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a04b8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0075.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a04b8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0075.536] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x16, wMilliseconds=0x32c)) [0075.536] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPE%x)Jk9wtiYz?d*2BLRysaL22l6~w>", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0075.536] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPE%x)Jk9wtiYz?d*2BLRysaL22l6~w>", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0075.536] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPE%x)Jk9wtiYz?d*2BLRysaL22l6~w>", cchWideChar=32, lpMultiByteStr=0x2006058, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPE%x)Jk9wtiYz?d*2BLRysaL22l6~w>", lpUsedDefaultChar=0x0) returned 32 [0075.536] GetCurrentThreadId () returned 0x970 [0075.536] GetCurrentThreadId () returned 0x970 [0075.536] GetCurrentThreadId () returned 0x970 [0075.536] GetCurrentThreadId () returned 0x970 [0075.536] GetCurrentThreadId () returned 0x970 [0075.536] GetCurrentThreadId () returned 0x970 [0075.543] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0075.543] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0075.543] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3b40678, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0075.543] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ed848, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0075.543] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ed848, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAD6fGwks+rAWXXFo9jgu392IbillELyY9NlIlZEdoRbmJMaJyjdSNslmORhJnsOJoDXTWY53l5SCZAOuk664hwcexUHH3K7idizP2xNwhUXrQAjjgLvR78hh8+jqr7g1ncJ6x+m9wW4qwogqFjYJotih/ilXtQTqNBAwN+QpOK6rZzTekHoT7spxE7dB5aZLOxk5tE+TS9UogwcoXjgUdUGxFXgLpxVKtQ==") returned 232 [0075.543] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x16, wMilliseconds=0x32c)) [0075.543] GetCurrentThreadId () returned 0x970 [0075.543] GetCurrentThreadId () returned 0x970 [0075.544] GetCurrentThreadId () returned 0x970 [0075.544] GetCurrentThreadId () returned 0x970 [0075.544] GetCurrentThreadId () returned 0x970 [0075.544] GetCurrentThreadId () returned 0x970 [0075.544] GetCurrentThreadId () returned 0x970 [0075.544] GetCurrentThreadId () returned 0x970 [0075.544] GetCurrentThreadId () returned 0x970 [0075.544] GetCurrentThreadId () returned 0x970 [0075.544] GetCurrentThreadId () returned 0x970 [0075.544] GetCurrentThreadId () returned 0x970 [0075.544] GetCurrentThreadId () returned 0x970 [0075.544] GetCurrentThreadId () returned 0x970 [0075.544] GetCurrentThreadId () returned 0x970 [0075.544] GetCurrentThreadId () returned 0x970 [0075.544] GetCurrentThreadId () returned 0x970 [0075.544] GetCurrentThreadId () returned 0x970 [0075.544] GetCurrentThreadId () returned 0x970 [0075.544] GetCurrentThreadId () returned 0x970 [0075.544] GetCurrentThreadId () returned 0x970 [0075.544] GetCurrentThreadId () returned 0x970 [0075.544] GetCurrentThreadId () returned 0x970 [0075.544] GetCurrentThreadId () returned 0x970 [0075.544] GetCurrentThreadId () returned 0x970 [0075.544] GetCurrentThreadId () returned 0x970 [0075.544] GetCurrentThreadId () returned 0x970 [0075.544] GetCurrentThreadId () returned 0x970 [0075.544] GetCurrentThreadId () returned 0x970 [0075.544] GetCurrentThreadId () returned 0x970 [0075.544] GetCurrentThreadId () returned 0x970 [0075.544] GetCurrentThreadId () returned 0x970 [0075.544] GetCurrentThreadId () returned 0x970 [0075.544] GetCurrentThreadId () returned 0x970 [0075.544] GetCurrentThreadId () returned 0x970 [0075.544] GetCurrentThreadId () returned 0x970 [0075.544] GetCurrentThreadId () returned 0x970 [0075.544] GetCurrentThreadId () returned 0x970 [0075.544] GetCurrentThreadId () returned 0x970 [0075.544] GetCurrentThreadId () returned 0x970 [0075.544] GetCurrentThreadId () returned 0x970 [0075.544] GetCurrentThreadId () returned 0x970 [0075.544] GetCurrentThreadId () returned 0x970 [0075.544] GetCurrentThreadId () returned 0x970 [0075.544] GetCurrentThreadId () returned 0x970 [0075.544] GetCurrentThreadId () returned 0x970 [0075.544] GetCurrentThreadId () returned 0x970 [0075.545] GetCurrentThreadId () returned 0x970 [0075.545] GetCurrentThreadId () returned 0x970 [0075.545] GetCurrentThreadId () returned 0x970 [0075.545] GetCurrentThreadId () returned 0x970 [0075.545] GetCurrentThreadId () returned 0x970 [0075.545] GetCurrentThreadId () returned 0x970 [0075.545] GetCurrentThreadId () returned 0x970 [0075.545] GetCurrentThreadId () returned 0x970 [0075.545] GetCurrentThreadId () returned 0x970 [0075.545] GetCurrentThreadId () returned 0x970 [0075.545] GetCurrentThreadId () returned 0x970 [0075.545] GetCurrentThreadId () returned 0x970 [0075.545] GetCurrentThreadId () returned 0x970 [0075.545] GetCurrentThreadId () returned 0x970 [0075.545] GetCurrentThreadId () returned 0x970 [0075.545] GetCurrentThreadId () returned 0x970 [0075.545] GetCurrentThreadId () returned 0x970 [0075.545] GetCurrentThreadId () returned 0x970 [0075.545] GetCurrentThreadId () returned 0x970 [0075.545] GetCurrentThreadId () returned 0x970 [0075.545] GetCurrentThreadId () returned 0x970 [0075.545] GetCurrentThreadId () returned 0x970 [0075.545] GetCurrentThreadId () returned 0x970 [0075.545] GetCurrentThreadId () returned 0x970 [0075.545] GetCurrentThreadId () returned 0x970 [0075.545] GetCurrentThreadId () returned 0x970 [0075.545] GetCurrentThreadId () returned 0x970 [0075.545] GetCurrentThreadId () returned 0x970 [0075.545] GetCurrentThreadId () returned 0x970 [0075.545] GetCurrentThreadId () returned 0x970 [0075.545] GetCurrentThreadId () returned 0x970 [0075.545] GetCurrentThreadId () returned 0x970 [0075.545] GetCurrentThreadId () returned 0x970 [0075.545] GetCurrentThreadId () returned 0x970 [0075.545] GetCurrentThreadId () returned 0x970 [0075.545] GetCurrentThreadId () returned 0x970 [0075.545] GetCurrentThreadId () returned 0x970 [0075.545] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAD6fGwks+rAWXXFo9jgu392IbillELyY9NlIlZEdoRbmJMaJyjdSNslmORhJnsOJoDXTWY53l5SCZAOuk664hwcexUHH3K7idizP2xNwhUXrQAjjgLvR78hh8+jqr7g1ncJ6x+m9wW4qwogqFjYJotih/ilXtQTqNBAwN+QpOK6rZzTekHoT7spxE7dB5aZLOxk5tE+TS9UogwcoXjgUdUGxFXgLpxVKtQ==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0075.545] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAD6fGwks+rAWXXFo9jgu392IbillELyY9NlIlZEdoRbmJMaJyjdSNslmORhJnsOJoDXTWY53l5SCZAOuk664hwcexUHH3K7idizP2xNwhUXrQAjjgLvR78hh8+jqr7g1ncJ6x+m9wW4qwogqFjYJotih/ilXtQTqNBAwN+QpOK6rZzTekHoT7spxE7dB5aZLOxk5tE+TS9UogwcoXjgUdUGxFXgLpxVKtQ==", cchWideChar=245, lpMultiByteStr=0x353b75c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAD6fGwks+rAWXXFo9jgu392IbillELyY9NlIlZEdoRbmJMaJyjdSNslmORhJnsOJoDXTWY53l5SCZAOuk664hwcexUHH3K7idizP2xNwhUXrQAjjgLvR78hh8+jqr7g1ncJ6x+m9wW4qwogqFjYJotih/ilXtQTqNBAwN+QpOK6rZzTekHoT7spxE7dB5aZLOxk5tE+TS9UogwcoXjgUdUGxFXgLpxVKtQ==", lpUsedDefaultChar=0x0) returned 245 [0075.545] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0075.546] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0075.546] CloseHandle (hObject=0x158) returned 1 [0075.546] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\scenesscroll.png")) returned 0 [0075.546] GetLastError () returned 0x5 [0075.546] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\scenesscroll.png")) returned 0x20 [0075.546] SetLastError (dwErrCode=0x5) [0075.546] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=19581189166) returned 1 [0075.549] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\Файл зашифрован [specialmainsubpicture.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\Файл зашифрован [specialmainsubpicture.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0075.549] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0075.549] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0075.549] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0075.549] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0075.549] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0075.549] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0075.550] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0075.550] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0075.550] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0075.550] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0075.550] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0075.550] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0075.550] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0075.550] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0075.550] SetEndOfFile (hFile=0x158) returned 1 [0075.550] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0075.550] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0075.550] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0075.550] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0075.550] WriteFile (in: hFile=0x158, lpBuffer=0x3777058*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777058*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0075.551] WriteFile (in: hFile=0x158, lpBuffer=0x35f035c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f035c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0075.551] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="+FnhyJIK+=UP}\\w:)k=1m70qOsw)pUYN", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0075.551] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="+FnhyJIK+=UP}\\w:)k=1m70qOsw)pUYN", cchWideChar=32, lpMultiByteStr=0x203904c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="+FnhyJIK+=UP}\\w:)k=1m70qOsw)pUYN", lpUsedDefaultChar=0x0) returned 32 [0075.551] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0075.552] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0075.552] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f5055c0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f5055c0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb30, dwReserved0=0x0, dwReserved1=0x0, cFileName="specialmainsubpicture.png", cAlternateFileName="")) returned 0x295098 [0075.552] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0075.552] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0075.552] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialmainsubpicture.png")) returned 0x20 [0075.552] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialmainsubpicture.png")) returned 0x20 [0075.552] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialmainsubpicture.png")) returned 0x20 [0075.552] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialmainsubpicture.png")) returned 0x20 [0075.552] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialmainsubpicture.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f5055c0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f5055c0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb30)) returned 1 [0075.552] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0075.552] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0075.552] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialmainsubpicture.png")) returned 0x20 [0075.552] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialmainsubpicture.png")) returned 0x20 [0075.552] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0075.552] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0075.553] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0075.553] SetEndOfFile (hFile=0x158) returned 1 [0075.553] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="specialmainsubpicture.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0075.553] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="specialmainsubpicture.png", cchWideChar=25, lpMultiByteStr=0x2004eec, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="specialmainsubpicture.png", lpUsedDefaultChar=0x0) returned 25 [0075.554] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="specialmainsubpicture.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0075.554] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="specialmainsubpicture.png", cchWideChar=25, lpMultiByteStr=0x20055ac, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="specialmainsubpicture.png", lpUsedDefaultChar=0x0) returned 25 [0075.554] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x20055ac, cbMultiByte=25, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="specialmainsubpicture.pnge.pngre.pngpngp") returned 25 [0075.554] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="specialmainsubpicture.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0075.554] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="specialmainsubpicture.png", cchWideChar=25, lpMultiByteStr=0x2004eec, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="specialmainsubpicture.png", lpUsedDefaultChar=0x0) returned 25 [0075.554] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialmainsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0075.554] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0075.554] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0xb30 [0075.554] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0075.554] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0075.554] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0075.554] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="specialmainsubpicture.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0075.554] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="specialmainsubpicture.png", cchWideChar=25, lpMultiByteStr=0x2004eec, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="specialmainsubpicture.png", lpUsedDefaultChar=0x0) returned 25 [0075.554] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="specialmainsubpicture.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0075.554] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="specialmainsubpicture.png", cchWideChar=25, lpMultiByteStr=0x20055ac, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="specialmainsubpicture.png", lpUsedDefaultChar=0x0) returned 25 [0075.555] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x20055ac, cbMultiByte=25, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="specialmainsubpicture.pngre.pnge.pngre.pngpngp") returned 25 [0075.555] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="specialmainsubpicture.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0075.555] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="specialmainsubpicture.png", cchWideChar=25, lpMultiByteStr=0x2004eec, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="specialmainsubpicture.png", lpUsedDefaultChar=0x0) returned 25 [0075.555] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0075.556] CharToOemA (in: pSrc="specialmainsubpicture.png", pDst=0x20055ac | out: pDst="specialmainsubpicture.png") returned 1 [0075.556] WriteFile (in: hFile=0x158, lpBuffer=0x20055ac*, nNumberOfBytesToWrite=0x19, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x20055ac*, lpNumberOfBytesWritten=0x18e048*=0x19, lpOverlapped=0x0) returned 1 [0075.556] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0075.556] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0075.556] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0075.556] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=19581942116) returned 1 [0075.556] ReadFile (in: hFile=0x11c, lpBuffer=0x3b62f50, nNumberOfBytesToRead=0xb30, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b62f50*, lpNumberOfBytesRead=0x18dd7c*=0xb30, lpOverlapped=0x0) returned 1 [0075.558] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0075.558] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=19582137240) returned 1 [0075.567] WriteFile (in: hFile=0x158, lpBuffer=0x379ad20*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379ad20*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0075.567] ReadFile (in: hFile=0x11c, lpBuffer=0x3b62f50, nNumberOfBytesToRead=0xb30, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3b62f50*, lpNumberOfBytesRead=0x18de38*=0xb30, lpOverlapped=0x0) returned 1 [0075.567] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x54 [0075.567] WriteFile (in: hFile=0x158, lpBuffer=0x3b95340*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3b95340*, lpNumberOfBytesWritten=0x18de10*=0xb30, lpOverlapped=0x0) returned 1 [0075.567] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0xb84 [0075.567] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0075.567] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0075.567] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0075.568] SetFilePointer (in: hFile=0x158, lDistanceToMove=25, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x37 [0075.568] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0xb8e [0075.568] CloseHandle (hObject=0x11c) returned 1 [0075.568] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xb8e [0075.568] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xb8e [0075.568] SetFilePointer (in: hFile=0x158, lDistanceToMove=2958, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xb8e [0075.568] SetFilePointer (in: hFile=0x158, lDistanceToMove=2958, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0xb8e [0075.568] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xb8e [0075.568] SetFilePointer (in: hFile=0x158, lDistanceToMove=2958, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0xb8e [0075.568] SetEndOfFile (hFile=0x158) returned 1 [0075.568] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xb8e [0075.568] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xb8e [0075.568] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="specialmainsubpicture.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0075.568] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="specialmainsubpicture.png", cchWideChar=25, lpMultiByteStr=0x20055ac, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="specialmainsubpicture.png", lpUsedDefaultChar=0x0) returned 25 [0075.569] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="specialmainsubpicture.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0075.569] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="specialmainsubpicture.png", cchWideChar=25, lpMultiByteStr=0x2004eec, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="specialmainsubpicture.png", lpUsedDefaultChar=0x0) returned 25 [0075.569] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x2004eec, cbMultiByte=25, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="specialmainsubpicture.pngȁ\x14\x14\x01c䃍㫋╝瑪ୌ") returned 25 [0075.569] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="specialmainsubpicture.png", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0075.569] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="specialmainsubpicture.png", cchWideChar=25, lpMultiByteStr=0x20055ac, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="specialmainsubpicture.png", lpUsedDefaultChar=0x0) returned 25 [0075.569] WriteFile (in: hFile=0x158, lpBuffer=0x3b46a28*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3b46a28*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0075.569] CharToOemA (in: pSrc="specialmainsubpicture.png", pDst=0x2004eec | out: pDst="specialmainsubpicture.png") returned 1 [0075.569] WriteFile (in: hFile=0x158, lpBuffer=0x2004eec*, nNumberOfBytesToWrite=0x19, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x2004eec*, lpNumberOfBytesWritten=0x18efcc*=0x19, lpOverlapped=0x0) returned 1 [0075.569] WriteFile (in: hFile=0x158, lpBuffer=0x379ae18*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379ae18*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0075.569] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0075.569] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0075.569] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xbe0 [0075.569] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xbe0 [0075.569] WriteFile (in: hFile=0x158, lpBuffer=0x3777058*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777058*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0075.570] WriteFile (in: hFile=0x158, lpBuffer=0x35f035c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f035c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0075.570] DeleteFileW (lpFileName="") returned 0 [0075.570] GetLastError () returned 0x3 [0075.570] GetFileAttributesW (lpFileName="") returned 0xffffffff [0075.570] SetLastError (dwErrCode=0x3) [0075.570] FlushFileBuffers (hFile=0x158) returned 1 [0075.572] GetCurrentThreadId () returned 0x970 [0075.572] GetCurrentThreadId () returned 0x970 [0075.572] GetCurrentThreadId () returned 0x970 [0075.572] GetCurrentThreadId () returned 0x970 [0075.572] GetCurrentThreadId () returned 0x970 [0075.572] GetCurrentThreadId () returned 0x970 [0075.572] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xc97 [0075.572] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xc97 [0075.572] SetFilePointer (in: hFile=0x158, lDistanceToMove=3223, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xc97 [0075.572] CloseHandle (hObject=0x158) returned 1 [0075.572] GetCurrentThreadId () returned 0x970 [0075.572] GetCurrentThreadId () returned 0x970 [0075.572] GetCurrentThreadId () returned 0x970 [0075.572] GetCurrentThreadId () returned 0x970 [0075.572] GetCurrentThreadId () returned 0x970 [0075.572] GetCurrentThreadId () returned 0x970 [0075.572] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\Файл зашифрован [specialmainsubpicture.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\Файл зашифрован [specialmainsubpicture.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0075.573] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc97 [0075.573] SetFilePointer (in: hFile=0x158, lDistanceToMove=3095, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc17 [0075.573] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0075.573] GetFileType (hFile=0x158) returned 0x1 [0075.573] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x16, wMilliseconds=0x34c)) [0075.573] GetCurrentThreadId () returned 0x970 [0075.573] GetCurrentThreadId () returned 0x970 [0075.573] GetCurrentThreadId () returned 0x970 [0075.573] GetCurrentThreadId () returned 0x970 [0075.573] GetCurrentThreadId () returned 0x970 [0075.573] GetCurrentThreadId () returned 0x970 [0075.573] GetCurrentThreadId () returned 0x970 [0075.573] GetCurrentThreadId () returned 0x970 [0075.573] GetCurrentThreadId () returned 0x970 [0075.573] GetCurrentThreadId () returned 0x970 [0075.573] GetCurrentThreadId () returned 0x970 [0075.573] GetCurrentThreadId () returned 0x970 [0075.573] GetCurrentThreadId () returned 0x970 [0075.573] GetCurrentThreadId () returned 0x970 [0075.573] GetCurrentThreadId () returned 0x970 [0075.573] GetCurrentThreadId () returned 0x970 [0075.573] GetCurrentThreadId () returned 0x970 [0075.573] GetCurrentThreadId () returned 0x970 [0075.573] GetCurrentThreadId () returned 0x970 [0075.573] GetCurrentThreadId () returned 0x970 [0075.573] GetCurrentThreadId () returned 0x970 [0075.573] GetCurrentThreadId () returned 0x970 [0075.573] GetCurrentThreadId () returned 0x970 [0075.573] GetCurrentThreadId () returned 0x970 [0075.573] GetCurrentThreadId () returned 0x970 [0075.573] GetCurrentThreadId () returned 0x970 [0075.573] GetCurrentThreadId () returned 0x970 [0075.573] GetCurrentThreadId () returned 0x970 [0075.573] GetCurrentThreadId () returned 0x970 [0075.574] GetCurrentThreadId () returned 0x970 [0075.574] GetCurrentThreadId () returned 0x970 [0075.574] GetCurrentThreadId () returned 0x970 [0075.574] GetCurrentThreadId () returned 0x970 [0075.574] GetCurrentThreadId () returned 0x970 [0075.574] GetCurrentThreadId () returned 0x970 [0075.574] GetCurrentThreadId () returned 0x970 [0075.574] GetCurrentThreadId () returned 0x970 [0075.574] GetCurrentThreadId () returned 0x970 [0075.574] GetCurrentThreadId () returned 0x970 [0075.574] GetCurrentThreadId () returned 0x970 [0075.574] GetCurrentThreadId () returned 0x970 [0075.574] GetCurrentThreadId () returned 0x970 [0075.574] GetCurrentThreadId () returned 0x970 [0075.574] GetCurrentThreadId () returned 0x970 [0075.574] GetCurrentThreadId () returned 0x970 [0075.574] GetCurrentThreadId () returned 0x970 [0075.574] GetCurrentThreadId () returned 0x970 [0075.574] GetCurrentThreadId () returned 0x970 [0075.574] GetCurrentThreadId () returned 0x970 [0075.574] GetCurrentThreadId () returned 0x970 [0075.574] GetCurrentThreadId () returned 0x970 [0075.574] GetCurrentThreadId () returned 0x970 [0075.574] GetCurrentThreadId () returned 0x970 [0075.574] GetCurrentThreadId () returned 0x970 [0075.574] GetCurrentThreadId () returned 0x970 [0075.574] GetCurrentThreadId () returned 0x970 [0075.574] GetCurrentThreadId () returned 0x970 [0075.574] GetCurrentThreadId () returned 0x970 [0075.574] GetCurrentThreadId () returned 0x970 [0075.574] GetCurrentThreadId () returned 0x970 [0075.574] GetCurrentThreadId () returned 0x970 [0075.574] GetCurrentThreadId () returned 0x970 [0075.574] GetCurrentThreadId () returned 0x970 [0075.574] GetCurrentThreadId () returned 0x970 [0075.574] GetCurrentThreadId () returned 0x970 [0075.574] GetCurrentThreadId () returned 0x970 [0075.574] GetCurrentThreadId () returned 0x970 [0075.574] GetCurrentThreadId () returned 0x970 [0075.574] GetCurrentThreadId () returned 0x970 [0075.574] GetCurrentThreadId () returned 0x970 [0075.574] GetCurrentThreadId () returned 0x970 [0075.574] GetCurrentThreadId () returned 0x970 [0075.574] GetCurrentThreadId () returned 0x970 [0075.575] GetCurrentThreadId () returned 0x970 [0075.575] GetCurrentThreadId () returned 0x970 [0075.575] GetCurrentThreadId () returned 0x970 [0075.575] GetCurrentThreadId () returned 0x970 [0075.575] GetCurrentThreadId () returned 0x970 [0075.575] GetCurrentThreadId () returned 0x970 [0075.575] GetCurrentThreadId () returned 0x970 [0075.575] GetCurrentThreadId () returned 0x970 [0075.575] GetCurrentThreadId () returned 0x970 [0075.575] GetCurrentThreadId () returned 0x970 [0075.575] GetCurrentThreadId () returned 0x970 [0075.575] GetCurrentThreadId () returned 0x970 [0075.575] GetCurrentThreadId () returned 0x970 [0075.575] GetCurrentThreadId () returned 0x970 [0075.575] GetCurrentThreadId () returned 0x970 [0075.575] GetCurrentThreadId () returned 0x970 [0075.575] GetCurrentThreadId () returned 0x970 [0075.575] GetCurrentThreadId () returned 0x970 [0075.575] GetCurrentThreadId () returned 0x970 [0075.575] GetCurrentThreadId () returned 0x970 [0075.575] GetCurrentThreadId () returned 0x970 [0075.575] GetCurrentThreadId () returned 0x970 [0075.575] GetCurrentThreadId () returned 0x970 [0075.575] GetCurrentThreadId () returned 0x970 [0075.575] GetCurrentThreadId () returned 0x970 [0075.575] GetCurrentThreadId () returned 0x970 [0075.575] GetCurrentThreadId () returned 0x970 [0075.575] GetCurrentThreadId () returned 0x970 [0075.575] GetCurrentThreadId () returned 0x970 [0075.575] GetCurrentThreadId () returned 0x970 [0075.575] GetCurrentThreadId () returned 0x970 [0075.575] GetCurrentThreadId () returned 0x970 [0075.575] GetCurrentThreadId () returned 0x970 [0075.575] GetCurrentThreadId () returned 0x970 [0075.575] GetCurrentThreadId () returned 0x970 [0075.575] GetCurrentThreadId () returned 0x970 [0075.575] GetCurrentThreadId () returned 0x970 [0075.575] GetCurrentThreadId () returned 0x970 [0075.575] GetCurrentThreadId () returned 0x970 [0075.575] GetCurrentThreadId () returned 0x970 [0075.575] GetCurrentThreadId () returned 0x970 [0075.575] GetCurrentThreadId () returned 0x970 [0075.575] GetCurrentThreadId () returned 0x970 [0075.575] GetCurrentThreadId () returned 0x970 [0075.576] GetCurrentThreadId () returned 0x970 [0075.576] GetCurrentThreadId () returned 0x970 [0075.576] GetCurrentThreadId () returned 0x970 [0075.576] GetCurrentThreadId () returned 0x970 [0075.576] GetCurrentThreadId () returned 0x970 [0075.576] GetCurrentThreadId () returned 0x970 [0075.576] GetCurrentThreadId () returned 0x970 [0075.576] GetCurrentThreadId () returned 0x970 [0075.576] GetCurrentThreadId () returned 0x970 [0075.576] GetCurrentThreadId () returned 0x970 [0075.576] GetCurrentThreadId () returned 0x970 [0075.576] GetCurrentThreadId () returned 0x970 [0075.576] GetCurrentThreadId () returned 0x970 [0075.576] GetCurrentThreadId () returned 0x970 [0075.576] GetCurrentThreadId () returned 0x970 [0075.576] GetCurrentThreadId () returned 0x970 [0075.576] GetCurrentThreadId () returned 0x970 [0075.576] GetCurrentThreadId () returned 0x970 [0075.576] GetCurrentThreadId () returned 0x970 [0075.576] GetCurrentThreadId () returned 0x970 [0075.576] GetCurrentThreadId () returned 0x970 [0075.576] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.576] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.576] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a04b8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0075.576] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.576] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.576] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a04b8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0075.576] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.576] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.576] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0075.576] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.576] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.576] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0075.576] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.576] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.576] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a0518, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3\x18Ã", lpUsedDefaultChar=0x0) returned 10 [0075.577] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.577] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.577] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a0518, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3\x18Ã", lpUsedDefaultChar=0x0) returned 10 [0075.577] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.577] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.577] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a0518, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3\x18Ã", lpUsedDefaultChar=0x0) returned 10 [0075.577] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x16, wMilliseconds=0x34c)) [0075.577] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="+FnhyJIK+=UP}\\w:)k=1m70qOsw)pUYN", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0075.577] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="+FnhyJIK+=UP}\\w:)k=1m70qOsw)pUYN", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0075.577] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="+FnhyJIK+=UP}\\w:)k=1m70qOsw)pUYN", cchWideChar=32, lpMultiByteStr=0x2006088, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="+FnhyJIK+=UP}\\w:)k=1m70qOsw)pUYN", lpUsedDefaultChar=0x0) returned 32 [0075.577] GetCurrentThreadId () returned 0x970 [0075.577] GetCurrentThreadId () returned 0x970 [0075.577] GetCurrentThreadId () returned 0x970 [0075.577] GetCurrentThreadId () returned 0x970 [0075.577] GetCurrentThreadId () returned 0x970 [0075.577] GetCurrentThreadId () returned 0x970 [0075.585] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0075.585] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0075.585] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3b40858, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0075.585] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eda48, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0075.585] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34eda48, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAD3vEDVRDZE0PXdshcdsgcipOlqXjk0b0TDzXKsVyiUw03IeQ75aJIb6RfOcLHztrC3SU7JOopZDr6otH8S3TO5qs59CwbUvVJZgPCWGjTPvm5FzykJzw8NNl4SWuseNLwgr/kIADNZFbZ+YF/etDZWqwblIEGT+d1usvZjDLhi0dVImjLNACCGbSgxvLCGgwd8IN94jINsnJmYbBT8iesEW8xgv19TwPA==") returned 232 [0075.585] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x16, wMilliseconds=0x35b)) [0075.585] GetCurrentThreadId () returned 0x970 [0075.585] GetCurrentThreadId () returned 0x970 [0075.585] GetCurrentThreadId () returned 0x970 [0075.585] GetCurrentThreadId () returned 0x970 [0075.585] GetCurrentThreadId () returned 0x970 [0075.585] GetCurrentThreadId () returned 0x970 [0075.585] GetCurrentThreadId () returned 0x970 [0075.585] GetCurrentThreadId () returned 0x970 [0075.585] GetCurrentThreadId () returned 0x970 [0075.585] GetCurrentThreadId () returned 0x970 [0075.585] GetCurrentThreadId () returned 0x970 [0075.585] GetCurrentThreadId () returned 0x970 [0075.585] GetCurrentThreadId () returned 0x970 [0075.585] GetCurrentThreadId () returned 0x970 [0075.585] GetCurrentThreadId () returned 0x970 [0075.585] GetCurrentThreadId () returned 0x970 [0075.585] GetCurrentThreadId () returned 0x970 [0075.585] GetCurrentThreadId () returned 0x970 [0075.585] GetCurrentThreadId () returned 0x970 [0075.585] GetCurrentThreadId () returned 0x970 [0075.585] GetCurrentThreadId () returned 0x970 [0075.585] GetCurrentThreadId () returned 0x970 [0075.585] GetCurrentThreadId () returned 0x970 [0075.585] GetCurrentThreadId () returned 0x970 [0075.585] GetCurrentThreadId () returned 0x970 [0075.585] GetCurrentThreadId () returned 0x970 [0075.585] GetCurrentThreadId () returned 0x970 [0075.585] GetCurrentThreadId () returned 0x970 [0075.585] GetCurrentThreadId () returned 0x970 [0075.585] GetCurrentThreadId () returned 0x970 [0075.586] GetCurrentThreadId () returned 0x970 [0075.586] GetCurrentThreadId () returned 0x970 [0075.586] GetCurrentThreadId () returned 0x970 [0075.586] GetCurrentThreadId () returned 0x970 [0075.586] GetCurrentThreadId () returned 0x970 [0075.586] GetCurrentThreadId () returned 0x970 [0075.586] GetCurrentThreadId () returned 0x970 [0075.586] GetCurrentThreadId () returned 0x970 [0075.586] GetCurrentThreadId () returned 0x970 [0075.586] GetCurrentThreadId () returned 0x970 [0075.586] GetCurrentThreadId () returned 0x970 [0075.586] GetCurrentThreadId () returned 0x970 [0075.586] GetCurrentThreadId () returned 0x970 [0075.586] GetCurrentThreadId () returned 0x970 [0075.586] GetCurrentThreadId () returned 0x970 [0075.586] GetCurrentThreadId () returned 0x970 [0075.586] GetCurrentThreadId () returned 0x970 [0075.586] GetCurrentThreadId () returned 0x970 [0075.586] GetCurrentThreadId () returned 0x970 [0075.586] GetCurrentThreadId () returned 0x970 [0075.586] GetCurrentThreadId () returned 0x970 [0075.586] GetCurrentThreadId () returned 0x970 [0075.586] GetCurrentThreadId () returned 0x970 [0075.586] GetCurrentThreadId () returned 0x970 [0075.586] GetCurrentThreadId () returned 0x970 [0075.586] GetCurrentThreadId () returned 0x970 [0075.586] GetCurrentThreadId () returned 0x970 [0075.586] GetCurrentThreadId () returned 0x970 [0075.586] GetCurrentThreadId () returned 0x970 [0075.586] GetCurrentThreadId () returned 0x970 [0075.586] GetCurrentThreadId () returned 0x970 [0075.586] GetCurrentThreadId () returned 0x970 [0075.586] GetCurrentThreadId () returned 0x970 [0075.586] GetCurrentThreadId () returned 0x970 [0075.586] GetCurrentThreadId () returned 0x970 [0075.586] GetCurrentThreadId () returned 0x970 [0075.586] GetCurrentThreadId () returned 0x970 [0075.586] GetCurrentThreadId () returned 0x970 [0075.586] GetCurrentThreadId () returned 0x970 [0075.586] GetCurrentThreadId () returned 0x970 [0075.586] GetCurrentThreadId () returned 0x970 [0075.586] GetCurrentThreadId () returned 0x970 [0075.586] GetCurrentThreadId () returned 0x970 [0075.587] GetCurrentThreadId () returned 0x970 [0075.587] GetCurrentThreadId () returned 0x970 [0075.587] GetCurrentThreadId () returned 0x970 [0075.587] GetCurrentThreadId () returned 0x970 [0075.587] GetCurrentThreadId () returned 0x970 [0075.587] GetCurrentThreadId () returned 0x970 [0075.587] GetCurrentThreadId () returned 0x970 [0075.587] GetCurrentThreadId () returned 0x970 [0075.587] GetCurrentThreadId () returned 0x970 [0075.587] GetCurrentThreadId () returned 0x970 [0075.587] GetCurrentThreadId () returned 0x970 [0075.587] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAD3vEDVRDZE0PXdshcdsgcipOlqXjk0b0TDzXKsVyiUw03IeQ75aJIb6RfOcLHztrC3SU7JOopZDr6otH8S3TO5qs59CwbUvVJZgPCWGjTPvm5FzykJzw8NNl4SWuseNLwgr/kIADNZFbZ+YF/etDZWqwblIEGT+d1usvZjDLhi0dVImjLNACCGbSgxvLCGgwd8IN94jINsnJmYbBT8iesEW8xgv19TwPA==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0075.587] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAD3vEDVRDZE0PXdshcdsgcipOlqXjk0b0TDzXKsVyiUw03IeQ75aJIb6RfOcLHztrC3SU7JOopZDr6otH8S3TO5qs59CwbUvVJZgPCWGjTPvm5FzykJzw8NNl4SWuseNLwgr/kIADNZFbZ+YF/etDZWqwblIEGT+d1usvZjDLhi0dVImjLNACCGbSgxvLCGgwd8IN94jINsnJmYbBT8iesEW8xgv19TwPA==", cchWideChar=245, lpMultiByteStr=0x353b75c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAD3vEDVRDZE0PXdshcdsgcipOlqXjk0b0TDzXKsVyiUw03IeQ75aJIb6RfOcLHztrC3SU7JOopZDr6otH8S3TO5qs59CwbUvVJZgPCWGjTPvm5FzykJzw8NNl4SWuseNLwgr/kIADNZFbZ+YF/etDZWqwblIEGT+d1usvZjDLhi0dVImjLNACCGbSgxvLCGgwd8IN94jINsnJmYbBT8iesEW8xgv19TwPA==", lpUsedDefaultChar=0x0) returned 245 [0075.587] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0075.587] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0075.587] CloseHandle (hObject=0x158) returned 1 [0075.590] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialmainsubpicture.png")) returned 0 [0075.590] GetLastError () returned 0x5 [0075.590] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialmainsubpicture.png")) returned 0x20 [0075.590] SetLastError (dwErrCode=0x5) [0075.590] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=19585333448) returned 1 [0075.590] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\Файл зашифрован [SpecialNavigationLeft_ButtonGraphic.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\Файл зашифрован [specialnavigationleft_buttongraphic.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0075.591] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0075.591] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0075.591] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0075.591] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0075.591] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0075.591] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0075.592] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0075.592] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0075.592] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0075.592] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0075.592] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0075.592] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0075.592] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0075.592] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0075.592] SetEndOfFile (hFile=0x158) returned 1 [0075.592] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0075.592] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0075.592] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0075.592] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0075.592] WriteFile (in: hFile=0x158, lpBuffer=0x3777058*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777058*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0075.593] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0075.593] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1^1)qgQ/:%PHPIh24kUo8N,!HC=8vGAw", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0075.593] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1^1)qgQ/:%PHPIh24kUo8N,!HC=8vGAw", cchWideChar=32, lpMultiByteStr=0x20378e4, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1^1)qgQ/:%PHPIh24kUo8N,!HC=8vGAw", lpUsedDefaultChar=0x0) returned 32 [0075.593] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0075.593] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0075.594] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_ButtonGraphic.png", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f5c3c91, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f5c3c91, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x12cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpecialNavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 0x295098 [0075.594] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0075.594] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0075.594] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_buttongraphic.png")) returned 0x20 [0075.594] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_buttongraphic.png")) returned 0x20 [0075.594] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_buttongraphic.png")) returned 0x20 [0075.594] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_buttongraphic.png")) returned 0x20 [0075.594] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_buttongraphic.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f5c3c91, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f5c3c91, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x12cf)) returned 1 [0075.594] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0075.594] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0075.594] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_buttongraphic.png")) returned 0x20 [0075.594] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_buttongraphic.png")) returned 0x20 [0075.594] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0075.594] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0075.594] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0075.595] SetEndOfFile (hFile=0x158) returned 1 [0075.595] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationLeft_ButtonGraphic.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0075.595] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationLeft_ButtonGraphic.png", cchWideChar=39, lpMultiByteStr=0x2038b7c, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpecialNavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 39 [0075.595] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationLeft_ButtonGraphic.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0075.595] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationLeft_ButtonGraphic.png", cchWideChar=39, lpMultiByteStr=0x2038f34, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpecialNavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 39 [0075.596] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x2038f34, cbMultiByte=39, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="SpecialNavigationLeft_ButtonGraphic.pngp") returned 39 [0075.596] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationLeft_ButtonGraphic.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0075.596] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationLeft_ButtonGraphic.png", cchWideChar=39, lpMultiByteStr=0x2038b7c, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpecialNavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 39 [0075.596] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0075.596] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0075.596] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x12cf [0075.596] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0075.596] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0075.596] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0075.596] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationLeft_ButtonGraphic.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0075.596] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationLeft_ButtonGraphic.png", cchWideChar=39, lpMultiByteStr=0x2038b7c, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpecialNavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 39 [0075.596] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationLeft_ButtonGraphic.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0075.596] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationLeft_ButtonGraphic.png", cchWideChar=39, lpMultiByteStr=0x2038f34, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpecialNavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 39 [0075.596] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x2038f34, cbMultiByte=39, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="SpecialNavigationLeft_ButtonGraphic.pngic.pngp") returned 39 [0075.597] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationLeft_ButtonGraphic.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0075.597] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationLeft_ButtonGraphic.png", cchWideChar=39, lpMultiByteStr=0x2038b7c, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpecialNavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 39 [0075.597] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0075.597] CharToOemA (in: pSrc="SpecialNavigationLeft_ButtonGraphic.png", pDst=0x2038f34 | out: pDst="SpecialNavigationLeft_ButtonGraphic.png") returned 1 [0075.598] WriteFile (in: hFile=0x158, lpBuffer=0x2038f34*, nNumberOfBytesToWrite=0x27, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x2038f34*, lpNumberOfBytesWritten=0x18e048*=0x27, lpOverlapped=0x0) returned 1 [0075.598] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0075.598] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0075.598] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0075.598] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=19586138855) returned 1 [0075.598] ReadFile (in: hFile=0x11c, lpBuffer=0x3b62f50, nNumberOfBytesToRead=0x12cf, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b62f50*, lpNumberOfBytesRead=0x18dd7c*=0x12cf, lpOverlapped=0x0) returned 1 [0075.599] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0075.599] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=19586293852) returned 1 [0075.608] WriteFile (in: hFile=0x158, lpBuffer=0x379aca8*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379aca8*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0075.608] ReadFile (in: hFile=0x11c, lpBuffer=0x3b62f50, nNumberOfBytesToRead=0x12cf, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3b62f50*, lpNumberOfBytesRead=0x18de38*=0x12cf, lpOverlapped=0x0) returned 1 [0075.609] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x62 [0075.609] WriteFile (in: hFile=0x158, lpBuffer=0x3b95a40*, nNumberOfBytesToWrite=0x12cf, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3b95a40*, lpNumberOfBytesWritten=0x18de10*=0x12cf, lpOverlapped=0x0) returned 1 [0075.609] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x1331 [0075.609] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0075.609] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0075.609] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0075.609] SetFilePointer (in: hFile=0x158, lDistanceToMove=39, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x45 [0075.609] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x133b [0075.609] CloseHandle (hObject=0x11c) returned 1 [0075.609] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x133b [0075.610] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x133b [0075.610] SetFilePointer (in: hFile=0x158, lDistanceToMove=4923, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x133b [0075.610] SetFilePointer (in: hFile=0x158, lDistanceToMove=4923, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x133b [0075.610] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x133b [0075.610] SetFilePointer (in: hFile=0x158, lDistanceToMove=4923, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x133b [0075.610] SetEndOfFile (hFile=0x158) returned 1 [0075.610] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x133b [0075.610] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x133b [0075.610] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationLeft_ButtonGraphic.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0075.610] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationLeft_ButtonGraphic.png", cchWideChar=39, lpMultiByteStr=0x2038f34, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpecialNavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 39 [0075.610] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationLeft_ButtonGraphic.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0075.610] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationLeft_ButtonGraphic.png", cchWideChar=39, lpMultiByteStr=0x2038b7c, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpecialNavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 39 [0075.610] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x2038b7c, cbMultiByte=39, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="SpecialNavigationLeft_ButtonGraphic.png") returned 39 [0075.610] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationLeft_ButtonGraphic.png", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0075.610] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationLeft_ButtonGraphic.png", cchWideChar=39, lpMultiByteStr=0x2038f34, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpecialNavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 39 [0075.610] WriteFile (in: hFile=0x158, lpBuffer=0x3b46a28*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3b46a28*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0075.611] CharToOemA (in: pSrc="SpecialNavigationLeft_ButtonGraphic.png", pDst=0x2038b7c | out: pDst="SpecialNavigationLeft_ButtonGraphic.png") returned 1 [0075.611] WriteFile (in: hFile=0x158, lpBuffer=0x2038b7c*, nNumberOfBytesToWrite=0x27, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x2038b7c*, lpNumberOfBytesWritten=0x18efcc*=0x27, lpOverlapped=0x0) returned 1 [0075.611] WriteFile (in: hFile=0x158, lpBuffer=0x379ad88*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379ad88*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0075.611] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0075.611] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0075.611] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x139b [0075.611] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x139b [0075.611] WriteFile (in: hFile=0x158, lpBuffer=0x3777058*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777058*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0075.611] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0075.611] DeleteFileW (lpFileName="") returned 0 [0075.611] GetLastError () returned 0x3 [0075.611] GetFileAttributesW (lpFileName="") returned 0xffffffff [0075.611] SetLastError (dwErrCode=0x3) [0075.611] FlushFileBuffers (hFile=0x158) returned 1 [0075.617] GetCurrentThreadId () returned 0x970 [0075.617] GetCurrentThreadId () returned 0x970 [0075.617] GetCurrentThreadId () returned 0x970 [0075.617] GetCurrentThreadId () returned 0x970 [0075.617] GetCurrentThreadId () returned 0x970 [0075.617] GetCurrentThreadId () returned 0x970 [0075.617] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x1452 [0075.617] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x1452 [0075.617] SetFilePointer (in: hFile=0x158, lDistanceToMove=5202, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x1452 [0075.617] CloseHandle (hObject=0x158) returned 1 [0075.617] GetCurrentThreadId () returned 0x970 [0075.617] GetCurrentThreadId () returned 0x970 [0075.617] GetCurrentThreadId () returned 0x970 [0075.617] GetCurrentThreadId () returned 0x970 [0075.617] GetCurrentThreadId () returned 0x970 [0075.617] GetCurrentThreadId () returned 0x970 [0075.617] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\Файл зашифрован [SpecialNavigationLeft_ButtonGraphic.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\Файл зашифрован [specialnavigationleft_buttongraphic.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0075.617] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1452 [0075.617] SetFilePointer (in: hFile=0x158, lDistanceToMove=5074, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13d2 [0075.617] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0075.617] GetFileType (hFile=0x158) returned 0x1 [0075.618] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x16, wMilliseconds=0x37a)) [0075.618] GetCurrentThreadId () returned 0x970 [0075.618] GetCurrentThreadId () returned 0x970 [0075.618] GetCurrentThreadId () returned 0x970 [0075.618] GetCurrentThreadId () returned 0x970 [0075.618] GetCurrentThreadId () returned 0x970 [0075.618] GetCurrentThreadId () returned 0x970 [0075.618] GetCurrentThreadId () returned 0x970 [0075.618] GetCurrentThreadId () returned 0x970 [0075.618] GetCurrentThreadId () returned 0x970 [0075.618] GetCurrentThreadId () returned 0x970 [0075.618] GetCurrentThreadId () returned 0x970 [0075.618] GetCurrentThreadId () returned 0x970 [0075.618] GetCurrentThreadId () returned 0x970 [0075.618] GetCurrentThreadId () returned 0x970 [0075.618] GetCurrentThreadId () returned 0x970 [0075.618] GetCurrentThreadId () returned 0x970 [0075.618] GetCurrentThreadId () returned 0x970 [0075.618] GetCurrentThreadId () returned 0x970 [0075.618] GetCurrentThreadId () returned 0x970 [0075.618] GetCurrentThreadId () returned 0x970 [0075.618] GetCurrentThreadId () returned 0x970 [0075.618] GetCurrentThreadId () returned 0x970 [0075.618] GetCurrentThreadId () returned 0x970 [0075.618] GetCurrentThreadId () returned 0x970 [0075.618] GetCurrentThreadId () returned 0x970 [0075.618] GetCurrentThreadId () returned 0x970 [0075.618] GetCurrentThreadId () returned 0x970 [0075.618] GetCurrentThreadId () returned 0x970 [0075.618] GetCurrentThreadId () returned 0x970 [0075.618] GetCurrentThreadId () returned 0x970 [0075.618] GetCurrentThreadId () returned 0x970 [0075.618] GetCurrentThreadId () returned 0x970 [0075.618] GetCurrentThreadId () returned 0x970 [0075.618] GetCurrentThreadId () returned 0x970 [0075.618] GetCurrentThreadId () returned 0x970 [0075.618] GetCurrentThreadId () returned 0x970 [0075.618] GetCurrentThreadId () returned 0x970 [0075.618] GetCurrentThreadId () returned 0x970 [0075.618] GetCurrentThreadId () returned 0x970 [0075.618] GetCurrentThreadId () returned 0x970 [0075.618] GetCurrentThreadId () returned 0x970 [0075.619] GetCurrentThreadId () returned 0x970 [0075.619] GetCurrentThreadId () returned 0x970 [0075.619] GetCurrentThreadId () returned 0x970 [0075.619] GetCurrentThreadId () returned 0x970 [0075.619] GetCurrentThreadId () returned 0x970 [0075.619] GetCurrentThreadId () returned 0x970 [0075.619] GetCurrentThreadId () returned 0x970 [0075.619] GetCurrentThreadId () returned 0x970 [0075.619] GetCurrentThreadId () returned 0x970 [0075.619] GetCurrentThreadId () returned 0x970 [0075.619] GetCurrentThreadId () returned 0x970 [0075.619] GetCurrentThreadId () returned 0x970 [0075.619] GetCurrentThreadId () returned 0x970 [0075.619] GetCurrentThreadId () returned 0x970 [0075.619] GetCurrentThreadId () returned 0x970 [0075.619] GetCurrentThreadId () returned 0x970 [0075.619] GetCurrentThreadId () returned 0x970 [0075.619] GetCurrentThreadId () returned 0x970 [0075.619] GetCurrentThreadId () returned 0x970 [0075.619] GetCurrentThreadId () returned 0x970 [0075.619] GetCurrentThreadId () returned 0x970 [0075.619] GetCurrentThreadId () returned 0x970 [0075.619] GetCurrentThreadId () returned 0x970 [0075.619] GetCurrentThreadId () returned 0x970 [0075.619] GetCurrentThreadId () returned 0x970 [0075.619] GetCurrentThreadId () returned 0x970 [0075.619] GetCurrentThreadId () returned 0x970 [0075.619] GetCurrentThreadId () returned 0x970 [0075.619] GetCurrentThreadId () returned 0x970 [0075.619] GetCurrentThreadId () returned 0x970 [0075.619] GetCurrentThreadId () returned 0x970 [0075.619] GetCurrentThreadId () returned 0x970 [0075.619] GetCurrentThreadId () returned 0x970 [0075.619] GetCurrentThreadId () returned 0x970 [0075.619] GetCurrentThreadId () returned 0x970 [0075.619] GetCurrentThreadId () returned 0x970 [0075.619] GetCurrentThreadId () returned 0x970 [0075.619] GetCurrentThreadId () returned 0x970 [0075.619] GetCurrentThreadId () returned 0x970 [0075.619] GetCurrentThreadId () returned 0x970 [0075.619] GetCurrentThreadId () returned 0x970 [0075.619] GetCurrentThreadId () returned 0x970 [0075.619] GetCurrentThreadId () returned 0x970 [0075.619] GetCurrentThreadId () returned 0x970 [0075.620] GetCurrentThreadId () returned 0x970 [0075.620] GetCurrentThreadId () returned 0x970 [0075.620] GetCurrentThreadId () returned 0x970 [0075.620] GetCurrentThreadId () returned 0x970 [0075.620] GetCurrentThreadId () returned 0x970 [0075.620] GetCurrentThreadId () returned 0x970 [0075.620] GetCurrentThreadId () returned 0x970 [0075.620] GetCurrentThreadId () returned 0x970 [0075.620] GetCurrentThreadId () returned 0x970 [0075.620] GetCurrentThreadId () returned 0x970 [0075.620] GetCurrentThreadId () returned 0x970 [0075.620] GetCurrentThreadId () returned 0x970 [0075.620] GetCurrentThreadId () returned 0x970 [0075.620] GetCurrentThreadId () returned 0x970 [0075.620] GetCurrentThreadId () returned 0x970 [0075.620] GetCurrentThreadId () returned 0x970 [0075.620] GetCurrentThreadId () returned 0x970 [0075.620] GetCurrentThreadId () returned 0x970 [0075.620] GetCurrentThreadId () returned 0x970 [0075.620] GetCurrentThreadId () returned 0x970 [0075.620] GetCurrentThreadId () returned 0x970 [0075.620] GetCurrentThreadId () returned 0x970 [0075.620] GetCurrentThreadId () returned 0x970 [0075.620] GetCurrentThreadId () returned 0x970 [0075.620] GetCurrentThreadId () returned 0x970 [0075.620] GetCurrentThreadId () returned 0x970 [0075.620] GetCurrentThreadId () returned 0x970 [0075.620] GetCurrentThreadId () returned 0x970 [0075.620] GetCurrentThreadId () returned 0x970 [0075.620] GetCurrentThreadId () returned 0x970 [0075.620] GetCurrentThreadId () returned 0x970 [0075.620] GetCurrentThreadId () returned 0x970 [0075.620] GetCurrentThreadId () returned 0x970 [0075.620] GetCurrentThreadId () returned 0x970 [0075.620] GetCurrentThreadId () returned 0x970 [0075.620] GetCurrentThreadId () returned 0x970 [0075.620] GetCurrentThreadId () returned 0x970 [0075.620] GetCurrentThreadId () returned 0x970 [0075.620] GetCurrentThreadId () returned 0x970 [0075.620] GetCurrentThreadId () returned 0x970 [0075.620] GetCurrentThreadId () returned 0x970 [0075.620] GetCurrentThreadId () returned 0x970 [0075.620] GetCurrentThreadId () returned 0x970 [0075.621] GetCurrentThreadId () returned 0x970 [0075.621] GetCurrentThreadId () returned 0x970 [0075.621] GetCurrentThreadId () returned 0x970 [0075.621] GetCurrentThreadId () returned 0x970 [0075.621] GetCurrentThreadId () returned 0x970 [0075.621] GetCurrentThreadId () returned 0x970 [0075.621] GetCurrentThreadId () returned 0x970 [0075.621] GetCurrentThreadId () returned 0x970 [0075.621] GetCurrentThreadId () returned 0x970 [0075.621] GetCurrentThreadId () returned 0x970 [0075.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a0518, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0075.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a0518, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0075.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0075.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0075.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a0578, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0075.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a0578, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0075.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a0578, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0075.621] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x16, wMilliseconds=0x37a)) [0075.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1^1)qgQ/:%PHPIh24kUo8N,!HC=8vGAw", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0075.622] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1^1)qgQ/:%PHPIh24kUo8N,!HC=8vGAw", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0075.622] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1^1)qgQ/:%PHPIh24kUo8N,!HC=8vGAw", cchWideChar=32, lpMultiByteStr=0x20060b8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1^1)qgQ/:%PHPIh24kUo8N,!HC=8vGAw", lpUsedDefaultChar=0x0) returned 32 [0075.622] GetCurrentThreadId () returned 0x970 [0075.622] GetCurrentThreadId () returned 0x970 [0075.622] GetCurrentThreadId () returned 0x970 [0075.622] GetCurrentThreadId () returned 0x970 [0075.622] GetCurrentThreadId () returned 0x970 [0075.622] GetCurrentThreadId () returned 0x970 [0075.629] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0075.629] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0075.629] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3b409e8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0075.630] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ed948, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0075.630] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ed948, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAIDbJgh94T26aSnpyVF1Rtrm1NFU3VSF//loKprcfFVhEFMrbvjMZ0jibZ/lkgSRaUjBQfe42HGaiMsydYLmyPZFEuEc2QFY3oiVrS4/ZWkVNzWXlX7d7k/aI1kLCMsC6IN0QSZtDno2zudl8NWBb6FlK/nfoL3DQIka7TPt7QEpmqJA1e12upTN0PqjmGufaK3SEYVd17zqRBCHML44LKrPLd5qKr7lRA==") returned 232 [0075.630] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x16, wMilliseconds=0x38a)) [0075.630] GetCurrentThreadId () returned 0x970 [0075.630] GetCurrentThreadId () returned 0x970 [0075.630] GetCurrentThreadId () returned 0x970 [0075.630] GetCurrentThreadId () returned 0x970 [0075.630] GetCurrentThreadId () returned 0x970 [0075.630] GetCurrentThreadId () returned 0x970 [0075.630] GetCurrentThreadId () returned 0x970 [0075.630] GetCurrentThreadId () returned 0x970 [0075.630] GetCurrentThreadId () returned 0x970 [0075.630] GetCurrentThreadId () returned 0x970 [0075.630] GetCurrentThreadId () returned 0x970 [0075.630] GetCurrentThreadId () returned 0x970 [0075.630] GetCurrentThreadId () returned 0x970 [0075.630] GetCurrentThreadId () returned 0x970 [0075.630] GetCurrentThreadId () returned 0x970 [0075.630] GetCurrentThreadId () returned 0x970 [0075.630] GetCurrentThreadId () returned 0x970 [0075.630] GetCurrentThreadId () returned 0x970 [0075.630] GetCurrentThreadId () returned 0x970 [0075.630] GetCurrentThreadId () returned 0x970 [0075.630] GetCurrentThreadId () returned 0x970 [0075.630] GetCurrentThreadId () returned 0x970 [0075.630] GetCurrentThreadId () returned 0x970 [0075.630] GetCurrentThreadId () returned 0x970 [0075.630] GetCurrentThreadId () returned 0x970 [0075.630] GetCurrentThreadId () returned 0x970 [0075.630] GetCurrentThreadId () returned 0x970 [0075.630] GetCurrentThreadId () returned 0x970 [0075.630] GetCurrentThreadId () returned 0x970 [0075.630] GetCurrentThreadId () returned 0x970 [0075.630] GetCurrentThreadId () returned 0x970 [0075.630] GetCurrentThreadId () returned 0x970 [0075.630] GetCurrentThreadId () returned 0x970 [0075.630] GetCurrentThreadId () returned 0x970 [0075.630] GetCurrentThreadId () returned 0x970 [0075.630] GetCurrentThreadId () returned 0x970 [0075.630] GetCurrentThreadId () returned 0x970 [0075.630] GetCurrentThreadId () returned 0x970 [0075.630] GetCurrentThreadId () returned 0x970 [0075.631] GetCurrentThreadId () returned 0x970 [0075.631] GetCurrentThreadId () returned 0x970 [0075.631] GetCurrentThreadId () returned 0x970 [0075.631] GetCurrentThreadId () returned 0x970 [0075.631] GetCurrentThreadId () returned 0x970 [0075.631] GetCurrentThreadId () returned 0x970 [0075.631] GetCurrentThreadId () returned 0x970 [0075.631] GetCurrentThreadId () returned 0x970 [0075.631] GetCurrentThreadId () returned 0x970 [0075.631] GetCurrentThreadId () returned 0x970 [0075.631] GetCurrentThreadId () returned 0x970 [0075.631] GetCurrentThreadId () returned 0x970 [0075.631] GetCurrentThreadId () returned 0x970 [0075.631] GetCurrentThreadId () returned 0x970 [0075.631] GetCurrentThreadId () returned 0x970 [0075.631] GetCurrentThreadId () returned 0x970 [0075.631] GetCurrentThreadId () returned 0x970 [0075.631] GetCurrentThreadId () returned 0x970 [0075.631] GetCurrentThreadId () returned 0x970 [0075.631] GetCurrentThreadId () returned 0x970 [0075.631] GetCurrentThreadId () returned 0x970 [0075.631] GetCurrentThreadId () returned 0x970 [0075.631] GetCurrentThreadId () returned 0x970 [0075.631] GetCurrentThreadId () returned 0x970 [0075.631] GetCurrentThreadId () returned 0x970 [0075.631] GetCurrentThreadId () returned 0x970 [0075.631] GetCurrentThreadId () returned 0x970 [0075.631] GetCurrentThreadId () returned 0x970 [0075.631] GetCurrentThreadId () returned 0x970 [0075.631] GetCurrentThreadId () returned 0x970 [0075.631] GetCurrentThreadId () returned 0x970 [0075.631] GetCurrentThreadId () returned 0x970 [0075.631] GetCurrentThreadId () returned 0x970 [0075.631] GetCurrentThreadId () returned 0x970 [0075.631] GetCurrentThreadId () returned 0x970 [0075.631] GetCurrentThreadId () returned 0x970 [0075.631] GetCurrentThreadId () returned 0x970 [0075.631] GetCurrentThreadId () returned 0x970 [0075.631] GetCurrentThreadId () returned 0x970 [0075.631] GetCurrentThreadId () returned 0x970 [0075.631] GetCurrentThreadId () returned 0x970 [0075.631] GetCurrentThreadId () returned 0x970 [0075.631] GetCurrentThreadId () returned 0x970 [0075.631] GetCurrentThreadId () returned 0x970 [0075.631] GetCurrentThreadId () returned 0x970 [0075.632] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAIDbJgh94T26aSnpyVF1Rtrm1NFU3VSF//loKprcfFVhEFMrbvjMZ0jibZ/lkgSRaUjBQfe42HGaiMsydYLmyPZFEuEc2QFY3oiVrS4/ZWkVNzWXlX7d7k/aI1kLCMsC6IN0QSZtDno2zudl8NWBb6FlK/nfoL3DQIka7TPt7QEpmqJA1e12upTN0PqjmGufaK3SEYVd17zqRBCHML44LKrPLd5qKr7lRA==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0075.632] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAIDbJgh94T26aSnpyVF1Rtrm1NFU3VSF//loKprcfFVhEFMrbvjMZ0jibZ/lkgSRaUjBQfe42HGaiMsydYLmyPZFEuEc2QFY3oiVrS4/ZWkVNzWXlX7d7k/aI1kLCMsC6IN0QSZtDno2zudl8NWBb6FlK/nfoL3DQIka7TPt7QEpmqJA1e12upTN0PqjmGufaK3SEYVd17zqRBCHML44LKrPLd5qKr7lRA==", cchWideChar=245, lpMultiByteStr=0x353b75c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAIDbJgh94T26aSnpyVF1Rtrm1NFU3VSF//loKprcfFVhEFMrbvjMZ0jibZ/lkgSRaUjBQfe42HGaiMsydYLmyPZFEuEc2QFY3oiVrS4/ZWkVNzWXlX7d7k/aI1kLCMsC6IN0QSZtDno2zudl8NWBb6FlK/nfoL3DQIka7TPt7QEpmqJA1e12upTN0PqjmGufaK3SEYVd17zqRBCHML44LKrPLd5qKr7lRA==", lpUsedDefaultChar=0x0) returned 245 [0075.632] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0075.632] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0075.632] CloseHandle (hObject=0x158) returned 1 [0075.632] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_buttongraphic.png")) returned 0 [0075.632] GetLastError () returned 0x5 [0075.632] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_buttongraphic.png")) returned 0x20 [0075.632] SetLastError (dwErrCode=0x5) [0075.632] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=19589580077) returned 1 [0075.633] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\Файл зашифрован [SpecialNavigationLeft_SelectionSubpicture.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\Файл зашифрован [specialnavigationleft_selectionsubpicture.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0075.633] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0075.633] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0075.633] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0075.633] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0075.633] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0075.633] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0075.634] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0075.634] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0075.634] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0075.634] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0075.634] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0075.634] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0075.634] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0075.634] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0075.634] SetEndOfFile (hFile=0x158) returned 1 [0075.634] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0075.634] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0075.634] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0075.634] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0075.634] WriteFile (in: hFile=0x158, lpBuffer=0x3777058*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777058*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0075.635] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0075.635] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="4tv%)5/:+!e4Lv~DwSn8#:GlQ1yg.qOH", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0075.635] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="4tv%)5/:+!e4Lv~DwSn8#:GlQ1yg.qOH", cchWideChar=32, lpMultiByteStr=0x2038594, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4tv%)5/:+!e4Lv~DwSn8#:GlQ1yg.qOH", lpUsedDefaultChar=0x0) returned 32 [0075.635] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0075.635] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0075.636] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_SelectionSubpicture.png", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f5c3c91, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f5c3c91, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd79845, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpecialNavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 0x295098 [0075.636] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0075.636] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0075.636] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_selectionsubpicture.png")) returned 0x20 [0075.637] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_selectionsubpicture.png")) returned 0x20 [0075.637] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_selectionsubpicture.png")) returned 0x20 [0075.637] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_selectionsubpicture.png")) returned 0x20 [0075.637] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_selectionsubpicture.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f5c3c91, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f5c3c91, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd79845, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbd6)) returned 1 [0075.637] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0075.637] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0075.637] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_selectionsubpicture.png")) returned 0x20 [0075.637] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_selectionsubpicture.png")) returned 0x20 [0075.637] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0075.637] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0075.637] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0075.637] SetEndOfFile (hFile=0x158) returned 1 [0075.638] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationLeft_SelectionSubpicture.png", cchWideChar=45, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 45 [0075.638] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationLeft_SelectionSubpicture.png", cchWideChar=45, lpMultiByteStr=0x201c52c, cbMultiByte=45, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpecialNavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 45 [0075.638] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationLeft_SelectionSubpicture.png", cchWideChar=45, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 45 [0075.638] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationLeft_SelectionSubpicture.png", cchWideChar=45, lpMultiByteStr=0x201c6ec, cbMultiByte=45, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpecialNavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 45 [0075.638] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x201c6ec, cbMultiByte=45, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="SpecialNavigationLeft_SelectionSubpicture.png") returned 45 [0075.639] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationLeft_SelectionSubpicture.png", cchWideChar=45, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 45 [0075.639] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationLeft_SelectionSubpicture.png", cchWideChar=45, lpMultiByteStr=0x201c52c, cbMultiByte=45, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpecialNavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 45 [0075.639] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0075.639] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0075.639] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0xbd6 [0075.639] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0075.639] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0075.639] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0075.639] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationLeft_SelectionSubpicture.png", cchWideChar=45, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 45 [0075.639] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationLeft_SelectionSubpicture.png", cchWideChar=45, lpMultiByteStr=0x201c52c, cbMultiByte=45, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpecialNavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 45 [0075.639] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationLeft_SelectionSubpicture.png", cchWideChar=45, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 45 [0075.639] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationLeft_SelectionSubpicture.png", cchWideChar=45, lpMultiByteStr=0x201c6ec, cbMultiByte=45, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpecialNavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 45 [0075.639] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x201c6ec, cbMultiByte=45, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="SpecialNavigationLeft_SelectionSubpicture.pngre.png") returned 45 [0075.640] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationLeft_SelectionSubpicture.png", cchWideChar=45, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 45 [0075.640] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationLeft_SelectionSubpicture.png", cchWideChar=45, lpMultiByteStr=0x201c52c, cbMultiByte=45, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpecialNavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 45 [0075.640] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0075.640] CharToOemA (in: pSrc="SpecialNavigationLeft_SelectionSubpicture.png", pDst=0x201c6ec | out: pDst="SpecialNavigationLeft_SelectionSubpicture.png") returned 1 [0075.641] WriteFile (in: hFile=0x158, lpBuffer=0x201c6ec*, nNumberOfBytesToWrite=0x2d, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x201c6ec*, lpNumberOfBytesWritten=0x18e048*=0x2d, lpOverlapped=0x0) returned 1 [0075.641] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0075.641] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0075.641] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0075.641] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=19590436641) returned 1 [0075.641] ReadFile (in: hFile=0x11c, lpBuffer=0x3b62f50, nNumberOfBytesToRead=0xbd6, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b62f50*, lpNumberOfBytesRead=0x18dd7c*=0xbd6, lpOverlapped=0x0) returned 1 [0075.643] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0075.643] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=19590608068) returned 1 [0075.652] WriteFile (in: hFile=0x158, lpBuffer=0x379adb0*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379adb0*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0075.653] ReadFile (in: hFile=0x11c, lpBuffer=0x3b62f50, nNumberOfBytesToRead=0xbd6, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3b62f50*, lpNumberOfBytesRead=0x18de38*=0xbd6, lpOverlapped=0x0) returned 1 [0075.653] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x68 [0075.653] WriteFile (in: hFile=0x158, lpBuffer=0x3b95340*, nNumberOfBytesToWrite=0xbd6, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3b95340*, lpNumberOfBytesWritten=0x18de10*=0xbd6, lpOverlapped=0x0) returned 1 [0075.653] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0xc3e [0075.653] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0075.653] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0075.653] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0075.653] SetFilePointer (in: hFile=0x158, lDistanceToMove=45, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x4b [0075.653] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0xc48 [0075.653] CloseHandle (hObject=0x11c) returned 1 [0075.654] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xc48 [0075.654] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xc48 [0075.654] SetFilePointer (in: hFile=0x158, lDistanceToMove=3144, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xc48 [0075.654] SetFilePointer (in: hFile=0x158, lDistanceToMove=3144, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0xc48 [0075.654] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xc48 [0075.654] SetFilePointer (in: hFile=0x158, lDistanceToMove=3144, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0xc48 [0075.654] SetEndOfFile (hFile=0x158) returned 1 [0075.654] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xc48 [0075.654] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xc48 [0075.654] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationLeft_SelectionSubpicture.png", cchWideChar=45, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 45 [0075.654] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationLeft_SelectionSubpicture.png", cchWideChar=45, lpMultiByteStr=0x201c6ec, cbMultiByte=45, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpecialNavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 45 [0075.654] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationLeft_SelectionSubpicture.png", cchWideChar=45, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 45 [0075.654] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationLeft_SelectionSubpicture.png", cchWideChar=45, lpMultiByteStr=0x201c52c, cbMultiByte=45, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpecialNavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 45 [0075.654] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x201c52c, cbMultiByte=45, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="SpecialNavigationLeft_SelectionSubpicture.png") returned 45 [0075.654] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationLeft_SelectionSubpicture.png", cchWideChar=45, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 45 [0075.654] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationLeft_SelectionSubpicture.png", cchWideChar=45, lpMultiByteStr=0x201c6ec, cbMultiByte=45, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpecialNavigationLeft_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 45 [0075.654] WriteFile (in: hFile=0x158, lpBuffer=0x3b46a28*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3b46a28*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0075.655] CharToOemA (in: pSrc="SpecialNavigationLeft_SelectionSubpicture.png", pDst=0x201c52c | out: pDst="SpecialNavigationLeft_SelectionSubpicture.png") returned 1 [0075.655] WriteFile (in: hFile=0x158, lpBuffer=0x201c52c*, nNumberOfBytesToWrite=0x2d, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x201c52c*, lpNumberOfBytesWritten=0x18efcc*=0x2d, lpOverlapped=0x0) returned 1 [0075.655] WriteFile (in: hFile=0x158, lpBuffer=0x379ade8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379ade8*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0075.655] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0075.655] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0075.655] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xcae [0075.655] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xcae [0075.655] WriteFile (in: hFile=0x158, lpBuffer=0x3777058*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777058*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0075.655] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0075.655] DeleteFileW (lpFileName="") returned 0 [0075.655] GetLastError () returned 0x3 [0075.655] GetFileAttributesW (lpFileName="") returned 0xffffffff [0075.655] SetLastError (dwErrCode=0x3) [0075.655] FlushFileBuffers (hFile=0x158) returned 1 [0075.657] GetCurrentThreadId () returned 0x970 [0075.657] GetCurrentThreadId () returned 0x970 [0075.657] GetCurrentThreadId () returned 0x970 [0075.658] GetCurrentThreadId () returned 0x970 [0075.658] GetCurrentThreadId () returned 0x970 [0075.658] GetCurrentThreadId () returned 0x970 [0075.658] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xd65 [0075.658] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xd65 [0075.658] SetFilePointer (in: hFile=0x158, lDistanceToMove=3429, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xd65 [0075.658] CloseHandle (hObject=0x158) returned 1 [0075.658] GetCurrentThreadId () returned 0x970 [0075.658] GetCurrentThreadId () returned 0x970 [0075.658] GetCurrentThreadId () returned 0x970 [0075.658] GetCurrentThreadId () returned 0x970 [0075.658] GetCurrentThreadId () returned 0x970 [0075.658] GetCurrentThreadId () returned 0x970 [0075.658] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\Файл зашифрован [SpecialNavigationLeft_SelectionSubpicture.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\Файл зашифрован [specialnavigationleft_selectionsubpicture.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0075.658] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd65 [0075.658] SetFilePointer (in: hFile=0x158, lDistanceToMove=3301, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xce5 [0075.658] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0075.658] GetFileType (hFile=0x158) returned 0x1 [0075.658] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x16, wMilliseconds=0x3a9)) [0075.658] GetCurrentThreadId () returned 0x970 [0075.659] GetCurrentThreadId () returned 0x970 [0075.659] GetCurrentThreadId () returned 0x970 [0075.659] GetCurrentThreadId () returned 0x970 [0075.659] GetCurrentThreadId () returned 0x970 [0075.659] GetCurrentThreadId () returned 0x970 [0075.659] GetCurrentThreadId () returned 0x970 [0075.659] GetCurrentThreadId () returned 0x970 [0075.659] GetCurrentThreadId () returned 0x970 [0075.659] GetCurrentThreadId () returned 0x970 [0075.659] GetCurrentThreadId () returned 0x970 [0075.659] GetCurrentThreadId () returned 0x970 [0075.659] GetCurrentThreadId () returned 0x970 [0075.659] GetCurrentThreadId () returned 0x970 [0075.659] GetCurrentThreadId () returned 0x970 [0075.659] GetCurrentThreadId () returned 0x970 [0075.659] GetCurrentThreadId () returned 0x970 [0075.659] GetCurrentThreadId () returned 0x970 [0075.659] GetCurrentThreadId () returned 0x970 [0075.659] GetCurrentThreadId () returned 0x970 [0075.659] GetCurrentThreadId () returned 0x970 [0075.659] GetCurrentThreadId () returned 0x970 [0075.659] GetCurrentThreadId () returned 0x970 [0075.659] GetCurrentThreadId () returned 0x970 [0075.659] GetCurrentThreadId () returned 0x970 [0075.659] GetCurrentThreadId () returned 0x970 [0075.659] GetCurrentThreadId () returned 0x970 [0075.659] GetCurrentThreadId () returned 0x970 [0075.659] GetCurrentThreadId () returned 0x970 [0075.659] GetCurrentThreadId () returned 0x970 [0075.659] GetCurrentThreadId () returned 0x970 [0075.659] GetCurrentThreadId () returned 0x970 [0075.659] GetCurrentThreadId () returned 0x970 [0075.659] GetCurrentThreadId () returned 0x970 [0075.659] GetCurrentThreadId () returned 0x970 [0075.659] GetCurrentThreadId () returned 0x970 [0075.659] GetCurrentThreadId () returned 0x970 [0075.659] GetCurrentThreadId () returned 0x970 [0075.659] GetCurrentThreadId () returned 0x970 [0075.659] GetCurrentThreadId () returned 0x970 [0075.659] GetCurrentThreadId () returned 0x970 [0075.659] GetCurrentThreadId () returned 0x970 [0075.659] GetCurrentThreadId () returned 0x970 [0075.659] GetCurrentThreadId () returned 0x970 [0075.659] GetCurrentThreadId () returned 0x970 [0075.659] GetCurrentThreadId () returned 0x970 [0075.660] GetCurrentThreadId () returned 0x970 [0075.660] GetCurrentThreadId () returned 0x970 [0075.660] GetCurrentThreadId () returned 0x970 [0075.660] GetCurrentThreadId () returned 0x970 [0075.660] GetCurrentThreadId () returned 0x970 [0075.660] GetCurrentThreadId () returned 0x970 [0075.660] GetCurrentThreadId () returned 0x970 [0075.660] GetCurrentThreadId () returned 0x970 [0075.660] GetCurrentThreadId () returned 0x970 [0075.660] GetCurrentThreadId () returned 0x970 [0075.660] GetCurrentThreadId () returned 0x970 [0075.660] GetCurrentThreadId () returned 0x970 [0075.660] GetCurrentThreadId () returned 0x970 [0075.660] GetCurrentThreadId () returned 0x970 [0075.660] GetCurrentThreadId () returned 0x970 [0075.660] GetCurrentThreadId () returned 0x970 [0075.660] GetCurrentThreadId () returned 0x970 [0075.660] GetCurrentThreadId () returned 0x970 [0075.660] GetCurrentThreadId () returned 0x970 [0075.660] GetCurrentThreadId () returned 0x970 [0075.660] GetCurrentThreadId () returned 0x970 [0075.660] GetCurrentThreadId () returned 0x970 [0075.660] GetCurrentThreadId () returned 0x970 [0075.660] GetCurrentThreadId () returned 0x970 [0075.660] GetCurrentThreadId () returned 0x970 [0075.660] GetCurrentThreadId () returned 0x970 [0075.660] GetCurrentThreadId () returned 0x970 [0075.660] GetCurrentThreadId () returned 0x970 [0075.660] GetCurrentThreadId () returned 0x970 [0075.660] GetCurrentThreadId () returned 0x970 [0075.660] GetCurrentThreadId () returned 0x970 [0075.660] GetCurrentThreadId () returned 0x970 [0075.660] GetCurrentThreadId () returned 0x970 [0075.660] GetCurrentThreadId () returned 0x970 [0075.660] GetCurrentThreadId () returned 0x970 [0075.660] GetCurrentThreadId () returned 0x970 [0075.660] GetCurrentThreadId () returned 0x970 [0075.660] GetCurrentThreadId () returned 0x970 [0075.660] GetCurrentThreadId () returned 0x970 [0075.660] GetCurrentThreadId () returned 0x970 [0075.660] GetCurrentThreadId () returned 0x970 [0075.660] GetCurrentThreadId () returned 0x970 [0075.660] GetCurrentThreadId () returned 0x970 [0075.660] GetCurrentThreadId () returned 0x970 [0075.660] GetCurrentThreadId () returned 0x970 [0075.661] GetCurrentThreadId () returned 0x970 [0075.661] GetCurrentThreadId () returned 0x970 [0075.661] GetCurrentThreadId () returned 0x970 [0075.661] GetCurrentThreadId () returned 0x970 [0075.661] GetCurrentThreadId () returned 0x970 [0075.661] GetCurrentThreadId () returned 0x970 [0075.661] GetCurrentThreadId () returned 0x970 [0075.661] GetCurrentThreadId () returned 0x970 [0075.661] GetCurrentThreadId () returned 0x970 [0075.661] GetCurrentThreadId () returned 0x970 [0075.661] GetCurrentThreadId () returned 0x970 [0075.661] GetCurrentThreadId () returned 0x970 [0075.661] GetCurrentThreadId () returned 0x970 [0075.661] GetCurrentThreadId () returned 0x970 [0075.661] GetCurrentThreadId () returned 0x970 [0075.661] GetCurrentThreadId () returned 0x970 [0075.661] GetCurrentThreadId () returned 0x970 [0075.661] GetCurrentThreadId () returned 0x970 [0075.661] GetCurrentThreadId () returned 0x970 [0075.661] GetCurrentThreadId () returned 0x970 [0075.661] GetCurrentThreadId () returned 0x970 [0075.661] GetCurrentThreadId () returned 0x970 [0075.661] GetCurrentThreadId () returned 0x970 [0075.661] GetCurrentThreadId () returned 0x970 [0075.661] GetCurrentThreadId () returned 0x970 [0075.661] GetCurrentThreadId () returned 0x970 [0075.661] GetCurrentThreadId () returned 0x970 [0075.661] GetCurrentThreadId () returned 0x970 [0075.661] GetCurrentThreadId () returned 0x970 [0075.661] GetCurrentThreadId () returned 0x970 [0075.661] GetCurrentThreadId () returned 0x970 [0075.661] GetCurrentThreadId () returned 0x970 [0075.661] GetCurrentThreadId () returned 0x970 [0075.661] GetCurrentThreadId () returned 0x970 [0075.661] GetCurrentThreadId () returned 0x970 [0075.661] GetCurrentThreadId () returned 0x970 [0075.661] GetCurrentThreadId () returned 0x970 [0075.661] GetCurrentThreadId () returned 0x970 [0075.661] GetCurrentThreadId () returned 0x970 [0075.661] GetCurrentThreadId () returned 0x970 [0075.661] GetCurrentThreadId () returned 0x970 [0075.661] GetCurrentThreadId () returned 0x970 [0075.661] GetCurrentThreadId () returned 0x970 [0075.661] GetCurrentThreadId () returned 0x970 [0075.661] GetCurrentThreadId () returned 0x970 [0075.662] GetCurrentThreadId () returned 0x970 [0075.662] GetCurrentThreadId () returned 0x970 [0075.662] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.662] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.662] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a0578, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0075.662] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.662] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.662] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a0578, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0075.662] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.662] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.662] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0075.662] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.662] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.662] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0075.662] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.662] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.662] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a05d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0075.662] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.662] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.662] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a05d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0075.662] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.662] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.662] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a05d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0075.662] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x16, wMilliseconds=0x3a9)) [0075.662] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="4tv%)5/:+!e4Lv~DwSn8#:GlQ1yg.qOH", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0075.662] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="4tv%)5/:+!e4Lv~DwSn8#:GlQ1yg.qOH", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0075.662] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="4tv%)5/:+!e4Lv~DwSn8#:GlQ1yg.qOH", cchWideChar=32, lpMultiByteStr=0x20060e8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4tv%)5/:+!e4Lv~DwSn8#:GlQ1yg.qOH", lpUsedDefaultChar=0x0) returned 32 [0075.662] GetCurrentThreadId () returned 0x970 [0075.662] GetCurrentThreadId () returned 0x970 [0075.662] GetCurrentThreadId () returned 0x970 [0075.662] GetCurrentThreadId () returned 0x970 [0075.663] GetCurrentThreadId () returned 0x970 [0075.663] GetCurrentThreadId () returned 0x970 [0075.670] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0075.670] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0075.670] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3b40ad8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0075.670] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ed948, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0075.670] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ed948, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAEBXHRq5cD/vP0O7j5WYLhE/4N6X8dQsToT5Y13qurwc03tBE73LAWn7v2fINe71kxT3tk8OVt+QLjnoFO+PnNdYMgpXveyu7R8CxfueLdDyaJOwcyovzlXUUFbT7xnzrT1Mhc68IquL/eYk/jLwS5aZqS2H+gKRy5HgnYg+oBKwdOpbsA/+VlrhPXHv8DC2co5xEkTaAA9JvymQ6k58jvcova4p2nhJaw==") returned 232 [0075.670] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x16, wMilliseconds=0x3a9)) [0075.670] GetCurrentThreadId () returned 0x970 [0075.670] GetCurrentThreadId () returned 0x970 [0075.670] GetCurrentThreadId () returned 0x970 [0075.670] GetCurrentThreadId () returned 0x970 [0075.670] GetCurrentThreadId () returned 0x970 [0075.670] GetCurrentThreadId () returned 0x970 [0075.670] GetCurrentThreadId () returned 0x970 [0075.670] GetCurrentThreadId () returned 0x970 [0075.670] GetCurrentThreadId () returned 0x970 [0075.670] GetCurrentThreadId () returned 0x970 [0075.670] GetCurrentThreadId () returned 0x970 [0075.670] GetCurrentThreadId () returned 0x970 [0075.670] GetCurrentThreadId () returned 0x970 [0075.670] GetCurrentThreadId () returned 0x970 [0075.670] GetCurrentThreadId () returned 0x970 [0075.670] GetCurrentThreadId () returned 0x970 [0075.670] GetCurrentThreadId () returned 0x970 [0075.670] GetCurrentThreadId () returned 0x970 [0075.671] GetCurrentThreadId () returned 0x970 [0075.671] GetCurrentThreadId () returned 0x970 [0075.671] GetCurrentThreadId () returned 0x970 [0075.671] GetCurrentThreadId () returned 0x970 [0075.671] GetCurrentThreadId () returned 0x970 [0075.671] GetCurrentThreadId () returned 0x970 [0075.671] GetCurrentThreadId () returned 0x970 [0075.671] GetCurrentThreadId () returned 0x970 [0075.671] GetCurrentThreadId () returned 0x970 [0075.671] GetCurrentThreadId () returned 0x970 [0075.671] GetCurrentThreadId () returned 0x970 [0075.671] GetCurrentThreadId () returned 0x970 [0075.671] GetCurrentThreadId () returned 0x970 [0075.671] GetCurrentThreadId () returned 0x970 [0075.671] GetCurrentThreadId () returned 0x970 [0075.671] GetCurrentThreadId () returned 0x970 [0075.671] GetCurrentThreadId () returned 0x970 [0075.671] GetCurrentThreadId () returned 0x970 [0075.671] GetCurrentThreadId () returned 0x970 [0075.671] GetCurrentThreadId () returned 0x970 [0075.671] GetCurrentThreadId () returned 0x970 [0075.671] GetCurrentThreadId () returned 0x970 [0075.671] GetCurrentThreadId () returned 0x970 [0075.671] GetCurrentThreadId () returned 0x970 [0075.671] GetCurrentThreadId () returned 0x970 [0075.671] GetCurrentThreadId () returned 0x970 [0075.671] GetCurrentThreadId () returned 0x970 [0075.671] GetCurrentThreadId () returned 0x970 [0075.671] GetCurrentThreadId () returned 0x970 [0075.671] GetCurrentThreadId () returned 0x970 [0075.671] GetCurrentThreadId () returned 0x970 [0075.671] GetCurrentThreadId () returned 0x970 [0075.671] GetCurrentThreadId () returned 0x970 [0075.671] GetCurrentThreadId () returned 0x970 [0075.671] GetCurrentThreadId () returned 0x970 [0075.671] GetCurrentThreadId () returned 0x970 [0075.671] GetCurrentThreadId () returned 0x970 [0075.671] GetCurrentThreadId () returned 0x970 [0075.671] GetCurrentThreadId () returned 0x970 [0075.671] GetCurrentThreadId () returned 0x970 [0075.671] GetCurrentThreadId () returned 0x970 [0075.671] GetCurrentThreadId () returned 0x970 [0075.671] GetCurrentThreadId () returned 0x970 [0075.671] GetCurrentThreadId () returned 0x970 [0075.671] GetCurrentThreadId () returned 0x970 [0075.672] GetCurrentThreadId () returned 0x970 [0075.672] GetCurrentThreadId () returned 0x970 [0075.672] GetCurrentThreadId () returned 0x970 [0075.672] GetCurrentThreadId () returned 0x970 [0075.672] GetCurrentThreadId () returned 0x970 [0075.672] GetCurrentThreadId () returned 0x970 [0075.672] GetCurrentThreadId () returned 0x970 [0075.672] GetCurrentThreadId () returned 0x970 [0075.672] GetCurrentThreadId () returned 0x970 [0075.672] GetCurrentThreadId () returned 0x970 [0075.672] GetCurrentThreadId () returned 0x970 [0075.672] GetCurrentThreadId () returned 0x970 [0075.672] GetCurrentThreadId () returned 0x970 [0075.672] GetCurrentThreadId () returned 0x970 [0075.672] GetCurrentThreadId () returned 0x970 [0075.672] GetCurrentThreadId () returned 0x970 [0075.672] GetCurrentThreadId () returned 0x970 [0075.672] GetCurrentThreadId () returned 0x970 [0075.672] GetCurrentThreadId () returned 0x970 [0075.672] GetCurrentThreadId () returned 0x970 [0075.672] GetCurrentThreadId () returned 0x970 [0075.672] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAEBXHRq5cD/vP0O7j5WYLhE/4N6X8dQsToT5Y13qurwc03tBE73LAWn7v2fINe71kxT3tk8OVt+QLjnoFO+PnNdYMgpXveyu7R8CxfueLdDyaJOwcyovzlXUUFbT7xnzrT1Mhc68IquL/eYk/jLwS5aZqS2H+gKRy5HgnYg+oBKwdOpbsA/+VlrhPXHv8DC2co5xEkTaAA9JvymQ6k58jvcova4p2nhJaw==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0075.672] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAEBXHRq5cD/vP0O7j5WYLhE/4N6X8dQsToT5Y13qurwc03tBE73LAWn7v2fINe71kxT3tk8OVt+QLjnoFO+PnNdYMgpXveyu7R8CxfueLdDyaJOwcyovzlXUUFbT7xnzrT1Mhc68IquL/eYk/jLwS5aZqS2H+gKRy5HgnYg+oBKwdOpbsA/+VlrhPXHv8DC2co5xEkTaAA9JvymQ6k58jvcova4p2nhJaw==", cchWideChar=245, lpMultiByteStr=0x353b75c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAEBXHRq5cD/vP0O7j5WYLhE/4N6X8dQsToT5Y13qurwc03tBE73LAWn7v2fINe71kxT3tk8OVt+QLjnoFO+PnNdYMgpXveyu7R8CxfueLdDyaJOwcyovzlXUUFbT7xnzrT1Mhc68IquL/eYk/jLwS5aZqS2H+gKRy5HgnYg+oBKwdOpbsA/+VlrhPXHv8DC2co5xEkTaAA9JvymQ6k58jvcova4p2nhJaw==", lpUsedDefaultChar=0x0) returned 245 [0075.672] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0075.672] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0075.672] CloseHandle (hObject=0x158) returned 1 [0075.672] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_selectionsubpicture.png")) returned 0 [0075.673] GetLastError () returned 0x5 [0075.673] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_selectionsubpicture.png")) returned 0x20 [0075.673] SetLastError (dwErrCode=0x5) [0075.673] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=19593618488) returned 1 [0075.673] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\Файл зашифрован [SpecialNavigationRight_ButtonGraphic.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\Файл зашифрован [specialnavigationright_buttongraphic.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0075.674] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0075.674] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0075.674] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0075.674] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0075.674] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0075.674] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0075.674] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0075.674] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0075.674] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0075.674] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0075.674] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0075.674] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0075.674] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0075.674] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0075.674] SetEndOfFile (hFile=0x158) returned 1 [0075.674] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0075.675] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0075.675] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0075.675] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0075.675] WriteFile (in: hFile=0x158, lpBuffer=0x3777058*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777058*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0075.676] WriteFile (in: hFile=0x158, lpBuffer=0x35f035c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f035c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0075.676] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6AJQ&O+L^Jkl/cA{UTF\"$@&K82+X^g&d", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0075.676] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6AJQ&O+L^Jkl/cA{UTF\"$@&K82+X^g&d", cchWideChar=32, lpMultiByteStr=0x2038b7c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6AJQ&O+L^Jkl/cA{UTF\"$@&K82+X^g&d", lpUsedDefaultChar=0x0) returned 32 [0075.676] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0075.676] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0075.676] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_ButtonGraphic.png", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f59db34, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f59db34, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd79845, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x12cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpecialNavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 0x295098 [0075.676] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0075.676] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0075.676] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_buttongraphic.png")) returned 0x20 [0075.676] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_buttongraphic.png")) returned 0x20 [0075.676] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_buttongraphic.png")) returned 0x20 [0075.676] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_buttongraphic.png")) returned 0x20 [0075.676] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_buttongraphic.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f59db34, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f59db34, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd79845, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x12cf)) returned 1 [0075.677] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0075.677] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0075.677] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_buttongraphic.png")) returned 0x20 [0075.677] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_buttongraphic.png")) returned 0x20 [0075.677] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0075.677] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0075.677] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0075.677] SetEndOfFile (hFile=0x158) returned 1 [0075.678] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationRight_ButtonGraphic.png", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0075.678] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationRight_ButtonGraphic.png", cchWideChar=40, lpMultiByteStr=0x201c52c, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpecialNavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 40 [0075.678] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationRight_ButtonGraphic.png", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0075.678] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationRight_ButtonGraphic.png", cchWideChar=40, lpMultiByteStr=0x201c6ec, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpecialNavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 40 [0075.678] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x201c6ec, cbMultiByte=40, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="SpecialNavigationRight_ButtonGraphic.pnge.png") returned 40 [0075.678] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationRight_ButtonGraphic.png", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0075.678] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationRight_ButtonGraphic.png", cchWideChar=40, lpMultiByteStr=0x201c52c, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpecialNavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 40 [0075.678] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0075.678] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0075.678] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x12cf [0075.678] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0075.678] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0075.679] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0075.679] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationRight_ButtonGraphic.png", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0075.679] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationRight_ButtonGraphic.png", cchWideChar=40, lpMultiByteStr=0x201c52c, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpecialNavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 40 [0075.679] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationRight_ButtonGraphic.png", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0075.679] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationRight_ButtonGraphic.png", cchWideChar=40, lpMultiByteStr=0x201c6ec, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpecialNavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 40 [0075.679] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x201c6ec, cbMultiByte=40, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="SpecialNavigationRight_ButtonGraphic.pngic.pnge.png") returned 40 [0075.679] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationRight_ButtonGraphic.png", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0075.679] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationRight_ButtonGraphic.png", cchWideChar=40, lpMultiByteStr=0x201c52c, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpecialNavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 40 [0075.679] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0075.680] CharToOemA (in: pSrc="SpecialNavigationRight_ButtonGraphic.png", pDst=0x201c6ec | out: pDst="SpecialNavigationRight_ButtonGraphic.png") returned 1 [0075.680] WriteFile (in: hFile=0x158, lpBuffer=0x201c6ec*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x201c6ec*, lpNumberOfBytesWritten=0x18e048*=0x28, lpOverlapped=0x0) returned 1 [0075.680] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0075.680] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0075.680] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0075.680] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=19594369142) returned 1 [0075.680] ReadFile (in: hFile=0x11c, lpBuffer=0x3b62f50, nNumberOfBytesToRead=0x12cf, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b62f50*, lpNumberOfBytesRead=0x18dd7c*=0x12cf, lpOverlapped=0x0) returned 1 [0075.682] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0075.682] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=19594516127) returned 1 [0075.691] WriteFile (in: hFile=0x158, lpBuffer=0x379acd8*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379acd8*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0075.691] ReadFile (in: hFile=0x11c, lpBuffer=0x3b62f50, nNumberOfBytesToRead=0x12cf, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3b62f50*, lpNumberOfBytesRead=0x18de38*=0x12cf, lpOverlapped=0x0) returned 1 [0075.691] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x63 [0075.691] WriteFile (in: hFile=0x158, lpBuffer=0x3b95a40*, nNumberOfBytesToWrite=0x12cf, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3b95a40*, lpNumberOfBytesWritten=0x18de10*=0x12cf, lpOverlapped=0x0) returned 1 [0075.691] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x1332 [0075.691] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0075.691] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0075.691] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0075.692] SetFilePointer (in: hFile=0x158, lDistanceToMove=40, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x46 [0075.692] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x133c [0075.692] CloseHandle (hObject=0x11c) returned 1 [0075.692] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x133c [0075.692] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x133c [0075.692] SetFilePointer (in: hFile=0x158, lDistanceToMove=4924, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x133c [0075.692] SetFilePointer (in: hFile=0x158, lDistanceToMove=4924, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x133c [0075.692] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x133c [0075.692] SetFilePointer (in: hFile=0x158, lDistanceToMove=4924, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x133c [0075.692] SetEndOfFile (hFile=0x158) returned 1 [0075.692] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x133c [0075.692] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x133c [0075.692] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationRight_ButtonGraphic.png", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0075.692] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationRight_ButtonGraphic.png", cchWideChar=40, lpMultiByteStr=0x201c6ec, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpecialNavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 40 [0075.693] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationRight_ButtonGraphic.png", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0075.693] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationRight_ButtonGraphic.png", cchWideChar=40, lpMultiByteStr=0x201c52c, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpecialNavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 40 [0075.693] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x201c52c, cbMultiByte=40, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="SpecialNavigationRight_ButtonGraphic.png") returned 40 [0075.693] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationRight_ButtonGraphic.png", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0075.693] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationRight_ButtonGraphic.png", cchWideChar=40, lpMultiByteStr=0x201c6ec, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpecialNavigationRight_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 40 [0075.693] WriteFile (in: hFile=0x158, lpBuffer=0x3b46a28*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3b46a28*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0075.693] CharToOemA (in: pSrc="SpecialNavigationRight_ButtonGraphic.png", pDst=0x201c52c | out: pDst="SpecialNavigationRight_ButtonGraphic.png") returned 1 [0075.693] WriteFile (in: hFile=0x158, lpBuffer=0x201c52c*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x201c52c*, lpNumberOfBytesWritten=0x18efcc*=0x28, lpOverlapped=0x0) returned 1 [0075.693] WriteFile (in: hFile=0x158, lpBuffer=0x379ae18*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379ae18*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0075.693] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0075.693] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0075.693] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x139d [0075.693] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x139d [0075.693] WriteFile (in: hFile=0x158, lpBuffer=0x3777058*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777058*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0075.694] WriteFile (in: hFile=0x158, lpBuffer=0x35f035c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f035c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0075.694] DeleteFileW (lpFileName="") returned 0 [0075.694] GetLastError () returned 0x3 [0075.694] GetFileAttributesW (lpFileName="") returned 0xffffffff [0075.694] SetLastError (dwErrCode=0x3) [0075.694] FlushFileBuffers (hFile=0x158) returned 1 [0075.696] GetCurrentThreadId () returned 0x970 [0075.696] GetCurrentThreadId () returned 0x970 [0075.696] GetCurrentThreadId () returned 0x970 [0075.696] GetCurrentThreadId () returned 0x970 [0075.697] GetCurrentThreadId () returned 0x970 [0075.697] GetCurrentThreadId () returned 0x970 [0075.697] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x1454 [0075.697] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x1454 [0075.697] SetFilePointer (in: hFile=0x158, lDistanceToMove=5204, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x1454 [0075.697] CloseHandle (hObject=0x158) returned 1 [0075.697] GetCurrentThreadId () returned 0x970 [0075.697] GetCurrentThreadId () returned 0x970 [0075.697] GetCurrentThreadId () returned 0x970 [0075.697] GetCurrentThreadId () returned 0x970 [0075.697] GetCurrentThreadId () returned 0x970 [0075.697] GetCurrentThreadId () returned 0x970 [0075.697] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\Файл зашифрован [SpecialNavigationRight_ButtonGraphic.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\Файл зашифрован [specialnavigationright_buttongraphic.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0075.697] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1454 [0075.697] SetFilePointer (in: hFile=0x158, lDistanceToMove=5076, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13d4 [0075.697] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0075.697] GetFileType (hFile=0x158) returned 0x1 [0075.697] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x16, wMilliseconds=0x3c8)) [0075.697] GetCurrentThreadId () returned 0x970 [0075.697] GetCurrentThreadId () returned 0x970 [0075.698] GetCurrentThreadId () returned 0x970 [0075.698] GetCurrentThreadId () returned 0x970 [0075.698] GetCurrentThreadId () returned 0x970 [0075.698] GetCurrentThreadId () returned 0x970 [0075.698] GetCurrentThreadId () returned 0x970 [0075.698] GetCurrentThreadId () returned 0x970 [0075.698] GetCurrentThreadId () returned 0x970 [0075.698] GetCurrentThreadId () returned 0x970 [0075.698] GetCurrentThreadId () returned 0x970 [0075.698] GetCurrentThreadId () returned 0x970 [0075.698] GetCurrentThreadId () returned 0x970 [0075.698] GetCurrentThreadId () returned 0x970 [0075.698] GetCurrentThreadId () returned 0x970 [0075.698] GetCurrentThreadId () returned 0x970 [0075.698] GetCurrentThreadId () returned 0x970 [0075.698] GetCurrentThreadId () returned 0x970 [0075.698] GetCurrentThreadId () returned 0x970 [0075.698] GetCurrentThreadId () returned 0x970 [0075.698] GetCurrentThreadId () returned 0x970 [0075.698] GetCurrentThreadId () returned 0x970 [0075.698] GetCurrentThreadId () returned 0x970 [0075.698] GetCurrentThreadId () returned 0x970 [0075.698] GetCurrentThreadId () returned 0x970 [0075.698] GetCurrentThreadId () returned 0x970 [0075.698] GetCurrentThreadId () returned 0x970 [0075.698] GetCurrentThreadId () returned 0x970 [0075.698] GetCurrentThreadId () returned 0x970 [0075.698] GetCurrentThreadId () returned 0x970 [0075.698] GetCurrentThreadId () returned 0x970 [0075.698] GetCurrentThreadId () returned 0x970 [0075.698] GetCurrentThreadId () returned 0x970 [0075.698] GetCurrentThreadId () returned 0x970 [0075.698] GetCurrentThreadId () returned 0x970 [0075.698] GetCurrentThreadId () returned 0x970 [0075.698] GetCurrentThreadId () returned 0x970 [0075.698] GetCurrentThreadId () returned 0x970 [0075.698] GetCurrentThreadId () returned 0x970 [0075.698] GetCurrentThreadId () returned 0x970 [0075.698] GetCurrentThreadId () returned 0x970 [0075.698] GetCurrentThreadId () returned 0x970 [0075.698] GetCurrentThreadId () returned 0x970 [0075.698] GetCurrentThreadId () returned 0x970 [0075.698] GetCurrentThreadId () returned 0x970 [0075.698] GetCurrentThreadId () returned 0x970 [0075.698] GetCurrentThreadId () returned 0x970 [0075.699] GetCurrentThreadId () returned 0x970 [0075.699] GetCurrentThreadId () returned 0x970 [0075.699] GetCurrentThreadId () returned 0x970 [0075.699] GetCurrentThreadId () returned 0x970 [0075.699] GetCurrentThreadId () returned 0x970 [0075.699] GetCurrentThreadId () returned 0x970 [0075.699] GetCurrentThreadId () returned 0x970 [0075.699] GetCurrentThreadId () returned 0x970 [0075.699] GetCurrentThreadId () returned 0x970 [0075.699] GetCurrentThreadId () returned 0x970 [0075.699] GetCurrentThreadId () returned 0x970 [0075.699] GetCurrentThreadId () returned 0x970 [0075.699] GetCurrentThreadId () returned 0x970 [0075.699] GetCurrentThreadId () returned 0x970 [0075.699] GetCurrentThreadId () returned 0x970 [0075.699] GetCurrentThreadId () returned 0x970 [0075.699] GetCurrentThreadId () returned 0x970 [0075.699] GetCurrentThreadId () returned 0x970 [0075.699] GetCurrentThreadId () returned 0x970 [0075.699] GetCurrentThreadId () returned 0x970 [0075.699] GetCurrentThreadId () returned 0x970 [0075.699] GetCurrentThreadId () returned 0x970 [0075.699] GetCurrentThreadId () returned 0x970 [0075.699] GetCurrentThreadId () returned 0x970 [0075.699] GetCurrentThreadId () returned 0x970 [0075.699] GetCurrentThreadId () returned 0x970 [0075.699] GetCurrentThreadId () returned 0x970 [0075.699] GetCurrentThreadId () returned 0x970 [0075.699] GetCurrentThreadId () returned 0x970 [0075.699] GetCurrentThreadId () returned 0x970 [0075.699] GetCurrentThreadId () returned 0x970 [0075.699] GetCurrentThreadId () returned 0x970 [0075.699] GetCurrentThreadId () returned 0x970 [0075.699] GetCurrentThreadId () returned 0x970 [0075.699] GetCurrentThreadId () returned 0x970 [0075.699] GetCurrentThreadId () returned 0x970 [0075.699] GetCurrentThreadId () returned 0x970 [0075.699] GetCurrentThreadId () returned 0x970 [0075.699] GetCurrentThreadId () returned 0x970 [0075.699] GetCurrentThreadId () returned 0x970 [0075.699] GetCurrentThreadId () returned 0x970 [0075.699] GetCurrentThreadId () returned 0x970 [0075.699] GetCurrentThreadId () returned 0x970 [0075.699] GetCurrentThreadId () returned 0x970 [0075.699] GetCurrentThreadId () returned 0x970 [0075.700] GetCurrentThreadId () returned 0x970 [0075.700] GetCurrentThreadId () returned 0x970 [0075.700] GetCurrentThreadId () returned 0x970 [0075.700] GetCurrentThreadId () returned 0x970 [0075.700] GetCurrentThreadId () returned 0x970 [0075.700] GetCurrentThreadId () returned 0x970 [0075.700] GetCurrentThreadId () returned 0x970 [0075.700] GetCurrentThreadId () returned 0x970 [0075.700] GetCurrentThreadId () returned 0x970 [0075.700] GetCurrentThreadId () returned 0x970 [0075.700] GetCurrentThreadId () returned 0x970 [0075.700] GetCurrentThreadId () returned 0x970 [0075.700] GetCurrentThreadId () returned 0x970 [0075.700] GetCurrentThreadId () returned 0x970 [0075.700] GetCurrentThreadId () returned 0x970 [0075.700] GetCurrentThreadId () returned 0x970 [0075.700] GetCurrentThreadId () returned 0x970 [0075.700] GetCurrentThreadId () returned 0x970 [0075.700] GetCurrentThreadId () returned 0x970 [0075.700] GetCurrentThreadId () returned 0x970 [0075.700] GetCurrentThreadId () returned 0x970 [0075.700] GetCurrentThreadId () returned 0x970 [0075.700] GetCurrentThreadId () returned 0x970 [0075.700] GetCurrentThreadId () returned 0x970 [0075.700] GetCurrentThreadId () returned 0x970 [0075.700] GetCurrentThreadId () returned 0x970 [0075.700] GetCurrentThreadId () returned 0x970 [0075.700] GetCurrentThreadId () returned 0x970 [0075.700] GetCurrentThreadId () returned 0x970 [0075.700] GetCurrentThreadId () returned 0x970 [0075.700] GetCurrentThreadId () returned 0x970 [0075.700] GetCurrentThreadId () returned 0x970 [0075.700] GetCurrentThreadId () returned 0x970 [0075.700] GetCurrentThreadId () returned 0x970 [0075.700] GetCurrentThreadId () returned 0x970 [0075.700] GetCurrentThreadId () returned 0x970 [0075.700] GetCurrentThreadId () returned 0x970 [0075.700] GetCurrentThreadId () returned 0x970 [0075.700] GetCurrentThreadId () returned 0x970 [0075.700] GetCurrentThreadId () returned 0x970 [0075.700] GetCurrentThreadId () returned 0x970 [0075.700] GetCurrentThreadId () returned 0x970 [0075.700] GetCurrentThreadId () returned 0x970 [0075.701] GetCurrentThreadId () returned 0x970 [0075.701] GetCurrentThreadId () returned 0x970 [0075.701] GetCurrentThreadId () returned 0x970 [0075.701] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.701] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.701] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a05d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0075.701] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.701] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.701] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a05d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0075.701] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.701] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.701] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0075.701] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.701] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.701] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0075.701] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.701] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.701] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a0638, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0075.701] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.701] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.701] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a0638, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0075.701] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.701] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.701] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a0638, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0075.701] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x16, wMilliseconds=0x3c8)) [0075.701] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="6AJQ&O+L^Jkl/cA{UTF\"$@&K82+X^g&d", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0075.701] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="6AJQ&O+L^Jkl/cA{UTF\"$@&K82+X^g&d", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0075.701] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="6AJQ&O+L^Jkl/cA{UTF\"$@&K82+X^g&d", cchWideChar=32, lpMultiByteStr=0x2006118, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6AJQ&O+L^Jkl/cA{UTF\"$@&K82+X^g&d", lpUsedDefaultChar=0x0) returned 32 [0075.702] GetCurrentThreadId () returned 0x970 [0075.702] GetCurrentThreadId () returned 0x970 [0075.702] GetCurrentThreadId () returned 0x970 [0075.702] GetCurrentThreadId () returned 0x970 [0075.702] GetCurrentThreadId () returned 0x970 [0075.702] GetCurrentThreadId () returned 0x970 [0075.709] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0075.709] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0075.709] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3b40bc8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0075.709] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ed948, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0075.709] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ed948, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAACNLALDkp+Je2xf8qrk+NPgTO44XJ0pYDL44HMS6gwlO/5+MezrEFpGfqlaat31l3VWLKVaKlOKe9+4VrT9NraEfIHrlsDNL0VZLDPnZCHhE5fH9NlYFooE3RAtih5tmuTCVdqJOHsuaHcN0krV8PK4BSCJtEDEHE8qaNGbh9Dk63z/5WszRmWQwdt24eTNUctjFt7oPMNvgVx1q4eL0oSy/qRREOTIZOA==") returned 232 [0075.709] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x16, wMilliseconds=0x3d8)) [0075.709] GetCurrentThreadId () returned 0x970 [0075.709] GetCurrentThreadId () returned 0x970 [0075.709] GetCurrentThreadId () returned 0x970 [0075.709] GetCurrentThreadId () returned 0x970 [0075.709] GetCurrentThreadId () returned 0x970 [0075.709] GetCurrentThreadId () returned 0x970 [0075.710] GetCurrentThreadId () returned 0x970 [0075.710] GetCurrentThreadId () returned 0x970 [0075.710] GetCurrentThreadId () returned 0x970 [0075.710] GetCurrentThreadId () returned 0x970 [0075.710] GetCurrentThreadId () returned 0x970 [0075.710] GetCurrentThreadId () returned 0x970 [0075.710] GetCurrentThreadId () returned 0x970 [0075.710] GetCurrentThreadId () returned 0x970 [0075.710] GetCurrentThreadId () returned 0x970 [0075.710] GetCurrentThreadId () returned 0x970 [0075.710] GetCurrentThreadId () returned 0x970 [0075.710] GetCurrentThreadId () returned 0x970 [0075.710] GetCurrentThreadId () returned 0x970 [0075.710] GetCurrentThreadId () returned 0x970 [0075.710] GetCurrentThreadId () returned 0x970 [0075.710] GetCurrentThreadId () returned 0x970 [0075.710] GetCurrentThreadId () returned 0x970 [0075.710] GetCurrentThreadId () returned 0x970 [0075.710] GetCurrentThreadId () returned 0x970 [0075.710] GetCurrentThreadId () returned 0x970 [0075.710] GetCurrentThreadId () returned 0x970 [0075.710] GetCurrentThreadId () returned 0x970 [0075.710] GetCurrentThreadId () returned 0x970 [0075.710] GetCurrentThreadId () returned 0x970 [0075.710] GetCurrentThreadId () returned 0x970 [0075.710] GetCurrentThreadId () returned 0x970 [0075.710] GetCurrentThreadId () returned 0x970 [0075.710] GetCurrentThreadId () returned 0x970 [0075.710] GetCurrentThreadId () returned 0x970 [0075.710] GetCurrentThreadId () returned 0x970 [0075.710] GetCurrentThreadId () returned 0x970 [0075.710] GetCurrentThreadId () returned 0x970 [0075.710] GetCurrentThreadId () returned 0x970 [0075.710] GetCurrentThreadId () returned 0x970 [0075.710] GetCurrentThreadId () returned 0x970 [0075.710] GetCurrentThreadId () returned 0x970 [0075.710] GetCurrentThreadId () returned 0x970 [0075.710] GetCurrentThreadId () returned 0x970 [0075.710] GetCurrentThreadId () returned 0x970 [0075.710] GetCurrentThreadId () returned 0x970 [0075.710] GetCurrentThreadId () returned 0x970 [0075.710] GetCurrentThreadId () returned 0x970 [0075.710] GetCurrentThreadId () returned 0x970 [0075.710] GetCurrentThreadId () returned 0x970 [0075.710] GetCurrentThreadId () returned 0x970 [0075.711] GetCurrentThreadId () returned 0x970 [0075.711] GetCurrentThreadId () returned 0x970 [0075.711] GetCurrentThreadId () returned 0x970 [0075.711] GetCurrentThreadId () returned 0x970 [0075.711] GetCurrentThreadId () returned 0x970 [0075.711] GetCurrentThreadId () returned 0x970 [0075.711] GetCurrentThreadId () returned 0x970 [0075.711] GetCurrentThreadId () returned 0x970 [0075.711] GetCurrentThreadId () returned 0x970 [0075.711] GetCurrentThreadId () returned 0x970 [0075.711] GetCurrentThreadId () returned 0x970 [0075.711] GetCurrentThreadId () returned 0x970 [0075.711] GetCurrentThreadId () returned 0x970 [0075.711] GetCurrentThreadId () returned 0x970 [0075.711] GetCurrentThreadId () returned 0x970 [0075.711] GetCurrentThreadId () returned 0x970 [0075.711] GetCurrentThreadId () returned 0x970 [0075.711] GetCurrentThreadId () returned 0x970 [0075.711] GetCurrentThreadId () returned 0x970 [0075.711] GetCurrentThreadId () returned 0x970 [0075.711] GetCurrentThreadId () returned 0x970 [0075.711] GetCurrentThreadId () returned 0x970 [0075.711] GetCurrentThreadId () returned 0x970 [0075.711] GetCurrentThreadId () returned 0x970 [0075.711] GetCurrentThreadId () returned 0x970 [0075.711] GetCurrentThreadId () returned 0x970 [0075.711] GetCurrentThreadId () returned 0x970 [0075.711] GetCurrentThreadId () returned 0x970 [0075.711] GetCurrentThreadId () returned 0x970 [0075.711] GetCurrentThreadId () returned 0x970 [0075.711] GetCurrentThreadId () returned 0x970 [0075.711] GetCurrentThreadId () returned 0x970 [0075.711] GetCurrentThreadId () returned 0x970 [0075.711] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAACNLALDkp+Je2xf8qrk+NPgTO44XJ0pYDL44HMS6gwlO/5+MezrEFpGfqlaat31l3VWLKVaKlOKe9+4VrT9NraEfIHrlsDNL0VZLDPnZCHhE5fH9NlYFooE3RAtih5tmuTCVdqJOHsuaHcN0krV8PK4BSCJtEDEHE8qaNGbh9Dk63z/5WszRmWQwdt24eTNUctjFt7oPMNvgVx1q4eL0oSy/qRREOTIZOA==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0075.711] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAACNLALDkp+Je2xf8qrk+NPgTO44XJ0pYDL44HMS6gwlO/5+MezrEFpGfqlaat31l3VWLKVaKlOKe9+4VrT9NraEfIHrlsDNL0VZLDPnZCHhE5fH9NlYFooE3RAtih5tmuTCVdqJOHsuaHcN0krV8PK4BSCJtEDEHE8qaNGbh9Dk63z/5WszRmWQwdt24eTNUctjFt7oPMNvgVx1q4eL0oSy/qRREOTIZOA==", cchWideChar=245, lpMultiByteStr=0x353b75c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAACNLALDkp+Je2xf8qrk+NPgTO44XJ0pYDL44HMS6gwlO/5+MezrEFpGfqlaat31l3VWLKVaKlOKe9+4VrT9NraEfIHrlsDNL0VZLDPnZCHhE5fH9NlYFooE3RAtih5tmuTCVdqJOHsuaHcN0krV8PK4BSCJtEDEHE8qaNGbh9Dk63z/5WszRmWQwdt24eTNUctjFt7oPMNvgVx1q4eL0oSy/qRREOTIZOA==", lpUsedDefaultChar=0x0) returned 245 [0075.711] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0075.712] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0075.712] CloseHandle (hObject=0x158) returned 1 [0075.712] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_buttongraphic.png")) returned 0 [0075.712] GetLastError () returned 0x5 [0075.712] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_buttongraphic.png")) returned 0x20 [0075.712] SetLastError (dwErrCode=0x5) [0075.712] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=19597547893) returned 1 [0075.712] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\Файл зашифрован [SpecialNavigationRight_SelectionSubpicture.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\Файл зашифрован [specialnavigationright_selectionsubpicture.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0075.713] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0075.713] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0075.713] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0075.713] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0075.713] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0075.713] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0075.713] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0075.713] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0075.713] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0075.713] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0075.713] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0075.713] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0075.713] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0075.713] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0075.713] SetEndOfFile (hFile=0x158) returned 1 [0075.714] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0075.714] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0075.714] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0075.714] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0075.714] WriteFile (in: hFile=0x158, lpBuffer=0x3777058*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777058*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0075.715] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0075.715] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="wYe)9k7V7YJo##!/M.M@)8Rg}UPJ&#jK", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0075.715] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="wYe)9k7V7YJo##!/M.M@)8Rg}UPJ&#jK", cchWideChar=32, lpMultiByteStr=0x2039244, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wYe)9k7V7YJo##!/M.M@)8Rg}UPJ&#jK", lpUsedDefaultChar=0x0) returned 32 [0075.715] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0075.715] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0075.715] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_SelectionSubpicture.png", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f59db34, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f59db34, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd79845, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpecialNavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 0x295098 [0075.715] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0075.715] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0075.715] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_selectionsubpicture.png")) returned 0x20 [0075.715] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_selectionsubpicture.png")) returned 0x20 [0075.716] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_selectionsubpicture.png")) returned 0x20 [0075.716] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_selectionsubpicture.png")) returned 0x20 [0075.716] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_selectionsubpicture.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f59db34, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f59db34, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd79845, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbd0)) returned 1 [0075.716] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0075.716] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0075.716] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_selectionsubpicture.png")) returned 0x20 [0075.716] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_selectionsubpicture.png")) returned 0x20 [0075.716] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0075.716] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0075.716] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0075.716] SetEndOfFile (hFile=0x158) returned 1 [0075.717] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationRight_SelectionSubpicture.png", cchWideChar=46, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 46 [0075.717] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationRight_SelectionSubpicture.png", cchWideChar=46, lpMultiByteStr=0x201c52c, cbMultiByte=46, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpecialNavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 46 [0075.717] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationRight_SelectionSubpicture.png", cchWideChar=46, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 46 [0075.717] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationRight_SelectionSubpicture.png", cchWideChar=46, lpMultiByteStr=0x201c6ec, cbMultiByte=46, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpecialNavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 46 [0075.717] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x201c6ec, cbMultiByte=46, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="SpecialNavigationRight_SelectionSubpicture.png?ǒ弼f๜͝暀䫅?ǒ") returned 46 [0075.718] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationRight_SelectionSubpicture.png", cchWideChar=46, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 46 [0075.718] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationRight_SelectionSubpicture.png", cchWideChar=46, lpMultiByteStr=0x201c52c, cbMultiByte=46, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpecialNavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 46 [0075.718] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0075.718] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0075.718] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0xbd0 [0075.718] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0075.718] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0075.718] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0075.718] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationRight_SelectionSubpicture.png", cchWideChar=46, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 46 [0075.718] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationRight_SelectionSubpicture.png", cchWideChar=46, lpMultiByteStr=0x201c52c, cbMultiByte=46, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpecialNavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 46 [0075.719] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationRight_SelectionSubpicture.png", cchWideChar=46, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 46 [0075.719] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationRight_SelectionSubpicture.png", cchWideChar=46, lpMultiByteStr=0x201c6ec, cbMultiByte=46, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpecialNavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 46 [0075.719] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x201c6ec, cbMultiByte=46, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="SpecialNavigationRight_SelectionSubpicture.pngre.png?ǒ弼f๜͝暀䫅?ǒ") returned 46 [0075.719] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationRight_SelectionSubpicture.png", cchWideChar=46, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 46 [0075.719] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationRight_SelectionSubpicture.png", cchWideChar=46, lpMultiByteStr=0x201c52c, cbMultiByte=46, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpecialNavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 46 [0075.719] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0075.720] CharToOemA (in: pSrc="SpecialNavigationRight_SelectionSubpicture.png", pDst=0x201c6ec | out: pDst="SpecialNavigationRight_SelectionSubpicture.png") returned 1 [0075.720] WriteFile (in: hFile=0x158, lpBuffer=0x201c6ec*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x201c6ec*, lpNumberOfBytesWritten=0x18e048*=0x2e, lpOverlapped=0x0) returned 1 [0075.720] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0075.720] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0075.720] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0075.720] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=19598378771) returned 1 [0075.720] ReadFile (in: hFile=0x11c, lpBuffer=0x3b62f50, nNumberOfBytesToRead=0xbd0, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b62f50*, lpNumberOfBytesRead=0x18dd7c*=0xbd0, lpOverlapped=0x0) returned 1 [0075.722] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0075.722] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=19598530706) returned 1 [0075.731] WriteFile (in: hFile=0x158, lpBuffer=0x379acf0*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379acf0*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0075.731] ReadFile (in: hFile=0x11c, lpBuffer=0x3b62f50, nNumberOfBytesToRead=0xbd0, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3b62f50*, lpNumberOfBytesRead=0x18de38*=0xbd0, lpOverlapped=0x0) returned 1 [0075.731] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x69 [0075.731] WriteFile (in: hFile=0x158, lpBuffer=0x3b95340*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3b95340*, lpNumberOfBytesWritten=0x18de10*=0xbd0, lpOverlapped=0x0) returned 1 [0075.731] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0xc39 [0075.731] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0075.731] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0075.731] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0075.731] SetFilePointer (in: hFile=0x158, lDistanceToMove=46, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x4c [0075.731] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0xc43 [0075.732] CloseHandle (hObject=0x11c) returned 1 [0075.732] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xc43 [0075.732] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xc43 [0075.732] SetFilePointer (in: hFile=0x158, lDistanceToMove=3139, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xc43 [0075.732] SetFilePointer (in: hFile=0x158, lDistanceToMove=3139, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0xc43 [0075.732] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xc43 [0075.732] SetFilePointer (in: hFile=0x158, lDistanceToMove=3139, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0xc43 [0075.732] SetEndOfFile (hFile=0x158) returned 1 [0075.732] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xc43 [0075.732] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xc43 [0075.732] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationRight_SelectionSubpicture.png", cchWideChar=46, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 46 [0075.732] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationRight_SelectionSubpicture.png", cchWideChar=46, lpMultiByteStr=0x201c6ec, cbMultiByte=46, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpecialNavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 46 [0075.732] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationRight_SelectionSubpicture.png", cchWideChar=46, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 46 [0075.732] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationRight_SelectionSubpicture.png", cchWideChar=46, lpMultiByteStr=0x201c52c, cbMultiByte=46, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpecialNavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 46 [0075.732] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x201c52c, cbMultiByte=46, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="SpecialNavigationRight_SelectionSubpicture.png") returned 46 [0075.732] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationRight_SelectionSubpicture.png", cchWideChar=46, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 46 [0075.733] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationRight_SelectionSubpicture.png", cchWideChar=46, lpMultiByteStr=0x201c6ec, cbMultiByte=46, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpecialNavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x0) returned 46 [0075.733] WriteFile (in: hFile=0x158, lpBuffer=0x3b46a28*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3b46a28*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0075.733] CharToOemA (in: pSrc="SpecialNavigationRight_SelectionSubpicture.png", pDst=0x201c52c | out: pDst="SpecialNavigationRight_SelectionSubpicture.png") returned 1 [0075.733] WriteFile (in: hFile=0x158, lpBuffer=0x201c52c*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x201c52c*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0075.733] WriteFile (in: hFile=0x158, lpBuffer=0x379ad88*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379ad88*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0075.733] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0075.733] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0075.733] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xcaa [0075.733] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xcaa [0075.733] WriteFile (in: hFile=0x158, lpBuffer=0x3777058*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777058*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0075.733] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0075.733] DeleteFileW (lpFileName="") returned 0 [0075.733] GetLastError () returned 0x3 [0075.733] GetFileAttributesW (lpFileName="") returned 0xffffffff [0075.733] SetLastError (dwErrCode=0x3) [0075.734] FlushFileBuffers (hFile=0x158) returned 1 [0075.736] GetCurrentThreadId () returned 0x970 [0075.736] GetCurrentThreadId () returned 0x970 [0075.736] GetCurrentThreadId () returned 0x970 [0075.736] GetCurrentThreadId () returned 0x970 [0075.736] GetCurrentThreadId () returned 0x970 [0075.736] GetCurrentThreadId () returned 0x970 [0075.736] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xd61 [0075.737] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xd61 [0075.737] SetFilePointer (in: hFile=0x158, lDistanceToMove=3425, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xd61 [0075.737] CloseHandle (hObject=0x158) returned 1 [0075.737] GetCurrentThreadId () returned 0x970 [0075.737] GetCurrentThreadId () returned 0x970 [0075.737] GetCurrentThreadId () returned 0x970 [0075.737] GetCurrentThreadId () returned 0x970 [0075.737] GetCurrentThreadId () returned 0x970 [0075.737] GetCurrentThreadId () returned 0x970 [0075.737] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\Файл зашифрован [SpecialNavigationRight_SelectionSubpicture.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\Файл зашифрован [specialnavigationright_selectionsubpicture.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0075.737] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd61 [0075.737] SetFilePointer (in: hFile=0x158, lDistanceToMove=3297, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xce1 [0075.737] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0075.737] GetFileType (hFile=0x158) returned 0x1 [0075.737] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x17, wMilliseconds=0xf)) [0075.737] GetCurrentThreadId () returned 0x970 [0075.737] GetCurrentThreadId () returned 0x970 [0075.737] GetCurrentThreadId () returned 0x970 [0075.737] GetCurrentThreadId () returned 0x970 [0075.737] GetCurrentThreadId () returned 0x970 [0075.737] GetCurrentThreadId () returned 0x970 [0075.738] GetCurrentThreadId () returned 0x970 [0075.738] GetCurrentThreadId () returned 0x970 [0075.738] GetCurrentThreadId () returned 0x970 [0075.738] GetCurrentThreadId () returned 0x970 [0075.738] GetCurrentThreadId () returned 0x970 [0075.738] GetCurrentThreadId () returned 0x970 [0075.738] GetCurrentThreadId () returned 0x970 [0075.738] GetCurrentThreadId () returned 0x970 [0075.738] GetCurrentThreadId () returned 0x970 [0075.738] GetCurrentThreadId () returned 0x970 [0075.738] GetCurrentThreadId () returned 0x970 [0075.738] GetCurrentThreadId () returned 0x970 [0075.738] GetCurrentThreadId () returned 0x970 [0075.738] GetCurrentThreadId () returned 0x970 [0075.738] GetCurrentThreadId () returned 0x970 [0075.738] GetCurrentThreadId () returned 0x970 [0075.738] GetCurrentThreadId () returned 0x970 [0075.738] GetCurrentThreadId () returned 0x970 [0075.738] GetCurrentThreadId () returned 0x970 [0075.738] GetCurrentThreadId () returned 0x970 [0075.738] GetCurrentThreadId () returned 0x970 [0075.738] GetCurrentThreadId () returned 0x970 [0075.738] GetCurrentThreadId () returned 0x970 [0075.738] GetCurrentThreadId () returned 0x970 [0075.738] GetCurrentThreadId () returned 0x970 [0075.738] GetCurrentThreadId () returned 0x970 [0075.738] GetCurrentThreadId () returned 0x970 [0075.738] GetCurrentThreadId () returned 0x970 [0075.738] GetCurrentThreadId () returned 0x970 [0075.738] GetCurrentThreadId () returned 0x970 [0075.738] GetCurrentThreadId () returned 0x970 [0075.738] GetCurrentThreadId () returned 0x970 [0075.738] GetCurrentThreadId () returned 0x970 [0075.738] GetCurrentThreadId () returned 0x970 [0075.738] GetCurrentThreadId () returned 0x970 [0075.738] GetCurrentThreadId () returned 0x970 [0075.738] GetCurrentThreadId () returned 0x970 [0075.738] GetCurrentThreadId () returned 0x970 [0075.738] GetCurrentThreadId () returned 0x970 [0075.738] GetCurrentThreadId () returned 0x970 [0075.738] GetCurrentThreadId () returned 0x970 [0075.738] GetCurrentThreadId () returned 0x970 [0075.738] GetCurrentThreadId () returned 0x970 [0075.738] GetCurrentThreadId () returned 0x970 [0075.738] GetCurrentThreadId () returned 0x970 [0075.739] GetCurrentThreadId () returned 0x970 [0075.739] GetCurrentThreadId () returned 0x970 [0075.739] GetCurrentThreadId () returned 0x970 [0075.739] GetCurrentThreadId () returned 0x970 [0075.739] GetCurrentThreadId () returned 0x970 [0075.739] GetCurrentThreadId () returned 0x970 [0075.739] GetCurrentThreadId () returned 0x970 [0075.739] GetCurrentThreadId () returned 0x970 [0075.739] GetCurrentThreadId () returned 0x970 [0075.739] GetCurrentThreadId () returned 0x970 [0075.739] GetCurrentThreadId () returned 0x970 [0075.739] GetCurrentThreadId () returned 0x970 [0075.739] GetCurrentThreadId () returned 0x970 [0075.739] GetCurrentThreadId () returned 0x970 [0075.739] GetCurrentThreadId () returned 0x970 [0075.739] GetCurrentThreadId () returned 0x970 [0075.739] GetCurrentThreadId () returned 0x970 [0075.739] GetCurrentThreadId () returned 0x970 [0075.739] GetCurrentThreadId () returned 0x970 [0075.739] GetCurrentThreadId () returned 0x970 [0075.739] GetCurrentThreadId () returned 0x970 [0075.739] GetCurrentThreadId () returned 0x970 [0075.739] GetCurrentThreadId () returned 0x970 [0075.739] GetCurrentThreadId () returned 0x970 [0075.739] GetCurrentThreadId () returned 0x970 [0075.739] GetCurrentThreadId () returned 0x970 [0075.739] GetCurrentThreadId () returned 0x970 [0075.739] GetCurrentThreadId () returned 0x970 [0075.739] GetCurrentThreadId () returned 0x970 [0075.739] GetCurrentThreadId () returned 0x970 [0075.739] GetCurrentThreadId () returned 0x970 [0075.739] GetCurrentThreadId () returned 0x970 [0075.739] GetCurrentThreadId () returned 0x970 [0075.739] GetCurrentThreadId () returned 0x970 [0075.739] GetCurrentThreadId () returned 0x970 [0075.739] GetCurrentThreadId () returned 0x970 [0075.739] GetCurrentThreadId () returned 0x970 [0075.739] GetCurrentThreadId () returned 0x970 [0075.739] GetCurrentThreadId () returned 0x970 [0075.739] GetCurrentThreadId () returned 0x970 [0075.739] GetCurrentThreadId () returned 0x970 [0075.739] GetCurrentThreadId () returned 0x970 [0075.739] GetCurrentThreadId () returned 0x970 [0075.739] GetCurrentThreadId () returned 0x970 [0075.739] GetCurrentThreadId () returned 0x970 [0075.740] GetCurrentThreadId () returned 0x970 [0075.740] GetCurrentThreadId () returned 0x970 [0075.740] GetCurrentThreadId () returned 0x970 [0075.740] GetCurrentThreadId () returned 0x970 [0075.740] GetCurrentThreadId () returned 0x970 [0075.740] GetCurrentThreadId () returned 0x970 [0075.740] GetCurrentThreadId () returned 0x970 [0075.740] GetCurrentThreadId () returned 0x970 [0075.740] GetCurrentThreadId () returned 0x970 [0075.740] GetCurrentThreadId () returned 0x970 [0075.740] GetCurrentThreadId () returned 0x970 [0075.740] GetCurrentThreadId () returned 0x970 [0075.740] GetCurrentThreadId () returned 0x970 [0075.740] GetCurrentThreadId () returned 0x970 [0075.740] GetCurrentThreadId () returned 0x970 [0075.740] GetCurrentThreadId () returned 0x970 [0075.740] GetCurrentThreadId () returned 0x970 [0075.740] GetCurrentThreadId () returned 0x970 [0075.740] GetCurrentThreadId () returned 0x970 [0075.740] GetCurrentThreadId () returned 0x970 [0075.740] GetCurrentThreadId () returned 0x970 [0075.740] GetCurrentThreadId () returned 0x970 [0075.740] GetCurrentThreadId () returned 0x970 [0075.740] GetCurrentThreadId () returned 0x970 [0075.740] GetCurrentThreadId () returned 0x970 [0075.740] GetCurrentThreadId () returned 0x970 [0075.740] GetCurrentThreadId () returned 0x970 [0075.740] GetCurrentThreadId () returned 0x970 [0075.740] GetCurrentThreadId () returned 0x970 [0075.740] GetCurrentThreadId () returned 0x970 [0075.740] GetCurrentThreadId () returned 0x970 [0075.740] GetCurrentThreadId () returned 0x970 [0075.740] GetCurrentThreadId () returned 0x970 [0075.740] GetCurrentThreadId () returned 0x970 [0075.740] GetCurrentThreadId () returned 0x970 [0075.740] GetCurrentThreadId () returned 0x970 [0075.740] GetCurrentThreadId () returned 0x970 [0075.740] GetCurrentThreadId () returned 0x970 [0075.740] GetCurrentThreadId () returned 0x970 [0075.740] GetCurrentThreadId () returned 0x970 [0075.740] GetCurrentThreadId () returned 0x970 [0075.740] GetCurrentThreadId () returned 0x970 [0075.740] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.741] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.741] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a0638, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0075.741] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.741] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.741] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a0638, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0075.741] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.741] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.741] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0075.741] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.741] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.741] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0075.741] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.741] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.741] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a0698, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0075.741] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.741] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.741] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a0698, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0075.741] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.741] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.741] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a0698, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0075.741] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x17, wMilliseconds=0xf)) [0075.741] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wYe)9k7V7YJo##!/M.M@)8Rg}UPJ&#jK", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0075.741] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wYe)9k7V7YJo##!/M.M@)8Rg}UPJ&#jK", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0075.741] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wYe)9k7V7YJo##!/M.M@)8Rg}UPJ&#jK", cchWideChar=32, lpMultiByteStr=0x2006148, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wYe)9k7V7YJo##!/M.M@)8Rg}UPJ&#jK", lpUsedDefaultChar=0x0) returned 32 [0075.741] GetCurrentThreadId () returned 0x970 [0075.741] GetCurrentThreadId () returned 0x970 [0075.741] GetCurrentThreadId () returned 0x970 [0075.741] GetCurrentThreadId () returned 0x970 [0075.741] GetCurrentThreadId () returned 0x970 [0075.741] GetCurrentThreadId () returned 0x970 [0075.749] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0075.749] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0075.749] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3b40cb8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0075.749] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ed948, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0075.749] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ed948, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAHcXKsoz59DEaoVuJMstVdpMJDsuOg7IlrRnTn9HF6n2lASjCq7WynNAvWl9iV4ujcLzO3Use1bSpge8/tNru4X5HNcKRkrjUptakrN94yc1NqTfLHYgILxzPEBCviyYEUmvWoFhkLbApfYkk2atC/9s6PBDwxRwQiOJty6H3lJ7jxogynMQ5DNmhuKTaLVkfwLLGs++mfExrAr3njyz2ZMUqO7+sJndlg==") returned 232 [0075.749] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x17, wMilliseconds=0xf)) [0075.749] GetCurrentThreadId () returned 0x970 [0075.749] GetCurrentThreadId () returned 0x970 [0075.749] GetCurrentThreadId () returned 0x970 [0075.749] GetCurrentThreadId () returned 0x970 [0075.749] GetCurrentThreadId () returned 0x970 [0075.749] GetCurrentThreadId () returned 0x970 [0075.749] GetCurrentThreadId () returned 0x970 [0075.749] GetCurrentThreadId () returned 0x970 [0075.749] GetCurrentThreadId () returned 0x970 [0075.749] GetCurrentThreadId () returned 0x970 [0075.749] GetCurrentThreadId () returned 0x970 [0075.749] GetCurrentThreadId () returned 0x970 [0075.749] GetCurrentThreadId () returned 0x970 [0075.749] GetCurrentThreadId () returned 0x970 [0075.749] GetCurrentThreadId () returned 0x970 [0075.749] GetCurrentThreadId () returned 0x970 [0075.749] GetCurrentThreadId () returned 0x970 [0075.750] GetCurrentThreadId () returned 0x970 [0075.750] GetCurrentThreadId () returned 0x970 [0075.750] GetCurrentThreadId () returned 0x970 [0075.750] GetCurrentThreadId () returned 0x970 [0075.750] GetCurrentThreadId () returned 0x970 [0075.750] GetCurrentThreadId () returned 0x970 [0075.750] GetCurrentThreadId () returned 0x970 [0075.750] GetCurrentThreadId () returned 0x970 [0075.750] GetCurrentThreadId () returned 0x970 [0075.750] GetCurrentThreadId () returned 0x970 [0075.750] GetCurrentThreadId () returned 0x970 [0075.750] GetCurrentThreadId () returned 0x970 [0075.750] GetCurrentThreadId () returned 0x970 [0075.750] GetCurrentThreadId () returned 0x970 [0075.750] GetCurrentThreadId () returned 0x970 [0075.750] GetCurrentThreadId () returned 0x970 [0075.750] GetCurrentThreadId () returned 0x970 [0075.750] GetCurrentThreadId () returned 0x970 [0075.750] GetCurrentThreadId () returned 0x970 [0075.750] GetCurrentThreadId () returned 0x970 [0075.750] GetCurrentThreadId () returned 0x970 [0075.750] GetCurrentThreadId () returned 0x970 [0075.750] GetCurrentThreadId () returned 0x970 [0075.750] GetCurrentThreadId () returned 0x970 [0075.750] GetCurrentThreadId () returned 0x970 [0075.750] GetCurrentThreadId () returned 0x970 [0075.750] GetCurrentThreadId () returned 0x970 [0075.750] GetCurrentThreadId () returned 0x970 [0075.750] GetCurrentThreadId () returned 0x970 [0075.750] GetCurrentThreadId () returned 0x970 [0075.750] GetCurrentThreadId () returned 0x970 [0075.750] GetCurrentThreadId () returned 0x970 [0075.750] GetCurrentThreadId () returned 0x970 [0075.750] GetCurrentThreadId () returned 0x970 [0075.750] GetCurrentThreadId () returned 0x970 [0075.750] GetCurrentThreadId () returned 0x970 [0075.750] GetCurrentThreadId () returned 0x970 [0075.750] GetCurrentThreadId () returned 0x970 [0075.750] GetCurrentThreadId () returned 0x970 [0075.750] GetCurrentThreadId () returned 0x970 [0075.750] GetCurrentThreadId () returned 0x970 [0075.750] GetCurrentThreadId () returned 0x970 [0075.751] GetCurrentThreadId () returned 0x970 [0075.751] GetCurrentThreadId () returned 0x970 [0075.751] GetCurrentThreadId () returned 0x970 [0075.751] GetCurrentThreadId () returned 0x970 [0075.751] GetCurrentThreadId () returned 0x970 [0075.751] GetCurrentThreadId () returned 0x970 [0075.751] GetCurrentThreadId () returned 0x970 [0075.751] GetCurrentThreadId () returned 0x970 [0075.751] GetCurrentThreadId () returned 0x970 [0075.751] GetCurrentThreadId () returned 0x970 [0075.751] GetCurrentThreadId () returned 0x970 [0075.751] GetCurrentThreadId () returned 0x970 [0075.751] GetCurrentThreadId () returned 0x970 [0075.751] GetCurrentThreadId () returned 0x970 [0075.751] GetCurrentThreadId () returned 0x970 [0075.751] GetCurrentThreadId () returned 0x970 [0075.751] GetCurrentThreadId () returned 0x970 [0075.751] GetCurrentThreadId () returned 0x970 [0075.751] GetCurrentThreadId () returned 0x970 [0075.751] GetCurrentThreadId () returned 0x970 [0075.751] GetCurrentThreadId () returned 0x970 [0075.751] GetCurrentThreadId () returned 0x970 [0075.751] GetCurrentThreadId () returned 0x970 [0075.751] GetCurrentThreadId () returned 0x970 [0075.751] GetCurrentThreadId () returned 0x970 [0075.751] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAHcXKsoz59DEaoVuJMstVdpMJDsuOg7IlrRnTn9HF6n2lASjCq7WynNAvWl9iV4ujcLzO3Use1bSpge8/tNru4X5HNcKRkrjUptakrN94yc1NqTfLHYgILxzPEBCviyYEUmvWoFhkLbApfYkk2atC/9s6PBDwxRwQiOJty6H3lJ7jxogynMQ5DNmhuKTaLVkfwLLGs++mfExrAr3njyz2ZMUqO7+sJndlg==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0075.751] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAHcXKsoz59DEaoVuJMstVdpMJDsuOg7IlrRnTn9HF6n2lASjCq7WynNAvWl9iV4ujcLzO3Use1bSpge8/tNru4X5HNcKRkrjUptakrN94yc1NqTfLHYgILxzPEBCviyYEUmvWoFhkLbApfYkk2atC/9s6PBDwxRwQiOJty6H3lJ7jxogynMQ5DNmhuKTaLVkfwLLGs++mfExrAr3njyz2ZMUqO7+sJndlg==", cchWideChar=245, lpMultiByteStr=0x353b75c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAHcXKsoz59DEaoVuJMstVdpMJDsuOg7IlrRnTn9HF6n2lASjCq7WynNAvWl9iV4ujcLzO3Use1bSpge8/tNru4X5HNcKRkrjUptakrN94yc1NqTfLHYgILxzPEBCviyYEUmvWoFhkLbApfYkk2atC/9s6PBDwxRwQiOJty6H3lJ7jxogynMQ5DNmhuKTaLVkfwLLGs++mfExrAr3njyz2ZMUqO7+sJndlg==", lpUsedDefaultChar=0x0) returned 245 [0075.751] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0075.751] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0075.752] CloseHandle (hObject=0x158) returned 1 [0075.752] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_selectionsubpicture.png")) returned 0 [0075.752] GetLastError () returned 0x5 [0075.752] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_selectionsubpicture.png")) returned 0x20 [0075.752] SetLastError (dwErrCode=0x5) [0075.752] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=19601584755) returned 1 [0075.753] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\Файл зашифрован [SpecialNavigationUp_ButtonGraphic.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\Файл зашифрован [specialnavigationup_buttongraphic.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0075.753] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0075.753] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0075.753] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0075.753] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0075.754] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0075.754] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0075.754] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0075.754] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0075.754] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0075.754] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0075.754] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0075.754] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0075.754] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0075.754] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0075.754] SetEndOfFile (hFile=0x158) returned 1 [0075.754] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0075.754] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0075.755] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0075.755] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0075.755] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0075.756] WriteFile (in: hFile=0x158, lpBuffer=0x35f035c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f035c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0075.756] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a>zA\\qM\\G#OTy9*PmBldrOJwh/$>rH4Y", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0075.756] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a>zA\\qM\\G#OTy9*PmBldrOJwh/$>rH4Y", cchWideChar=32, lpMultiByteStr=0x2038e8c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="a>zA\\qM\\G#OTy9*PmBldrOJwh/$>rH4Y", lpUsedDefaultChar=0x0) returned 32 [0075.756] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0075.756] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0075.756] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_ButtonGraphic.png", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f55187a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f55187a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd79845, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1302, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpecialNavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 0x295098 [0075.756] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0075.756] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0075.756] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_buttongraphic.png")) returned 0x20 [0075.757] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_buttongraphic.png")) returned 0x20 [0075.757] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_buttongraphic.png")) returned 0x20 [0075.757] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_buttongraphic.png")) returned 0x20 [0075.757] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_buttongraphic.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f55187a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f55187a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd79845, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1302)) returned 1 [0075.757] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0075.757] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0075.757] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_buttongraphic.png")) returned 0x20 [0075.757] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_buttongraphic.png")) returned 0x20 [0075.757] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0075.757] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0075.757] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0075.758] SetEndOfFile (hFile=0x158) returned 1 [0075.758] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationUp_ButtonGraphic.png", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0075.759] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationUp_ButtonGraphic.png", cchWideChar=37, lpMultiByteStr=0x203920c, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpecialNavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 37 [0075.759] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationUp_ButtonGraphic.png", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0075.759] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationUp_ButtonGraphic.png", cchWideChar=37, lpMultiByteStr=0x2038f34, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpecialNavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 37 [0075.759] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x2038f34, cbMultiByte=37, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="SpecialNavigationUp_ButtonGraphic.pngpngre.png?ǒ弼f๜͝暀䫅?ǒ") returned 37 [0075.759] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationUp_ButtonGraphic.png", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0075.759] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationUp_ButtonGraphic.png", cchWideChar=37, lpMultiByteStr=0x203920c, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpecialNavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 37 [0075.759] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0075.759] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0075.759] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x1302 [0075.760] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0075.760] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0075.760] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0075.760] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationUp_ButtonGraphic.png", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0075.760] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationUp_ButtonGraphic.png", cchWideChar=37, lpMultiByteStr=0x203920c, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpecialNavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 37 [0075.760] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationUp_ButtonGraphic.png", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0075.760] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationUp_ButtonGraphic.png", cchWideChar=37, lpMultiByteStr=0x2038f34, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpecialNavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 37 [0075.760] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x2038f34, cbMultiByte=37, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="SpecialNavigationUp_ButtonGraphic.pngic.pngpngre.png?ǒ弼f๜͝暀䫅?ǒ") returned 37 [0075.760] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationUp_ButtonGraphic.png", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0075.760] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationUp_ButtonGraphic.png", cchWideChar=37, lpMultiByteStr=0x203920c, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpecialNavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 37 [0075.760] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0075.761] CharToOemA (in: pSrc="SpecialNavigationUp_ButtonGraphic.png", pDst=0x2038f34 | out: pDst="SpecialNavigationUp_ButtonGraphic.png") returned 1 [0075.761] WriteFile (in: hFile=0x158, lpBuffer=0x2038f34*, nNumberOfBytesToWrite=0x25, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x2038f34*, lpNumberOfBytesWritten=0x18e048*=0x25, lpOverlapped=0x0) returned 1 [0075.761] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0075.762] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0075.762] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0075.762] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=19602530442) returned 1 [0075.762] ReadFile (in: hFile=0x11c, lpBuffer=0x3b62f50, nNumberOfBytesToRead=0x1302, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b62f50*, lpNumberOfBytesRead=0x18dd7c*=0x1302, lpOverlapped=0x0) returned 1 [0075.764] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0075.764] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=19602710529) returned 1 [0075.775] WriteFile (in: hFile=0x158, lpBuffer=0x379ad20*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379ad20*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0075.775] ReadFile (in: hFile=0x11c, lpBuffer=0x3b62f50, nNumberOfBytesToRead=0x1302, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3b62f50*, lpNumberOfBytesRead=0x18de38*=0x1302, lpOverlapped=0x0) returned 1 [0075.775] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x60 [0075.775] WriteFile (in: hFile=0x158, lpBuffer=0x3b95a40*, nNumberOfBytesToWrite=0x1302, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3b95a40*, lpNumberOfBytesWritten=0x18de10*=0x1302, lpOverlapped=0x0) returned 1 [0075.776] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x1362 [0075.776] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0075.776] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0075.776] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0075.776] SetFilePointer (in: hFile=0x158, lDistanceToMove=37, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x43 [0075.776] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x136c [0075.776] CloseHandle (hObject=0x11c) returned 1 [0075.776] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x136c [0075.776] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x136c [0075.777] SetFilePointer (in: hFile=0x158, lDistanceToMove=4972, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x136c [0075.777] SetFilePointer (in: hFile=0x158, lDistanceToMove=4972, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x136c [0075.777] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x136c [0075.777] SetFilePointer (in: hFile=0x158, lDistanceToMove=4972, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x136c [0075.777] SetEndOfFile (hFile=0x158) returned 1 [0075.777] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x136c [0075.777] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x136c [0075.777] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationUp_ButtonGraphic.png", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0075.777] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationUp_ButtonGraphic.png", cchWideChar=37, lpMultiByteStr=0x2038f34, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpecialNavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 37 [0075.777] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationUp_ButtonGraphic.png", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0075.777] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationUp_ButtonGraphic.png", cchWideChar=37, lpMultiByteStr=0x203920c, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpecialNavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 37 [0075.777] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x203920c, cbMultiByte=37, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="SpecialNavigationUp_ButtonGraphic.png") returned 37 [0075.777] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationUp_ButtonGraphic.png", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0075.778] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationUp_ButtonGraphic.png", cchWideChar=37, lpMultiByteStr=0x2038f34, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpecialNavigationUp_ButtonGraphic.png", lpUsedDefaultChar=0x0) returned 37 [0075.778] WriteFile (in: hFile=0x158, lpBuffer=0x3b46a28*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3b46a28*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0075.778] CharToOemA (in: pSrc="SpecialNavigationUp_ButtonGraphic.png", pDst=0x203920c | out: pDst="SpecialNavigationUp_ButtonGraphic.png") returned 1 [0075.778] WriteFile (in: hFile=0x158, lpBuffer=0x203920c*, nNumberOfBytesToWrite=0x25, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x203920c*, lpNumberOfBytesWritten=0x18efcc*=0x25, lpOverlapped=0x0) returned 1 [0075.778] WriteFile (in: hFile=0x158, lpBuffer=0x379ade8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379ade8*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0075.778] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0075.778] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0075.778] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x13ca [0075.778] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x13ca [0075.778] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0075.779] WriteFile (in: hFile=0x158, lpBuffer=0x35f035c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f035c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0075.779] DeleteFileW (lpFileName="") returned 0 [0075.779] GetLastError () returned 0x3 [0075.779] GetFileAttributesW (lpFileName="") returned 0xffffffff [0075.779] SetLastError (dwErrCode=0x3) [0075.779] FlushFileBuffers (hFile=0x158) returned 1 [0075.782] GetCurrentThreadId () returned 0x970 [0075.782] GetCurrentThreadId () returned 0x970 [0075.782] GetCurrentThreadId () returned 0x970 [0075.782] GetCurrentThreadId () returned 0x970 [0075.783] GetCurrentThreadId () returned 0x970 [0075.783] GetCurrentThreadId () returned 0x970 [0075.783] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x1481 [0075.783] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x1481 [0075.783] SetFilePointer (in: hFile=0x158, lDistanceToMove=5249, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x1481 [0075.783] CloseHandle (hObject=0x158) returned 1 [0075.783] GetCurrentThreadId () returned 0x970 [0075.783] GetCurrentThreadId () returned 0x970 [0075.783] GetCurrentThreadId () returned 0x970 [0075.783] GetCurrentThreadId () returned 0x970 [0075.783] GetCurrentThreadId () returned 0x970 [0075.783] GetCurrentThreadId () returned 0x970 [0075.783] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\Файл зашифрован [SpecialNavigationUp_ButtonGraphic.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\Файл зашифрован [specialnavigationup_buttongraphic.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0075.784] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1481 [0075.784] SetFilePointer (in: hFile=0x158, lDistanceToMove=5121, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1401 [0075.784] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0075.784] GetFileType (hFile=0x158) returned 0x1 [0075.784] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x17, wMilliseconds=0x3e)) [0075.784] GetCurrentThreadId () returned 0x970 [0075.784] GetCurrentThreadId () returned 0x970 [0075.784] GetCurrentThreadId () returned 0x970 [0075.784] GetCurrentThreadId () returned 0x970 [0075.784] GetCurrentThreadId () returned 0x970 [0075.784] GetCurrentThreadId () returned 0x970 [0075.784] GetCurrentThreadId () returned 0x970 [0075.784] GetCurrentThreadId () returned 0x970 [0075.784] GetCurrentThreadId () returned 0x970 [0075.784] GetCurrentThreadId () returned 0x970 [0075.784] GetCurrentThreadId () returned 0x970 [0075.784] GetCurrentThreadId () returned 0x970 [0075.784] GetCurrentThreadId () returned 0x970 [0075.784] GetCurrentThreadId () returned 0x970 [0075.784] GetCurrentThreadId () returned 0x970 [0075.784] GetCurrentThreadId () returned 0x970 [0075.784] GetCurrentThreadId () returned 0x970 [0075.784] GetCurrentThreadId () returned 0x970 [0075.784] GetCurrentThreadId () returned 0x970 [0075.784] GetCurrentThreadId () returned 0x970 [0075.784] GetCurrentThreadId () returned 0x970 [0075.784] GetCurrentThreadId () returned 0x970 [0075.784] GetCurrentThreadId () returned 0x970 [0075.784] GetCurrentThreadId () returned 0x970 [0075.785] GetCurrentThreadId () returned 0x970 [0075.785] GetCurrentThreadId () returned 0x970 [0075.785] GetCurrentThreadId () returned 0x970 [0075.785] GetCurrentThreadId () returned 0x970 [0075.785] GetCurrentThreadId () returned 0x970 [0075.785] GetCurrentThreadId () returned 0x970 [0075.785] GetCurrentThreadId () returned 0x970 [0075.785] GetCurrentThreadId () returned 0x970 [0075.785] GetCurrentThreadId () returned 0x970 [0075.785] GetCurrentThreadId () returned 0x970 [0075.785] GetCurrentThreadId () returned 0x970 [0075.785] GetCurrentThreadId () returned 0x970 [0075.785] GetCurrentThreadId () returned 0x970 [0075.785] GetCurrentThreadId () returned 0x970 [0075.785] GetCurrentThreadId () returned 0x970 [0075.785] GetCurrentThreadId () returned 0x970 [0075.785] GetCurrentThreadId () returned 0x970 [0075.785] GetCurrentThreadId () returned 0x970 [0075.785] GetCurrentThreadId () returned 0x970 [0075.785] GetCurrentThreadId () returned 0x970 [0075.785] GetCurrentThreadId () returned 0x970 [0075.785] GetCurrentThreadId () returned 0x970 [0075.785] GetCurrentThreadId () returned 0x970 [0075.785] GetCurrentThreadId () returned 0x970 [0075.785] GetCurrentThreadId () returned 0x970 [0075.785] GetCurrentThreadId () returned 0x970 [0075.785] GetCurrentThreadId () returned 0x970 [0075.785] GetCurrentThreadId () returned 0x970 [0075.785] GetCurrentThreadId () returned 0x970 [0075.785] GetCurrentThreadId () returned 0x970 [0075.785] GetCurrentThreadId () returned 0x970 [0075.785] GetCurrentThreadId () returned 0x970 [0075.785] GetCurrentThreadId () returned 0x970 [0075.785] GetCurrentThreadId () returned 0x970 [0075.785] GetCurrentThreadId () returned 0x970 [0075.785] GetCurrentThreadId () returned 0x970 [0075.786] GetCurrentThreadId () returned 0x970 [0075.786] GetCurrentThreadId () returned 0x970 [0075.786] GetCurrentThreadId () returned 0x970 [0075.786] GetCurrentThreadId () returned 0x970 [0075.786] GetCurrentThreadId () returned 0x970 [0075.786] GetCurrentThreadId () returned 0x970 [0075.786] GetCurrentThreadId () returned 0x970 [0075.786] GetCurrentThreadId () returned 0x970 [0075.786] GetCurrentThreadId () returned 0x970 [0075.786] GetCurrentThreadId () returned 0x970 [0075.786] GetCurrentThreadId () returned 0x970 [0075.786] GetCurrentThreadId () returned 0x970 [0075.786] GetCurrentThreadId () returned 0x970 [0075.786] GetCurrentThreadId () returned 0x970 [0075.786] GetCurrentThreadId () returned 0x970 [0075.786] GetCurrentThreadId () returned 0x970 [0075.786] GetCurrentThreadId () returned 0x970 [0075.786] GetCurrentThreadId () returned 0x970 [0075.786] GetCurrentThreadId () returned 0x970 [0075.786] GetCurrentThreadId () returned 0x970 [0075.786] GetCurrentThreadId () returned 0x970 [0075.786] GetCurrentThreadId () returned 0x970 [0075.786] GetCurrentThreadId () returned 0x970 [0075.786] GetCurrentThreadId () returned 0x970 [0075.786] GetCurrentThreadId () returned 0x970 [0075.786] GetCurrentThreadId () returned 0x970 [0075.786] GetCurrentThreadId () returned 0x970 [0075.786] GetCurrentThreadId () returned 0x970 [0075.786] GetCurrentThreadId () returned 0x970 [0075.786] GetCurrentThreadId () returned 0x970 [0075.786] GetCurrentThreadId () returned 0x970 [0075.786] GetCurrentThreadId () returned 0x970 [0075.786] GetCurrentThreadId () returned 0x970 [0075.786] GetCurrentThreadId () returned 0x970 [0075.786] GetCurrentThreadId () returned 0x970 [0075.786] GetCurrentThreadId () returned 0x970 [0075.787] GetCurrentThreadId () returned 0x970 [0075.787] GetCurrentThreadId () returned 0x970 [0075.787] GetCurrentThreadId () returned 0x970 [0075.787] GetCurrentThreadId () returned 0x970 [0075.787] GetCurrentThreadId () returned 0x970 [0075.787] GetCurrentThreadId () returned 0x970 [0075.787] GetCurrentThreadId () returned 0x970 [0075.787] GetCurrentThreadId () returned 0x970 [0075.787] GetCurrentThreadId () returned 0x970 [0075.787] GetCurrentThreadId () returned 0x970 [0075.787] GetCurrentThreadId () returned 0x970 [0075.787] GetCurrentThreadId () returned 0x970 [0075.787] GetCurrentThreadId () returned 0x970 [0075.787] GetCurrentThreadId () returned 0x970 [0075.787] GetCurrentThreadId () returned 0x970 [0075.787] GetCurrentThreadId () returned 0x970 [0075.787] GetCurrentThreadId () returned 0x970 [0075.787] GetCurrentThreadId () returned 0x970 [0075.787] GetCurrentThreadId () returned 0x970 [0075.787] GetCurrentThreadId () returned 0x970 [0075.787] GetCurrentThreadId () returned 0x970 [0075.787] GetCurrentThreadId () returned 0x970 [0075.787] GetCurrentThreadId () returned 0x970 [0075.787] GetCurrentThreadId () returned 0x970 [0075.787] GetCurrentThreadId () returned 0x970 [0075.787] GetCurrentThreadId () returned 0x970 [0075.787] GetCurrentThreadId () returned 0x970 [0075.787] GetCurrentThreadId () returned 0x970 [0075.787] GetCurrentThreadId () returned 0x970 [0075.787] GetCurrentThreadId () returned 0x970 [0075.787] GetCurrentThreadId () returned 0x970 [0075.787] GetCurrentThreadId () returned 0x970 [0075.787] GetCurrentThreadId () returned 0x970 [0075.787] GetCurrentThreadId () returned 0x970 [0075.787] GetCurrentThreadId () returned 0x970 [0075.787] GetCurrentThreadId () returned 0x970 [0075.788] GetCurrentThreadId () returned 0x970 [0075.788] GetCurrentThreadId () returned 0x970 [0075.788] GetCurrentThreadId () returned 0x970 [0075.788] GetCurrentThreadId () returned 0x970 [0075.788] GetCurrentThreadId () returned 0x970 [0075.788] GetCurrentThreadId () returned 0x970 [0075.788] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.788] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.788] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a0698, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0075.788] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.788] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.788] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a0698, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0075.788] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.788] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.788] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0075.788] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.788] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.788] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0075.788] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.788] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.788] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a06f8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0075.788] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.788] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.788] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a06f8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0075.788] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.788] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.788] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a06f8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0075.789] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x17, wMilliseconds=0x3e)) [0075.789] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="a>zA\\qM\\G#OTy9*PmBldrOJwh/$>rH4Y", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0075.789] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="a>zA\\qM\\G#OTy9*PmBldrOJwh/$>rH4Y", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0075.789] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="a>zA\\qM\\G#OTy9*PmBldrOJwh/$>rH4Y", cchWideChar=32, lpMultiByteStr=0x2006178, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="a>zA\\qM\\G#OTy9*PmBldrOJwh/$>rH4Y", lpUsedDefaultChar=0x0) returned 32 [0075.789] GetCurrentThreadId () returned 0x970 [0075.789] GetCurrentThreadId () returned 0x970 [0075.789] GetCurrentThreadId () returned 0x970 [0075.789] GetCurrentThreadId () returned 0x970 [0075.789] GetCurrentThreadId () returned 0x970 [0075.789] GetCurrentThreadId () returned 0x970 [0075.799] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0075.799] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0075.799] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3b40da8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0075.799] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ed948, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0075.799] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ed948, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAD/LHxSsqBSIDEYwKvzv4k+8NiwUvNvuVQm9lfG9fnXR35aSGlMqulkI6bD5ln7oAsJ78t1AuxJzwI9biGk9qcMfhpjkj4Yc2ms3wgYfc5JSnB3HL61d/6rWQs6ZUQolOnfJCBkw6KqWWdkWOZHvaKiqy6fRPD7qRn9q/aOPXU0U+8Aqn0d0NZWuv2hzevHQZhUZSJWG77cvE0GhgzeYERVAx7JlImdkgg==") returned 232 [0075.799] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x17, wMilliseconds=0x4e)) [0075.799] GetCurrentThreadId () returned 0x970 [0075.799] GetCurrentThreadId () returned 0x970 [0075.799] GetCurrentThreadId () returned 0x970 [0075.799] GetCurrentThreadId () returned 0x970 [0075.799] GetCurrentThreadId () returned 0x970 [0075.799] GetCurrentThreadId () returned 0x970 [0075.799] GetCurrentThreadId () returned 0x970 [0075.799] GetCurrentThreadId () returned 0x970 [0075.799] GetCurrentThreadId () returned 0x970 [0075.799] GetCurrentThreadId () returned 0x970 [0075.799] GetCurrentThreadId () returned 0x970 [0075.799] GetCurrentThreadId () returned 0x970 [0075.799] GetCurrentThreadId () returned 0x970 [0075.799] GetCurrentThreadId () returned 0x970 [0075.799] GetCurrentThreadId () returned 0x970 [0075.799] GetCurrentThreadId () returned 0x970 [0075.799] GetCurrentThreadId () returned 0x970 [0075.799] GetCurrentThreadId () returned 0x970 [0075.799] GetCurrentThreadId () returned 0x970 [0075.799] GetCurrentThreadId () returned 0x970 [0075.799] GetCurrentThreadId () returned 0x970 [0075.799] GetCurrentThreadId () returned 0x970 [0075.799] GetCurrentThreadId () returned 0x970 [0075.799] GetCurrentThreadId () returned 0x970 [0075.800] GetCurrentThreadId () returned 0x970 [0075.800] GetCurrentThreadId () returned 0x970 [0075.800] GetCurrentThreadId () returned 0x970 [0075.800] GetCurrentThreadId () returned 0x970 [0075.800] GetCurrentThreadId () returned 0x970 [0075.800] GetCurrentThreadId () returned 0x970 [0075.800] GetCurrentThreadId () returned 0x970 [0075.800] GetCurrentThreadId () returned 0x970 [0075.800] GetCurrentThreadId () returned 0x970 [0075.800] GetCurrentThreadId () returned 0x970 [0075.800] GetCurrentThreadId () returned 0x970 [0075.800] GetCurrentThreadId () returned 0x970 [0075.800] GetCurrentThreadId () returned 0x970 [0075.800] GetCurrentThreadId () returned 0x970 [0075.800] GetCurrentThreadId () returned 0x970 [0075.800] GetCurrentThreadId () returned 0x970 [0075.800] GetCurrentThreadId () returned 0x970 [0075.800] GetCurrentThreadId () returned 0x970 [0075.800] GetCurrentThreadId () returned 0x970 [0075.800] GetCurrentThreadId () returned 0x970 [0075.800] GetCurrentThreadId () returned 0x970 [0075.800] GetCurrentThreadId () returned 0x970 [0075.800] GetCurrentThreadId () returned 0x970 [0075.800] GetCurrentThreadId () returned 0x970 [0075.800] GetCurrentThreadId () returned 0x970 [0075.800] GetCurrentThreadId () returned 0x970 [0075.800] GetCurrentThreadId () returned 0x970 [0075.800] GetCurrentThreadId () returned 0x970 [0075.800] GetCurrentThreadId () returned 0x970 [0075.800] GetCurrentThreadId () returned 0x970 [0075.800] GetCurrentThreadId () returned 0x970 [0075.800] GetCurrentThreadId () returned 0x970 [0075.800] GetCurrentThreadId () returned 0x970 [0075.800] GetCurrentThreadId () returned 0x970 [0075.800] GetCurrentThreadId () returned 0x970 [0075.800] GetCurrentThreadId () returned 0x970 [0075.801] GetCurrentThreadId () returned 0x970 [0075.801] GetCurrentThreadId () returned 0x970 [0075.801] GetCurrentThreadId () returned 0x970 [0075.801] GetCurrentThreadId () returned 0x970 [0075.801] GetCurrentThreadId () returned 0x970 [0075.801] GetCurrentThreadId () returned 0x970 [0075.801] GetCurrentThreadId () returned 0x970 [0075.801] GetCurrentThreadId () returned 0x970 [0075.801] GetCurrentThreadId () returned 0x970 [0075.801] GetCurrentThreadId () returned 0x970 [0075.801] GetCurrentThreadId () returned 0x970 [0075.801] GetCurrentThreadId () returned 0x970 [0075.801] GetCurrentThreadId () returned 0x970 [0075.801] GetCurrentThreadId () returned 0x970 [0075.801] GetCurrentThreadId () returned 0x970 [0075.801] GetCurrentThreadId () returned 0x970 [0075.801] GetCurrentThreadId () returned 0x970 [0075.801] GetCurrentThreadId () returned 0x970 [0075.801] GetCurrentThreadId () returned 0x970 [0075.801] GetCurrentThreadId () returned 0x970 [0075.801] GetCurrentThreadId () returned 0x970 [0075.801] GetCurrentThreadId () returned 0x970 [0075.801] GetCurrentThreadId () returned 0x970 [0075.801] GetCurrentThreadId () returned 0x970 [0075.801] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAD/LHxSsqBSIDEYwKvzv4k+8NiwUvNvuVQm9lfG9fnXR35aSGlMqulkI6bD5ln7oAsJ78t1AuxJzwI9biGk9qcMfhpjkj4Yc2ms3wgYfc5JSnB3HL61d/6rWQs6ZUQolOnfJCBkw6KqWWdkWOZHvaKiqy6fRPD7qRn9q/aOPXU0U+8Aqn0d0NZWuv2hzevHQZhUZSJWG77cvE0GhgzeYERVAx7JlImdkgg==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0075.801] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAD/LHxSsqBSIDEYwKvzv4k+8NiwUvNvuVQm9lfG9fnXR35aSGlMqulkI6bD5ln7oAsJ78t1AuxJzwI9biGk9qcMfhpjkj4Yc2ms3wgYfc5JSnB3HL61d/6rWQs6ZUQolOnfJCBkw6KqWWdkWOZHvaKiqy6fRPD7qRn9q/aOPXU0U+8Aqn0d0NZWuv2hzevHQZhUZSJWG77cvE0GhgzeYERVAx7JlImdkgg==", cchWideChar=245, lpMultiByteStr=0x353b75c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAD/LHxSsqBSIDEYwKvzv4k+8NiwUvNvuVQm9lfG9fnXR35aSGlMqulkI6bD5ln7oAsJ78t1AuxJzwI9biGk9qcMfhpjkj4Yc2ms3wgYfc5JSnB3HL61d/6rWQs6ZUQolOnfJCBkw6KqWWdkWOZHvaKiqy6fRPD7qRn9q/aOPXU0U+8Aqn0d0NZWuv2hzevHQZhUZSJWG77cvE0GhgzeYERVAx7JlImdkgg==", lpUsedDefaultChar=0x0) returned 245 [0075.801] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0075.802] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0075.802] CloseHandle (hObject=0x158) returned 1 [0075.802] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_buttongraphic.png")) returned 0 [0075.802] GetLastError () returned 0x5 [0075.802] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_buttongraphic.png")) returned 0x20 [0075.802] SetLastError (dwErrCode=0x5) [0075.802] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=19606578213) returned 1 [0075.802] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\Файл зашифрован [SpecialNavigationUp_SelectionSubpicture.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\Файл зашифрован [specialnavigationup_selectionsubpicture.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0075.803] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0075.803] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0075.803] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0075.803] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0075.803] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0075.804] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0075.804] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0075.804] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0075.804] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0075.804] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0075.804] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0075.804] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0075.804] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0075.804] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0075.804] SetEndOfFile (hFile=0x158) returned 1 [0075.804] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0075.804] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0075.805] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0075.805] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0075.805] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0075.806] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0075.806] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="~tWoLjwx+u:U@z%Inwrso,oWu)yA{", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0077.347] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="D\"n^ZFo#{/>+u:U@z%Inwrso,oWu)yA{", cchWideChar=32, lpMultiByteStr=0x20399ec, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D\"n^ZFo#{/>+u:U@z%Inwrso,oWu)yA{", lpUsedDefaultChar=0x0) returned 32 [0077.347] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0077.347] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0077.347] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7268fbb9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7268fbb9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x553e929b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x20d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-previous-static.png", cAlternateFileName="")) returned 0x295098 [0077.347] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0077.347] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0077.347] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-previous-static.png")) returned 0x20 [0077.348] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-previous-static.png")) returned 0x20 [0077.348] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-previous-static.png")) returned 0x20 [0077.348] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-previous-static.png")) returned 0x20 [0077.348] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-previous-static.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7268fbb9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7268fbb9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x553e929b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x20d6)) returned 1 [0077.348] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0077.348] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0077.348] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-previous-static.png")) returned 0x20 [0077.348] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-previous-static.png")) returned 0x20 [0077.348] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0077.348] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0077.348] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0077.348] SetEndOfFile (hFile=0x158) returned 1 [0077.349] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="btn-previous-static.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0077.350] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="btn-previous-static.png", cchWideChar=23, lpMultiByteStr=0x1ff89c4, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn-previous-static.png", lpUsedDefaultChar=0x0) returned 23 [0077.350] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="btn-previous-static.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0077.350] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="btn-previous-static.png", cchWideChar=23, lpMultiByteStr=0x1ff894c, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn-previous-static.png", lpUsedDefaultChar=0x0) returned 23 [0077.350] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff894c, cbMultiByte=23, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="btn-previous-static.pngpng.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 23 [0077.350] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="btn-previous-static.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0077.350] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="btn-previous-static.png", cchWideChar=23, lpMultiByteStr=0x1ff89c4, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn-previous-static.png", lpUsedDefaultChar=0x0) returned 23 [0077.350] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-previous-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0077.350] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0077.351] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x20d6 [0077.351] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0077.351] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0077.351] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0077.351] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="btn-previous-static.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0077.351] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="btn-previous-static.png", cchWideChar=23, lpMultiByteStr=0x1ff89c4, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn-previous-static.png", lpUsedDefaultChar=0x0) returned 23 [0077.351] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="btn-previous-static.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0077.351] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="btn-previous-static.png", cchWideChar=23, lpMultiByteStr=0x1ff894c, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn-previous-static.png", lpUsedDefaultChar=0x0) returned 23 [0077.351] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff894c, cbMultiByte=23, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="btn-previous-static.pngic.pngpng.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 23 [0077.351] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="btn-previous-static.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0077.351] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="btn-previous-static.png", cchWideChar=23, lpMultiByteStr=0x1ff89c4, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn-previous-static.png", lpUsedDefaultChar=0x0) returned 23 [0077.351] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0077.352] CharToOemA (in: pSrc="btn-previous-static.png", pDst=0x1ff894c | out: pDst="btn-previous-static.png") returned 1 [0077.352] WriteFile (in: hFile=0x158, lpBuffer=0x1ff894c*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1ff894c*, lpNumberOfBytesWritten=0x18e048*=0x17, lpOverlapped=0x0) returned 1 [0077.352] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0077.352] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0077.352] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0077.353] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=19761599245) returned 1 [0077.353] ReadFile (in: hFile=0x11c, lpBuffer=0x3b714b0, nNumberOfBytesToRead=0x20d6, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b714b0*, lpNumberOfBytesRead=0x18dd7c*=0x20d6, lpOverlapped=0x0) returned 1 [0077.354] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0077.354] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=19761755080) returned 1 [0077.364] WriteFile (in: hFile=0x158, lpBuffer=0x379adb0*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379adb0*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0077.365] ReadFile (in: hFile=0x11c, lpBuffer=0x3b714b0, nNumberOfBytesToRead=0x20d6, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3b714b0*, lpNumberOfBytesRead=0x18de38*=0x20d6, lpOverlapped=0x0) returned 1 [0077.365] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x52 [0077.365] WriteFile (in: hFile=0x158, lpBuffer=0x3b94d70*, nNumberOfBytesToWrite=0x20d6, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3b94d70*, lpNumberOfBytesWritten=0x18de10*=0x20d6, lpOverlapped=0x0) returned 1 [0077.366] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x2128 [0077.366] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0077.366] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0077.366] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0077.366] SetFilePointer (in: hFile=0x158, lDistanceToMove=23, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x35 [0077.366] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x2132 [0077.366] CloseHandle (hObject=0x11c) returned 1 [0077.366] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x2132 [0077.366] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x2132 [0077.366] SetFilePointer (in: hFile=0x158, lDistanceToMove=8498, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x2132 [0077.366] SetFilePointer (in: hFile=0x158, lDistanceToMove=8498, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x2132 [0077.366] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x2132 [0077.367] SetFilePointer (in: hFile=0x158, lDistanceToMove=8498, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x2132 [0077.367] SetEndOfFile (hFile=0x158) returned 1 [0077.367] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x2132 [0077.367] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x2132 [0077.367] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="btn-previous-static.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0077.367] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="btn-previous-static.png", cchWideChar=23, lpMultiByteStr=0x1ff894c, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn-previous-static.png", lpUsedDefaultChar=0x0) returned 23 [0077.367] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="btn-previous-static.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0077.367] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="btn-previous-static.png", cchWideChar=23, lpMultiByteStr=0x1ff89c4, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn-previous-static.png", lpUsedDefaultChar=0x0) returned 23 [0077.367] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff89c4, cbMultiByte=23, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="btn-previous-static.pngĀ䭐ȁ\x14\x14\x01c䃑㫋Ꙣ礎⃲") returned 23 [0077.367] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="btn-previous-static.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0077.367] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="btn-previous-static.png", cchWideChar=23, lpMultiByteStr=0x1ff894c, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="btn-previous-static.png", lpUsedDefaultChar=0x0) returned 23 [0077.367] WriteFile (in: hFile=0x158, lpBuffer=0x3b54f88*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3b54f88*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0077.367] CharToOemA (in: pSrc="btn-previous-static.png", pDst=0x1ff89c4 | out: pDst="btn-previous-static.png") returned 1 [0077.367] WriteFile (in: hFile=0x158, lpBuffer=0x1ff89c4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1ff89c4*, lpNumberOfBytesWritten=0x18efcc*=0x17, lpOverlapped=0x0) returned 1 [0077.367] WriteFile (in: hFile=0x158, lpBuffer=0x379ade8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379ade8*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0077.368] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0077.368] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0077.368] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x2182 [0077.368] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x2182 [0077.368] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0077.368] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0077.368] DeleteFileW (lpFileName="") returned 0 [0077.368] GetLastError () returned 0x3 [0077.368] GetFileAttributesW (lpFileName="") returned 0xffffffff [0077.368] SetLastError (dwErrCode=0x3) [0077.368] FlushFileBuffers (hFile=0x158) returned 1 [0077.375] GetCurrentThreadId () returned 0x970 [0077.375] GetCurrentThreadId () returned 0x970 [0077.375] GetCurrentThreadId () returned 0x970 [0077.375] GetCurrentThreadId () returned 0x970 [0077.376] GetCurrentThreadId () returned 0x970 [0077.376] GetCurrentThreadId () returned 0x970 [0077.376] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x2239 [0077.376] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x2239 [0077.376] SetFilePointer (in: hFile=0x158, lDistanceToMove=8761, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x2239 [0077.376] CloseHandle (hObject=0x158) returned 1 [0077.376] GetCurrentThreadId () returned 0x970 [0077.376] GetCurrentThreadId () returned 0x970 [0077.376] GetCurrentThreadId () returned 0x970 [0077.376] GetCurrentThreadId () returned 0x970 [0077.376] GetCurrentThreadId () returned 0x970 [0077.376] GetCurrentThreadId () returned 0x970 [0077.376] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Файл зашифрован [btn-previous-static.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\Файл зашифрован [btn-previous-static.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0077.376] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2239 [0077.377] SetFilePointer (in: hFile=0x158, lDistanceToMove=8633, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x21b9 [0077.377] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0077.377] GetFileType (hFile=0x158) returned 0x1 [0077.377] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x18, wMilliseconds=0x28d)) [0077.377] GetCurrentThreadId () returned 0x970 [0077.377] GetCurrentThreadId () returned 0x970 [0077.377] GetCurrentThreadId () returned 0x970 [0077.377] GetCurrentThreadId () returned 0x970 [0077.377] GetCurrentThreadId () returned 0x970 [0077.377] GetCurrentThreadId () returned 0x970 [0077.377] GetCurrentThreadId () returned 0x970 [0077.377] GetCurrentThreadId () returned 0x970 [0077.377] GetCurrentThreadId () returned 0x970 [0077.377] GetCurrentThreadId () returned 0x970 [0077.377] GetCurrentThreadId () returned 0x970 [0077.377] GetCurrentThreadId () returned 0x970 [0077.377] GetCurrentThreadId () returned 0x970 [0077.377] GetCurrentThreadId () returned 0x970 [0077.377] GetCurrentThreadId () returned 0x970 [0077.377] GetCurrentThreadId () returned 0x970 [0077.377] GetCurrentThreadId () returned 0x970 [0077.377] GetCurrentThreadId () returned 0x970 [0077.377] GetCurrentThreadId () returned 0x970 [0077.377] GetCurrentThreadId () returned 0x970 [0077.377] GetCurrentThreadId () returned 0x970 [0077.377] GetCurrentThreadId () returned 0x970 [0077.377] GetCurrentThreadId () returned 0x970 [0077.377] GetCurrentThreadId () returned 0x970 [0077.377] GetCurrentThreadId () returned 0x970 [0077.377] GetCurrentThreadId () returned 0x970 [0077.378] GetCurrentThreadId () returned 0x970 [0077.378] GetCurrentThreadId () returned 0x970 [0077.378] GetCurrentThreadId () returned 0x970 [0077.378] GetCurrentThreadId () returned 0x970 [0077.378] GetCurrentThreadId () returned 0x970 [0077.378] GetCurrentThreadId () returned 0x970 [0077.378] GetCurrentThreadId () returned 0x970 [0077.378] GetCurrentThreadId () returned 0x970 [0077.378] GetCurrentThreadId () returned 0x970 [0077.378] GetCurrentThreadId () returned 0x970 [0077.378] GetCurrentThreadId () returned 0x970 [0077.378] GetCurrentThreadId () returned 0x970 [0077.378] GetCurrentThreadId () returned 0x970 [0077.378] GetCurrentThreadId () returned 0x970 [0077.378] GetCurrentThreadId () returned 0x970 [0077.378] GetCurrentThreadId () returned 0x970 [0077.378] GetCurrentThreadId () returned 0x970 [0077.378] GetCurrentThreadId () returned 0x970 [0077.378] GetCurrentThreadId () returned 0x970 [0077.378] GetCurrentThreadId () returned 0x970 [0077.378] GetCurrentThreadId () returned 0x970 [0077.378] GetCurrentThreadId () returned 0x970 [0077.378] GetCurrentThreadId () returned 0x970 [0077.378] GetCurrentThreadId () returned 0x970 [0077.378] GetCurrentThreadId () returned 0x970 [0077.378] GetCurrentThreadId () returned 0x970 [0077.378] GetCurrentThreadId () returned 0x970 [0077.378] GetCurrentThreadId () returned 0x970 [0077.378] GetCurrentThreadId () returned 0x970 [0077.378] GetCurrentThreadId () returned 0x970 [0077.378] GetCurrentThreadId () returned 0x970 [0077.378] GetCurrentThreadId () returned 0x970 [0077.378] GetCurrentThreadId () returned 0x970 [0077.378] GetCurrentThreadId () returned 0x970 [0077.378] GetCurrentThreadId () returned 0x970 [0077.378] GetCurrentThreadId () returned 0x970 [0077.378] GetCurrentThreadId () returned 0x970 [0077.379] GetCurrentThreadId () returned 0x970 [0077.379] GetCurrentThreadId () returned 0x970 [0077.379] GetCurrentThreadId () returned 0x970 [0077.379] GetCurrentThreadId () returned 0x970 [0077.379] GetCurrentThreadId () returned 0x970 [0077.379] GetCurrentThreadId () returned 0x970 [0077.379] GetCurrentThreadId () returned 0x970 [0077.379] GetCurrentThreadId () returned 0x970 [0077.379] GetCurrentThreadId () returned 0x970 [0077.379] GetCurrentThreadId () returned 0x970 [0077.379] GetCurrentThreadId () returned 0x970 [0077.379] GetCurrentThreadId () returned 0x970 [0077.379] GetCurrentThreadId () returned 0x970 [0077.379] GetCurrentThreadId () returned 0x970 [0077.379] GetCurrentThreadId () returned 0x970 [0077.379] GetCurrentThreadId () returned 0x970 [0077.379] GetCurrentThreadId () returned 0x970 [0077.379] GetCurrentThreadId () returned 0x970 [0077.379] GetCurrentThreadId () returned 0x970 [0077.379] GetCurrentThreadId () returned 0x970 [0077.379] GetCurrentThreadId () returned 0x970 [0077.379] GetCurrentThreadId () returned 0x970 [0077.379] GetCurrentThreadId () returned 0x970 [0077.379] GetCurrentThreadId () returned 0x970 [0077.379] GetCurrentThreadId () returned 0x970 [0077.379] GetCurrentThreadId () returned 0x970 [0077.379] GetCurrentThreadId () returned 0x970 [0077.379] GetCurrentThreadId () returned 0x970 [0077.379] GetCurrentThreadId () returned 0x970 [0077.379] GetCurrentThreadId () returned 0x970 [0077.379] GetCurrentThreadId () returned 0x970 [0077.379] GetCurrentThreadId () returned 0x970 [0077.379] GetCurrentThreadId () returned 0x970 [0077.379] GetCurrentThreadId () returned 0x970 [0077.379] GetCurrentThreadId () returned 0x970 [0077.380] GetCurrentThreadId () returned 0x970 [0077.380] GetCurrentThreadId () returned 0x970 [0077.380] GetCurrentThreadId () returned 0x970 [0077.380] GetCurrentThreadId () returned 0x970 [0077.380] GetCurrentThreadId () returned 0x970 [0077.380] GetCurrentThreadId () returned 0x970 [0077.380] GetCurrentThreadId () returned 0x970 [0077.380] GetCurrentThreadId () returned 0x970 [0077.380] GetCurrentThreadId () returned 0x970 [0077.380] GetCurrentThreadId () returned 0x970 [0077.380] GetCurrentThreadId () returned 0x970 [0077.380] GetCurrentThreadId () returned 0x970 [0077.380] GetCurrentThreadId () returned 0x970 [0077.380] GetCurrentThreadId () returned 0x970 [0077.380] GetCurrentThreadId () returned 0x970 [0077.380] GetCurrentThreadId () returned 0x970 [0077.380] GetCurrentThreadId () returned 0x970 [0077.380] GetCurrentThreadId () returned 0x970 [0077.380] GetCurrentThreadId () returned 0x970 [0077.380] GetCurrentThreadId () returned 0x970 [0077.380] GetCurrentThreadId () returned 0x970 [0077.380] GetCurrentThreadId () returned 0x970 [0077.380] GetCurrentThreadId () returned 0x970 [0077.380] GetCurrentThreadId () returned 0x970 [0077.380] GetCurrentThreadId () returned 0x970 [0077.380] GetCurrentThreadId () returned 0x970 [0077.380] GetCurrentThreadId () returned 0x970 [0077.380] GetCurrentThreadId () returned 0x970 [0077.380] GetCurrentThreadId () returned 0x970 [0077.380] GetCurrentThreadId () returned 0x970 [0077.380] GetCurrentThreadId () returned 0x970 [0077.380] GetCurrentThreadId () returned 0x970 [0077.380] GetCurrentThreadId () returned 0x970 [0077.380] GetCurrentThreadId () returned 0x970 [0077.380] GetCurrentThreadId () returned 0x970 [0077.381] GetCurrentThreadId () returned 0x970 [0077.381] GetCurrentThreadId () returned 0x970 [0077.381] GetCurrentThreadId () returned 0x970 [0077.381] GetCurrentThreadId () returned 0x970 [0077.381] GetCurrentThreadId () returned 0x970 [0077.381] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.381] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.381] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a12f8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.381] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.381] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.381] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a12f8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.381] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.381] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.381] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.381] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.381] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.381] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.381] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.381] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.381] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a1358, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.381] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.381] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.381] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a1358, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.381] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.381] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.382] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a1358, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.382] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x18, wMilliseconds=0x28d)) [0077.382] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="D\"n^ZFo#{/>+u:U@z%Inwrso,oWu)yA{", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0077.382] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="D\"n^ZFo#{/>+u:U@z%Inwrso,oWu)yA{", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0077.382] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="D\"n^ZFo#{/>+u:U@z%Inwrso,oWu)yA{", cchWideChar=32, lpMultiByteStr=0x3b5f958, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D\"n^ZFo#{/>+u:U@z%Inwrso,oWu)yA{", lpUsedDefaultChar=0x0) returned 32 [0077.382] GetCurrentThreadId () returned 0x970 [0077.382] GetCurrentThreadId () returned 0x970 [0077.382] GetCurrentThreadId () returned 0x970 [0077.382] GetCurrentThreadId () returned 0x970 [0077.382] GetCurrentThreadId () returned 0x970 [0077.382] GetCurrentThreadId () returned 0x970 [0077.392] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0077.392] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0077.392] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3b42bf8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0077.392] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34edf48, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0077.392] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34edf48, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAHqSki4MmLFGNHTOqsL+c3fchrZHZHOIC7q5Bv91+pWYNKWRyg8nIH0tYOvlIGoR+1n8Ytp7fYrq6BhGR72v+aosYuTRdAHmydws4Ll4Lu1BUYsfCYeqavoZ8NTeOjmtaSwJ76RmLC9dkNgx+o6NitcQVsZmTovj6yn5d43eaahmhhDNTvIKuSVP0lATmrCVw0QczP0DD+lmrQCFXid7BpGqBy0RKjSDDQ==") returned 232 [0077.392] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x18, wMilliseconds=0x29d)) [0077.393] GetCurrentThreadId () returned 0x970 [0077.393] GetCurrentThreadId () returned 0x970 [0077.393] GetCurrentThreadId () returned 0x970 [0077.393] GetCurrentThreadId () returned 0x970 [0077.393] GetCurrentThreadId () returned 0x970 [0077.393] GetCurrentThreadId () returned 0x970 [0077.393] GetCurrentThreadId () returned 0x970 [0077.393] GetCurrentThreadId () returned 0x970 [0077.393] GetCurrentThreadId () returned 0x970 [0077.393] GetCurrentThreadId () returned 0x970 [0077.393] GetCurrentThreadId () returned 0x970 [0077.393] GetCurrentThreadId () returned 0x970 [0077.393] GetCurrentThreadId () returned 0x970 [0077.393] GetCurrentThreadId () returned 0x970 [0077.393] GetCurrentThreadId () returned 0x970 [0077.393] GetCurrentThreadId () returned 0x970 [0077.393] GetCurrentThreadId () returned 0x970 [0077.393] GetCurrentThreadId () returned 0x970 [0077.393] GetCurrentThreadId () returned 0x970 [0077.393] GetCurrentThreadId () returned 0x970 [0077.393] GetCurrentThreadId () returned 0x970 [0077.393] GetCurrentThreadId () returned 0x970 [0077.393] GetCurrentThreadId () returned 0x970 [0077.393] GetCurrentThreadId () returned 0x970 [0077.393] GetCurrentThreadId () returned 0x970 [0077.393] GetCurrentThreadId () returned 0x970 [0077.393] GetCurrentThreadId () returned 0x970 [0077.393] GetCurrentThreadId () returned 0x970 [0077.393] GetCurrentThreadId () returned 0x970 [0077.393] GetCurrentThreadId () returned 0x970 [0077.393] GetCurrentThreadId () returned 0x970 [0077.393] GetCurrentThreadId () returned 0x970 [0077.393] GetCurrentThreadId () returned 0x970 [0077.394] GetCurrentThreadId () returned 0x970 [0077.394] GetCurrentThreadId () returned 0x970 [0077.394] GetCurrentThreadId () returned 0x970 [0077.394] GetCurrentThreadId () returned 0x970 [0077.394] GetCurrentThreadId () returned 0x970 [0077.394] GetCurrentThreadId () returned 0x970 [0077.394] GetCurrentThreadId () returned 0x970 [0077.394] GetCurrentThreadId () returned 0x970 [0077.394] GetCurrentThreadId () returned 0x970 [0077.394] GetCurrentThreadId () returned 0x970 [0077.394] GetCurrentThreadId () returned 0x970 [0077.394] GetCurrentThreadId () returned 0x970 [0077.394] GetCurrentThreadId () returned 0x970 [0077.394] GetCurrentThreadId () returned 0x970 [0077.394] GetCurrentThreadId () returned 0x970 [0077.394] GetCurrentThreadId () returned 0x970 [0077.394] GetCurrentThreadId () returned 0x970 [0077.394] GetCurrentThreadId () returned 0x970 [0077.394] GetCurrentThreadId () returned 0x970 [0077.394] GetCurrentThreadId () returned 0x970 [0077.394] GetCurrentThreadId () returned 0x970 [0077.394] GetCurrentThreadId () returned 0x970 [0077.394] GetCurrentThreadId () returned 0x970 [0077.394] GetCurrentThreadId () returned 0x970 [0077.394] GetCurrentThreadId () returned 0x970 [0077.394] GetCurrentThreadId () returned 0x970 [0077.394] GetCurrentThreadId () returned 0x970 [0077.394] GetCurrentThreadId () returned 0x970 [0077.394] GetCurrentThreadId () returned 0x970 [0077.394] GetCurrentThreadId () returned 0x970 [0077.394] GetCurrentThreadId () returned 0x970 [0077.394] GetCurrentThreadId () returned 0x970 [0077.394] GetCurrentThreadId () returned 0x970 [0077.394] GetCurrentThreadId () returned 0x970 [0077.395] GetCurrentThreadId () returned 0x970 [0077.395] GetCurrentThreadId () returned 0x970 [0077.395] GetCurrentThreadId () returned 0x970 [0077.395] GetCurrentThreadId () returned 0x970 [0077.395] GetCurrentThreadId () returned 0x970 [0077.395] GetCurrentThreadId () returned 0x970 [0077.395] GetCurrentThreadId () returned 0x970 [0077.395] GetCurrentThreadId () returned 0x970 [0077.395] GetCurrentThreadId () returned 0x970 [0077.395] GetCurrentThreadId () returned 0x970 [0077.395] GetCurrentThreadId () returned 0x970 [0077.395] GetCurrentThreadId () returned 0x970 [0077.395] GetCurrentThreadId () returned 0x970 [0077.395] GetCurrentThreadId () returned 0x970 [0077.395] GetCurrentThreadId () returned 0x970 [0077.395] GetCurrentThreadId () returned 0x970 [0077.395] GetCurrentThreadId () returned 0x970 [0077.395] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAHqSki4MmLFGNHTOqsL+c3fchrZHZHOIC7q5Bv91+pWYNKWRyg8nIH0tYOvlIGoR+1n8Ytp7fYrq6BhGR72v+aosYuTRdAHmydws4Ll4Lu1BUYsfCYeqavoZ8NTeOjmtaSwJ76RmLC9dkNgx+o6NitcQVsZmTovj6yn5d43eaahmhhDNTvIKuSVP0lATmrCVw0QczP0DD+lmrQCFXid7BpGqBy0RKjSDDQ==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0077.395] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAHqSki4MmLFGNHTOqsL+c3fchrZHZHOIC7q5Bv91+pWYNKWRyg8nIH0tYOvlIGoR+1n8Ytp7fYrq6BhGR72v+aosYuTRdAHmydws4Ll4Lu1BUYsfCYeqavoZ8NTeOjmtaSwJ76RmLC9dkNgx+o6NitcQVsZmTovj6yn5d43eaahmhhDNTvIKuSVP0lATmrCVw0QczP0DD+lmrQCFXid7BpGqBy0RKjSDDQ==", cchWideChar=245, lpMultiByteStr=0x3b4cd5c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAHqSki4MmLFGNHTOqsL+c3fchrZHZHOIC7q5Bv91+pWYNKWRyg8nIH0tYOvlIGoR+1n8Ytp7fYrq6BhGR72v+aosYuTRdAHmydws4Ll4Lu1BUYsfCYeqavoZ8NTeOjmtaSwJ76RmLC9dkNgx+o6NitcQVsZmTovj6yn5d43eaahmhhDNTvIKuSVP0lATmrCVw0QczP0DD+lmrQCFXid7BpGqBy0RKjSDDQ==", lpUsedDefaultChar=0x0) returned 245 [0077.395] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0077.395] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0077.396] CloseHandle (hObject=0x158) returned 1 [0077.396] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-previous-static.png")) returned 0 [0077.396] GetLastError () returned 0x5 [0077.396] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-previous-static.png")) returned 0x20 [0077.396] SetLastError (dwErrCode=0x5) [0077.396] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=19765948568) returned 1 [0077.396] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Файл зашифрован [button-bullet.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\Файл зашифрован [button-bullet.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0077.397] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0077.397] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0077.397] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0077.397] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0077.397] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0077.397] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0077.397] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0077.397] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0077.397] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0077.398] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0077.398] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0077.398] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0077.398] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0077.398] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0077.398] SetEndOfFile (hFile=0x158) returned 1 [0077.398] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0077.398] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0077.398] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0077.398] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0077.398] WriteFile (in: hFile=0x158, lpBuffer=0x3777058*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777058*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0077.399] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0077.400] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C-awK$#zqB{<50WE~LA\\gN{6D.xNm7CQ", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0077.400] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="C-awK$#zqB{<50WE~LA\\gN{6D.xNm7CQ", cchWideChar=32, lpMultiByteStr=0x203990c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C-awK$#zqB{<50WE~LA\\gN{6D.xNm7CQ", lpUsedDefaultChar=0x0) returned 32 [0077.400] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0077.400] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0077.400] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x726b5d16, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x726b5d16, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x553e929b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x3c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="button-bullet.png", cAlternateFileName="")) returned 0x295098 [0077.400] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0077.400] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0077.400] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-bullet.png")) returned 0x20 [0077.400] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-bullet.png")) returned 0x20 [0077.400] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-bullet.png")) returned 0x20 [0077.400] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-bullet.png")) returned 0x20 [0077.401] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-bullet.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x726b5d16, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x726b5d16, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x553e929b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x3c2)) returned 1 [0077.401] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0077.401] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0077.401] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-bullet.png")) returned 0x20 [0077.401] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-bullet.png")) returned 0x20 [0077.401] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0077.401] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0077.401] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0077.401] SetEndOfFile (hFile=0x158) returned 1 [0077.402] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="button-bullet.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0077.402] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="button-bullet.png", cchWideChar=17, lpMultiByteStr=0x1ff885c, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button-bullet.png", lpUsedDefaultChar=0x0) returned 17 [0077.402] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="button-bullet.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0077.402] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="button-bullet.png", cchWideChar=17, lpMultiByteStr=0x1ff88fc, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button-bullet.png", lpUsedDefaultChar=0x0) returned 17 [0077.402] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff88fc, cbMultiByte=17, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="button-bullet.pngic.pngpng.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 17 [0077.402] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="button-bullet.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0077.402] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="button-bullet.png", cchWideChar=17, lpMultiByteStr=0x1ff885c, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button-bullet.png", lpUsedDefaultChar=0x0) returned 17 [0077.403] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-bullet.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0077.403] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0077.403] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x3c2 [0077.403] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0077.403] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0077.403] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0077.403] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="button-bullet.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0077.403] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="button-bullet.png", cchWideChar=17, lpMultiByteStr=0x1ff885c, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button-bullet.png", lpUsedDefaultChar=0x0) returned 17 [0077.404] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="button-bullet.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0077.404] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="button-bullet.png", cchWideChar=17, lpMultiByteStr=0x1ff88fc, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button-bullet.png", lpUsedDefaultChar=0x0) returned 17 [0077.404] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff88fc, cbMultiByte=17, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="button-bullet.pnget.pngic.pngpng.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 17 [0077.404] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="button-bullet.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0077.404] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="button-bullet.png", cchWideChar=17, lpMultiByteStr=0x1ff885c, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button-bullet.png", lpUsedDefaultChar=0x0) returned 17 [0077.404] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0077.405] CharToOemA (in: pSrc="button-bullet.png", pDst=0x1ff88fc | out: pDst="button-bullet.png") returned 1 [0077.405] WriteFile (in: hFile=0x158, lpBuffer=0x1ff88fc*, nNumberOfBytesToWrite=0x11, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1ff88fc*, lpNumberOfBytesWritten=0x18e048*=0x11, lpOverlapped=0x0) returned 1 [0077.405] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0077.405] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0077.405] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0077.406] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=19766898044) returned 1 [0077.406] ReadFile (in: hFile=0x11c, lpBuffer=0x3b714d0, nNumberOfBytesToRead=0x3c2, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b714d0*, lpNumberOfBytesRead=0x18dd7c*=0x3c2, lpOverlapped=0x0) returned 1 [0077.408] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0077.408] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=19767124890) returned 1 [0077.417] WriteFile (in: hFile=0x158, lpBuffer=0x379acd8*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379acd8*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0077.417] ReadFile (in: hFile=0x11c, lpBuffer=0x3b714d0, nNumberOfBytesToRead=0x3c2, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3b714d0*, lpNumberOfBytesRead=0x18de38*=0x3c2, lpOverlapped=0x0) returned 1 [0077.417] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x4c [0077.417] WriteFile (in: hFile=0x158, lpBuffer=0x3b718f0*, nNumberOfBytesToWrite=0x3c2, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3b718f0*, lpNumberOfBytesWritten=0x18de10*=0x3c2, lpOverlapped=0x0) returned 1 [0077.417] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x40e [0077.417] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0077.418] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0077.418] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0077.418] SetFilePointer (in: hFile=0x158, lDistanceToMove=17, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2f [0077.418] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x418 [0077.418] CloseHandle (hObject=0x11c) returned 1 [0077.418] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x418 [0077.418] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x418 [0077.418] SetFilePointer (in: hFile=0x158, lDistanceToMove=1048, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x418 [0077.418] SetFilePointer (in: hFile=0x158, lDistanceToMove=1048, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x418 [0077.418] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x418 [0077.418] SetFilePointer (in: hFile=0x158, lDistanceToMove=1048, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x418 [0077.418] SetEndOfFile (hFile=0x158) returned 1 [0077.418] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x418 [0077.419] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x418 [0077.419] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="button-bullet.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0077.419] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="button-bullet.png", cchWideChar=17, lpMultiByteStr=0x1ff88fc, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button-bullet.png", lpUsedDefaultChar=0x0) returned 17 [0077.419] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="button-bullet.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0077.419] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="button-bullet.png", cchWideChar=17, lpMultiByteStr=0x1ff885c, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button-bullet.png", lpUsedDefaultChar=0x0) returned 17 [0077.419] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff885c, cbMultiByte=17, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="button-bullet.png\x18믉`믑`") returned 17 [0077.419] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="button-bullet.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0077.419] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="button-bullet.png", cchWideChar=17, lpMultiByteStr=0x1ff88fc, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button-bullet.png", lpUsedDefaultChar=0x0) returned 17 [0077.419] WriteFile (in: hFile=0x158, lpBuffer=0x3b54f88*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3b54f88*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0077.419] CharToOemA (in: pSrc="button-bullet.png", pDst=0x1ff885c | out: pDst="button-bullet.png") returned 1 [0077.419] WriteFile (in: hFile=0x158, lpBuffer=0x1ff885c*, nNumberOfBytesToWrite=0x11, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1ff885c*, lpNumberOfBytesWritten=0x18efcc*=0x11, lpOverlapped=0x0) returned 1 [0077.419] WriteFile (in: hFile=0x158, lpBuffer=0x379ae18*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379ae18*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0077.419] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0077.419] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0077.419] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x462 [0077.419] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x462 [0077.420] WriteFile (in: hFile=0x158, lpBuffer=0x3777058*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777058*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0077.420] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0077.420] DeleteFileW (lpFileName="") returned 0 [0077.420] GetLastError () returned 0x3 [0077.420] GetFileAttributesW (lpFileName="") returned 0xffffffff [0077.420] SetLastError (dwErrCode=0x3) [0077.420] FlushFileBuffers (hFile=0x158) returned 1 [0077.423] GetCurrentThreadId () returned 0x970 [0077.423] GetCurrentThreadId () returned 0x970 [0077.423] GetCurrentThreadId () returned 0x970 [0077.423] GetCurrentThreadId () returned 0x970 [0077.423] GetCurrentThreadId () returned 0x970 [0077.423] GetCurrentThreadId () returned 0x970 [0077.423] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x519 [0077.423] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x519 [0077.423] SetFilePointer (in: hFile=0x158, lDistanceToMove=1305, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x519 [0077.423] CloseHandle (hObject=0x158) returned 1 [0077.423] GetCurrentThreadId () returned 0x970 [0077.423] GetCurrentThreadId () returned 0x970 [0077.423] GetCurrentThreadId () returned 0x970 [0077.423] GetCurrentThreadId () returned 0x970 [0077.423] GetCurrentThreadId () returned 0x970 [0077.423] GetCurrentThreadId () returned 0x970 [0077.423] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Файл зашифрован [button-bullet.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\Файл зашифрован [button-bullet.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0077.423] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x519 [0077.423] SetFilePointer (in: hFile=0x158, lDistanceToMove=1177, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x499 [0077.423] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0077.423] GetFileType (hFile=0x158) returned 0x1 [0077.424] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x18, wMilliseconds=0x2bc)) [0077.424] GetCurrentThreadId () returned 0x970 [0077.424] GetCurrentThreadId () returned 0x970 [0077.424] GetCurrentThreadId () returned 0x970 [0077.424] GetCurrentThreadId () returned 0x970 [0077.424] GetCurrentThreadId () returned 0x970 [0077.424] GetCurrentThreadId () returned 0x970 [0077.424] GetCurrentThreadId () returned 0x970 [0077.424] GetCurrentThreadId () returned 0x970 [0077.424] GetCurrentThreadId () returned 0x970 [0077.424] GetCurrentThreadId () returned 0x970 [0077.424] GetCurrentThreadId () returned 0x970 [0077.424] GetCurrentThreadId () returned 0x970 [0077.424] GetCurrentThreadId () returned 0x970 [0077.424] GetCurrentThreadId () returned 0x970 [0077.424] GetCurrentThreadId () returned 0x970 [0077.424] GetCurrentThreadId () returned 0x970 [0077.424] GetCurrentThreadId () returned 0x970 [0077.424] GetCurrentThreadId () returned 0x970 [0077.424] GetCurrentThreadId () returned 0x970 [0077.424] GetCurrentThreadId () returned 0x970 [0077.424] GetCurrentThreadId () returned 0x970 [0077.424] GetCurrentThreadId () returned 0x970 [0077.424] GetCurrentThreadId () returned 0x970 [0077.424] GetCurrentThreadId () returned 0x970 [0077.424] GetCurrentThreadId () returned 0x970 [0077.424] GetCurrentThreadId () returned 0x970 [0077.424] GetCurrentThreadId () returned 0x970 [0077.424] GetCurrentThreadId () returned 0x970 [0077.424] GetCurrentThreadId () returned 0x970 [0077.424] GetCurrentThreadId () returned 0x970 [0077.424] GetCurrentThreadId () returned 0x970 [0077.424] GetCurrentThreadId () returned 0x970 [0077.424] GetCurrentThreadId () returned 0x970 [0077.424] GetCurrentThreadId () returned 0x970 [0077.424] GetCurrentThreadId () returned 0x970 [0077.424] GetCurrentThreadId () returned 0x970 [0077.424] GetCurrentThreadId () returned 0x970 [0077.424] GetCurrentThreadId () returned 0x970 [0077.424] GetCurrentThreadId () returned 0x970 [0077.424] GetCurrentThreadId () returned 0x970 [0077.424] GetCurrentThreadId () returned 0x970 [0077.424] GetCurrentThreadId () returned 0x970 [0077.425] GetCurrentThreadId () returned 0x970 [0077.425] GetCurrentThreadId () returned 0x970 [0077.425] GetCurrentThreadId () returned 0x970 [0077.425] GetCurrentThreadId () returned 0x970 [0077.425] GetCurrentThreadId () returned 0x970 [0077.425] GetCurrentThreadId () returned 0x970 [0077.425] GetCurrentThreadId () returned 0x970 [0077.425] GetCurrentThreadId () returned 0x970 [0077.425] GetCurrentThreadId () returned 0x970 [0077.425] GetCurrentThreadId () returned 0x970 [0077.425] GetCurrentThreadId () returned 0x970 [0077.425] GetCurrentThreadId () returned 0x970 [0077.425] GetCurrentThreadId () returned 0x970 [0077.425] GetCurrentThreadId () returned 0x970 [0077.425] GetCurrentThreadId () returned 0x970 [0077.425] GetCurrentThreadId () returned 0x970 [0077.425] GetCurrentThreadId () returned 0x970 [0077.425] GetCurrentThreadId () returned 0x970 [0077.425] GetCurrentThreadId () returned 0x970 [0077.425] GetCurrentThreadId () returned 0x970 [0077.425] GetCurrentThreadId () returned 0x970 [0077.425] GetCurrentThreadId () returned 0x970 [0077.425] GetCurrentThreadId () returned 0x970 [0077.425] GetCurrentThreadId () returned 0x970 [0077.425] GetCurrentThreadId () returned 0x970 [0077.425] GetCurrentThreadId () returned 0x970 [0077.425] GetCurrentThreadId () returned 0x970 [0077.425] GetCurrentThreadId () returned 0x970 [0077.425] GetCurrentThreadId () returned 0x970 [0077.425] GetCurrentThreadId () returned 0x970 [0077.425] GetCurrentThreadId () returned 0x970 [0077.425] GetCurrentThreadId () returned 0x970 [0077.425] GetCurrentThreadId () returned 0x970 [0077.425] GetCurrentThreadId () returned 0x970 [0077.425] GetCurrentThreadId () returned 0x970 [0077.425] GetCurrentThreadId () returned 0x970 [0077.425] GetCurrentThreadId () returned 0x970 [0077.425] GetCurrentThreadId () returned 0x970 [0077.425] GetCurrentThreadId () returned 0x970 [0077.425] GetCurrentThreadId () returned 0x970 [0077.425] GetCurrentThreadId () returned 0x970 [0077.425] GetCurrentThreadId () returned 0x970 [0077.425] GetCurrentThreadId () returned 0x970 [0077.425] GetCurrentThreadId () returned 0x970 [0077.425] GetCurrentThreadId () returned 0x970 [0077.426] GetCurrentThreadId () returned 0x970 [0077.426] GetCurrentThreadId () returned 0x970 [0077.426] GetCurrentThreadId () returned 0x970 [0077.426] GetCurrentThreadId () returned 0x970 [0077.426] GetCurrentThreadId () returned 0x970 [0077.426] GetCurrentThreadId () returned 0x970 [0077.426] GetCurrentThreadId () returned 0x970 [0077.426] GetCurrentThreadId () returned 0x970 [0077.426] GetCurrentThreadId () returned 0x970 [0077.426] GetCurrentThreadId () returned 0x970 [0077.426] GetCurrentThreadId () returned 0x970 [0077.426] GetCurrentThreadId () returned 0x970 [0077.426] GetCurrentThreadId () returned 0x970 [0077.426] GetCurrentThreadId () returned 0x970 [0077.426] GetCurrentThreadId () returned 0x970 [0077.426] GetCurrentThreadId () returned 0x970 [0077.426] GetCurrentThreadId () returned 0x970 [0077.426] GetCurrentThreadId () returned 0x970 [0077.426] GetCurrentThreadId () returned 0x970 [0077.426] GetCurrentThreadId () returned 0x970 [0077.426] GetCurrentThreadId () returned 0x970 [0077.426] GetCurrentThreadId () returned 0x970 [0077.426] GetCurrentThreadId () returned 0x970 [0077.426] GetCurrentThreadId () returned 0x970 [0077.426] GetCurrentThreadId () returned 0x970 [0077.426] GetCurrentThreadId () returned 0x970 [0077.426] GetCurrentThreadId () returned 0x970 [0077.426] GetCurrentThreadId () returned 0x970 [0077.426] GetCurrentThreadId () returned 0x970 [0077.426] GetCurrentThreadId () returned 0x970 [0077.426] GetCurrentThreadId () returned 0x970 [0077.426] GetCurrentThreadId () returned 0x970 [0077.426] GetCurrentThreadId () returned 0x970 [0077.426] GetCurrentThreadId () returned 0x970 [0077.426] GetCurrentThreadId () returned 0x970 [0077.426] GetCurrentThreadId () returned 0x970 [0077.426] GetCurrentThreadId () returned 0x970 [0077.426] GetCurrentThreadId () returned 0x970 [0077.426] GetCurrentThreadId () returned 0x970 [0077.426] GetCurrentThreadId () returned 0x970 [0077.426] GetCurrentThreadId () returned 0x970 [0077.426] GetCurrentThreadId () returned 0x970 [0077.426] GetCurrentThreadId () returned 0x970 [0077.426] GetCurrentThreadId () returned 0x970 [0077.426] GetCurrentThreadId () returned 0x970 [0077.426] GetCurrentThreadId () returned 0x970 [0077.427] GetCurrentThreadId () returned 0x970 [0077.427] GetCurrentThreadId () returned 0x970 [0077.427] GetCurrentThreadId () returned 0x970 [0077.427] GetCurrentThreadId () returned 0x970 [0077.427] GetCurrentThreadId () returned 0x970 [0077.427] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.427] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.427] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a1358, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.427] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.427] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.427] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a1358, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.427] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.427] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.427] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.427] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.427] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.427] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.427] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.427] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.427] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a13b8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.427] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.427] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.427] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a13b8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.427] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.427] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.427] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a13b8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.427] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x18, wMilliseconds=0x2bc)) [0077.427] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C-awK$#zqB{<50WE~LA\\gN{6D.xNm7CQ", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0077.427] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C-awK$#zqB{<50WE~LA\\gN{6D.xNm7CQ", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0077.427] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C-awK$#zqB{<50WE~LA\\gN{6D.xNm7CQ", cchWideChar=32, lpMultiByteStr=0x3b5f988, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C-awK$#zqB{<50WE~LA\\gN{6D.xNm7CQ", lpUsedDefaultChar=0x0) returned 32 [0077.427] GetCurrentThreadId () returned 0x970 [0077.427] GetCurrentThreadId () returned 0x970 [0077.428] GetCurrentThreadId () returned 0x970 [0077.428] GetCurrentThreadId () returned 0x970 [0077.428] GetCurrentThreadId () returned 0x970 [0077.428] GetCurrentThreadId () returned 0x970 [0077.436] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0077.436] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0077.436] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3b42ce8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0077.436] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34edf48, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0077.436] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34edf48, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAGRMoYgX9gUbkjDBJUcgRfIowSrOT+G4jrrA+ZpcNLRjAZ3eC2hgzv6+lY016rk2gOh81eOMZax+vTN/H9ELOKxQGmLFlAGfSEbcsmgnJE2OhWdN9Fvbjp5frYNTTUcPa8pgro14rXr2dhu3SBlZtTQSRoE41kX5Q1vldl9HsHafbwohQx4E1GFZxMexUwRyz+alz0Dl+W5kW3kCuUrbQ4QFkl9Xfq878Q==") returned 232 [0077.436] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x18, wMilliseconds=0x2bc)) [0077.436] GetCurrentThreadId () returned 0x970 [0077.436] GetCurrentThreadId () returned 0x970 [0077.436] GetCurrentThreadId () returned 0x970 [0077.436] GetCurrentThreadId () returned 0x970 [0077.436] GetCurrentThreadId () returned 0x970 [0077.436] GetCurrentThreadId () returned 0x970 [0077.436] GetCurrentThreadId () returned 0x970 [0077.436] GetCurrentThreadId () returned 0x970 [0077.436] GetCurrentThreadId () returned 0x970 [0077.436] GetCurrentThreadId () returned 0x970 [0077.436] GetCurrentThreadId () returned 0x970 [0077.436] GetCurrentThreadId () returned 0x970 [0077.436] GetCurrentThreadId () returned 0x970 [0077.436] GetCurrentThreadId () returned 0x970 [0077.436] GetCurrentThreadId () returned 0x970 [0077.436] GetCurrentThreadId () returned 0x970 [0077.436] GetCurrentThreadId () returned 0x970 [0077.436] GetCurrentThreadId () returned 0x970 [0077.436] GetCurrentThreadId () returned 0x970 [0077.436] GetCurrentThreadId () returned 0x970 [0077.437] GetCurrentThreadId () returned 0x970 [0077.437] GetCurrentThreadId () returned 0x970 [0077.437] GetCurrentThreadId () returned 0x970 [0077.437] GetCurrentThreadId () returned 0x970 [0077.437] GetCurrentThreadId () returned 0x970 [0077.437] GetCurrentThreadId () returned 0x970 [0077.437] GetCurrentThreadId () returned 0x970 [0077.437] GetCurrentThreadId () returned 0x970 [0077.437] GetCurrentThreadId () returned 0x970 [0077.437] GetCurrentThreadId () returned 0x970 [0077.437] GetCurrentThreadId () returned 0x970 [0077.437] GetCurrentThreadId () returned 0x970 [0077.437] GetCurrentThreadId () returned 0x970 [0077.437] GetCurrentThreadId () returned 0x970 [0077.437] GetCurrentThreadId () returned 0x970 [0077.437] GetCurrentThreadId () returned 0x970 [0077.437] GetCurrentThreadId () returned 0x970 [0077.437] GetCurrentThreadId () returned 0x970 [0077.437] GetCurrentThreadId () returned 0x970 [0077.437] GetCurrentThreadId () returned 0x970 [0077.437] GetCurrentThreadId () returned 0x970 [0077.437] GetCurrentThreadId () returned 0x970 [0077.437] GetCurrentThreadId () returned 0x970 [0077.437] GetCurrentThreadId () returned 0x970 [0077.437] GetCurrentThreadId () returned 0x970 [0077.437] GetCurrentThreadId () returned 0x970 [0077.437] GetCurrentThreadId () returned 0x970 [0077.437] GetCurrentThreadId () returned 0x970 [0077.437] GetCurrentThreadId () returned 0x970 [0077.437] GetCurrentThreadId () returned 0x970 [0077.437] GetCurrentThreadId () returned 0x970 [0077.437] GetCurrentThreadId () returned 0x970 [0077.437] GetCurrentThreadId () returned 0x970 [0077.437] GetCurrentThreadId () returned 0x970 [0077.437] GetCurrentThreadId () returned 0x970 [0077.437] GetCurrentThreadId () returned 0x970 [0077.437] GetCurrentThreadId () returned 0x970 [0077.437] GetCurrentThreadId () returned 0x970 [0077.437] GetCurrentThreadId () returned 0x970 [0077.437] GetCurrentThreadId () returned 0x970 [0077.437] GetCurrentThreadId () returned 0x970 [0077.437] GetCurrentThreadId () returned 0x970 [0077.437] GetCurrentThreadId () returned 0x970 [0077.437] GetCurrentThreadId () returned 0x970 [0077.437] GetCurrentThreadId () returned 0x970 [0077.437] GetCurrentThreadId () returned 0x970 [0077.438] GetCurrentThreadId () returned 0x970 [0077.438] GetCurrentThreadId () returned 0x970 [0077.438] GetCurrentThreadId () returned 0x970 [0077.438] GetCurrentThreadId () returned 0x970 [0077.438] GetCurrentThreadId () returned 0x970 [0077.438] GetCurrentThreadId () returned 0x970 [0077.438] GetCurrentThreadId () returned 0x970 [0077.438] GetCurrentThreadId () returned 0x970 [0077.438] GetCurrentThreadId () returned 0x970 [0077.438] GetCurrentThreadId () returned 0x970 [0077.438] GetCurrentThreadId () returned 0x970 [0077.438] GetCurrentThreadId () returned 0x970 [0077.438] GetCurrentThreadId () returned 0x970 [0077.438] GetCurrentThreadId () returned 0x970 [0077.438] GetCurrentThreadId () returned 0x970 [0077.438] GetCurrentThreadId () returned 0x970 [0077.438] GetCurrentThreadId () returned 0x970 [0077.438] GetCurrentThreadId () returned 0x970 [0077.438] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAGRMoYgX9gUbkjDBJUcgRfIowSrOT+G4jrrA+ZpcNLRjAZ3eC2hgzv6+lY016rk2gOh81eOMZax+vTN/H9ELOKxQGmLFlAGfSEbcsmgnJE2OhWdN9Fvbjp5frYNTTUcPa8pgro14rXr2dhu3SBlZtTQSRoE41kX5Q1vldl9HsHafbwohQx4E1GFZxMexUwRyz+alz0Dl+W5kW3kCuUrbQ4QFkl9Xfq878Q==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0077.438] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAGRMoYgX9gUbkjDBJUcgRfIowSrOT+G4jrrA+ZpcNLRjAZ3eC2hgzv6+lY016rk2gOh81eOMZax+vTN/H9ELOKxQGmLFlAGfSEbcsmgnJE2OhWdN9Fvbjp5frYNTTUcPa8pgro14rXr2dhu3SBlZtTQSRoE41kX5Q1vldl9HsHafbwohQx4E1GFZxMexUwRyz+alz0Dl+W5kW3kCuUrbQ4QFkl9Xfq878Q==", cchWideChar=245, lpMultiByteStr=0x3b4cd5c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAGRMoYgX9gUbkjDBJUcgRfIowSrOT+G4jrrA+ZpcNLRjAZ3eC2hgzv6+lY016rk2gOh81eOMZax+vTN/H9ELOKxQGmLFlAGfSEbcsmgnJE2OhWdN9Fvbjp5frYNTTUcPa8pgro14rXr2dhu3SBlZtTQSRoE41kX5Q1vldl9HsHafbwohQx4E1GFZxMexUwRyz+alz0Dl+W5kW3kCuUrbQ4QFkl9Xfq878Q==", lpUsedDefaultChar=0x0) returned 245 [0077.438] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0077.438] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0077.438] CloseHandle (hObject=0x158) returned 1 [0077.438] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-bullet.png")) returned 0 [0077.439] GetLastError () returned 0x5 [0077.439] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-bullet.png")) returned 0x20 [0077.439] SetLastError (dwErrCode=0x5) [0077.439] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=19770213434) returned 1 [0077.439] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Файл зашифрован [button-highlight.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\Файл зашифрован [button-highlight.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0077.439] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0077.439] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0077.439] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0077.440] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0077.440] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0077.440] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0077.440] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0077.440] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0077.440] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0077.440] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0077.440] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0077.440] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0077.440] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0077.440] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0077.440] SetEndOfFile (hFile=0x158) returned 1 [0077.440] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0077.440] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0077.440] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0077.440] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0077.440] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0077.441] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0077.441] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="xa#Fit-sQpv->oP1bCD\\txuT=T#%}WbD", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0077.442] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="xa#Fit-sQpv->oP1bCD\\txuT=T#%}WbD", cchWideChar=32, lpMultiByteStr=0x20399b4, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xa#Fit-sQpv->oP1bCD\\txuT=T#%}WbD", lpUsedDefaultChar=0x0) returned 32 [0077.442] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0077.442] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0077.442] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x726b5d16, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x726b5d16, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x553e929b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="button-highlight.png", cAlternateFileName="")) returned 0x295098 [0077.442] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0077.442] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0077.442] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-highlight.png")) returned 0x20 [0077.442] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-highlight.png")) returned 0x20 [0077.442] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-highlight.png")) returned 0x20 [0077.442] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-highlight.png")) returned 0x20 [0077.443] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-highlight.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x726b5d16, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x726b5d16, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x553e929b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2cc)) returned 1 [0077.443] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0077.443] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0077.443] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-highlight.png")) returned 0x20 [0077.443] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-highlight.png")) returned 0x20 [0077.443] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0077.443] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0077.443] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0077.443] SetEndOfFile (hFile=0x158) returned 1 [0077.444] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="button-highlight.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0077.444] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="button-highlight.png", cchWideChar=20, lpMultiByteStr=0x1ff8974, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button-highlight.png", lpUsedDefaultChar=0x0) returned 20 [0077.444] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="button-highlight.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0077.444] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="button-highlight.png", cchWideChar=20, lpMultiByteStr=0x1ff8a14, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button-highlight.png", lpUsedDefaultChar=0x0) returned 20 [0077.444] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff8a14, cbMultiByte=20, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="button-highlight.pngpngpng.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 20 [0077.444] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="button-highlight.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0077.444] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="button-highlight.png", cchWideChar=20, lpMultiByteStr=0x1ff8974, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button-highlight.png", lpUsedDefaultChar=0x0) returned 20 [0077.444] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-highlight.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0077.444] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0077.444] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2cc [0077.445] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0077.445] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0077.445] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0077.445] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="button-highlight.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0077.445] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="button-highlight.png", cchWideChar=20, lpMultiByteStr=0x1ff8974, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button-highlight.png", lpUsedDefaultChar=0x0) returned 20 [0077.445] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="button-highlight.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0077.445] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="button-highlight.png", cchWideChar=20, lpMultiByteStr=0x1ff8a14, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button-highlight.png", lpUsedDefaultChar=0x0) returned 20 [0077.445] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff8a14, cbMultiByte=20, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="button-highlight.pnght.pngpngpng.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 20 [0077.445] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="button-highlight.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0077.445] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="button-highlight.png", cchWideChar=20, lpMultiByteStr=0x1ff8974, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button-highlight.png", lpUsedDefaultChar=0x0) returned 20 [0077.445] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0077.446] CharToOemA (in: pSrc="button-highlight.png", pDst=0x1ff8a14 | out: pDst="button-highlight.png") returned 1 [0077.446] WriteFile (in: hFile=0x158, lpBuffer=0x1ff8a14*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1ff8a14*, lpNumberOfBytesWritten=0x18e048*=0x14, lpOverlapped=0x0) returned 1 [0077.446] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0077.446] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0077.446] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0077.446] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=19770975732) returned 1 [0077.446] ReadFile (in: hFile=0x11c, lpBuffer=0x1fc46c0, nNumberOfBytesToRead=0x2cc, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fc46c0*, lpNumberOfBytesRead=0x18dd7c*=0x2cc, lpOverlapped=0x0) returned 1 [0077.448] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0077.448] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=19771137242) returned 1 [0077.458] WriteFile (in: hFile=0x158, lpBuffer=0x379ae58*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379ae58*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0077.458] ReadFile (in: hFile=0x11c, lpBuffer=0x1fc46c0, nNumberOfBytesToRead=0x2cc, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x1fc46c0*, lpNumberOfBytesRead=0x18de38*=0x2cc, lpOverlapped=0x0) returned 1 [0077.458] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x4f [0077.458] WriteFile (in: hFile=0x158, lpBuffer=0x1fc49a0*, nNumberOfBytesToWrite=0x2cc, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1fc49a0*, lpNumberOfBytesWritten=0x18de10*=0x2cc, lpOverlapped=0x0) returned 1 [0077.458] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x31b [0077.458] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0077.458] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0077.459] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0077.459] SetFilePointer (in: hFile=0x158, lDistanceToMove=20, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x32 [0077.459] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x325 [0077.459] CloseHandle (hObject=0x11c) returned 1 [0077.459] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x325 [0077.459] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x325 [0077.459] SetFilePointer (in: hFile=0x158, lDistanceToMove=805, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x325 [0077.459] SetFilePointer (in: hFile=0x158, lDistanceToMove=805, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x325 [0077.459] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x325 [0077.459] SetFilePointer (in: hFile=0x158, lDistanceToMove=805, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x325 [0077.459] SetEndOfFile (hFile=0x158) returned 1 [0077.459] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x325 [0077.460] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x325 [0077.460] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="button-highlight.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0077.460] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="button-highlight.png", cchWideChar=20, lpMultiByteStr=0x1ff8a14, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button-highlight.png", lpUsedDefaultChar=0x0) returned 20 [0077.460] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="button-highlight.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0077.460] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="button-highlight.png", cchWideChar=20, lpMultiByteStr=0x1ff8974, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button-highlight.png", lpUsedDefaultChar=0x0) returned 20 [0077.460] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff8974, cbMultiByte=20, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="button-highlight.png믑`") returned 20 [0077.460] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="button-highlight.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0077.460] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="button-highlight.png", cchWideChar=20, lpMultiByteStr=0x1ff8a14, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="button-highlight.png", lpUsedDefaultChar=0x0) returned 20 [0077.460] WriteFile (in: hFile=0x158, lpBuffer=0x3b54f88*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3b54f88*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0077.460] CharToOemA (in: pSrc="button-highlight.png", pDst=0x1ff8974 | out: pDst="button-highlight.png") returned 1 [0077.460] WriteFile (in: hFile=0x158, lpBuffer=0x1ff8974*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1ff8974*, lpNumberOfBytesWritten=0x18efcc*=0x14, lpOverlapped=0x0) returned 1 [0077.460] WriteFile (in: hFile=0x158, lpBuffer=0x379ad88*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379ad88*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0077.460] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0077.460] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0077.460] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x372 [0077.461] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x372 [0077.461] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0077.461] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0077.461] DeleteFileW (lpFileName="") returned 0 [0077.461] GetLastError () returned 0x3 [0077.461] GetFileAttributesW (lpFileName="") returned 0xffffffff [0077.461] SetLastError (dwErrCode=0x3) [0077.461] FlushFileBuffers (hFile=0x158) returned 1 [0077.463] GetCurrentThreadId () returned 0x970 [0077.463] GetCurrentThreadId () returned 0x970 [0077.463] GetCurrentThreadId () returned 0x970 [0077.463] GetCurrentThreadId () returned 0x970 [0077.463] GetCurrentThreadId () returned 0x970 [0077.463] GetCurrentThreadId () returned 0x970 [0077.463] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x429 [0077.463] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x429 [0077.463] SetFilePointer (in: hFile=0x158, lDistanceToMove=1065, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x429 [0077.463] CloseHandle (hObject=0x158) returned 1 [0077.463] GetCurrentThreadId () returned 0x970 [0077.463] GetCurrentThreadId () returned 0x970 [0077.463] GetCurrentThreadId () returned 0x970 [0077.463] GetCurrentThreadId () returned 0x970 [0077.464] GetCurrentThreadId () returned 0x970 [0077.464] GetCurrentThreadId () returned 0x970 [0077.464] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Файл зашифрован [button-highlight.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\Файл зашифрован [button-highlight.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0077.464] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x429 [0077.464] SetFilePointer (in: hFile=0x158, lDistanceToMove=937, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3a9 [0077.464] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0077.464] GetFileType (hFile=0x158) returned 0x1 [0077.464] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x18, wMilliseconds=0x2db)) [0077.464] GetCurrentThreadId () returned 0x970 [0077.464] GetCurrentThreadId () returned 0x970 [0077.464] GetCurrentThreadId () returned 0x970 [0077.464] GetCurrentThreadId () returned 0x970 [0077.464] GetCurrentThreadId () returned 0x970 [0077.464] GetCurrentThreadId () returned 0x970 [0077.464] GetCurrentThreadId () returned 0x970 [0077.464] GetCurrentThreadId () returned 0x970 [0077.464] GetCurrentThreadId () returned 0x970 [0077.464] GetCurrentThreadId () returned 0x970 [0077.464] GetCurrentThreadId () returned 0x970 [0077.464] GetCurrentThreadId () returned 0x970 [0077.464] GetCurrentThreadId () returned 0x970 [0077.464] GetCurrentThreadId () returned 0x970 [0077.464] GetCurrentThreadId () returned 0x970 [0077.464] GetCurrentThreadId () returned 0x970 [0077.464] GetCurrentThreadId () returned 0x970 [0077.464] GetCurrentThreadId () returned 0x970 [0077.464] GetCurrentThreadId () returned 0x970 [0077.464] GetCurrentThreadId () returned 0x970 [0077.464] GetCurrentThreadId () returned 0x970 [0077.464] GetCurrentThreadId () returned 0x970 [0077.464] GetCurrentThreadId () returned 0x970 [0077.464] GetCurrentThreadId () returned 0x970 [0077.464] GetCurrentThreadId () returned 0x970 [0077.465] GetCurrentThreadId () returned 0x970 [0077.465] GetCurrentThreadId () returned 0x970 [0077.465] GetCurrentThreadId () returned 0x970 [0077.465] GetCurrentThreadId () returned 0x970 [0077.465] GetCurrentThreadId () returned 0x970 [0077.465] GetCurrentThreadId () returned 0x970 [0077.465] GetCurrentThreadId () returned 0x970 [0077.465] GetCurrentThreadId () returned 0x970 [0077.465] GetCurrentThreadId () returned 0x970 [0077.465] GetCurrentThreadId () returned 0x970 [0077.465] GetCurrentThreadId () returned 0x970 [0077.465] GetCurrentThreadId () returned 0x970 [0077.465] GetCurrentThreadId () returned 0x970 [0077.465] GetCurrentThreadId () returned 0x970 [0077.465] GetCurrentThreadId () returned 0x970 [0077.465] GetCurrentThreadId () returned 0x970 [0077.465] GetCurrentThreadId () returned 0x970 [0077.465] GetCurrentThreadId () returned 0x970 [0077.465] GetCurrentThreadId () returned 0x970 [0077.465] GetCurrentThreadId () returned 0x970 [0077.465] GetCurrentThreadId () returned 0x970 [0077.465] GetCurrentThreadId () returned 0x970 [0077.465] GetCurrentThreadId () returned 0x970 [0077.465] GetCurrentThreadId () returned 0x970 [0077.465] GetCurrentThreadId () returned 0x970 [0077.465] GetCurrentThreadId () returned 0x970 [0077.465] GetCurrentThreadId () returned 0x970 [0077.465] GetCurrentThreadId () returned 0x970 [0077.465] GetCurrentThreadId () returned 0x970 [0077.465] GetCurrentThreadId () returned 0x970 [0077.465] GetCurrentThreadId () returned 0x970 [0077.465] GetCurrentThreadId () returned 0x970 [0077.465] GetCurrentThreadId () returned 0x970 [0077.465] GetCurrentThreadId () returned 0x970 [0077.465] GetCurrentThreadId () returned 0x970 [0077.465] GetCurrentThreadId () returned 0x970 [0077.465] GetCurrentThreadId () returned 0x970 [0077.465] GetCurrentThreadId () returned 0x970 [0077.465] GetCurrentThreadId () returned 0x970 [0077.465] GetCurrentThreadId () returned 0x970 [0077.465] GetCurrentThreadId () returned 0x970 [0077.465] GetCurrentThreadId () returned 0x970 [0077.465] GetCurrentThreadId () returned 0x970 [0077.465] GetCurrentThreadId () returned 0x970 [0077.466] GetCurrentThreadId () returned 0x970 [0077.466] GetCurrentThreadId () returned 0x970 [0077.466] GetCurrentThreadId () returned 0x970 [0077.466] GetCurrentThreadId () returned 0x970 [0077.466] GetCurrentThreadId () returned 0x970 [0077.466] GetCurrentThreadId () returned 0x970 [0077.466] GetCurrentThreadId () returned 0x970 [0077.466] GetCurrentThreadId () returned 0x970 [0077.466] GetCurrentThreadId () returned 0x970 [0077.466] GetCurrentThreadId () returned 0x970 [0077.466] GetCurrentThreadId () returned 0x970 [0077.466] GetCurrentThreadId () returned 0x970 [0077.466] GetCurrentThreadId () returned 0x970 [0077.466] GetCurrentThreadId () returned 0x970 [0077.466] GetCurrentThreadId () returned 0x970 [0077.466] GetCurrentThreadId () returned 0x970 [0077.466] GetCurrentThreadId () returned 0x970 [0077.466] GetCurrentThreadId () returned 0x970 [0077.466] GetCurrentThreadId () returned 0x970 [0077.466] GetCurrentThreadId () returned 0x970 [0077.466] GetCurrentThreadId () returned 0x970 [0077.466] GetCurrentThreadId () returned 0x970 [0077.466] GetCurrentThreadId () returned 0x970 [0077.466] GetCurrentThreadId () returned 0x970 [0077.466] GetCurrentThreadId () returned 0x970 [0077.466] GetCurrentThreadId () returned 0x970 [0077.466] GetCurrentThreadId () returned 0x970 [0077.466] GetCurrentThreadId () returned 0x970 [0077.466] GetCurrentThreadId () returned 0x970 [0077.466] GetCurrentThreadId () returned 0x970 [0077.466] GetCurrentThreadId () returned 0x970 [0077.466] GetCurrentThreadId () returned 0x970 [0077.466] GetCurrentThreadId () returned 0x970 [0077.466] GetCurrentThreadId () returned 0x970 [0077.466] GetCurrentThreadId () returned 0x970 [0077.466] GetCurrentThreadId () returned 0x970 [0077.466] GetCurrentThreadId () returned 0x970 [0077.466] GetCurrentThreadId () returned 0x970 [0077.466] GetCurrentThreadId () returned 0x970 [0077.466] GetCurrentThreadId () returned 0x970 [0077.466] GetCurrentThreadId () returned 0x970 [0077.466] GetCurrentThreadId () returned 0x970 [0077.466] GetCurrentThreadId () returned 0x970 [0077.466] GetCurrentThreadId () returned 0x970 [0077.467] GetCurrentThreadId () returned 0x970 [0077.467] GetCurrentThreadId () returned 0x970 [0077.467] GetCurrentThreadId () returned 0x970 [0077.467] GetCurrentThreadId () returned 0x970 [0077.467] GetCurrentThreadId () returned 0x970 [0077.467] GetCurrentThreadId () returned 0x970 [0077.467] GetCurrentThreadId () returned 0x970 [0077.467] GetCurrentThreadId () returned 0x970 [0077.467] GetCurrentThreadId () returned 0x970 [0077.467] GetCurrentThreadId () returned 0x970 [0077.467] GetCurrentThreadId () returned 0x970 [0077.467] GetCurrentThreadId () returned 0x970 [0077.467] GetCurrentThreadId () returned 0x970 [0077.467] GetCurrentThreadId () returned 0x970 [0077.467] GetCurrentThreadId () returned 0x970 [0077.467] GetCurrentThreadId () returned 0x970 [0077.467] GetCurrentThreadId () returned 0x970 [0077.467] GetCurrentThreadId () returned 0x970 [0077.467] GetCurrentThreadId () returned 0x970 [0077.467] GetCurrentThreadId () returned 0x970 [0077.467] GetCurrentThreadId () returned 0x970 [0077.467] GetCurrentThreadId () returned 0x970 [0077.467] GetCurrentThreadId () returned 0x970 [0077.467] GetCurrentThreadId () returned 0x970 [0077.467] GetCurrentThreadId () returned 0x970 [0077.467] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.467] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.467] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a13b8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.467] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.467] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.467] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a13b8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.467] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.467] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.467] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.467] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.467] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.468] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.468] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.468] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.468] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a1418, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.468] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.468] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.468] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a1418, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.468] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.468] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.468] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a1418, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.468] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x18, wMilliseconds=0x2eb)) [0077.468] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="xa#Fit-sQpv->oP1bCD\\txuT=T#%}WbD", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0077.468] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="xa#Fit-sQpv->oP1bCD\\txuT=T#%}WbD", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0077.468] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="xa#Fit-sQpv->oP1bCD\\txuT=T#%}WbD", cchWideChar=32, lpMultiByteStr=0x3b58188, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xa#Fit-sQpv->oP1bCD\\txuT=T#%}WbD", lpUsedDefaultChar=0x0) returned 32 [0077.468] GetCurrentThreadId () returned 0x970 [0077.468] GetCurrentThreadId () returned 0x970 [0077.468] GetCurrentThreadId () returned 0x970 [0077.468] GetCurrentThreadId () returned 0x970 [0077.468] GetCurrentThreadId () returned 0x970 [0077.468] GetCurrentThreadId () returned 0x970 [0077.476] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0077.476] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0077.476] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3b42dd8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0077.476] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34edf48, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0077.476] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34edf48, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAC8QiZTq0V2OrqOXKI3z12ODkeFRO4ULqDWZWHmCR6RAgQdT9F3qR1cX2f6d216ep23jamPV1vEN0hB8KbsBf5tmVPRG4GKzV3j0Tea44Hjm6TTO67QEkFNrjVsu065u4jdaICkGMqbwIGPdeqeEAmbGq4bqua/G4gIz79aOqyHwqSbXzZwgnT66PfxcELBkhPAglO7aYyl3CwRbRHDkTZWFXz0deoKFWg==") returned 232 [0077.476] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x18, wMilliseconds=0x2eb)) [0077.476] GetCurrentThreadId () returned 0x970 [0077.476] GetCurrentThreadId () returned 0x970 [0077.476] GetCurrentThreadId () returned 0x970 [0077.476] GetCurrentThreadId () returned 0x970 [0077.476] GetCurrentThreadId () returned 0x970 [0077.476] GetCurrentThreadId () returned 0x970 [0077.476] GetCurrentThreadId () returned 0x970 [0077.476] GetCurrentThreadId () returned 0x970 [0077.476] GetCurrentThreadId () returned 0x970 [0077.476] GetCurrentThreadId () returned 0x970 [0077.476] GetCurrentThreadId () returned 0x970 [0077.476] GetCurrentThreadId () returned 0x970 [0077.476] GetCurrentThreadId () returned 0x970 [0077.476] GetCurrentThreadId () returned 0x970 [0077.476] GetCurrentThreadId () returned 0x970 [0077.476] GetCurrentThreadId () returned 0x970 [0077.476] GetCurrentThreadId () returned 0x970 [0077.476] GetCurrentThreadId () returned 0x970 [0077.476] GetCurrentThreadId () returned 0x970 [0077.476] GetCurrentThreadId () returned 0x970 [0077.476] GetCurrentThreadId () returned 0x970 [0077.476] GetCurrentThreadId () returned 0x970 [0077.476] GetCurrentThreadId () returned 0x970 [0077.476] GetCurrentThreadId () returned 0x970 [0077.476] GetCurrentThreadId () returned 0x970 [0077.476] GetCurrentThreadId () returned 0x970 [0077.476] GetCurrentThreadId () returned 0x970 [0077.476] GetCurrentThreadId () returned 0x970 [0077.476] GetCurrentThreadId () returned 0x970 [0077.476] GetCurrentThreadId () returned 0x970 [0077.476] GetCurrentThreadId () returned 0x970 [0077.476] GetCurrentThreadId () returned 0x970 [0077.476] GetCurrentThreadId () returned 0x970 [0077.476] GetCurrentThreadId () returned 0x970 [0077.477] GetCurrentThreadId () returned 0x970 [0077.477] GetCurrentThreadId () returned 0x970 [0077.477] GetCurrentThreadId () returned 0x970 [0077.477] GetCurrentThreadId () returned 0x970 [0077.477] GetCurrentThreadId () returned 0x970 [0077.477] GetCurrentThreadId () returned 0x970 [0077.477] GetCurrentThreadId () returned 0x970 [0077.477] GetCurrentThreadId () returned 0x970 [0077.477] GetCurrentThreadId () returned 0x970 [0077.477] GetCurrentThreadId () returned 0x970 [0077.477] GetCurrentThreadId () returned 0x970 [0077.477] GetCurrentThreadId () returned 0x970 [0077.477] GetCurrentThreadId () returned 0x970 [0077.477] GetCurrentThreadId () returned 0x970 [0077.477] GetCurrentThreadId () returned 0x970 [0077.477] GetCurrentThreadId () returned 0x970 [0077.477] GetCurrentThreadId () returned 0x970 [0077.477] GetCurrentThreadId () returned 0x970 [0077.477] GetCurrentThreadId () returned 0x970 [0077.477] GetCurrentThreadId () returned 0x970 [0077.477] GetCurrentThreadId () returned 0x970 [0077.477] GetCurrentThreadId () returned 0x970 [0077.477] GetCurrentThreadId () returned 0x970 [0077.477] GetCurrentThreadId () returned 0x970 [0077.477] GetCurrentThreadId () returned 0x970 [0077.477] GetCurrentThreadId () returned 0x970 [0077.477] GetCurrentThreadId () returned 0x970 [0077.477] GetCurrentThreadId () returned 0x970 [0077.477] GetCurrentThreadId () returned 0x970 [0077.477] GetCurrentThreadId () returned 0x970 [0077.477] GetCurrentThreadId () returned 0x970 [0077.477] GetCurrentThreadId () returned 0x970 [0077.477] GetCurrentThreadId () returned 0x970 [0077.477] GetCurrentThreadId () returned 0x970 [0077.477] GetCurrentThreadId () returned 0x970 [0077.477] GetCurrentThreadId () returned 0x970 [0077.477] GetCurrentThreadId () returned 0x970 [0077.477] GetCurrentThreadId () returned 0x970 [0077.477] GetCurrentThreadId () returned 0x970 [0077.477] GetCurrentThreadId () returned 0x970 [0077.477] GetCurrentThreadId () returned 0x970 [0077.477] GetCurrentThreadId () returned 0x970 [0077.477] GetCurrentThreadId () returned 0x970 [0077.477] GetCurrentThreadId () returned 0x970 [0077.477] GetCurrentThreadId () returned 0x970 [0077.478] GetCurrentThreadId () returned 0x970 [0077.478] GetCurrentThreadId () returned 0x970 [0077.478] GetCurrentThreadId () returned 0x970 [0077.478] GetCurrentThreadId () returned 0x970 [0077.478] GetCurrentThreadId () returned 0x970 [0077.478] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAC8QiZTq0V2OrqOXKI3z12ODkeFRO4ULqDWZWHmCR6RAgQdT9F3qR1cX2f6d216ep23jamPV1vEN0hB8KbsBf5tmVPRG4GKzV3j0Tea44Hjm6TTO67QEkFNrjVsu065u4jdaICkGMqbwIGPdeqeEAmbGq4bqua/G4gIz79aOqyHwqSbXzZwgnT66PfxcELBkhPAglO7aYyl3CwRbRHDkTZWFXz0deoKFWg==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0077.478] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAC8QiZTq0V2OrqOXKI3z12ODkeFRO4ULqDWZWHmCR6RAgQdT9F3qR1cX2f6d216ep23jamPV1vEN0hB8KbsBf5tmVPRG4GKzV3j0Tea44Hjm6TTO67QEkFNrjVsu065u4jdaICkGMqbwIGPdeqeEAmbGq4bqua/G4gIz79aOqyHwqSbXzZwgnT66PfxcELBkhPAglO7aYyl3CwRbRHDkTZWFXz0deoKFWg==", cchWideChar=245, lpMultiByteStr=0x3b4cd5c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAC8QiZTq0V2OrqOXKI3z12ODkeFRO4ULqDWZWHmCR6RAgQdT9F3qR1cX2f6d216ep23jamPV1vEN0hB8KbsBf5tmVPRG4GKzV3j0Tea44Hjm6TTO67QEkFNrjVsu065u4jdaICkGMqbwIGPdeqeEAmbGq4bqua/G4gIz79aOqyHwqSbXzZwgnT66PfxcELBkhPAglO7aYyl3CwRbRHDkTZWFXz0deoKFWg==", lpUsedDefaultChar=0x0) returned 245 [0077.478] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0077.478] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0077.478] CloseHandle (hObject=0x158) returned 1 [0077.478] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-highlight.png")) returned 0 [0077.478] GetLastError () returned 0x5 [0077.478] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-highlight.png")) returned 0x20 [0077.478] SetLastError (dwErrCode=0x5) [0077.478] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=19774185379) returned 1 [0077.479] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Файл зашифрован [content-background.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\Файл зашифрован [content-background.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0077.479] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0077.479] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0077.479] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0077.479] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0077.479] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0077.479] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0077.480] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0077.480] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0077.480] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0077.480] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0077.480] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0077.480] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0077.480] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0077.480] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0077.480] SetEndOfFile (hFile=0x158) returned 1 [0077.480] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0077.480] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0077.480] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0077.480] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0077.480] WriteFile (in: hFile=0x158, lpBuffer=0x3777058*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777058*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0077.481] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0077.481] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{Y\"SM.1BhGUr-W7Hb)^wVgra#r0LJGXE", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0077.481] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{Y\"SM.1BhGUr-W7Hb)^wVgra#r0LJGXE", cchWideChar=32, lpMultiByteStr=0x2039164, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{Y\"SM.1BhGUr-W7Hb)^wVgra#r0LJGXE", lpUsedDefaultChar=0x0) returned 32 [0077.481] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0077.481] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0077.481] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\content-background.png", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x726dbe73, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x726dbe73, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5540f3f9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x47c1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="content-background.png", cAlternateFileName="")) returned 0x295098 [0077.482] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0077.482] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0077.482] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\content-background.png")) returned 0x20 [0077.482] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\content-background.png")) returned 0x20 [0077.483] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\content-background.png")) returned 0x20 [0077.483] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\content-background.png")) returned 0x20 [0077.483] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\content-background.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x726dbe73, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x726dbe73, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5540f3f9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x47c1d)) returned 1 [0077.483] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0077.483] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0077.483] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\content-background.png")) returned 0x20 [0077.483] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\content-background.png")) returned 0x20 [0077.483] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0077.483] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0077.483] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0077.483] SetEndOfFile (hFile=0x158) returned 1 [0077.484] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="content-background.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0077.484] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="content-background.png", cchWideChar=22, lpMultiByteStr=0x1ff899c, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="content-background.png", lpUsedDefaultChar=0x0) returned 22 [0077.484] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="content-background.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0077.484] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="content-background.png", cchWideChar=22, lpMultiByteStr=0x1ff894c, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="content-background.png", lpUsedDefaultChar=0x0) returned 22 [0077.484] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff894c, cbMultiByte=22, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="content-background.pnggpng.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 22 [0077.484] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="content-background.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0077.484] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="content-background.png", cchWideChar=22, lpMultiByteStr=0x1ff899c, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="content-background.png", lpUsedDefaultChar=0x0) returned 22 [0077.484] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\content-background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0077.485] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0077.485] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x47c1d [0077.485] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0077.485] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0077.485] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0077.485] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="content-background.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0077.485] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="content-background.png", cchWideChar=22, lpMultiByteStr=0x1ff899c, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="content-background.png", lpUsedDefaultChar=0x0) returned 22 [0077.485] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="content-background.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0077.485] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="content-background.png", cchWideChar=22, lpMultiByteStr=0x1ff894c, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="content-background.png", lpUsedDefaultChar=0x0) returned 22 [0077.485] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff894c, cbMultiByte=22, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="content-background.pngnd.pnggpng.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 22 [0077.485] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="content-background.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0077.485] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="content-background.png", cchWideChar=22, lpMultiByteStr=0x1ff899c, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="content-background.png", lpUsedDefaultChar=0x0) returned 22 [0077.485] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0077.486] CharToOemA (in: pSrc="content-background.png", pDst=0x1ff894c | out: pDst="content-background.png") returned 1 [0077.486] WriteFile (in: hFile=0x158, lpBuffer=0x1ff894c*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1ff894c*, lpNumberOfBytesWritten=0x18e048*=0x16, lpOverlapped=0x0) returned 1 [0077.486] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0077.486] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0077.487] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0077.487] VirtualAlloc (lpAddress=0x0, dwSize=0x50000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ef50000 [0077.487] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=19775042321) returned 1 [0077.487] ReadFile (in: hFile=0x11c, lpBuffer=0x7ef50010, nNumberOfBytesToRead=0x47c1d, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x7ef50010*, lpNumberOfBytesRead=0x18dd7c*=0x47c1d, lpOverlapped=0x0) returned 1 [0077.496] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0077.496] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=19775972716) returned 1 [0077.505] WriteFile (in: hFile=0x158, lpBuffer=0x379ad50*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379ad50*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0077.505] ReadFile (in: hFile=0x11c, lpBuffer=0x7ef50010, nNumberOfBytesToRead=0x47c1d, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x7ef50010*, lpNumberOfBytesRead=0x18de38*=0x47c1d, lpOverlapped=0x0) returned 1 [0077.505] VirtualAlloc (lpAddress=0x0, dwSize=0x50000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ef00000 [0077.517] VirtualAlloc (lpAddress=0x0, dwSize=0x50000, flAllocationType=0x101000, flProtect=0x4) returned 0x7eeb0000 [0077.529] VirtualFree (lpAddress=0x7eeb0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0077.531] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x51 [0077.531] WriteFile (in: hFile=0x158, lpBuffer=0x7ef00010*, nNumberOfBytesToWrite=0x47c1d, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x7ef00010*, lpNumberOfBytesWritten=0x18de10*=0x47c1d, lpOverlapped=0x0) returned 1 [0077.537] VirtualFree (lpAddress=0x7ef00000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0077.538] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x47c6e [0077.538] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0077.538] VirtualFree (lpAddress=0x7ef50000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0077.540] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0077.540] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0077.540] SetFilePointer (in: hFile=0x158, lDistanceToMove=22, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x34 [0077.540] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x47c78 [0077.540] CloseHandle (hObject=0x11c) returned 1 [0077.540] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x47c78 [0077.540] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x47c78 [0077.540] SetFilePointer (in: hFile=0x158, lDistanceToMove=294008, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x47c78 [0077.540] SetFilePointer (in: hFile=0x158, lDistanceToMove=294008, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x47c78 [0077.540] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x47c78 [0077.541] SetFilePointer (in: hFile=0x158, lDistanceToMove=294008, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x47c78 [0077.541] SetEndOfFile (hFile=0x158) returned 1 [0077.541] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x47c78 [0077.541] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x47c78 [0077.541] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="content-background.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0077.541] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="content-background.png", cchWideChar=22, lpMultiByteStr=0x1ff894c, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="content-background.png", lpUsedDefaultChar=0x0) returned 22 [0077.541] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="content-background.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0077.541] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="content-background.png", cchWideChar=22, lpMultiByteStr=0x1ff899c, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="content-background.png", lpUsedDefaultChar=0x0) returned 22 [0077.541] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff899c, cbMultiByte=22, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="content-background.png") returned 22 [0077.541] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="content-background.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0077.541] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="content-background.png", cchWideChar=22, lpMultiByteStr=0x1ff894c, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="content-background.png", lpUsedDefaultChar=0x0) returned 22 [0077.541] WriteFile (in: hFile=0x158, lpBuffer=0x3b54f88*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3b54f88*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0077.541] CharToOemA (in: pSrc="content-background.png", pDst=0x1ff899c | out: pDst="content-background.png") returned 1 [0077.541] WriteFile (in: hFile=0x158, lpBuffer=0x1ff899c*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1ff899c*, lpNumberOfBytesWritten=0x18efcc*=0x16, lpOverlapped=0x0) returned 1 [0077.541] WriteFile (in: hFile=0x158, lpBuffer=0x379ade8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379ade8*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0077.542] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0077.542] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0077.542] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x47cc7 [0077.542] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x47cc7 [0077.542] WriteFile (in: hFile=0x158, lpBuffer=0x3777058*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777058*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0077.542] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0077.542] DeleteFileW (lpFileName="") returned 0 [0077.542] GetLastError () returned 0x3 [0077.542] GetFileAttributesW (lpFileName="") returned 0xffffffff [0077.542] SetLastError (dwErrCode=0x3) [0077.542] FlushFileBuffers (hFile=0x158) returned 1 [0077.545] GetCurrentThreadId () returned 0x970 [0077.545] GetCurrentThreadId () returned 0x970 [0077.545] GetCurrentThreadId () returned 0x970 [0077.545] GetCurrentThreadId () returned 0x970 [0077.545] GetCurrentThreadId () returned 0x970 [0077.545] GetCurrentThreadId () returned 0x970 [0077.545] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x47d7e [0077.545] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x47d7e [0077.545] SetFilePointer (in: hFile=0x158, lDistanceToMove=294270, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x47d7e [0077.546] CloseHandle (hObject=0x158) returned 1 [0077.546] GetCurrentThreadId () returned 0x970 [0077.546] GetCurrentThreadId () returned 0x970 [0077.546] GetCurrentThreadId () returned 0x970 [0077.546] GetCurrentThreadId () returned 0x970 [0077.546] GetCurrentThreadId () returned 0x970 [0077.546] GetCurrentThreadId () returned 0x970 [0077.546] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Файл зашифрован [content-background.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\Файл зашифрован [content-background.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0077.546] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x47d7e [0077.546] SetFilePointer (in: hFile=0x158, lDistanceToMove=294142, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x47cfe [0077.546] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0077.546] GetFileType (hFile=0x158) returned 0x1 [0077.546] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x18, wMilliseconds=0x339)) [0077.546] GetCurrentThreadId () returned 0x970 [0077.546] GetCurrentThreadId () returned 0x970 [0077.546] GetCurrentThreadId () returned 0x970 [0077.546] GetCurrentThreadId () returned 0x970 [0077.546] GetCurrentThreadId () returned 0x970 [0077.546] GetCurrentThreadId () returned 0x970 [0077.546] GetCurrentThreadId () returned 0x970 [0077.546] GetCurrentThreadId () returned 0x970 [0077.546] GetCurrentThreadId () returned 0x970 [0077.546] GetCurrentThreadId () returned 0x970 [0077.546] GetCurrentThreadId () returned 0x970 [0077.546] GetCurrentThreadId () returned 0x970 [0077.546] GetCurrentThreadId () returned 0x970 [0077.546] GetCurrentThreadId () returned 0x970 [0077.546] GetCurrentThreadId () returned 0x970 [0077.547] GetCurrentThreadId () returned 0x970 [0077.547] GetCurrentThreadId () returned 0x970 [0077.547] GetCurrentThreadId () returned 0x970 [0077.547] GetCurrentThreadId () returned 0x970 [0077.547] GetCurrentThreadId () returned 0x970 [0077.547] GetCurrentThreadId () returned 0x970 [0077.547] GetCurrentThreadId () returned 0x970 [0077.547] GetCurrentThreadId () returned 0x970 [0077.547] GetCurrentThreadId () returned 0x970 [0077.547] GetCurrentThreadId () returned 0x970 [0077.547] GetCurrentThreadId () returned 0x970 [0077.547] GetCurrentThreadId () returned 0x970 [0077.547] GetCurrentThreadId () returned 0x970 [0077.547] GetCurrentThreadId () returned 0x970 [0077.547] GetCurrentThreadId () returned 0x970 [0077.547] GetCurrentThreadId () returned 0x970 [0077.547] GetCurrentThreadId () returned 0x970 [0077.547] GetCurrentThreadId () returned 0x970 [0077.547] GetCurrentThreadId () returned 0x970 [0077.547] GetCurrentThreadId () returned 0x970 [0077.547] GetCurrentThreadId () returned 0x970 [0077.547] GetCurrentThreadId () returned 0x970 [0077.547] GetCurrentThreadId () returned 0x970 [0077.547] GetCurrentThreadId () returned 0x970 [0077.547] GetCurrentThreadId () returned 0x970 [0077.547] GetCurrentThreadId () returned 0x970 [0077.547] GetCurrentThreadId () returned 0x970 [0077.547] GetCurrentThreadId () returned 0x970 [0077.547] GetCurrentThreadId () returned 0x970 [0077.547] GetCurrentThreadId () returned 0x970 [0077.547] GetCurrentThreadId () returned 0x970 [0077.547] GetCurrentThreadId () returned 0x970 [0077.547] GetCurrentThreadId () returned 0x970 [0077.547] GetCurrentThreadId () returned 0x970 [0077.547] GetCurrentThreadId () returned 0x970 [0077.547] GetCurrentThreadId () returned 0x970 [0077.547] GetCurrentThreadId () returned 0x970 [0077.547] GetCurrentThreadId () returned 0x970 [0077.547] GetCurrentThreadId () returned 0x970 [0077.547] GetCurrentThreadId () returned 0x970 [0077.547] GetCurrentThreadId () returned 0x970 [0077.547] GetCurrentThreadId () returned 0x970 [0077.547] GetCurrentThreadId () returned 0x970 [0077.547] GetCurrentThreadId () returned 0x970 [0077.547] GetCurrentThreadId () returned 0x970 [0077.547] GetCurrentThreadId () returned 0x970 [0077.548] GetCurrentThreadId () returned 0x970 [0077.548] GetCurrentThreadId () returned 0x970 [0077.548] GetCurrentThreadId () returned 0x970 [0077.548] GetCurrentThreadId () returned 0x970 [0077.548] GetCurrentThreadId () returned 0x970 [0077.548] GetCurrentThreadId () returned 0x970 [0077.548] GetCurrentThreadId () returned 0x970 [0077.548] GetCurrentThreadId () returned 0x970 [0077.548] GetCurrentThreadId () returned 0x970 [0077.548] GetCurrentThreadId () returned 0x970 [0077.548] GetCurrentThreadId () returned 0x970 [0077.548] GetCurrentThreadId () returned 0x970 [0077.548] GetCurrentThreadId () returned 0x970 [0077.548] GetCurrentThreadId () returned 0x970 [0077.548] GetCurrentThreadId () returned 0x970 [0077.548] GetCurrentThreadId () returned 0x970 [0077.548] GetCurrentThreadId () returned 0x970 [0077.548] GetCurrentThreadId () returned 0x970 [0077.548] GetCurrentThreadId () returned 0x970 [0077.548] GetCurrentThreadId () returned 0x970 [0077.548] GetCurrentThreadId () returned 0x970 [0077.548] GetCurrentThreadId () returned 0x970 [0077.548] GetCurrentThreadId () returned 0x970 [0077.548] GetCurrentThreadId () returned 0x970 [0077.548] GetCurrentThreadId () returned 0x970 [0077.548] GetCurrentThreadId () returned 0x970 [0077.548] GetCurrentThreadId () returned 0x970 [0077.548] GetCurrentThreadId () returned 0x970 [0077.548] GetCurrentThreadId () returned 0x970 [0077.548] GetCurrentThreadId () returned 0x970 [0077.548] GetCurrentThreadId () returned 0x970 [0077.548] GetCurrentThreadId () returned 0x970 [0077.548] GetCurrentThreadId () returned 0x970 [0077.548] GetCurrentThreadId () returned 0x970 [0077.548] GetCurrentThreadId () returned 0x970 [0077.548] GetCurrentThreadId () returned 0x970 [0077.548] GetCurrentThreadId () returned 0x970 [0077.548] GetCurrentThreadId () returned 0x970 [0077.548] GetCurrentThreadId () returned 0x970 [0077.548] GetCurrentThreadId () returned 0x970 [0077.548] GetCurrentThreadId () returned 0x970 [0077.548] GetCurrentThreadId () returned 0x970 [0077.548] GetCurrentThreadId () returned 0x970 [0077.548] GetCurrentThreadId () returned 0x970 [0077.548] GetCurrentThreadId () returned 0x970 [0077.549] GetCurrentThreadId () returned 0x970 [0077.549] GetCurrentThreadId () returned 0x970 [0077.549] GetCurrentThreadId () returned 0x970 [0077.549] GetCurrentThreadId () returned 0x970 [0077.549] GetCurrentThreadId () returned 0x970 [0077.549] GetCurrentThreadId () returned 0x970 [0077.549] GetCurrentThreadId () returned 0x970 [0077.549] GetCurrentThreadId () returned 0x970 [0077.549] GetCurrentThreadId () returned 0x970 [0077.549] GetCurrentThreadId () returned 0x970 [0077.549] GetCurrentThreadId () returned 0x970 [0077.549] GetCurrentThreadId () returned 0x970 [0077.549] GetCurrentThreadId () returned 0x970 [0077.549] GetCurrentThreadId () returned 0x970 [0077.549] GetCurrentThreadId () returned 0x970 [0077.549] GetCurrentThreadId () returned 0x970 [0077.549] GetCurrentThreadId () returned 0x970 [0077.549] GetCurrentThreadId () returned 0x970 [0077.549] GetCurrentThreadId () returned 0x970 [0077.549] GetCurrentThreadId () returned 0x970 [0077.549] GetCurrentThreadId () returned 0x970 [0077.549] GetCurrentThreadId () returned 0x970 [0077.549] GetCurrentThreadId () returned 0x970 [0077.549] GetCurrentThreadId () returned 0x970 [0077.549] GetCurrentThreadId () returned 0x970 [0077.549] GetCurrentThreadId () returned 0x970 [0077.549] GetCurrentThreadId () returned 0x970 [0077.549] GetCurrentThreadId () returned 0x970 [0077.549] GetCurrentThreadId () returned 0x970 [0077.549] GetCurrentThreadId () returned 0x970 [0077.549] GetCurrentThreadId () returned 0x970 [0077.549] GetCurrentThreadId () returned 0x970 [0077.549] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.549] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.549] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a1418, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.550] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.550] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.550] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a1418, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.550] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.550] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.550] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.550] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.550] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.550] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.550] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.550] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.550] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a1478, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.550] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.550] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.550] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a1478, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.550] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.550] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.550] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a1478, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.550] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x18, wMilliseconds=0x339)) [0077.550] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="{Y\"SM.1BhGUr-W7Hb)^wVgra#r0LJGXE", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0077.550] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="{Y\"SM.1BhGUr-W7Hb)^wVgra#r0LJGXE", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0077.550] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="{Y\"SM.1BhGUr-W7Hb)^wVgra#r0LJGXE", cchWideChar=32, lpMultiByteStr=0x3b581b8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{Y\"SM.1BhGUr-W7Hb)^wVgra#r0LJGXE", lpUsedDefaultChar=0x0) returned 32 [0077.550] GetCurrentThreadId () returned 0x970 [0077.550] GetCurrentThreadId () returned 0x970 [0077.550] GetCurrentThreadId () returned 0x970 [0077.550] GetCurrentThreadId () returned 0x970 [0077.550] GetCurrentThreadId () returned 0x970 [0077.550] GetCurrentThreadId () returned 0x970 [0077.558] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0077.558] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0077.558] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3b42ec8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0077.558] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34edf48, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0077.558] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34edf48, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAENihPG5Vg88hIKWTk1SyoOo3oAI3AU1knECcgFVygI6/nJCZJYfhtrAtSNgc80FEqcEFAbjelyVJtjtbKKETu399mZVcuHauC2N3bko4aSEJmg/JlXAkFtykfn07kDDaRda63AgXmm7//JBj6g9k51k3tHklfmAq0m81028ZgKpIsAErKE1SnCZFNVQwXgcMnHpLprMQPNjY22tya5IMAQ87aVJrzc+zA==") returned 232 [0077.558] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x18, wMilliseconds=0x339)) [0077.558] GetCurrentThreadId () returned 0x970 [0077.558] GetCurrentThreadId () returned 0x970 [0077.558] GetCurrentThreadId () returned 0x970 [0077.558] GetCurrentThreadId () returned 0x970 [0077.558] GetCurrentThreadId () returned 0x970 [0077.558] GetCurrentThreadId () returned 0x970 [0077.558] GetCurrentThreadId () returned 0x970 [0077.558] GetCurrentThreadId () returned 0x970 [0077.558] GetCurrentThreadId () returned 0x970 [0077.558] GetCurrentThreadId () returned 0x970 [0077.558] GetCurrentThreadId () returned 0x970 [0077.558] GetCurrentThreadId () returned 0x970 [0077.558] GetCurrentThreadId () returned 0x970 [0077.558] GetCurrentThreadId () returned 0x970 [0077.558] GetCurrentThreadId () returned 0x970 [0077.558] GetCurrentThreadId () returned 0x970 [0077.558] GetCurrentThreadId () returned 0x970 [0077.558] GetCurrentThreadId () returned 0x970 [0077.558] GetCurrentThreadId () returned 0x970 [0077.558] GetCurrentThreadId () returned 0x970 [0077.558] GetCurrentThreadId () returned 0x970 [0077.558] GetCurrentThreadId () returned 0x970 [0077.558] GetCurrentThreadId () returned 0x970 [0077.558] GetCurrentThreadId () returned 0x970 [0077.559] GetCurrentThreadId () returned 0x970 [0077.559] GetCurrentThreadId () returned 0x970 [0077.559] GetCurrentThreadId () returned 0x970 [0077.559] GetCurrentThreadId () returned 0x970 [0077.559] GetCurrentThreadId () returned 0x970 [0077.559] GetCurrentThreadId () returned 0x970 [0077.559] GetCurrentThreadId () returned 0x970 [0077.559] GetCurrentThreadId () returned 0x970 [0077.559] GetCurrentThreadId () returned 0x970 [0077.559] GetCurrentThreadId () returned 0x970 [0077.559] GetCurrentThreadId () returned 0x970 [0077.559] GetCurrentThreadId () returned 0x970 [0077.559] GetCurrentThreadId () returned 0x970 [0077.559] GetCurrentThreadId () returned 0x970 [0077.559] GetCurrentThreadId () returned 0x970 [0077.559] GetCurrentThreadId () returned 0x970 [0077.559] GetCurrentThreadId () returned 0x970 [0077.559] GetCurrentThreadId () returned 0x970 [0077.559] GetCurrentThreadId () returned 0x970 [0077.559] GetCurrentThreadId () returned 0x970 [0077.559] GetCurrentThreadId () returned 0x970 [0077.559] GetCurrentThreadId () returned 0x970 [0077.559] GetCurrentThreadId () returned 0x970 [0077.559] GetCurrentThreadId () returned 0x970 [0077.559] GetCurrentThreadId () returned 0x970 [0077.559] GetCurrentThreadId () returned 0x970 [0077.559] GetCurrentThreadId () returned 0x970 [0077.559] GetCurrentThreadId () returned 0x970 [0077.559] GetCurrentThreadId () returned 0x970 [0077.559] GetCurrentThreadId () returned 0x970 [0077.559] GetCurrentThreadId () returned 0x970 [0077.559] GetCurrentThreadId () returned 0x970 [0077.559] GetCurrentThreadId () returned 0x970 [0077.559] GetCurrentThreadId () returned 0x970 [0077.559] GetCurrentThreadId () returned 0x970 [0077.559] GetCurrentThreadId () returned 0x970 [0077.559] GetCurrentThreadId () returned 0x970 [0077.559] GetCurrentThreadId () returned 0x970 [0077.559] GetCurrentThreadId () returned 0x970 [0077.559] GetCurrentThreadId () returned 0x970 [0077.559] GetCurrentThreadId () returned 0x970 [0077.559] GetCurrentThreadId () returned 0x970 [0077.559] GetCurrentThreadId () returned 0x970 [0077.559] GetCurrentThreadId () returned 0x970 [0077.559] GetCurrentThreadId () returned 0x970 [0077.560] GetCurrentThreadId () returned 0x970 [0077.560] GetCurrentThreadId () returned 0x970 [0077.560] GetCurrentThreadId () returned 0x970 [0077.560] GetCurrentThreadId () returned 0x970 [0077.560] GetCurrentThreadId () returned 0x970 [0077.560] GetCurrentThreadId () returned 0x970 [0077.560] GetCurrentThreadId () returned 0x970 [0077.560] GetCurrentThreadId () returned 0x970 [0077.560] GetCurrentThreadId () returned 0x970 [0077.560] GetCurrentThreadId () returned 0x970 [0077.560] GetCurrentThreadId () returned 0x970 [0077.560] GetCurrentThreadId () returned 0x970 [0077.560] GetCurrentThreadId () returned 0x970 [0077.560] GetCurrentThreadId () returned 0x970 [0077.560] GetCurrentThreadId () returned 0x970 [0077.560] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAENihPG5Vg88hIKWTk1SyoOo3oAI3AU1knECcgFVygI6/nJCZJYfhtrAtSNgc80FEqcEFAbjelyVJtjtbKKETu399mZVcuHauC2N3bko4aSEJmg/JlXAkFtykfn07kDDaRda63AgXmm7//JBj6g9k51k3tHklfmAq0m81028ZgKpIsAErKE1SnCZFNVQwXgcMnHpLprMQPNjY22tya5IMAQ87aVJrzc+zA==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0077.560] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAENihPG5Vg88hIKWTk1SyoOo3oAI3AU1knECcgFVygI6/nJCZJYfhtrAtSNgc80FEqcEFAbjelyVJtjtbKKETu399mZVcuHauC2N3bko4aSEJmg/JlXAkFtykfn07kDDaRda63AgXmm7//JBj6g9k51k3tHklfmAq0m81028ZgKpIsAErKE1SnCZFNVQwXgcMnHpLprMQPNjY22tya5IMAQ87aVJrzc+zA==", cchWideChar=245, lpMultiByteStr=0x3b4cd5c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAENihPG5Vg88hIKWTk1SyoOo3oAI3AU1knECcgFVygI6/nJCZJYfhtrAtSNgc80FEqcEFAbjelyVJtjtbKKETu399mZVcuHauC2N3bko4aSEJmg/JlXAkFtykfn07kDDaRda63AgXmm7//JBj6g9k51k3tHklfmAq0m81028ZgKpIsAErKE1SnCZFNVQwXgcMnHpLprMQPNjY22tya5IMAQ87aVJrzc+zA==", lpUsedDefaultChar=0x0) returned 245 [0077.560] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0077.560] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0077.560] CloseHandle (hObject=0x158) returned 1 [0077.560] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\content-background.png")) returned 0 [0077.560] GetLastError () returned 0x5 [0077.560] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\content-background.png")) returned 0x20 [0077.561] SetLastError (dwErrCode=0x5) [0077.561] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=19782401571) returned 1 [0077.561] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Файл зашифрован [header-background.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\Файл зашифрован [header-background.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0077.562] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0077.562] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0077.562] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0077.562] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0077.563] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0077.563] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0077.563] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0077.563] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0077.563] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0077.563] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0077.563] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0077.563] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0077.563] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0077.563] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0077.563] SetEndOfFile (hFile=0x158) returned 1 [0077.563] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0077.563] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0077.563] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0077.563] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0077.563] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0077.564] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0077.564] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r*Imp!MizT9)^=3lM$iXLXzN:Z!S?IBD", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0077.564] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r*Imp!MizT9)^=3lM$iXLXzN:Z!S?IBD", cchWideChar=32, lpMultiByteStr=0x2039634, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="r*Imp!MizT9)^=3lM$iXLXzN:Z!S?IBD", lpUsedDefaultChar=0x0) returned 32 [0077.564] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0077.565] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0077.565] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\header-background.png", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72701fd0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72701fd0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5540f3f9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11276, dwReserved0=0x0, dwReserved1=0x0, cFileName="header-background.png", cAlternateFileName="")) returned 0x295098 [0077.565] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0077.565] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0077.565] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\header-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\header-background.png")) returned 0x20 [0077.565] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\header-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\header-background.png")) returned 0x20 [0077.565] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\header-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\header-background.png")) returned 0x20 [0077.565] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\header-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\header-background.png")) returned 0x20 [0077.565] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\header-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\header-background.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72701fd0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72701fd0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5540f3f9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11276)) returned 1 [0077.565] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0077.565] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0077.565] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\header-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\header-background.png")) returned 0x20 [0077.565] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\header-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\header-background.png")) returned 0x20 [0077.565] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0077.565] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0077.566] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0077.566] SetEndOfFile (hFile=0x158) returned 1 [0077.566] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="header-background.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0077.566] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="header-background.png", cchWideChar=21, lpMultiByteStr=0x1ff89c4, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="header-background.png", lpUsedDefaultChar=0x0) returned 21 [0077.567] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="header-background.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0077.567] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="header-background.png", cchWideChar=21, lpMultiByteStr=0x1ff88fc, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="header-background.png", lpUsedDefaultChar=0x0) returned 21 [0077.567] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff88fc, cbMultiByte=21, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="header-background.pngggpng.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 21 [0077.567] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="header-background.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0077.567] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="header-background.png", cchWideChar=21, lpMultiByteStr=0x1ff89c4, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="header-background.png", lpUsedDefaultChar=0x0) returned 21 [0077.567] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\header-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\header-background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0077.567] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0077.567] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x11276 [0077.567] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0077.567] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0077.567] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0077.567] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="header-background.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0077.567] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="header-background.png", cchWideChar=21, lpMultiByteStr=0x1ff89c4, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="header-background.png", lpUsedDefaultChar=0x0) returned 21 [0077.567] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="header-background.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0077.567] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="header-background.png", cchWideChar=21, lpMultiByteStr=0x1ff88fc, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="header-background.png", lpUsedDefaultChar=0x0) returned 21 [0077.568] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff88fc, cbMultiByte=21, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="header-background.pngnd.pngggpng.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 21 [0077.568] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="header-background.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0077.568] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="header-background.png", cchWideChar=21, lpMultiByteStr=0x1ff89c4, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="header-background.png", lpUsedDefaultChar=0x0) returned 21 [0077.568] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0077.569] CharToOemA (in: pSrc="header-background.png", pDst=0x1ff88fc | out: pDst="header-background.png") returned 1 [0077.569] WriteFile (in: hFile=0x158, lpBuffer=0x1ff88fc*, nNumberOfBytesToWrite=0x15, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1ff88fc*, lpNumberOfBytesWritten=0x18e048*=0x15, lpOverlapped=0x0) returned 1 [0077.569] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0077.569] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0077.569] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0077.569] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=19783239148) returned 1 [0077.569] ReadFile (in: hFile=0x11c, lpBuffer=0x3b714b0, nNumberOfBytesToRead=0x11276, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b714b0*, lpNumberOfBytesRead=0x18dd7c*=0x11276, lpOverlapped=0x0) returned 1 [0077.571] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0077.571] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=19783469124) returned 1 [0077.580] WriteFile (in: hFile=0x158, lpBuffer=0x379aca8*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379aca8*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0077.580] ReadFile (in: hFile=0x11c, lpBuffer=0x3b714b0, nNumberOfBytesToRead=0x11276, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3b714b0*, lpNumberOfBytesRead=0x18de38*=0x11276, lpOverlapped=0x0) returned 1 [0077.582] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x50 [0077.582] WriteFile (in: hFile=0x158, lpBuffer=0x37eeac0*, nNumberOfBytesToWrite=0x11276, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x37eeac0*, lpNumberOfBytesWritten=0x18de10*=0x11276, lpOverlapped=0x0) returned 1 [0077.584] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x112c6 [0077.584] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0077.584] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0077.584] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0077.584] SetFilePointer (in: hFile=0x158, lDistanceToMove=21, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x33 [0077.584] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x112d0 [0077.584] CloseHandle (hObject=0x11c) returned 1 [0077.584] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x112d0 [0077.584] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x112d0 [0077.584] SetFilePointer (in: hFile=0x158, lDistanceToMove=70352, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x112d0 [0077.584] SetFilePointer (in: hFile=0x158, lDistanceToMove=70352, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x112d0 [0077.584] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x112d0 [0077.584] SetFilePointer (in: hFile=0x158, lDistanceToMove=70352, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x112d0 [0077.584] SetEndOfFile (hFile=0x158) returned 1 [0077.585] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x112d0 [0077.585] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x112d0 [0077.585] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="header-background.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0077.585] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="header-background.png", cchWideChar=21, lpMultiByteStr=0x1ff88fc, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="header-background.png", lpUsedDefaultChar=0x0) returned 21 [0077.585] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="header-background.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0077.585] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="header-background.png", cchWideChar=21, lpMultiByteStr=0x1ff89c4, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="header-background.png", lpUsedDefaultChar=0x0) returned 21 [0077.585] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff89c4, cbMultiByte=21, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="header-background.png`") returned 21 [0077.585] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="header-background.png", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0077.585] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="header-background.png", cchWideChar=21, lpMultiByteStr=0x1ff88fc, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="header-background.png", lpUsedDefaultChar=0x0) returned 21 [0077.585] WriteFile (in: hFile=0x158, lpBuffer=0x3b54f88*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3b54f88*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0077.585] CharToOemA (in: pSrc="header-background.png", pDst=0x1ff89c4 | out: pDst="header-background.png") returned 1 [0077.585] WriteFile (in: hFile=0x158, lpBuffer=0x1ff89c4*, nNumberOfBytesToWrite=0x15, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1ff89c4*, lpNumberOfBytesWritten=0x18efcc*=0x15, lpOverlapped=0x0) returned 1 [0077.585] WriteFile (in: hFile=0x158, lpBuffer=0x379ae18*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379ae18*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0077.585] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0077.585] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0077.585] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1131e [0077.586] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1131e [0077.586] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0077.586] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0077.586] DeleteFileW (lpFileName="") returned 0 [0077.586] GetLastError () returned 0x3 [0077.586] GetFileAttributesW (lpFileName="") returned 0xffffffff [0077.586] SetLastError (dwErrCode=0x3) [0077.586] FlushFileBuffers (hFile=0x158) returned 1 [0077.589] GetCurrentThreadId () returned 0x970 [0077.589] GetCurrentThreadId () returned 0x970 [0077.589] GetCurrentThreadId () returned 0x970 [0077.589] GetCurrentThreadId () returned 0x970 [0077.589] GetCurrentThreadId () returned 0x970 [0077.589] GetCurrentThreadId () returned 0x970 [0077.589] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x113d5 [0077.589] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x113d5 [0077.589] SetFilePointer (in: hFile=0x158, lDistanceToMove=70613, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x113d5 [0077.589] CloseHandle (hObject=0x158) returned 1 [0077.589] GetCurrentThreadId () returned 0x970 [0077.589] GetCurrentThreadId () returned 0x970 [0077.589] GetCurrentThreadId () returned 0x970 [0077.589] GetCurrentThreadId () returned 0x970 [0077.589] GetCurrentThreadId () returned 0x970 [0077.589] GetCurrentThreadId () returned 0x970 [0077.589] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Файл зашифрован [header-background.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\Файл зашифрован [header-background.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0077.589] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x113d5 [0077.589] SetFilePointer (in: hFile=0x158, lDistanceToMove=70485, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x11355 [0077.590] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0077.590] GetFileType (hFile=0x158) returned 0x1 [0077.590] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x18, wMilliseconds=0x358)) [0077.590] GetCurrentThreadId () returned 0x970 [0077.590] GetCurrentThreadId () returned 0x970 [0077.590] GetCurrentThreadId () returned 0x970 [0077.590] GetCurrentThreadId () returned 0x970 [0077.590] GetCurrentThreadId () returned 0x970 [0077.590] GetCurrentThreadId () returned 0x970 [0077.590] GetCurrentThreadId () returned 0x970 [0077.590] GetCurrentThreadId () returned 0x970 [0077.590] GetCurrentThreadId () returned 0x970 [0077.590] GetCurrentThreadId () returned 0x970 [0077.590] GetCurrentThreadId () returned 0x970 [0077.590] GetCurrentThreadId () returned 0x970 [0077.590] GetCurrentThreadId () returned 0x970 [0077.590] GetCurrentThreadId () returned 0x970 [0077.590] GetCurrentThreadId () returned 0x970 [0077.590] GetCurrentThreadId () returned 0x970 [0077.590] GetCurrentThreadId () returned 0x970 [0077.590] GetCurrentThreadId () returned 0x970 [0077.590] GetCurrentThreadId () returned 0x970 [0077.590] GetCurrentThreadId () returned 0x970 [0077.590] GetCurrentThreadId () returned 0x970 [0077.590] GetCurrentThreadId () returned 0x970 [0077.590] GetCurrentThreadId () returned 0x970 [0077.590] GetCurrentThreadId () returned 0x970 [0077.590] GetCurrentThreadId () returned 0x970 [0077.590] GetCurrentThreadId () returned 0x970 [0077.590] GetCurrentThreadId () returned 0x970 [0077.590] GetCurrentThreadId () returned 0x970 [0077.590] GetCurrentThreadId () returned 0x970 [0077.590] GetCurrentThreadId () returned 0x970 [0077.590] GetCurrentThreadId () returned 0x970 [0077.590] GetCurrentThreadId () returned 0x970 [0077.590] GetCurrentThreadId () returned 0x970 [0077.590] GetCurrentThreadId () returned 0x970 [0077.590] GetCurrentThreadId () returned 0x970 [0077.590] GetCurrentThreadId () returned 0x970 [0077.590] GetCurrentThreadId () returned 0x970 [0077.591] GetCurrentThreadId () returned 0x970 [0077.591] GetCurrentThreadId () returned 0x970 [0077.591] GetCurrentThreadId () returned 0x970 [0077.591] GetCurrentThreadId () returned 0x970 [0077.591] GetCurrentThreadId () returned 0x970 [0077.591] GetCurrentThreadId () returned 0x970 [0077.591] GetCurrentThreadId () returned 0x970 [0077.591] GetCurrentThreadId () returned 0x970 [0077.591] GetCurrentThreadId () returned 0x970 [0077.591] GetCurrentThreadId () returned 0x970 [0077.591] GetCurrentThreadId () returned 0x970 [0077.591] GetCurrentThreadId () returned 0x970 [0077.591] GetCurrentThreadId () returned 0x970 [0077.591] GetCurrentThreadId () returned 0x970 [0077.591] GetCurrentThreadId () returned 0x970 [0077.591] GetCurrentThreadId () returned 0x970 [0077.591] GetCurrentThreadId () returned 0x970 [0077.591] GetCurrentThreadId () returned 0x970 [0077.591] GetCurrentThreadId () returned 0x970 [0077.591] GetCurrentThreadId () returned 0x970 [0077.591] GetCurrentThreadId () returned 0x970 [0077.591] GetCurrentThreadId () returned 0x970 [0077.591] GetCurrentThreadId () returned 0x970 [0077.591] GetCurrentThreadId () returned 0x970 [0077.591] GetCurrentThreadId () returned 0x970 [0077.591] GetCurrentThreadId () returned 0x970 [0077.591] GetCurrentThreadId () returned 0x970 [0077.591] GetCurrentThreadId () returned 0x970 [0077.591] GetCurrentThreadId () returned 0x970 [0077.591] GetCurrentThreadId () returned 0x970 [0077.591] GetCurrentThreadId () returned 0x970 [0077.591] GetCurrentThreadId () returned 0x970 [0077.591] GetCurrentThreadId () returned 0x970 [0077.591] GetCurrentThreadId () returned 0x970 [0077.591] GetCurrentThreadId () returned 0x970 [0077.591] GetCurrentThreadId () returned 0x970 [0077.591] GetCurrentThreadId () returned 0x970 [0077.591] GetCurrentThreadId () returned 0x970 [0077.591] GetCurrentThreadId () returned 0x970 [0077.591] GetCurrentThreadId () returned 0x970 [0077.591] GetCurrentThreadId () returned 0x970 [0077.591] GetCurrentThreadId () returned 0x970 [0077.591] GetCurrentThreadId () returned 0x970 [0077.591] GetCurrentThreadId () returned 0x970 [0077.591] GetCurrentThreadId () returned 0x970 [0077.591] GetCurrentThreadId () returned 0x970 [0077.592] GetCurrentThreadId () returned 0x970 [0077.592] GetCurrentThreadId () returned 0x970 [0077.592] GetCurrentThreadId () returned 0x970 [0077.592] GetCurrentThreadId () returned 0x970 [0077.592] GetCurrentThreadId () returned 0x970 [0077.592] GetCurrentThreadId () returned 0x970 [0077.592] GetCurrentThreadId () returned 0x970 [0077.592] GetCurrentThreadId () returned 0x970 [0077.592] GetCurrentThreadId () returned 0x970 [0077.592] GetCurrentThreadId () returned 0x970 [0077.592] GetCurrentThreadId () returned 0x970 [0077.592] GetCurrentThreadId () returned 0x970 [0077.592] GetCurrentThreadId () returned 0x970 [0077.592] GetCurrentThreadId () returned 0x970 [0077.592] GetCurrentThreadId () returned 0x970 [0077.592] GetCurrentThreadId () returned 0x970 [0077.592] GetCurrentThreadId () returned 0x970 [0077.592] GetCurrentThreadId () returned 0x970 [0077.592] GetCurrentThreadId () returned 0x970 [0077.592] GetCurrentThreadId () returned 0x970 [0077.592] GetCurrentThreadId () returned 0x970 [0077.592] GetCurrentThreadId () returned 0x970 [0077.592] GetCurrentThreadId () returned 0x970 [0077.592] GetCurrentThreadId () returned 0x970 [0077.592] GetCurrentThreadId () returned 0x970 [0077.592] GetCurrentThreadId () returned 0x970 [0077.592] GetCurrentThreadId () returned 0x970 [0077.592] GetCurrentThreadId () returned 0x970 [0077.592] GetCurrentThreadId () returned 0x970 [0077.592] GetCurrentThreadId () returned 0x970 [0077.592] GetCurrentThreadId () returned 0x970 [0077.592] GetCurrentThreadId () returned 0x970 [0077.592] GetCurrentThreadId () returned 0x970 [0077.592] GetCurrentThreadId () returned 0x970 [0077.592] GetCurrentThreadId () returned 0x970 [0077.592] GetCurrentThreadId () returned 0x970 [0077.592] GetCurrentThreadId () returned 0x970 [0077.592] GetCurrentThreadId () returned 0x970 [0077.592] GetCurrentThreadId () returned 0x970 [0077.592] GetCurrentThreadId () returned 0x970 [0077.592] GetCurrentThreadId () returned 0x970 [0077.592] GetCurrentThreadId () returned 0x970 [0077.592] GetCurrentThreadId () returned 0x970 [0077.592] GetCurrentThreadId () returned 0x970 [0077.592] GetCurrentThreadId () returned 0x970 [0077.593] GetCurrentThreadId () returned 0x970 [0077.593] GetCurrentThreadId () returned 0x970 [0077.593] GetCurrentThreadId () returned 0x970 [0077.593] GetCurrentThreadId () returned 0x970 [0077.593] GetCurrentThreadId () returned 0x970 [0077.593] GetCurrentThreadId () returned 0x970 [0077.593] GetCurrentThreadId () returned 0x970 [0077.593] GetCurrentThreadId () returned 0x970 [0077.593] GetCurrentThreadId () returned 0x970 [0077.593] GetCurrentThreadId () returned 0x970 [0077.593] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.593] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.593] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a1478, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.593] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.593] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.593] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a1478, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.593] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.593] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.593] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.593] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.593] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.593] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.593] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.593] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.593] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a14d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.593] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.593] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.593] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a14d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.593] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.593] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.593] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a14d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.593] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x18, wMilliseconds=0x368)) [0077.594] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="r*Imp!MizT9)^=3lM$iXLXzN:Z!S?IBD", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0077.594] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="r*Imp!MizT9)^=3lM$iXLXzN:Z!S?IBD", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0077.594] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="r*Imp!MizT9)^=3lM$iXLXzN:Z!S?IBD", cchWideChar=32, lpMultiByteStr=0x3b581e8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="r*Imp!MizT9)^=3lM$iXLXzN:Z!S?IBD", lpUsedDefaultChar=0x0) returned 32 [0077.594] GetCurrentThreadId () returned 0x970 [0077.594] GetCurrentThreadId () returned 0x970 [0077.594] GetCurrentThreadId () returned 0x970 [0077.594] GetCurrentThreadId () returned 0x970 [0077.594] GetCurrentThreadId () returned 0x970 [0077.594] GetCurrentThreadId () returned 0x970 [0077.601] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0077.601] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0077.601] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3b42fb8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0077.601] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34edf48, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0077.602] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34edf48, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAHaM32yNsr4rwaybsx3gmhI33fYQfEo5/s4q5/5mVdq0Fyd8XdJ648dgQWsPw96o2BhtzWXqnFQYxge/cjMTG6q/oRSJLXSAUyDQaUMnnLmn8YuoyJzjcUdH4GWgIWb1NFZjIvoTlHi+r9NSVnwWLmCPFAmp2u3GtQf8sR7cOtSX+CiOZfBy2F4oHjz2fEQOUYjEQPle1r7t96DQsbAeR/xn1gzcGw89tw==") returned 232 [0077.602] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x18, wMilliseconds=0x368)) [0077.602] GetCurrentThreadId () returned 0x970 [0077.602] GetCurrentThreadId () returned 0x970 [0077.602] GetCurrentThreadId () returned 0x970 [0077.602] GetCurrentThreadId () returned 0x970 [0077.602] GetCurrentThreadId () returned 0x970 [0077.602] GetCurrentThreadId () returned 0x970 [0077.602] GetCurrentThreadId () returned 0x970 [0077.602] GetCurrentThreadId () returned 0x970 [0077.602] GetCurrentThreadId () returned 0x970 [0077.602] GetCurrentThreadId () returned 0x970 [0077.602] GetCurrentThreadId () returned 0x970 [0077.602] GetCurrentThreadId () returned 0x970 [0077.602] GetCurrentThreadId () returned 0x970 [0077.602] GetCurrentThreadId () returned 0x970 [0077.602] GetCurrentThreadId () returned 0x970 [0077.602] GetCurrentThreadId () returned 0x970 [0077.602] GetCurrentThreadId () returned 0x970 [0077.602] GetCurrentThreadId () returned 0x970 [0077.602] GetCurrentThreadId () returned 0x970 [0077.602] GetCurrentThreadId () returned 0x970 [0077.602] GetCurrentThreadId () returned 0x970 [0077.602] GetCurrentThreadId () returned 0x970 [0077.602] GetCurrentThreadId () returned 0x970 [0077.602] GetCurrentThreadId () returned 0x970 [0077.602] GetCurrentThreadId () returned 0x970 [0077.602] GetCurrentThreadId () returned 0x970 [0077.602] GetCurrentThreadId () returned 0x970 [0077.602] GetCurrentThreadId () returned 0x970 [0077.602] GetCurrentThreadId () returned 0x970 [0077.602] GetCurrentThreadId () returned 0x970 [0077.602] GetCurrentThreadId () returned 0x970 [0077.602] GetCurrentThreadId () returned 0x970 [0077.602] GetCurrentThreadId () returned 0x970 [0077.602] GetCurrentThreadId () returned 0x970 [0077.602] GetCurrentThreadId () returned 0x970 [0077.602] GetCurrentThreadId () returned 0x970 [0077.602] GetCurrentThreadId () returned 0x970 [0077.602] GetCurrentThreadId () returned 0x970 [0077.602] GetCurrentThreadId () returned 0x970 [0077.602] GetCurrentThreadId () returned 0x970 [0077.602] GetCurrentThreadId () returned 0x970 [0077.602] GetCurrentThreadId () returned 0x970 [0077.603] GetCurrentThreadId () returned 0x970 [0077.603] GetCurrentThreadId () returned 0x970 [0077.603] GetCurrentThreadId () returned 0x970 [0077.603] GetCurrentThreadId () returned 0x970 [0077.603] GetCurrentThreadId () returned 0x970 [0077.603] GetCurrentThreadId () returned 0x970 [0077.603] GetCurrentThreadId () returned 0x970 [0077.603] GetCurrentThreadId () returned 0x970 [0077.603] GetCurrentThreadId () returned 0x970 [0077.603] GetCurrentThreadId () returned 0x970 [0077.603] GetCurrentThreadId () returned 0x970 [0077.603] GetCurrentThreadId () returned 0x970 [0077.603] GetCurrentThreadId () returned 0x970 [0077.603] GetCurrentThreadId () returned 0x970 [0077.603] GetCurrentThreadId () returned 0x970 [0077.603] GetCurrentThreadId () returned 0x970 [0077.603] GetCurrentThreadId () returned 0x970 [0077.603] GetCurrentThreadId () returned 0x970 [0077.603] GetCurrentThreadId () returned 0x970 [0077.603] GetCurrentThreadId () returned 0x970 [0077.603] GetCurrentThreadId () returned 0x970 [0077.603] GetCurrentThreadId () returned 0x970 [0077.603] GetCurrentThreadId () returned 0x970 [0077.603] GetCurrentThreadId () returned 0x970 [0077.603] GetCurrentThreadId () returned 0x970 [0077.603] GetCurrentThreadId () returned 0x970 [0077.603] GetCurrentThreadId () returned 0x970 [0077.603] GetCurrentThreadId () returned 0x970 [0077.603] GetCurrentThreadId () returned 0x970 [0077.603] GetCurrentThreadId () returned 0x970 [0077.603] GetCurrentThreadId () returned 0x970 [0077.603] GetCurrentThreadId () returned 0x970 [0077.603] GetCurrentThreadId () returned 0x970 [0077.603] GetCurrentThreadId () returned 0x970 [0077.603] GetCurrentThreadId () returned 0x970 [0077.603] GetCurrentThreadId () returned 0x970 [0077.603] GetCurrentThreadId () returned 0x970 [0077.603] GetCurrentThreadId () returned 0x970 [0077.603] GetCurrentThreadId () returned 0x970 [0077.603] GetCurrentThreadId () returned 0x970 [0077.603] GetCurrentThreadId () returned 0x970 [0077.603] GetCurrentThreadId () returned 0x970 [0077.603] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAHaM32yNsr4rwaybsx3gmhI33fYQfEo5/s4q5/5mVdq0Fyd8XdJ648dgQWsPw96o2BhtzWXqnFQYxge/cjMTG6q/oRSJLXSAUyDQaUMnnLmn8YuoyJzjcUdH4GWgIWb1NFZjIvoTlHi+r9NSVnwWLmCPFAmp2u3GtQf8sR7cOtSX+CiOZfBy2F4oHjz2fEQOUYjEQPle1r7t96DQsbAeR/xn1gzcGw89tw==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0077.603] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAHaM32yNsr4rwaybsx3gmhI33fYQfEo5/s4q5/5mVdq0Fyd8XdJ648dgQWsPw96o2BhtzWXqnFQYxge/cjMTG6q/oRSJLXSAUyDQaUMnnLmn8YuoyJzjcUdH4GWgIWb1NFZjIvoTlHi+r9NSVnwWLmCPFAmp2u3GtQf8sR7cOtSX+CiOZfBy2F4oHjz2fEQOUYjEQPle1r7t96DQsbAeR/xn1gzcGw89tw==", cchWideChar=245, lpMultiByteStr=0x3b4cd5c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAHaM32yNsr4rwaybsx3gmhI33fYQfEo5/s4q5/5mVdq0Fyd8XdJ648dgQWsPw96o2BhtzWXqnFQYxge/cjMTG6q/oRSJLXSAUyDQaUMnnLmn8YuoyJzjcUdH4GWgIWb1NFZjIvoTlHi+r9NSVnwWLmCPFAmp2u3GtQf8sR7cOtSX+CiOZfBy2F4oHjz2fEQOUYjEQPle1r7t96DQsbAeR/xn1gzcGw89tw==", lpUsedDefaultChar=0x0) returned 245 [0077.604] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0077.604] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0077.604] CloseHandle (hObject=0x158) returned 1 [0077.604] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\header-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\header-background.png")) returned 0 [0077.604] GetLastError () returned 0x5 [0077.604] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\header-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\header-background.png")) returned 0x20 [0077.604] SetLastError (dwErrCode=0x5) [0077.604] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=19786763321) returned 1 [0077.604] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Файл зашифрован [passport.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\Файл зашифрован [passport.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0077.605] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0077.605] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0077.605] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0077.605] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0077.605] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0077.605] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0077.605] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0077.605] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0077.605] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0077.605] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0077.605] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0077.605] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0077.605] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0077.606] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0077.606] SetEndOfFile (hFile=0x158) returned 1 [0077.606] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0077.606] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0077.606] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0077.606] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0077.606] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0077.607] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0077.607] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GzoRjW~W{jlu^gi\"uxDk@/p!@4*\\ukp%", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0077.607] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GzoRjW~W{jlu^gi\"uxDk@/p!@4*\\ukp%", cchWideChar=32, lpMultiByteStr=0x203997c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GzoRjW~W{jlu^gi\"uxDk@/p!@4*\\ukp%", lpUsedDefaultChar=0x0) returned 32 [0077.607] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0077.607] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0077.607] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport.png", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72701fd0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72701fd0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x55435557, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x3126b, dwReserved0=0x0, dwReserved1=0x0, cFileName="passport.png", cAlternateFileName="")) returned 0x295098 [0077.607] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0077.607] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0077.607] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport.png")) returned 0x20 [0077.608] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport.png")) returned 0x20 [0077.608] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport.png")) returned 0x20 [0077.608] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport.png")) returned 0x20 [0077.608] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72701fd0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72701fd0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x55435557, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x3126b)) returned 1 [0077.608] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0077.608] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0077.608] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport.png")) returned 0x20 [0077.608] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport.png")) returned 0x20 [0077.608] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0077.608] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0077.608] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0077.608] SetEndOfFile (hFile=0x158) returned 1 [0077.609] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="passport.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0077.609] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="passport.png", cchWideChar=12, lpMultiByteStr=0x1fe64ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="passport.png", lpUsedDefaultChar=0x0) returned 12 [0077.610] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="passport.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0077.610] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="passport.png", cchWideChar=12, lpMultiByteStr=0x1fe47cc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="passport.png", lpUsedDefaultChar=0x0) returned 12 [0077.610] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe47cc, cbMultiByte=12, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="passport.pngpngnd.pngggpng.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0077.610] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="passport.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0077.610] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="passport.png", cchWideChar=12, lpMultiByteStr=0x1fe64ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="passport.png", lpUsedDefaultChar=0x0) returned 12 [0077.610] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0077.610] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0077.610] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x3126b [0077.610] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0077.610] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0077.610] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0077.610] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="passport.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0077.610] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="passport.png", cchWideChar=12, lpMultiByteStr=0x1fe64ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="passport.png", lpUsedDefaultChar=0x0) returned 12 [0077.610] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="passport.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0077.610] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="passport.png", cchWideChar=12, lpMultiByteStr=0x1fe47cc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="passport.png", lpUsedDefaultChar=0x0) returned 12 [0077.611] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe47cc, cbMultiByte=12, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="passport.pngrt.pngpngnd.pngggpng.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0077.611] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="passport.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0077.611] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="passport.png", cchWideChar=12, lpMultiByteStr=0x1fe64ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="passport.png", lpUsedDefaultChar=0x0) returned 12 [0077.611] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0077.611] CharToOemA (in: pSrc="passport.png", pDst=0x1fe47cc | out: pDst="passport.png") returned 1 [0077.612] WriteFile (in: hFile=0x158, lpBuffer=0x1fe47cc*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe47cc*, lpNumberOfBytesWritten=0x18e048*=0xc, lpOverlapped=0x0) returned 1 [0077.612] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0077.612] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0077.612] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0077.612] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=19787538687) returned 1 [0077.612] ReadFile (in: hFile=0x11c, lpBuffer=0x37bea30, nNumberOfBytesToRead=0x3126b, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37bea30*, lpNumberOfBytesRead=0x18dd7c*=0x3126b, lpOverlapped=0x0) returned 1 [0077.615] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0077.616] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=19787896894) returned 1 [0077.624] WriteFile (in: hFile=0x158, lpBuffer=0x379adb0*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379adb0*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0077.624] ReadFile (in: hFile=0x11c, lpBuffer=0x37bea30, nNumberOfBytesToRead=0x3126b, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x37bea30*, lpNumberOfBytesRead=0x18de38*=0x3126b, lpOverlapped=0x0) returned 1 [0077.630] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x47 [0077.630] WriteFile (in: hFile=0x158, lpBuffer=0x380fdc0*, nNumberOfBytesToWrite=0x3126b, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x380fdc0*, lpNumberOfBytesWritten=0x18de10*=0x3126b, lpOverlapped=0x0) returned 1 [0077.633] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x312b2 [0077.633] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0077.634] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0077.634] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0077.634] SetFilePointer (in: hFile=0x158, lDistanceToMove=12, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2a [0077.634] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x312bc [0077.634] CloseHandle (hObject=0x11c) returned 1 [0077.634] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x312bc [0077.634] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x312bc [0077.634] SetFilePointer (in: hFile=0x158, lDistanceToMove=201404, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x312bc [0077.634] SetFilePointer (in: hFile=0x158, lDistanceToMove=201404, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x312bc [0077.634] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x312bc [0077.634] SetFilePointer (in: hFile=0x158, lDistanceToMove=201404, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x312bc [0077.634] SetEndOfFile (hFile=0x158) returned 1 [0077.634] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x312bc [0077.634] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x312bc [0077.635] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="passport.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0077.635] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="passport.png", cchWideChar=12, lpMultiByteStr=0x1fe64ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="passport.png", lpUsedDefaultChar=0x0) returned 12 [0077.635] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="passport.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0077.635] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="passport.png", cchWideChar=12, lpMultiByteStr=0x1fe376c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="passport.png", lpUsedDefaultChar=0x0) returned 12 [0077.635] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe376c, cbMultiByte=12, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="passport.pngꞗ@涤(\x18믉`믑`") returned 12 [0077.635] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="passport.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0077.635] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="passport.png", cchWideChar=12, lpMultiByteStr=0x1fe64ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="passport.png", lpUsedDefaultChar=0x0) returned 12 [0077.635] WriteFile (in: hFile=0x158, lpBuffer=0x3b54f88*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3b54f88*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0077.635] CharToOemA (in: pSrc="passport.png", pDst=0x1fe376c | out: pDst="passport.png") returned 1 [0077.635] WriteFile (in: hFile=0x158, lpBuffer=0x1fe376c*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe376c*, lpNumberOfBytesWritten=0x18efcc*=0xc, lpOverlapped=0x0) returned 1 [0077.635] WriteFile (in: hFile=0x158, lpBuffer=0x379ad88*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379ad88*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0077.635] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0077.635] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0077.635] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x31301 [0077.635] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x31301 [0077.635] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0077.636] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0077.636] DeleteFileW (lpFileName="") returned 0 [0077.636] GetLastError () returned 0x3 [0077.636] GetFileAttributesW (lpFileName="") returned 0xffffffff [0077.636] SetLastError (dwErrCode=0x3) [0077.636] FlushFileBuffers (hFile=0x158) returned 1 [0077.639] GetCurrentThreadId () returned 0x970 [0077.639] GetCurrentThreadId () returned 0x970 [0077.639] GetCurrentThreadId () returned 0x970 [0077.639] GetCurrentThreadId () returned 0x970 [0077.639] GetCurrentThreadId () returned 0x970 [0077.639] GetCurrentThreadId () returned 0x970 [0077.639] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x313b8 [0077.639] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x313b8 [0077.639] SetFilePointer (in: hFile=0x158, lDistanceToMove=201656, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x313b8 [0077.639] CloseHandle (hObject=0x158) returned 1 [0077.639] GetCurrentThreadId () returned 0x970 [0077.639] GetCurrentThreadId () returned 0x970 [0077.639] GetCurrentThreadId () returned 0x970 [0077.639] GetCurrentThreadId () returned 0x970 [0077.639] GetCurrentThreadId () returned 0x970 [0077.639] GetCurrentThreadId () returned 0x970 [0077.639] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Файл зашифрован [passport.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\Файл зашифрован [passport.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0077.640] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x313b8 [0077.640] SetFilePointer (in: hFile=0x158, lDistanceToMove=201528, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x31338 [0077.640] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0077.640] GetFileType (hFile=0x158) returned 0x1 [0077.640] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x18, wMilliseconds=0x396)) [0077.640] GetCurrentThreadId () returned 0x970 [0077.640] GetCurrentThreadId () returned 0x970 [0077.640] GetCurrentThreadId () returned 0x970 [0077.640] GetCurrentThreadId () returned 0x970 [0077.640] GetCurrentThreadId () returned 0x970 [0077.640] GetCurrentThreadId () returned 0x970 [0077.640] GetCurrentThreadId () returned 0x970 [0077.640] GetCurrentThreadId () returned 0x970 [0077.640] GetCurrentThreadId () returned 0x970 [0077.640] GetCurrentThreadId () returned 0x970 [0077.640] GetCurrentThreadId () returned 0x970 [0077.640] GetCurrentThreadId () returned 0x970 [0077.640] GetCurrentThreadId () returned 0x970 [0077.640] GetCurrentThreadId () returned 0x970 [0077.640] GetCurrentThreadId () returned 0x970 [0077.640] GetCurrentThreadId () returned 0x970 [0077.640] GetCurrentThreadId () returned 0x970 [0077.640] GetCurrentThreadId () returned 0x970 [0077.640] GetCurrentThreadId () returned 0x970 [0077.640] GetCurrentThreadId () returned 0x970 [0077.640] GetCurrentThreadId () returned 0x970 [0077.640] GetCurrentThreadId () returned 0x970 [0077.640] GetCurrentThreadId () returned 0x970 [0077.640] GetCurrentThreadId () returned 0x970 [0077.640] GetCurrentThreadId () returned 0x970 [0077.640] GetCurrentThreadId () returned 0x970 [0077.640] GetCurrentThreadId () returned 0x970 [0077.640] GetCurrentThreadId () returned 0x970 [0077.640] GetCurrentThreadId () returned 0x970 [0077.640] GetCurrentThreadId () returned 0x970 [0077.640] GetCurrentThreadId () returned 0x970 [0077.640] GetCurrentThreadId () returned 0x970 [0077.640] GetCurrentThreadId () returned 0x970 [0077.641] GetCurrentThreadId () returned 0x970 [0077.641] GetCurrentThreadId () returned 0x970 [0077.641] GetCurrentThreadId () returned 0x970 [0077.641] GetCurrentThreadId () returned 0x970 [0077.641] GetCurrentThreadId () returned 0x970 [0077.641] GetCurrentThreadId () returned 0x970 [0077.641] GetCurrentThreadId () returned 0x970 [0077.641] GetCurrentThreadId () returned 0x970 [0077.641] GetCurrentThreadId () returned 0x970 [0077.641] GetCurrentThreadId () returned 0x970 [0077.641] GetCurrentThreadId () returned 0x970 [0077.641] GetCurrentThreadId () returned 0x970 [0077.641] GetCurrentThreadId () returned 0x970 [0077.641] GetCurrentThreadId () returned 0x970 [0077.641] GetCurrentThreadId () returned 0x970 [0077.641] GetCurrentThreadId () returned 0x970 [0077.641] GetCurrentThreadId () returned 0x970 [0077.641] GetCurrentThreadId () returned 0x970 [0077.641] GetCurrentThreadId () returned 0x970 [0077.641] GetCurrentThreadId () returned 0x970 [0077.641] GetCurrentThreadId () returned 0x970 [0077.641] GetCurrentThreadId () returned 0x970 [0077.641] GetCurrentThreadId () returned 0x970 [0077.641] GetCurrentThreadId () returned 0x970 [0077.641] GetCurrentThreadId () returned 0x970 [0077.641] GetCurrentThreadId () returned 0x970 [0077.641] GetCurrentThreadId () returned 0x970 [0077.641] GetCurrentThreadId () returned 0x970 [0077.641] GetCurrentThreadId () returned 0x970 [0077.641] GetCurrentThreadId () returned 0x970 [0077.641] GetCurrentThreadId () returned 0x970 [0077.641] GetCurrentThreadId () returned 0x970 [0077.641] GetCurrentThreadId () returned 0x970 [0077.641] GetCurrentThreadId () returned 0x970 [0077.641] GetCurrentThreadId () returned 0x970 [0077.641] GetCurrentThreadId () returned 0x970 [0077.641] GetCurrentThreadId () returned 0x970 [0077.641] GetCurrentThreadId () returned 0x970 [0077.641] GetCurrentThreadId () returned 0x970 [0077.641] GetCurrentThreadId () returned 0x970 [0077.641] GetCurrentThreadId () returned 0x970 [0077.641] GetCurrentThreadId () returned 0x970 [0077.641] GetCurrentThreadId () returned 0x970 [0077.641] GetCurrentThreadId () returned 0x970 [0077.641] GetCurrentThreadId () returned 0x970 [0077.642] GetCurrentThreadId () returned 0x970 [0077.642] GetCurrentThreadId () returned 0x970 [0077.642] GetCurrentThreadId () returned 0x970 [0077.642] GetCurrentThreadId () returned 0x970 [0077.642] GetCurrentThreadId () returned 0x970 [0077.642] GetCurrentThreadId () returned 0x970 [0077.642] GetCurrentThreadId () returned 0x970 [0077.642] GetCurrentThreadId () returned 0x970 [0077.642] GetCurrentThreadId () returned 0x970 [0077.642] GetCurrentThreadId () returned 0x970 [0077.642] GetCurrentThreadId () returned 0x970 [0077.642] GetCurrentThreadId () returned 0x970 [0077.642] GetCurrentThreadId () returned 0x970 [0077.642] GetCurrentThreadId () returned 0x970 [0077.642] GetCurrentThreadId () returned 0x970 [0077.642] GetCurrentThreadId () returned 0x970 [0077.642] GetCurrentThreadId () returned 0x970 [0077.642] GetCurrentThreadId () returned 0x970 [0077.642] GetCurrentThreadId () returned 0x970 [0077.642] GetCurrentThreadId () returned 0x970 [0077.642] GetCurrentThreadId () returned 0x970 [0077.642] GetCurrentThreadId () returned 0x970 [0077.642] GetCurrentThreadId () returned 0x970 [0077.642] GetCurrentThreadId () returned 0x970 [0077.642] GetCurrentThreadId () returned 0x970 [0077.642] GetCurrentThreadId () returned 0x970 [0077.642] GetCurrentThreadId () returned 0x970 [0077.642] GetCurrentThreadId () returned 0x970 [0077.642] GetCurrentThreadId () returned 0x970 [0077.642] GetCurrentThreadId () returned 0x970 [0077.642] GetCurrentThreadId () returned 0x970 [0077.642] GetCurrentThreadId () returned 0x970 [0077.642] GetCurrentThreadId () returned 0x970 [0077.642] GetCurrentThreadId () returned 0x970 [0077.642] GetCurrentThreadId () returned 0x970 [0077.642] GetCurrentThreadId () returned 0x970 [0077.642] GetCurrentThreadId () returned 0x970 [0077.642] GetCurrentThreadId () returned 0x970 [0077.642] GetCurrentThreadId () returned 0x970 [0077.642] GetCurrentThreadId () returned 0x970 [0077.642] GetCurrentThreadId () returned 0x970 [0077.642] GetCurrentThreadId () returned 0x970 [0077.642] GetCurrentThreadId () returned 0x970 [0077.642] GetCurrentThreadId () returned 0x970 [0077.642] GetCurrentThreadId () returned 0x970 [0077.642] GetCurrentThreadId () returned 0x970 [0077.643] GetCurrentThreadId () returned 0x970 [0077.643] GetCurrentThreadId () returned 0x970 [0077.643] GetCurrentThreadId () returned 0x970 [0077.643] GetCurrentThreadId () returned 0x970 [0077.643] GetCurrentThreadId () returned 0x970 [0077.643] GetCurrentThreadId () returned 0x970 [0077.643] GetCurrentThreadId () returned 0x970 [0077.643] GetCurrentThreadId () returned 0x970 [0077.643] GetCurrentThreadId () returned 0x970 [0077.643] GetCurrentThreadId () returned 0x970 [0077.643] GetCurrentThreadId () returned 0x970 [0077.643] GetCurrentThreadId () returned 0x970 [0077.643] GetCurrentThreadId () returned 0x970 [0077.643] GetCurrentThreadId () returned 0x970 [0077.643] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.643] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.643] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a14d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.643] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.643] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.643] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a14d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.643] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.643] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.643] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.643] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.643] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.643] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.643] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.643] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.643] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a1538, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.643] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.643] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.643] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a1538, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.643] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.643] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.643] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a1538, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.644] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x18, wMilliseconds=0x396)) [0077.644] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GzoRjW~W{jlu^gi\"uxDk@/p!@4*\\ukp%", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0077.644] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GzoRjW~W{jlu^gi\"uxDk@/p!@4*\\ukp%", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0077.644] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GzoRjW~W{jlu^gi\"uxDk@/p!@4*\\ukp%", cchWideChar=32, lpMultiByteStr=0x3b58278, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GzoRjW~W{jlu^gi\"uxDk@/p!@4*\\ukp%", lpUsedDefaultChar=0x0) returned 32 [0077.644] GetCurrentThreadId () returned 0x970 [0077.644] GetCurrentThreadId () returned 0x970 [0077.644] GetCurrentThreadId () returned 0x970 [0077.644] GetCurrentThreadId () returned 0x970 [0077.644] GetCurrentThreadId () returned 0x970 [0077.644] GetCurrentThreadId () returned 0x970 [0077.651] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0077.651] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0077.651] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3b430a8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0077.651] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34edf48, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0077.651] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34edf48, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAHCHgFJIs9mRVXwlITY6b9dBreUc+FhJWbVcBTi4qGlmWwFHhCh8Z45ANggRpChmd3mAVqztbawac1BxzxjcQ76e0fkwjAHImtHHUC8fjsmWxF4udV8N67Bm0W3BE0btQFBFjy74IHsTntDyU6rOi6zvrtK+tMxqe45p+Bsz+cynUE7K+9BUfXj88hWalyqCL/pfSWlyOyWOJczDMGzkIt4StziBOEP2Qw==") returned 232 [0077.651] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x18, wMilliseconds=0x396)) [0077.651] GetCurrentThreadId () returned 0x970 [0077.651] GetCurrentThreadId () returned 0x970 [0077.651] GetCurrentThreadId () returned 0x970 [0077.651] GetCurrentThreadId () returned 0x970 [0077.652] GetCurrentThreadId () returned 0x970 [0077.652] GetCurrentThreadId () returned 0x970 [0077.652] GetCurrentThreadId () returned 0x970 [0077.652] GetCurrentThreadId () returned 0x970 [0077.652] GetCurrentThreadId () returned 0x970 [0077.652] GetCurrentThreadId () returned 0x970 [0077.652] GetCurrentThreadId () returned 0x970 [0077.652] GetCurrentThreadId () returned 0x970 [0077.652] GetCurrentThreadId () returned 0x970 [0077.652] GetCurrentThreadId () returned 0x970 [0077.652] GetCurrentThreadId () returned 0x970 [0077.652] GetCurrentThreadId () returned 0x970 [0077.652] GetCurrentThreadId () returned 0x970 [0077.652] GetCurrentThreadId () returned 0x970 [0077.652] GetCurrentThreadId () returned 0x970 [0077.652] GetCurrentThreadId () returned 0x970 [0077.652] GetCurrentThreadId () returned 0x970 [0077.652] GetCurrentThreadId () returned 0x970 [0077.652] GetCurrentThreadId () returned 0x970 [0077.652] GetCurrentThreadId () returned 0x970 [0077.652] GetCurrentThreadId () returned 0x970 [0077.652] GetCurrentThreadId () returned 0x970 [0077.652] GetCurrentThreadId () returned 0x970 [0077.652] GetCurrentThreadId () returned 0x970 [0077.652] GetCurrentThreadId () returned 0x970 [0077.652] GetCurrentThreadId () returned 0x970 [0077.652] GetCurrentThreadId () returned 0x970 [0077.652] GetCurrentThreadId () returned 0x970 [0077.652] GetCurrentThreadId () returned 0x970 [0077.652] GetCurrentThreadId () returned 0x970 [0077.652] GetCurrentThreadId () returned 0x970 [0077.652] GetCurrentThreadId () returned 0x970 [0077.652] GetCurrentThreadId () returned 0x970 [0077.652] GetCurrentThreadId () returned 0x970 [0077.652] GetCurrentThreadId () returned 0x970 [0077.652] GetCurrentThreadId () returned 0x970 [0077.652] GetCurrentThreadId () returned 0x970 [0077.652] GetCurrentThreadId () returned 0x970 [0077.652] GetCurrentThreadId () returned 0x970 [0077.652] GetCurrentThreadId () returned 0x970 [0077.652] GetCurrentThreadId () returned 0x970 [0077.652] GetCurrentThreadId () returned 0x970 [0077.652] GetCurrentThreadId () returned 0x970 [0077.652] GetCurrentThreadId () returned 0x970 [0077.653] GetCurrentThreadId () returned 0x970 [0077.653] GetCurrentThreadId () returned 0x970 [0077.653] GetCurrentThreadId () returned 0x970 [0077.653] GetCurrentThreadId () returned 0x970 [0077.653] GetCurrentThreadId () returned 0x970 [0077.653] GetCurrentThreadId () returned 0x970 [0077.653] GetCurrentThreadId () returned 0x970 [0077.653] GetCurrentThreadId () returned 0x970 [0077.653] GetCurrentThreadId () returned 0x970 [0077.653] GetCurrentThreadId () returned 0x970 [0077.653] GetCurrentThreadId () returned 0x970 [0077.653] GetCurrentThreadId () returned 0x970 [0077.653] GetCurrentThreadId () returned 0x970 [0077.653] GetCurrentThreadId () returned 0x970 [0077.653] GetCurrentThreadId () returned 0x970 [0077.653] GetCurrentThreadId () returned 0x970 [0077.653] GetCurrentThreadId () returned 0x970 [0077.653] GetCurrentThreadId () returned 0x970 [0077.653] GetCurrentThreadId () returned 0x970 [0077.653] GetCurrentThreadId () returned 0x970 [0077.653] GetCurrentThreadId () returned 0x970 [0077.653] GetCurrentThreadId () returned 0x970 [0077.653] GetCurrentThreadId () returned 0x970 [0077.653] GetCurrentThreadId () returned 0x970 [0077.653] GetCurrentThreadId () returned 0x970 [0077.653] GetCurrentThreadId () returned 0x970 [0077.653] GetCurrentThreadId () returned 0x970 [0077.653] GetCurrentThreadId () returned 0x970 [0077.653] GetCurrentThreadId () returned 0x970 [0077.653] GetCurrentThreadId () returned 0x970 [0077.653] GetCurrentThreadId () returned 0x970 [0077.653] GetCurrentThreadId () returned 0x970 [0077.653] GetCurrentThreadId () returned 0x970 [0077.653] GetCurrentThreadId () returned 0x970 [0077.653] GetCurrentThreadId () returned 0x970 [0077.653] GetCurrentThreadId () returned 0x970 [0077.653] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAHCHgFJIs9mRVXwlITY6b9dBreUc+FhJWbVcBTi4qGlmWwFHhCh8Z45ANggRpChmd3mAVqztbawac1BxzxjcQ76e0fkwjAHImtHHUC8fjsmWxF4udV8N67Bm0W3BE0btQFBFjy74IHsTntDyU6rOi6zvrtK+tMxqe45p+Bsz+cynUE7K+9BUfXj88hWalyqCL/pfSWlyOyWOJczDMGzkIt4StziBOEP2Qw==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0077.653] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAHCHgFJIs9mRVXwlITY6b9dBreUc+FhJWbVcBTi4qGlmWwFHhCh8Z45ANggRpChmd3mAVqztbawac1BxzxjcQ76e0fkwjAHImtHHUC8fjsmWxF4udV8N67Bm0W3BE0btQFBFjy74IHsTntDyU6rOi6zvrtK+tMxqe45p+Bsz+cynUE7K+9BUfXj88hWalyqCL/pfSWlyOyWOJczDMGzkIt4StziBOEP2Qw==", cchWideChar=245, lpMultiByteStr=0x3b4cd5c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAHCHgFJIs9mRVXwlITY6b9dBreUc+FhJWbVcBTi4qGlmWwFHhCh8Z45ANggRpChmd3mAVqztbawac1BxzxjcQ76e0fkwjAHImtHHUC8fjsmWxF4udV8N67Bm0W3BE0btQFBFjy74IHsTntDyU6rOi6zvrtK+tMxqe45p+Bsz+cynUE7K+9BUfXj88hWalyqCL/pfSWlyOyWOJczDMGzkIt4StziBOEP2Qw==", lpUsedDefaultChar=0x0) returned 245 [0077.653] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0077.654] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0077.654] CloseHandle (hObject=0x158) returned 1 [0077.654] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport.png")) returned 0 [0077.654] GetLastError () returned 0x5 [0077.654] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport.png")) returned 0x20 [0077.654] SetLastError (dwErrCode=0x5) [0077.654] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=19791770757) returned 1 [0077.654] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Файл зашифрован [passportcover.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\Файл зашифрован [passportcover.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0077.655] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0077.655] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0077.655] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0077.655] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0077.655] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0077.655] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0077.655] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0077.655] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0077.655] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0077.655] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0077.655] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0077.656] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0077.656] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0077.656] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0077.656] SetEndOfFile (hFile=0x158) returned 1 [0077.656] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0077.656] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0077.656] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0077.656] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0077.656] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0077.657] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0077.657] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HHRGSXUn\"j\"~=YP0{Ae+3JHAsC/w15B3", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0077.657] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HHRGSXUn\"j\"~=YP0{Ae+3JHAsC/w15B3", cchWideChar=32, lpMultiByteStr=0x2039b3c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HHRGSXUn\"j\"~=YP0{Ae+3JHAsC/w15B3", lpUsedDefaultChar=0x0) returned 32 [0077.657] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0077.657] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0077.657] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passportcover.png", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x727e67fe, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x727e67fe, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5545b6b5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x58bf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="passportcover.png", cAlternateFileName="")) returned 0x295098 [0077.657] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0077.657] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0077.657] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passportcover.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportcover.png")) returned 0x20 [0077.658] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passportcover.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportcover.png")) returned 0x20 [0077.658] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passportcover.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportcover.png")) returned 0x20 [0077.658] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passportcover.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportcover.png")) returned 0x20 [0077.658] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passportcover.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportcover.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x727e67fe, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x727e67fe, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5545b6b5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x58bf8)) returned 1 [0077.658] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0077.658] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0077.658] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passportcover.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportcover.png")) returned 0x20 [0077.658] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passportcover.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportcover.png")) returned 0x20 [0077.659] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0077.659] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0077.659] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0077.659] SetEndOfFile (hFile=0x158) returned 1 [0077.659] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="passportcover.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0077.660] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="passportcover.png", cchWideChar=17, lpMultiByteStr=0x1ff885c, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="passportcover.png", lpUsedDefaultChar=0x0) returned 17 [0077.660] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="passportcover.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0077.660] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="passportcover.png", cchWideChar=17, lpMultiByteStr=0x1ff894c, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="passportcover.png", lpUsedDefaultChar=0x0) returned 17 [0077.660] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff894c, cbMultiByte=17, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="passportcover.png.pngggpng.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 17 [0077.660] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="passportcover.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0077.660] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="passportcover.png", cchWideChar=17, lpMultiByteStr=0x1ff885c, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="passportcover.png", lpUsedDefaultChar=0x0) returned 17 [0077.660] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passportcover.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportcover.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0077.660] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0077.660] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x58bf8 [0077.660] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0077.660] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0077.660] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0077.660] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="passportcover.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0077.660] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="passportcover.png", cchWideChar=17, lpMultiByteStr=0x1ff885c, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="passportcover.png", lpUsedDefaultChar=0x0) returned 17 [0077.661] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="passportcover.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0077.661] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="passportcover.png", cchWideChar=17, lpMultiByteStr=0x1ff894c, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="passportcover.png", lpUsedDefaultChar=0x0) returned 17 [0077.661] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff894c, cbMultiByte=17, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="passportcover.pnger.png.pngggpng.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 17 [0077.661] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="passportcover.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0077.661] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="passportcover.png", cchWideChar=17, lpMultiByteStr=0x1ff885c, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="passportcover.png", lpUsedDefaultChar=0x0) returned 17 [0077.661] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0077.662] CharToOemA (in: pSrc="passportcover.png", pDst=0x1ff894c | out: pDst="passportcover.png") returned 1 [0077.662] WriteFile (in: hFile=0x158, lpBuffer=0x1ff894c*, nNumberOfBytesToWrite=0x11, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1ff894c*, lpNumberOfBytesWritten=0x18e048*=0x11, lpOverlapped=0x0) returned 1 [0077.662] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0077.662] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0077.662] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0077.662] VirtualAlloc (lpAddress=0x0, dwSize=0x60000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ef40000 [0077.662] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=19792578204) returned 1 [0077.662] ReadFile (in: hFile=0x11c, lpBuffer=0x7ef40010, nNumberOfBytesToRead=0x58bf8, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x7ef40010*, lpNumberOfBytesRead=0x18dd7c*=0x58bf8, lpOverlapped=0x0) returned 1 [0077.672] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0077.673] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=19793601652) returned 1 [0077.681] WriteFile (in: hFile=0x158, lpBuffer=0x379acd8*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379acd8*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0077.681] ReadFile (in: hFile=0x11c, lpBuffer=0x7ef40010, nNumberOfBytesToRead=0x58bf8, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x7ef40010*, lpNumberOfBytesRead=0x18de38*=0x58bf8, lpOverlapped=0x0) returned 1 [0077.682] VirtualAlloc (lpAddress=0x0, dwSize=0x60000, flAllocationType=0x101000, flProtect=0x4) returned 0x7eee0000 [0077.687] VirtualAlloc (lpAddress=0x0, dwSize=0x60000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ee80000 [0077.702] VirtualFree (lpAddress=0x7ee80000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0077.704] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x4c [0077.704] WriteFile (in: hFile=0x158, lpBuffer=0x7eee0010*, nNumberOfBytesToWrite=0x58bf8, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x7eee0010*, lpNumberOfBytesWritten=0x18de10*=0x58bf8, lpOverlapped=0x0) returned 1 [0077.710] VirtualFree (lpAddress=0x7eee0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0077.712] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x58c44 [0077.712] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0077.712] VirtualFree (lpAddress=0x7ef40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0077.714] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0077.714] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0077.714] SetFilePointer (in: hFile=0x158, lDistanceToMove=17, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2f [0077.714] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x58c4e [0077.714] CloseHandle (hObject=0x11c) returned 1 [0077.714] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x58c4e [0077.714] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x58c4e [0077.715] SetFilePointer (in: hFile=0x158, lDistanceToMove=363598, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x58c4e [0077.715] SetFilePointer (in: hFile=0x158, lDistanceToMove=363598, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x58c4e [0077.715] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x58c4e [0077.715] SetFilePointer (in: hFile=0x158, lDistanceToMove=363598, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x58c4e [0077.715] SetEndOfFile (hFile=0x158) returned 1 [0077.715] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x58c4e [0077.715] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x58c4e [0077.715] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="passportcover.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0077.715] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="passportcover.png", cchWideChar=17, lpMultiByteStr=0x1ff894c, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="passportcover.png", lpUsedDefaultChar=0x0) returned 17 [0077.715] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="passportcover.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0077.715] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="passportcover.png", cchWideChar=17, lpMultiByteStr=0x1ff885c, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="passportcover.png", lpUsedDefaultChar=0x0) returned 17 [0077.715] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff885c, cbMultiByte=17, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="passportcover.png\x18믉`믑`") returned 17 [0077.715] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="passportcover.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0077.715] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="passportcover.png", cchWideChar=17, lpMultiByteStr=0x1ff894c, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="passportcover.png", lpUsedDefaultChar=0x0) returned 17 [0077.715] WriteFile (in: hFile=0x158, lpBuffer=0x3b54f88*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3b54f88*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0077.715] CharToOemA (in: pSrc="passportcover.png", pDst=0x1ff885c | out: pDst="passportcover.png") returned 1 [0077.715] WriteFile (in: hFile=0x158, lpBuffer=0x1ff885c*, nNumberOfBytesToWrite=0x11, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1ff885c*, lpNumberOfBytesWritten=0x18efcc*=0x11, lpOverlapped=0x0) returned 1 [0077.716] WriteFile (in: hFile=0x158, lpBuffer=0x379ade8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379ade8*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0077.716] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0077.716] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0077.716] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x58c98 [0077.716] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x58c98 [0077.716] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0077.716] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0077.716] DeleteFileW (lpFileName="") returned 0 [0077.716] GetLastError () returned 0x3 [0077.716] GetFileAttributesW (lpFileName="") returned 0xffffffff [0077.716] SetLastError (dwErrCode=0x3) [0077.716] FlushFileBuffers (hFile=0x158) returned 1 [0077.720] GetCurrentThreadId () returned 0x970 [0077.720] GetCurrentThreadId () returned 0x970 [0077.720] GetCurrentThreadId () returned 0x970 [0077.720] GetCurrentThreadId () returned 0x970 [0077.720] GetCurrentThreadId () returned 0x970 [0077.720] GetCurrentThreadId () returned 0x970 [0077.720] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x58d4f [0077.720] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x58d4f [0077.720] SetFilePointer (in: hFile=0x158, lDistanceToMove=363855, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x58d4f [0077.720] CloseHandle (hObject=0x158) returned 1 [0077.721] GetCurrentThreadId () returned 0x970 [0077.721] GetCurrentThreadId () returned 0x970 [0077.721] GetCurrentThreadId () returned 0x970 [0077.721] GetCurrentThreadId () returned 0x970 [0077.721] GetCurrentThreadId () returned 0x970 [0077.721] GetCurrentThreadId () returned 0x970 [0077.721] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Файл зашифрован [passportcover.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\Файл зашифрован [passportcover.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0077.721] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x58d4f [0077.721] SetFilePointer (in: hFile=0x158, lDistanceToMove=363727, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x58ccf [0077.721] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0077.721] GetFileType (hFile=0x158) returned 0x1 [0077.721] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x18, wMilliseconds=0x3e4)) [0077.721] GetCurrentThreadId () returned 0x970 [0077.721] GetCurrentThreadId () returned 0x970 [0077.721] GetCurrentThreadId () returned 0x970 [0077.721] GetCurrentThreadId () returned 0x970 [0077.721] GetCurrentThreadId () returned 0x970 [0077.721] GetCurrentThreadId () returned 0x970 [0077.721] GetCurrentThreadId () returned 0x970 [0077.721] GetCurrentThreadId () returned 0x970 [0077.721] GetCurrentThreadId () returned 0x970 [0077.721] GetCurrentThreadId () returned 0x970 [0077.721] GetCurrentThreadId () returned 0x970 [0077.721] GetCurrentThreadId () returned 0x970 [0077.721] GetCurrentThreadId () returned 0x970 [0077.721] GetCurrentThreadId () returned 0x970 [0077.722] GetCurrentThreadId () returned 0x970 [0077.722] GetCurrentThreadId () returned 0x970 [0077.722] GetCurrentThreadId () returned 0x970 [0077.722] GetCurrentThreadId () returned 0x970 [0077.722] GetCurrentThreadId () returned 0x970 [0077.722] GetCurrentThreadId () returned 0x970 [0077.722] GetCurrentThreadId () returned 0x970 [0077.722] GetCurrentThreadId () returned 0x970 [0077.722] GetCurrentThreadId () returned 0x970 [0077.722] GetCurrentThreadId () returned 0x970 [0077.722] GetCurrentThreadId () returned 0x970 [0077.722] GetCurrentThreadId () returned 0x970 [0077.722] GetCurrentThreadId () returned 0x970 [0077.722] GetCurrentThreadId () returned 0x970 [0077.722] GetCurrentThreadId () returned 0x970 [0077.722] GetCurrentThreadId () returned 0x970 [0077.722] GetCurrentThreadId () returned 0x970 [0077.722] GetCurrentThreadId () returned 0x970 [0077.722] GetCurrentThreadId () returned 0x970 [0077.722] GetCurrentThreadId () returned 0x970 [0077.722] GetCurrentThreadId () returned 0x970 [0077.722] GetCurrentThreadId () returned 0x970 [0077.722] GetCurrentThreadId () returned 0x970 [0077.722] GetCurrentThreadId () returned 0x970 [0077.722] GetCurrentThreadId () returned 0x970 [0077.722] GetCurrentThreadId () returned 0x970 [0077.722] GetCurrentThreadId () returned 0x970 [0077.722] GetCurrentThreadId () returned 0x970 [0077.722] GetCurrentThreadId () returned 0x970 [0077.722] GetCurrentThreadId () returned 0x970 [0077.722] GetCurrentThreadId () returned 0x970 [0077.722] GetCurrentThreadId () returned 0x970 [0077.722] GetCurrentThreadId () returned 0x970 [0077.722] GetCurrentThreadId () returned 0x970 [0077.722] GetCurrentThreadId () returned 0x970 [0077.722] GetCurrentThreadId () returned 0x970 [0077.722] GetCurrentThreadId () returned 0x970 [0077.722] GetCurrentThreadId () returned 0x970 [0077.722] GetCurrentThreadId () returned 0x970 [0077.722] GetCurrentThreadId () returned 0x970 [0077.722] GetCurrentThreadId () returned 0x970 [0077.722] GetCurrentThreadId () returned 0x970 [0077.722] GetCurrentThreadId () returned 0x970 [0077.722] GetCurrentThreadId () returned 0x970 [0077.722] GetCurrentThreadId () returned 0x970 [0077.723] GetCurrentThreadId () returned 0x970 [0077.723] GetCurrentThreadId () returned 0x970 [0077.723] GetCurrentThreadId () returned 0x970 [0077.723] GetCurrentThreadId () returned 0x970 [0077.723] GetCurrentThreadId () returned 0x970 [0077.723] GetCurrentThreadId () returned 0x970 [0077.723] GetCurrentThreadId () returned 0x970 [0077.723] GetCurrentThreadId () returned 0x970 [0077.723] GetCurrentThreadId () returned 0x970 [0077.723] GetCurrentThreadId () returned 0x970 [0077.723] GetCurrentThreadId () returned 0x970 [0077.723] GetCurrentThreadId () returned 0x970 [0077.723] GetCurrentThreadId () returned 0x970 [0077.723] GetCurrentThreadId () returned 0x970 [0077.723] GetCurrentThreadId () returned 0x970 [0077.723] GetCurrentThreadId () returned 0x970 [0077.723] GetCurrentThreadId () returned 0x970 [0077.723] GetCurrentThreadId () returned 0x970 [0077.723] GetCurrentThreadId () returned 0x970 [0077.723] GetCurrentThreadId () returned 0x970 [0077.723] GetCurrentThreadId () returned 0x970 [0077.723] GetCurrentThreadId () returned 0x970 [0077.723] GetCurrentThreadId () returned 0x970 [0077.723] GetCurrentThreadId () returned 0x970 [0077.723] GetCurrentThreadId () returned 0x970 [0077.723] GetCurrentThreadId () returned 0x970 [0077.723] GetCurrentThreadId () returned 0x970 [0077.723] GetCurrentThreadId () returned 0x970 [0077.723] GetCurrentThreadId () returned 0x970 [0077.723] GetCurrentThreadId () returned 0x970 [0077.723] GetCurrentThreadId () returned 0x970 [0077.723] GetCurrentThreadId () returned 0x970 [0077.723] GetCurrentThreadId () returned 0x970 [0077.723] GetCurrentThreadId () returned 0x970 [0077.723] GetCurrentThreadId () returned 0x970 [0077.723] GetCurrentThreadId () returned 0x970 [0077.723] GetCurrentThreadId () returned 0x970 [0077.723] GetCurrentThreadId () returned 0x970 [0077.723] GetCurrentThreadId () returned 0x970 [0077.723] GetCurrentThreadId () returned 0x970 [0077.723] GetCurrentThreadId () returned 0x970 [0077.723] GetCurrentThreadId () returned 0x970 [0077.723] GetCurrentThreadId () returned 0x970 [0077.723] GetCurrentThreadId () returned 0x970 [0077.723] GetCurrentThreadId () returned 0x970 [0077.724] GetCurrentThreadId () returned 0x970 [0077.724] GetCurrentThreadId () returned 0x970 [0077.724] GetCurrentThreadId () returned 0x970 [0077.724] GetCurrentThreadId () returned 0x970 [0077.724] GetCurrentThreadId () returned 0x970 [0077.724] GetCurrentThreadId () returned 0x970 [0077.724] GetCurrentThreadId () returned 0x970 [0077.724] GetCurrentThreadId () returned 0x970 [0077.724] GetCurrentThreadId () returned 0x970 [0077.724] GetCurrentThreadId () returned 0x970 [0077.724] GetCurrentThreadId () returned 0x970 [0077.724] GetCurrentThreadId () returned 0x970 [0077.724] GetCurrentThreadId () returned 0x970 [0077.724] GetCurrentThreadId () returned 0x970 [0077.724] GetCurrentThreadId () returned 0x970 [0077.724] GetCurrentThreadId () returned 0x970 [0077.724] GetCurrentThreadId () returned 0x970 [0077.724] GetCurrentThreadId () returned 0x970 [0077.724] GetCurrentThreadId () returned 0x970 [0077.724] GetCurrentThreadId () returned 0x970 [0077.724] GetCurrentThreadId () returned 0x970 [0077.724] GetCurrentThreadId () returned 0x970 [0077.724] GetCurrentThreadId () returned 0x970 [0077.724] GetCurrentThreadId () returned 0x970 [0077.724] GetCurrentThreadId () returned 0x970 [0077.724] GetCurrentThreadId () returned 0x970 [0077.724] GetCurrentThreadId () returned 0x970 [0077.724] GetCurrentThreadId () returned 0x970 [0077.724] GetCurrentThreadId () returned 0x970 [0077.724] GetCurrentThreadId () returned 0x970 [0077.724] GetCurrentThreadId () returned 0x970 [0077.724] GetCurrentThreadId () returned 0x970 [0077.724] GetCurrentThreadId () returned 0x970 [0077.724] GetCurrentThreadId () returned 0x970 [0077.724] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.724] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.724] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a1538, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.724] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.724] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.724] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a1538, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.724] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.724] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.725] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.725] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.725] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.725] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.725] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.725] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.725] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a1598, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.725] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.725] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.725] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a1598, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.725] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.725] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.725] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a1598, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.725] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x18, wMilliseconds=0x3e4)) [0077.725] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HHRGSXUn\"j\"~=YP0{Ae+3JHAsC/w15B3", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0077.725] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HHRGSXUn\"j\"~=YP0{Ae+3JHAsC/w15B3", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0077.725] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HHRGSXUn\"j\"~=YP0{Ae+3JHAsC/w15B3", cchWideChar=32, lpMultiByteStr=0x3b5f578, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HHRGSXUn\"j\"~=YP0{Ae+3JHAsC/w15B3", lpUsedDefaultChar=0x0) returned 32 [0077.725] GetCurrentThreadId () returned 0x970 [0077.725] GetCurrentThreadId () returned 0x970 [0077.725] GetCurrentThreadId () returned 0x970 [0077.725] GetCurrentThreadId () returned 0x970 [0077.725] GetCurrentThreadId () returned 0x970 [0077.725] GetCurrentThreadId () returned 0x970 [0077.733] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0077.733] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0077.733] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3b43198, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0077.733] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34edf48, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0077.733] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34edf48, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAE1U77fj8/feJFgE5/abjgCkuiTY03obMU1AJ7UQQR52b782VQ03Z8ETFU4Yg2A6BJi3hLmWHyatBYrZEyKKaWIlVLl3pMWVC5jm8/Qu7hozJeuLMbrDm0EL7VdGMbYUxCbjK2AxI+dVs2XYmduaQVKzleMq7ZGW3AwPE7e1z2Fxo6L6Pf9zOJoSvedbIebT0XnOoiutNkW5ElBfyEbsXdbuSv7DIHJ13w==") returned 232 [0077.733] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x19, wMilliseconds=0xc)) [0077.733] GetCurrentThreadId () returned 0x970 [0077.733] GetCurrentThreadId () returned 0x970 [0077.733] GetCurrentThreadId () returned 0x970 [0077.733] GetCurrentThreadId () returned 0x970 [0077.733] GetCurrentThreadId () returned 0x970 [0077.733] GetCurrentThreadId () returned 0x970 [0077.733] GetCurrentThreadId () returned 0x970 [0077.733] GetCurrentThreadId () returned 0x970 [0077.733] GetCurrentThreadId () returned 0x970 [0077.733] GetCurrentThreadId () returned 0x970 [0077.733] GetCurrentThreadId () returned 0x970 [0077.733] GetCurrentThreadId () returned 0x970 [0077.733] GetCurrentThreadId () returned 0x970 [0077.733] GetCurrentThreadId () returned 0x970 [0077.733] GetCurrentThreadId () returned 0x970 [0077.733] GetCurrentThreadId () returned 0x970 [0077.734] GetCurrentThreadId () returned 0x970 [0077.734] GetCurrentThreadId () returned 0x970 [0077.734] GetCurrentThreadId () returned 0x970 [0077.734] GetCurrentThreadId () returned 0x970 [0077.734] GetCurrentThreadId () returned 0x970 [0077.734] GetCurrentThreadId () returned 0x970 [0077.734] GetCurrentThreadId () returned 0x970 [0077.734] GetCurrentThreadId () returned 0x970 [0077.734] GetCurrentThreadId () returned 0x970 [0077.734] GetCurrentThreadId () returned 0x970 [0077.734] GetCurrentThreadId () returned 0x970 [0077.734] GetCurrentThreadId () returned 0x970 [0077.734] GetCurrentThreadId () returned 0x970 [0077.734] GetCurrentThreadId () returned 0x970 [0077.734] GetCurrentThreadId () returned 0x970 [0077.734] GetCurrentThreadId () returned 0x970 [0077.734] GetCurrentThreadId () returned 0x970 [0077.734] GetCurrentThreadId () returned 0x970 [0077.734] GetCurrentThreadId () returned 0x970 [0077.734] GetCurrentThreadId () returned 0x970 [0077.734] GetCurrentThreadId () returned 0x970 [0077.734] GetCurrentThreadId () returned 0x970 [0077.734] GetCurrentThreadId () returned 0x970 [0077.734] GetCurrentThreadId () returned 0x970 [0077.734] GetCurrentThreadId () returned 0x970 [0077.734] GetCurrentThreadId () returned 0x970 [0077.734] GetCurrentThreadId () returned 0x970 [0077.734] GetCurrentThreadId () returned 0x970 [0077.734] GetCurrentThreadId () returned 0x970 [0077.734] GetCurrentThreadId () returned 0x970 [0077.734] GetCurrentThreadId () returned 0x970 [0077.734] GetCurrentThreadId () returned 0x970 [0077.734] GetCurrentThreadId () returned 0x970 [0077.734] GetCurrentThreadId () returned 0x970 [0077.734] GetCurrentThreadId () returned 0x970 [0077.734] GetCurrentThreadId () returned 0x970 [0077.734] GetCurrentThreadId () returned 0x970 [0077.734] GetCurrentThreadId () returned 0x970 [0077.734] GetCurrentThreadId () returned 0x970 [0077.734] GetCurrentThreadId () returned 0x970 [0077.734] GetCurrentThreadId () returned 0x970 [0077.735] GetCurrentThreadId () returned 0x970 [0077.735] GetCurrentThreadId () returned 0x970 [0077.735] GetCurrentThreadId () returned 0x970 [0077.735] GetCurrentThreadId () returned 0x970 [0077.735] GetCurrentThreadId () returned 0x970 [0077.735] GetCurrentThreadId () returned 0x970 [0077.735] GetCurrentThreadId () returned 0x970 [0077.735] GetCurrentThreadId () returned 0x970 [0077.735] GetCurrentThreadId () returned 0x970 [0077.735] GetCurrentThreadId () returned 0x970 [0077.735] GetCurrentThreadId () returned 0x970 [0077.735] GetCurrentThreadId () returned 0x970 [0077.735] GetCurrentThreadId () returned 0x970 [0077.735] GetCurrentThreadId () returned 0x970 [0077.735] GetCurrentThreadId () returned 0x970 [0077.735] GetCurrentThreadId () returned 0x970 [0077.735] GetCurrentThreadId () returned 0x970 [0077.735] GetCurrentThreadId () returned 0x970 [0077.735] GetCurrentThreadId () returned 0x970 [0077.735] GetCurrentThreadId () returned 0x970 [0077.735] GetCurrentThreadId () returned 0x970 [0077.735] GetCurrentThreadId () returned 0x970 [0077.735] GetCurrentThreadId () returned 0x970 [0077.735] GetCurrentThreadId () returned 0x970 [0077.735] GetCurrentThreadId () returned 0x970 [0077.735] GetCurrentThreadId () returned 0x970 [0077.735] GetCurrentThreadId () returned 0x970 [0077.735] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAE1U77fj8/feJFgE5/abjgCkuiTY03obMU1AJ7UQQR52b782VQ03Z8ETFU4Yg2A6BJi3hLmWHyatBYrZEyKKaWIlVLl3pMWVC5jm8/Qu7hozJeuLMbrDm0EL7VdGMbYUxCbjK2AxI+dVs2XYmduaQVKzleMq7ZGW3AwPE7e1z2Fxo6L6Pf9zOJoSvedbIebT0XnOoiutNkW5ElBfyEbsXdbuSv7DIHJ13w==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0077.735] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAE1U77fj8/feJFgE5/abjgCkuiTY03obMU1AJ7UQQR52b782VQ03Z8ETFU4Yg2A6BJi3hLmWHyatBYrZEyKKaWIlVLl3pMWVC5jm8/Qu7hozJeuLMbrDm0EL7VdGMbYUxCbjK2AxI+dVs2XYmduaQVKzleMq7ZGW3AwPE7e1z2Fxo6L6Pf9zOJoSvedbIebT0XnOoiutNkW5ElBfyEbsXdbuSv7DIHJ13w==", cchWideChar=245, lpMultiByteStr=0x3b4cd5c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAE1U77fj8/feJFgE5/abjgCkuiTY03obMU1AJ7UQQR52b782VQ03Z8ETFU4Yg2A6BJi3hLmWHyatBYrZEyKKaWIlVLl3pMWVC5jm8/Qu7hozJeuLMbrDm0EL7VdGMbYUxCbjK2AxI+dVs2XYmduaQVKzleMq7ZGW3AwPE7e1z2Fxo6L6Pf9zOJoSvedbIebT0XnOoiutNkW5ElBfyEbsXdbuSv7DIHJ13w==", lpUsedDefaultChar=0x0) returned 245 [0077.735] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0077.735] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0077.735] CloseHandle (hObject=0x158) returned 1 [0077.736] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passportcover.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportcover.png")) returned 0 [0077.736] GetLastError () returned 0x5 [0077.736] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passportcover.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportcover.png")) returned 0x20 [0077.736] SetLastError (dwErrCode=0x5) [0077.736] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=19799931495) returned 1 [0077.736] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Файл зашифрован [passport_mask_left.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\Файл зашифрован [passport_mask_left.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0077.737] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0077.737] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0077.737] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0077.737] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0077.737] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0077.737] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0077.737] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0077.737] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0077.737] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0077.737] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0077.737] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0077.737] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0077.737] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0077.737] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0077.737] SetEndOfFile (hFile=0x158) returned 1 [0077.737] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0077.738] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0077.738] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0077.738] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0077.738] WriteFile (in: hFile=0x158, lpBuffer=0x3777058*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777058*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0077.739] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0077.739] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Jmu/GtA\"q*KD3LP>KTUajvWdy#~IVSjZ", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0077.739] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Jmu/GtA\"q*KD3LP>KTUajvWdy#~IVSjZ", cchWideChar=32, lpMultiByteStr=0x2039b04, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Jmu/GtA\"q*KD3LP>KTUajvWdy#~IVSjZ", lpUsedDefaultChar=0x0) returned 32 [0077.739] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0077.739] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0077.739] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_left.png", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x727c06a1, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x727c06a1, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x55435557, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x12b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="passport_mask_left.png", cAlternateFileName="")) returned 0x295098 [0077.739] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0077.739] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0077.739] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_left.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_left.png")) returned 0x20 [0077.739] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_left.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_left.png")) returned 0x20 [0077.739] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_left.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_left.png")) returned 0x20 [0077.739] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_left.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_left.png")) returned 0x20 [0077.740] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_left.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_left.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x727c06a1, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x727c06a1, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x55435557, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x12b9)) returned 1 [0077.740] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0077.740] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0077.740] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_left.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_left.png")) returned 0x20 [0077.740] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_left.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_left.png")) returned 0x20 [0077.740] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0077.740] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0077.740] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0077.740] SetEndOfFile (hFile=0x158) returned 1 [0077.741] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="passport_mask_left.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0077.741] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="passport_mask_left.png", cchWideChar=22, lpMultiByteStr=0x1ff8974, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="passport_mask_left.png", lpUsedDefaultChar=0x0) returned 22 [0077.741] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="passport_mask_left.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0077.741] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="passport_mask_left.png", cchWideChar=22, lpMultiByteStr=0x1ff88fc, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="passport_mask_left.png", lpUsedDefaultChar=0x0) returned 22 [0077.741] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff88fc, cbMultiByte=22, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="passport_mask_left.pnggpng.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 22 [0077.741] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="passport_mask_left.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0077.741] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="passport_mask_left.png", cchWideChar=22, lpMultiByteStr=0x1ff8974, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="passport_mask_left.png", lpUsedDefaultChar=0x0) returned 22 [0077.741] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_left.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_left.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0077.741] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0077.742] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x12b9 [0077.742] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0077.742] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0077.742] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0077.742] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="passport_mask_left.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0077.742] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="passport_mask_left.png", cchWideChar=22, lpMultiByteStr=0x1ff8974, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="passport_mask_left.png", lpUsedDefaultChar=0x0) returned 22 [0077.742] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="passport_mask_left.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0077.742] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="passport_mask_left.png", cchWideChar=22, lpMultiByteStr=0x1ff88fc, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="passport_mask_left.png", lpUsedDefaultChar=0x0) returned 22 [0077.742] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff88fc, cbMultiByte=22, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="passport_mask_left.pngft.pnggpng.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 22 [0077.742] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="passport_mask_left.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0077.742] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="passport_mask_left.png", cchWideChar=22, lpMultiByteStr=0x1ff8974, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="passport_mask_left.png", lpUsedDefaultChar=0x0) returned 22 [0077.742] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0077.743] CharToOemA (in: pSrc="passport_mask_left.png", pDst=0x1ff88fc | out: pDst="passport_mask_left.png") returned 1 [0077.743] WriteFile (in: hFile=0x158, lpBuffer=0x1ff88fc*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1ff88fc*, lpNumberOfBytesWritten=0x18e048*=0x16, lpOverlapped=0x0) returned 1 [0077.743] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0077.743] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0077.743] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0077.743] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=19800683373) returned 1 [0077.743] ReadFile (in: hFile=0x11c, lpBuffer=0x3b714b0, nNumberOfBytesToRead=0x12b9, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b714b0*, lpNumberOfBytesRead=0x18dd7c*=0x12b9, lpOverlapped=0x0) returned 1 [0077.745] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0077.745] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=19800832474) returned 1 [0077.754] WriteFile (in: hFile=0x158, lpBuffer=0x379ae58*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379ae58*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0077.754] ReadFile (in: hFile=0x11c, lpBuffer=0x3b714b0, nNumberOfBytesToRead=0x12b9, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3b714b0*, lpNumberOfBytesRead=0x18de38*=0x12b9, lpOverlapped=0x0) returned 1 [0077.754] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x51 [0077.754] WriteFile (in: hFile=0x158, lpBuffer=0x3b93f70*, nNumberOfBytesToWrite=0x12b9, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3b93f70*, lpNumberOfBytesWritten=0x18de10*=0x12b9, lpOverlapped=0x0) returned 1 [0077.755] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x130a [0077.755] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0077.755] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0077.755] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0077.755] SetFilePointer (in: hFile=0x158, lDistanceToMove=22, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x34 [0077.755] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x1314 [0077.755] CloseHandle (hObject=0x11c) returned 1 [0077.755] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1314 [0077.755] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1314 [0077.755] SetFilePointer (in: hFile=0x158, lDistanceToMove=4884, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1314 [0077.756] SetFilePointer (in: hFile=0x158, lDistanceToMove=4884, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x1314 [0077.756] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1314 [0077.756] SetFilePointer (in: hFile=0x158, lDistanceToMove=4884, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x1314 [0077.756] SetEndOfFile (hFile=0x158) returned 1 [0077.756] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1314 [0077.756] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1314 [0077.756] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="passport_mask_left.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0077.756] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="passport_mask_left.png", cchWideChar=22, lpMultiByteStr=0x1ff88fc, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="passport_mask_left.png", lpUsedDefaultChar=0x0) returned 22 [0077.756] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="passport_mask_left.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0077.756] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="passport_mask_left.png", cchWideChar=22, lpMultiByteStr=0x1ff8974, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="passport_mask_left.png", lpUsedDefaultChar=0x0) returned 22 [0077.756] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff8974, cbMultiByte=22, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="passport_mask_left.png") returned 22 [0077.756] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="passport_mask_left.png", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0077.756] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="passport_mask_left.png", cchWideChar=22, lpMultiByteStr=0x1ff88fc, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="passport_mask_left.png", lpUsedDefaultChar=0x0) returned 22 [0077.756] WriteFile (in: hFile=0x158, lpBuffer=0x3b54f88*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3b54f88*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0077.756] CharToOemA (in: pSrc="passport_mask_left.png", pDst=0x1ff8974 | out: pDst="passport_mask_left.png") returned 1 [0077.756] WriteFile (in: hFile=0x158, lpBuffer=0x1ff8974*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1ff8974*, lpNumberOfBytesWritten=0x18efcc*=0x16, lpOverlapped=0x0) returned 1 [0077.756] WriteFile (in: hFile=0x158, lpBuffer=0x379ae18*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379ae18*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0077.757] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0077.757] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0077.757] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1363 [0077.757] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1363 [0077.757] WriteFile (in: hFile=0x158, lpBuffer=0x3777058*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777058*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0077.757] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0077.757] DeleteFileW (lpFileName="") returned 0 [0077.757] GetLastError () returned 0x3 [0077.757] GetFileAttributesW (lpFileName="") returned 0xffffffff [0077.757] SetLastError (dwErrCode=0x3) [0077.757] FlushFileBuffers (hFile=0x158) returned 1 [0077.763] GetCurrentThreadId () returned 0x970 [0077.763] GetCurrentThreadId () returned 0x970 [0077.763] GetCurrentThreadId () returned 0x970 [0077.763] GetCurrentThreadId () returned 0x970 [0077.763] GetCurrentThreadId () returned 0x970 [0077.763] GetCurrentThreadId () returned 0x970 [0077.763] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x141a [0077.763] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x141a [0077.763] SetFilePointer (in: hFile=0x158, lDistanceToMove=5146, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x141a [0077.763] CloseHandle (hObject=0x158) returned 1 [0077.763] GetCurrentThreadId () returned 0x970 [0077.763] GetCurrentThreadId () returned 0x970 [0077.763] GetCurrentThreadId () returned 0x970 [0077.764] GetCurrentThreadId () returned 0x970 [0077.764] GetCurrentThreadId () returned 0x970 [0077.764] GetCurrentThreadId () returned 0x970 [0077.764] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Файл зашифрован [passport_mask_left.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\Файл зашифрован [passport_mask_left.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0077.764] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x141a [0077.764] SetFilePointer (in: hFile=0x158, lDistanceToMove=5018, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x139a [0077.764] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0077.764] GetFileType (hFile=0x158) returned 0x1 [0077.764] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x19, wMilliseconds=0x2b)) [0077.764] GetCurrentThreadId () returned 0x970 [0077.764] GetCurrentThreadId () returned 0x970 [0077.764] GetCurrentThreadId () returned 0x970 [0077.764] GetCurrentThreadId () returned 0x970 [0077.764] GetCurrentThreadId () returned 0x970 [0077.764] GetCurrentThreadId () returned 0x970 [0077.764] GetCurrentThreadId () returned 0x970 [0077.764] GetCurrentThreadId () returned 0x970 [0077.764] GetCurrentThreadId () returned 0x970 [0077.764] GetCurrentThreadId () returned 0x970 [0077.764] GetCurrentThreadId () returned 0x970 [0077.764] GetCurrentThreadId () returned 0x970 [0077.764] GetCurrentThreadId () returned 0x970 [0077.764] GetCurrentThreadId () returned 0x970 [0077.765] GetCurrentThreadId () returned 0x970 [0077.765] GetCurrentThreadId () returned 0x970 [0077.765] GetCurrentThreadId () returned 0x970 [0077.765] GetCurrentThreadId () returned 0x970 [0077.765] GetCurrentThreadId () returned 0x970 [0077.765] GetCurrentThreadId () returned 0x970 [0077.765] GetCurrentThreadId () returned 0x970 [0077.765] GetCurrentThreadId () returned 0x970 [0077.765] GetCurrentThreadId () returned 0x970 [0077.765] GetCurrentThreadId () returned 0x970 [0077.765] GetCurrentThreadId () returned 0x970 [0077.765] GetCurrentThreadId () returned 0x970 [0077.765] GetCurrentThreadId () returned 0x970 [0077.765] GetCurrentThreadId () returned 0x970 [0077.765] GetCurrentThreadId () returned 0x970 [0077.765] GetCurrentThreadId () returned 0x970 [0077.765] GetCurrentThreadId () returned 0x970 [0077.765] GetCurrentThreadId () returned 0x970 [0077.765] GetCurrentThreadId () returned 0x970 [0077.765] GetCurrentThreadId () returned 0x970 [0077.765] GetCurrentThreadId () returned 0x970 [0077.765] GetCurrentThreadId () returned 0x970 [0077.765] GetCurrentThreadId () returned 0x970 [0077.765] GetCurrentThreadId () returned 0x970 [0077.765] GetCurrentThreadId () returned 0x970 [0077.765] GetCurrentThreadId () returned 0x970 [0077.765] GetCurrentThreadId () returned 0x970 [0077.765] GetCurrentThreadId () returned 0x970 [0077.765] GetCurrentThreadId () returned 0x970 [0077.765] GetCurrentThreadId () returned 0x970 [0077.765] GetCurrentThreadId () returned 0x970 [0077.765] GetCurrentThreadId () returned 0x970 [0077.765] GetCurrentThreadId () returned 0x970 [0077.765] GetCurrentThreadId () returned 0x970 [0077.765] GetCurrentThreadId () returned 0x970 [0077.765] GetCurrentThreadId () returned 0x970 [0077.765] GetCurrentThreadId () returned 0x970 [0077.765] GetCurrentThreadId () returned 0x970 [0077.765] GetCurrentThreadId () returned 0x970 [0077.765] GetCurrentThreadId () returned 0x970 [0077.765] GetCurrentThreadId () returned 0x970 [0077.765] GetCurrentThreadId () returned 0x970 [0077.765] GetCurrentThreadId () returned 0x970 [0077.765] GetCurrentThreadId () returned 0x970 [0077.765] GetCurrentThreadId () returned 0x970 [0077.766] GetCurrentThreadId () returned 0x970 [0077.766] GetCurrentThreadId () returned 0x970 [0077.766] GetCurrentThreadId () returned 0x970 [0077.766] GetCurrentThreadId () returned 0x970 [0077.766] GetCurrentThreadId () returned 0x970 [0077.766] GetCurrentThreadId () returned 0x970 [0077.766] GetCurrentThreadId () returned 0x970 [0077.766] GetCurrentThreadId () returned 0x970 [0077.766] GetCurrentThreadId () returned 0x970 [0077.766] GetCurrentThreadId () returned 0x970 [0077.766] GetCurrentThreadId () returned 0x970 [0077.766] GetCurrentThreadId () returned 0x970 [0077.766] GetCurrentThreadId () returned 0x970 [0077.766] GetCurrentThreadId () returned 0x970 [0077.766] GetCurrentThreadId () returned 0x970 [0077.766] GetCurrentThreadId () returned 0x970 [0077.766] GetCurrentThreadId () returned 0x970 [0077.766] GetCurrentThreadId () returned 0x970 [0077.766] GetCurrentThreadId () returned 0x970 [0077.766] GetCurrentThreadId () returned 0x970 [0077.766] GetCurrentThreadId () returned 0x970 [0077.766] GetCurrentThreadId () returned 0x970 [0077.766] GetCurrentThreadId () returned 0x970 [0077.766] GetCurrentThreadId () returned 0x970 [0077.766] GetCurrentThreadId () returned 0x970 [0077.766] GetCurrentThreadId () returned 0x970 [0077.766] GetCurrentThreadId () returned 0x970 [0077.766] GetCurrentThreadId () returned 0x970 [0077.766] GetCurrentThreadId () returned 0x970 [0077.766] GetCurrentThreadId () returned 0x970 [0077.766] GetCurrentThreadId () returned 0x970 [0077.766] GetCurrentThreadId () returned 0x970 [0077.766] GetCurrentThreadId () returned 0x970 [0077.766] GetCurrentThreadId () returned 0x970 [0077.766] GetCurrentThreadId () returned 0x970 [0077.766] GetCurrentThreadId () returned 0x970 [0077.766] GetCurrentThreadId () returned 0x970 [0077.766] GetCurrentThreadId () returned 0x970 [0077.766] GetCurrentThreadId () returned 0x970 [0077.766] GetCurrentThreadId () returned 0x970 [0077.766] GetCurrentThreadId () returned 0x970 [0077.766] GetCurrentThreadId () returned 0x970 [0077.766] GetCurrentThreadId () returned 0x970 [0077.766] GetCurrentThreadId () returned 0x970 [0077.766] GetCurrentThreadId () returned 0x970 [0077.767] GetCurrentThreadId () returned 0x970 [0077.767] GetCurrentThreadId () returned 0x970 [0077.767] GetCurrentThreadId () returned 0x970 [0077.767] GetCurrentThreadId () returned 0x970 [0077.767] GetCurrentThreadId () returned 0x970 [0077.767] GetCurrentThreadId () returned 0x970 [0077.767] GetCurrentThreadId () returned 0x970 [0077.767] GetCurrentThreadId () returned 0x970 [0077.767] GetCurrentThreadId () returned 0x970 [0077.767] GetCurrentThreadId () returned 0x970 [0077.767] GetCurrentThreadId () returned 0x970 [0077.767] GetCurrentThreadId () returned 0x970 [0077.767] GetCurrentThreadId () returned 0x970 [0077.767] GetCurrentThreadId () returned 0x970 [0077.767] GetCurrentThreadId () returned 0x970 [0077.767] GetCurrentThreadId () returned 0x970 [0077.767] GetCurrentThreadId () returned 0x970 [0077.767] GetCurrentThreadId () returned 0x970 [0077.767] GetCurrentThreadId () returned 0x970 [0077.767] GetCurrentThreadId () returned 0x970 [0077.767] GetCurrentThreadId () returned 0x970 [0077.767] GetCurrentThreadId () returned 0x970 [0077.767] GetCurrentThreadId () returned 0x970 [0077.767] GetCurrentThreadId () returned 0x970 [0077.767] GetCurrentThreadId () returned 0x970 [0077.767] GetCurrentThreadId () returned 0x970 [0077.767] GetCurrentThreadId () returned 0x970 [0077.767] GetCurrentThreadId () returned 0x970 [0077.767] GetCurrentThreadId () returned 0x970 [0077.767] GetCurrentThreadId () returned 0x970 [0077.767] GetCurrentThreadId () returned 0x970 [0077.767] GetCurrentThreadId () returned 0x970 [0077.767] GetCurrentThreadId () returned 0x970 [0077.767] GetCurrentThreadId () returned 0x970 [0077.767] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.767] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.767] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a1598, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.767] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.767] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.767] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a1598, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.767] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.767] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.768] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.768] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.768] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.768] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.768] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.768] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.768] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a15f8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.768] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.768] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.768] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a15f8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.768] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.768] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.768] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a15f8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.768] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x19, wMilliseconds=0x2b)) [0077.768] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Jmu/GtA\"q*KD3LP>KTUajvWdy#~IVSjZ", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0077.768] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Jmu/GtA\"q*KD3LP>KTUajvWdy#~IVSjZ", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0077.768] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Jmu/GtA\"q*KD3LP>KTUajvWdy#~IVSjZ", cchWideChar=32, lpMultiByteStr=0x3b58278, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Jmu/GtA\"q*KD3LP>KTUajvWdy#~IVSjZ", lpUsedDefaultChar=0x0) returned 32 [0077.768] GetCurrentThreadId () returned 0x970 [0077.768] GetCurrentThreadId () returned 0x970 [0077.768] GetCurrentThreadId () returned 0x970 [0077.768] GetCurrentThreadId () returned 0x970 [0077.768] GetCurrentThreadId () returned 0x970 [0077.768] GetCurrentThreadId () returned 0x970 [0077.776] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0077.776] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0077.776] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3b43288, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0077.776] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34edf48, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0077.776] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34edf48, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAHKa8/kbo73EKneMgMvtkL725B2tSv2Uz4zffzzEhUxo/hCXyLEgCEKUJCLqxKrd16ou9sINjLasgxB3+vihB0rT8BHEassBtGaLPb2suqIQ49qjqliBEFfxoLeo2uwA47Pl5UDUBR0MJizDVESNnII5PcZ94C0gW/5zlmX2f7qKgzWVedvC4YPJCqFubUVC5xiSMBPTSLvyRAfryCix0wsgsnic7J7gUw==") returned 232 [0077.776] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x19, wMilliseconds=0x2b)) [0077.776] GetCurrentThreadId () returned 0x970 [0077.776] GetCurrentThreadId () returned 0x970 [0077.776] GetCurrentThreadId () returned 0x970 [0077.776] GetCurrentThreadId () returned 0x970 [0077.776] GetCurrentThreadId () returned 0x970 [0077.776] GetCurrentThreadId () returned 0x970 [0077.776] GetCurrentThreadId () returned 0x970 [0077.776] GetCurrentThreadId () returned 0x970 [0077.776] GetCurrentThreadId () returned 0x970 [0077.776] GetCurrentThreadId () returned 0x970 [0077.776] GetCurrentThreadId () returned 0x970 [0077.776] GetCurrentThreadId () returned 0x970 [0077.776] GetCurrentThreadId () returned 0x970 [0077.776] GetCurrentThreadId () returned 0x970 [0077.776] GetCurrentThreadId () returned 0x970 [0077.776] GetCurrentThreadId () returned 0x970 [0077.776] GetCurrentThreadId () returned 0x970 [0077.776] GetCurrentThreadId () returned 0x970 [0077.776] GetCurrentThreadId () returned 0x970 [0077.776] GetCurrentThreadId () returned 0x970 [0077.776] GetCurrentThreadId () returned 0x970 [0077.776] GetCurrentThreadId () returned 0x970 [0077.776] GetCurrentThreadId () returned 0x970 [0077.776] GetCurrentThreadId () returned 0x970 [0077.776] GetCurrentThreadId () returned 0x970 [0077.776] GetCurrentThreadId () returned 0x970 [0077.776] GetCurrentThreadId () returned 0x970 [0077.776] GetCurrentThreadId () returned 0x970 [0077.776] GetCurrentThreadId () returned 0x970 [0077.777] GetCurrentThreadId () returned 0x970 [0077.777] GetCurrentThreadId () returned 0x970 [0077.777] GetCurrentThreadId () returned 0x970 [0077.777] GetCurrentThreadId () returned 0x970 [0077.777] GetCurrentThreadId () returned 0x970 [0077.777] GetCurrentThreadId () returned 0x970 [0077.777] GetCurrentThreadId () returned 0x970 [0077.777] GetCurrentThreadId () returned 0x970 [0077.777] GetCurrentThreadId () returned 0x970 [0077.777] GetCurrentThreadId () returned 0x970 [0077.777] GetCurrentThreadId () returned 0x970 [0077.777] GetCurrentThreadId () returned 0x970 [0077.777] GetCurrentThreadId () returned 0x970 [0077.777] GetCurrentThreadId () returned 0x970 [0077.777] GetCurrentThreadId () returned 0x970 [0077.777] GetCurrentThreadId () returned 0x970 [0077.777] GetCurrentThreadId () returned 0x970 [0077.777] GetCurrentThreadId () returned 0x970 [0077.777] GetCurrentThreadId () returned 0x970 [0077.777] GetCurrentThreadId () returned 0x970 [0077.777] GetCurrentThreadId () returned 0x970 [0077.777] GetCurrentThreadId () returned 0x970 [0077.777] GetCurrentThreadId () returned 0x970 [0077.777] GetCurrentThreadId () returned 0x970 [0077.777] GetCurrentThreadId () returned 0x970 [0077.777] GetCurrentThreadId () returned 0x970 [0077.777] GetCurrentThreadId () returned 0x970 [0077.777] GetCurrentThreadId () returned 0x970 [0077.777] GetCurrentThreadId () returned 0x970 [0077.777] GetCurrentThreadId () returned 0x970 [0077.777] GetCurrentThreadId () returned 0x970 [0077.777] GetCurrentThreadId () returned 0x970 [0077.777] GetCurrentThreadId () returned 0x970 [0077.777] GetCurrentThreadId () returned 0x970 [0077.777] GetCurrentThreadId () returned 0x970 [0077.777] GetCurrentThreadId () returned 0x970 [0077.777] GetCurrentThreadId () returned 0x970 [0077.777] GetCurrentThreadId () returned 0x970 [0077.777] GetCurrentThreadId () returned 0x970 [0077.777] GetCurrentThreadId () returned 0x970 [0077.777] GetCurrentThreadId () returned 0x970 [0077.777] GetCurrentThreadId () returned 0x970 [0077.777] GetCurrentThreadId () returned 0x970 [0077.777] GetCurrentThreadId () returned 0x970 [0077.777] GetCurrentThreadId () returned 0x970 [0077.778] GetCurrentThreadId () returned 0x970 [0077.778] GetCurrentThreadId () returned 0x970 [0077.778] GetCurrentThreadId () returned 0x970 [0077.778] GetCurrentThreadId () returned 0x970 [0077.778] GetCurrentThreadId () returned 0x970 [0077.778] GetCurrentThreadId () returned 0x970 [0077.778] GetCurrentThreadId () returned 0x970 [0077.778] GetCurrentThreadId () returned 0x970 [0077.778] GetCurrentThreadId () returned 0x970 [0077.778] GetCurrentThreadId () returned 0x970 [0077.778] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAHKa8/kbo73EKneMgMvtkL725B2tSv2Uz4zffzzEhUxo/hCXyLEgCEKUJCLqxKrd16ou9sINjLasgxB3+vihB0rT8BHEassBtGaLPb2suqIQ49qjqliBEFfxoLeo2uwA47Pl5UDUBR0MJizDVESNnII5PcZ94C0gW/5zlmX2f7qKgzWVedvC4YPJCqFubUVC5xiSMBPTSLvyRAfryCix0wsgsnic7J7gUw==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0077.778] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAHKa8/kbo73EKneMgMvtkL725B2tSv2Uz4zffzzEhUxo/hCXyLEgCEKUJCLqxKrd16ou9sINjLasgxB3+vihB0rT8BHEassBtGaLPb2suqIQ49qjqliBEFfxoLeo2uwA47Pl5UDUBR0MJizDVESNnII5PcZ94C0gW/5zlmX2f7qKgzWVedvC4YPJCqFubUVC5xiSMBPTSLvyRAfryCix0wsgsnic7J7gUw==", cchWideChar=245, lpMultiByteStr=0x3b4cd5c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAHKa8/kbo73EKneMgMvtkL725B2tSv2Uz4zffzzEhUxo/hCXyLEgCEKUJCLqxKrd16ou9sINjLasgxB3+vihB0rT8BHEassBtGaLPb2suqIQ49qjqliBEFfxoLeo2uwA47Pl5UDUBR0MJizDVESNnII5PcZ94C0gW/5zlmX2f7qKgzWVedvC4YPJCqFubUVC5xiSMBPTSLvyRAfryCix0wsgsnic7J7gUw==", lpUsedDefaultChar=0x0) returned 245 [0077.778] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0077.778] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0077.778] CloseHandle (hObject=0x158) returned 1 [0077.778] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_left.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_left.png")) returned 0 [0077.778] GetLastError () returned 0x5 [0077.778] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_left.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_left.png")) returned 0x20 [0077.778] SetLastError (dwErrCode=0x5) [0077.778] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=19804193955) returned 1 [0077.779] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Файл зашифрован [passport_mask_right.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\Файл зашифрован [passport_mask_right.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0077.779] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0077.779] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0077.779] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0077.779] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0077.779] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0077.779] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0077.779] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0077.780] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0077.780] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0077.780] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0077.780] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0077.780] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0077.780] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0077.780] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0077.780] SetEndOfFile (hFile=0x158) returned 1 [0077.780] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0077.780] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0077.780] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0077.780] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0077.780] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0077.781] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0077.781] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="dlwQ>{?{%mPF?8zc/:=$m5tW7YV\\hY=m", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0077.781] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="dlwQ>{?{%mPF?8zc/:=$m5tW7YV\\hY=m", cchWideChar=32, lpMultiByteStr=0x20395c4, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dlwQ>{?{%mPF?8zc/:=$m5tW7YV\\hY=m", lpUsedDefaultChar=0x0) returned 32 [0077.781] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0077.781] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0077.781] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_right.png", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x727e67fe, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x727e67fe, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x55435557, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x12cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="passport_mask_right.png", cAlternateFileName="")) returned 0x295098 [0077.781] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0077.782] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0077.782] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_right.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_right.png")) returned 0x20 [0077.782] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_right.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_right.png")) returned 0x20 [0077.783] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_right.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_right.png")) returned 0x20 [0077.783] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_right.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_right.png")) returned 0x20 [0077.783] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_right.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_right.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x727e67fe, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x727e67fe, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x55435557, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x12cd)) returned 1 [0077.783] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0077.783] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0077.783] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_right.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_right.png")) returned 0x20 [0077.783] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_right.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_right.png")) returned 0x20 [0077.783] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0077.783] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0077.783] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0077.783] SetEndOfFile (hFile=0x158) returned 1 [0077.784] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="passport_mask_right.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0077.784] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="passport_mask_right.png", cchWideChar=23, lpMultiByteStr=0x1ff89c4, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="passport_mask_right.png", lpUsedDefaultChar=0x0) returned 23 [0077.784] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="passport_mask_right.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0077.784] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="passport_mask_right.png", cchWideChar=23, lpMultiByteStr=0x1ff8a14, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="passport_mask_right.png", lpUsedDefaultChar=0x0) returned 23 [0077.784] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff8a14, cbMultiByte=23, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="passport_mask_right.pngpng.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 23 [0077.784] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="passport_mask_right.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0077.784] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="passport_mask_right.png", cchWideChar=23, lpMultiByteStr=0x1ff89c4, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="passport_mask_right.png", lpUsedDefaultChar=0x0) returned 23 [0077.784] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_right.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_right.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0077.784] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0077.785] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x12cd [0077.785] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0077.785] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0077.785] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0077.785] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="passport_mask_right.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0077.785] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="passport_mask_right.png", cchWideChar=23, lpMultiByteStr=0x1ff89c4, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="passport_mask_right.png", lpUsedDefaultChar=0x0) returned 23 [0077.785] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="passport_mask_right.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0077.785] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="passport_mask_right.png", cchWideChar=23, lpMultiByteStr=0x1ff8a14, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="passport_mask_right.png", lpUsedDefaultChar=0x0) returned 23 [0077.785] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff8a14, cbMultiByte=23, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="passport_mask_right.pnght.pngpng.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 23 [0077.785] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="passport_mask_right.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0077.785] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="passport_mask_right.png", cchWideChar=23, lpMultiByteStr=0x1ff89c4, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="passport_mask_right.png", lpUsedDefaultChar=0x0) returned 23 [0077.785] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0077.786] CharToOemA (in: pSrc="passport_mask_right.png", pDst=0x1ff8a14 | out: pDst="passport_mask_right.png") returned 1 [0077.786] WriteFile (in: hFile=0x158, lpBuffer=0x1ff8a14*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1ff8a14*, lpNumberOfBytesWritten=0x18e048*=0x17, lpOverlapped=0x0) returned 1 [0077.786] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0077.786] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0077.786] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0077.786] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=19804980429) returned 1 [0077.786] ReadFile (in: hFile=0x11c, lpBuffer=0x3b714b0, nNumberOfBytesToRead=0x12cd, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b714b0*, lpNumberOfBytesRead=0x18dd7c*=0x12cd, lpOverlapped=0x0) returned 1 [0077.788] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0077.788] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=19805122867) returned 1 [0077.797] WriteFile (in: hFile=0x158, lpBuffer=0x379ad50*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379ad50*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0077.797] ReadFile (in: hFile=0x11c, lpBuffer=0x3b714b0, nNumberOfBytesToRead=0x12cd, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3b714b0*, lpNumberOfBytesRead=0x18de38*=0x12cd, lpOverlapped=0x0) returned 1 [0077.797] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x52 [0077.797] WriteFile (in: hFile=0x158, lpBuffer=0x3b93f70*, nNumberOfBytesToWrite=0x12cd, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3b93f70*, lpNumberOfBytesWritten=0x18de10*=0x12cd, lpOverlapped=0x0) returned 1 [0077.797] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x131f [0077.797] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0077.797] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0077.797] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0077.798] SetFilePointer (in: hFile=0x158, lDistanceToMove=23, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x35 [0077.798] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x1329 [0077.798] CloseHandle (hObject=0x11c) returned 1 [0077.798] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1329 [0077.798] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1329 [0077.798] SetFilePointer (in: hFile=0x158, lDistanceToMove=4905, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1329 [0077.798] SetFilePointer (in: hFile=0x158, lDistanceToMove=4905, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x1329 [0077.798] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1329 [0077.798] SetFilePointer (in: hFile=0x158, lDistanceToMove=4905, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x1329 [0077.798] SetEndOfFile (hFile=0x158) returned 1 [0077.798] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1329 [0077.798] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1329 [0077.798] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="passport_mask_right.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0077.798] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="passport_mask_right.png", cchWideChar=23, lpMultiByteStr=0x1ff8a14, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="passport_mask_right.png", lpUsedDefaultChar=0x0) returned 23 [0077.799] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="passport_mask_right.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0077.799] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="passport_mask_right.png", cchWideChar=23, lpMultiByteStr=0x1ff89c4, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="passport_mask_right.png", lpUsedDefaultChar=0x0) returned 23 [0077.799] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff89c4, cbMultiByte=23, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="passport_mask_right.pngĀ䭐ȁ\x14\x14\x01c䃑㫋皥㮙ዩ") returned 23 [0077.799] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="passport_mask_right.png", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0077.799] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="passport_mask_right.png", cchWideChar=23, lpMultiByteStr=0x1ff8a14, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="passport_mask_right.png", lpUsedDefaultChar=0x0) returned 23 [0077.799] WriteFile (in: hFile=0x158, lpBuffer=0x3b54f88*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3b54f88*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0077.799] CharToOemA (in: pSrc="passport_mask_right.png", pDst=0x1ff89c4 | out: pDst="passport_mask_right.png") returned 1 [0077.799] WriteFile (in: hFile=0x158, lpBuffer=0x1ff89c4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1ff89c4*, lpNumberOfBytesWritten=0x18efcc*=0x17, lpOverlapped=0x0) returned 1 [0077.799] WriteFile (in: hFile=0x158, lpBuffer=0x379ad88*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379ad88*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0077.799] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0077.799] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0077.799] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1379 [0077.799] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1379 [0077.799] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0077.799] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0077.800] DeleteFileW (lpFileName="") returned 0 [0077.800] GetLastError () returned 0x3 [0077.800] GetFileAttributesW (lpFileName="") returned 0xffffffff [0077.800] SetLastError (dwErrCode=0x3) [0077.800] FlushFileBuffers (hFile=0x158) returned 1 [0077.802] GetCurrentThreadId () returned 0x970 [0077.802] GetCurrentThreadId () returned 0x970 [0077.802] GetCurrentThreadId () returned 0x970 [0077.802] GetCurrentThreadId () returned 0x970 [0077.802] GetCurrentThreadId () returned 0x970 [0077.802] GetCurrentThreadId () returned 0x970 [0077.802] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x1430 [0077.802] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x1430 [0077.803] SetFilePointer (in: hFile=0x158, lDistanceToMove=5168, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x1430 [0077.803] CloseHandle (hObject=0x158) returned 1 [0077.803] GetCurrentThreadId () returned 0x970 [0077.803] GetCurrentThreadId () returned 0x970 [0077.803] GetCurrentThreadId () returned 0x970 [0077.803] GetCurrentThreadId () returned 0x970 [0077.803] GetCurrentThreadId () returned 0x970 [0077.803] GetCurrentThreadId () returned 0x970 [0077.803] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Файл зашифрован [passport_mask_right.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\Файл зашифрован [passport_mask_right.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0077.803] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1430 [0077.803] SetFilePointer (in: hFile=0x158, lDistanceToMove=5040, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13b0 [0077.803] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0077.803] GetFileType (hFile=0x158) returned 0x1 [0077.803] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x19, wMilliseconds=0x4a)) [0077.803] GetCurrentThreadId () returned 0x970 [0077.803] GetCurrentThreadId () returned 0x970 [0077.803] GetCurrentThreadId () returned 0x970 [0077.803] GetCurrentThreadId () returned 0x970 [0077.803] GetCurrentThreadId () returned 0x970 [0077.803] GetCurrentThreadId () returned 0x970 [0077.803] GetCurrentThreadId () returned 0x970 [0077.803] GetCurrentThreadId () returned 0x970 [0077.803] GetCurrentThreadId () returned 0x970 [0077.803] GetCurrentThreadId () returned 0x970 [0077.803] GetCurrentThreadId () returned 0x970 [0077.803] GetCurrentThreadId () returned 0x970 [0077.804] GetCurrentThreadId () returned 0x970 [0077.804] GetCurrentThreadId () returned 0x970 [0077.804] GetCurrentThreadId () returned 0x970 [0077.804] GetCurrentThreadId () returned 0x970 [0077.804] GetCurrentThreadId () returned 0x970 [0077.804] GetCurrentThreadId () returned 0x970 [0077.804] GetCurrentThreadId () returned 0x970 [0077.804] GetCurrentThreadId () returned 0x970 [0077.804] GetCurrentThreadId () returned 0x970 [0077.804] GetCurrentThreadId () returned 0x970 [0077.804] GetCurrentThreadId () returned 0x970 [0077.804] GetCurrentThreadId () returned 0x970 [0077.804] GetCurrentThreadId () returned 0x970 [0077.804] GetCurrentThreadId () returned 0x970 [0077.804] GetCurrentThreadId () returned 0x970 [0077.804] GetCurrentThreadId () returned 0x970 [0077.804] GetCurrentThreadId () returned 0x970 [0077.804] GetCurrentThreadId () returned 0x970 [0077.804] GetCurrentThreadId () returned 0x970 [0077.804] GetCurrentThreadId () returned 0x970 [0077.804] GetCurrentThreadId () returned 0x970 [0077.804] GetCurrentThreadId () returned 0x970 [0077.804] GetCurrentThreadId () returned 0x970 [0077.804] GetCurrentThreadId () returned 0x970 [0077.804] GetCurrentThreadId () returned 0x970 [0077.804] GetCurrentThreadId () returned 0x970 [0077.804] GetCurrentThreadId () returned 0x970 [0077.804] GetCurrentThreadId () returned 0x970 [0077.804] GetCurrentThreadId () returned 0x970 [0077.804] GetCurrentThreadId () returned 0x970 [0077.804] GetCurrentThreadId () returned 0x970 [0077.804] GetCurrentThreadId () returned 0x970 [0077.804] GetCurrentThreadId () returned 0x970 [0077.804] GetCurrentThreadId () returned 0x970 [0077.804] GetCurrentThreadId () returned 0x970 [0077.804] GetCurrentThreadId () returned 0x970 [0077.804] GetCurrentThreadId () returned 0x970 [0077.804] GetCurrentThreadId () returned 0x970 [0077.804] GetCurrentThreadId () returned 0x970 [0077.804] GetCurrentThreadId () returned 0x970 [0077.804] GetCurrentThreadId () returned 0x970 [0077.804] GetCurrentThreadId () returned 0x970 [0077.804] GetCurrentThreadId () returned 0x970 [0077.804] GetCurrentThreadId () returned 0x970 [0077.804] GetCurrentThreadId () returned 0x970 [0077.804] GetCurrentThreadId () returned 0x970 [0077.805] GetCurrentThreadId () returned 0x970 [0077.805] GetCurrentThreadId () returned 0x970 [0077.805] GetCurrentThreadId () returned 0x970 [0077.805] GetCurrentThreadId () returned 0x970 [0077.805] GetCurrentThreadId () returned 0x970 [0077.805] GetCurrentThreadId () returned 0x970 [0077.805] GetCurrentThreadId () returned 0x970 [0077.805] GetCurrentThreadId () returned 0x970 [0077.805] GetCurrentThreadId () returned 0x970 [0077.805] GetCurrentThreadId () returned 0x970 [0077.805] GetCurrentThreadId () returned 0x970 [0077.805] GetCurrentThreadId () returned 0x970 [0077.805] GetCurrentThreadId () returned 0x970 [0077.805] GetCurrentThreadId () returned 0x970 [0077.805] GetCurrentThreadId () returned 0x970 [0077.805] GetCurrentThreadId () returned 0x970 [0077.805] GetCurrentThreadId () returned 0x970 [0077.805] GetCurrentThreadId () returned 0x970 [0077.805] GetCurrentThreadId () returned 0x970 [0077.805] GetCurrentThreadId () returned 0x970 [0077.805] GetCurrentThreadId () returned 0x970 [0077.805] GetCurrentThreadId () returned 0x970 [0077.805] GetCurrentThreadId () returned 0x970 [0077.805] GetCurrentThreadId () returned 0x970 [0077.805] GetCurrentThreadId () returned 0x970 [0077.805] GetCurrentThreadId () returned 0x970 [0077.805] GetCurrentThreadId () returned 0x970 [0077.805] GetCurrentThreadId () returned 0x970 [0077.805] GetCurrentThreadId () returned 0x970 [0077.805] GetCurrentThreadId () returned 0x970 [0077.805] GetCurrentThreadId () returned 0x970 [0077.805] GetCurrentThreadId () returned 0x970 [0077.805] GetCurrentThreadId () returned 0x970 [0077.805] GetCurrentThreadId () returned 0x970 [0077.805] GetCurrentThreadId () returned 0x970 [0077.805] GetCurrentThreadId () returned 0x970 [0077.805] GetCurrentThreadId () returned 0x970 [0077.805] GetCurrentThreadId () returned 0x970 [0077.805] GetCurrentThreadId () returned 0x970 [0077.805] GetCurrentThreadId () returned 0x970 [0077.805] GetCurrentThreadId () returned 0x970 [0077.805] GetCurrentThreadId () returned 0x970 [0077.805] GetCurrentThreadId () returned 0x970 [0077.805] GetCurrentThreadId () returned 0x970 [0077.806] GetCurrentThreadId () returned 0x970 [0077.806] GetCurrentThreadId () returned 0x970 [0077.806] GetCurrentThreadId () returned 0x970 [0077.806] GetCurrentThreadId () returned 0x970 [0077.806] GetCurrentThreadId () returned 0x970 [0077.806] GetCurrentThreadId () returned 0x970 [0077.806] GetCurrentThreadId () returned 0x970 [0077.806] GetCurrentThreadId () returned 0x970 [0077.806] GetCurrentThreadId () returned 0x970 [0077.806] GetCurrentThreadId () returned 0x970 [0077.806] GetCurrentThreadId () returned 0x970 [0077.806] GetCurrentThreadId () returned 0x970 [0077.806] GetCurrentThreadId () returned 0x970 [0077.806] GetCurrentThreadId () returned 0x970 [0077.806] GetCurrentThreadId () returned 0x970 [0077.806] GetCurrentThreadId () returned 0x970 [0077.806] GetCurrentThreadId () returned 0x970 [0077.806] GetCurrentThreadId () returned 0x970 [0077.806] GetCurrentThreadId () returned 0x970 [0077.806] GetCurrentThreadId () returned 0x970 [0077.806] GetCurrentThreadId () returned 0x970 [0077.806] GetCurrentThreadId () returned 0x970 [0077.806] GetCurrentThreadId () returned 0x970 [0077.806] GetCurrentThreadId () returned 0x970 [0077.806] GetCurrentThreadId () returned 0x970 [0077.806] GetCurrentThreadId () returned 0x970 [0077.806] GetCurrentThreadId () returned 0x970 [0077.806] GetCurrentThreadId () returned 0x970 [0077.806] GetCurrentThreadId () returned 0x970 [0077.806] GetCurrentThreadId () returned 0x970 [0077.806] GetCurrentThreadId () returned 0x970 [0077.806] GetCurrentThreadId () returned 0x970 [0077.806] GetCurrentThreadId () returned 0x970 [0077.806] GetCurrentThreadId () returned 0x970 [0077.806] GetCurrentThreadId () returned 0x970 [0077.806] GetCurrentThreadId () returned 0x970 [0077.806] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.806] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.806] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a15f8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.806] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.806] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.806] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a15f8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.807] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.807] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.807] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.807] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.807] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.807] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.807] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.807] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.807] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a1658, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.807] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.807] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.807] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a1658, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.807] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.807] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.807] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a1658, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.807] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x19, wMilliseconds=0x4a)) [0077.807] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dlwQ>{?{%mPF?8zc/:=$m5tW7YV\\hY=m", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0077.807] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dlwQ>{?{%mPF?8zc/:=$m5tW7YV\\hY=m", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0077.807] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dlwQ>{?{%mPF?8zc/:=$m5tW7YV\\hY=m", cchWideChar=32, lpMultiByteStr=0x3b582a8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dlwQ>{?{%mPF?8zc/:=$m5tW7YV\\hY=m", lpUsedDefaultChar=0x0) returned 32 [0077.807] GetCurrentThreadId () returned 0x970 [0077.807] GetCurrentThreadId () returned 0x970 [0077.807] GetCurrentThreadId () returned 0x970 [0077.807] GetCurrentThreadId () returned 0x970 [0077.807] GetCurrentThreadId () returned 0x970 [0077.807] GetCurrentThreadId () returned 0x970 [0077.815] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0077.815] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0077.815] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3b43378, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0077.815] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34edf48, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0077.815] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34edf48, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAABf01J9ZFw1ppoyjS5CivfScDouHRxvRxBELiA/hctEPSBXgZtLKW0T9uoh23MjDG8BwmrkbG53fvOxKagMGbsG7oi835J43AHnOH9zoAnb8n6uZrvpTG8jyRCpY0I0I4Udbd57FM1HazEO9aRI46Fm4cn1Y9+XESxGQH2mLQplVmmWzBrzDiKE9ZEPfjwLRv6durIRvTK6c7FGHw8+fOu1+6WMrzDRoKg==") returned 232 [0077.815] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x19, wMilliseconds=0x5a)) [0077.815] GetCurrentThreadId () returned 0x970 [0077.815] GetCurrentThreadId () returned 0x970 [0077.815] GetCurrentThreadId () returned 0x970 [0077.815] GetCurrentThreadId () returned 0x970 [0077.815] GetCurrentThreadId () returned 0x970 [0077.815] GetCurrentThreadId () returned 0x970 [0077.815] GetCurrentThreadId () returned 0x970 [0077.815] GetCurrentThreadId () returned 0x970 [0077.815] GetCurrentThreadId () returned 0x970 [0077.815] GetCurrentThreadId () returned 0x970 [0077.815] GetCurrentThreadId () returned 0x970 [0077.815] GetCurrentThreadId () returned 0x970 [0077.815] GetCurrentThreadId () returned 0x970 [0077.815] GetCurrentThreadId () returned 0x970 [0077.815] GetCurrentThreadId () returned 0x970 [0077.815] GetCurrentThreadId () returned 0x970 [0077.815] GetCurrentThreadId () returned 0x970 [0077.815] GetCurrentThreadId () returned 0x970 [0077.815] GetCurrentThreadId () returned 0x970 [0077.815] GetCurrentThreadId () returned 0x970 [0077.815] GetCurrentThreadId () returned 0x970 [0077.815] GetCurrentThreadId () returned 0x970 [0077.815] GetCurrentThreadId () returned 0x970 [0077.816] GetCurrentThreadId () returned 0x970 [0077.816] GetCurrentThreadId () returned 0x970 [0077.816] GetCurrentThreadId () returned 0x970 [0077.816] GetCurrentThreadId () returned 0x970 [0077.816] GetCurrentThreadId () returned 0x970 [0077.816] GetCurrentThreadId () returned 0x970 [0077.816] GetCurrentThreadId () returned 0x970 [0077.816] GetCurrentThreadId () returned 0x970 [0077.816] GetCurrentThreadId () returned 0x970 [0077.816] GetCurrentThreadId () returned 0x970 [0077.816] GetCurrentThreadId () returned 0x970 [0077.816] GetCurrentThreadId () returned 0x970 [0077.816] GetCurrentThreadId () returned 0x970 [0077.816] GetCurrentThreadId () returned 0x970 [0077.816] GetCurrentThreadId () returned 0x970 [0077.816] GetCurrentThreadId () returned 0x970 [0077.816] GetCurrentThreadId () returned 0x970 [0077.816] GetCurrentThreadId () returned 0x970 [0077.816] GetCurrentThreadId () returned 0x970 [0077.816] GetCurrentThreadId () returned 0x970 [0077.816] GetCurrentThreadId () returned 0x970 [0077.816] GetCurrentThreadId () returned 0x970 [0077.816] GetCurrentThreadId () returned 0x970 [0077.816] GetCurrentThreadId () returned 0x970 [0077.816] GetCurrentThreadId () returned 0x970 [0077.816] GetCurrentThreadId () returned 0x970 [0077.816] GetCurrentThreadId () returned 0x970 [0077.816] GetCurrentThreadId () returned 0x970 [0077.816] GetCurrentThreadId () returned 0x970 [0077.816] GetCurrentThreadId () returned 0x970 [0077.816] GetCurrentThreadId () returned 0x970 [0077.816] GetCurrentThreadId () returned 0x970 [0077.816] GetCurrentThreadId () returned 0x970 [0077.816] GetCurrentThreadId () returned 0x970 [0077.816] GetCurrentThreadId () returned 0x970 [0077.816] GetCurrentThreadId () returned 0x970 [0077.816] GetCurrentThreadId () returned 0x970 [0077.816] GetCurrentThreadId () returned 0x970 [0077.816] GetCurrentThreadId () returned 0x970 [0077.816] GetCurrentThreadId () returned 0x970 [0077.816] GetCurrentThreadId () returned 0x970 [0077.816] GetCurrentThreadId () returned 0x970 [0077.816] GetCurrentThreadId () returned 0x970 [0077.816] GetCurrentThreadId () returned 0x970 [0077.816] GetCurrentThreadId () returned 0x970 [0077.816] GetCurrentThreadId () returned 0x970 [0077.817] GetCurrentThreadId () returned 0x970 [0077.817] GetCurrentThreadId () returned 0x970 [0077.817] GetCurrentThreadId () returned 0x970 [0077.817] GetCurrentThreadId () returned 0x970 [0077.817] GetCurrentThreadId () returned 0x970 [0077.817] GetCurrentThreadId () returned 0x970 [0077.817] GetCurrentThreadId () returned 0x970 [0077.817] GetCurrentThreadId () returned 0x970 [0077.817] GetCurrentThreadId () returned 0x970 [0077.817] GetCurrentThreadId () returned 0x970 [0077.817] GetCurrentThreadId () returned 0x970 [0077.817] GetCurrentThreadId () returned 0x970 [0077.817] GetCurrentThreadId () returned 0x970 [0077.817] GetCurrentThreadId () returned 0x970 [0077.817] GetCurrentThreadId () returned 0x970 [0077.817] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAABf01J9ZFw1ppoyjS5CivfScDouHRxvRxBELiA/hctEPSBXgZtLKW0T9uoh23MjDG8BwmrkbG53fvOxKagMGbsG7oi835J43AHnOH9zoAnb8n6uZrvpTG8jyRCpY0I0I4Udbd57FM1HazEO9aRI46Fm4cn1Y9+XESxGQH2mLQplVmmWzBrzDiKE9ZEPfjwLRv6durIRvTK6c7FGHw8+fOu1+6WMrzDRoKg==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0077.817] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAABf01J9ZFw1ppoyjS5CivfScDouHRxvRxBELiA/hctEPSBXgZtLKW0T9uoh23MjDG8BwmrkbG53fvOxKagMGbsG7oi835J43AHnOH9zoAnb8n6uZrvpTG8jyRCpY0I0I4Udbd57FM1HazEO9aRI46Fm4cn1Y9+XESxGQH2mLQplVmmWzBrzDiKE9ZEPfjwLRv6durIRvTK6c7FGHw8+fOu1+6WMrzDRoKg==", cchWideChar=245, lpMultiByteStr=0x3b4cd5c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAABf01J9ZFw1ppoyjS5CivfScDouHRxvRxBELiA/hctEPSBXgZtLKW0T9uoh23MjDG8BwmrkbG53fvOxKagMGbsG7oi835J43AHnOH9zoAnb8n6uZrvpTG8jyRCpY0I0I4Udbd57FM1HazEO9aRI46Fm4cn1Y9+XESxGQH2mLQplVmmWzBrzDiKE9ZEPfjwLRv6durIRvTK6c7FGHw8+fOu1+6WMrzDRoKg==", lpUsedDefaultChar=0x0) returned 245 [0077.817] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0077.817] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0077.817] CloseHandle (hObject=0x158) returned 1 [0077.817] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_right.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_right.png")) returned 0 [0077.817] GetLastError () returned 0x5 [0077.817] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_right.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_right.png")) returned 0x20 [0077.817] SetLastError (dwErrCode=0x5) [0077.818] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=19808097548) returned 1 [0077.818] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Файл зашифрован [play-background.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\Файл зашифрован [play-background.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0077.818] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0077.818] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0077.818] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0077.818] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0077.818] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0077.818] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0077.818] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0077.818] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0077.819] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0077.819] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0077.819] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0077.819] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0077.819] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0077.819] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0077.819] SetEndOfFile (hFile=0x158) returned 1 [0077.819] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0077.819] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0077.819] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0077.819] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0077.820] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0077.820] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0077.821] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Fs8}zHZPz5RA!ve#Zbw+VlM$mK,6E,l#", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0077.821] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Fs8}zHZPz5RA!ve#Zbw+VlM$mK,6E,l#", cchWideChar=32, lpMultiByteStr=0x2039c1c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Fs8}zHZPz5RA!ve#Zbw+VlM$mK,6E,l#", lpUsedDefaultChar=0x0) returned 32 [0077.821] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0077.821] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0077.821] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\play-background.png", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72538f74, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72538f74, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5545b6b5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x18337, dwReserved0=0x0, dwReserved1=0x0, cFileName="play-background.png", cAlternateFileName="")) returned 0x295098 [0077.821] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0077.821] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0077.821] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\play-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\play-background.png")) returned 0x20 [0077.821] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\play-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\play-background.png")) returned 0x20 [0077.821] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\play-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\play-background.png")) returned 0x20 [0077.821] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\play-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\play-background.png")) returned 0x20 [0077.821] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\play-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\play-background.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72538f74, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72538f74, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5545b6b5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x18337)) returned 1 [0077.821] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0077.821] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0077.821] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\play-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\play-background.png")) returned 0x20 [0077.821] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\play-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\play-background.png")) returned 0x20 [0077.822] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0077.822] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0077.822] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0077.822] SetEndOfFile (hFile=0x158) returned 1 [0077.823] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="play-background.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0077.823] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="play-background.png", cchWideChar=19, lpMultiByteStr=0x1ff899c, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="play-background.png", lpUsedDefaultChar=0x0) returned 19 [0077.823] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="play-background.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0077.823] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="play-background.png", cchWideChar=19, lpMultiByteStr=0x1ff894c, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="play-background.png", lpUsedDefaultChar=0x0) returned 19 [0077.823] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff894c, cbMultiByte=19, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="play-background.png.pngpng.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 19 [0077.823] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="play-background.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0077.823] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="play-background.png", cchWideChar=19, lpMultiByteStr=0x1ff899c, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="play-background.png", lpUsedDefaultChar=0x0) returned 19 [0077.823] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\play-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\play-background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0077.823] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0077.823] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x18337 [0077.823] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0077.823] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0077.824] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0077.824] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="play-background.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0077.824] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="play-background.png", cchWideChar=19, lpMultiByteStr=0x1ff899c, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="play-background.png", lpUsedDefaultChar=0x0) returned 19 [0077.824] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="play-background.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0077.824] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="play-background.png", cchWideChar=19, lpMultiByteStr=0x1ff894c, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="play-background.png", lpUsedDefaultChar=0x0) returned 19 [0077.824] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff894c, cbMultiByte=19, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="play-background.pngnd.png.pngpng.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 19 [0077.824] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="play-background.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0077.824] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="play-background.png", cchWideChar=19, lpMultiByteStr=0x1ff899c, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="play-background.png", lpUsedDefaultChar=0x0) returned 19 [0077.824] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0077.825] CharToOemA (in: pSrc="play-background.png", pDst=0x1ff894c | out: pDst="play-background.png") returned 1 [0077.825] WriteFile (in: hFile=0x158, lpBuffer=0x1ff894c*, nNumberOfBytesToWrite=0x13, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1ff894c*, lpNumberOfBytesWritten=0x18e048*=0x13, lpOverlapped=0x0) returned 1 [0077.825] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0077.825] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0077.825] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0077.825] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=19808983346) returned 1 [0077.827] ReadFile (in: hFile=0x11c, lpBuffer=0x3b714b0, nNumberOfBytesToRead=0x18337, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b714b0*, lpNumberOfBytesRead=0x18dd7c*=0x18337, lpOverlapped=0x0) returned 1 [0077.830] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0077.830] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=19809314992) returned 1 [0077.838] WriteFile (in: hFile=0x158, lpBuffer=0x379aca8*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379aca8*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0077.838] ReadFile (in: hFile=0x11c, lpBuffer=0x3b714b0, nNumberOfBytesToRead=0x18337, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3b714b0*, lpNumberOfBytesRead=0x18de38*=0x18337, lpOverlapped=0x0) returned 1 [0077.841] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x4e [0077.841] WriteFile (in: hFile=0x158, lpBuffer=0x37eeac0*, nNumberOfBytesToWrite=0x18337, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x37eeac0*, lpNumberOfBytesWritten=0x18de10*=0x18337, lpOverlapped=0x0) returned 1 [0077.843] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x18385 [0077.843] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0077.843] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0077.843] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0077.843] SetFilePointer (in: hFile=0x158, lDistanceToMove=19, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x31 [0077.843] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x1838f [0077.844] CloseHandle (hObject=0x11c) returned 1 [0077.844] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1838f [0077.844] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1838f [0077.844] SetFilePointer (in: hFile=0x158, lDistanceToMove=99215, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1838f [0077.844] SetFilePointer (in: hFile=0x158, lDistanceToMove=99215, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x1838f [0077.844] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1838f [0077.844] SetFilePointer (in: hFile=0x158, lDistanceToMove=99215, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x1838f [0077.844] SetEndOfFile (hFile=0x158) returned 1 [0077.844] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1838f [0077.844] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1838f [0077.844] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="play-background.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0077.845] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="play-background.png", cchWideChar=19, lpMultiByteStr=0x1ff894c, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="play-background.png", lpUsedDefaultChar=0x0) returned 19 [0077.845] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="play-background.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0077.845] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="play-background.png", cchWideChar=19, lpMultiByteStr=0x1ff899c, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="play-background.png", lpUsedDefaultChar=0x0) returned 19 [0077.845] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff899c, cbMultiByte=19, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="play-background.png`믑`") returned 19 [0077.845] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="play-background.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0077.845] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="play-background.png", cchWideChar=19, lpMultiByteStr=0x1ff894c, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="play-background.png", lpUsedDefaultChar=0x0) returned 19 [0077.845] WriteFile (in: hFile=0x158, lpBuffer=0x3b54f88*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3b54f88*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0077.845] CharToOemA (in: pSrc="play-background.png", pDst=0x1ff899c | out: pDst="play-background.png") returned 1 [0077.845] WriteFile (in: hFile=0x158, lpBuffer=0x1ff899c*, nNumberOfBytesToWrite=0x13, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1ff899c*, lpNumberOfBytesWritten=0x18efcc*=0x13, lpOverlapped=0x0) returned 1 [0077.845] WriteFile (in: hFile=0x158, lpBuffer=0x379ade8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379ade8*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0077.845] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0077.845] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0077.845] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x183db [0077.845] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x183db [0077.845] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0077.846] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0077.846] DeleteFileW (lpFileName="") returned 0 [0077.846] GetLastError () returned 0x3 [0077.846] GetFileAttributesW (lpFileName="") returned 0xffffffff [0077.846] SetLastError (dwErrCode=0x3) [0077.846] FlushFileBuffers (hFile=0x158) returned 1 [0077.849] GetCurrentThreadId () returned 0x970 [0077.849] GetCurrentThreadId () returned 0x970 [0077.849] GetCurrentThreadId () returned 0x970 [0077.849] GetCurrentThreadId () returned 0x970 [0077.849] GetCurrentThreadId () returned 0x970 [0077.849] GetCurrentThreadId () returned 0x970 [0077.849] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x18492 [0077.849] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x18492 [0077.849] SetFilePointer (in: hFile=0x158, lDistanceToMove=99474, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x18492 [0077.849] CloseHandle (hObject=0x158) returned 1 [0077.849] GetCurrentThreadId () returned 0x970 [0077.849] GetCurrentThreadId () returned 0x970 [0077.849] GetCurrentThreadId () returned 0x970 [0077.849] GetCurrentThreadId () returned 0x970 [0077.849] GetCurrentThreadId () returned 0x970 [0077.849] GetCurrentThreadId () returned 0x970 [0077.849] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Файл зашифрован [play-background.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\Файл зашифрован [play-background.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0077.849] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18492 [0077.849] SetFilePointer (in: hFile=0x158, lDistanceToMove=99346, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x18412 [0077.849] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0077.850] GetFileType (hFile=0x158) returned 0x1 [0077.850] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x19, wMilliseconds=0x79)) [0077.850] GetCurrentThreadId () returned 0x970 [0077.850] GetCurrentThreadId () returned 0x970 [0077.850] GetCurrentThreadId () returned 0x970 [0077.850] GetCurrentThreadId () returned 0x970 [0077.850] GetCurrentThreadId () returned 0x970 [0077.850] GetCurrentThreadId () returned 0x970 [0077.850] GetCurrentThreadId () returned 0x970 [0077.850] GetCurrentThreadId () returned 0x970 [0077.850] GetCurrentThreadId () returned 0x970 [0077.850] GetCurrentThreadId () returned 0x970 [0077.850] GetCurrentThreadId () returned 0x970 [0077.850] GetCurrentThreadId () returned 0x970 [0077.850] GetCurrentThreadId () returned 0x970 [0077.850] GetCurrentThreadId () returned 0x970 [0077.850] GetCurrentThreadId () returned 0x970 [0077.850] GetCurrentThreadId () returned 0x970 [0077.850] GetCurrentThreadId () returned 0x970 [0077.850] GetCurrentThreadId () returned 0x970 [0077.850] GetCurrentThreadId () returned 0x970 [0077.850] GetCurrentThreadId () returned 0x970 [0077.850] GetCurrentThreadId () returned 0x970 [0077.850] GetCurrentThreadId () returned 0x970 [0077.850] GetCurrentThreadId () returned 0x970 [0077.850] GetCurrentThreadId () returned 0x970 [0077.850] GetCurrentThreadId () returned 0x970 [0077.850] GetCurrentThreadId () returned 0x970 [0077.850] GetCurrentThreadId () returned 0x970 [0077.850] GetCurrentThreadId () returned 0x970 [0077.850] GetCurrentThreadId () returned 0x970 [0077.850] GetCurrentThreadId () returned 0x970 [0077.850] GetCurrentThreadId () returned 0x970 [0077.850] GetCurrentThreadId () returned 0x970 [0077.850] GetCurrentThreadId () returned 0x970 [0077.850] GetCurrentThreadId () returned 0x970 [0077.850] GetCurrentThreadId () returned 0x970 [0077.850] GetCurrentThreadId () returned 0x970 [0077.850] GetCurrentThreadId () returned 0x970 [0077.850] GetCurrentThreadId () returned 0x970 [0077.850] GetCurrentThreadId () returned 0x970 [0077.851] GetCurrentThreadId () returned 0x970 [0077.851] GetCurrentThreadId () returned 0x970 [0077.851] GetCurrentThreadId () returned 0x970 [0077.851] GetCurrentThreadId () returned 0x970 [0077.851] GetCurrentThreadId () returned 0x970 [0077.851] GetCurrentThreadId () returned 0x970 [0077.851] GetCurrentThreadId () returned 0x970 [0077.851] GetCurrentThreadId () returned 0x970 [0077.851] GetCurrentThreadId () returned 0x970 [0077.851] GetCurrentThreadId () returned 0x970 [0077.851] GetCurrentThreadId () returned 0x970 [0077.851] GetCurrentThreadId () returned 0x970 [0077.851] GetCurrentThreadId () returned 0x970 [0077.851] GetCurrentThreadId () returned 0x970 [0077.851] GetCurrentThreadId () returned 0x970 [0077.851] GetCurrentThreadId () returned 0x970 [0077.851] GetCurrentThreadId () returned 0x970 [0077.851] GetCurrentThreadId () returned 0x970 [0077.851] GetCurrentThreadId () returned 0x970 [0077.851] GetCurrentThreadId () returned 0x970 [0077.851] GetCurrentThreadId () returned 0x970 [0077.851] GetCurrentThreadId () returned 0x970 [0077.851] GetCurrentThreadId () returned 0x970 [0077.851] GetCurrentThreadId () returned 0x970 [0077.851] GetCurrentThreadId () returned 0x970 [0077.851] GetCurrentThreadId () returned 0x970 [0077.851] GetCurrentThreadId () returned 0x970 [0077.851] GetCurrentThreadId () returned 0x970 [0077.851] GetCurrentThreadId () returned 0x970 [0077.851] GetCurrentThreadId () returned 0x970 [0077.851] GetCurrentThreadId () returned 0x970 [0077.851] GetCurrentThreadId () returned 0x970 [0077.851] GetCurrentThreadId () returned 0x970 [0077.851] GetCurrentThreadId () returned 0x970 [0077.851] GetCurrentThreadId () returned 0x970 [0077.851] GetCurrentThreadId () returned 0x970 [0077.851] GetCurrentThreadId () returned 0x970 [0077.851] GetCurrentThreadId () returned 0x970 [0077.851] GetCurrentThreadId () returned 0x970 [0077.851] GetCurrentThreadId () returned 0x970 [0077.851] GetCurrentThreadId () returned 0x970 [0077.851] GetCurrentThreadId () returned 0x970 [0077.851] GetCurrentThreadId () returned 0x970 [0077.851] GetCurrentThreadId () returned 0x970 [0077.852] GetCurrentThreadId () returned 0x970 [0077.852] GetCurrentThreadId () returned 0x970 [0077.852] GetCurrentThreadId () returned 0x970 [0077.852] GetCurrentThreadId () returned 0x970 [0077.852] GetCurrentThreadId () returned 0x970 [0077.852] GetCurrentThreadId () returned 0x970 [0077.852] GetCurrentThreadId () returned 0x970 [0077.852] GetCurrentThreadId () returned 0x970 [0077.852] GetCurrentThreadId () returned 0x970 [0077.852] GetCurrentThreadId () returned 0x970 [0077.852] GetCurrentThreadId () returned 0x970 [0077.852] GetCurrentThreadId () returned 0x970 [0077.852] GetCurrentThreadId () returned 0x970 [0077.852] GetCurrentThreadId () returned 0x970 [0077.852] GetCurrentThreadId () returned 0x970 [0077.852] GetCurrentThreadId () returned 0x970 [0077.852] GetCurrentThreadId () returned 0x970 [0077.852] GetCurrentThreadId () returned 0x970 [0077.852] GetCurrentThreadId () returned 0x970 [0077.852] GetCurrentThreadId () returned 0x970 [0077.852] GetCurrentThreadId () returned 0x970 [0077.852] GetCurrentThreadId () returned 0x970 [0077.852] GetCurrentThreadId () returned 0x970 [0077.852] GetCurrentThreadId () returned 0x970 [0077.852] GetCurrentThreadId () returned 0x970 [0077.852] GetCurrentThreadId () returned 0x970 [0077.852] GetCurrentThreadId () returned 0x970 [0077.852] GetCurrentThreadId () returned 0x970 [0077.852] GetCurrentThreadId () returned 0x970 [0077.852] GetCurrentThreadId () returned 0x970 [0077.852] GetCurrentThreadId () returned 0x970 [0077.852] GetCurrentThreadId () returned 0x970 [0077.852] GetCurrentThreadId () returned 0x970 [0077.852] GetCurrentThreadId () returned 0x970 [0077.852] GetCurrentThreadId () returned 0x970 [0077.852] GetCurrentThreadId () returned 0x970 [0077.852] GetCurrentThreadId () returned 0x970 [0077.852] GetCurrentThreadId () returned 0x970 [0077.852] GetCurrentThreadId () returned 0x970 [0077.852] GetCurrentThreadId () returned 0x970 [0077.852] GetCurrentThreadId () returned 0x970 [0077.852] GetCurrentThreadId () returned 0x970 [0077.852] GetCurrentThreadId () returned 0x970 [0077.852] GetCurrentThreadId () returned 0x970 [0077.852] GetCurrentThreadId () returned 0x970 [0077.853] GetCurrentThreadId () returned 0x970 [0077.853] GetCurrentThreadId () returned 0x970 [0077.853] GetCurrentThreadId () returned 0x970 [0077.853] GetCurrentThreadId () returned 0x970 [0077.853] GetCurrentThreadId () returned 0x970 [0077.853] GetCurrentThreadId () returned 0x970 [0077.853] GetCurrentThreadId () returned 0x970 [0077.853] GetCurrentThreadId () returned 0x970 [0077.853] GetCurrentThreadId () returned 0x970 [0077.853] GetCurrentThreadId () returned 0x970 [0077.853] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.853] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.853] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a1658, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.853] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.853] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.853] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a1658, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.853] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.853] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.853] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.853] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.853] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.853] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.853] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.853] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.853] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a16b8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.853] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.853] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.853] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a16b8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.853] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.853] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.853] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a16b8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.853] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x19, wMilliseconds=0x79)) [0077.853] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Fs8}zHZPz5RA!ve#Zbw+VlM$mK,6E,l#", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0077.853] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Fs8}zHZPz5RA!ve#Zbw+VlM$mK,6E,l#", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0077.854] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Fs8}zHZPz5RA!ve#Zbw+VlM$mK,6E,l#", cchWideChar=32, lpMultiByteStr=0x3b582d8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Fs8}zHZPz5RA!ve#Zbw+VlM$mK,6E,l#", lpUsedDefaultChar=0x0) returned 32 [0077.854] GetCurrentThreadId () returned 0x970 [0077.854] GetCurrentThreadId () returned 0x970 [0077.854] GetCurrentThreadId () returned 0x970 [0077.854] GetCurrentThreadId () returned 0x970 [0077.854] GetCurrentThreadId () returned 0x970 [0077.854] GetCurrentThreadId () returned 0x970 [0077.873] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0077.873] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0077.873] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3b43468, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0077.873] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34edf48, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0077.873] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34edf48, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAAbo4HRYng7lxeOGVtMZF8OWssuB7lx/C2F+GT6jO9nYQsuKzUqTIPJlyEoRRscebQvpcxTYKXFRJQgvCC5y/Bt9haLTpptUaWJT9wNeRxGGj/0IyvrZUL27eU3xSbZt/6sQNCmRR8V/+2SJ/Pwgq+Mzpekmof3BNn53g2rxb2iPM/LekLK/3vLJpHGkYVSzSQuAFRN/HDLIU4BUqEa+OG82vmym3QyDkA==") returned 232 [0077.873] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x19, wMilliseconds=0x89)) [0077.873] GetCurrentThreadId () returned 0x970 [0077.873] GetCurrentThreadId () returned 0x970 [0077.873] GetCurrentThreadId () returned 0x970 [0077.873] GetCurrentThreadId () returned 0x970 [0077.873] GetCurrentThreadId () returned 0x970 [0077.873] GetCurrentThreadId () returned 0x970 [0077.873] GetCurrentThreadId () returned 0x970 [0077.873] GetCurrentThreadId () returned 0x970 [0077.873] GetCurrentThreadId () returned 0x970 [0077.873] GetCurrentThreadId () returned 0x970 [0077.873] GetCurrentThreadId () returned 0x970 [0077.873] GetCurrentThreadId () returned 0x970 [0077.873] GetCurrentThreadId () returned 0x970 [0077.873] GetCurrentThreadId () returned 0x970 [0077.873] GetCurrentThreadId () returned 0x970 [0077.874] GetCurrentThreadId () returned 0x970 [0077.874] GetCurrentThreadId () returned 0x970 [0077.874] GetCurrentThreadId () returned 0x970 [0077.874] GetCurrentThreadId () returned 0x970 [0077.874] GetCurrentThreadId () returned 0x970 [0077.874] GetCurrentThreadId () returned 0x970 [0077.874] GetCurrentThreadId () returned 0x970 [0077.874] GetCurrentThreadId () returned 0x970 [0077.874] GetCurrentThreadId () returned 0x970 [0077.874] GetCurrentThreadId () returned 0x970 [0077.874] GetCurrentThreadId () returned 0x970 [0077.874] GetCurrentThreadId () returned 0x970 [0077.874] GetCurrentThreadId () returned 0x970 [0077.874] GetCurrentThreadId () returned 0x970 [0077.874] GetCurrentThreadId () returned 0x970 [0077.874] GetCurrentThreadId () returned 0x970 [0077.874] GetCurrentThreadId () returned 0x970 [0077.874] GetCurrentThreadId () returned 0x970 [0077.874] GetCurrentThreadId () returned 0x970 [0077.874] GetCurrentThreadId () returned 0x970 [0077.874] GetCurrentThreadId () returned 0x970 [0077.874] GetCurrentThreadId () returned 0x970 [0077.874] GetCurrentThreadId () returned 0x970 [0077.874] GetCurrentThreadId () returned 0x970 [0077.874] GetCurrentThreadId () returned 0x970 [0077.874] GetCurrentThreadId () returned 0x970 [0077.874] GetCurrentThreadId () returned 0x970 [0077.874] GetCurrentThreadId () returned 0x970 [0077.874] GetCurrentThreadId () returned 0x970 [0077.874] GetCurrentThreadId () returned 0x970 [0077.874] GetCurrentThreadId () returned 0x970 [0077.874] GetCurrentThreadId () returned 0x970 [0077.874] GetCurrentThreadId () returned 0x970 [0077.874] GetCurrentThreadId () returned 0x970 [0077.874] GetCurrentThreadId () returned 0x970 [0077.874] GetCurrentThreadId () returned 0x970 [0077.874] GetCurrentThreadId () returned 0x970 [0077.874] GetCurrentThreadId () returned 0x970 [0077.874] GetCurrentThreadId () returned 0x970 [0077.874] GetCurrentThreadId () returned 0x970 [0077.874] GetCurrentThreadId () returned 0x970 [0077.874] GetCurrentThreadId () returned 0x970 [0077.874] GetCurrentThreadId () returned 0x970 [0077.874] GetCurrentThreadId () returned 0x970 [0077.874] GetCurrentThreadId () returned 0x970 [0077.875] GetCurrentThreadId () returned 0x970 [0077.875] GetCurrentThreadId () returned 0x970 [0077.875] GetCurrentThreadId () returned 0x970 [0077.875] GetCurrentThreadId () returned 0x970 [0077.875] GetCurrentThreadId () returned 0x970 [0077.875] GetCurrentThreadId () returned 0x970 [0077.875] GetCurrentThreadId () returned 0x970 [0077.875] GetCurrentThreadId () returned 0x970 [0077.875] GetCurrentThreadId () returned 0x970 [0077.875] GetCurrentThreadId () returned 0x970 [0077.875] GetCurrentThreadId () returned 0x970 [0077.875] GetCurrentThreadId () returned 0x970 [0077.875] GetCurrentThreadId () returned 0x970 [0077.875] GetCurrentThreadId () returned 0x970 [0077.875] GetCurrentThreadId () returned 0x970 [0077.875] GetCurrentThreadId () returned 0x970 [0077.875] GetCurrentThreadId () returned 0x970 [0077.875] GetCurrentThreadId () returned 0x970 [0077.875] GetCurrentThreadId () returned 0x970 [0077.875] GetCurrentThreadId () returned 0x970 [0077.875] GetCurrentThreadId () returned 0x970 [0077.875] GetCurrentThreadId () returned 0x970 [0077.875] GetCurrentThreadId () returned 0x970 [0077.875] GetCurrentThreadId () returned 0x970 [0077.875] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAAbo4HRYng7lxeOGVtMZF8OWssuB7lx/C2F+GT6jO9nYQsuKzUqTIPJlyEoRRscebQvpcxTYKXFRJQgvCC5y/Bt9haLTpptUaWJT9wNeRxGGj/0IyvrZUL27eU3xSbZt/6sQNCmRR8V/+2SJ/Pwgq+Mzpekmof3BNn53g2rxb2iPM/LekLK/3vLJpHGkYVSzSQuAFRN/HDLIU4BUqEa+OG82vmym3QyDkA==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0077.875] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAAbo4HRYng7lxeOGVtMZF8OWssuB7lx/C2F+GT6jO9nYQsuKzUqTIPJlyEoRRscebQvpcxTYKXFRJQgvCC5y/Bt9haLTpptUaWJT9wNeRxGGj/0IyvrZUL27eU3xSbZt/6sQNCmRR8V/+2SJ/Pwgq+Mzpekmof3BNn53g2rxb2iPM/LekLK/3vLJpHGkYVSzSQuAFRN/HDLIU4BUqEa+OG82vmym3QyDkA==", cchWideChar=245, lpMultiByteStr=0x3b4cd5c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAAbo4HRYng7lxeOGVtMZF8OWssuB7lx/C2F+GT6jO9nYQsuKzUqTIPJlyEoRRscebQvpcxTYKXFRJQgvCC5y/Bt9haLTpptUaWJT9wNeRxGGj/0IyvrZUL27eU3xSbZt/6sQNCmRR8V/+2SJ/Pwgq+Mzpekmof3BNn53g2rxb2iPM/LekLK/3vLJpHGkYVSzSQuAFRN/HDLIU4BUqEa+OG82vmym3QyDkA==", lpUsedDefaultChar=0x0) returned 245 [0077.875] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0077.875] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0077.875] CloseHandle (hObject=0x158) returned 1 [0077.876] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\play-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\play-background.png")) returned 0 [0077.876] GetLastError () returned 0x5 [0077.876] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\play-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\play-background.png")) returned 0x20 [0077.876] SetLastError (dwErrCode=0x5) [0077.876] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=19813926497) returned 1 [0077.876] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Файл зашифрован [selection_subpicture.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\Файл зашифрован [selection_subpicture.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0077.876] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0077.877] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0077.877] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0077.877] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0077.877] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0077.877] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0077.877] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0077.877] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0077.877] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0077.877] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0077.877] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0077.877] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0077.877] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0077.877] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0077.877] SetEndOfFile (hFile=0x158) returned 1 [0077.877] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0077.877] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0077.877] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0077.878] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0077.878] WriteFile (in: hFile=0x158, lpBuffer=0x3777058*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777058*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0077.878] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0077.879] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e?rutzV{imazB:m{wz\"Vf:*UoL%$V+Y.", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0077.879] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e?rutzV{imazB:m{wz\"Vf:*UoL%$V+Y.", cchWideChar=32, lpMultiByteStr=0x20390f4, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="e?rutzV{imazB:m{wz\"Vf:*UoL%$V+Y.", lpUsedDefaultChar=0x0) returned 32 [0077.879] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0077.879] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0077.879] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\selection_subpicture.png", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72512e17, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72512e17, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5545b6b5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbf1, dwReserved0=0x0, dwReserved1=0x0, cFileName="selection_subpicture.png", cAlternateFileName="")) returned 0x295098 [0077.879] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0077.879] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0077.879] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\selection_subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\selection_subpicture.png")) returned 0x20 [0077.879] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\selection_subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\selection_subpicture.png")) returned 0x20 [0077.879] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\selection_subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\selection_subpicture.png")) returned 0x20 [0077.879] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\selection_subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\selection_subpicture.png")) returned 0x20 [0077.879] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\selection_subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\selection_subpicture.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72512e17, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72512e17, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5545b6b5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbf1)) returned 1 [0077.879] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0077.879] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0077.879] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\selection_subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\selection_subpicture.png")) returned 0x20 [0077.879] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\selection_subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\selection_subpicture.png")) returned 0x20 [0077.880] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0077.880] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0077.880] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0077.880] SetEndOfFile (hFile=0x158) returned 1 [0077.880] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="selection_subpicture.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0077.880] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="selection_subpicture.png", cchWideChar=24, lpMultiByteStr=0x3b7150c, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="selection_subpicture.png", lpUsedDefaultChar=0x0) returned 24 [0077.881] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="selection_subpicture.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0077.881] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="selection_subpicture.png", cchWideChar=24, lpMultiByteStr=0x3b7153c, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="selection_subpicture.png", lpUsedDefaultChar=0x0) returned 24 [0077.881] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3b7153c, cbMultiByte=24, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="selection_subpicture.pngng.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 24 [0077.881] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="selection_subpicture.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0077.881] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="selection_subpicture.png", cchWideChar=24, lpMultiByteStr=0x3b7150c, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="selection_subpicture.png", lpUsedDefaultChar=0x0) returned 24 [0077.881] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\selection_subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\selection_subpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0077.881] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0077.881] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0xbf1 [0077.881] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0077.881] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0077.881] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0077.881] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="selection_subpicture.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0077.881] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="selection_subpicture.png", cchWideChar=24, lpMultiByteStr=0x3b7150c, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="selection_subpicture.png", lpUsedDefaultChar=0x0) returned 24 [0077.882] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="selection_subpicture.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0077.882] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="selection_subpicture.png", cchWideChar=24, lpMultiByteStr=0x3b7153c, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="selection_subpicture.png", lpUsedDefaultChar=0x0) returned 24 [0077.882] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3b7153c, cbMultiByte=24, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="selection_subpicture.pngre.pngng.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 24 [0077.882] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="selection_subpicture.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0077.882] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="selection_subpicture.png", cchWideChar=24, lpMultiByteStr=0x3b7150c, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="selection_subpicture.png", lpUsedDefaultChar=0x0) returned 24 [0077.882] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0077.883] CharToOemA (in: pSrc="selection_subpicture.png", pDst=0x3b7153c | out: pDst="selection_subpicture.png") returned 1 [0077.883] WriteFile (in: hFile=0x158, lpBuffer=0x3b7153c*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x3b7153c*, lpNumberOfBytesWritten=0x18e048*=0x18, lpOverlapped=0x0) returned 1 [0077.883] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0077.883] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0077.883] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0077.883] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=19814649828) returned 1 [0077.883] ReadFile (in: hFile=0x11c, lpBuffer=0x3b787e0, nNumberOfBytesToRead=0xbf1, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b787e0*, lpNumberOfBytesRead=0x18dd7c*=0xbf1, lpOverlapped=0x0) returned 1 [0077.885] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0077.885] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=19814814018) returned 1 [0077.894] WriteFile (in: hFile=0x158, lpBuffer=0x379adb0*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379adb0*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0077.894] ReadFile (in: hFile=0x11c, lpBuffer=0x3b787e0, nNumberOfBytesToRead=0xbf1, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3b787e0*, lpNumberOfBytesRead=0x18de38*=0xbf1, lpOverlapped=0x0) returned 1 [0077.894] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x53 [0077.894] WriteFile (in: hFile=0x158, lpBuffer=0x3b9aba0*, nNumberOfBytesToWrite=0xbf1, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3b9aba0*, lpNumberOfBytesWritten=0x18de10*=0xbf1, lpOverlapped=0x0) returned 1 [0077.894] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0xc44 [0077.894] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0077.895] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0077.895] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0077.895] SetFilePointer (in: hFile=0x158, lDistanceToMove=24, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x36 [0077.895] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0xc4e [0077.895] CloseHandle (hObject=0x11c) returned 1 [0077.895] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xc4e [0077.895] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xc4e [0077.895] SetFilePointer (in: hFile=0x158, lDistanceToMove=3150, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xc4e [0077.895] SetFilePointer (in: hFile=0x158, lDistanceToMove=3150, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0xc4e [0077.895] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xc4e [0077.895] SetFilePointer (in: hFile=0x158, lDistanceToMove=3150, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0xc4e [0077.895] SetEndOfFile (hFile=0x158) returned 1 [0077.895] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xc4e [0077.895] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xc4e [0077.896] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="selection_subpicture.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0077.896] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="selection_subpicture.png", cchWideChar=24, lpMultiByteStr=0x3b7153c, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="selection_subpicture.png", lpUsedDefaultChar=0x0) returned 24 [0077.896] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="selection_subpicture.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0077.896] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="selection_subpicture.png", cchWideChar=24, lpMultiByteStr=0x3b7150c, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="selection_subpicture.png", lpUsedDefaultChar=0x0) returned 24 [0077.896] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3b7150c, cbMultiByte=24, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="selection_subpicture.png䭐ȁ\x14\x14\x01c䃑㫋ܿ蔒఍") returned 24 [0077.896] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="selection_subpicture.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0077.896] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="selection_subpicture.png", cchWideChar=24, lpMultiByteStr=0x3b7153c, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="selection_subpicture.png", lpUsedDefaultChar=0x0) returned 24 [0077.896] WriteFile (in: hFile=0x158, lpBuffer=0x3b54f88*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3b54f88*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0077.896] CharToOemA (in: pSrc="selection_subpicture.png", pDst=0x3b7150c | out: pDst="selection_subpicture.png") returned 1 [0077.896] WriteFile (in: hFile=0x158, lpBuffer=0x3b7150c*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3b7150c*, lpNumberOfBytesWritten=0x18efcc*=0x18, lpOverlapped=0x0) returned 1 [0077.896] WriteFile (in: hFile=0x158, lpBuffer=0x379ae18*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379ae18*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0077.896] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0077.896] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0077.896] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xc9f [0077.896] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xc9f [0077.896] WriteFile (in: hFile=0x158, lpBuffer=0x3777058*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777058*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0077.897] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0077.897] DeleteFileW (lpFileName="") returned 0 [0077.897] GetLastError () returned 0x3 [0077.897] GetFileAttributesW (lpFileName="") returned 0xffffffff [0077.897] SetLastError (dwErrCode=0x3) [0077.897] FlushFileBuffers (hFile=0x158) returned 1 [0077.899] GetCurrentThreadId () returned 0x970 [0077.899] GetCurrentThreadId () returned 0x970 [0077.899] GetCurrentThreadId () returned 0x970 [0077.900] GetCurrentThreadId () returned 0x970 [0077.900] GetCurrentThreadId () returned 0x970 [0077.900] GetCurrentThreadId () returned 0x970 [0077.900] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xd56 [0077.900] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xd56 [0077.900] SetFilePointer (in: hFile=0x158, lDistanceToMove=3414, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xd56 [0077.900] CloseHandle (hObject=0x158) returned 1 [0077.900] GetCurrentThreadId () returned 0x970 [0077.900] GetCurrentThreadId () returned 0x970 [0077.900] GetCurrentThreadId () returned 0x970 [0077.900] GetCurrentThreadId () returned 0x970 [0077.900] GetCurrentThreadId () returned 0x970 [0077.900] GetCurrentThreadId () returned 0x970 [0077.900] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Файл зашифрован [selection_subpicture.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\Файл зашифрован [selection_subpicture.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0077.900] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd56 [0077.900] SetFilePointer (in: hFile=0x158, lDistanceToMove=3286, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xcd6 [0077.900] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0077.900] GetFileType (hFile=0x158) returned 0x1 [0077.900] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x19, wMilliseconds=0xa8)) [0077.900] GetCurrentThreadId () returned 0x970 [0077.900] GetCurrentThreadId () returned 0x970 [0077.901] GetCurrentThreadId () returned 0x970 [0077.901] GetCurrentThreadId () returned 0x970 [0077.901] GetCurrentThreadId () returned 0x970 [0077.901] GetCurrentThreadId () returned 0x970 [0077.901] GetCurrentThreadId () returned 0x970 [0077.901] GetCurrentThreadId () returned 0x970 [0077.901] GetCurrentThreadId () returned 0x970 [0077.901] GetCurrentThreadId () returned 0x970 [0077.901] GetCurrentThreadId () returned 0x970 [0077.901] GetCurrentThreadId () returned 0x970 [0077.901] GetCurrentThreadId () returned 0x970 [0077.901] GetCurrentThreadId () returned 0x970 [0077.901] GetCurrentThreadId () returned 0x970 [0077.901] GetCurrentThreadId () returned 0x970 [0077.901] GetCurrentThreadId () returned 0x970 [0077.901] GetCurrentThreadId () returned 0x970 [0077.901] GetCurrentThreadId () returned 0x970 [0077.901] GetCurrentThreadId () returned 0x970 [0077.901] GetCurrentThreadId () returned 0x970 [0077.901] GetCurrentThreadId () returned 0x970 [0077.901] GetCurrentThreadId () returned 0x970 [0077.901] GetCurrentThreadId () returned 0x970 [0077.901] GetCurrentThreadId () returned 0x970 [0077.901] GetCurrentThreadId () returned 0x970 [0077.901] GetCurrentThreadId () returned 0x970 [0077.901] GetCurrentThreadId () returned 0x970 [0077.901] GetCurrentThreadId () returned 0x970 [0077.901] GetCurrentThreadId () returned 0x970 [0077.901] GetCurrentThreadId () returned 0x970 [0077.901] GetCurrentThreadId () returned 0x970 [0077.901] GetCurrentThreadId () returned 0x970 [0077.901] GetCurrentThreadId () returned 0x970 [0077.901] GetCurrentThreadId () returned 0x970 [0077.901] GetCurrentThreadId () returned 0x970 [0077.901] GetCurrentThreadId () returned 0x970 [0077.901] GetCurrentThreadId () returned 0x970 [0077.901] GetCurrentThreadId () returned 0x970 [0077.901] GetCurrentThreadId () returned 0x970 [0077.901] GetCurrentThreadId () returned 0x970 [0077.901] GetCurrentThreadId () returned 0x970 [0077.901] GetCurrentThreadId () returned 0x970 [0077.901] GetCurrentThreadId () returned 0x970 [0077.901] GetCurrentThreadId () returned 0x970 [0077.901] GetCurrentThreadId () returned 0x970 [0077.902] GetCurrentThreadId () returned 0x970 [0077.902] GetCurrentThreadId () returned 0x970 [0077.902] GetCurrentThreadId () returned 0x970 [0077.902] GetCurrentThreadId () returned 0x970 [0077.902] GetCurrentThreadId () returned 0x970 [0077.902] GetCurrentThreadId () returned 0x970 [0077.902] GetCurrentThreadId () returned 0x970 [0077.902] GetCurrentThreadId () returned 0x970 [0077.902] GetCurrentThreadId () returned 0x970 [0077.902] GetCurrentThreadId () returned 0x970 [0077.902] GetCurrentThreadId () returned 0x970 [0077.902] GetCurrentThreadId () returned 0x970 [0077.902] GetCurrentThreadId () returned 0x970 [0077.902] GetCurrentThreadId () returned 0x970 [0077.902] GetCurrentThreadId () returned 0x970 [0077.902] GetCurrentThreadId () returned 0x970 [0077.902] GetCurrentThreadId () returned 0x970 [0077.902] GetCurrentThreadId () returned 0x970 [0077.902] GetCurrentThreadId () returned 0x970 [0077.902] GetCurrentThreadId () returned 0x970 [0077.902] GetCurrentThreadId () returned 0x970 [0077.902] GetCurrentThreadId () returned 0x970 [0077.902] GetCurrentThreadId () returned 0x970 [0077.902] GetCurrentThreadId () returned 0x970 [0077.902] GetCurrentThreadId () returned 0x970 [0077.902] GetCurrentThreadId () returned 0x970 [0077.902] GetCurrentThreadId () returned 0x970 [0077.902] GetCurrentThreadId () returned 0x970 [0077.902] GetCurrentThreadId () returned 0x970 [0077.902] GetCurrentThreadId () returned 0x970 [0077.902] GetCurrentThreadId () returned 0x970 [0077.902] GetCurrentThreadId () returned 0x970 [0077.902] GetCurrentThreadId () returned 0x970 [0077.902] GetCurrentThreadId () returned 0x970 [0077.902] GetCurrentThreadId () returned 0x970 [0077.902] GetCurrentThreadId () returned 0x970 [0077.902] GetCurrentThreadId () returned 0x970 [0077.902] GetCurrentThreadId () returned 0x970 [0077.902] GetCurrentThreadId () returned 0x970 [0077.902] GetCurrentThreadId () returned 0x970 [0077.902] GetCurrentThreadId () returned 0x970 [0077.902] GetCurrentThreadId () returned 0x970 [0077.902] GetCurrentThreadId () returned 0x970 [0077.902] GetCurrentThreadId () returned 0x970 [0077.902] GetCurrentThreadId () returned 0x970 [0077.903] GetCurrentThreadId () returned 0x970 [0077.903] GetCurrentThreadId () returned 0x970 [0077.903] GetCurrentThreadId () returned 0x970 [0077.903] GetCurrentThreadId () returned 0x970 [0077.903] GetCurrentThreadId () returned 0x970 [0077.903] GetCurrentThreadId () returned 0x970 [0077.903] GetCurrentThreadId () returned 0x970 [0077.903] GetCurrentThreadId () returned 0x970 [0077.903] GetCurrentThreadId () returned 0x970 [0077.903] GetCurrentThreadId () returned 0x970 [0077.903] GetCurrentThreadId () returned 0x970 [0077.903] GetCurrentThreadId () returned 0x970 [0077.903] GetCurrentThreadId () returned 0x970 [0077.903] GetCurrentThreadId () returned 0x970 [0077.903] GetCurrentThreadId () returned 0x970 [0077.903] GetCurrentThreadId () returned 0x970 [0077.903] GetCurrentThreadId () returned 0x970 [0077.903] GetCurrentThreadId () returned 0x970 [0077.903] GetCurrentThreadId () returned 0x970 [0077.903] GetCurrentThreadId () returned 0x970 [0077.903] GetCurrentThreadId () returned 0x970 [0077.903] GetCurrentThreadId () returned 0x970 [0077.903] GetCurrentThreadId () returned 0x970 [0077.903] GetCurrentThreadId () returned 0x970 [0077.903] GetCurrentThreadId () returned 0x970 [0077.903] GetCurrentThreadId () returned 0x970 [0077.903] GetCurrentThreadId () returned 0x970 [0077.903] GetCurrentThreadId () returned 0x970 [0077.903] GetCurrentThreadId () returned 0x970 [0077.903] GetCurrentThreadId () returned 0x970 [0077.903] GetCurrentThreadId () returned 0x970 [0077.903] GetCurrentThreadId () returned 0x970 [0077.903] GetCurrentThreadId () returned 0x970 [0077.903] GetCurrentThreadId () returned 0x970 [0077.903] GetCurrentThreadId () returned 0x970 [0077.903] GetCurrentThreadId () returned 0x970 [0077.903] GetCurrentThreadId () returned 0x970 [0077.903] GetCurrentThreadId () returned 0x970 [0077.903] GetCurrentThreadId () returned 0x970 [0077.903] GetCurrentThreadId () returned 0x970 [0077.903] GetCurrentThreadId () returned 0x970 [0077.904] GetCurrentThreadId () returned 0x970 [0077.904] GetCurrentThreadId () returned 0x970 [0077.904] GetCurrentThreadId () returned 0x970 [0077.904] GetCurrentThreadId () returned 0x970 [0077.904] GetCurrentThreadId () returned 0x970 [0077.904] GetCurrentThreadId () returned 0x970 [0077.904] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.904] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.904] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a16b8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.904] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.904] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.904] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a16b8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.904] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.904] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.904] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.904] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.904] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.904] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.904] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.904] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.904] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a1718, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.904] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.904] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.904] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a1718, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.904] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.904] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.904] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a1718, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.904] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x19, wMilliseconds=0xb8)) [0077.905] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="e?rutzV{imazB:m{wz\"Vf:*UoL%$V+Y.", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0077.905] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="e?rutzV{imazB:m{wz\"Vf:*UoL%$V+Y.", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0077.905] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="e?rutzV{imazB:m{wz\"Vf:*UoL%$V+Y.", cchWideChar=32, lpMultiByteStr=0x3b58308, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="e?rutzV{imazB:m{wz\"Vf:*UoL%$V+Y.", lpUsedDefaultChar=0x0) returned 32 [0077.905] GetCurrentThreadId () returned 0x970 [0077.905] GetCurrentThreadId () returned 0x970 [0077.905] GetCurrentThreadId () returned 0x970 [0077.905] GetCurrentThreadId () returned 0x970 [0077.905] GetCurrentThreadId () returned 0x970 [0077.905] GetCurrentThreadId () returned 0x970 [0077.912] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0077.912] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0077.912] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3b43558, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0077.912] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34edf48, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0077.912] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34edf48, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAAano70qjwkfgkrabr+Ml4GqGpXVz1bFQ7Dbyf85emLNUNsvlYuNayN9DA8h7uIKYGFVHhmyR9iY04i0cZwkC+hfyAsfIFx2WV1obvXqKfGpyPXdv9zZML7xPHrvIqGzmRmYvx9gV4yHa0NkhC22G8RP6U/NpBIzNS7jffgsiOcajc2TwZGe8MyR4mdW9NKFgajT2DVCZUZjTHLlRSY3ogrtYo9+tp4DKA==") returned 232 [0077.912] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x19, wMilliseconds=0xb8)) [0077.912] GetCurrentThreadId () returned 0x970 [0077.912] GetCurrentThreadId () returned 0x970 [0077.912] GetCurrentThreadId () returned 0x970 [0077.912] GetCurrentThreadId () returned 0x970 [0077.913] GetCurrentThreadId () returned 0x970 [0077.913] GetCurrentThreadId () returned 0x970 [0077.913] GetCurrentThreadId () returned 0x970 [0077.913] GetCurrentThreadId () returned 0x970 [0077.913] GetCurrentThreadId () returned 0x970 [0077.913] GetCurrentThreadId () returned 0x970 [0077.913] GetCurrentThreadId () returned 0x970 [0077.913] GetCurrentThreadId () returned 0x970 [0077.913] GetCurrentThreadId () returned 0x970 [0077.913] GetCurrentThreadId () returned 0x970 [0077.913] GetCurrentThreadId () returned 0x970 [0077.913] GetCurrentThreadId () returned 0x970 [0077.913] GetCurrentThreadId () returned 0x970 [0077.913] GetCurrentThreadId () returned 0x970 [0077.913] GetCurrentThreadId () returned 0x970 [0077.913] GetCurrentThreadId () returned 0x970 [0077.913] GetCurrentThreadId () returned 0x970 [0077.913] GetCurrentThreadId () returned 0x970 [0077.913] GetCurrentThreadId () returned 0x970 [0077.913] GetCurrentThreadId () returned 0x970 [0077.913] GetCurrentThreadId () returned 0x970 [0077.913] GetCurrentThreadId () returned 0x970 [0077.913] GetCurrentThreadId () returned 0x970 [0077.913] GetCurrentThreadId () returned 0x970 [0077.913] GetCurrentThreadId () returned 0x970 [0077.913] GetCurrentThreadId () returned 0x970 [0077.913] GetCurrentThreadId () returned 0x970 [0077.913] GetCurrentThreadId () returned 0x970 [0077.913] GetCurrentThreadId () returned 0x970 [0077.913] GetCurrentThreadId () returned 0x970 [0077.913] GetCurrentThreadId () returned 0x970 [0077.913] GetCurrentThreadId () returned 0x970 [0077.913] GetCurrentThreadId () returned 0x970 [0077.913] GetCurrentThreadId () returned 0x970 [0077.913] GetCurrentThreadId () returned 0x970 [0077.913] GetCurrentThreadId () returned 0x970 [0077.913] GetCurrentThreadId () returned 0x970 [0077.913] GetCurrentThreadId () returned 0x970 [0077.913] GetCurrentThreadId () returned 0x970 [0077.913] GetCurrentThreadId () returned 0x970 [0077.913] GetCurrentThreadId () returned 0x970 [0077.913] GetCurrentThreadId () returned 0x970 [0077.913] GetCurrentThreadId () returned 0x970 [0077.913] GetCurrentThreadId () returned 0x970 [0077.914] GetCurrentThreadId () returned 0x970 [0077.914] GetCurrentThreadId () returned 0x970 [0077.914] GetCurrentThreadId () returned 0x970 [0077.914] GetCurrentThreadId () returned 0x970 [0077.914] GetCurrentThreadId () returned 0x970 [0077.914] GetCurrentThreadId () returned 0x970 [0077.914] GetCurrentThreadId () returned 0x970 [0077.914] GetCurrentThreadId () returned 0x970 [0077.914] GetCurrentThreadId () returned 0x970 [0077.914] GetCurrentThreadId () returned 0x970 [0077.914] GetCurrentThreadId () returned 0x970 [0077.914] GetCurrentThreadId () returned 0x970 [0077.914] GetCurrentThreadId () returned 0x970 [0077.914] GetCurrentThreadId () returned 0x970 [0077.914] GetCurrentThreadId () returned 0x970 [0077.914] GetCurrentThreadId () returned 0x970 [0077.914] GetCurrentThreadId () returned 0x970 [0077.914] GetCurrentThreadId () returned 0x970 [0077.914] GetCurrentThreadId () returned 0x970 [0077.914] GetCurrentThreadId () returned 0x970 [0077.914] GetCurrentThreadId () returned 0x970 [0077.914] GetCurrentThreadId () returned 0x970 [0077.914] GetCurrentThreadId () returned 0x970 [0077.914] GetCurrentThreadId () returned 0x970 [0077.914] GetCurrentThreadId () returned 0x970 [0077.914] GetCurrentThreadId () returned 0x970 [0077.914] GetCurrentThreadId () returned 0x970 [0077.914] GetCurrentThreadId () returned 0x970 [0077.914] GetCurrentThreadId () returned 0x970 [0077.914] GetCurrentThreadId () returned 0x970 [0077.914] GetCurrentThreadId () returned 0x970 [0077.914] GetCurrentThreadId () returned 0x970 [0077.914] GetCurrentThreadId () returned 0x970 [0077.914] GetCurrentThreadId () returned 0x970 [0077.914] GetCurrentThreadId () returned 0x970 [0077.914] GetCurrentThreadId () returned 0x970 [0077.914] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAAano70qjwkfgkrabr+Ml4GqGpXVz1bFQ7Dbyf85emLNUNsvlYuNayN9DA8h7uIKYGFVHhmyR9iY04i0cZwkC+hfyAsfIFx2WV1obvXqKfGpyPXdv9zZML7xPHrvIqGzmRmYvx9gV4yHa0NkhC22G8RP6U/NpBIzNS7jffgsiOcajc2TwZGe8MyR4mdW9NKFgajT2DVCZUZjTHLlRSY3ogrtYo9+tp4DKA==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0077.914] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAAano70qjwkfgkrabr+Ml4GqGpXVz1bFQ7Dbyf85emLNUNsvlYuNayN9DA8h7uIKYGFVHhmyR9iY04i0cZwkC+hfyAsfIFx2WV1obvXqKfGpyPXdv9zZML7xPHrvIqGzmRmYvx9gV4yHa0NkhC22G8RP6U/NpBIzNS7jffgsiOcajc2TwZGe8MyR4mdW9NKFgajT2DVCZUZjTHLlRSY3ogrtYo9+tp4DKA==", cchWideChar=245, lpMultiByteStr=0x3b4cd5c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAAano70qjwkfgkrabr+Ml4GqGpXVz1bFQ7Dbyf85emLNUNsvlYuNayN9DA8h7uIKYGFVHhmyR9iY04i0cZwkC+hfyAsfIFx2WV1obvXqKfGpyPXdv9zZML7xPHrvIqGzmRmYvx9gV4yHa0NkhC22G8RP6U/NpBIzNS7jffgsiOcajc2TwZGe8MyR4mdW9NKFgajT2DVCZUZjTHLlRSY3ogrtYo9+tp4DKA==", lpUsedDefaultChar=0x0) returned 245 [0077.914] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0077.915] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0077.915] CloseHandle (hObject=0x158) returned 1 [0077.915] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\selection_subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\selection_subpicture.png")) returned 0 [0077.915] GetLastError () returned 0x5 [0077.915] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\selection_subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\selection_subpicture.png")) returned 0x20 [0077.915] SetLastError (dwErrCode=0x5) [0077.915] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=19817852009) returned 1 [0077.915] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Файл зашифрован [travel.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\Файл зашифрован [travel.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0077.916] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0077.916] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0077.916] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0077.916] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0077.917] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0077.917] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0077.917] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0077.917] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0077.917] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0077.917] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0077.917] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0077.917] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0077.917] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0077.917] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0077.917] SetEndOfFile (hFile=0x158) returned 1 [0077.917] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0077.917] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0077.917] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0077.917] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0077.917] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0077.918] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0077.918] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="mF^<=\\?uxgkdb+W3ZI=Mp1lp1RhJ@AUL", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0077.918] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="mF^<=\\?uxgkdb+W3ZI=Mp1lp1RhJ@AUL", cchWideChar=32, lpMultiByteStr=0x2039b74, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mF^<=\\?uxgkdb+W3ZI=Mp1lp1RhJ@AUL", lpUsedDefaultChar=0x0) returned 32 [0077.918] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0077.919] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0077.919] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\travel.png", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x725f7645, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x725f7645, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5545b6b5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x658e, dwReserved0=0x0, dwReserved1=0x0, cFileName="travel.png", cAlternateFileName="")) returned 0x295098 [0077.919] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0077.919] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0077.919] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\travel.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travel.png")) returned 0x20 [0077.920] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\travel.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travel.png")) returned 0x20 [0077.920] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\travel.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travel.png")) returned 0x20 [0077.920] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\travel.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travel.png")) returned 0x20 [0077.920] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\travel.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travel.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x725f7645, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x725f7645, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5545b6b5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x658e)) returned 1 [0077.920] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0077.920] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0077.920] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\travel.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travel.png")) returned 0x20 [0077.920] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\travel.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travel.png")) returned 0x20 [0077.920] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0077.920] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0077.920] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0077.920] SetEndOfFile (hFile=0x158) returned 1 [0077.921] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="travel.png", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.921] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="travel.png", cchWideChar=10, lpMultiByteStr=0x1fe478c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="travel.png", lpUsedDefaultChar=0x0) returned 10 [0077.921] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="travel.png", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.921] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="travel.png", cchWideChar=10, lpMultiByteStr=0x1fe36ec, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="travel.png", lpUsedDefaultChar=0x0) returned 10 [0077.921] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe36ec, cbMultiByte=10, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="travel.pngture.pngre.pngng.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 10 [0077.921] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="travel.png", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.921] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="travel.png", cchWideChar=10, lpMultiByteStr=0x1fe478c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="travel.png", lpUsedDefaultChar=0x0) returned 10 [0077.921] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\travel.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travel.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0077.922] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0077.922] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x658e [0077.922] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0077.922] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0077.922] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0077.922] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="travel.png", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.922] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="travel.png", cchWideChar=10, lpMultiByteStr=0x1fe478c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="travel.png", lpUsedDefaultChar=0x0) returned 10 [0077.922] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="travel.png", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.922] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="travel.png", cchWideChar=10, lpMultiByteStr=0x1fe36ec, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="travel.png", lpUsedDefaultChar=0x0) returned 10 [0077.922] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe36ec, cbMultiByte=10, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="travel.pngel.pngture.pngre.pngng.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 10 [0077.922] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="travel.png", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.922] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="travel.png", cchWideChar=10, lpMultiByteStr=0x1fe478c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="travel.png", lpUsedDefaultChar=0x0) returned 10 [0077.922] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0077.923] CharToOemA (in: pSrc="travel.png", pDst=0x1fe36ec | out: pDst="travel.png") returned 1 [0077.923] WriteFile (in: hFile=0x158, lpBuffer=0x1fe36ec*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe36ec*, lpNumberOfBytesWritten=0x18e048*=0xa, lpOverlapped=0x0) returned 1 [0077.923] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0077.923] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0077.923] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0077.924] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=19818702832) returned 1 [0077.924] ReadFile (in: hFile=0x11c, lpBuffer=0x3b787e0, nNumberOfBytesToRead=0x658e, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b787e0*, lpNumberOfBytesRead=0x18dd7c*=0x658e, lpOverlapped=0x0) returned 1 [0077.925] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0077.925] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=19818874833) returned 1 [0077.934] WriteFile (in: hFile=0x158, lpBuffer=0x379acd8*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379acd8*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0077.934] ReadFile (in: hFile=0x11c, lpBuffer=0x3b787e0, nNumberOfBytesToRead=0x658e, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3b787e0*, lpNumberOfBytesRead=0x18de38*=0x658e, lpOverlapped=0x0) returned 1 [0077.935] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x45 [0077.935] WriteFile (in: hFile=0x158, lpBuffer=0x3b90570*, nNumberOfBytesToWrite=0x658e, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3b90570*, lpNumberOfBytesWritten=0x18de10*=0x658e, lpOverlapped=0x0) returned 1 [0077.936] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x65d3 [0077.936] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0077.936] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0077.936] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0077.936] SetFilePointer (in: hFile=0x158, lDistanceToMove=10, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x28 [0077.936] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x65dd [0077.937] CloseHandle (hObject=0x11c) returned 1 [0077.937] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x65dd [0077.937] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x65dd [0077.937] SetFilePointer (in: hFile=0x158, lDistanceToMove=26077, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x65dd [0077.937] SetFilePointer (in: hFile=0x158, lDistanceToMove=26077, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x65dd [0077.937] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x65dd [0077.937] SetFilePointer (in: hFile=0x158, lDistanceToMove=26077, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x65dd [0077.937] SetEndOfFile (hFile=0x158) returned 1 [0077.937] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x65dd [0077.937] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x65dd [0077.937] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="travel.png", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.937] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="travel.png", cchWideChar=10, lpMultiByteStr=0x1fe478c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="travel.png", lpUsedDefaultChar=0x0) returned 10 [0077.937] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="travel.png", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.937] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="travel.png", cchWideChar=10, lpMultiByteStr=0x1fe64ec, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="travel.png", lpUsedDefaultChar=0x0) returned 10 [0077.937] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe64ec, cbMultiByte=10, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="travel.png\x18ꞗ@涤(\x18믉`믑`") returned 10 [0077.938] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="travel.png", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.938] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="travel.png", cchWideChar=10, lpMultiByteStr=0x1fe478c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="travel.png", lpUsedDefaultChar=0x0) returned 10 [0077.938] WriteFile (in: hFile=0x158, lpBuffer=0x3b5c2b8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3b5c2b8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0077.938] CharToOemA (in: pSrc="travel.png", pDst=0x1fe64ec | out: pDst="travel.png") returned 1 [0077.938] WriteFile (in: hFile=0x158, lpBuffer=0x1fe64ec*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe64ec*, lpNumberOfBytesWritten=0x18efcc*=0xa, lpOverlapped=0x0) returned 1 [0077.938] WriteFile (in: hFile=0x158, lpBuffer=0x379ad88*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379ad88*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0077.938] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0077.938] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0077.938] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x6620 [0077.938] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x6620 [0077.938] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0077.938] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0077.938] DeleteFileW (lpFileName="") returned 0 [0077.938] GetLastError () returned 0x3 [0077.938] GetFileAttributesW (lpFileName="") returned 0xffffffff [0077.938] SetLastError (dwErrCode=0x3) [0077.939] FlushFileBuffers (hFile=0x158) returned 1 [0077.941] GetCurrentThreadId () returned 0x970 [0077.941] GetCurrentThreadId () returned 0x970 [0077.941] GetCurrentThreadId () returned 0x970 [0077.941] GetCurrentThreadId () returned 0x970 [0077.941] GetCurrentThreadId () returned 0x970 [0077.941] GetCurrentThreadId () returned 0x970 [0077.941] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x66d7 [0077.941] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x66d7 [0077.941] SetFilePointer (in: hFile=0x158, lDistanceToMove=26327, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x66d7 [0077.941] CloseHandle (hObject=0x158) returned 1 [0077.942] GetCurrentThreadId () returned 0x970 [0077.942] GetCurrentThreadId () returned 0x970 [0077.942] GetCurrentThreadId () returned 0x970 [0077.942] GetCurrentThreadId () returned 0x970 [0077.942] GetCurrentThreadId () returned 0x970 [0077.942] GetCurrentThreadId () returned 0x970 [0077.942] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Файл зашифрован [travel.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\Файл зашифрован [travel.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0077.942] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x66d7 [0077.942] SetFilePointer (in: hFile=0x158, lDistanceToMove=26199, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6657 [0077.942] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0077.942] GetFileType (hFile=0x158) returned 0x1 [0077.942] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x19, wMilliseconds=0xd7)) [0077.942] GetCurrentThreadId () returned 0x970 [0077.942] GetCurrentThreadId () returned 0x970 [0077.942] GetCurrentThreadId () returned 0x970 [0077.942] GetCurrentThreadId () returned 0x970 [0077.942] GetCurrentThreadId () returned 0x970 [0077.942] GetCurrentThreadId () returned 0x970 [0077.942] GetCurrentThreadId () returned 0x970 [0077.942] GetCurrentThreadId () returned 0x970 [0077.942] GetCurrentThreadId () returned 0x970 [0077.942] GetCurrentThreadId () returned 0x970 [0077.943] GetCurrentThreadId () returned 0x970 [0077.943] GetCurrentThreadId () returned 0x970 [0077.943] GetCurrentThreadId () returned 0x970 [0077.943] GetCurrentThreadId () returned 0x970 [0077.943] GetCurrentThreadId () returned 0x970 [0077.943] GetCurrentThreadId () returned 0x970 [0077.943] GetCurrentThreadId () returned 0x970 [0077.943] GetCurrentThreadId () returned 0x970 [0077.943] GetCurrentThreadId () returned 0x970 [0077.943] GetCurrentThreadId () returned 0x970 [0077.943] GetCurrentThreadId () returned 0x970 [0077.943] GetCurrentThreadId () returned 0x970 [0077.943] GetCurrentThreadId () returned 0x970 [0077.943] GetCurrentThreadId () returned 0x970 [0077.943] GetCurrentThreadId () returned 0x970 [0077.943] GetCurrentThreadId () returned 0x970 [0077.943] GetCurrentThreadId () returned 0x970 [0077.943] GetCurrentThreadId () returned 0x970 [0077.943] GetCurrentThreadId () returned 0x970 [0077.943] GetCurrentThreadId () returned 0x970 [0077.943] GetCurrentThreadId () returned 0x970 [0077.943] GetCurrentThreadId () returned 0x970 [0077.943] GetCurrentThreadId () returned 0x970 [0077.943] GetCurrentThreadId () returned 0x970 [0077.943] GetCurrentThreadId () returned 0x970 [0077.943] GetCurrentThreadId () returned 0x970 [0077.943] GetCurrentThreadId () returned 0x970 [0077.943] GetCurrentThreadId () returned 0x970 [0077.943] GetCurrentThreadId () returned 0x970 [0077.943] GetCurrentThreadId () returned 0x970 [0077.943] GetCurrentThreadId () returned 0x970 [0077.943] GetCurrentThreadId () returned 0x970 [0077.943] GetCurrentThreadId () returned 0x970 [0077.943] GetCurrentThreadId () returned 0x970 [0077.943] GetCurrentThreadId () returned 0x970 [0077.943] GetCurrentThreadId () returned 0x970 [0077.943] GetCurrentThreadId () returned 0x970 [0077.943] GetCurrentThreadId () returned 0x970 [0077.943] GetCurrentThreadId () returned 0x970 [0077.943] GetCurrentThreadId () returned 0x970 [0077.943] GetCurrentThreadId () returned 0x970 [0077.943] GetCurrentThreadId () returned 0x970 [0077.943] GetCurrentThreadId () returned 0x970 [0077.943] GetCurrentThreadId () returned 0x970 [0077.944] GetCurrentThreadId () returned 0x970 [0077.944] GetCurrentThreadId () returned 0x970 [0077.944] GetCurrentThreadId () returned 0x970 [0077.944] GetCurrentThreadId () returned 0x970 [0077.944] GetCurrentThreadId () returned 0x970 [0077.944] GetCurrentThreadId () returned 0x970 [0077.944] GetCurrentThreadId () returned 0x970 [0077.944] GetCurrentThreadId () returned 0x970 [0077.944] GetCurrentThreadId () returned 0x970 [0077.944] GetCurrentThreadId () returned 0x970 [0077.944] GetCurrentThreadId () returned 0x970 [0077.944] GetCurrentThreadId () returned 0x970 [0077.944] GetCurrentThreadId () returned 0x970 [0077.944] GetCurrentThreadId () returned 0x970 [0077.944] GetCurrentThreadId () returned 0x970 [0077.944] GetCurrentThreadId () returned 0x970 [0077.944] GetCurrentThreadId () returned 0x970 [0077.944] GetCurrentThreadId () returned 0x970 [0077.944] GetCurrentThreadId () returned 0x970 [0077.944] GetCurrentThreadId () returned 0x970 [0077.944] GetCurrentThreadId () returned 0x970 [0077.944] GetCurrentThreadId () returned 0x970 [0077.944] GetCurrentThreadId () returned 0x970 [0077.944] GetCurrentThreadId () returned 0x970 [0077.944] GetCurrentThreadId () returned 0x970 [0077.944] GetCurrentThreadId () returned 0x970 [0077.944] GetCurrentThreadId () returned 0x970 [0077.944] GetCurrentThreadId () returned 0x970 [0077.944] GetCurrentThreadId () returned 0x970 [0077.944] GetCurrentThreadId () returned 0x970 [0077.944] GetCurrentThreadId () returned 0x970 [0077.944] GetCurrentThreadId () returned 0x970 [0077.944] GetCurrentThreadId () returned 0x970 [0077.944] GetCurrentThreadId () returned 0x970 [0077.944] GetCurrentThreadId () returned 0x970 [0077.944] GetCurrentThreadId () returned 0x970 [0077.944] GetCurrentThreadId () returned 0x970 [0077.944] GetCurrentThreadId () returned 0x970 [0077.944] GetCurrentThreadId () returned 0x970 [0077.944] GetCurrentThreadId () returned 0x970 [0077.944] GetCurrentThreadId () returned 0x970 [0077.944] GetCurrentThreadId () returned 0x970 [0077.944] GetCurrentThreadId () returned 0x970 [0077.944] GetCurrentThreadId () returned 0x970 [0077.944] GetCurrentThreadId () returned 0x970 [0077.945] GetCurrentThreadId () returned 0x970 [0077.945] GetCurrentThreadId () returned 0x970 [0077.945] GetCurrentThreadId () returned 0x970 [0077.945] GetCurrentThreadId () returned 0x970 [0077.945] GetCurrentThreadId () returned 0x970 [0077.945] GetCurrentThreadId () returned 0x970 [0077.945] GetCurrentThreadId () returned 0x970 [0077.945] GetCurrentThreadId () returned 0x970 [0077.945] GetCurrentThreadId () returned 0x970 [0077.945] GetCurrentThreadId () returned 0x970 [0077.945] GetCurrentThreadId () returned 0x970 [0077.945] GetCurrentThreadId () returned 0x970 [0077.945] GetCurrentThreadId () returned 0x970 [0077.945] GetCurrentThreadId () returned 0x970 [0077.945] GetCurrentThreadId () returned 0x970 [0077.945] GetCurrentThreadId () returned 0x970 [0077.945] GetCurrentThreadId () returned 0x970 [0077.945] GetCurrentThreadId () returned 0x970 [0077.945] GetCurrentThreadId () returned 0x970 [0077.945] GetCurrentThreadId () returned 0x970 [0077.945] GetCurrentThreadId () returned 0x970 [0077.945] GetCurrentThreadId () returned 0x970 [0077.945] GetCurrentThreadId () returned 0x970 [0077.945] GetCurrentThreadId () returned 0x970 [0077.945] GetCurrentThreadId () returned 0x970 [0077.945] GetCurrentThreadId () returned 0x970 [0077.945] GetCurrentThreadId () returned 0x970 [0077.945] GetCurrentThreadId () returned 0x970 [0077.945] GetCurrentThreadId () returned 0x970 [0077.945] GetCurrentThreadId () returned 0x970 [0077.945] GetCurrentThreadId () returned 0x970 [0077.945] GetCurrentThreadId () returned 0x970 [0077.945] GetCurrentThreadId () returned 0x970 [0077.945] GetCurrentThreadId () returned 0x970 [0077.945] GetCurrentThreadId () returned 0x970 [0077.945] GetCurrentThreadId () returned 0x970 [0077.945] GetCurrentThreadId () returned 0x970 [0077.945] GetCurrentThreadId () returned 0x970 [0077.945] GetCurrentThreadId () returned 0x970 [0077.945] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.945] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.945] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a1718, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.946] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.946] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.946] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a1718, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.946] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.946] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.946] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.946] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.946] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.946] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.946] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.946] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.946] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a1778, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.946] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.946] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.946] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a1778, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.946] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.946] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.946] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a1778, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.946] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x19, wMilliseconds=0xd7)) [0077.946] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="mF^<=\\?uxgkdb+W3ZI=Mp1lp1RhJ@AUL", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0077.946] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="mF^<=\\?uxgkdb+W3ZI=Mp1lp1RhJ@AUL", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0077.946] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="mF^<=\\?uxgkdb+W3ZI=Mp1lp1RhJ@AUL", cchWideChar=32, lpMultiByteStr=0x3b58338, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mF^<=\\?uxgkdb+W3ZI=Mp1lp1RhJ@AUL", lpUsedDefaultChar=0x0) returned 32 [0077.946] GetCurrentThreadId () returned 0x970 [0077.946] GetCurrentThreadId () returned 0x970 [0077.946] GetCurrentThreadId () returned 0x970 [0077.946] GetCurrentThreadId () returned 0x970 [0077.946] GetCurrentThreadId () returned 0x970 [0077.946] GetCurrentThreadId () returned 0x970 [0077.954] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0077.954] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0077.954] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3b43648, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0077.954] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34edf48, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0077.954] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34edf48, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAECk8yIWOtMEFvoDT6h65Qp11DhxusMa7/fvcGnfH3sC97t9eR5HyQ1vT8ASdfz7SyU4vbbKXtlHw9MOJBDFVXSveheuuDqDzNdgYYR/hYSWJymDtKpqfumDxTkZqDBiCe95B83gAEx9N87hHuN+HyRqlFsuApEWnLqMR7MU8qkYlxOIRwUNRA/fYXpOoC8SaMeOyMSGIjZufyDJ4ewXRy8LYoQotHabdw==") returned 232 [0077.954] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x19, wMilliseconds=0xe6)) [0077.954] GetCurrentThreadId () returned 0x970 [0077.954] GetCurrentThreadId () returned 0x970 [0077.954] GetCurrentThreadId () returned 0x970 [0077.954] GetCurrentThreadId () returned 0x970 [0077.954] GetCurrentThreadId () returned 0x970 [0077.954] GetCurrentThreadId () returned 0x970 [0077.954] GetCurrentThreadId () returned 0x970 [0077.954] GetCurrentThreadId () returned 0x970 [0077.955] GetCurrentThreadId () returned 0x970 [0077.955] GetCurrentThreadId () returned 0x970 [0077.955] GetCurrentThreadId () returned 0x970 [0077.955] GetCurrentThreadId () returned 0x970 [0077.955] GetCurrentThreadId () returned 0x970 [0077.955] GetCurrentThreadId () returned 0x970 [0077.955] GetCurrentThreadId () returned 0x970 [0077.955] GetCurrentThreadId () returned 0x970 [0077.955] GetCurrentThreadId () returned 0x970 [0077.955] GetCurrentThreadId () returned 0x970 [0077.955] GetCurrentThreadId () returned 0x970 [0077.955] GetCurrentThreadId () returned 0x970 [0077.955] GetCurrentThreadId () returned 0x970 [0077.955] GetCurrentThreadId () returned 0x970 [0077.955] GetCurrentThreadId () returned 0x970 [0077.955] GetCurrentThreadId () returned 0x970 [0077.955] GetCurrentThreadId () returned 0x970 [0077.955] GetCurrentThreadId () returned 0x970 [0077.955] GetCurrentThreadId () returned 0x970 [0077.955] GetCurrentThreadId () returned 0x970 [0077.955] GetCurrentThreadId () returned 0x970 [0077.955] GetCurrentThreadId () returned 0x970 [0077.955] GetCurrentThreadId () returned 0x970 [0077.955] GetCurrentThreadId () returned 0x970 [0077.955] GetCurrentThreadId () returned 0x970 [0077.955] GetCurrentThreadId () returned 0x970 [0077.955] GetCurrentThreadId () returned 0x970 [0077.955] GetCurrentThreadId () returned 0x970 [0077.955] GetCurrentThreadId () returned 0x970 [0077.955] GetCurrentThreadId () returned 0x970 [0077.955] GetCurrentThreadId () returned 0x970 [0077.955] GetCurrentThreadId () returned 0x970 [0077.955] GetCurrentThreadId () returned 0x970 [0077.955] GetCurrentThreadId () returned 0x970 [0077.955] GetCurrentThreadId () returned 0x970 [0077.955] GetCurrentThreadId () returned 0x970 [0077.955] GetCurrentThreadId () returned 0x970 [0077.955] GetCurrentThreadId () returned 0x970 [0077.955] GetCurrentThreadId () returned 0x970 [0077.955] GetCurrentThreadId () returned 0x970 [0077.955] GetCurrentThreadId () returned 0x970 [0077.955] GetCurrentThreadId () returned 0x970 [0077.955] GetCurrentThreadId () returned 0x970 [0077.955] GetCurrentThreadId () returned 0x970 [0077.956] GetCurrentThreadId () returned 0x970 [0077.956] GetCurrentThreadId () returned 0x970 [0077.956] GetCurrentThreadId () returned 0x970 [0077.956] GetCurrentThreadId () returned 0x970 [0077.956] GetCurrentThreadId () returned 0x970 [0077.956] GetCurrentThreadId () returned 0x970 [0077.956] GetCurrentThreadId () returned 0x970 [0077.956] GetCurrentThreadId () returned 0x970 [0077.956] GetCurrentThreadId () returned 0x970 [0077.956] GetCurrentThreadId () returned 0x970 [0077.956] GetCurrentThreadId () returned 0x970 [0077.956] GetCurrentThreadId () returned 0x970 [0077.956] GetCurrentThreadId () returned 0x970 [0077.956] GetCurrentThreadId () returned 0x970 [0077.956] GetCurrentThreadId () returned 0x970 [0077.956] GetCurrentThreadId () returned 0x970 [0077.956] GetCurrentThreadId () returned 0x970 [0077.956] GetCurrentThreadId () returned 0x970 [0077.956] GetCurrentThreadId () returned 0x970 [0077.956] GetCurrentThreadId () returned 0x970 [0077.956] GetCurrentThreadId () returned 0x970 [0077.956] GetCurrentThreadId () returned 0x970 [0077.956] GetCurrentThreadId () returned 0x970 [0077.956] GetCurrentThreadId () returned 0x970 [0077.956] GetCurrentThreadId () returned 0x970 [0077.956] GetCurrentThreadId () returned 0x970 [0077.956] GetCurrentThreadId () returned 0x970 [0077.956] GetCurrentThreadId () returned 0x970 [0077.956] GetCurrentThreadId () returned 0x970 [0077.956] GetCurrentThreadId () returned 0x970 [0077.956] GetCurrentThreadId () returned 0x970 [0077.956] GetCurrentThreadId () returned 0x970 [0077.956] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAECk8yIWOtMEFvoDT6h65Qp11DhxusMa7/fvcGnfH3sC97t9eR5HyQ1vT8ASdfz7SyU4vbbKXtlHw9MOJBDFVXSveheuuDqDzNdgYYR/hYSWJymDtKpqfumDxTkZqDBiCe95B83gAEx9N87hHuN+HyRqlFsuApEWnLqMR7MU8qkYlxOIRwUNRA/fYXpOoC8SaMeOyMSGIjZufyDJ4ewXRy8LYoQotHabdw==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0077.956] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAECk8yIWOtMEFvoDT6h65Qp11DhxusMa7/fvcGnfH3sC97t9eR5HyQ1vT8ASdfz7SyU4vbbKXtlHw9MOJBDFVXSveheuuDqDzNdgYYR/hYSWJymDtKpqfumDxTkZqDBiCe95B83gAEx9N87hHuN+HyRqlFsuApEWnLqMR7MU8qkYlxOIRwUNRA/fYXpOoC8SaMeOyMSGIjZufyDJ4ewXRy8LYoQotHabdw==", cchWideChar=245, lpMultiByteStr=0x3b4cd5c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAECk8yIWOtMEFvoDT6h65Qp11DhxusMa7/fvcGnfH3sC97t9eR5HyQ1vT8ASdfz7SyU4vbbKXtlHw9MOJBDFVXSveheuuDqDzNdgYYR/hYSWJymDtKpqfumDxTkZqDBiCe95B83gAEx9N87hHuN+HyRqlFsuApEWnLqMR7MU8qkYlxOIRwUNRA/fYXpOoC8SaMeOyMSGIjZufyDJ4ewXRy8LYoQotHabdw==", lpUsedDefaultChar=0x0) returned 245 [0077.956] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0077.956] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0077.957] CloseHandle (hObject=0x158) returned 1 [0077.957] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\travel.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travel.png")) returned 0 [0077.957] GetLastError () returned 0x5 [0077.957] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\travel.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travel.png")) returned 0x20 [0077.957] SetLastError (dwErrCode=0x5) [0077.957] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=19822041972) returned 1 [0077.957] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\Файл зашифрован [203x8subpicture.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\Файл зашифрован [203x8subpicture.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0077.958] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0077.958] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0077.958] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0077.958] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0077.958] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0077.958] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0077.958] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0077.958] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0077.958] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0077.958] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0077.958] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0077.958] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0077.958] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0077.959] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0077.959] SetEndOfFile (hFile=0x158) returned 1 [0077.959] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0077.959] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0077.959] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0077.959] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0077.959] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0077.960] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0077.960] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=":8x$9f>H?+hjsw@OfzW%$c4RP=j&L#q~", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0077.960] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=":8x$9f>H?+hjsw@OfzW%$c4RP=j&L#q~", cchWideChar=32, lpMultiByteStr=0x2039cc4, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=":8x$9f>H?+hjsw@OfzW%$c4RP=j&L#q~", lpUsedDefaultChar=0x0) returned 32 [0077.960] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0077.960] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0077.960] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\203x8subpicture.png", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f2a3ff0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f2a3ff0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb04, dwReserved0=0x0, dwReserved1=0x0, cFileName="203x8subpicture.png", cAlternateFileName="")) returned 0x295098 [0077.960] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0077.960] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0077.960] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\203x8subpicture.png")) returned 0x20 [0077.961] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\203x8subpicture.png")) returned 0x20 [0077.961] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\203x8subpicture.png")) returned 0x20 [0077.961] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\203x8subpicture.png")) returned 0x20 [0077.961] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\203x8subpicture.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f2a3ff0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f2a3ff0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb04)) returned 1 [0077.961] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0077.961] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0077.961] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\203x8subpicture.png")) returned 0x20 [0077.961] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\203x8subpicture.png")) returned 0x20 [0077.961] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0077.961] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0077.961] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0077.961] SetEndOfFile (hFile=0x158) returned 1 [0077.962] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="203x8subpicture.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0077.962] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="203x8subpicture.png", cchWideChar=19, lpMultiByteStr=0x1ff88ac, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="203x8subpicture.png", lpUsedDefaultChar=0x0) returned 19 [0077.962] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="203x8subpicture.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0077.962] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="203x8subpicture.png", cchWideChar=19, lpMultiByteStr=0x1ff899c, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="203x8subpicture.png", lpUsedDefaultChar=0x0) returned 19 [0077.962] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff899c, cbMultiByte=19, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="203x8subpicture.pnge.pngng.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 19 [0077.962] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="203x8subpicture.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0077.962] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="203x8subpicture.png", cchWideChar=19, lpMultiByteStr=0x1ff88ac, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="203x8subpicture.png", lpUsedDefaultChar=0x0) returned 19 [0077.962] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\203x8subpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0077.963] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0077.963] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0xb04 [0077.963] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0077.963] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0077.963] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0077.963] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="203x8subpicture.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0077.963] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="203x8subpicture.png", cchWideChar=19, lpMultiByteStr=0x1ff88ac, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="203x8subpicture.png", lpUsedDefaultChar=0x0) returned 19 [0077.963] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="203x8subpicture.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0077.963] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="203x8subpicture.png", cchWideChar=19, lpMultiByteStr=0x1ff899c, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="203x8subpicture.png", lpUsedDefaultChar=0x0) returned 19 [0077.963] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff899c, cbMultiByte=19, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="203x8subpicture.pngre.pnge.pngng.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 19 [0077.963] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="203x8subpicture.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0077.963] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="203x8subpicture.png", cchWideChar=19, lpMultiByteStr=0x1ff88ac, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="203x8subpicture.png", lpUsedDefaultChar=0x0) returned 19 [0077.963] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0077.964] CharToOemA (in: pSrc="203x8subpicture.png", pDst=0x1ff899c | out: pDst="203x8subpicture.png") returned 1 [0077.964] WriteFile (in: hFile=0x158, lpBuffer=0x1ff899c*, nNumberOfBytesToWrite=0x13, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1ff899c*, lpNumberOfBytesWritten=0x18e048*=0x13, lpOverlapped=0x0) returned 1 [0077.964] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0077.964] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0077.965] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0077.965] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=19822812835) returned 1 [0077.965] ReadFile (in: hFile=0x11c, lpBuffer=0x3b787e0, nNumberOfBytesToRead=0xb04, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b787e0*, lpNumberOfBytesRead=0x18dd7c*=0xb04, lpOverlapped=0x0) returned 1 [0077.966] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0077.966] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=19822956583) returned 1 [0077.975] WriteFile (in: hFile=0x158, lpBuffer=0x379ae58*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379ae58*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0077.975] ReadFile (in: hFile=0x11c, lpBuffer=0x3b787e0, nNumberOfBytesToRead=0xb04, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3b787e0*, lpNumberOfBytesRead=0x18de38*=0xb04, lpOverlapped=0x0) returned 1 [0077.975] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x4e [0077.975] WriteFile (in: hFile=0x158, lpBuffer=0x3b9aaa0*, nNumberOfBytesToWrite=0xb04, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3b9aaa0*, lpNumberOfBytesWritten=0x18de10*=0xb04, lpOverlapped=0x0) returned 1 [0077.975] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0xb52 [0077.975] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0077.976] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0077.976] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0077.976] SetFilePointer (in: hFile=0x158, lDistanceToMove=19, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x31 [0077.976] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0xb5c [0077.976] CloseHandle (hObject=0x11c) returned 1 [0077.976] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xb5c [0077.976] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xb5c [0077.976] SetFilePointer (in: hFile=0x158, lDistanceToMove=2908, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xb5c [0077.976] SetFilePointer (in: hFile=0x158, lDistanceToMove=2908, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0xb5c [0077.976] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xb5c [0077.976] SetFilePointer (in: hFile=0x158, lDistanceToMove=2908, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0xb5c [0077.976] SetEndOfFile (hFile=0x158) returned 1 [0077.976] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xb5c [0077.976] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xb5c [0077.977] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="203x8subpicture.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0077.977] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="203x8subpicture.png", cchWideChar=19, lpMultiByteStr=0x1ff899c, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="203x8subpicture.png", lpUsedDefaultChar=0x0) returned 19 [0077.977] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="203x8subpicture.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0077.977] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="203x8subpicture.png", cchWideChar=19, lpMultiByteStr=0x1ff88ac, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="203x8subpicture.png", lpUsedDefaultChar=0x0) returned 19 [0077.977] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff88ac, cbMultiByte=19, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="203x8subpicture.png`믑`") returned 19 [0077.977] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="203x8subpicture.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0077.977] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="203x8subpicture.png", cchWideChar=19, lpMultiByteStr=0x1ff899c, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="203x8subpicture.png", lpUsedDefaultChar=0x0) returned 19 [0077.977] WriteFile (in: hFile=0x158, lpBuffer=0x3b5c2b8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3b5c2b8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0077.977] CharToOemA (in: pSrc="203x8subpicture.png", pDst=0x1ff88ac | out: pDst="203x8subpicture.png") returned 1 [0077.977] WriteFile (in: hFile=0x158, lpBuffer=0x1ff88ac*, nNumberOfBytesToWrite=0x13, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1ff88ac*, lpNumberOfBytesWritten=0x18efcc*=0x13, lpOverlapped=0x0) returned 1 [0077.977] WriteFile (in: hFile=0x158, lpBuffer=0x379ade8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379ade8*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0077.977] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0077.977] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0077.977] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xba8 [0077.977] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xba8 [0077.977] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0077.978] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0077.978] DeleteFileW (lpFileName="") returned 0 [0077.978] GetLastError () returned 0x3 [0077.978] GetFileAttributesW (lpFileName="") returned 0xffffffff [0077.978] SetLastError (dwErrCode=0x3) [0077.978] FlushFileBuffers (hFile=0x158) returned 1 [0077.981] GetCurrentThreadId () returned 0x970 [0077.981] GetCurrentThreadId () returned 0x970 [0077.981] GetCurrentThreadId () returned 0x970 [0077.981] GetCurrentThreadId () returned 0x970 [0077.981] GetCurrentThreadId () returned 0x970 [0077.981] GetCurrentThreadId () returned 0x970 [0077.981] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xc5f [0077.981] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xc5f [0077.981] SetFilePointer (in: hFile=0x158, lDistanceToMove=3167, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xc5f [0077.981] CloseHandle (hObject=0x158) returned 1 [0077.981] GetCurrentThreadId () returned 0x970 [0077.981] GetCurrentThreadId () returned 0x970 [0077.981] GetCurrentThreadId () returned 0x970 [0077.981] GetCurrentThreadId () returned 0x970 [0077.981] GetCurrentThreadId () returned 0x970 [0077.981] GetCurrentThreadId () returned 0x970 [0077.981] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\Файл зашифрован [203x8subpicture.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\Файл зашифрован [203x8subpicture.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0077.981] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc5f [0077.981] SetFilePointer (in: hFile=0x158, lDistanceToMove=3039, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbdf [0077.982] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0077.982] GetFileType (hFile=0x158) returned 0x1 [0077.982] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x19, wMilliseconds=0xf6)) [0077.982] GetCurrentThreadId () returned 0x970 [0077.982] GetCurrentThreadId () returned 0x970 [0077.982] GetCurrentThreadId () returned 0x970 [0077.982] GetCurrentThreadId () returned 0x970 [0077.982] GetCurrentThreadId () returned 0x970 [0077.982] GetCurrentThreadId () returned 0x970 [0077.982] GetCurrentThreadId () returned 0x970 [0077.982] GetCurrentThreadId () returned 0x970 [0077.982] GetCurrentThreadId () returned 0x970 [0077.982] GetCurrentThreadId () returned 0x970 [0077.982] GetCurrentThreadId () returned 0x970 [0077.982] GetCurrentThreadId () returned 0x970 [0077.982] GetCurrentThreadId () returned 0x970 [0077.982] GetCurrentThreadId () returned 0x970 [0077.982] GetCurrentThreadId () returned 0x970 [0077.982] GetCurrentThreadId () returned 0x970 [0077.982] GetCurrentThreadId () returned 0x970 [0077.982] GetCurrentThreadId () returned 0x970 [0077.982] GetCurrentThreadId () returned 0x970 [0077.982] GetCurrentThreadId () returned 0x970 [0077.982] GetCurrentThreadId () returned 0x970 [0077.982] GetCurrentThreadId () returned 0x970 [0077.982] GetCurrentThreadId () returned 0x970 [0077.982] GetCurrentThreadId () returned 0x970 [0077.982] GetCurrentThreadId () returned 0x970 [0077.982] GetCurrentThreadId () returned 0x970 [0077.982] GetCurrentThreadId () returned 0x970 [0077.982] GetCurrentThreadId () returned 0x970 [0077.982] GetCurrentThreadId () returned 0x970 [0077.982] GetCurrentThreadId () returned 0x970 [0077.982] GetCurrentThreadId () returned 0x970 [0077.982] GetCurrentThreadId () returned 0x970 [0077.982] GetCurrentThreadId () returned 0x970 [0077.982] GetCurrentThreadId () returned 0x970 [0077.982] GetCurrentThreadId () returned 0x970 [0077.983] GetCurrentThreadId () returned 0x970 [0077.983] GetCurrentThreadId () returned 0x970 [0077.983] GetCurrentThreadId () returned 0x970 [0077.983] GetCurrentThreadId () returned 0x970 [0077.983] GetCurrentThreadId () returned 0x970 [0077.983] GetCurrentThreadId () returned 0x970 [0077.983] GetCurrentThreadId () returned 0x970 [0077.983] GetCurrentThreadId () returned 0x970 [0077.983] GetCurrentThreadId () returned 0x970 [0077.983] GetCurrentThreadId () returned 0x970 [0077.983] GetCurrentThreadId () returned 0x970 [0077.983] GetCurrentThreadId () returned 0x970 [0077.983] GetCurrentThreadId () returned 0x970 [0077.983] GetCurrentThreadId () returned 0x970 [0077.983] GetCurrentThreadId () returned 0x970 [0077.983] GetCurrentThreadId () returned 0x970 [0077.983] GetCurrentThreadId () returned 0x970 [0077.983] GetCurrentThreadId () returned 0x970 [0077.983] GetCurrentThreadId () returned 0x970 [0077.983] GetCurrentThreadId () returned 0x970 [0077.983] GetCurrentThreadId () returned 0x970 [0077.983] GetCurrentThreadId () returned 0x970 [0077.983] GetCurrentThreadId () returned 0x970 [0077.983] GetCurrentThreadId () returned 0x970 [0077.983] GetCurrentThreadId () returned 0x970 [0077.983] GetCurrentThreadId () returned 0x970 [0077.983] GetCurrentThreadId () returned 0x970 [0077.983] GetCurrentThreadId () returned 0x970 [0077.983] GetCurrentThreadId () returned 0x970 [0077.983] GetCurrentThreadId () returned 0x970 [0077.983] GetCurrentThreadId () returned 0x970 [0077.983] GetCurrentThreadId () returned 0x970 [0077.983] GetCurrentThreadId () returned 0x970 [0077.983] GetCurrentThreadId () returned 0x970 [0077.983] GetCurrentThreadId () returned 0x970 [0077.983] GetCurrentThreadId () returned 0x970 [0077.983] GetCurrentThreadId () returned 0x970 [0077.983] GetCurrentThreadId () returned 0x970 [0077.983] GetCurrentThreadId () returned 0x970 [0077.983] GetCurrentThreadId () returned 0x970 [0077.983] GetCurrentThreadId () returned 0x970 [0077.983] GetCurrentThreadId () returned 0x970 [0077.983] GetCurrentThreadId () returned 0x970 [0077.983] GetCurrentThreadId () returned 0x970 [0077.983] GetCurrentThreadId () returned 0x970 [0077.984] GetCurrentThreadId () returned 0x970 [0077.984] GetCurrentThreadId () returned 0x970 [0077.984] GetCurrentThreadId () returned 0x970 [0077.984] GetCurrentThreadId () returned 0x970 [0077.984] GetCurrentThreadId () returned 0x970 [0077.984] GetCurrentThreadId () returned 0x970 [0077.984] GetCurrentThreadId () returned 0x970 [0077.984] GetCurrentThreadId () returned 0x970 [0077.984] GetCurrentThreadId () returned 0x970 [0077.984] GetCurrentThreadId () returned 0x970 [0077.984] GetCurrentThreadId () returned 0x970 [0077.984] GetCurrentThreadId () returned 0x970 [0077.984] GetCurrentThreadId () returned 0x970 [0077.984] GetCurrentThreadId () returned 0x970 [0077.984] GetCurrentThreadId () returned 0x970 [0077.984] GetCurrentThreadId () returned 0x970 [0077.984] GetCurrentThreadId () returned 0x970 [0077.984] GetCurrentThreadId () returned 0x970 [0077.984] GetCurrentThreadId () returned 0x970 [0077.984] GetCurrentThreadId () returned 0x970 [0077.984] GetCurrentThreadId () returned 0x970 [0077.984] GetCurrentThreadId () returned 0x970 [0077.984] GetCurrentThreadId () returned 0x970 [0077.984] GetCurrentThreadId () returned 0x970 [0077.984] GetCurrentThreadId () returned 0x970 [0077.984] GetCurrentThreadId () returned 0x970 [0077.984] GetCurrentThreadId () returned 0x970 [0077.984] GetCurrentThreadId () returned 0x970 [0077.984] GetCurrentThreadId () returned 0x970 [0077.984] GetCurrentThreadId () returned 0x970 [0077.984] GetCurrentThreadId () returned 0x970 [0077.984] GetCurrentThreadId () returned 0x970 [0077.984] GetCurrentThreadId () returned 0x970 [0077.984] GetCurrentThreadId () returned 0x970 [0077.984] GetCurrentThreadId () returned 0x970 [0077.984] GetCurrentThreadId () returned 0x970 [0077.984] GetCurrentThreadId () returned 0x970 [0077.984] GetCurrentThreadId () returned 0x970 [0077.984] GetCurrentThreadId () returned 0x970 [0077.984] GetCurrentThreadId () returned 0x970 [0077.984] GetCurrentThreadId () returned 0x970 [0077.984] GetCurrentThreadId () returned 0x970 [0077.984] GetCurrentThreadId () returned 0x970 [0077.984] GetCurrentThreadId () returned 0x970 [0077.985] GetCurrentThreadId () returned 0x970 [0077.985] GetCurrentThreadId () returned 0x970 [0077.985] GetCurrentThreadId () returned 0x970 [0077.985] GetCurrentThreadId () returned 0x970 [0077.985] GetCurrentThreadId () returned 0x970 [0077.985] GetCurrentThreadId () returned 0x970 [0077.985] GetCurrentThreadId () returned 0x970 [0077.985] GetCurrentThreadId () returned 0x970 [0077.985] GetCurrentThreadId () returned 0x970 [0077.985] GetCurrentThreadId () returned 0x970 [0077.985] GetCurrentThreadId () returned 0x970 [0077.985] GetCurrentThreadId () returned 0x970 [0077.985] GetCurrentThreadId () returned 0x970 [0077.985] GetCurrentThreadId () returned 0x970 [0077.985] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.985] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.985] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a1778, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.985] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.985] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.985] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a1778, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.985] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.985] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.985] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.985] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.985] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.985] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.985] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.985] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.985] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a17d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.985] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.985] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.985] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a17d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.985] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.985] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.985] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a17d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0077.986] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x19, wMilliseconds=0x106)) [0077.986] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr=":8x$9f>H?+hjsw@OfzW%$c4RP=j&L#q~", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0077.986] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr=":8x$9f>H?+hjsw@OfzW%$c4RP=j&L#q~", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0077.986] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr=":8x$9f>H?+hjsw@OfzW%$c4RP=j&L#q~", cchWideChar=32, lpMultiByteStr=0x3b5f698, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=":8x$9f>H?+hjsw@OfzW%$c4RP=j&L#q~", lpUsedDefaultChar=0x0) returned 32 [0077.986] GetCurrentThreadId () returned 0x970 [0077.986] GetCurrentThreadId () returned 0x970 [0077.986] GetCurrentThreadId () returned 0x970 [0077.986] GetCurrentThreadId () returned 0x970 [0077.986] GetCurrentThreadId () returned 0x970 [0077.986] GetCurrentThreadId () returned 0x970 [0077.994] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0077.994] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0077.994] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3b43738, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0077.994] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34edf48, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0077.994] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34edf48, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAADA3XkOt/rIfGVzAIC2TQU7M/5ZAUdJattEh/EOt2dW6wYqE/E4Go6iV8Ept/w/jkXy7YB+adEJEUVRUVVerdEY3wX1wlaofFlZeEYgU2kzyGqG6/lAX2VKbjuC4eFja5BrNB31h7p2+K5hnAliBtRMularUJfWAoSdgZYhVbiaN7K7awcZni5V+DBs13/uaKv7NDgfHW0Y1OIz5jy0HFEHlSr4OdZCXZA==") returned 232 [0077.994] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x19, wMilliseconds=0x106)) [0077.994] GetCurrentThreadId () returned 0x970 [0077.994] GetCurrentThreadId () returned 0x970 [0077.994] GetCurrentThreadId () returned 0x970 [0077.994] GetCurrentThreadId () returned 0x970 [0077.994] GetCurrentThreadId () returned 0x970 [0077.994] GetCurrentThreadId () returned 0x970 [0077.994] GetCurrentThreadId () returned 0x970 [0077.994] GetCurrentThreadId () returned 0x970 [0077.994] GetCurrentThreadId () returned 0x970 [0077.994] GetCurrentThreadId () returned 0x970 [0077.994] GetCurrentThreadId () returned 0x970 [0077.994] GetCurrentThreadId () returned 0x970 [0077.994] GetCurrentThreadId () returned 0x970 [0077.994] GetCurrentThreadId () returned 0x970 [0077.994] GetCurrentThreadId () returned 0x970 [0077.994] GetCurrentThreadId () returned 0x970 [0077.994] GetCurrentThreadId () returned 0x970 [0077.994] GetCurrentThreadId () returned 0x970 [0077.994] GetCurrentThreadId () returned 0x970 [0077.994] GetCurrentThreadId () returned 0x970 [0077.994] GetCurrentThreadId () returned 0x970 [0077.994] GetCurrentThreadId () returned 0x970 [0077.994] GetCurrentThreadId () returned 0x970 [0077.994] GetCurrentThreadId () returned 0x970 [0077.994] GetCurrentThreadId () returned 0x970 [0077.994] GetCurrentThreadId () returned 0x970 [0077.994] GetCurrentThreadId () returned 0x970 [0077.994] GetCurrentThreadId () returned 0x970 [0077.994] GetCurrentThreadId () returned 0x970 [0077.994] GetCurrentThreadId () returned 0x970 [0077.995] GetCurrentThreadId () returned 0x970 [0077.995] GetCurrentThreadId () returned 0x970 [0077.995] GetCurrentThreadId () returned 0x970 [0077.995] GetCurrentThreadId () returned 0x970 [0077.995] GetCurrentThreadId () returned 0x970 [0077.995] GetCurrentThreadId () returned 0x970 [0077.995] GetCurrentThreadId () returned 0x970 [0077.995] GetCurrentThreadId () returned 0x970 [0077.995] GetCurrentThreadId () returned 0x970 [0077.995] GetCurrentThreadId () returned 0x970 [0077.995] GetCurrentThreadId () returned 0x970 [0077.995] GetCurrentThreadId () returned 0x970 [0077.995] GetCurrentThreadId () returned 0x970 [0077.995] GetCurrentThreadId () returned 0x970 [0077.995] GetCurrentThreadId () returned 0x970 [0077.995] GetCurrentThreadId () returned 0x970 [0077.995] GetCurrentThreadId () returned 0x970 [0077.995] GetCurrentThreadId () returned 0x970 [0077.995] GetCurrentThreadId () returned 0x970 [0077.995] GetCurrentThreadId () returned 0x970 [0077.995] GetCurrentThreadId () returned 0x970 [0077.995] GetCurrentThreadId () returned 0x970 [0077.995] GetCurrentThreadId () returned 0x970 [0077.995] GetCurrentThreadId () returned 0x970 [0077.995] GetCurrentThreadId () returned 0x970 [0077.995] GetCurrentThreadId () returned 0x970 [0077.995] GetCurrentThreadId () returned 0x970 [0077.995] GetCurrentThreadId () returned 0x970 [0077.995] GetCurrentThreadId () returned 0x970 [0077.995] GetCurrentThreadId () returned 0x970 [0077.995] GetCurrentThreadId () returned 0x970 [0077.995] GetCurrentThreadId () returned 0x970 [0077.995] GetCurrentThreadId () returned 0x970 [0077.995] GetCurrentThreadId () returned 0x970 [0077.995] GetCurrentThreadId () returned 0x970 [0077.995] GetCurrentThreadId () returned 0x970 [0077.995] GetCurrentThreadId () returned 0x970 [0077.995] GetCurrentThreadId () returned 0x970 [0077.995] GetCurrentThreadId () returned 0x970 [0077.996] GetCurrentThreadId () returned 0x970 [0077.996] GetCurrentThreadId () returned 0x970 [0077.996] GetCurrentThreadId () returned 0x970 [0077.996] GetCurrentThreadId () returned 0x970 [0077.996] GetCurrentThreadId () returned 0x970 [0077.996] GetCurrentThreadId () returned 0x970 [0077.996] GetCurrentThreadId () returned 0x970 [0077.996] GetCurrentThreadId () returned 0x970 [0077.996] GetCurrentThreadId () returned 0x970 [0077.996] GetCurrentThreadId () returned 0x970 [0077.996] GetCurrentThreadId () returned 0x970 [0077.996] GetCurrentThreadId () returned 0x970 [0077.996] GetCurrentThreadId () returned 0x970 [0077.996] GetCurrentThreadId () returned 0x970 [0077.996] GetCurrentThreadId () returned 0x970 [0077.996] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAADA3XkOt/rIfGVzAIC2TQU7M/5ZAUdJattEh/EOt2dW6wYqE/E4Go6iV8Ept/w/jkXy7YB+adEJEUVRUVVerdEY3wX1wlaofFlZeEYgU2kzyGqG6/lAX2VKbjuC4eFja5BrNB31h7p2+K5hnAliBtRMularUJfWAoSdgZYhVbiaN7K7awcZni5V+DBs13/uaKv7NDgfHW0Y1OIz5jy0HFEHlSr4OdZCXZA==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0077.996] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAADA3XkOt/rIfGVzAIC2TQU7M/5ZAUdJattEh/EOt2dW6wYqE/E4Go6iV8Ept/w/jkXy7YB+adEJEUVRUVVerdEY3wX1wlaofFlZeEYgU2kzyGqG6/lAX2VKbjuC4eFja5BrNB31h7p2+K5hnAliBtRMularUJfWAoSdgZYhVbiaN7K7awcZni5V+DBs13/uaKv7NDgfHW0Y1OIz5jy0HFEHlSr4OdZCXZA==", cchWideChar=245, lpMultiByteStr=0x3b4cd5c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAADA3XkOt/rIfGVzAIC2TQU7M/5ZAUdJattEh/EOt2dW6wYqE/E4Go6iV8Ept/w/jkXy7YB+adEJEUVRUVVerdEY3wX1wlaofFlZeEYgU2kzyGqG6/lAX2VKbjuC4eFja5BrNB31h7p2+K5hnAliBtRMularUJfWAoSdgZYhVbiaN7K7awcZni5V+DBs13/uaKv7NDgfHW0Y1OIz5jy0HFEHlSr4OdZCXZA==", lpUsedDefaultChar=0x0) returned 245 [0077.996] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0077.999] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0077.999] CloseHandle (hObject=0x158) returned 1 [0077.999] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\203x8subpicture.png")) returned 0 [0077.999] GetLastError () returned 0x5 [0077.999] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\203x8subpicture.png")) returned 0x20 [0077.999] SetLastError (dwErrCode=0x5) [0078.000] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=19826297905) returned 1 [0078.000] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\Файл зашифрован [videowall.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\Файл зашифрован [videowall.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0078.002] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0078.002] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0078.002] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0078.002] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0078.002] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0078.002] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0078.002] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0078.002] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0078.002] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0078.002] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0078.002] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0078.002] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0078.003] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0078.003] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0078.003] SetEndOfFile (hFile=0x158) returned 1 [0078.003] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0078.003] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0078.003] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0078.003] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0078.003] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0078.004] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0078.004] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="JsrHSty?m2DT){m@uA$k@FVccuO3KnpO", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0078.004] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="JsrHSty?m2DT){m@uA$k@FVccuO3KnpO", cchWideChar=32, lpMultiByteStr=0x203919c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="JsrHSty?m2DT){m@uA$k@FVccuO3KnpO", lpUsedDefaultChar=0x0) returned 32 [0078.004] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0078.004] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0078.004] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\videowall.png", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f27de93, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f27de93, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x4d86, dwReserved0=0x0, dwReserved1=0x0, cFileName="videowall.png", cAlternateFileName="")) returned 0x295098 [0078.004] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0078.004] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0078.004] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\videowall.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\videowall.png")) returned 0x20 [0078.005] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\videowall.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\videowall.png")) returned 0x20 [0078.005] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\videowall.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\videowall.png")) returned 0x20 [0078.005] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\videowall.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\videowall.png")) returned 0x20 [0078.005] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\videowall.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\videowall.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f27de93, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f27de93, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x4d86)) returned 1 [0078.005] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0078.005] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0078.005] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\videowall.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\videowall.png")) returned 0x20 [0078.005] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\videowall.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\videowall.png")) returned 0x20 [0078.005] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0078.005] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0078.005] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0078.005] SetEndOfFile (hFile=0x158) returned 1 [0078.006] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="videowall.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0078.006] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="videowall.png", cchWideChar=13, lpMultiByteStr=0x1fe484c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="videowall.png", lpUsedDefaultChar=0x0) returned 13 [0078.006] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="videowall.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0078.006] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="videowall.png", cchWideChar=13, lpMultiByteStr=0x1fe432c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="videowall.png", lpUsedDefaultChar=0x0) returned 13 [0078.006] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe432c, cbMultiByte=13, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="videowall.pngre.pnge.pngng.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 13 [0078.006] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="videowall.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0078.006] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="videowall.png", cchWideChar=13, lpMultiByteStr=0x1fe484c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="videowall.png", lpUsedDefaultChar=0x0) returned 13 [0078.006] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\videowall.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\videowall.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0078.007] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0078.007] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x4d86 [0078.007] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0078.007] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0078.007] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0078.007] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="videowall.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0078.007] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="videowall.png", cchWideChar=13, lpMultiByteStr=0x1fe484c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="videowall.png", lpUsedDefaultChar=0x0) returned 13 [0078.007] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="videowall.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0078.007] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="videowall.png", cchWideChar=13, lpMultiByteStr=0x1fe432c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="videowall.png", lpUsedDefaultChar=0x0) returned 13 [0078.007] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe432c, cbMultiByte=13, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="videowall.pngll.pngre.pnge.pngng.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 13 [0078.007] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="videowall.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0078.007] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="videowall.png", cchWideChar=13, lpMultiByteStr=0x1fe484c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="videowall.png", lpUsedDefaultChar=0x0) returned 13 [0078.007] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0078.008] CharToOemA (in: pSrc="videowall.png", pDst=0x1fe432c | out: pDst="videowall.png") returned 1 [0078.008] WriteFile (in: hFile=0x158, lpBuffer=0x1fe432c*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe432c*, lpNumberOfBytesWritten=0x18e048*=0xd, lpOverlapped=0x0) returned 1 [0078.008] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0078.008] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0078.008] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0078.009] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=19827200327) returned 1 [0078.009] ReadFile (in: hFile=0x11c, lpBuffer=0x3b787e0, nNumberOfBytesToRead=0x4d86, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b787e0*, lpNumberOfBytesRead=0x18dd7c*=0x4d86, lpOverlapped=0x0) returned 1 [0078.011] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0078.011] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=19827407531) returned 1 [0078.020] WriteFile (in: hFile=0x158, lpBuffer=0x379ad50*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379ad50*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0078.020] ReadFile (in: hFile=0x11c, lpBuffer=0x3b787e0, nNumberOfBytesToRead=0x4d86, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3b787e0*, lpNumberOfBytesRead=0x18de38*=0x4d86, lpOverlapped=0x0) returned 1 [0078.020] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x48 [0078.021] WriteFile (in: hFile=0x158, lpBuffer=0x37dea90*, nNumberOfBytesToWrite=0x4d86, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x37dea90*, lpNumberOfBytesWritten=0x18de10*=0x4d86, lpOverlapped=0x0) returned 1 [0078.021] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x4dce [0078.021] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0078.021] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0078.021] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0078.021] SetFilePointer (in: hFile=0x158, lDistanceToMove=13, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2b [0078.021] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x4dd8 [0078.022] CloseHandle (hObject=0x11c) returned 1 [0078.022] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x4dd8 [0078.022] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x4dd8 [0078.022] SetFilePointer (in: hFile=0x158, lDistanceToMove=19928, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x4dd8 [0078.022] SetFilePointer (in: hFile=0x158, lDistanceToMove=19928, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x4dd8 [0078.022] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x4dd8 [0078.022] SetFilePointer (in: hFile=0x158, lDistanceToMove=19928, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x4dd8 [0078.022] SetEndOfFile (hFile=0x158) returned 1 [0078.022] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x4dd8 [0078.022] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x4dd8 [0078.022] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="videowall.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0078.022] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="videowall.png", cchWideChar=13, lpMultiByteStr=0x1fe484c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="videowall.png", lpUsedDefaultChar=0x0) returned 13 [0078.022] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="videowall.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0078.022] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="videowall.png", cchWideChar=13, lpMultiByteStr=0x1fe64ec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="videowall.png", lpUsedDefaultChar=0x0) returned 13 [0078.022] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe64ec, cbMultiByte=13, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="videowall.png@涤(\x18믉`믑`") returned 13 [0078.023] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="videowall.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0078.023] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="videowall.png", cchWideChar=13, lpMultiByteStr=0x1fe484c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="videowall.png", lpUsedDefaultChar=0x0) returned 13 [0078.023] WriteFile (in: hFile=0x158, lpBuffer=0x3b5c2b8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3b5c2b8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0078.023] CharToOemA (in: pSrc="videowall.png", pDst=0x1fe64ec | out: pDst="videowall.png") returned 1 [0078.023] WriteFile (in: hFile=0x158, lpBuffer=0x1fe64ec*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe64ec*, lpNumberOfBytesWritten=0x18efcc*=0xd, lpOverlapped=0x0) returned 1 [0078.023] WriteFile (in: hFile=0x158, lpBuffer=0x379ae18*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379ae18*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0078.023] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0078.023] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0078.023] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x4e1e [0078.023] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x4e1e [0078.023] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0078.023] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0078.023] DeleteFileW (lpFileName="") returned 0 [0078.023] GetLastError () returned 0x3 [0078.023] GetFileAttributesW (lpFileName="") returned 0xffffffff [0078.023] SetLastError (dwErrCode=0x3) [0078.024] FlushFileBuffers (hFile=0x158) returned 1 [0078.027] GetCurrentThreadId () returned 0x970 [0078.027] GetCurrentThreadId () returned 0x970 [0078.027] GetCurrentThreadId () returned 0x970 [0078.027] GetCurrentThreadId () returned 0x970 [0078.027] GetCurrentThreadId () returned 0x970 [0078.027] GetCurrentThreadId () returned 0x970 [0078.027] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x4ed5 [0078.028] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x4ed5 [0078.028] SetFilePointer (in: hFile=0x158, lDistanceToMove=20181, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x4ed5 [0078.028] CloseHandle (hObject=0x158) returned 1 [0078.028] GetCurrentThreadId () returned 0x970 [0078.028] GetCurrentThreadId () returned 0x970 [0078.028] GetCurrentThreadId () returned 0x970 [0078.028] GetCurrentThreadId () returned 0x970 [0078.028] GetCurrentThreadId () returned 0x970 [0078.028] GetCurrentThreadId () returned 0x970 [0078.028] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\Файл зашифрован [videowall.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\Файл зашифрован [videowall.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0078.028] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4ed5 [0078.028] SetFilePointer (in: hFile=0x158, lDistanceToMove=20053, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4e55 [0078.028] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0078.028] GetFileType (hFile=0x158) returned 0x1 [0078.028] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x19, wMilliseconds=0x125)) [0078.028] GetCurrentThreadId () returned 0x970 [0078.028] GetCurrentThreadId () returned 0x970 [0078.028] GetCurrentThreadId () returned 0x970 [0078.028] GetCurrentThreadId () returned 0x970 [0078.028] GetCurrentThreadId () returned 0x970 [0078.028] GetCurrentThreadId () returned 0x970 [0078.028] GetCurrentThreadId () returned 0x970 [0078.029] GetCurrentThreadId () returned 0x970 [0078.029] GetCurrentThreadId () returned 0x970 [0078.029] GetCurrentThreadId () returned 0x970 [0078.029] GetCurrentThreadId () returned 0x970 [0078.029] GetCurrentThreadId () returned 0x970 [0078.029] GetCurrentThreadId () returned 0x970 [0078.029] GetCurrentThreadId () returned 0x970 [0078.029] GetCurrentThreadId () returned 0x970 [0078.029] GetCurrentThreadId () returned 0x970 [0078.029] GetCurrentThreadId () returned 0x970 [0078.029] GetCurrentThreadId () returned 0x970 [0078.029] GetCurrentThreadId () returned 0x970 [0078.029] GetCurrentThreadId () returned 0x970 [0078.029] GetCurrentThreadId () returned 0x970 [0078.029] GetCurrentThreadId () returned 0x970 [0078.029] GetCurrentThreadId () returned 0x970 [0078.029] GetCurrentThreadId () returned 0x970 [0078.029] GetCurrentThreadId () returned 0x970 [0078.029] GetCurrentThreadId () returned 0x970 [0078.029] GetCurrentThreadId () returned 0x970 [0078.029] GetCurrentThreadId () returned 0x970 [0078.029] GetCurrentThreadId () returned 0x970 [0078.029] GetCurrentThreadId () returned 0x970 [0078.029] GetCurrentThreadId () returned 0x970 [0078.029] GetCurrentThreadId () returned 0x970 [0078.029] GetCurrentThreadId () returned 0x970 [0078.029] GetCurrentThreadId () returned 0x970 [0078.029] GetCurrentThreadId () returned 0x970 [0078.029] GetCurrentThreadId () returned 0x970 [0078.029] GetCurrentThreadId () returned 0x970 [0078.029] GetCurrentThreadId () returned 0x970 [0078.029] GetCurrentThreadId () returned 0x970 [0078.029] GetCurrentThreadId () returned 0x970 [0078.029] GetCurrentThreadId () returned 0x970 [0078.029] GetCurrentThreadId () returned 0x970 [0078.029] GetCurrentThreadId () returned 0x970 [0078.029] GetCurrentThreadId () returned 0x970 [0078.029] GetCurrentThreadId () returned 0x970 [0078.029] GetCurrentThreadId () returned 0x970 [0078.029] GetCurrentThreadId () returned 0x970 [0078.029] GetCurrentThreadId () returned 0x970 [0078.029] GetCurrentThreadId () returned 0x970 [0078.029] GetCurrentThreadId () returned 0x970 [0078.030] GetCurrentThreadId () returned 0x970 [0078.030] GetCurrentThreadId () returned 0x970 [0078.030] GetCurrentThreadId () returned 0x970 [0078.030] GetCurrentThreadId () returned 0x970 [0078.030] GetCurrentThreadId () returned 0x970 [0078.030] GetCurrentThreadId () returned 0x970 [0078.030] GetCurrentThreadId () returned 0x970 [0078.030] GetCurrentThreadId () returned 0x970 [0078.030] GetCurrentThreadId () returned 0x970 [0078.030] GetCurrentThreadId () returned 0x970 [0078.030] GetCurrentThreadId () returned 0x970 [0078.030] GetCurrentThreadId () returned 0x970 [0078.030] GetCurrentThreadId () returned 0x970 [0078.030] GetCurrentThreadId () returned 0x970 [0078.030] GetCurrentThreadId () returned 0x970 [0078.030] GetCurrentThreadId () returned 0x970 [0078.030] GetCurrentThreadId () returned 0x970 [0078.030] GetCurrentThreadId () returned 0x970 [0078.030] GetCurrentThreadId () returned 0x970 [0078.030] GetCurrentThreadId () returned 0x970 [0078.030] GetCurrentThreadId () returned 0x970 [0078.030] GetCurrentThreadId () returned 0x970 [0078.030] GetCurrentThreadId () returned 0x970 [0078.030] GetCurrentThreadId () returned 0x970 [0078.030] GetCurrentThreadId () returned 0x970 [0078.030] GetCurrentThreadId () returned 0x970 [0078.030] GetCurrentThreadId () returned 0x970 [0078.030] GetCurrentThreadId () returned 0x970 [0078.030] GetCurrentThreadId () returned 0x970 [0078.030] GetCurrentThreadId () returned 0x970 [0078.030] GetCurrentThreadId () returned 0x970 [0078.030] GetCurrentThreadId () returned 0x970 [0078.030] GetCurrentThreadId () returned 0x970 [0078.030] GetCurrentThreadId () returned 0x970 [0078.030] GetCurrentThreadId () returned 0x970 [0078.030] GetCurrentThreadId () returned 0x970 [0078.030] GetCurrentThreadId () returned 0x970 [0078.030] GetCurrentThreadId () returned 0x970 [0078.030] GetCurrentThreadId () returned 0x970 [0078.030] GetCurrentThreadId () returned 0x970 [0078.030] GetCurrentThreadId () returned 0x970 [0078.030] GetCurrentThreadId () returned 0x970 [0078.030] GetCurrentThreadId () returned 0x970 [0078.030] GetCurrentThreadId () returned 0x970 [0078.030] GetCurrentThreadId () returned 0x970 [0078.031] GetCurrentThreadId () returned 0x970 [0078.031] GetCurrentThreadId () returned 0x970 [0078.031] GetCurrentThreadId () returned 0x970 [0078.031] GetCurrentThreadId () returned 0x970 [0078.031] GetCurrentThreadId () returned 0x970 [0078.031] GetCurrentThreadId () returned 0x970 [0078.031] GetCurrentThreadId () returned 0x970 [0078.031] GetCurrentThreadId () returned 0x970 [0078.031] GetCurrentThreadId () returned 0x970 [0078.031] GetCurrentThreadId () returned 0x970 [0078.031] GetCurrentThreadId () returned 0x970 [0078.031] GetCurrentThreadId () returned 0x970 [0078.031] GetCurrentThreadId () returned 0x970 [0078.031] GetCurrentThreadId () returned 0x970 [0078.031] GetCurrentThreadId () returned 0x970 [0078.031] GetCurrentThreadId () returned 0x970 [0078.031] GetCurrentThreadId () returned 0x970 [0078.031] GetCurrentThreadId () returned 0x970 [0078.031] GetCurrentThreadId () returned 0x970 [0078.031] GetCurrentThreadId () returned 0x970 [0078.031] GetCurrentThreadId () returned 0x970 [0078.031] GetCurrentThreadId () returned 0x970 [0078.031] GetCurrentThreadId () returned 0x970 [0078.031] GetCurrentThreadId () returned 0x970 [0078.031] GetCurrentThreadId () returned 0x970 [0078.031] GetCurrentThreadId () returned 0x970 [0078.031] GetCurrentThreadId () returned 0x970 [0078.031] GetCurrentThreadId () returned 0x970 [0078.031] GetCurrentThreadId () returned 0x970 [0078.031] GetCurrentThreadId () returned 0x970 [0078.031] GetCurrentThreadId () returned 0x970 [0078.031] GetCurrentThreadId () returned 0x970 [0078.031] GetCurrentThreadId () returned 0x970 [0078.031] GetCurrentThreadId () returned 0x970 [0078.031] GetCurrentThreadId () returned 0x970 [0078.031] GetCurrentThreadId () returned 0x970 [0078.031] GetCurrentThreadId () returned 0x970 [0078.031] GetCurrentThreadId () returned 0x970 [0078.031] GetCurrentThreadId () returned 0x970 [0078.031] GetCurrentThreadId () returned 0x970 [0078.031] GetCurrentThreadId () returned 0x970 [0078.031] GetCurrentThreadId () returned 0x970 [0078.031] GetCurrentThreadId () returned 0x970 [0078.031] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0078.032] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0078.032] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a17d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0078.032] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0078.032] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0078.032] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a17d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0078.032] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0078.032] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0078.032] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0078.032] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0078.032] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0078.032] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aed8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0078.032] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0078.032] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0078.032] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a1838, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0078.032] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0078.032] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0078.032] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a1838, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0078.032] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0078.032] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0078.032] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a1838, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0078.032] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x19, wMilliseconds=0x134)) [0078.032] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JsrHSty?m2DT){m@uA$k@FVccuO3KnpO", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0078.032] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JsrHSty?m2DT){m@uA$k@FVccuO3KnpO", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0078.032] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JsrHSty?m2DT){m@uA$k@FVccuO3KnpO", cchWideChar=32, lpMultiByteStr=0x3b54398, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="JsrHSty?m2DT){m@uA$k@FVccuO3KnpO", lpUsedDefaultChar=0x0) returned 32 [0078.032] GetCurrentThreadId () returned 0x970 [0078.032] GetCurrentThreadId () returned 0x970 [0078.032] GetCurrentThreadId () returned 0x970 [0078.032] GetCurrentThreadId () returned 0x970 [0078.032] GetCurrentThreadId () returned 0x970 [0078.032] GetCurrentThreadId () returned 0x970 [0078.040] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0078.040] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0078.040] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3b43828, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0078.040] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34edf48, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0078.040] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34edf48, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAIAaNCiBm+ccGWNHitjacOgQwH5iE8B02S6F8YvZ5hhMFcbuU5PHLxeQLoWCGtr299wFOWBKgjpgufk8ScTT8cmW+YStGdTuUeTonZZc8nSPqF51DJkhS6HLlC/kk6QPFiweAweGNTMUcoNkha6rlVgwVxQvhGVlg7k0veOUb2FfIcsuhUS9Of3xpqY3LRJxSY6d71WNIWsc61oc+m9Uehbx7H5+cd3vtg==") returned 232 [0078.040] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x19, wMilliseconds=0x134)) [0078.040] GetCurrentThreadId () returned 0x970 [0078.040] GetCurrentThreadId () returned 0x970 [0078.040] GetCurrentThreadId () returned 0x970 [0078.040] GetCurrentThreadId () returned 0x970 [0078.040] GetCurrentThreadId () returned 0x970 [0078.040] GetCurrentThreadId () returned 0x970 [0078.040] GetCurrentThreadId () returned 0x970 [0078.040] GetCurrentThreadId () returned 0x970 [0078.040] GetCurrentThreadId () returned 0x970 [0078.040] GetCurrentThreadId () returned 0x970 [0078.040] GetCurrentThreadId () returned 0x970 [0078.040] GetCurrentThreadId () returned 0x970 [0078.040] GetCurrentThreadId () returned 0x970 [0078.040] GetCurrentThreadId () returned 0x970 [0078.040] GetCurrentThreadId () returned 0x970 [0078.040] GetCurrentThreadId () returned 0x970 [0078.040] GetCurrentThreadId () returned 0x970 [0078.041] GetCurrentThreadId () returned 0x970 [0078.041] GetCurrentThreadId () returned 0x970 [0078.041] GetCurrentThreadId () returned 0x970 [0078.041] GetCurrentThreadId () returned 0x970 [0078.041] GetCurrentThreadId () returned 0x970 [0078.041] GetCurrentThreadId () returned 0x970 [0078.041] GetCurrentThreadId () returned 0x970 [0078.041] GetCurrentThreadId () returned 0x970 [0078.041] GetCurrentThreadId () returned 0x970 [0078.041] GetCurrentThreadId () returned 0x970 [0078.041] GetCurrentThreadId () returned 0x970 [0078.041] GetCurrentThreadId () returned 0x970 [0078.041] GetCurrentThreadId () returned 0x970 [0078.041] GetCurrentThreadId () returned 0x970 [0078.041] GetCurrentThreadId () returned 0x970 [0078.041] GetCurrentThreadId () returned 0x970 [0078.041] GetCurrentThreadId () returned 0x970 [0078.041] GetCurrentThreadId () returned 0x970 [0078.041] GetCurrentThreadId () returned 0x970 [0078.041] GetCurrentThreadId () returned 0x970 [0078.041] GetCurrentThreadId () returned 0x970 [0078.041] GetCurrentThreadId () returned 0x970 [0078.041] GetCurrentThreadId () returned 0x970 [0078.041] GetCurrentThreadId () returned 0x970 [0078.041] GetCurrentThreadId () returned 0x970 [0078.041] GetCurrentThreadId () returned 0x970 [0078.041] GetCurrentThreadId () returned 0x970 [0078.041] GetCurrentThreadId () returned 0x970 [0078.041] GetCurrentThreadId () returned 0x970 [0078.041] GetCurrentThreadId () returned 0x970 [0078.041] GetCurrentThreadId () returned 0x970 [0078.041] GetCurrentThreadId () returned 0x970 [0078.041] GetCurrentThreadId () returned 0x970 [0078.041] GetCurrentThreadId () returned 0x970 [0078.041] GetCurrentThreadId () returned 0x970 [0078.041] GetCurrentThreadId () returned 0x970 [0078.041] GetCurrentThreadId () returned 0x970 [0078.041] GetCurrentThreadId () returned 0x970 [0078.041] GetCurrentThreadId () returned 0x970 [0078.041] GetCurrentThreadId () returned 0x970 [0078.041] GetCurrentThreadId () returned 0x970 [0078.041] GetCurrentThreadId () returned 0x970 [0078.041] GetCurrentThreadId () returned 0x970 [0078.041] GetCurrentThreadId () returned 0x970 [0078.042] GetCurrentThreadId () returned 0x970 [0078.042] GetCurrentThreadId () returned 0x970 [0078.042] GetCurrentThreadId () returned 0x970 [0078.042] GetCurrentThreadId () returned 0x970 [0078.042] GetCurrentThreadId () returned 0x970 [0078.042] GetCurrentThreadId () returned 0x970 [0078.042] GetCurrentThreadId () returned 0x970 [0078.042] GetCurrentThreadId () returned 0x970 [0078.042] GetCurrentThreadId () returned 0x970 [0078.042] GetCurrentThreadId () returned 0x970 [0078.042] GetCurrentThreadId () returned 0x970 [0078.042] GetCurrentThreadId () returned 0x970 [0078.042] GetCurrentThreadId () returned 0x970 [0078.042] GetCurrentThreadId () returned 0x970 [0078.042] GetCurrentThreadId () returned 0x970 [0078.042] GetCurrentThreadId () returned 0x970 [0078.042] GetCurrentThreadId () returned 0x970 [0078.042] GetCurrentThreadId () returned 0x970 [0078.042] GetCurrentThreadId () returned 0x970 [0078.042] GetCurrentThreadId () returned 0x970 [0078.042] GetCurrentThreadId () returned 0x970 [0078.042] GetCurrentThreadId () returned 0x970 [0078.042] GetCurrentThreadId () returned 0x970 [0078.042] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAIAaNCiBm+ccGWNHitjacOgQwH5iE8B02S6F8YvZ5hhMFcbuU5PHLxeQLoWCGtr299wFOWBKgjpgufk8ScTT8cmW+YStGdTuUeTonZZc8nSPqF51DJkhS6HLlC/kk6QPFiweAweGNTMUcoNkha6rlVgwVxQvhGVlg7k0veOUb2FfIcsuhUS9Of3xpqY3LRJxSY6d71WNIWsc61oc+m9Uehbx7H5+cd3vtg==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0078.042] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAIAaNCiBm+ccGWNHitjacOgQwH5iE8B02S6F8YvZ5hhMFcbuU5PHLxeQLoWCGtr299wFOWBKgjpgufk8ScTT8cmW+YStGdTuUeTonZZc8nSPqF51DJkhS6HLlC/kk6QPFiweAweGNTMUcoNkha6rlVgwVxQvhGVlg7k0veOUb2FfIcsuhUS9Of3xpqY3LRJxSY6d71WNIWsc61oc+m9Uehbx7H5+cd3vtg==", cchWideChar=245, lpMultiByteStr=0x3b4cd5c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAIAaNCiBm+ccGWNHitjacOgQwH5iE8B02S6F8YvZ5hhMFcbuU5PHLxeQLoWCGtr299wFOWBKgjpgufk8ScTT8cmW+YStGdTuUeTonZZc8nSPqF51DJkhS6HLlC/kk6QPFiweAweGNTMUcoNkha6rlVgwVxQvhGVlg7k0veOUb2FfIcsuhUS9Of3xpqY3LRJxSY6d71WNIWsc61oc+m9Uehbx7H5+cd3vtg==", lpUsedDefaultChar=0x0) returned 245 [0078.042] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0078.042] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0078.042] CloseHandle (hObject=0x158) returned 1 [0078.042] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\videowall.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\videowall.png")) returned 0 [0078.043] GetLastError () returned 0x5 [0078.043] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\videowall.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\videowall.png")) returned 0x20 [0078.043] SetLastError (dwErrCode=0x5) [0078.043] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=19830621941) returned 1 [0078.043] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\Файл зашифрован [1047x576black.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\Файл зашифрован [1047x576black.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0078.044] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0078.044] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0078.044] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0078.044] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0078.044] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0078.044] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0078.044] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0078.045] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0078.045] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0078.045] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0078.045] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0078.045] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0078.045] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0078.045] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0078.045] SetEndOfFile (hFile=0x158) returned 1 [0078.045] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0078.045] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0078.045] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0078.045] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0078.045] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0078.046] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0078.046] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".IlZRn:N>~pgb,C(MTHYSvu,{6:WI(}x", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0078.046] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".IlZRn:N>~pgb,C(MTHYSvu,{6:WI(}x", cchWideChar=32, lpMultiByteStr=0x2039be4, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".IlZRn:N>~pgb,C(MTHYSvu,{6:WI(}x", lpUsedDefaultChar=0x0) returned 32 [0078.046] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0078.046] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0078.046] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\1047x576black.png", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f84b3be, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f84b3be, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 0x295098 [0078.047] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0078.047] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0078.047] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\1047x576black.png")) returned 0x20 [0078.047] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\1047x576black.png")) returned 0x20 [0078.047] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\1047x576black.png")) returned 0x20 [0078.047] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\1047x576black.png")) returned 0x20 [0078.047] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\1047x576black.png"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f84b3be, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f84b3be, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da)) returned 1 [0078.047] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0078.047] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0078.047] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\1047x576black.png")) returned 0x20 [0078.047] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\1047x576black.png")) returned 0x20 [0078.047] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0078.047] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0078.047] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0078.048] SetEndOfFile (hFile=0x158) returned 1 [0078.048] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0078.048] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x1ff899c, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x0) returned 17 [0078.048] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0078.048] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x1ff885c, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x0) returned 17 [0078.048] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff885c, cbMultiByte=17, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="1047x576black.pngnge.pngng.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 17 [0078.049] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0078.049] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x1ff899c, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x0) returned 17 [0078.049] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\1047x576black.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0078.049] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0078.049] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x11da [0078.049] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0078.049] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0078.049] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0078.049] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0078.049] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x1ff899c, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x0) returned 17 [0078.049] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0078.049] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x1ff885c, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x0) returned 17 [0078.049] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff885c, cbMultiByte=17, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="1047x576black.pngck.pngnge.pngng.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 17 [0078.050] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0078.050] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x1ff899c, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x0) returned 17 [0078.050] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0078.050] CharToOemA (in: pSrc="1047x576black.png", pDst=0x1ff885c | out: pDst="1047x576black.png") returned 1 [0078.050] WriteFile (in: hFile=0x158, lpBuffer=0x1ff885c*, nNumberOfBytesToWrite=0x11, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1ff885c*, lpNumberOfBytesWritten=0x18e048*=0x11, lpOverlapped=0x0) returned 1 [0078.051] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0078.051] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0078.051] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0078.051] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=19831432538) returned 1 [0078.051] ReadFile (in: hFile=0x11c, lpBuffer=0x3b787e0, nNumberOfBytesToRead=0x11da, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b787e0*, lpNumberOfBytesRead=0x18dd7c*=0x11da, lpOverlapped=0x0) returned 1 [0078.052] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0078.052] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=19831587918) returned 1 [0078.062] WriteFile (in: hFile=0x158, lpBuffer=0x379aca8*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379aca8*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0078.062] ReadFile (in: hFile=0x11c, lpBuffer=0x3b787e0, nNumberOfBytesToRead=0x11da, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3b787e0*, lpNumberOfBytesRead=0x18de38*=0x11da, lpOverlapped=0x0) returned 1 [0078.063] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x4c [0078.063] WriteFile (in: hFile=0x158, lpBuffer=0x3b9b1a0*, nNumberOfBytesToWrite=0x11da, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3b9b1a0*, lpNumberOfBytesWritten=0x18de10*=0x11da, lpOverlapped=0x0) returned 1 [0078.063] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x1226 [0078.063] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0078.063] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0078.063] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0078.063] SetFilePointer (in: hFile=0x158, lDistanceToMove=17, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2f [0078.063] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x1230 [0078.063] CloseHandle (hObject=0x11c) returned 1 [0078.064] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1230 [0078.064] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1230 [0078.064] SetFilePointer (in: hFile=0x158, lDistanceToMove=4656, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1230 [0078.064] SetFilePointer (in: hFile=0x158, lDistanceToMove=4656, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x1230 [0078.064] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1230 [0078.064] SetFilePointer (in: hFile=0x158, lDistanceToMove=4656, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x1230 [0078.064] SetEndOfFile (hFile=0x158) returned 1 [0078.064] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1230 [0078.064] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1230 [0078.064] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0078.064] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x1ff885c, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x0) returned 17 [0078.064] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0078.064] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x1ff899c, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x0) returned 17 [0078.064] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ff899c, cbMultiByte=17, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="1047x576black.png\x18믉`믑`") returned 17 [0078.064] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0078.064] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x1ff885c, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x0) returned 17 [0078.065] WriteFile (in: hFile=0x158, lpBuffer=0x3b5c2b8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3b5c2b8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0078.065] CharToOemA (in: pSrc="1047x576black.png", pDst=0x1ff899c | out: pDst="1047x576black.png") returned 1 [0078.065] WriteFile (in: hFile=0x158, lpBuffer=0x1ff899c*, nNumberOfBytesToWrite=0x11, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1ff899c*, lpNumberOfBytesWritten=0x18efcc*=0x11, lpOverlapped=0x0) returned 1 [0078.065] WriteFile (in: hFile=0x158, lpBuffer=0x379ad88*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379ad88*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0078.065] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0078.065] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0078.065] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x127a [0078.065] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x127a [0078.065] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0078.065] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0078.065] DeleteFileW (lpFileName="") returned 0 [0078.065] GetLastError () returned 0x3 [0078.065] GetFileAttributesW (lpFileName="") returned 0xffffffff [0078.065] SetLastError (dwErrCode=0x3) [0078.065] FlushFileBuffers (hFile=0x158) returned 1 [0078.068] GetCurrentThreadId () returned 0x970 [0078.068] GetCurrentThreadId () returned 0x970 [0078.068] GetCurrentThreadId () returned 0x970 [0078.068] GetCurrentThreadId () returned 0x970 [0078.068] GetCurrentThreadId () returned 0x970 [0078.068] GetCurrentThreadId () returned 0x970 [0078.068] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x1331 [0078.069] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x1331 [0078.069] SetFilePointer (in: hFile=0x158, lDistanceToMove=4913, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x1331 [0078.069] CloseHandle (hObject=0x158) returned 1 [0078.069] GetCurrentThreadId () returned 0x970 [0078.069] GetCurrentThreadId () returned 0x970 [0078.069] GetCurrentThreadId () returned 0x970 [0078.069] GetCurrentThreadId () returned 0x970 [0078.069] GetCurrentThreadId () returned 0x970 [0078.069] GetCurrentThreadId () returned 0x970 [0078.069] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\Файл зашифрован [1047x576black.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\Файл зашифрован [1047x576black.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0078.069] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1331 [0078.069] SetFilePointer (in: hFile=0x158, lDistanceToMove=4785, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x12b1 [0078.069] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0078.069] GetFileType (hFile=0x158) returned 0x1 [0078.069] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x19, wMilliseconds=0x154)) [0078.069] GetCurrentThreadId () returned 0x970 [0078.069] GetCurrentThreadId () returned 0x970 [0078.069] GetCurrentThreadId () returned 0x970 [0078.069] GetCurrentThreadId () returned 0x970 [0078.069] GetCurrentThreadId () returned 0x970 [0078.069] GetCurrentThreadId () returned 0x970 [0078.069] GetCurrentThreadId () returned 0x970 [0078.069] GetCurrentThreadId () returned 0x970 [0078.070] GetCurrentThreadId () returned 0x970 [0078.070] GetCurrentThreadId () returned 0x970 [0078.070] GetCurrentThreadId () returned 0x970 [0078.070] GetCurrentThreadId () returned 0x970 [0078.070] GetCurrentThreadId () returned 0x970 [0078.070] GetCurrentThreadId () returned 0x970 [0078.070] GetCurrentThreadId () returned 0x970 [0078.070] GetCurrentThreadId () returned 0x970 [0078.070] GetCurrentThreadId () returned 0x970 [0078.070] GetCurrentThreadId () returned 0x970 [0078.070] GetCurrentThreadId () returned 0x970 [0078.070] GetCurrentThreadId () returned 0x970 [0078.070] GetCurrentThreadId () returned 0x970 [0078.070] GetCurrentThreadId () returned 0x970 [0078.070] GetCurrentThreadId () returned 0x970 [0078.070] GetCurrentThreadId () returned 0x970 [0078.070] GetCurrentThreadId () returned 0x970 [0078.070] GetCurrentThreadId () returned 0x970 [0078.070] GetCurrentThreadId () returned 0x970 [0078.070] GetCurrentThreadId () returned 0x970 [0078.070] GetCurrentThreadId () returned 0x970 [0078.070] GetCurrentThreadId () returned 0x970 [0078.070] GetCurrentThreadId () returned 0x970 [0078.070] GetCurrentThreadId () returned 0x970 [0078.070] GetCurrentThreadId () returned 0x970 [0078.070] GetCurrentThreadId () returned 0x970 [0078.070] GetCurrentThreadId () returned 0x970 [0078.070] GetCurrentThreadId () returned 0x970 [0078.070] GetCurrentThreadId () returned 0x970 [0078.070] GetCurrentThreadId () returned 0x970 [0078.070] GetCurrentThreadId () returned 0x970 [0078.070] GetCurrentThreadId () returned 0x970 [0078.070] GetCurrentThreadId () returned 0x970 [0078.070] GetCurrentThreadId () returned 0x970 [0078.070] GetCurrentThreadId () returned 0x970 [0078.070] GetCurrentThreadId () returned 0x970 [0078.070] GetCurrentThreadId () returned 0x970 [0078.070] GetCurrentThreadId () returned 0x970 [0078.070] GetCurrentThreadId () returned 0x970 [0078.070] GetCurrentThreadId () returned 0x970 [0078.070] GetCurrentThreadId () returned 0x970 [0078.070] GetCurrentThreadId () returned 0x970 [0078.070] GetCurrentThreadId () returned 0x970 [0078.070] GetCurrentThreadId () returned 0x970 [0078.070] GetCurrentThreadId () returned 0x970 [0078.071] GetCurrentThreadId () returned 0x970 [0078.071] GetCurrentThreadId () returned 0x970 [0078.071] GetCurrentThreadId () returned 0x970 [0078.071] GetCurrentThreadId () returned 0x970 [0078.071] GetCurrentThreadId () returned 0x970 [0078.071] GetCurrentThreadId () returned 0x970 [0078.071] GetCurrentThreadId () returned 0x970 [0078.071] GetCurrentThreadId () returned 0x970 [0078.071] GetCurrentThreadId () returned 0x970 [0078.071] GetCurrentThreadId () returned 0x970 [0078.071] GetCurrentThreadId () returned 0x970 [0078.071] GetCurrentThreadId () returned 0x970 [0078.071] GetCurrentThreadId () returned 0x970 [0078.071] GetCurrentThreadId () returned 0x970 [0078.071] GetCurrentThreadId () returned 0x970 [0078.071] GetCurrentThreadId () returned 0x970 [0078.071] GetCurrentThreadId () returned 0x970 [0078.071] GetCurrentThreadId () returned 0x970 [0078.071] GetCurrentThreadId () returned 0x970 [0078.071] GetCurrentThreadId () returned 0x970 [0078.071] GetCurrentThreadId () returned 0x970 [0078.071] GetCurrentThreadId () returned 0x970 [0078.071] GetCurrentThreadId () returned 0x970 [0078.071] GetCurrentThreadId () returned 0x970 [0078.071] GetCurrentThreadId () returned 0x970 [0078.071] GetCurrentThreadId () returned 0x970 [0078.071] GetCurrentThreadId () returned 0x970 [0078.071] GetCurrentThreadId () returned 0x970 [0078.071] GetCurrentThreadId () returned 0x970 [0078.071] GetCurrentThreadId () returned 0x970 [0078.071] GetCurrentThreadId () returned 0x970 [0078.071] GetCurrentThreadId () returned 0x970 [0078.071] GetCurrentThreadId () returned 0x970 [0078.071] GetCurrentThreadId () returned 0x970 [0078.071] GetCurrentThreadId () returned 0x970 [0078.071] GetCurrentThreadId () returned 0x970 [0078.071] GetCurrentThreadId () returned 0x970 [0078.071] GetCurrentThreadId () returned 0x970 [0078.071] GetCurrentThreadId () returned 0x970 [0078.071] GetCurrentThreadId () returned 0x970 [0078.071] GetCurrentThreadId () returned 0x970 [0078.071] GetCurrentThreadId () returned 0x970 [0078.071] GetCurrentThreadId () returned 0x970 [0078.071] GetCurrentThreadId () returned 0x970 [0078.071] GetCurrentThreadId () returned 0x970 [0078.071] GetCurrentThreadId () returned 0x970 [0078.072] GetCurrentThreadId () returned 0x970 [0078.072] GetCurrentThreadId () returned 0x970 [0078.072] GetCurrentThreadId () returned 0x970 [0078.072] GetCurrentThreadId () returned 0x970 [0078.072] GetCurrentThreadId () returned 0x970 [0078.072] GetCurrentThreadId () returned 0x970 [0078.072] GetCurrentThreadId () returned 0x970 [0078.072] GetCurrentThreadId () returned 0x970 [0078.072] GetCurrentThreadId () returned 0x970 [0078.072] GetCurrentThreadId () returned 0x970 [0078.072] GetCurrentThreadId () returned 0x970 [0078.072] GetCurrentThreadId () returned 0x970 [0078.072] GetCurrentThreadId () returned 0x970 [0078.072] GetCurrentThreadId () returned 0x970 [0078.072] GetCurrentThreadId () returned 0x970 [0078.072] GetCurrentThreadId () returned 0x970 [0078.072] GetCurrentThreadId () returned 0x970 [0078.072] GetCurrentThreadId () returned 0x970 [0078.072] GetCurrentThreadId () returned 0x970 [0078.072] GetCurrentThreadId () returned 0x970 [0078.072] GetCurrentThreadId () returned 0x970 [0078.072] GetCurrentThreadId () returned 0x970 [0078.072] GetCurrentThreadId () returned 0x970 [0078.072] GetCurrentThreadId () returned 0x970 [0078.072] GetCurrentThreadId () returned 0x970 [0078.072] GetCurrentThreadId () returned 0x970 [0078.072] GetCurrentThreadId () returned 0x970 [0078.072] GetCurrentThreadId () returned 0x970 [0078.072] GetCurrentThreadId () returned 0x970 [0078.072] GetCurrentThreadId () returned 0x970 [0078.072] GetCurrentThreadId () returned 0x970 [0078.072] GetCurrentThreadId () returned 0x970 [0078.072] GetCurrentThreadId () returned 0x970 [0078.072] GetCurrentThreadId () returned 0x970 [0078.072] GetCurrentThreadId () returned 0x970 [0078.072] GetCurrentThreadId () returned 0x970 [0078.072] GetCurrentThreadId () returned 0x970 [0078.072] GetCurrentThreadId () returned 0x970 [0078.072] GetCurrentThreadId () returned 0x970 [0078.072] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0078.072] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0078.072] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a1838, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0078.072] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0078.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0078.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a1838, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0078.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0078.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0078.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0078.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0078.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0078.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0078.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0078.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0078.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a1898, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0078.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0078.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0078.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a1898, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0078.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0078.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0078.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a1898, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0078.073] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x19, wMilliseconds=0x154)) [0078.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr=".IlZRn:N>~pgb,C(MTHYSvu,{6:WI(}x", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0078.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr=".IlZRn:N>~pgb,C(MTHYSvu,{6:WI(}x", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0078.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr=".IlZRn:N>~pgb,C(MTHYSvu,{6:WI(}x", cchWideChar=32, lpMultiByteStr=0x3b54308, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".IlZRn:N>~pgb,C(MTHYSvu,{6:WI(}x", lpUsedDefaultChar=0x0) returned 32 [0078.073] GetCurrentThreadId () returned 0x970 [0078.073] GetCurrentThreadId () returned 0x970 [0078.073] GetCurrentThreadId () returned 0x970 [0078.073] GetCurrentThreadId () returned 0x970 [0078.073] GetCurrentThreadId () returned 0x970 [0078.073] GetCurrentThreadId () returned 0x970 [0078.081] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0078.081] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0078.081] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3b43918, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0078.081] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34edf48, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0078.081] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34edf48, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAHz6EXaYCmAFckNGap89ExAfnvqAZwzfGOG9BI+vcOJJ/FnlENeMyRtjbkIYxSI9hD5pgzph4VJabFefFu16HKh8aVSJElQOqkHVBbuPfXFYkxi71d33gEWMTgEh9EUIGK8cZpRPN1mYWOY0cbZLnY02PCH3l7239lm9q5IK6Jrj5yGfWn/ijre4syclhtR1iqOS7RpMO9+TXhe9qU/BSIERT8kaExGSXA==") returned 232 [0078.081] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x19, wMilliseconds=0x163)) [0078.082] GetCurrentThreadId () returned 0x970 [0078.082] GetCurrentThreadId () returned 0x970 [0078.082] GetCurrentThreadId () returned 0x970 [0078.082] GetCurrentThreadId () returned 0x970 [0078.082] GetCurrentThreadId () returned 0x970 [0078.082] GetCurrentThreadId () returned 0x970 [0078.082] GetCurrentThreadId () returned 0x970 [0078.082] GetCurrentThreadId () returned 0x970 [0078.082] GetCurrentThreadId () returned 0x970 [0078.082] GetCurrentThreadId () returned 0x970 [0078.082] GetCurrentThreadId () returned 0x970 [0078.082] GetCurrentThreadId () returned 0x970 [0078.082] GetCurrentThreadId () returned 0x970 [0078.082] GetCurrentThreadId () returned 0x970 [0078.082] GetCurrentThreadId () returned 0x970 [0078.082] GetCurrentThreadId () returned 0x970 [0078.082] GetCurrentThreadId () returned 0x970 [0078.082] GetCurrentThreadId () returned 0x970 [0078.082] GetCurrentThreadId () returned 0x970 [0078.082] GetCurrentThreadId () returned 0x970 [0078.082] GetCurrentThreadId () returned 0x970 [0078.082] GetCurrentThreadId () returned 0x970 [0078.082] GetCurrentThreadId () returned 0x970 [0078.082] GetCurrentThreadId () returned 0x970 [0078.082] GetCurrentThreadId () returned 0x970 [0078.082] GetCurrentThreadId () returned 0x970 [0078.082] GetCurrentThreadId () returned 0x970 [0078.082] GetCurrentThreadId () returned 0x970 [0078.082] GetCurrentThreadId () returned 0x970 [0078.082] GetCurrentThreadId () returned 0x970 [0078.082] GetCurrentThreadId () returned 0x970 [0078.082] GetCurrentThreadId () returned 0x970 [0078.082] GetCurrentThreadId () returned 0x970 [0078.082] GetCurrentThreadId () returned 0x970 [0078.082] GetCurrentThreadId () returned 0x970 [0078.082] GetCurrentThreadId () returned 0x970 [0078.082] GetCurrentThreadId () returned 0x970 [0078.082] GetCurrentThreadId () returned 0x970 [0078.082] GetCurrentThreadId () returned 0x970 [0078.082] GetCurrentThreadId () returned 0x970 [0078.082] GetCurrentThreadId () returned 0x970 [0078.082] GetCurrentThreadId () returned 0x970 [0078.082] GetCurrentThreadId () returned 0x970 [0078.082] GetCurrentThreadId () returned 0x970 [0078.083] GetCurrentThreadId () returned 0x970 [0078.083] GetCurrentThreadId () returned 0x970 [0078.083] GetCurrentThreadId () returned 0x970 [0078.083] GetCurrentThreadId () returned 0x970 [0078.083] GetCurrentThreadId () returned 0x970 [0078.083] GetCurrentThreadId () returned 0x970 [0078.083] GetCurrentThreadId () returned 0x970 [0078.083] GetCurrentThreadId () returned 0x970 [0078.083] GetCurrentThreadId () returned 0x970 [0078.083] GetCurrentThreadId () returned 0x970 [0078.083] GetCurrentThreadId () returned 0x970 [0078.083] GetCurrentThreadId () returned 0x970 [0078.083] GetCurrentThreadId () returned 0x970 [0078.083] GetCurrentThreadId () returned 0x970 [0078.083] GetCurrentThreadId () returned 0x970 [0078.083] GetCurrentThreadId () returned 0x970 [0078.083] GetCurrentThreadId () returned 0x970 [0078.083] GetCurrentThreadId () returned 0x970 [0078.083] GetCurrentThreadId () returned 0x970 [0078.083] GetCurrentThreadId () returned 0x970 [0078.083] GetCurrentThreadId () returned 0x970 [0078.083] GetCurrentThreadId () returned 0x970 [0078.083] GetCurrentThreadId () returned 0x970 [0078.083] GetCurrentThreadId () returned 0x970 [0078.083] GetCurrentThreadId () returned 0x970 [0078.083] GetCurrentThreadId () returned 0x970 [0078.083] GetCurrentThreadId () returned 0x970 [0078.083] GetCurrentThreadId () returned 0x970 [0078.083] GetCurrentThreadId () returned 0x970 [0078.083] GetCurrentThreadId () returned 0x970 [0078.083] GetCurrentThreadId () returned 0x970 [0078.083] GetCurrentThreadId () returned 0x970 [0078.083] GetCurrentThreadId () returned 0x970 [0078.083] GetCurrentThreadId () returned 0x970 [0078.083] GetCurrentThreadId () returned 0x970 [0078.083] GetCurrentThreadId () returned 0x970 [0078.083] GetCurrentThreadId () returned 0x970 [0078.083] GetCurrentThreadId () returned 0x970 [0078.083] GetCurrentThreadId () returned 0x970 [0078.083] GetCurrentThreadId () returned 0x970 [0078.083] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAHz6EXaYCmAFckNGap89ExAfnvqAZwzfGOG9BI+vcOJJ/FnlENeMyRtjbkIYxSI9hD5pgzph4VJabFefFu16HKh8aVSJElQOqkHVBbuPfXFYkxi71d33gEWMTgEh9EUIGK8cZpRPN1mYWOY0cbZLnY02PCH3l7239lm9q5IK6Jrj5yGfWn/ijre4syclhtR1iqOS7RpMO9+TXhe9qU/BSIERT8kaExGSXA==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0078.083] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAHz6EXaYCmAFckNGap89ExAfnvqAZwzfGOG9BI+vcOJJ/FnlENeMyRtjbkIYxSI9hD5pgzph4VJabFefFu16HKh8aVSJElQOqkHVBbuPfXFYkxi71d33gEWMTgEh9EUIGK8cZpRPN1mYWOY0cbZLnY02PCH3l7239lm9q5IK6Jrj5yGfWn/ijre4syclhtR1iqOS7RpMO9+TXhe9qU/BSIERT8kaExGSXA==", cchWideChar=245, lpMultiByteStr=0x3b4cd5c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAHz6EXaYCmAFckNGap89ExAfnvqAZwzfGOG9BI+vcOJJ/FnlENeMyRtjbkIYxSI9hD5pgzph4VJabFefFu16HKh8aVSJElQOqkHVBbuPfXFYkxi71d33gEWMTgEh9EUIGK8cZpRPN1mYWOY0cbZLnY02PCH3l7239lm9q5IK6Jrj5yGfWn/ijre4syclhtR1iqOS7RpMO9+TXhe9qU/BSIERT8kaExGSXA==", lpUsedDefaultChar=0x0) returned 245 [0078.083] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0078.084] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0078.084] CloseHandle (hObject=0x158) returned 1 [0078.084] DeleteFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\1047x576black.png")) returned 0 [0078.084] GetLastError () returned 0x5 [0078.084] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\1047x576black.png")) returned 0x20 [0078.084] SetLastError (dwErrCode=0x5) [0078.084] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=19834918527) returned 1 [0078.087] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\Файл зашифрован [15x15dot.png].wannacash .zip" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\Файл зашифрован [15x15dot.png].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0078.087] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0078.087] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0078.087] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0078.087] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0078.088] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0078.088] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0078.088] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0078.088] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0078.088] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0078.088] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0078.088] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0078.088] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0078.088] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0078.088] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0078.088] SetEndOfFile (hFile=0x158) returned 1 [0078.088] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0078.088] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0078.088] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0078.088] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0078.088] WriteFile (in: hFile=0x158, lpBuffer=0x3777058*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777058*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0078.089] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0078.089] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0078.926] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DVJv9<:ls,xFhz&PA2o7j\"Vyg.-U7ew>", cchWideChar=32, lpMultiByteStr=0x203a07c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVJv9<:ls,xFhz&PA2o7j\"Vyg.-U7ew>", lpUsedDefaultChar=0x0) returned 32 [0078.926] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0078.926] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0078.926] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x262e5400, ftCreationTime.dwHighDateTime=0x1bd4c10, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x262e5400, ftLastWriteTime.dwHighDateTime=0x1bd4c10, nFileSizeHigh=0x0, nFileSizeLow=0x1e06, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00052_.GIF", cAlternateFileName="")) returned 0x295098 [0078.926] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0078.926] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0078.926] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif")) returned 0x20 [0078.926] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif")) returned 0x20 [0078.927] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif")) returned 0x20 [0078.927] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif")) returned 0x20 [0078.927] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x262e5400, ftCreationTime.dwHighDateTime=0x1bd4c10, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x262e5400, ftLastWriteTime.dwHighDateTime=0x1bd4c10, nFileSizeHigh=0x0, nFileSizeLow=0x1e06)) returned 1 [0078.927] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0078.927] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0078.927] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif")) returned 0x20 [0078.927] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif")) returned 0x20 [0078.927] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0078.927] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0078.927] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0078.927] SetEndOfFile (hFile=0x158) returned 1 [0078.928] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00052_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0078.928] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00052_.GIF", cchWideChar=12, lpMultiByteStr=0x1fe44ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AG00052_.GIF", lpUsedDefaultChar=0x0) returned 12 [0078.928] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00052_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0078.928] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00052_.GIF", cchWideChar=12, lpMultiByteStr=0x1fe470c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AG00052_.GIF", lpUsedDefaultChar=0x0) returned 12 [0078.928] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe470c, cbMultiByte=12, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="AG00052_.GIFg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0078.928] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00052_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0078.928] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00052_.GIF", cchWideChar=12, lpMultiByteStr=0x1fe44ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AG00052_.GIF", lpUsedDefaultChar=0x0) returned 12 [0078.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0078.928] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0078.929] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x1e06 [0078.929] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0078.929] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0078.929] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0078.929] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00052_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0078.929] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00052_.GIF", cchWideChar=12, lpMultiByteStr=0x1fe44ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AG00052_.GIF", lpUsedDefaultChar=0x0) returned 12 [0078.929] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00052_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0078.929] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00052_.GIF", cchWideChar=12, lpMultiByteStr=0x1fe470c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AG00052_.GIF", lpUsedDefaultChar=0x0) returned 12 [0078.929] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe470c, cbMultiByte=12, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="AG00052_.GIF2_.GIFg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0078.929] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00052_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0078.929] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00052_.GIF", cchWideChar=12, lpMultiByteStr=0x1fe44ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AG00052_.GIF", lpUsedDefaultChar=0x0) returned 12 [0078.929] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0078.930] CharToOemA (in: pSrc="AG00052_.GIF", pDst=0x1fe470c | out: pDst="AG00052_.GIF") returned 1 [0078.930] WriteFile (in: hFile=0x158, lpBuffer=0x1fe470c*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe470c*, lpNumberOfBytesWritten=0x18e048*=0xc, lpOverlapped=0x0) returned 1 [0078.930] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0078.930] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0078.930] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0078.930] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=19919383979) returned 1 [0078.930] ReadFile (in: hFile=0x11c, lpBuffer=0x3b7fb10, nNumberOfBytesToRead=0x1e06, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b7fb10*, lpNumberOfBytesRead=0x18dd7c*=0x1e06, lpOverlapped=0x0) returned 1 [0078.935] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0078.935] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=19919857689) returned 1 [0078.944] WriteFile (in: hFile=0x158, lpBuffer=0x379ac90*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379ac90*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0078.944] ReadFile (in: hFile=0x11c, lpBuffer=0x3b7fb10, nNumberOfBytesToRead=0x1e06, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3b7fb10*, lpNumberOfBytesRead=0x18de38*=0x1e06, lpOverlapped=0x0) returned 1 [0078.944] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x47 [0078.944] WriteFile (in: hFile=0x158, lpBuffer=0x3b930a0*, nNumberOfBytesToWrite=0x1e06, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3b930a0*, lpNumberOfBytesWritten=0x18de10*=0x1e06, lpOverlapped=0x0) returned 1 [0078.945] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x1e4d [0078.945] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0078.945] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0078.945] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0078.945] SetFilePointer (in: hFile=0x158, lDistanceToMove=12, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2a [0078.945] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x1e57 [0078.945] CloseHandle (hObject=0x11c) returned 1 [0078.945] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1e57 [0078.945] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1e57 [0078.945] SetFilePointer (in: hFile=0x158, lDistanceToMove=7767, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1e57 [0078.945] SetFilePointer (in: hFile=0x158, lDistanceToMove=7767, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x1e57 [0078.945] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1e57 [0078.945] SetFilePointer (in: hFile=0x158, lDistanceToMove=7767, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x1e57 [0078.945] SetEndOfFile (hFile=0x158) returned 1 [0078.946] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1e57 [0078.946] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1e57 [0078.946] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00052_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0078.946] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00052_.GIF", cchWideChar=12, lpMultiByteStr=0x1fe44ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AG00052_.GIF", lpUsedDefaultChar=0x0) returned 12 [0078.946] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00052_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0078.946] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00052_.GIF", cchWideChar=12, lpMultiByteStr=0x1fe3a2c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AG00052_.GIF", lpUsedDefaultChar=0x0) returned 12 [0078.946] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe3a2c, cbMultiByte=12, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="AG00052_.GIFꞗ@涤(\x18믉`믑`") returned 12 [0078.946] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00052_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0078.946] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00052_.GIF", cchWideChar=12, lpMultiByteStr=0x1fe44ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AG00052_.GIF", lpUsedDefaultChar=0x0) returned 12 [0078.946] WriteFile (in: hFile=0x158, lpBuffer=0x3b635e8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3b635e8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0078.946] CharToOemA (in: pSrc="AG00052_.GIF", pDst=0x1fe3a2c | out: pDst="AG00052_.GIF") returned 1 [0078.946] WriteFile (in: hFile=0x158, lpBuffer=0x1fe3a2c*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe3a2c*, lpNumberOfBytesWritten=0x18efcc*=0xc, lpOverlapped=0x0) returned 1 [0078.946] WriteFile (in: hFile=0x158, lpBuffer=0x379ade8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379ade8*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0078.946] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0078.946] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0078.947] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1e9c [0078.947] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1e9c [0078.947] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0078.947] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0078.947] DeleteFileW (lpFileName="") returned 0 [0078.947] GetLastError () returned 0x3 [0078.947] GetFileAttributesW (lpFileName="") returned 0xffffffff [0078.947] SetLastError (dwErrCode=0x3) [0078.947] FlushFileBuffers (hFile=0x158) returned 1 [0078.950] GetCurrentThreadId () returned 0x970 [0078.950] GetCurrentThreadId () returned 0x970 [0078.950] GetCurrentThreadId () returned 0x970 [0078.950] GetCurrentThreadId () returned 0x970 [0078.950] GetCurrentThreadId () returned 0x970 [0078.950] GetCurrentThreadId () returned 0x970 [0078.950] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x1f53 [0078.950] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x1f53 [0078.950] SetFilePointer (in: hFile=0x158, lDistanceToMove=8019, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x1f53 [0078.950] CloseHandle (hObject=0x158) returned 1 [0078.950] GetCurrentThreadId () returned 0x970 [0078.950] GetCurrentThreadId () returned 0x970 [0078.950] GetCurrentThreadId () returned 0x970 [0078.950] GetCurrentThreadId () returned 0x970 [0078.950] GetCurrentThreadId () returned 0x970 [0078.950] GetCurrentThreadId () returned 0x970 [0078.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [AG00052_.GIF].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [ag00052_.gif].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0078.951] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1f53 [0078.951] SetFilePointer (in: hFile=0x158, lDistanceToMove=7891, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1ed3 [0078.951] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0078.951] GetFileType (hFile=0x158) returned 0x1 [0078.951] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x1a, wMilliseconds=0xe5)) [0078.951] GetCurrentThreadId () returned 0x970 [0078.951] GetCurrentThreadId () returned 0x970 [0078.951] GetCurrentThreadId () returned 0x970 [0078.951] GetCurrentThreadId () returned 0x970 [0078.951] GetCurrentThreadId () returned 0x970 [0078.951] GetCurrentThreadId () returned 0x970 [0078.951] GetCurrentThreadId () returned 0x970 [0078.951] GetCurrentThreadId () returned 0x970 [0078.951] GetCurrentThreadId () returned 0x970 [0078.951] GetCurrentThreadId () returned 0x970 [0078.951] GetCurrentThreadId () returned 0x970 [0078.951] GetCurrentThreadId () returned 0x970 [0078.951] GetCurrentThreadId () returned 0x970 [0078.951] GetCurrentThreadId () returned 0x970 [0078.951] GetCurrentThreadId () returned 0x970 [0078.951] GetCurrentThreadId () returned 0x970 [0078.951] GetCurrentThreadId () returned 0x970 [0078.951] GetCurrentThreadId () returned 0x970 [0078.951] GetCurrentThreadId () returned 0x970 [0078.951] GetCurrentThreadId () returned 0x970 [0078.951] GetCurrentThreadId () returned 0x970 [0078.951] GetCurrentThreadId () returned 0x970 [0078.951] GetCurrentThreadId () returned 0x970 [0078.951] GetCurrentThreadId () returned 0x970 [0078.951] GetCurrentThreadId () returned 0x970 [0078.951] GetCurrentThreadId () returned 0x970 [0078.951] GetCurrentThreadId () returned 0x970 [0078.951] GetCurrentThreadId () returned 0x970 [0078.951] GetCurrentThreadId () returned 0x970 [0078.952] GetCurrentThreadId () returned 0x970 [0078.952] GetCurrentThreadId () returned 0x970 [0078.952] GetCurrentThreadId () returned 0x970 [0078.952] GetCurrentThreadId () returned 0x970 [0078.952] GetCurrentThreadId () returned 0x970 [0078.952] GetCurrentThreadId () returned 0x970 [0078.952] GetCurrentThreadId () returned 0x970 [0078.952] GetCurrentThreadId () returned 0x970 [0078.952] GetCurrentThreadId () returned 0x970 [0078.952] GetCurrentThreadId () returned 0x970 [0078.952] GetCurrentThreadId () returned 0x970 [0078.952] GetCurrentThreadId () returned 0x970 [0078.952] GetCurrentThreadId () returned 0x970 [0078.952] GetCurrentThreadId () returned 0x970 [0078.952] GetCurrentThreadId () returned 0x970 [0078.952] GetCurrentThreadId () returned 0x970 [0078.952] GetCurrentThreadId () returned 0x970 [0078.952] GetCurrentThreadId () returned 0x970 [0078.952] GetCurrentThreadId () returned 0x970 [0078.952] GetCurrentThreadId () returned 0x970 [0078.952] GetCurrentThreadId () returned 0x970 [0078.952] GetCurrentThreadId () returned 0x970 [0078.952] GetCurrentThreadId () returned 0x970 [0078.952] GetCurrentThreadId () returned 0x970 [0078.952] GetCurrentThreadId () returned 0x970 [0078.952] GetCurrentThreadId () returned 0x970 [0078.952] GetCurrentThreadId () returned 0x970 [0078.952] GetCurrentThreadId () returned 0x970 [0078.952] GetCurrentThreadId () returned 0x970 [0078.952] GetCurrentThreadId () returned 0x970 [0078.952] GetCurrentThreadId () returned 0x970 [0078.952] GetCurrentThreadId () returned 0x970 [0078.952] GetCurrentThreadId () returned 0x970 [0078.952] GetCurrentThreadId () returned 0x970 [0078.952] GetCurrentThreadId () returned 0x970 [0078.952] GetCurrentThreadId () returned 0x970 [0078.952] GetCurrentThreadId () returned 0x970 [0078.952] GetCurrentThreadId () returned 0x970 [0078.952] GetCurrentThreadId () returned 0x970 [0078.952] GetCurrentThreadId () returned 0x970 [0078.952] GetCurrentThreadId () returned 0x970 [0078.952] GetCurrentThreadId () returned 0x970 [0078.952] GetCurrentThreadId () returned 0x970 [0078.952] GetCurrentThreadId () returned 0x970 [0078.952] GetCurrentThreadId () returned 0x970 [0078.953] GetCurrentThreadId () returned 0x970 [0078.953] GetCurrentThreadId () returned 0x970 [0078.953] GetCurrentThreadId () returned 0x970 [0078.953] GetCurrentThreadId () returned 0x970 [0078.953] GetCurrentThreadId () returned 0x970 [0078.953] GetCurrentThreadId () returned 0x970 [0078.953] GetCurrentThreadId () returned 0x970 [0078.953] GetCurrentThreadId () returned 0x970 [0078.953] GetCurrentThreadId () returned 0x970 [0078.953] GetCurrentThreadId () returned 0x970 [0078.953] GetCurrentThreadId () returned 0x970 [0078.953] GetCurrentThreadId () returned 0x970 [0078.953] GetCurrentThreadId () returned 0x970 [0078.953] GetCurrentThreadId () returned 0x970 [0078.953] GetCurrentThreadId () returned 0x970 [0078.953] GetCurrentThreadId () returned 0x970 [0078.953] GetCurrentThreadId () returned 0x970 [0078.953] GetCurrentThreadId () returned 0x970 [0078.953] GetCurrentThreadId () returned 0x970 [0078.953] GetCurrentThreadId () returned 0x970 [0078.953] GetCurrentThreadId () returned 0x970 [0078.953] GetCurrentThreadId () returned 0x970 [0078.953] GetCurrentThreadId () returned 0x970 [0078.953] GetCurrentThreadId () returned 0x970 [0078.953] GetCurrentThreadId () returned 0x970 [0078.953] GetCurrentThreadId () returned 0x970 [0078.953] GetCurrentThreadId () returned 0x970 [0078.953] GetCurrentThreadId () returned 0x970 [0078.953] GetCurrentThreadId () returned 0x970 [0078.953] GetCurrentThreadId () returned 0x970 [0078.953] GetCurrentThreadId () returned 0x970 [0078.953] GetCurrentThreadId () returned 0x970 [0078.953] GetCurrentThreadId () returned 0x970 [0078.953] GetCurrentThreadId () returned 0x970 [0078.953] GetCurrentThreadId () returned 0x970 [0078.953] GetCurrentThreadId () returned 0x970 [0078.953] GetCurrentThreadId () returned 0x970 [0078.953] GetCurrentThreadId () returned 0x970 [0078.953] GetCurrentThreadId () returned 0x970 [0078.953] GetCurrentThreadId () returned 0x970 [0078.953] GetCurrentThreadId () returned 0x970 [0078.953] GetCurrentThreadId () returned 0x970 [0078.953] GetCurrentThreadId () returned 0x970 [0078.954] GetCurrentThreadId () returned 0x970 [0078.954] GetCurrentThreadId () returned 0x970 [0078.954] GetCurrentThreadId () returned 0x970 [0078.954] GetCurrentThreadId () returned 0x970 [0078.954] GetCurrentThreadId () returned 0x970 [0078.954] GetCurrentThreadId () returned 0x970 [0078.954] GetCurrentThreadId () returned 0x970 [0078.954] GetCurrentThreadId () returned 0x970 [0078.954] GetCurrentThreadId () returned 0x970 [0078.954] GetCurrentThreadId () returned 0x970 [0078.954] GetCurrentThreadId () returned 0x970 [0078.954] GetCurrentThreadId () returned 0x970 [0078.954] GetCurrentThreadId () returned 0x970 [0078.954] GetCurrentThreadId () returned 0x970 [0078.954] GetCurrentThreadId () returned 0x970 [0078.954] GetCurrentThreadId () returned 0x970 [0078.954] GetCurrentThreadId () returned 0x970 [0078.954] GetCurrentThreadId () returned 0x970 [0078.954] GetCurrentThreadId () returned 0x970 [0078.954] GetCurrentThreadId () returned 0x970 [0078.954] GetCurrentThreadId () returned 0x970 [0078.954] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0078.954] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0078.954] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a1f58, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0078.954] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0078.954] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0078.954] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x37a1f58, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0078.954] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0078.954] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0078.954] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0078.954] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0078.954] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0078.954] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x379aef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0078.954] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0078.954] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0078.954] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b7cee0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0078.954] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0078.955] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0078.955] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b7cee0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0078.955] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0078.955] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0078.955] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b7cee0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0078.955] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x1a, wMilliseconds=0xe5)) [0078.955] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVJv9<:ls,xFhz&PA2o7j\"Vyg.-U7ew>", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0078.955] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVJv9<:ls,xFhz&PA2o7j\"Vyg.-U7ew>", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0078.955] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVJv9<:ls,xFhz&PA2o7j\"Vyg.-U7ew>", cchWideChar=32, lpMultiByteStr=0x3b54758, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVJv9<:ls,xFhz&PA2o7j\"Vyg.-U7ew>", lpUsedDefaultChar=0x0) returned 32 [0078.955] GetCurrentThreadId () returned 0x970 [0078.955] GetCurrentThreadId () returned 0x970 [0078.955] GetCurrentThreadId () returned 0x970 [0078.955] GetCurrentThreadId () returned 0x970 [0078.955] GetCurrentThreadId () returned 0x970 [0078.955] GetCurrentThreadId () returned 0x970 [0078.962] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0078.962] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0078.962] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3b44ae8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0078.963] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0078.963] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAACAohFjOjiibO7fYUdbJ4hcpwR+iDlEyaX557uAKcrthZ5m+2/W1jllLLPBHdqCR11HLVn+rUhj5/EG0QnLDKhqgBz4iXhs61ecWtDPENo9g/4NQHeiiZFGk8wZce8IgjtwdWTVfj8CerxBnvhkfcWKw3JjZh32KaB0uJo7F2HUhGxBVHO7K2UKo/Q+mjcITBbmzEcctjY+O4q9znf/+GhS4E731fBg6Cw==") returned 232 [0078.963] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x1a, wMilliseconds=0xe5)) [0078.963] GetCurrentThreadId () returned 0x970 [0078.963] GetCurrentThreadId () returned 0x970 [0078.963] GetCurrentThreadId () returned 0x970 [0078.963] GetCurrentThreadId () returned 0x970 [0078.963] GetCurrentThreadId () returned 0x970 [0078.963] GetCurrentThreadId () returned 0x970 [0078.963] GetCurrentThreadId () returned 0x970 [0078.963] GetCurrentThreadId () returned 0x970 [0078.963] GetCurrentThreadId () returned 0x970 [0078.963] GetCurrentThreadId () returned 0x970 [0078.963] GetCurrentThreadId () returned 0x970 [0078.963] GetCurrentThreadId () returned 0x970 [0078.963] GetCurrentThreadId () returned 0x970 [0078.963] GetCurrentThreadId () returned 0x970 [0078.963] GetCurrentThreadId () returned 0x970 [0078.963] GetCurrentThreadId () returned 0x970 [0078.963] GetCurrentThreadId () returned 0x970 [0078.963] GetCurrentThreadId () returned 0x970 [0078.963] GetCurrentThreadId () returned 0x970 [0078.963] GetCurrentThreadId () returned 0x970 [0078.963] GetCurrentThreadId () returned 0x970 [0078.963] GetCurrentThreadId () returned 0x970 [0078.963] GetCurrentThreadId () returned 0x970 [0078.963] GetCurrentThreadId () returned 0x970 [0078.963] GetCurrentThreadId () returned 0x970 [0078.963] GetCurrentThreadId () returned 0x970 [0078.963] GetCurrentThreadId () returned 0x970 [0078.963] GetCurrentThreadId () returned 0x970 [0078.963] GetCurrentThreadId () returned 0x970 [0078.963] GetCurrentThreadId () returned 0x970 [0078.963] GetCurrentThreadId () returned 0x970 [0078.963] GetCurrentThreadId () returned 0x970 [0078.963] GetCurrentThreadId () returned 0x970 [0078.963] GetCurrentThreadId () returned 0x970 [0078.963] GetCurrentThreadId () returned 0x970 [0078.963] GetCurrentThreadId () returned 0x970 [0078.963] GetCurrentThreadId () returned 0x970 [0078.963] GetCurrentThreadId () returned 0x970 [0078.963] GetCurrentThreadId () returned 0x970 [0078.963] GetCurrentThreadId () returned 0x970 [0078.964] GetCurrentThreadId () returned 0x970 [0078.964] GetCurrentThreadId () returned 0x970 [0078.964] GetCurrentThreadId () returned 0x970 [0078.964] GetCurrentThreadId () returned 0x970 [0078.964] GetCurrentThreadId () returned 0x970 [0078.964] GetCurrentThreadId () returned 0x970 [0078.964] GetCurrentThreadId () returned 0x970 [0078.964] GetCurrentThreadId () returned 0x970 [0078.964] GetCurrentThreadId () returned 0x970 [0078.964] GetCurrentThreadId () returned 0x970 [0078.964] GetCurrentThreadId () returned 0x970 [0078.964] GetCurrentThreadId () returned 0x970 [0078.964] GetCurrentThreadId () returned 0x970 [0078.964] GetCurrentThreadId () returned 0x970 [0078.964] GetCurrentThreadId () returned 0x970 [0078.964] GetCurrentThreadId () returned 0x970 [0078.964] GetCurrentThreadId () returned 0x970 [0078.964] GetCurrentThreadId () returned 0x970 [0078.964] GetCurrentThreadId () returned 0x970 [0078.964] GetCurrentThreadId () returned 0x970 [0078.964] GetCurrentThreadId () returned 0x970 [0078.964] GetCurrentThreadId () returned 0x970 [0078.964] GetCurrentThreadId () returned 0x970 [0078.964] GetCurrentThreadId () returned 0x970 [0078.964] GetCurrentThreadId () returned 0x970 [0078.964] GetCurrentThreadId () returned 0x970 [0078.964] GetCurrentThreadId () returned 0x970 [0078.964] GetCurrentThreadId () returned 0x970 [0078.964] GetCurrentThreadId () returned 0x970 [0078.964] GetCurrentThreadId () returned 0x970 [0078.964] GetCurrentThreadId () returned 0x970 [0078.964] GetCurrentThreadId () returned 0x970 [0078.964] GetCurrentThreadId () returned 0x970 [0078.964] GetCurrentThreadId () returned 0x970 [0078.964] GetCurrentThreadId () returned 0x970 [0078.964] GetCurrentThreadId () returned 0x970 [0078.964] GetCurrentThreadId () returned 0x970 [0078.964] GetCurrentThreadId () returned 0x970 [0078.964] GetCurrentThreadId () returned 0x970 [0078.964] GetCurrentThreadId () returned 0x970 [0078.964] GetCurrentThreadId () returned 0x970 [0078.964] GetCurrentThreadId () returned 0x970 [0078.964] GetCurrentThreadId () returned 0x970 [0078.964] GetCurrentThreadId () returned 0x970 [0078.965] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAACAohFjOjiibO7fYUdbJ4hcpwR+iDlEyaX557uAKcrthZ5m+2/W1jllLLPBHdqCR11HLVn+rUhj5/EG0QnLDKhqgBz4iXhs61ecWtDPENo9g/4NQHeiiZFGk8wZce8IgjtwdWTVfj8CerxBnvhkfcWKw3JjZh32KaB0uJo7F2HUhGxBVHO7K2UKo/Q+mjcITBbmzEcctjY+O4q9znf/+GhS4E731fBg6Cw==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0078.965] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAACAohFjOjiibO7fYUdbJ4hcpwR+iDlEyaX557uAKcrthZ5m+2/W1jllLLPBHdqCR11HLVn+rUhj5/EG0QnLDKhqgBz4iXhs61ecWtDPENo9g/4NQHeiiZFGk8wZce8IgjtwdWTVfj8CerxBnvhkfcWKw3JjZh32KaB0uJo7F2HUhGxBVHO7K2UKo/Q+mjcITBbmzEcctjY+O4q9znf/+GhS4E731fBg6Cw==", cchWideChar=245, lpMultiByteStr=0x3b4d08c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAACAohFjOjiibO7fYUdbJ4hcpwR+iDlEyaX557uAKcrthZ5m+2/W1jllLLPBHdqCR11HLVn+rUhj5/EG0QnLDKhqgBz4iXhs61ecWtDPENo9g/4NQHeiiZFGk8wZce8IgjtwdWTVfj8CerxBnvhkfcWKw3JjZh32KaB0uJo7F2HUhGxBVHO7K2UKo/Q+mjcITBbmzEcctjY+O4q9znf/+GhS4E731fBg6Cw==", lpUsedDefaultChar=0x0) returned 245 [0078.965] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0078.965] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0078.965] CloseHandle (hObject=0x158) returned 1 [0078.965] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif")) returned 1 [0078.966] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=19922989329) returned 1 [0078.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [AG00057_.GIF].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [ag00057_.gif].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0078.967] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0078.967] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0078.967] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0078.967] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0078.967] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0078.967] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0078.967] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0078.967] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0078.967] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0078.968] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0078.968] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0078.968] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0078.968] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0078.968] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0078.968] SetEndOfFile (hFile=0x158) returned 1 [0078.968] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0078.968] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0078.968] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0078.968] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0078.968] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0078.969] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0078.969] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="K08}<4w8#UJPWnVpZU-o~ni-oBU*{&h!", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0078.969] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="K08}<4w8#UJPWnVpZU-o~ni-oBU*{&h!", cchWideChar=32, lpMultiByteStr=0x203a0b4, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="K08}<4w8#UJPWnVpZU-o~ni-oBU*{&h!", lpUsedDefaultChar=0x0) returned 32 [0078.969] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0078.969] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0078.969] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b6b4200, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8b6b4200, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x2e73, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00057_.GIF", cAlternateFileName="")) returned 0x295098 [0078.969] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0078.970] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0078.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif")) returned 0x20 [0078.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif")) returned 0x20 [0078.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif")) returned 0x20 [0078.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif")) returned 0x20 [0078.970] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b6b4200, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8b6b4200, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x2e73)) returned 1 [0078.970] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0078.970] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0078.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif")) returned 0x20 [0078.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif")) returned 0x20 [0078.970] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0078.970] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0078.970] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0078.970] SetEndOfFile (hFile=0x158) returned 1 [0078.971] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00057_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0078.971] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00057_.GIF", cchWideChar=12, lpMultiByteStr=0x1fe430c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AG00057_.GIF", lpUsedDefaultChar=0x0) returned 12 [0078.971] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00057_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0078.971] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00057_.GIF", cchWideChar=12, lpMultiByteStr=0x1fe354c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AG00057_.GIF", lpUsedDefaultChar=0x0) returned 12 [0078.971] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe354c, cbMultiByte=12, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="AG00057_.GIFg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0078.971] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00057_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0078.972] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00057_.GIF", cchWideChar=12, lpMultiByteStr=0x1fe430c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AG00057_.GIF", lpUsedDefaultChar=0x0) returned 12 [0078.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0078.972] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0078.972] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2e73 [0078.972] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0078.972] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0078.972] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0078.972] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00057_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0078.972] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00057_.GIF", cchWideChar=12, lpMultiByteStr=0x1fe430c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AG00057_.GIF", lpUsedDefaultChar=0x0) returned 12 [0078.972] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00057_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0078.972] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00057_.GIF", cchWideChar=12, lpMultiByteStr=0x1fe354c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AG00057_.GIF", lpUsedDefaultChar=0x0) returned 12 [0078.972] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe354c, cbMultiByte=12, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="AG00057_.GIF7_.GIFg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0078.972] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00057_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0078.972] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00057_.GIF", cchWideChar=12, lpMultiByteStr=0x1fe430c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AG00057_.GIF", lpUsedDefaultChar=0x0) returned 12 [0078.973] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0078.973] CharToOemA (in: pSrc="AG00057_.GIF", pDst=0x1fe354c | out: pDst="AG00057_.GIF") returned 1 [0078.973] WriteFile (in: hFile=0x158, lpBuffer=0x1fe354c*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe354c*, lpNumberOfBytesWritten=0x18e048*=0xc, lpOverlapped=0x0) returned 1 [0078.973] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0078.974] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0078.974] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0078.974] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=19923722724) returned 1 [0078.974] ReadFile (in: hFile=0x11c, lpBuffer=0x3b7fb10, nNumberOfBytesToRead=0x2e73, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b7fb10*, lpNumberOfBytesRead=0x18dd7c*=0x2e73, lpOverlapped=0x0) returned 1 [0078.975] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0078.975] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=19923880826) returned 1 [0078.984] WriteFile (in: hFile=0x158, lpBuffer=0x379ad98*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379ad98*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0078.984] ReadFile (in: hFile=0x11c, lpBuffer=0x3b7fb10, nNumberOfBytesToRead=0x2e73, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3b7fb10*, lpNumberOfBytesRead=0x18de38*=0x2e73, lpOverlapped=0x0) returned 1 [0078.985] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x47 [0078.985] WriteFile (in: hFile=0x158, lpBuffer=0x3b941a0*, nNumberOfBytesToWrite=0x2e73, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3b941a0*, lpNumberOfBytesWritten=0x18de10*=0x2e73, lpOverlapped=0x0) returned 1 [0078.985] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x2eba [0078.985] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0078.985] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0078.985] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0078.985] SetFilePointer (in: hFile=0x158, lDistanceToMove=12, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2a [0078.985] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x2ec4 [0078.985] CloseHandle (hObject=0x11c) returned 1 [0078.986] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x2ec4 [0078.986] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x2ec4 [0078.986] SetFilePointer (in: hFile=0x158, lDistanceToMove=11972, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x2ec4 [0078.986] SetFilePointer (in: hFile=0x158, lDistanceToMove=11972, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x2ec4 [0078.986] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x2ec4 [0078.986] SetFilePointer (in: hFile=0x158, lDistanceToMove=11972, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x2ec4 [0078.986] SetEndOfFile (hFile=0x158) returned 1 [0078.986] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x2ec4 [0078.986] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x2ec4 [0078.986] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00057_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0078.986] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00057_.GIF", cchWideChar=12, lpMultiByteStr=0x1fe430c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AG00057_.GIF", lpUsedDefaultChar=0x0) returned 12 [0078.986] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00057_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0078.986] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00057_.GIF", cchWideChar=12, lpMultiByteStr=0x1fe43ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AG00057_.GIF", lpUsedDefaultChar=0x0) returned 12 [0078.986] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe43ac, cbMultiByte=12, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="AG00057_.GIFꞗ@涤(\x18믉`믑`") returned 12 [0078.986] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00057_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0078.986] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00057_.GIF", cchWideChar=12, lpMultiByteStr=0x1fe430c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AG00057_.GIF", lpUsedDefaultChar=0x0) returned 12 [0078.987] WriteFile (in: hFile=0x158, lpBuffer=0x3b635e8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3b635e8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0078.987] CharToOemA (in: pSrc="AG00057_.GIF", pDst=0x1fe43ac | out: pDst="AG00057_.GIF") returned 1 [0078.987] WriteFile (in: hFile=0x158, lpBuffer=0x1fe43ac*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe43ac*, lpNumberOfBytesWritten=0x18efcc*=0xc, lpOverlapped=0x0) returned 1 [0078.987] WriteFile (in: hFile=0x158, lpBuffer=0x379ae18*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379ae18*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0078.987] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0078.987] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0078.987] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x2f09 [0078.987] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x2f09 [0078.987] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0078.987] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0078.987] DeleteFileW (lpFileName="") returned 0 [0078.987] GetLastError () returned 0x3 [0078.987] GetFileAttributesW (lpFileName="") returned 0xffffffff [0078.987] SetLastError (dwErrCode=0x3) [0078.987] FlushFileBuffers (hFile=0x158) returned 1 [0078.990] GetCurrentThreadId () returned 0x970 [0078.990] GetCurrentThreadId () returned 0x970 [0078.990] GetCurrentThreadId () returned 0x970 [0078.990] GetCurrentThreadId () returned 0x970 [0078.990] GetCurrentThreadId () returned 0x970 [0078.990] GetCurrentThreadId () returned 0x970 [0078.990] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x2fc0 [0078.990] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x2fc0 [0078.990] SetFilePointer (in: hFile=0x158, lDistanceToMove=12224, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x2fc0 [0078.990] CloseHandle (hObject=0x158) returned 1 [0078.991] GetCurrentThreadId () returned 0x970 [0078.991] GetCurrentThreadId () returned 0x970 [0078.991] GetCurrentThreadId () returned 0x970 [0078.991] GetCurrentThreadId () returned 0x970 [0078.991] GetCurrentThreadId () returned 0x970 [0078.991] GetCurrentThreadId () returned 0x970 [0078.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [AG00057_.GIF].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [ag00057_.gif].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0078.991] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2fc0 [0078.991] SetFilePointer (in: hFile=0x158, lDistanceToMove=12096, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2f40 [0078.991] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0078.991] GetFileType (hFile=0x158) returned 0x1 [0078.991] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x1a, wMilliseconds=0x104)) [0078.991] GetCurrentThreadId () returned 0x970 [0078.991] GetCurrentThreadId () returned 0x970 [0078.991] GetCurrentThreadId () returned 0x970 [0078.991] GetCurrentThreadId () returned 0x970 [0078.991] GetCurrentThreadId () returned 0x970 [0078.991] GetCurrentThreadId () returned 0x970 [0078.991] GetCurrentThreadId () returned 0x970 [0078.991] GetCurrentThreadId () returned 0x970 [0078.991] GetCurrentThreadId () returned 0x970 [0078.991] GetCurrentThreadId () returned 0x970 [0078.991] GetCurrentThreadId () returned 0x970 [0078.991] GetCurrentThreadId () returned 0x970 [0078.991] GetCurrentThreadId () returned 0x970 [0078.991] GetCurrentThreadId () returned 0x970 [0078.991] GetCurrentThreadId () returned 0x970 [0078.991] GetCurrentThreadId () returned 0x970 [0078.991] GetCurrentThreadId () returned 0x970 [0078.992] GetCurrentThreadId () returned 0x970 [0078.992] GetCurrentThreadId () returned 0x970 [0078.992] GetCurrentThreadId () returned 0x970 [0078.992] GetCurrentThreadId () returned 0x970 [0078.992] GetCurrentThreadId () returned 0x970 [0078.992] GetCurrentThreadId () returned 0x970 [0078.992] GetCurrentThreadId () returned 0x970 [0078.992] GetCurrentThreadId () returned 0x970 [0078.992] GetCurrentThreadId () returned 0x970 [0078.992] GetCurrentThreadId () returned 0x970 [0078.992] GetCurrentThreadId () returned 0x970 [0078.992] GetCurrentThreadId () returned 0x970 [0078.992] GetCurrentThreadId () returned 0x970 [0078.992] GetCurrentThreadId () returned 0x970 [0078.992] GetCurrentThreadId () returned 0x970 [0078.992] GetCurrentThreadId () returned 0x970 [0078.992] GetCurrentThreadId () returned 0x970 [0078.992] GetCurrentThreadId () returned 0x970 [0078.992] GetCurrentThreadId () returned 0x970 [0078.992] GetCurrentThreadId () returned 0x970 [0078.992] GetCurrentThreadId () returned 0x970 [0078.992] GetCurrentThreadId () returned 0x970 [0078.992] GetCurrentThreadId () returned 0x970 [0078.992] GetCurrentThreadId () returned 0x970 [0078.992] GetCurrentThreadId () returned 0x970 [0078.992] GetCurrentThreadId () returned 0x970 [0078.992] GetCurrentThreadId () returned 0x970 [0078.992] GetCurrentThreadId () returned 0x970 [0078.992] GetCurrentThreadId () returned 0x970 [0078.992] GetCurrentThreadId () returned 0x970 [0078.992] GetCurrentThreadId () returned 0x970 [0078.992] GetCurrentThreadId () returned 0x970 [0078.992] GetCurrentThreadId () returned 0x970 [0078.992] GetCurrentThreadId () returned 0x970 [0078.992] GetCurrentThreadId () returned 0x970 [0078.992] GetCurrentThreadId () returned 0x970 [0078.992] GetCurrentThreadId () returned 0x970 [0078.992] GetCurrentThreadId () returned 0x970 [0078.992] GetCurrentThreadId () returned 0x970 [0078.992] GetCurrentThreadId () returned 0x970 [0078.992] GetCurrentThreadId () returned 0x970 [0078.992] GetCurrentThreadId () returned 0x970 [0078.992] GetCurrentThreadId () returned 0x970 [0078.992] GetCurrentThreadId () returned 0x970 [0078.993] GetCurrentThreadId () returned 0x970 [0078.993] GetCurrentThreadId () returned 0x970 [0078.993] GetCurrentThreadId () returned 0x970 [0078.993] GetCurrentThreadId () returned 0x970 [0078.993] GetCurrentThreadId () returned 0x970 [0078.993] GetCurrentThreadId () returned 0x970 [0078.993] GetCurrentThreadId () returned 0x970 [0078.993] GetCurrentThreadId () returned 0x970 [0078.993] GetCurrentThreadId () returned 0x970 [0078.993] GetCurrentThreadId () returned 0x970 [0078.993] GetCurrentThreadId () returned 0x970 [0078.993] GetCurrentThreadId () returned 0x970 [0078.993] GetCurrentThreadId () returned 0x970 [0078.993] GetCurrentThreadId () returned 0x970 [0078.993] GetCurrentThreadId () returned 0x970 [0078.993] GetCurrentThreadId () returned 0x970 [0078.993] GetCurrentThreadId () returned 0x970 [0078.993] GetCurrentThreadId () returned 0x970 [0078.993] GetCurrentThreadId () returned 0x970 [0078.993] GetCurrentThreadId () returned 0x970 [0078.993] GetCurrentThreadId () returned 0x970 [0078.993] GetCurrentThreadId () returned 0x970 [0078.993] GetCurrentThreadId () returned 0x970 [0078.993] GetCurrentThreadId () returned 0x970 [0078.993] GetCurrentThreadId () returned 0x970 [0078.993] GetCurrentThreadId () returned 0x970 [0078.993] GetCurrentThreadId () returned 0x970 [0078.993] GetCurrentThreadId () returned 0x970 [0078.993] GetCurrentThreadId () returned 0x970 [0078.993] GetCurrentThreadId () returned 0x970 [0078.993] GetCurrentThreadId () returned 0x970 [0078.993] GetCurrentThreadId () returned 0x970 [0078.993] GetCurrentThreadId () returned 0x970 [0078.993] GetCurrentThreadId () returned 0x970 [0078.993] GetCurrentThreadId () returned 0x970 [0078.993] GetCurrentThreadId () returned 0x970 [0078.993] GetCurrentThreadId () returned 0x970 [0078.993] GetCurrentThreadId () returned 0x970 [0078.993] GetCurrentThreadId () returned 0x970 [0078.993] GetCurrentThreadId () returned 0x970 [0078.993] GetCurrentThreadId () returned 0x970 [0078.993] GetCurrentThreadId () returned 0x970 [0078.993] GetCurrentThreadId () returned 0x970 [0078.993] GetCurrentThreadId () returned 0x970 [0078.994] GetCurrentThreadId () returned 0x970 [0078.994] GetCurrentThreadId () returned 0x970 [0078.994] GetCurrentThreadId () returned 0x970 [0078.994] GetCurrentThreadId () returned 0x970 [0078.994] GetCurrentThreadId () returned 0x970 [0078.994] GetCurrentThreadId () returned 0x970 [0078.994] GetCurrentThreadId () returned 0x970 [0078.994] GetCurrentThreadId () returned 0x970 [0078.994] GetCurrentThreadId () returned 0x970 [0078.994] GetCurrentThreadId () returned 0x970 [0078.994] GetCurrentThreadId () returned 0x970 [0078.994] GetCurrentThreadId () returned 0x970 [0078.994] GetCurrentThreadId () returned 0x970 [0078.994] GetCurrentThreadId () returned 0x970 [0078.994] GetCurrentThreadId () returned 0x970 [0078.994] GetCurrentThreadId () returned 0x970 [0078.994] GetCurrentThreadId () returned 0x970 [0078.994] GetCurrentThreadId () returned 0x970 [0078.994] GetCurrentThreadId () returned 0x970 [0078.994] GetCurrentThreadId () returned 0x970 [0078.994] GetCurrentThreadId () returned 0x970 [0078.994] GetCurrentThreadId () returned 0x970 [0078.994] GetCurrentThreadId () returned 0x970 [0078.994] GetCurrentThreadId () returned 0x970 [0078.994] GetCurrentThreadId () returned 0x970 [0078.994] GetCurrentThreadId () returned 0x970 [0078.994] GetCurrentThreadId () returned 0x970 [0078.994] GetCurrentThreadId () returned 0x970 [0078.994] GetCurrentThreadId () returned 0x970 [0078.994] GetCurrentThreadId () returned 0x970 [0078.994] GetCurrentThreadId () returned 0x970 [0078.994] GetCurrentThreadId () returned 0x970 [0078.994] GetCurrentThreadId () returned 0x970 [0078.994] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0078.994] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0078.994] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b6de80, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0078.994] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0078.994] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0078.994] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b6de80, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0078.994] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0078.995] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0078.995] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b6deb0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0078.995] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0078.995] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0078.995] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b6deb0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0078.995] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0078.995] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0078.995] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b6dee0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0078.995] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0078.995] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0078.995] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b6dee0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0078.995] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0078.995] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0078.995] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b6dee0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0078.995] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x1a, wMilliseconds=0x104)) [0078.995] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="K08}<4w8#UJPWnVpZU-o~ni-oBU*{&h!", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0078.995] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="K08}<4w8#UJPWnVpZU-o~ni-oBU*{&h!", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0078.995] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="K08}<4w8#UJPWnVpZU-o~ni-oBU*{&h!", cchWideChar=32, lpMultiByteStr=0x3b54788, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="K08}<4w8#UJPWnVpZU-o~ni-oBU*{&h!", lpUsedDefaultChar=0x0) returned 32 [0078.995] GetCurrentThreadId () returned 0x970 [0078.995] GetCurrentThreadId () returned 0x970 [0078.995] GetCurrentThreadId () returned 0x970 [0078.995] GetCurrentThreadId () returned 0x970 [0078.995] GetCurrentThreadId () returned 0x970 [0078.995] GetCurrentThreadId () returned 0x970 [0079.003] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0079.003] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0079.003] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3b44bd8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0079.003] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0079.003] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAEa2W+7vnjWT6Vf+AxNOwof/U49j6F+RDLGCepQWjis4YGMp7LcjJUevBDl2R89neUerJ7m0Tqpj63tafeEUTmJL4cptx6/5ABd6e0xbrDJHgvoh5KV7OFzcHVbTvRhu6z7TduQIyxgk+8gtdmGCKR5eeaalDiSWtvivKpug1riVuRxdq3XUS3L2Bbz2mgxdn+g2qYBuh4Ck9UroeDtFTQCnCtQUJY5qqg==") returned 232 [0079.003] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x1a, wMilliseconds=0x114)) [0079.003] GetCurrentThreadId () returned 0x970 [0079.003] GetCurrentThreadId () returned 0x970 [0079.003] GetCurrentThreadId () returned 0x970 [0079.003] GetCurrentThreadId () returned 0x970 [0079.003] GetCurrentThreadId () returned 0x970 [0079.003] GetCurrentThreadId () returned 0x970 [0079.003] GetCurrentThreadId () returned 0x970 [0079.003] GetCurrentThreadId () returned 0x970 [0079.003] GetCurrentThreadId () returned 0x970 [0079.003] GetCurrentThreadId () returned 0x970 [0079.003] GetCurrentThreadId () returned 0x970 [0079.003] GetCurrentThreadId () returned 0x970 [0079.003] GetCurrentThreadId () returned 0x970 [0079.003] GetCurrentThreadId () returned 0x970 [0079.003] GetCurrentThreadId () returned 0x970 [0079.003] GetCurrentThreadId () returned 0x970 [0079.003] GetCurrentThreadId () returned 0x970 [0079.003] GetCurrentThreadId () returned 0x970 [0079.003] GetCurrentThreadId () returned 0x970 [0079.003] GetCurrentThreadId () returned 0x970 [0079.003] GetCurrentThreadId () returned 0x970 [0079.003] GetCurrentThreadId () returned 0x970 [0079.003] GetCurrentThreadId () returned 0x970 [0079.003] GetCurrentThreadId () returned 0x970 [0079.003] GetCurrentThreadId () returned 0x970 [0079.004] GetCurrentThreadId () returned 0x970 [0079.004] GetCurrentThreadId () returned 0x970 [0079.004] GetCurrentThreadId () returned 0x970 [0079.004] GetCurrentThreadId () returned 0x970 [0079.004] GetCurrentThreadId () returned 0x970 [0079.004] GetCurrentThreadId () returned 0x970 [0079.004] GetCurrentThreadId () returned 0x970 [0079.004] GetCurrentThreadId () returned 0x970 [0079.004] GetCurrentThreadId () returned 0x970 [0079.004] GetCurrentThreadId () returned 0x970 [0079.004] GetCurrentThreadId () returned 0x970 [0079.004] GetCurrentThreadId () returned 0x970 [0079.004] GetCurrentThreadId () returned 0x970 [0079.004] GetCurrentThreadId () returned 0x970 [0079.004] GetCurrentThreadId () returned 0x970 [0079.004] GetCurrentThreadId () returned 0x970 [0079.004] GetCurrentThreadId () returned 0x970 [0079.004] GetCurrentThreadId () returned 0x970 [0079.004] GetCurrentThreadId () returned 0x970 [0079.004] GetCurrentThreadId () returned 0x970 [0079.004] GetCurrentThreadId () returned 0x970 [0079.004] GetCurrentThreadId () returned 0x970 [0079.004] GetCurrentThreadId () returned 0x970 [0079.004] GetCurrentThreadId () returned 0x970 [0079.004] GetCurrentThreadId () returned 0x970 [0079.004] GetCurrentThreadId () returned 0x970 [0079.004] GetCurrentThreadId () returned 0x970 [0079.004] GetCurrentThreadId () returned 0x970 [0079.004] GetCurrentThreadId () returned 0x970 [0079.004] GetCurrentThreadId () returned 0x970 [0079.004] GetCurrentThreadId () returned 0x970 [0079.004] GetCurrentThreadId () returned 0x970 [0079.004] GetCurrentThreadId () returned 0x970 [0079.004] GetCurrentThreadId () returned 0x970 [0079.004] GetCurrentThreadId () returned 0x970 [0079.004] GetCurrentThreadId () returned 0x970 [0079.004] GetCurrentThreadId () returned 0x970 [0079.004] GetCurrentThreadId () returned 0x970 [0079.004] GetCurrentThreadId () returned 0x970 [0079.004] GetCurrentThreadId () returned 0x970 [0079.004] GetCurrentThreadId () returned 0x970 [0079.004] GetCurrentThreadId () returned 0x970 [0079.004] GetCurrentThreadId () returned 0x970 [0079.004] GetCurrentThreadId () returned 0x970 [0079.005] GetCurrentThreadId () returned 0x970 [0079.005] GetCurrentThreadId () returned 0x970 [0079.005] GetCurrentThreadId () returned 0x970 [0079.005] GetCurrentThreadId () returned 0x970 [0079.005] GetCurrentThreadId () returned 0x970 [0079.005] GetCurrentThreadId () returned 0x970 [0079.005] GetCurrentThreadId () returned 0x970 [0079.005] GetCurrentThreadId () returned 0x970 [0079.005] GetCurrentThreadId () returned 0x970 [0079.005] GetCurrentThreadId () returned 0x970 [0079.005] GetCurrentThreadId () returned 0x970 [0079.005] GetCurrentThreadId () returned 0x970 [0079.005] GetCurrentThreadId () returned 0x970 [0079.005] GetCurrentThreadId () returned 0x970 [0079.005] GetCurrentThreadId () returned 0x970 [0079.005] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAEa2W+7vnjWT6Vf+AxNOwof/U49j6F+RDLGCepQWjis4YGMp7LcjJUevBDl2R89neUerJ7m0Tqpj63tafeEUTmJL4cptx6/5ABd6e0xbrDJHgvoh5KV7OFzcHVbTvRhu6z7TduQIyxgk+8gtdmGCKR5eeaalDiSWtvivKpug1riVuRxdq3XUS3L2Bbz2mgxdn+g2qYBuh4Ck9UroeDtFTQCnCtQUJY5qqg==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0079.005] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAEa2W+7vnjWT6Vf+AxNOwof/U49j6F+RDLGCepQWjis4YGMp7LcjJUevBDl2R89neUerJ7m0Tqpj63tafeEUTmJL4cptx6/5ABd6e0xbrDJHgvoh5KV7OFzcHVbTvRhu6z7TduQIyxgk+8gtdmGCKR5eeaalDiSWtvivKpug1riVuRxdq3XUS3L2Bbz2mgxdn+g2qYBuh4Ck9UroeDtFTQCnCtQUJY5qqg==", cchWideChar=245, lpMultiByteStr=0x3b4d08c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAEa2W+7vnjWT6Vf+AxNOwof/U49j6F+RDLGCepQWjis4YGMp7LcjJUevBDl2R89neUerJ7m0Tqpj63tafeEUTmJL4cptx6/5ABd6e0xbrDJHgvoh5KV7OFzcHVbTvRhu6z7TduQIyxgk+8gtdmGCKR5eeaalDiSWtvivKpug1riVuRxdq3XUS3L2Bbz2mgxdn+g2qYBuh4Ck9UroeDtFTQCnCtQUJY5qqg==", lpUsedDefaultChar=0x0) returned 245 [0079.005] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0079.005] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0079.005] CloseHandle (hObject=0x158) returned 1 [0079.005] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif")) returned 1 [0079.006] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=19926980609) returned 1 [0079.006] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [AG00090_.GIF].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [ag00090_.gif].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0079.007] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0079.007] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0079.007] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0079.007] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0079.007] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0079.007] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0079.007] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0079.007] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0079.007] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0079.007] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0079.007] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0079.008] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0079.008] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0079.008] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0079.008] SetEndOfFile (hFile=0x158) returned 1 [0079.008] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0079.008] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0079.008] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0079.008] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0079.008] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0079.009] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0079.009] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WPkIR^:&*&dTQ*yO8fn/:V$RxjU*z^7?", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0079.009] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WPkIR^:&*&dTQ*yO8fn/:V$RxjU*z^7?", cchWideChar=32, lpMultiByteStr=0x203a0ec, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WPkIR^:&*&dTQ*yO8fn/:V$RxjU*z^7?", lpUsedDefaultChar=0x0) returned 32 [0079.009] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0079.009] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0079.009] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29618e00, ftCreationTime.dwHighDateTime=0x1bd50af, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x29618e00, ftLastWriteTime.dwHighDateTime=0x1bd50af, nFileSizeHigh=0x0, nFileSizeLow=0x205, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00090_.GIF", cAlternateFileName="")) returned 0x295098 [0079.009] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0079.009] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0079.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif")) returned 0x20 [0079.010] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif")) returned 0x20 [0079.010] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif")) returned 0x20 [0079.010] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif")) returned 0x20 [0079.010] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29618e00, ftCreationTime.dwHighDateTime=0x1bd50af, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x29618e00, ftLastWriteTime.dwHighDateTime=0x1bd50af, nFileSizeHigh=0x0, nFileSizeLow=0x205)) returned 1 [0079.010] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0079.010] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0079.010] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif")) returned 0x20 [0079.010] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif")) returned 0x20 [0079.010] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0079.010] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0079.010] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0079.010] SetEndOfFile (hFile=0x158) returned 1 [0079.011] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00090_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0079.011] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00090_.GIF", cchWideChar=12, lpMultiByteStr=0x1fe3c4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AG00090_.GIF", lpUsedDefaultChar=0x0) returned 12 [0079.011] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00090_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0079.011] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00090_.GIF", cchWideChar=12, lpMultiByteStr=0x1fe35ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AG00090_.GIF", lpUsedDefaultChar=0x0) returned 12 [0079.011] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe35ac, cbMultiByte=12, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="AG00090_.GIFg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0079.011] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00090_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0079.011] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00090_.GIF", cchWideChar=12, lpMultiByteStr=0x1fe3c4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AG00090_.GIF", lpUsedDefaultChar=0x0) returned 12 [0079.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0079.012] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0079.012] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x205 [0079.012] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0079.012] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0079.013] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0079.013] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00090_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0079.013] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00090_.GIF", cchWideChar=12, lpMultiByteStr=0x1fe3c4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AG00090_.GIF", lpUsedDefaultChar=0x0) returned 12 [0079.013] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00090_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0079.013] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00090_.GIF", cchWideChar=12, lpMultiByteStr=0x1fe35ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AG00090_.GIF", lpUsedDefaultChar=0x0) returned 12 [0079.013] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe35ac, cbMultiByte=12, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="AG00090_.GIF0_.GIFg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0079.013] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00090_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0079.013] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00090_.GIF", cchWideChar=12, lpMultiByteStr=0x1fe3c4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AG00090_.GIF", lpUsedDefaultChar=0x0) returned 12 [0079.013] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0079.014] CharToOemA (in: pSrc="AG00090_.GIF", pDst=0x1fe35ac | out: pDst="AG00090_.GIF") returned 1 [0079.014] WriteFile (in: hFile=0x158, lpBuffer=0x1fe35ac*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe35ac*, lpNumberOfBytesWritten=0x18e048*=0xc, lpOverlapped=0x0) returned 1 [0079.014] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0079.014] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0079.014] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0079.014] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=19927764845) returned 1 [0079.014] ReadFile (in: hFile=0x11c, lpBuffer=0x34e2690, nNumberOfBytesToRead=0x205, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x34e2690*, lpNumberOfBytesRead=0x18dd7c*=0x205, lpOverlapped=0x0) returned 1 [0079.015] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0079.015] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=19927861293) returned 1 [0079.024] WriteFile (in: hFile=0x158, lpBuffer=0x379aca8*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x379aca8*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0079.024] ReadFile (in: hFile=0x11c, lpBuffer=0x34e2690, nNumberOfBytesToRead=0x205, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x34e2690*, lpNumberOfBytesRead=0x18de38*=0x205, lpOverlapped=0x0) returned 1 [0079.024] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x47 [0079.024] WriteFile (in: hFile=0x158, lpBuffer=0x34e28a0*, nNumberOfBytesToWrite=0x205, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x34e28a0*, lpNumberOfBytesWritten=0x18de10*=0x205, lpOverlapped=0x0) returned 1 [0079.024] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x24c [0079.024] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0079.024] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0079.024] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0079.024] SetFilePointer (in: hFile=0x158, lDistanceToMove=12, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2a [0079.025] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x256 [0079.025] CloseHandle (hObject=0x11c) returned 1 [0079.025] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x256 [0079.025] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x256 [0079.025] SetFilePointer (in: hFile=0x158, lDistanceToMove=598, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x256 [0079.025] SetFilePointer (in: hFile=0x158, lDistanceToMove=598, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x256 [0079.025] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x256 [0079.025] SetFilePointer (in: hFile=0x158, lDistanceToMove=598, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x256 [0079.025] SetEndOfFile (hFile=0x158) returned 1 [0079.025] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x256 [0079.025] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x256 [0079.025] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00090_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0079.025] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00090_.GIF", cchWideChar=12, lpMultiByteStr=0x1fe3c4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AG00090_.GIF", lpUsedDefaultChar=0x0) returned 12 [0079.025] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00090_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0079.025] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00090_.GIF", cchWideChar=12, lpMultiByteStr=0x1fe3a2c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AG00090_.GIF", lpUsedDefaultChar=0x0) returned 12 [0079.026] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe3a2c, cbMultiByte=12, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="AG00090_.GIFꞗ@涤(\x18믉`믑`") returned 12 [0079.026] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00090_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0079.026] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00090_.GIF", cchWideChar=12, lpMultiByteStr=0x1fe3c4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AG00090_.GIF", lpUsedDefaultChar=0x0) returned 12 [0079.026] WriteFile (in: hFile=0x158, lpBuffer=0x3b635e8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3b635e8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0079.026] CharToOemA (in: pSrc="AG00090_.GIF", pDst=0x1fe3a2c | out: pDst="AG00090_.GIF") returned 1 [0079.026] WriteFile (in: hFile=0x158, lpBuffer=0x1fe3a2c*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe3a2c*, lpNumberOfBytesWritten=0x18efcc*=0xc, lpOverlapped=0x0) returned 1 [0079.026] WriteFile (in: hFile=0x158, lpBuffer=0x379ad10*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379ad10*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0079.026] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0079.026] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0079.026] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x29b [0079.026] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x29b [0079.026] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0079.026] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0079.026] DeleteFileW (lpFileName="") returned 0 [0079.026] GetLastError () returned 0x3 [0079.026] GetFileAttributesW (lpFileName="") returned 0xffffffff [0079.026] SetLastError (dwErrCode=0x3) [0079.027] FlushFileBuffers (hFile=0x158) returned 1 [0079.030] GetCurrentThreadId () returned 0x970 [0079.030] GetCurrentThreadId () returned 0x970 [0079.030] GetCurrentThreadId () returned 0x970 [0079.030] GetCurrentThreadId () returned 0x970 [0079.030] GetCurrentThreadId () returned 0x970 [0079.030] GetCurrentThreadId () returned 0x970 [0079.030] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x352 [0079.031] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x352 [0079.031] SetFilePointer (in: hFile=0x158, lDistanceToMove=850, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x352 [0079.031] CloseHandle (hObject=0x158) returned 1 [0079.031] GetCurrentThreadId () returned 0x970 [0079.031] GetCurrentThreadId () returned 0x970 [0079.031] GetCurrentThreadId () returned 0x970 [0079.031] GetCurrentThreadId () returned 0x970 [0079.031] GetCurrentThreadId () returned 0x970 [0079.031] GetCurrentThreadId () returned 0x970 [0079.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [AG00090_.GIF].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [ag00090_.gif].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0079.031] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x352 [0079.031] SetFilePointer (in: hFile=0x158, lDistanceToMove=722, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2d2 [0079.031] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0079.031] GetFileType (hFile=0x158) returned 0x1 [0079.031] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x1a, wMilliseconds=0x133)) [0079.031] GetCurrentThreadId () returned 0x970 [0079.031] GetCurrentThreadId () returned 0x970 [0079.031] GetCurrentThreadId () returned 0x970 [0079.031] GetCurrentThreadId () returned 0x970 [0079.031] GetCurrentThreadId () returned 0x970 [0079.031] GetCurrentThreadId () returned 0x970 [0079.031] GetCurrentThreadId () returned 0x970 [0079.031] GetCurrentThreadId () returned 0x970 [0079.031] GetCurrentThreadId () returned 0x970 [0079.032] GetCurrentThreadId () returned 0x970 [0079.032] GetCurrentThreadId () returned 0x970 [0079.032] GetCurrentThreadId () returned 0x970 [0079.032] GetCurrentThreadId () returned 0x970 [0079.032] GetCurrentThreadId () returned 0x970 [0079.032] GetCurrentThreadId () returned 0x970 [0079.032] GetCurrentThreadId () returned 0x970 [0079.032] GetCurrentThreadId () returned 0x970 [0079.032] GetCurrentThreadId () returned 0x970 [0079.032] GetCurrentThreadId () returned 0x970 [0079.032] GetCurrentThreadId () returned 0x970 [0079.032] GetCurrentThreadId () returned 0x970 [0079.032] GetCurrentThreadId () returned 0x970 [0079.032] GetCurrentThreadId () returned 0x970 [0079.032] GetCurrentThreadId () returned 0x970 [0079.032] GetCurrentThreadId () returned 0x970 [0079.032] GetCurrentThreadId () returned 0x970 [0079.032] GetCurrentThreadId () returned 0x970 [0079.032] GetCurrentThreadId () returned 0x970 [0079.032] GetCurrentThreadId () returned 0x970 [0079.032] GetCurrentThreadId () returned 0x970 [0079.032] GetCurrentThreadId () returned 0x970 [0079.032] GetCurrentThreadId () returned 0x970 [0079.032] GetCurrentThreadId () returned 0x970 [0079.032] GetCurrentThreadId () returned 0x970 [0079.032] GetCurrentThreadId () returned 0x970 [0079.032] GetCurrentThreadId () returned 0x970 [0079.032] GetCurrentThreadId () returned 0x970 [0079.032] GetCurrentThreadId () returned 0x970 [0079.032] GetCurrentThreadId () returned 0x970 [0079.032] GetCurrentThreadId () returned 0x970 [0079.032] GetCurrentThreadId () returned 0x970 [0079.032] GetCurrentThreadId () returned 0x970 [0079.032] GetCurrentThreadId () returned 0x970 [0079.032] GetCurrentThreadId () returned 0x970 [0079.032] GetCurrentThreadId () returned 0x970 [0079.032] GetCurrentThreadId () returned 0x970 [0079.032] GetCurrentThreadId () returned 0x970 [0079.032] GetCurrentThreadId () returned 0x970 [0079.032] GetCurrentThreadId () returned 0x970 [0079.032] GetCurrentThreadId () returned 0x970 [0079.032] GetCurrentThreadId () returned 0x970 [0079.032] GetCurrentThreadId () returned 0x970 [0079.032] GetCurrentThreadId () returned 0x970 [0079.032] GetCurrentThreadId () returned 0x970 [0079.033] GetCurrentThreadId () returned 0x970 [0079.033] GetCurrentThreadId () returned 0x970 [0079.033] GetCurrentThreadId () returned 0x970 [0079.033] GetCurrentThreadId () returned 0x970 [0079.033] GetCurrentThreadId () returned 0x970 [0079.033] GetCurrentThreadId () returned 0x970 [0079.033] GetCurrentThreadId () returned 0x970 [0079.033] GetCurrentThreadId () returned 0x970 [0079.033] GetCurrentThreadId () returned 0x970 [0079.033] GetCurrentThreadId () returned 0x970 [0079.033] GetCurrentThreadId () returned 0x970 [0079.033] GetCurrentThreadId () returned 0x970 [0079.033] GetCurrentThreadId () returned 0x970 [0079.033] GetCurrentThreadId () returned 0x970 [0079.033] GetCurrentThreadId () returned 0x970 [0079.033] GetCurrentThreadId () returned 0x970 [0079.033] GetCurrentThreadId () returned 0x970 [0079.033] GetCurrentThreadId () returned 0x970 [0079.033] GetCurrentThreadId () returned 0x970 [0079.033] GetCurrentThreadId () returned 0x970 [0079.033] GetCurrentThreadId () returned 0x970 [0079.033] GetCurrentThreadId () returned 0x970 [0079.033] GetCurrentThreadId () returned 0x970 [0079.033] GetCurrentThreadId () returned 0x970 [0079.033] GetCurrentThreadId () returned 0x970 [0079.033] GetCurrentThreadId () returned 0x970 [0079.033] GetCurrentThreadId () returned 0x970 [0079.033] GetCurrentThreadId () returned 0x970 [0079.033] GetCurrentThreadId () returned 0x970 [0079.033] GetCurrentThreadId () returned 0x970 [0079.033] GetCurrentThreadId () returned 0x970 [0079.033] GetCurrentThreadId () returned 0x970 [0079.033] GetCurrentThreadId () returned 0x970 [0079.033] GetCurrentThreadId () returned 0x970 [0079.033] GetCurrentThreadId () returned 0x970 [0079.033] GetCurrentThreadId () returned 0x970 [0079.033] GetCurrentThreadId () returned 0x970 [0079.033] GetCurrentThreadId () returned 0x970 [0079.033] GetCurrentThreadId () returned 0x970 [0079.033] GetCurrentThreadId () returned 0x970 [0079.033] GetCurrentThreadId () returned 0x970 [0079.033] GetCurrentThreadId () returned 0x970 [0079.033] GetCurrentThreadId () returned 0x970 [0079.033] GetCurrentThreadId () returned 0x970 [0079.033] GetCurrentThreadId () returned 0x970 [0079.034] GetCurrentThreadId () returned 0x970 [0079.034] GetCurrentThreadId () returned 0x970 [0079.034] GetCurrentThreadId () returned 0x970 [0079.034] GetCurrentThreadId () returned 0x970 [0079.034] GetCurrentThreadId () returned 0x970 [0079.034] GetCurrentThreadId () returned 0x970 [0079.034] GetCurrentThreadId () returned 0x970 [0079.034] GetCurrentThreadId () returned 0x970 [0079.034] GetCurrentThreadId () returned 0x970 [0079.034] GetCurrentThreadId () returned 0x970 [0079.034] GetCurrentThreadId () returned 0x970 [0079.034] GetCurrentThreadId () returned 0x970 [0079.034] GetCurrentThreadId () returned 0x970 [0079.034] GetCurrentThreadId () returned 0x970 [0079.034] GetCurrentThreadId () returned 0x970 [0079.034] GetCurrentThreadId () returned 0x970 [0079.034] GetCurrentThreadId () returned 0x970 [0079.034] GetCurrentThreadId () returned 0x970 [0079.034] GetCurrentThreadId () returned 0x970 [0079.034] GetCurrentThreadId () returned 0x970 [0079.034] GetCurrentThreadId () returned 0x970 [0079.034] GetCurrentThreadId () returned 0x970 [0079.034] GetCurrentThreadId () returned 0x970 [0079.034] GetCurrentThreadId () returned 0x970 [0079.034] GetCurrentThreadId () returned 0x970 [0079.034] GetCurrentThreadId () returned 0x970 [0079.034] GetCurrentThreadId () returned 0x970 [0079.034] GetCurrentThreadId () returned 0x970 [0079.034] GetCurrentThreadId () returned 0x970 [0079.034] GetCurrentThreadId () returned 0x970 [0079.034] GetCurrentThreadId () returned 0x970 [0079.034] GetCurrentThreadId () returned 0x970 [0079.034] GetCurrentThreadId () returned 0x970 [0079.034] GetCurrentThreadId () returned 0x970 [0079.034] GetCurrentThreadId () returned 0x970 [0079.034] GetCurrentThreadId () returned 0x970 [0079.034] GetCurrentThreadId () returned 0x970 [0079.034] GetCurrentThreadId () returned 0x970 [0079.034] GetCurrentThreadId () returned 0x970 [0079.034] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0079.034] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0079.034] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b666b0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0079.035] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0079.035] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0079.035] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b666b0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0079.035] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0079.035] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0079.035] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b666e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0079.035] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0079.035] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0079.035] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b666e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0079.035] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0079.035] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0079.035] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b66710, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0079.035] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0079.035] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0079.035] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b66710, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0079.035] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0079.035] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0079.035] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b66710, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0079.035] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x1a, wMilliseconds=0x133)) [0079.035] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WPkIR^:&*&dTQ*yO8fn/:V$RxjU*z^7?", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0079.035] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WPkIR^:&*&dTQ*yO8fn/:V$RxjU*z^7?", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0079.035] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WPkIR^:&*&dTQ*yO8fn/:V$RxjU*z^7?", cchWideChar=32, lpMultiByteStr=0x3b547b8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WPkIR^:&*&dTQ*yO8fn/:V$RxjU*z^7?", lpUsedDefaultChar=0x0) returned 32 [0079.035] GetCurrentThreadId () returned 0x970 [0079.035] GetCurrentThreadId () returned 0x970 [0079.035] GetCurrentThreadId () returned 0x970 [0079.035] GetCurrentThreadId () returned 0x970 [0079.035] GetCurrentThreadId () returned 0x970 [0079.035] GetCurrentThreadId () returned 0x970 [0079.043] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0079.043] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0079.043] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3b44cc8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0079.043] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0079.043] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAHb61pkAG2GPggm93sRc+HjWsznymOuKymEQZZoOyvwe0oaU847BMCyYvgMjp0mKfjMTJdRjmV4syTZ5BWRg5CunGXsSDTU17KLoMP107YuU8sxKgGG2mnd7XPsMKM+65Rvm00PFP3dBOV1pAgYyC13XbPNH0LLIu0NODsm+Ryl5yujZpbG9QOROTcX0htE3feMsudHOeEEUy8rBQIBf8Cn+HbFQTTfOPA==") returned 232 [0079.043] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x1a, wMilliseconds=0x133)) [0079.043] GetCurrentThreadId () returned 0x970 [0079.043] GetCurrentThreadId () returned 0x970 [0079.043] GetCurrentThreadId () returned 0x970 [0079.043] GetCurrentThreadId () returned 0x970 [0079.043] GetCurrentThreadId () returned 0x970 [0079.043] GetCurrentThreadId () returned 0x970 [0079.043] GetCurrentThreadId () returned 0x970 [0079.043] GetCurrentThreadId () returned 0x970 [0079.043] GetCurrentThreadId () returned 0x970 [0079.043] GetCurrentThreadId () returned 0x970 [0079.043] GetCurrentThreadId () returned 0x970 [0079.043] GetCurrentThreadId () returned 0x970 [0079.043] GetCurrentThreadId () returned 0x970 [0079.043] GetCurrentThreadId () returned 0x970 [0079.043] GetCurrentThreadId () returned 0x970 [0079.043] GetCurrentThreadId () returned 0x970 [0079.043] GetCurrentThreadId () returned 0x970 [0079.043] GetCurrentThreadId () returned 0x970 [0079.043] GetCurrentThreadId () returned 0x970 [0079.043] GetCurrentThreadId () returned 0x970 [0079.043] GetCurrentThreadId () returned 0x970 [0079.044] GetCurrentThreadId () returned 0x970 [0079.044] GetCurrentThreadId () returned 0x970 [0079.044] GetCurrentThreadId () returned 0x970 [0079.044] GetCurrentThreadId () returned 0x970 [0079.044] GetCurrentThreadId () returned 0x970 [0079.044] GetCurrentThreadId () returned 0x970 [0079.044] GetCurrentThreadId () returned 0x970 [0079.044] GetCurrentThreadId () returned 0x970 [0079.044] GetCurrentThreadId () returned 0x970 [0079.044] GetCurrentThreadId () returned 0x970 [0079.044] GetCurrentThreadId () returned 0x970 [0079.044] GetCurrentThreadId () returned 0x970 [0079.044] GetCurrentThreadId () returned 0x970 [0079.044] GetCurrentThreadId () returned 0x970 [0079.044] GetCurrentThreadId () returned 0x970 [0079.044] GetCurrentThreadId () returned 0x970 [0079.044] GetCurrentThreadId () returned 0x970 [0079.044] GetCurrentThreadId () returned 0x970 [0079.044] GetCurrentThreadId () returned 0x970 [0079.044] GetCurrentThreadId () returned 0x970 [0079.044] GetCurrentThreadId () returned 0x970 [0079.044] GetCurrentThreadId () returned 0x970 [0079.044] GetCurrentThreadId () returned 0x970 [0079.044] GetCurrentThreadId () returned 0x970 [0079.044] GetCurrentThreadId () returned 0x970 [0079.044] GetCurrentThreadId () returned 0x970 [0079.044] GetCurrentThreadId () returned 0x970 [0079.044] GetCurrentThreadId () returned 0x970 [0079.044] GetCurrentThreadId () returned 0x970 [0079.044] GetCurrentThreadId () returned 0x970 [0079.044] GetCurrentThreadId () returned 0x970 [0079.044] GetCurrentThreadId () returned 0x970 [0079.044] GetCurrentThreadId () returned 0x970 [0079.044] GetCurrentThreadId () returned 0x970 [0079.044] GetCurrentThreadId () returned 0x970 [0079.044] GetCurrentThreadId () returned 0x970 [0079.044] GetCurrentThreadId () returned 0x970 [0079.044] GetCurrentThreadId () returned 0x970 [0079.044] GetCurrentThreadId () returned 0x970 [0079.044] GetCurrentThreadId () returned 0x970 [0079.044] GetCurrentThreadId () returned 0x970 [0079.044] GetCurrentThreadId () returned 0x970 [0079.044] GetCurrentThreadId () returned 0x970 [0079.044] GetCurrentThreadId () returned 0x970 [0079.044] GetCurrentThreadId () returned 0x970 [0079.045] GetCurrentThreadId () returned 0x970 [0079.045] GetCurrentThreadId () returned 0x970 [0079.045] GetCurrentThreadId () returned 0x970 [0079.045] GetCurrentThreadId () returned 0x970 [0079.045] GetCurrentThreadId () returned 0x970 [0079.045] GetCurrentThreadId () returned 0x970 [0079.045] GetCurrentThreadId () returned 0x970 [0079.045] GetCurrentThreadId () returned 0x970 [0079.045] GetCurrentThreadId () returned 0x970 [0079.045] GetCurrentThreadId () returned 0x970 [0079.045] GetCurrentThreadId () returned 0x970 [0079.045] GetCurrentThreadId () returned 0x970 [0079.045] GetCurrentThreadId () returned 0x970 [0079.045] GetCurrentThreadId () returned 0x970 [0079.045] GetCurrentThreadId () returned 0x970 [0079.045] GetCurrentThreadId () returned 0x970 [0079.045] GetCurrentThreadId () returned 0x970 [0079.045] GetCurrentThreadId () returned 0x970 [0079.045] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAHb61pkAG2GPggm93sRc+HjWsznymOuKymEQZZoOyvwe0oaU847BMCyYvgMjp0mKfjMTJdRjmV4syTZ5BWRg5CunGXsSDTU17KLoMP107YuU8sxKgGG2mnd7XPsMKM+65Rvm00PFP3dBOV1pAgYyC13XbPNH0LLIu0NODsm+Ryl5yujZpbG9QOROTcX0htE3feMsudHOeEEUy8rBQIBf8Cn+HbFQTTfOPA==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0079.045] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAHb61pkAG2GPggm93sRc+HjWsznymOuKymEQZZoOyvwe0oaU847BMCyYvgMjp0mKfjMTJdRjmV4syTZ5BWRg5CunGXsSDTU17KLoMP107YuU8sxKgGG2mnd7XPsMKM+65Rvm00PFP3dBOV1pAgYyC13XbPNH0LLIu0NODsm+Ryl5yujZpbG9QOROTcX0htE3feMsudHOeEEUy8rBQIBf8Cn+HbFQTTfOPA==", cchWideChar=245, lpMultiByteStr=0x3b4d08c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAHb61pkAG2GPggm93sRc+HjWsznymOuKymEQZZoOyvwe0oaU847BMCyYvgMjp0mKfjMTJdRjmV4syTZ5BWRg5CunGXsSDTU17KLoMP107YuU8sxKgGG2mnd7XPsMKM+65Rvm00PFP3dBOV1pAgYyC13XbPNH0LLIu0NODsm+Ryl5yujZpbG9QOROTcX0htE3feMsudHOeEEUy8rBQIBf8Cn+HbFQTTfOPA==", lpUsedDefaultChar=0x0) returned 245 [0079.045] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0079.045] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0079.045] CloseHandle (hObject=0x158) returned 1 [0079.045] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif")) returned 1 [0079.046] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=19930967018) returned 1 [0079.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [AG00092_.GIF].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [ag00092_.gif].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0079.047] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0079.047] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0079.047] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0079.047] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0079.047] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0079.047] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0079.047] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0079.047] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0079.047] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0079.047] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0079.047] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0079.047] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0079.047] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0079.048] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0079.048] SetEndOfFile (hFile=0x158) returned 1 [0079.048] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0079.048] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0079.048] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0079.048] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0079.048] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0079.049] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0079.049] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="U}xMTA/2sb,FrKGKte6pz9g+YVBh\"\\d6", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0079.049] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="U}xMTA/2sb,FrKGKte6pz9g+YVBh\"\\d6", cchWideChar=32, lpMultiByteStr=0x203a124, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="U}xMTA/2sb,FrKGKte6pz9g+YVBh\"\\d6", lpUsedDefaultChar=0x0) returned 32 [0079.049] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0079.049] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0079.049] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26ff3400, ftCreationTime.dwHighDateTime=0x1bd50af, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x26ff3400, ftLastWriteTime.dwHighDateTime=0x1bd50af, nFileSizeHigh=0x0, nFileSizeLow=0x1f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00092_.GIF", cAlternateFileName="")) returned 0x295098 [0079.049] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0079.049] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0079.049] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif")) returned 0x20 [0079.050] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif")) returned 0x20 [0079.050] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif")) returned 0x20 [0079.050] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif")) returned 0x20 [0079.050] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26ff3400, ftCreationTime.dwHighDateTime=0x1bd50af, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x26ff3400, ftLastWriteTime.dwHighDateTime=0x1bd50af, nFileSizeHigh=0x0, nFileSizeLow=0x1f6)) returned 1 [0079.050] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0079.050] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0079.050] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif")) returned 0x20 [0079.050] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif")) returned 0x20 [0079.050] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0079.050] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0079.050] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0079.050] SetEndOfFile (hFile=0x158) returned 1 [0079.051] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00092_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0079.051] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00092_.GIF", cchWideChar=12, lpMultiByteStr=0x1fe37ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AG00092_.GIF", lpUsedDefaultChar=0x0) returned 12 [0079.051] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00092_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0079.051] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00092_.GIF", cchWideChar=12, lpMultiByteStr=0x1fe368c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AG00092_.GIF", lpUsedDefaultChar=0x0) returned 12 [0079.051] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe368c, cbMultiByte=12, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="AG00092_.GIFg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0079.051] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00092_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0079.051] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00092_.GIF", cchWideChar=12, lpMultiByteStr=0x1fe37ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AG00092_.GIF", lpUsedDefaultChar=0x0) returned 12 [0079.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0079.052] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0079.052] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x1f6 [0079.052] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0079.052] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0079.052] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0079.052] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00092_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0079.052] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00092_.GIF", cchWideChar=12, lpMultiByteStr=0x1fe37ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AG00092_.GIF", lpUsedDefaultChar=0x0) returned 12 [0079.052] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00092_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0079.052] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00092_.GIF", cchWideChar=12, lpMultiByteStr=0x1fe368c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AG00092_.GIF", lpUsedDefaultChar=0x0) returned 12 [0079.052] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe368c, cbMultiByte=12, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="AG00092_.GIF2_.GIFg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0079.052] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00092_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0079.052] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00092_.GIF", cchWideChar=12, lpMultiByteStr=0x1fe37ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AG00092_.GIF", lpUsedDefaultChar=0x0) returned 12 [0079.052] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0079.053] CharToOemA (in: pSrc="AG00092_.GIF", pDst=0x1fe368c | out: pDst="AG00092_.GIF") returned 1 [0079.053] WriteFile (in: hFile=0x158, lpBuffer=0x1fe368c*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe368c*, lpNumberOfBytesWritten=0x18e048*=0xc, lpOverlapped=0x0) returned 1 [0079.053] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0079.053] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0079.054] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0079.054] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=19931707442) returned 1 [0079.054] ReadFile (in: hFile=0x11c, lpBuffer=0x34e2480, nNumberOfBytesToRead=0x1f6, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x34e2480*, lpNumberOfBytesRead=0x18dd7c*=0x1f6, lpOverlapped=0x0) returned 1 [0079.055] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0079.055] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=19931807192) returned 1 [0079.063] WriteFile (in: hFile=0x158, lpBuffer=0x3b912c0*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b912c0*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0079.063] ReadFile (in: hFile=0x11c, lpBuffer=0x34e2480, nNumberOfBytesToRead=0x1f6, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x34e2480*, lpNumberOfBytesRead=0x18de38*=0x1f6, lpOverlapped=0x0) returned 1 [0079.064] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x47 [0079.064] WriteFile (in: hFile=0x158, lpBuffer=0x34e28a0*, nNumberOfBytesToWrite=0x1f6, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x34e28a0*, lpNumberOfBytesWritten=0x18de10*=0x1f6, lpOverlapped=0x0) returned 1 [0079.064] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x23d [0079.064] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0079.064] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0079.064] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0079.064] SetFilePointer (in: hFile=0x158, lDistanceToMove=12, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2a [0079.064] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x247 [0079.064] CloseHandle (hObject=0x11c) returned 1 [0079.064] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x247 [0079.064] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x247 [0079.064] SetFilePointer (in: hFile=0x158, lDistanceToMove=583, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x247 [0079.065] SetFilePointer (in: hFile=0x158, lDistanceToMove=583, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x247 [0079.065] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x247 [0079.065] SetFilePointer (in: hFile=0x158, lDistanceToMove=583, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x247 [0079.065] SetEndOfFile (hFile=0x158) returned 1 [0079.065] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x247 [0079.065] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x247 [0079.065] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00092_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0079.065] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00092_.GIF", cchWideChar=12, lpMultiByteStr=0x1fe37ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AG00092_.GIF", lpUsedDefaultChar=0x0) returned 12 [0079.065] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00092_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0079.065] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00092_.GIF", cchWideChar=12, lpMultiByteStr=0x1fe43ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AG00092_.GIF", lpUsedDefaultChar=0x0) returned 12 [0079.065] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe43ac, cbMultiByte=12, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="AG00092_.GIFꞗ@涤(\x18믉`믑`") returned 12 [0079.065] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00092_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0079.065] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00092_.GIF", cchWideChar=12, lpMultiByteStr=0x1fe37ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AG00092_.GIF", lpUsedDefaultChar=0x0) returned 12 [0079.065] WriteFile (in: hFile=0x158, lpBuffer=0x3b635e8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3b635e8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0079.065] CharToOemA (in: pSrc="AG00092_.GIF", pDst=0x1fe43ac | out: pDst="AG00092_.GIF") returned 1 [0079.065] WriteFile (in: hFile=0x158, lpBuffer=0x1fe43ac*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe43ac*, lpNumberOfBytesWritten=0x18efcc*=0xc, lpOverlapped=0x0) returned 1 [0079.066] WriteFile (in: hFile=0x158, lpBuffer=0x379acf8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x379acf8*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0079.066] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0079.066] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0079.066] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x28c [0079.066] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x28c [0079.066] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0079.066] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0079.066] DeleteFileW (lpFileName="") returned 0 [0079.066] GetLastError () returned 0x3 [0079.066] GetFileAttributesW (lpFileName="") returned 0xffffffff [0079.066] SetLastError (dwErrCode=0x3) [0079.066] FlushFileBuffers (hFile=0x158) returned 1 [0079.069] GetCurrentThreadId () returned 0x970 [0079.069] GetCurrentThreadId () returned 0x970 [0079.069] GetCurrentThreadId () returned 0x970 [0079.069] GetCurrentThreadId () returned 0x970 [0079.069] GetCurrentThreadId () returned 0x970 [0079.069] GetCurrentThreadId () returned 0x970 [0079.069] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x343 [0079.069] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x343 [0079.069] SetFilePointer (in: hFile=0x158, lDistanceToMove=835, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x343 [0079.069] CloseHandle (hObject=0x158) returned 1 [0079.069] GetCurrentThreadId () returned 0x970 [0079.069] GetCurrentThreadId () returned 0x970 [0079.069] GetCurrentThreadId () returned 0x970 [0079.069] GetCurrentThreadId () returned 0x970 [0079.069] GetCurrentThreadId () returned 0x970 [0079.069] GetCurrentThreadId () returned 0x970 [0079.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [AG00092_.GIF].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [ag00092_.gif].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0079.069] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x343 [0079.069] SetFilePointer (in: hFile=0x158, lDistanceToMove=707, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2c3 [0079.069] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0079.070] GetFileType (hFile=0x158) returned 0x1 [0079.070] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x1a, wMilliseconds=0x152)) [0079.070] GetCurrentThreadId () returned 0x970 [0079.070] GetCurrentThreadId () returned 0x970 [0079.070] GetCurrentThreadId () returned 0x970 [0079.070] GetCurrentThreadId () returned 0x970 [0079.070] GetCurrentThreadId () returned 0x970 [0079.070] GetCurrentThreadId () returned 0x970 [0079.070] GetCurrentThreadId () returned 0x970 [0079.070] GetCurrentThreadId () returned 0x970 [0079.070] GetCurrentThreadId () returned 0x970 [0079.070] GetCurrentThreadId () returned 0x970 [0079.070] GetCurrentThreadId () returned 0x970 [0079.070] GetCurrentThreadId () returned 0x970 [0079.070] GetCurrentThreadId () returned 0x970 [0079.070] GetCurrentThreadId () returned 0x970 [0079.070] GetCurrentThreadId () returned 0x970 [0079.070] GetCurrentThreadId () returned 0x970 [0079.070] GetCurrentThreadId () returned 0x970 [0079.070] GetCurrentThreadId () returned 0x970 [0079.070] GetCurrentThreadId () returned 0x970 [0079.070] GetCurrentThreadId () returned 0x970 [0079.070] GetCurrentThreadId () returned 0x970 [0079.070] GetCurrentThreadId () returned 0x970 [0079.070] GetCurrentThreadId () returned 0x970 [0079.070] GetCurrentThreadId () returned 0x970 [0079.070] GetCurrentThreadId () returned 0x970 [0079.070] GetCurrentThreadId () returned 0x970 [0079.070] GetCurrentThreadId () returned 0x970 [0079.070] GetCurrentThreadId () returned 0x970 [0079.070] GetCurrentThreadId () returned 0x970 [0079.070] GetCurrentThreadId () returned 0x970 [0079.070] GetCurrentThreadId () returned 0x970 [0079.070] GetCurrentThreadId () returned 0x970 [0079.070] GetCurrentThreadId () returned 0x970 [0079.070] GetCurrentThreadId () returned 0x970 [0079.070] GetCurrentThreadId () returned 0x970 [0079.070] GetCurrentThreadId () returned 0x970 [0079.070] GetCurrentThreadId () returned 0x970 [0079.070] GetCurrentThreadId () returned 0x970 [0079.070] GetCurrentThreadId () returned 0x970 [0079.070] GetCurrentThreadId () returned 0x970 [0079.071] GetCurrentThreadId () returned 0x970 [0079.071] GetCurrentThreadId () returned 0x970 [0079.071] GetCurrentThreadId () returned 0x970 [0079.071] GetCurrentThreadId () returned 0x970 [0079.071] GetCurrentThreadId () returned 0x970 [0079.071] GetCurrentThreadId () returned 0x970 [0079.071] GetCurrentThreadId () returned 0x970 [0079.071] GetCurrentThreadId () returned 0x970 [0079.071] GetCurrentThreadId () returned 0x970 [0079.071] GetCurrentThreadId () returned 0x970 [0079.071] GetCurrentThreadId () returned 0x970 [0079.071] GetCurrentThreadId () returned 0x970 [0079.071] GetCurrentThreadId () returned 0x970 [0079.071] GetCurrentThreadId () returned 0x970 [0079.071] GetCurrentThreadId () returned 0x970 [0079.071] GetCurrentThreadId () returned 0x970 [0079.071] GetCurrentThreadId () returned 0x970 [0079.071] GetCurrentThreadId () returned 0x970 [0079.071] GetCurrentThreadId () returned 0x970 [0079.071] GetCurrentThreadId () returned 0x970 [0079.071] GetCurrentThreadId () returned 0x970 [0079.071] GetCurrentThreadId () returned 0x970 [0079.071] GetCurrentThreadId () returned 0x970 [0079.071] GetCurrentThreadId () returned 0x970 [0079.071] GetCurrentThreadId () returned 0x970 [0079.071] GetCurrentThreadId () returned 0x970 [0079.071] GetCurrentThreadId () returned 0x970 [0079.071] GetCurrentThreadId () returned 0x970 [0079.071] GetCurrentThreadId () returned 0x970 [0079.071] GetCurrentThreadId () returned 0x970 [0079.071] GetCurrentThreadId () returned 0x970 [0079.071] GetCurrentThreadId () returned 0x970 [0079.071] GetCurrentThreadId () returned 0x970 [0079.071] GetCurrentThreadId () returned 0x970 [0079.071] GetCurrentThreadId () returned 0x970 [0079.071] GetCurrentThreadId () returned 0x970 [0079.071] GetCurrentThreadId () returned 0x970 [0079.071] GetCurrentThreadId () returned 0x970 [0079.071] GetCurrentThreadId () returned 0x970 [0079.071] GetCurrentThreadId () returned 0x970 [0079.071] GetCurrentThreadId () returned 0x970 [0079.071] GetCurrentThreadId () returned 0x970 [0079.071] GetCurrentThreadId () returned 0x970 [0079.071] GetCurrentThreadId () returned 0x970 [0079.071] GetCurrentThreadId () returned 0x970 [0079.072] GetCurrentThreadId () returned 0x970 [0079.072] GetCurrentThreadId () returned 0x970 [0079.072] GetCurrentThreadId () returned 0x970 [0079.072] GetCurrentThreadId () returned 0x970 [0079.072] GetCurrentThreadId () returned 0x970 [0079.072] GetCurrentThreadId () returned 0x970 [0079.072] GetCurrentThreadId () returned 0x970 [0079.072] GetCurrentThreadId () returned 0x970 [0079.072] GetCurrentThreadId () returned 0x970 [0079.072] GetCurrentThreadId () returned 0x970 [0079.072] GetCurrentThreadId () returned 0x970 [0079.072] GetCurrentThreadId () returned 0x970 [0079.072] GetCurrentThreadId () returned 0x970 [0079.072] GetCurrentThreadId () returned 0x970 [0079.072] GetCurrentThreadId () returned 0x970 [0079.072] GetCurrentThreadId () returned 0x970 [0079.072] GetCurrentThreadId () returned 0x970 [0079.072] GetCurrentThreadId () returned 0x970 [0079.072] GetCurrentThreadId () returned 0x970 [0079.072] GetCurrentThreadId () returned 0x970 [0079.072] GetCurrentThreadId () returned 0x970 [0079.072] GetCurrentThreadId () returned 0x970 [0079.072] GetCurrentThreadId () returned 0x970 [0079.072] GetCurrentThreadId () returned 0x970 [0079.072] GetCurrentThreadId () returned 0x970 [0079.072] GetCurrentThreadId () returned 0x970 [0079.072] GetCurrentThreadId () returned 0x970 [0079.072] GetCurrentThreadId () returned 0x970 [0079.072] GetCurrentThreadId () returned 0x970 [0079.072] GetCurrentThreadId () returned 0x970 [0079.072] GetCurrentThreadId () returned 0x970 [0079.072] GetCurrentThreadId () returned 0x970 [0079.072] GetCurrentThreadId () returned 0x970 [0079.072] GetCurrentThreadId () returned 0x970 [0079.072] GetCurrentThreadId () returned 0x970 [0079.072] GetCurrentThreadId () returned 0x970 [0079.072] GetCurrentThreadId () returned 0x970 [0079.072] GetCurrentThreadId () returned 0x970 [0079.072] GetCurrentThreadId () returned 0x970 [0079.072] GetCurrentThreadId () returned 0x970 [0079.072] GetCurrentThreadId () returned 0x970 [0079.072] GetCurrentThreadId () returned 0x970 [0079.072] GetCurrentThreadId () returned 0x970 [0079.072] GetCurrentThreadId () returned 0x970 [0079.072] GetCurrentThreadId () returned 0x970 [0079.073] GetCurrentThreadId () returned 0x970 [0079.073] GetCurrentThreadId () returned 0x970 [0079.073] GetCurrentThreadId () returned 0x970 [0079.073] GetCurrentThreadId () returned 0x970 [0079.073] GetCurrentThreadId () returned 0x970 [0079.073] GetCurrentThreadId () returned 0x970 [0079.073] GetCurrentThreadId () returned 0x970 [0079.073] GetCurrentThreadId () returned 0x970 [0079.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0079.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0079.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b66710, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0079.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0079.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0079.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b66710, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0079.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0079.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0079.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b66740, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0079.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0079.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0079.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b66740, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0079.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0079.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0079.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b66770, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0079.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0079.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0079.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b66770, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0079.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0079.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0079.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b66770, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0079.073] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x1a, wMilliseconds=0x152)) [0079.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="U}xMTA/2sb,FrKGKte6pz9g+YVBh\"\\d6", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0079.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="U}xMTA/2sb,FrKGKte6pz9g+YVBh\"\\d6", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0079.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="U}xMTA/2sb,FrKGKte6pz9g+YVBh\"\\d6", cchWideChar=32, lpMultiByteStr=0x3b547e8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="U}xMTA/2sb,FrKGKte6pz9g+YVBh\"\\d6", lpUsedDefaultChar=0x0) returned 32 [0079.074] GetCurrentThreadId () returned 0x970 [0079.074] GetCurrentThreadId () returned 0x970 [0079.074] GetCurrentThreadId () returned 0x970 [0079.074] GetCurrentThreadId () returned 0x970 [0079.074] GetCurrentThreadId () returned 0x970 [0079.074] GetCurrentThreadId () returned 0x970 [0079.081] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0079.081] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0079.081] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3b44db8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0079.081] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0079.081] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAFaIe5b814thf6JhA76Nbqe7w83VaZJBlJj0lOvSwsRJPKOCyrPkRU4jCyp7vJmNrMq3XPDzJNuq6CqtZ+P4GlX2kYqaVIoCkiMiT3WO7x8zaZXlGQHAmz/DGfq0rvDO1bvCvEkYPw6zlcJww8dNE8uIfb7PBjhFp9KlbxzJ2BoUSLXpnZUED3EVl7JrPZ+wDWdA0dDKoaQwTJ/Mwe40hwq/I0Fu7Fsacw==") returned 232 [0079.081] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x1a, wMilliseconds=0x162)) [0079.081] GetCurrentThreadId () returned 0x970 [0079.081] GetCurrentThreadId () returned 0x970 [0079.081] GetCurrentThreadId () returned 0x970 [0079.081] GetCurrentThreadId () returned 0x970 [0079.082] GetCurrentThreadId () returned 0x970 [0079.082] GetCurrentThreadId () returned 0x970 [0079.082] GetCurrentThreadId () returned 0x970 [0079.082] GetCurrentThreadId () returned 0x970 [0079.082] GetCurrentThreadId () returned 0x970 [0079.082] GetCurrentThreadId () returned 0x970 [0079.082] GetCurrentThreadId () returned 0x970 [0079.082] GetCurrentThreadId () returned 0x970 [0079.082] GetCurrentThreadId () returned 0x970 [0079.082] GetCurrentThreadId () returned 0x970 [0079.082] GetCurrentThreadId () returned 0x970 [0079.082] GetCurrentThreadId () returned 0x970 [0079.082] GetCurrentThreadId () returned 0x970 [0079.082] GetCurrentThreadId () returned 0x970 [0079.082] GetCurrentThreadId () returned 0x970 [0079.082] GetCurrentThreadId () returned 0x970 [0079.082] GetCurrentThreadId () returned 0x970 [0079.082] GetCurrentThreadId () returned 0x970 [0079.082] GetCurrentThreadId () returned 0x970 [0079.082] GetCurrentThreadId () returned 0x970 [0079.082] GetCurrentThreadId () returned 0x970 [0079.082] GetCurrentThreadId () returned 0x970 [0079.082] GetCurrentThreadId () returned 0x970 [0079.082] GetCurrentThreadId () returned 0x970 [0079.082] GetCurrentThreadId () returned 0x970 [0079.082] GetCurrentThreadId () returned 0x970 [0079.082] GetCurrentThreadId () returned 0x970 [0079.082] GetCurrentThreadId () returned 0x970 [0079.082] GetCurrentThreadId () returned 0x970 [0079.082] GetCurrentThreadId () returned 0x970 [0079.082] GetCurrentThreadId () returned 0x970 [0079.082] GetCurrentThreadId () returned 0x970 [0079.082] GetCurrentThreadId () returned 0x970 [0079.082] GetCurrentThreadId () returned 0x970 [0079.082] GetCurrentThreadId () returned 0x970 [0079.082] GetCurrentThreadId () returned 0x970 [0079.082] GetCurrentThreadId () returned 0x970 [0079.082] GetCurrentThreadId () returned 0x970 [0079.082] GetCurrentThreadId () returned 0x970 [0079.082] GetCurrentThreadId () returned 0x970 [0079.082] GetCurrentThreadId () returned 0x970 [0079.082] GetCurrentThreadId () returned 0x970 [0079.082] GetCurrentThreadId () returned 0x970 [0079.082] GetCurrentThreadId () returned 0x970 [0079.082] GetCurrentThreadId () returned 0x970 [0079.083] GetCurrentThreadId () returned 0x970 [0079.083] GetCurrentThreadId () returned 0x970 [0079.083] GetCurrentThreadId () returned 0x970 [0079.083] GetCurrentThreadId () returned 0x970 [0079.083] GetCurrentThreadId () returned 0x970 [0079.083] GetCurrentThreadId () returned 0x970 [0079.083] GetCurrentThreadId () returned 0x970 [0079.083] GetCurrentThreadId () returned 0x970 [0079.083] GetCurrentThreadId () returned 0x970 [0079.083] GetCurrentThreadId () returned 0x970 [0079.083] GetCurrentThreadId () returned 0x970 [0079.083] GetCurrentThreadId () returned 0x970 [0079.083] GetCurrentThreadId () returned 0x970 [0079.083] GetCurrentThreadId () returned 0x970 [0079.083] GetCurrentThreadId () returned 0x970 [0079.083] GetCurrentThreadId () returned 0x970 [0079.083] GetCurrentThreadId () returned 0x970 [0079.083] GetCurrentThreadId () returned 0x970 [0079.083] GetCurrentThreadId () returned 0x970 [0079.083] GetCurrentThreadId () returned 0x970 [0079.083] GetCurrentThreadId () returned 0x970 [0079.083] GetCurrentThreadId () returned 0x970 [0079.083] GetCurrentThreadId () returned 0x970 [0079.083] GetCurrentThreadId () returned 0x970 [0079.083] GetCurrentThreadId () returned 0x970 [0079.083] GetCurrentThreadId () returned 0x970 [0079.083] GetCurrentThreadId () returned 0x970 [0079.083] GetCurrentThreadId () returned 0x970 [0079.083] GetCurrentThreadId () returned 0x970 [0079.083] GetCurrentThreadId () returned 0x970 [0079.083] GetCurrentThreadId () returned 0x970 [0079.083] GetCurrentThreadId () returned 0x970 [0079.083] GetCurrentThreadId () returned 0x970 [0079.083] GetCurrentThreadId () returned 0x970 [0079.083] GetCurrentThreadId () returned 0x970 [0079.083] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAFaIe5b814thf6JhA76Nbqe7w83VaZJBlJj0lOvSwsRJPKOCyrPkRU4jCyp7vJmNrMq3XPDzJNuq6CqtZ+P4GlX2kYqaVIoCkiMiT3WO7x8zaZXlGQHAmz/DGfq0rvDO1bvCvEkYPw6zlcJww8dNE8uIfb7PBjhFp9KlbxzJ2BoUSLXpnZUED3EVl7JrPZ+wDWdA0dDKoaQwTJ/Mwe40hwq/I0Fu7Fsacw==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0079.083] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAFaIe5b814thf6JhA76Nbqe7w83VaZJBlJj0lOvSwsRJPKOCyrPkRU4jCyp7vJmNrMq3XPDzJNuq6CqtZ+P4GlX2kYqaVIoCkiMiT3WO7x8zaZXlGQHAmz/DGfq0rvDO1bvCvEkYPw6zlcJww8dNE8uIfb7PBjhFp9KlbxzJ2BoUSLXpnZUED3EVl7JrPZ+wDWdA0dDKoaQwTJ/Mwe40hwq/I0Fu7Fsacw==", cchWideChar=245, lpMultiByteStr=0x3b4d08c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAFaIe5b814thf6JhA76Nbqe7w83VaZJBlJj0lOvSwsRJPKOCyrPkRU4jCyp7vJmNrMq3XPDzJNuq6CqtZ+P4GlX2kYqaVIoCkiMiT3WO7x8zaZXlGQHAmz/DGfq0rvDO1bvCvEkYPw6zlcJww8dNE8uIfb7PBjhFp9KlbxzJ2BoUSLXpnZUED3EVl7JrPZ+wDWdA0dDKoaQwTJ/Mwe40hwq/I0Fu7Fsacw==", lpUsedDefaultChar=0x0) returned 245 [0079.083] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0079.084] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0079.084] CloseHandle (hObject=0x158) returned 1 [0079.084] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif")) returned 1 [0079.085] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=19934803266) returned 1 [0079.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [AG00103_.GIF].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [ag00103_.gif].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0079.085] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0079.085] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0079.085] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0079.085] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0079.085] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0079.085] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0079.085] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0079.086] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0079.086] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0079.086] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0079.086] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0079.086] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0079.086] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0079.086] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0079.086] SetEndOfFile (hFile=0x158) returned 1 [0079.086] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0079.086] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0079.086] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0079.086] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0079.086] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0079.087] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0079.087] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k(w:Y,Y8lRzGs9b~-$jvL+*kpb~IoOuW%1fO", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0081.313] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="lO\"4a9\"7QKo?-5d^g>*kpb~IoOuW%1fO", cchWideChar=32, lpMultiByteStr=0x203ab34, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lO\"4a9\"7QKo?-5d^g>*kpb~IoOuW%1fO", lpUsedDefaultChar=0x0) returned 32 [0081.313] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0081.313] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0081.313] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xcd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099185.JPG", cAlternateFileName="")) returned 0x295098 [0081.313] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0081.313] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0081.313] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg")) returned 0x20 [0081.314] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg")) returned 0x20 [0081.314] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg")) returned 0x20 [0081.314] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg")) returned 0x20 [0081.314] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xcd2)) returned 1 [0081.314] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0081.314] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0081.314] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg")) returned 0x20 [0081.314] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg")) returned 0x20 [0081.314] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0081.314] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0081.314] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0081.315] SetEndOfFile (hFile=0x158) returned 1 [0081.315] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099185.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0081.315] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099185.JPG", cchWideChar=12, lpMultiByteStr=0x1fe430c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0099185.JPG", lpUsedDefaultChar=0x0) returned 12 [0081.315] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099185.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0081.315] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099185.JPG", cchWideChar=12, lpMultiByteStr=0x1fe358c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0099185.JPG", lpUsedDefaultChar=0x0) returned 12 [0081.315] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe358c, cbMultiByte=12, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="J0099185.JPGg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0081.316] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099185.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0081.316] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099185.JPG", cchWideChar=12, lpMultiByteStr=0x1fe430c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0099185.JPG", lpUsedDefaultChar=0x0) returned 12 [0081.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0081.316] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0081.316] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0xcd2 [0081.316] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0081.316] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0081.316] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0081.316] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099185.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0081.316] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099185.JPG", cchWideChar=12, lpMultiByteStr=0x1fe430c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0099185.JPG", lpUsedDefaultChar=0x0) returned 12 [0081.316] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099185.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0081.316] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099185.JPG", cchWideChar=12, lpMultiByteStr=0x1fe358c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0099185.JPG", lpUsedDefaultChar=0x0) returned 12 [0081.317] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe358c, cbMultiByte=12, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="J0099185.JPG85.JPGg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0081.317] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099185.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0081.317] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099185.JPG", cchWideChar=12, lpMultiByteStr=0x1fe430c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0099185.JPG", lpUsedDefaultChar=0x0) returned 12 [0081.317] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0081.318] CharToOemA (in: pSrc="J0099185.JPG", pDst=0x1fe358c | out: pDst="J0099185.JPG") returned 1 [0081.318] WriteFile (in: hFile=0x158, lpBuffer=0x1fe358c*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe358c*, lpNumberOfBytesWritten=0x18e048*=0xc, lpOverlapped=0x0) returned 1 [0081.318] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0081.318] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0081.318] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0081.318] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=20158139706) returned 1 [0081.318] ReadFile (in: hFile=0x11c, lpBuffer=0x3b953a0, nNumberOfBytesToRead=0xcd2, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b953a0*, lpNumberOfBytesRead=0x18dd7c*=0xcd2, lpOverlapped=0x0) returned 1 [0081.320] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0081.320] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=20158325116) returned 1 [0081.329] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b420*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b5b420*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0081.329] ReadFile (in: hFile=0x11c, lpBuffer=0x3b953a0, nNumberOfBytesToRead=0xcd2, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3b953a0*, lpNumberOfBytesRead=0x18de38*=0xcd2, lpOverlapped=0x0) returned 1 [0081.329] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x47 [0081.329] WriteFile (in: hFile=0x158, lpBuffer=0x3b97800*, nNumberOfBytesToWrite=0xcd2, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3b97800*, lpNumberOfBytesWritten=0x18de10*=0xcd2, lpOverlapped=0x0) returned 1 [0081.329] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0xd19 [0081.329] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0081.329] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0081.329] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0081.329] SetFilePointer (in: hFile=0x158, lDistanceToMove=12, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2a [0081.330] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0xd23 [0081.330] CloseHandle (hObject=0x11c) returned 1 [0081.330] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xd23 [0081.330] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xd23 [0081.330] SetFilePointer (in: hFile=0x158, lDistanceToMove=3363, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xd23 [0081.330] SetFilePointer (in: hFile=0x158, lDistanceToMove=3363, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0xd23 [0081.330] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xd23 [0081.330] SetFilePointer (in: hFile=0x158, lDistanceToMove=3363, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0xd23 [0081.330] SetEndOfFile (hFile=0x158) returned 1 [0081.330] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xd23 [0081.330] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xd23 [0081.330] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099185.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0081.330] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099185.JPG", cchWideChar=12, lpMultiByteStr=0x1fe430c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0099185.JPG", lpUsedDefaultChar=0x0) returned 12 [0081.330] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099185.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0081.331] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099185.JPG", cchWideChar=12, lpMultiByteStr=0x1fe43ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0099185.JPG", lpUsedDefaultChar=0x0) returned 12 [0081.331] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe43ac, cbMultiByte=12, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="J0099185.JPGꞗ@涤(\x18믉`믑`") returned 12 [0081.331] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099185.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0081.331] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099185.JPG", cchWideChar=12, lpMultiByteStr=0x1fe430c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0099185.JPG", lpUsedDefaultChar=0x0) returned 12 [0081.331] WriteFile (in: hFile=0x158, lpBuffer=0x3b78e78*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3b78e78*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0081.331] CharToOemA (in: pSrc="J0099185.JPG", pDst=0x1fe43ac | out: pDst="J0099185.JPG") returned 1 [0081.331] WriteFile (in: hFile=0x158, lpBuffer=0x1fe43ac*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe43ac*, lpNumberOfBytesWritten=0x18efcc*=0xc, lpOverlapped=0x0) returned 1 [0081.331] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b3b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x3b5b3b0*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0081.331] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0081.331] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0081.331] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xd68 [0081.331] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xd68 [0081.331] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0081.331] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0081.331] DeleteFileW (lpFileName="") returned 0 [0081.332] GetLastError () returned 0x3 [0081.332] GetFileAttributesW (lpFileName="") returned 0xffffffff [0081.332] SetLastError (dwErrCode=0x3) [0081.332] FlushFileBuffers (hFile=0x158) returned 1 [0081.334] GetCurrentThreadId () returned 0x970 [0081.334] GetCurrentThreadId () returned 0x970 [0081.334] GetCurrentThreadId () returned 0x970 [0081.334] GetCurrentThreadId () returned 0x970 [0081.334] GetCurrentThreadId () returned 0x970 [0081.335] GetCurrentThreadId () returned 0x970 [0081.335] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xe1f [0081.335] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xe1f [0081.335] SetFilePointer (in: hFile=0x158, lDistanceToMove=3615, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xe1f [0081.335] CloseHandle (hObject=0x158) returned 1 [0081.335] GetCurrentThreadId () returned 0x970 [0081.335] GetCurrentThreadId () returned 0x970 [0081.335] GetCurrentThreadId () returned 0x970 [0081.335] GetCurrentThreadId () returned 0x970 [0081.335] GetCurrentThreadId () returned 0x970 [0081.335] GetCurrentThreadId () returned 0x970 [0081.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [J0099185.JPG].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [j0099185.jpg].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0081.335] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe1f [0081.335] SetFilePointer (in: hFile=0x158, lDistanceToMove=3487, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd9f [0081.335] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0081.335] GetFileType (hFile=0x158) returned 0x1 [0081.335] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x1c, wMilliseconds=0x258)) [0081.335] GetCurrentThreadId () returned 0x970 [0081.335] GetCurrentThreadId () returned 0x970 [0081.335] GetCurrentThreadId () returned 0x970 [0081.335] GetCurrentThreadId () returned 0x970 [0081.335] GetCurrentThreadId () returned 0x970 [0081.336] GetCurrentThreadId () returned 0x970 [0081.336] GetCurrentThreadId () returned 0x970 [0081.336] GetCurrentThreadId () returned 0x970 [0081.336] GetCurrentThreadId () returned 0x970 [0081.336] GetCurrentThreadId () returned 0x970 [0081.336] GetCurrentThreadId () returned 0x970 [0081.336] GetCurrentThreadId () returned 0x970 [0081.336] GetCurrentThreadId () returned 0x970 [0081.336] GetCurrentThreadId () returned 0x970 [0081.336] GetCurrentThreadId () returned 0x970 [0081.336] GetCurrentThreadId () returned 0x970 [0081.336] GetCurrentThreadId () returned 0x970 [0081.336] GetCurrentThreadId () returned 0x970 [0081.336] GetCurrentThreadId () returned 0x970 [0081.336] GetCurrentThreadId () returned 0x970 [0081.336] GetCurrentThreadId () returned 0x970 [0081.336] GetCurrentThreadId () returned 0x970 [0081.336] GetCurrentThreadId () returned 0x970 [0081.336] GetCurrentThreadId () returned 0x970 [0081.336] GetCurrentThreadId () returned 0x970 [0081.336] GetCurrentThreadId () returned 0x970 [0081.336] GetCurrentThreadId () returned 0x970 [0081.336] GetCurrentThreadId () returned 0x970 [0081.336] GetCurrentThreadId () returned 0x970 [0081.336] GetCurrentThreadId () returned 0x970 [0081.336] GetCurrentThreadId () returned 0x970 [0081.336] GetCurrentThreadId () returned 0x970 [0081.336] GetCurrentThreadId () returned 0x970 [0081.336] GetCurrentThreadId () returned 0x970 [0081.336] GetCurrentThreadId () returned 0x970 [0081.336] GetCurrentThreadId () returned 0x970 [0081.336] GetCurrentThreadId () returned 0x970 [0081.337] GetCurrentThreadId () returned 0x970 [0081.337] GetCurrentThreadId () returned 0x970 [0081.337] GetCurrentThreadId () returned 0x970 [0081.337] GetCurrentThreadId () returned 0x970 [0081.337] GetCurrentThreadId () returned 0x970 [0081.337] GetCurrentThreadId () returned 0x970 [0081.337] GetCurrentThreadId () returned 0x970 [0081.337] GetCurrentThreadId () returned 0x970 [0081.337] GetCurrentThreadId () returned 0x970 [0081.337] GetCurrentThreadId () returned 0x970 [0081.337] GetCurrentThreadId () returned 0x970 [0081.337] GetCurrentThreadId () returned 0x970 [0081.337] GetCurrentThreadId () returned 0x970 [0081.337] GetCurrentThreadId () returned 0x970 [0081.337] GetCurrentThreadId () returned 0x970 [0081.337] GetCurrentThreadId () returned 0x970 [0081.337] GetCurrentThreadId () returned 0x970 [0081.337] GetCurrentThreadId () returned 0x970 [0081.337] GetCurrentThreadId () returned 0x970 [0081.337] GetCurrentThreadId () returned 0x970 [0081.337] GetCurrentThreadId () returned 0x970 [0081.337] GetCurrentThreadId () returned 0x970 [0081.337] GetCurrentThreadId () returned 0x970 [0081.337] GetCurrentThreadId () returned 0x970 [0081.337] GetCurrentThreadId () returned 0x970 [0081.337] GetCurrentThreadId () returned 0x970 [0081.337] GetCurrentThreadId () returned 0x970 [0081.337] GetCurrentThreadId () returned 0x970 [0081.337] GetCurrentThreadId () returned 0x970 [0081.337] GetCurrentThreadId () returned 0x970 [0081.337] GetCurrentThreadId () returned 0x970 [0081.337] GetCurrentThreadId () returned 0x970 [0081.337] GetCurrentThreadId () returned 0x970 [0081.338] GetCurrentThreadId () returned 0x970 [0081.338] GetCurrentThreadId () returned 0x970 [0081.338] GetCurrentThreadId () returned 0x970 [0081.338] GetCurrentThreadId () returned 0x970 [0081.338] GetCurrentThreadId () returned 0x970 [0081.338] GetCurrentThreadId () returned 0x970 [0081.338] GetCurrentThreadId () returned 0x970 [0081.338] GetCurrentThreadId () returned 0x970 [0081.338] GetCurrentThreadId () returned 0x970 [0081.338] GetCurrentThreadId () returned 0x970 [0081.338] GetCurrentThreadId () returned 0x970 [0081.338] GetCurrentThreadId () returned 0x970 [0081.338] GetCurrentThreadId () returned 0x970 [0081.338] GetCurrentThreadId () returned 0x970 [0081.338] GetCurrentThreadId () returned 0x970 [0081.338] GetCurrentThreadId () returned 0x970 [0081.338] GetCurrentThreadId () returned 0x970 [0081.338] GetCurrentThreadId () returned 0x970 [0081.338] GetCurrentThreadId () returned 0x970 [0081.338] GetCurrentThreadId () returned 0x970 [0081.338] GetCurrentThreadId () returned 0x970 [0081.338] GetCurrentThreadId () returned 0x970 [0081.338] GetCurrentThreadId () returned 0x970 [0081.338] GetCurrentThreadId () returned 0x970 [0081.338] GetCurrentThreadId () returned 0x970 [0081.338] GetCurrentThreadId () returned 0x970 [0081.338] GetCurrentThreadId () returned 0x970 [0081.338] GetCurrentThreadId () returned 0x970 [0081.338] GetCurrentThreadId () returned 0x970 [0081.338] GetCurrentThreadId () returned 0x970 [0081.338] GetCurrentThreadId () returned 0x970 [0081.338] GetCurrentThreadId () returned 0x970 [0081.338] GetCurrentThreadId () returned 0x970 [0081.338] GetCurrentThreadId () returned 0x970 [0081.338] GetCurrentThreadId () returned 0x970 [0081.338] GetCurrentThreadId () returned 0x970 [0081.338] GetCurrentThreadId () returned 0x970 [0081.338] GetCurrentThreadId () returned 0x970 [0081.338] GetCurrentThreadId () returned 0x970 [0081.338] GetCurrentThreadId () returned 0x970 [0081.338] GetCurrentThreadId () returned 0x970 [0081.338] GetCurrentThreadId () returned 0x970 [0081.339] GetCurrentThreadId () returned 0x970 [0081.339] GetCurrentThreadId () returned 0x970 [0081.339] GetCurrentThreadId () returned 0x970 [0081.339] GetCurrentThreadId () returned 0x970 [0081.339] GetCurrentThreadId () returned 0x970 [0081.339] GetCurrentThreadId () returned 0x970 [0081.339] GetCurrentThreadId () returned 0x970 [0081.339] GetCurrentThreadId () returned 0x970 [0081.339] GetCurrentThreadId () returned 0x970 [0081.339] GetCurrentThreadId () returned 0x970 [0081.339] GetCurrentThreadId () returned 0x970 [0081.339] GetCurrentThreadId () returned 0x970 [0081.339] GetCurrentThreadId () returned 0x970 [0081.339] GetCurrentThreadId () returned 0x970 [0081.339] GetCurrentThreadId () returned 0x970 [0081.339] GetCurrentThreadId () returned 0x970 [0081.339] GetCurrentThreadId () returned 0x970 [0081.339] GetCurrentThreadId () returned 0x970 [0081.339] GetCurrentThreadId () returned 0x970 [0081.339] GetCurrentThreadId () returned 0x970 [0081.339] GetCurrentThreadId () returned 0x970 [0081.339] GetCurrentThreadId () returned 0x970 [0081.339] GetCurrentThreadId () returned 0x970 [0081.339] GetCurrentThreadId () returned 0x970 [0081.339] GetCurrentThreadId () returned 0x970 [0081.339] GetCurrentThreadId () returned 0x970 [0081.339] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0081.339] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0081.339] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5c4f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0081.339] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0081.339] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0081.339] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5c4f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0081.339] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0081.339] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0081.339] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b530, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0081.339] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0081.339] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0081.339] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b530, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0081.339] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0081.340] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0081.340] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5c550, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0081.340] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0081.340] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0081.340] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5c550, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0081.340] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0081.340] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0081.340] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5c550, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0081.340] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x1c, wMilliseconds=0x268)) [0081.340] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="lO\"4a9\"7QKo?-5d^g>*kpb~IoOuW%1fO", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0081.340] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="lO\"4a9\"7QKo?-5d^g>*kpb~IoOuW%1fO", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0081.340] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="lO\"4a9\"7QKo?-5d^g>*kpb~IoOuW%1fO", cchWideChar=32, lpMultiByteStr=0x3b55088, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lO\"4a9\"7QKo?-5d^g>*kpb~IoOuW%1fO", lpUsedDefaultChar=0x0) returned 32 [0081.340] GetCurrentThreadId () returned 0x970 [0081.340] GetCurrentThreadId () returned 0x970 [0081.340] GetCurrentThreadId () returned 0x970 [0081.340] GetCurrentThreadId () returned 0x970 [0081.340] GetCurrentThreadId () returned 0x970 [0081.340] GetCurrentThreadId () returned 0x970 [0081.348] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0081.348] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0081.348] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3b644c8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0081.348] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0081.348] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAG1+9rRwFsbFwqIlL996fGgoT8srkEIyl+CfcksXnoCBivoymyoV2K5BnWwEsiH3djQhoTALzIwDJKEJEVwUmb0Vdb8FxFQRMcsF03OC6TmmX+K4f7cQZWiToEt+51ZiCI/A2wTtJ/LXaDdjyW3KbZKs/KFcfUQHD2Sre8X1jmZrUVoJNsF6rriFNrMPhKRoCZSs1ewNrKWRN48Eo5Gmu/GxHV5G8rB9jg==") returned 232 [0081.348] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x1c, wMilliseconds=0x268)) [0081.348] GetCurrentThreadId () returned 0x970 [0081.348] GetCurrentThreadId () returned 0x970 [0081.348] GetCurrentThreadId () returned 0x970 [0081.348] GetCurrentThreadId () returned 0x970 [0081.348] GetCurrentThreadId () returned 0x970 [0081.348] GetCurrentThreadId () returned 0x970 [0081.348] GetCurrentThreadId () returned 0x970 [0081.348] GetCurrentThreadId () returned 0x970 [0081.348] GetCurrentThreadId () returned 0x970 [0081.348] GetCurrentThreadId () returned 0x970 [0081.348] GetCurrentThreadId () returned 0x970 [0081.348] GetCurrentThreadId () returned 0x970 [0081.348] GetCurrentThreadId () returned 0x970 [0081.348] GetCurrentThreadId () returned 0x970 [0081.348] GetCurrentThreadId () returned 0x970 [0081.348] GetCurrentThreadId () returned 0x970 [0081.348] GetCurrentThreadId () returned 0x970 [0081.348] GetCurrentThreadId () returned 0x970 [0081.348] GetCurrentThreadId () returned 0x970 [0081.348] GetCurrentThreadId () returned 0x970 [0081.348] GetCurrentThreadId () returned 0x970 [0081.348] GetCurrentThreadId () returned 0x970 [0081.348] GetCurrentThreadId () returned 0x970 [0081.348] GetCurrentThreadId () returned 0x970 [0081.348] GetCurrentThreadId () returned 0x970 [0081.348] GetCurrentThreadId () returned 0x970 [0081.348] GetCurrentThreadId () returned 0x970 [0081.348] GetCurrentThreadId () returned 0x970 [0081.348] GetCurrentThreadId () returned 0x970 [0081.348] GetCurrentThreadId () returned 0x970 [0081.348] GetCurrentThreadId () returned 0x970 [0081.348] GetCurrentThreadId () returned 0x970 [0081.348] GetCurrentThreadId () returned 0x970 [0081.348] GetCurrentThreadId () returned 0x970 [0081.348] GetCurrentThreadId () returned 0x970 [0081.349] GetCurrentThreadId () returned 0x970 [0081.349] GetCurrentThreadId () returned 0x970 [0081.349] GetCurrentThreadId () returned 0x970 [0081.349] GetCurrentThreadId () returned 0x970 [0081.349] GetCurrentThreadId () returned 0x970 [0081.349] GetCurrentThreadId () returned 0x970 [0081.349] GetCurrentThreadId () returned 0x970 [0081.349] GetCurrentThreadId () returned 0x970 [0081.349] GetCurrentThreadId () returned 0x970 [0081.349] GetCurrentThreadId () returned 0x970 [0081.349] GetCurrentThreadId () returned 0x970 [0081.349] GetCurrentThreadId () returned 0x970 [0081.349] GetCurrentThreadId () returned 0x970 [0081.349] GetCurrentThreadId () returned 0x970 [0081.349] GetCurrentThreadId () returned 0x970 [0081.349] GetCurrentThreadId () returned 0x970 [0081.349] GetCurrentThreadId () returned 0x970 [0081.349] GetCurrentThreadId () returned 0x970 [0081.349] GetCurrentThreadId () returned 0x970 [0081.349] GetCurrentThreadId () returned 0x970 [0081.349] GetCurrentThreadId () returned 0x970 [0081.349] GetCurrentThreadId () returned 0x970 [0081.349] GetCurrentThreadId () returned 0x970 [0081.349] GetCurrentThreadId () returned 0x970 [0081.349] GetCurrentThreadId () returned 0x970 [0081.349] GetCurrentThreadId () returned 0x970 [0081.349] GetCurrentThreadId () returned 0x970 [0081.349] GetCurrentThreadId () returned 0x970 [0081.349] GetCurrentThreadId () returned 0x970 [0081.349] GetCurrentThreadId () returned 0x970 [0081.349] GetCurrentThreadId () returned 0x970 [0081.349] GetCurrentThreadId () returned 0x970 [0081.349] GetCurrentThreadId () returned 0x970 [0081.349] GetCurrentThreadId () returned 0x970 [0081.349] GetCurrentThreadId () returned 0x970 [0081.349] GetCurrentThreadId () returned 0x970 [0081.349] GetCurrentThreadId () returned 0x970 [0081.349] GetCurrentThreadId () returned 0x970 [0081.349] GetCurrentThreadId () returned 0x970 [0081.349] GetCurrentThreadId () returned 0x970 [0081.349] GetCurrentThreadId () returned 0x970 [0081.349] GetCurrentThreadId () returned 0x970 [0081.349] GetCurrentThreadId () returned 0x970 [0081.349] GetCurrentThreadId () returned 0x970 [0081.349] GetCurrentThreadId () returned 0x970 [0081.350] GetCurrentThreadId () returned 0x970 [0081.350] GetCurrentThreadId () returned 0x970 [0081.350] GetCurrentThreadId () returned 0x970 [0081.350] GetCurrentThreadId () returned 0x970 [0081.350] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAG1+9rRwFsbFwqIlL996fGgoT8srkEIyl+CfcksXnoCBivoymyoV2K5BnWwEsiH3djQhoTALzIwDJKEJEVwUmb0Vdb8FxFQRMcsF03OC6TmmX+K4f7cQZWiToEt+51ZiCI/A2wTtJ/LXaDdjyW3KbZKs/KFcfUQHD2Sre8X1jmZrUVoJNsF6rriFNrMPhKRoCZSs1ewNrKWRN48Eo5Gmu/GxHV5G8rB9jg==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0081.350] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAG1+9rRwFsbFwqIlL996fGgoT8srkEIyl+CfcksXnoCBivoymyoV2K5BnWwEsiH3djQhoTALzIwDJKEJEVwUmb0Vdb8FxFQRMcsF03OC6TmmX+K4f7cQZWiToEt+51ZiCI/A2wTtJ/LXaDdjyW3KbZKs/KFcfUQHD2Sre8X1jmZrUVoJNsF6rriFNrMPhKRoCZSs1ewNrKWRN48Eo5Gmu/GxHV5G8rB9jg==", cchWideChar=245, lpMultiByteStr=0x3b4d08c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAG1+9rRwFsbFwqIlL996fGgoT8srkEIyl+CfcksXnoCBivoymyoV2K5BnWwEsiH3djQhoTALzIwDJKEJEVwUmb0Vdb8FxFQRMcsF03OC6TmmX+K4f7cQZWiToEt+51ZiCI/A2wTtJ/LXaDdjyW3KbZKs/KFcfUQHD2Sre8X1jmZrUVoJNsF6rriFNrMPhKRoCZSs1ewNrKWRN48Eo5Gmu/GxHV5G8rB9jg==", lpUsedDefaultChar=0x0) returned 245 [0081.350] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0081.350] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0081.350] CloseHandle (hObject=0x158) returned 1 [0081.350] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg")) returned 1 [0081.351] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=20161538577) returned 1 [0081.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [J0099186.JPG].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [j0099186.jpg].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0081.353] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0081.353] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0081.353] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0081.353] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0081.353] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0081.353] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0081.353] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0081.353] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0081.353] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0081.353] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0081.354] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0081.354] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0081.354] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0081.354] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0081.354] SetEndOfFile (hFile=0x158) returned 1 [0081.354] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0081.354] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0081.354] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0081.354] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0081.354] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0081.355] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0081.355] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="}gU8}F#pJ{M0G#C0\\=oEzDTE2{E~Ix00", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0081.355] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="}gU8}F#pJ{M0G#C0\\=oEzDTE2{E~Ix00", cchWideChar=32, lpMultiByteStr=0x203ab6c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="}gU8}F#pJ{M0G#C0\\=oEzDTE2{E~Ix00", lpUsedDefaultChar=0x0) returned 32 [0081.355] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0081.355] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0081.355] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x183cef00, ftCreationTime.dwHighDateTime=0x1bdbf74, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x183cef00, ftLastWriteTime.dwHighDateTime=0x1bdbf74, nFileSizeHigh=0x0, nFileSizeLow=0x4162, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099186.JPG", cAlternateFileName="")) returned 0x295098 [0081.355] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0081.355] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0081.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg")) returned 0x20 [0081.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg")) returned 0x20 [0081.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg")) returned 0x20 [0081.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg")) returned 0x20 [0081.356] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x183cef00, ftCreationTime.dwHighDateTime=0x1bdbf74, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x183cef00, ftLastWriteTime.dwHighDateTime=0x1bdbf74, nFileSizeHigh=0x0, nFileSizeLow=0x4162)) returned 1 [0081.357] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0081.357] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0081.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg")) returned 0x20 [0081.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg")) returned 0x20 [0081.357] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0081.357] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0081.357] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0081.357] SetEndOfFile (hFile=0x158) returned 1 [0081.358] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099186.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0081.358] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099186.JPG", cchWideChar=12, lpMultiByteStr=0x1fe3c4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0099186.JPG", lpUsedDefaultChar=0x0) returned 12 [0081.358] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099186.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0081.358] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099186.JPG", cchWideChar=12, lpMultiByteStr=0x1fe37cc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0099186.JPG", lpUsedDefaultChar=0x0) returned 12 [0081.358] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe37cc, cbMultiByte=12, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="J0099186.JPGg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0081.358] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099186.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0081.358] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099186.JPG", cchWideChar=12, lpMultiByteStr=0x1fe3c4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0099186.JPG", lpUsedDefaultChar=0x0) returned 12 [0081.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0081.358] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0081.358] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x4162 [0081.359] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0081.359] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0081.359] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0081.359] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099186.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0081.359] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099186.JPG", cchWideChar=12, lpMultiByteStr=0x1fe3c4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0099186.JPG", lpUsedDefaultChar=0x0) returned 12 [0081.359] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099186.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0081.359] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099186.JPG", cchWideChar=12, lpMultiByteStr=0x1fe37cc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0099186.JPG", lpUsedDefaultChar=0x0) returned 12 [0081.359] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe37cc, cbMultiByte=12, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="J0099186.JPG86.JPGg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0081.359] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099186.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0081.359] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099186.JPG", cchWideChar=12, lpMultiByteStr=0x1fe3c4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0099186.JPG", lpUsedDefaultChar=0x0) returned 12 [0081.359] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0081.360] CharToOemA (in: pSrc="J0099186.JPG", pDst=0x1fe37cc | out: pDst="J0099186.JPG") returned 1 [0081.360] WriteFile (in: hFile=0x158, lpBuffer=0x1fe37cc*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe37cc*, lpNumberOfBytesWritten=0x18e048*=0xc, lpOverlapped=0x0) returned 1 [0081.360] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0081.360] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0081.360] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0081.360] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=20162373423) returned 1 [0081.360] ReadFile (in: hFile=0x11c, lpBuffer=0x3b953a0, nNumberOfBytesToRead=0x4162, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b953a0*, lpNumberOfBytesRead=0x18dd7c*=0x4162, lpOverlapped=0x0) returned 1 [0081.362] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0081.362] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=20162560588) returned 1 [0081.372] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b3d8*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b5b3d8*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0081.372] ReadFile (in: hFile=0x11c, lpBuffer=0x3b953a0, nNumberOfBytesToRead=0x4162, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3b953a0*, lpNumberOfBytesRead=0x18de38*=0x4162, lpOverlapped=0x0) returned 1 [0081.373] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x47 [0081.373] WriteFile (in: hFile=0x158, lpBuffer=0x3b9ad00*, nNumberOfBytesToWrite=0x4162, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3b9ad00*, lpNumberOfBytesWritten=0x18de10*=0x4162, lpOverlapped=0x0) returned 1 [0081.373] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x41a9 [0081.373] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0081.373] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0081.374] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0081.374] SetFilePointer (in: hFile=0x158, lDistanceToMove=12, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2a [0081.374] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x41b3 [0081.374] CloseHandle (hObject=0x11c) returned 1 [0081.374] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x41b3 [0081.374] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x41b3 [0081.374] SetFilePointer (in: hFile=0x158, lDistanceToMove=16819, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x41b3 [0081.374] SetFilePointer (in: hFile=0x158, lDistanceToMove=16819, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x41b3 [0081.374] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x41b3 [0081.374] SetFilePointer (in: hFile=0x158, lDistanceToMove=16819, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x41b3 [0081.374] SetEndOfFile (hFile=0x158) returned 1 [0081.375] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x41b3 [0081.375] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x41b3 [0081.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099186.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0081.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099186.JPG", cchWideChar=12, lpMultiByteStr=0x1fe3c4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0099186.JPG", lpUsedDefaultChar=0x0) returned 12 [0081.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099186.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0081.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099186.JPG", cchWideChar=12, lpMultiByteStr=0x1fe3a2c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0099186.JPG", lpUsedDefaultChar=0x0) returned 12 [0081.375] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe3a2c, cbMultiByte=12, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="J0099186.JPGꞗ@涤(\x18믉`믑`") returned 12 [0081.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099186.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0081.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099186.JPG", cchWideChar=12, lpMultiByteStr=0x1fe3c4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0099186.JPG", lpUsedDefaultChar=0x0) returned 12 [0081.375] WriteFile (in: hFile=0x158, lpBuffer=0x3b78e78*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3b78e78*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0081.375] CharToOemA (in: pSrc="J0099186.JPG", pDst=0x1fe3a2c | out: pDst="J0099186.JPG") returned 1 [0081.375] WriteFile (in: hFile=0x158, lpBuffer=0x1fe3a2c*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe3a2c*, lpNumberOfBytesWritten=0x18efcc*=0xc, lpOverlapped=0x0) returned 1 [0081.375] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b470*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x3b5b470*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0081.375] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0081.375] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0081.375] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x41f8 [0081.376] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x41f8 [0081.376] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0081.376] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0081.376] DeleteFileW (lpFileName="") returned 0 [0081.376] GetLastError () returned 0x3 [0081.376] GetFileAttributesW (lpFileName="") returned 0xffffffff [0081.376] SetLastError (dwErrCode=0x3) [0081.376] FlushFileBuffers (hFile=0x158) returned 1 [0081.379] GetCurrentThreadId () returned 0x970 [0081.379] GetCurrentThreadId () returned 0x970 [0081.379] GetCurrentThreadId () returned 0x970 [0081.379] GetCurrentThreadId () returned 0x970 [0081.379] GetCurrentThreadId () returned 0x970 [0081.379] GetCurrentThreadId () returned 0x970 [0081.379] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x42af [0081.379] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x42af [0081.379] SetFilePointer (in: hFile=0x158, lDistanceToMove=17071, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x42af [0081.379] CloseHandle (hObject=0x158) returned 1 [0081.380] GetCurrentThreadId () returned 0x970 [0081.380] GetCurrentThreadId () returned 0x970 [0081.380] GetCurrentThreadId () returned 0x970 [0081.380] GetCurrentThreadId () returned 0x970 [0081.380] GetCurrentThreadId () returned 0x970 [0081.380] GetCurrentThreadId () returned 0x970 [0081.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [J0099186.JPG].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [j0099186.jpg].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0081.380] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x42af [0081.380] SetFilePointer (in: hFile=0x158, lDistanceToMove=16943, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x422f [0081.380] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0081.380] GetFileType (hFile=0x158) returned 0x1 [0081.380] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x1c, wMilliseconds=0x287)) [0081.380] GetCurrentThreadId () returned 0x970 [0081.380] GetCurrentThreadId () returned 0x970 [0081.381] GetCurrentThreadId () returned 0x970 [0081.381] GetCurrentThreadId () returned 0x970 [0081.381] GetCurrentThreadId () returned 0x970 [0081.381] GetCurrentThreadId () returned 0x970 [0081.381] GetCurrentThreadId () returned 0x970 [0081.381] GetCurrentThreadId () returned 0x970 [0081.381] GetCurrentThreadId () returned 0x970 [0081.381] GetCurrentThreadId () returned 0x970 [0081.381] GetCurrentThreadId () returned 0x970 [0081.381] GetCurrentThreadId () returned 0x970 [0081.381] GetCurrentThreadId () returned 0x970 [0081.381] GetCurrentThreadId () returned 0x970 [0081.381] GetCurrentThreadId () returned 0x970 [0081.381] GetCurrentThreadId () returned 0x970 [0081.381] GetCurrentThreadId () returned 0x970 [0081.381] GetCurrentThreadId () returned 0x970 [0081.381] GetCurrentThreadId () returned 0x970 [0081.381] GetCurrentThreadId () returned 0x970 [0081.381] GetCurrentThreadId () returned 0x970 [0081.381] GetCurrentThreadId () returned 0x970 [0081.381] GetCurrentThreadId () returned 0x970 [0081.381] GetCurrentThreadId () returned 0x970 [0081.381] GetCurrentThreadId () returned 0x970 [0081.381] GetCurrentThreadId () returned 0x970 [0081.381] GetCurrentThreadId () returned 0x970 [0081.381] GetCurrentThreadId () returned 0x970 [0081.381] GetCurrentThreadId () returned 0x970 [0081.381] GetCurrentThreadId () returned 0x970 [0081.381] GetCurrentThreadId () returned 0x970 [0081.381] GetCurrentThreadId () returned 0x970 [0081.381] GetCurrentThreadId () returned 0x970 [0081.381] GetCurrentThreadId () returned 0x970 [0081.381] GetCurrentThreadId () returned 0x970 [0081.381] GetCurrentThreadId () returned 0x970 [0081.381] GetCurrentThreadId () returned 0x970 [0081.381] GetCurrentThreadId () returned 0x970 [0081.381] GetCurrentThreadId () returned 0x970 [0081.381] GetCurrentThreadId () returned 0x970 [0081.381] GetCurrentThreadId () returned 0x970 [0081.381] GetCurrentThreadId () returned 0x970 [0081.381] GetCurrentThreadId () returned 0x970 [0081.381] GetCurrentThreadId () returned 0x970 [0081.381] GetCurrentThreadId () returned 0x970 [0081.381] GetCurrentThreadId () returned 0x970 [0081.381] GetCurrentThreadId () returned 0x970 [0081.382] GetCurrentThreadId () returned 0x970 [0081.382] GetCurrentThreadId () returned 0x970 [0081.382] GetCurrentThreadId () returned 0x970 [0081.382] GetCurrentThreadId () returned 0x970 [0081.382] GetCurrentThreadId () returned 0x970 [0081.382] GetCurrentThreadId () returned 0x970 [0081.382] GetCurrentThreadId () returned 0x970 [0081.382] GetCurrentThreadId () returned 0x970 [0081.382] GetCurrentThreadId () returned 0x970 [0081.382] GetCurrentThreadId () returned 0x970 [0081.382] GetCurrentThreadId () returned 0x970 [0081.382] GetCurrentThreadId () returned 0x970 [0081.382] GetCurrentThreadId () returned 0x970 [0081.382] GetCurrentThreadId () returned 0x970 [0081.382] GetCurrentThreadId () returned 0x970 [0081.382] GetCurrentThreadId () returned 0x970 [0081.382] GetCurrentThreadId () returned 0x970 [0081.382] GetCurrentThreadId () returned 0x970 [0081.382] GetCurrentThreadId () returned 0x970 [0081.382] GetCurrentThreadId () returned 0x970 [0081.382] GetCurrentThreadId () returned 0x970 [0081.382] GetCurrentThreadId () returned 0x970 [0081.382] GetCurrentThreadId () returned 0x970 [0081.382] GetCurrentThreadId () returned 0x970 [0081.382] GetCurrentThreadId () returned 0x970 [0081.382] GetCurrentThreadId () returned 0x970 [0081.382] GetCurrentThreadId () returned 0x970 [0081.382] GetCurrentThreadId () returned 0x970 [0081.382] GetCurrentThreadId () returned 0x970 [0081.382] GetCurrentThreadId () returned 0x970 [0081.382] GetCurrentThreadId () returned 0x970 [0081.382] GetCurrentThreadId () returned 0x970 [0081.382] GetCurrentThreadId () returned 0x970 [0081.382] GetCurrentThreadId () returned 0x970 [0081.382] GetCurrentThreadId () returned 0x970 [0081.382] GetCurrentThreadId () returned 0x970 [0081.382] GetCurrentThreadId () returned 0x970 [0081.382] GetCurrentThreadId () returned 0x970 [0081.382] GetCurrentThreadId () returned 0x970 [0081.382] GetCurrentThreadId () returned 0x970 [0081.382] GetCurrentThreadId () returned 0x970 [0081.382] GetCurrentThreadId () returned 0x970 [0081.382] GetCurrentThreadId () returned 0x970 [0081.382] GetCurrentThreadId () returned 0x970 [0081.382] GetCurrentThreadId () returned 0x970 [0081.383] GetCurrentThreadId () returned 0x970 [0081.383] GetCurrentThreadId () returned 0x970 [0081.383] GetCurrentThreadId () returned 0x970 [0081.383] GetCurrentThreadId () returned 0x970 [0081.383] GetCurrentThreadId () returned 0x970 [0081.383] GetCurrentThreadId () returned 0x970 [0081.383] GetCurrentThreadId () returned 0x970 [0081.383] GetCurrentThreadId () returned 0x970 [0081.383] GetCurrentThreadId () returned 0x970 [0081.383] GetCurrentThreadId () returned 0x970 [0081.383] GetCurrentThreadId () returned 0x970 [0081.383] GetCurrentThreadId () returned 0x970 [0081.383] GetCurrentThreadId () returned 0x970 [0081.383] GetCurrentThreadId () returned 0x970 [0081.383] GetCurrentThreadId () returned 0x970 [0081.383] GetCurrentThreadId () returned 0x970 [0081.383] GetCurrentThreadId () returned 0x970 [0081.383] GetCurrentThreadId () returned 0x970 [0081.383] GetCurrentThreadId () returned 0x970 [0081.383] GetCurrentThreadId () returned 0x970 [0081.383] GetCurrentThreadId () returned 0x970 [0081.383] GetCurrentThreadId () returned 0x970 [0081.383] GetCurrentThreadId () returned 0x970 [0081.383] GetCurrentThreadId () returned 0x970 [0081.383] GetCurrentThreadId () returned 0x970 [0081.383] GetCurrentThreadId () returned 0x970 [0081.383] GetCurrentThreadId () returned 0x970 [0081.383] GetCurrentThreadId () returned 0x970 [0081.383] GetCurrentThreadId () returned 0x970 [0081.383] GetCurrentThreadId () returned 0x970 [0081.383] GetCurrentThreadId () returned 0x970 [0081.383] GetCurrentThreadId () returned 0x970 [0081.383] GetCurrentThreadId () returned 0x970 [0081.383] GetCurrentThreadId () returned 0x970 [0081.383] GetCurrentThreadId () returned 0x970 [0081.383] GetCurrentThreadId () returned 0x970 [0081.383] GetCurrentThreadId () returned 0x970 [0081.383] GetCurrentThreadId () returned 0x970 [0081.383] GetCurrentThreadId () returned 0x970 [0081.384] GetCurrentThreadId () returned 0x970 [0081.384] GetCurrentThreadId () returned 0x970 [0081.384] GetCurrentThreadId () returned 0x970 [0081.384] GetCurrentThreadId () returned 0x970 [0081.384] GetCurrentThreadId () returned 0x970 [0081.384] GetCurrentThreadId () returned 0x970 [0081.384] GetCurrentThreadId () returned 0x970 [0081.384] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0081.384] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0081.384] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5c550, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0081.384] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0081.384] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0081.384] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5c550, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0081.384] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0081.384] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0081.384] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b548, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0081.384] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0081.384] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0081.384] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b548, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0081.384] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0081.384] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0081.384] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5c5b0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0081.384] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0081.384] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0081.384] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5c5b0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0081.384] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0081.384] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0081.384] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5c5b0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0081.384] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x1c, wMilliseconds=0x296)) [0081.384] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="}gU8}F#pJ{M0G#C0\\=oEzDTE2{E~Ix00", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0081.384] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="}gU8}F#pJ{M0G#C0\\=oEzDTE2{E~Ix00", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0081.384] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="}gU8}F#pJ{M0G#C0\\=oEzDTE2{E~Ix00", cchWideChar=32, lpMultiByteStr=0x3b550b8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="}gU8}F#pJ{M0G#C0\\=oEzDTE2{E~Ix00", lpUsedDefaultChar=0x0) returned 32 [0081.385] GetCurrentThreadId () returned 0x970 [0081.385] GetCurrentThreadId () returned 0x970 [0081.385] GetCurrentThreadId () returned 0x970 [0081.385] GetCurrentThreadId () returned 0x970 [0081.385] GetCurrentThreadId () returned 0x970 [0081.385] GetCurrentThreadId () returned 0x970 [0081.392] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0081.392] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0081.392] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3b645b8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0081.392] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0081.392] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAC/upmZnUo8ragyV5jj2nBm83m/61kLtd46U72uiO2j7+zSOeKKZS9m/N1ki3jU6C1t/H7O/B+3PhJfxfXL5L27nW2N0lhbxQ5HjxFXbBmaJQV3GWQ6tQW7EzIAVqBfzvxNy4SwCDa7Zv3xhOirrps4ggD3qAl/oT1vpov+qsxA14yjSFknmubKZiiv4oXvNFhBDSNWh+MuMVLchbovPpgf302dx3rZC2Q==") returned 232 [0081.392] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x1c, wMilliseconds=0x296)) [0081.392] GetCurrentThreadId () returned 0x970 [0081.392] GetCurrentThreadId () returned 0x970 [0081.392] GetCurrentThreadId () returned 0x970 [0081.392] GetCurrentThreadId () returned 0x970 [0081.392] GetCurrentThreadId () returned 0x970 [0081.392] GetCurrentThreadId () returned 0x970 [0081.392] GetCurrentThreadId () returned 0x970 [0081.392] GetCurrentThreadId () returned 0x970 [0081.392] GetCurrentThreadId () returned 0x970 [0081.392] GetCurrentThreadId () returned 0x970 [0081.392] GetCurrentThreadId () returned 0x970 [0081.392] GetCurrentThreadId () returned 0x970 [0081.392] GetCurrentThreadId () returned 0x970 [0081.392] GetCurrentThreadId () returned 0x970 [0081.392] GetCurrentThreadId () returned 0x970 [0081.393] GetCurrentThreadId () returned 0x970 [0081.393] GetCurrentThreadId () returned 0x970 [0081.393] GetCurrentThreadId () returned 0x970 [0081.393] GetCurrentThreadId () returned 0x970 [0081.393] GetCurrentThreadId () returned 0x970 [0081.393] GetCurrentThreadId () returned 0x970 [0081.393] GetCurrentThreadId () returned 0x970 [0081.393] GetCurrentThreadId () returned 0x970 [0081.393] GetCurrentThreadId () returned 0x970 [0081.393] GetCurrentThreadId () returned 0x970 [0081.393] GetCurrentThreadId () returned 0x970 [0081.393] GetCurrentThreadId () returned 0x970 [0081.393] GetCurrentThreadId () returned 0x970 [0081.393] GetCurrentThreadId () returned 0x970 [0081.393] GetCurrentThreadId () returned 0x970 [0081.393] GetCurrentThreadId () returned 0x970 [0081.393] GetCurrentThreadId () returned 0x970 [0081.393] GetCurrentThreadId () returned 0x970 [0081.393] GetCurrentThreadId () returned 0x970 [0081.393] GetCurrentThreadId () returned 0x970 [0081.393] GetCurrentThreadId () returned 0x970 [0081.393] GetCurrentThreadId () returned 0x970 [0081.393] GetCurrentThreadId () returned 0x970 [0081.393] GetCurrentThreadId () returned 0x970 [0081.393] GetCurrentThreadId () returned 0x970 [0081.393] GetCurrentThreadId () returned 0x970 [0081.393] GetCurrentThreadId () returned 0x970 [0081.393] GetCurrentThreadId () returned 0x970 [0081.393] GetCurrentThreadId () returned 0x970 [0081.393] GetCurrentThreadId () returned 0x970 [0081.393] GetCurrentThreadId () returned 0x970 [0081.393] GetCurrentThreadId () returned 0x970 [0081.393] GetCurrentThreadId () returned 0x970 [0081.393] GetCurrentThreadId () returned 0x970 [0081.393] GetCurrentThreadId () returned 0x970 [0081.393] GetCurrentThreadId () returned 0x970 [0081.393] GetCurrentThreadId () returned 0x970 [0081.393] GetCurrentThreadId () returned 0x970 [0081.393] GetCurrentThreadId () returned 0x970 [0081.393] GetCurrentThreadId () returned 0x970 [0081.393] GetCurrentThreadId () returned 0x970 [0081.393] GetCurrentThreadId () returned 0x970 [0081.393] GetCurrentThreadId () returned 0x970 [0081.393] GetCurrentThreadId () returned 0x970 [0081.394] GetCurrentThreadId () returned 0x970 [0081.394] GetCurrentThreadId () returned 0x970 [0081.394] GetCurrentThreadId () returned 0x970 [0081.394] GetCurrentThreadId () returned 0x970 [0081.394] GetCurrentThreadId () returned 0x970 [0081.394] GetCurrentThreadId () returned 0x970 [0081.394] GetCurrentThreadId () returned 0x970 [0081.394] GetCurrentThreadId () returned 0x970 [0081.394] GetCurrentThreadId () returned 0x970 [0081.394] GetCurrentThreadId () returned 0x970 [0081.394] GetCurrentThreadId () returned 0x970 [0081.394] GetCurrentThreadId () returned 0x970 [0081.394] GetCurrentThreadId () returned 0x970 [0081.394] GetCurrentThreadId () returned 0x970 [0081.394] GetCurrentThreadId () returned 0x970 [0081.394] GetCurrentThreadId () returned 0x970 [0081.394] GetCurrentThreadId () returned 0x970 [0081.394] GetCurrentThreadId () returned 0x970 [0081.394] GetCurrentThreadId () returned 0x970 [0081.394] GetCurrentThreadId () returned 0x970 [0081.394] GetCurrentThreadId () returned 0x970 [0081.394] GetCurrentThreadId () returned 0x970 [0081.394] GetCurrentThreadId () returned 0x970 [0081.394] GetCurrentThreadId () returned 0x970 [0081.394] GetCurrentThreadId () returned 0x970 [0081.394] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAC/upmZnUo8ragyV5jj2nBm83m/61kLtd46U72uiO2j7+zSOeKKZS9m/N1ki3jU6C1t/H7O/B+3PhJfxfXL5L27nW2N0lhbxQ5HjxFXbBmaJQV3GWQ6tQW7EzIAVqBfzvxNy4SwCDa7Zv3xhOirrps4ggD3qAl/oT1vpov+qsxA14yjSFknmubKZiiv4oXvNFhBDSNWh+MuMVLchbovPpgf302dx3rZC2Q==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0081.394] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAC/upmZnUo8ragyV5jj2nBm83m/61kLtd46U72uiO2j7+zSOeKKZS9m/N1ki3jU6C1t/H7O/B+3PhJfxfXL5L27nW2N0lhbxQ5HjxFXbBmaJQV3GWQ6tQW7EzIAVqBfzvxNy4SwCDa7Zv3xhOirrps4ggD3qAl/oT1vpov+qsxA14yjSFknmubKZiiv4oXvNFhBDSNWh+MuMVLchbovPpgf302dx3rZC2Q==", cchWideChar=245, lpMultiByteStr=0x3b4d08c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAC/upmZnUo8ragyV5jj2nBm83m/61kLtd46U72uiO2j7+zSOeKKZS9m/N1ki3jU6C1t/H7O/B+3PhJfxfXL5L27nW2N0lhbxQ5HjxFXbBmaJQV3GWQ6tQW7EzIAVqBfzvxNy4SwCDa7Zv3xhOirrps4ggD3qAl/oT1vpov+qsxA14yjSFknmubKZiiv4oXvNFhBDSNWh+MuMVLchbovPpgf302dx3rZC2Q==", lpUsedDefaultChar=0x0) returned 245 [0081.394] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0081.394] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0081.394] CloseHandle (hObject=0x158) returned 1 [0081.395] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg")) returned 1 [0081.396] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=20165923216) returned 1 [0081.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [J0099187.JPG].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [j0099187.jpg].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0081.397] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0081.397] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0081.397] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0081.397] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0081.397] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0081.397] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0081.397] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0081.397] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0081.397] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0081.397] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0081.397] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0081.397] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0081.397] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0081.397] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0081.397] SetEndOfFile (hFile=0x158) returned 1 [0081.398] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0081.398] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0081.398] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0081.398] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0081.398] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0081.399] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0081.399] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M{siRaT2&uL>Y9DY%?L3CYSa.C89W#$z", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0081.399] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M{siRaT2&uL>Y9DY%?L3CYSa.C89W#$z", cchWideChar=32, lpMultiByteStr=0x203aba4, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M{siRaT2&uL>Y9DY%?L3CYSa.C89W#$z", lpUsedDefaultChar=0x0) returned 32 [0081.399] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0081.399] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0081.399] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe4b400, ftCreationTime.dwHighDateTime=0x1bdbf74, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe4b400, ftLastWriteTime.dwHighDateTime=0x1bdbf74, nFileSizeHigh=0x0, nFileSizeLow=0x5fd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099187.JPG", cAlternateFileName="")) returned 0x295098 [0081.399] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0081.399] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0081.400] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg")) returned 0x20 [0081.400] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg")) returned 0x20 [0081.400] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg")) returned 0x20 [0081.400] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg")) returned 0x20 [0081.400] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe4b400, ftCreationTime.dwHighDateTime=0x1bdbf74, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe4b400, ftLastWriteTime.dwHighDateTime=0x1bdbf74, nFileSizeHigh=0x0, nFileSizeLow=0x5fd0)) returned 1 [0081.400] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0081.400] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0081.400] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg")) returned 0x20 [0081.400] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg")) returned 0x20 [0081.400] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0081.400] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0081.400] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0081.400] SetEndOfFile (hFile=0x158) returned 1 [0081.401] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099187.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0081.401] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099187.JPG", cchWideChar=12, lpMultiByteStr=0x1fe37ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0099187.JPG", lpUsedDefaultChar=0x0) returned 12 [0081.401] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099187.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0081.401] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099187.JPG", cchWideChar=12, lpMultiByteStr=0x1fe660c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0099187.JPG", lpUsedDefaultChar=0x0) returned 12 [0081.401] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe660c, cbMultiByte=12, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="J0099187.JPGg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0081.402] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099187.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0081.402] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099187.JPG", cchWideChar=12, lpMultiByteStr=0x1fe37ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0099187.JPG", lpUsedDefaultChar=0x0) returned 12 [0081.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0081.402] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0081.402] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x5fd0 [0081.402] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0081.402] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0081.402] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0081.402] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099187.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0081.402] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099187.JPG", cchWideChar=12, lpMultiByteStr=0x1fe37ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0099187.JPG", lpUsedDefaultChar=0x0) returned 12 [0081.402] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099187.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0081.402] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099187.JPG", cchWideChar=12, lpMultiByteStr=0x1fe660c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0099187.JPG", lpUsedDefaultChar=0x0) returned 12 [0081.402] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe660c, cbMultiByte=12, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="J0099187.JPG87.JPGg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0081.403] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099187.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0081.403] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099187.JPG", cchWideChar=12, lpMultiByteStr=0x1fe37ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0099187.JPG", lpUsedDefaultChar=0x0) returned 12 [0081.403] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0081.404] CharToOemA (in: pSrc="J0099187.JPG", pDst=0x1fe660c | out: pDst="J0099187.JPG") returned 1 [0081.404] WriteFile (in: hFile=0x158, lpBuffer=0x1fe660c*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe660c*, lpNumberOfBytesWritten=0x18e048*=0xc, lpOverlapped=0x0) returned 1 [0081.404] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0081.404] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0081.404] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0081.404] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=20166738887) returned 1 [0081.404] ReadFile (in: hFile=0x11c, lpBuffer=0x3b953a0, nNumberOfBytesToRead=0x5fd0, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b953a0*, lpNumberOfBytesRead=0x18dd7c*=0x5fd0, lpOverlapped=0x0) returned 1 [0081.406] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0081.406] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=20166928986) returned 1 [0081.415] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b3c0*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b5b3c0*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0081.415] ReadFile (in: hFile=0x11c, lpBuffer=0x3b953a0, nNumberOfBytesToRead=0x5fd0, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3b953a0*, lpNumberOfBytesRead=0x18de38*=0x5fd0, lpOverlapped=0x0) returned 1 [0081.415] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x47 [0081.416] WriteFile (in: hFile=0x158, lpBuffer=0x37feaf0*, nNumberOfBytesToWrite=0x5fd0, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x37feaf0*, lpNumberOfBytesWritten=0x18de10*=0x5fd0, lpOverlapped=0x0) returned 1 [0081.416] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x6017 [0081.416] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0081.416] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0081.416] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0081.417] SetFilePointer (in: hFile=0x158, lDistanceToMove=12, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2a [0081.417] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x6021 [0081.417] CloseHandle (hObject=0x11c) returned 1 [0081.417] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x6021 [0081.417] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x6021 [0081.417] SetFilePointer (in: hFile=0x158, lDistanceToMove=24609, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x6021 [0081.417] SetFilePointer (in: hFile=0x158, lDistanceToMove=24609, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x6021 [0081.417] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x6021 [0081.417] SetFilePointer (in: hFile=0x158, lDistanceToMove=24609, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x6021 [0081.417] SetEndOfFile (hFile=0x158) returned 1 [0081.417] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x6021 [0081.418] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x6021 [0081.418] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099187.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0081.418] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099187.JPG", cchWideChar=12, lpMultiByteStr=0x1fe37ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0099187.JPG", lpUsedDefaultChar=0x0) returned 12 [0081.418] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099187.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0081.418] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099187.JPG", cchWideChar=12, lpMultiByteStr=0x1fe43ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0099187.JPG", lpUsedDefaultChar=0x0) returned 12 [0081.418] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe43ac, cbMultiByte=12, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="J0099187.JPGꞗ@涤(\x18믉`믑`") returned 12 [0081.418] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099187.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0081.418] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099187.JPG", cchWideChar=12, lpMultiByteStr=0x1fe37ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0099187.JPG", lpUsedDefaultChar=0x0) returned 12 [0081.418] WriteFile (in: hFile=0x158, lpBuffer=0x3b78e78*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3b78e78*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0081.418] CharToOemA (in: pSrc="J0099187.JPG", pDst=0x1fe43ac | out: pDst="J0099187.JPG") returned 1 [0081.418] WriteFile (in: hFile=0x158, lpBuffer=0x1fe43ac*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe43ac*, lpNumberOfBytesWritten=0x18efcc*=0xc, lpOverlapped=0x0) returned 1 [0081.418] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b350*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x3b5b350*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0081.418] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0081.418] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0081.418] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x6066 [0081.418] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x6066 [0081.418] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0081.419] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0081.419] DeleteFileW (lpFileName="") returned 0 [0081.419] GetLastError () returned 0x3 [0081.419] GetFileAttributesW (lpFileName="") returned 0xffffffff [0081.419] SetLastError (dwErrCode=0x3) [0081.419] FlushFileBuffers (hFile=0x158) returned 1 [0081.422] GetCurrentThreadId () returned 0x970 [0081.422] GetCurrentThreadId () returned 0x970 [0081.422] GetCurrentThreadId () returned 0x970 [0081.422] GetCurrentThreadId () returned 0x970 [0081.422] GetCurrentThreadId () returned 0x970 [0081.422] GetCurrentThreadId () returned 0x970 [0081.422] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x611d [0081.422] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x611d [0081.422] SetFilePointer (in: hFile=0x158, lDistanceToMove=24861, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x611d [0081.422] CloseHandle (hObject=0x158) returned 1 [0081.422] GetCurrentThreadId () returned 0x970 [0081.423] GetCurrentThreadId () returned 0x970 [0081.423] GetCurrentThreadId () returned 0x970 [0081.423] GetCurrentThreadId () returned 0x970 [0081.423] GetCurrentThreadId () returned 0x970 [0081.423] GetCurrentThreadId () returned 0x970 [0081.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [J0099187.JPG].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [j0099187.jpg].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0081.423] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x611d [0081.423] SetFilePointer (in: hFile=0x158, lDistanceToMove=24733, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x609d [0081.423] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0081.423] GetFileType (hFile=0x158) returned 0x1 [0081.423] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x1c, wMilliseconds=0x2b6)) [0081.423] GetCurrentThreadId () returned 0x970 [0081.423] GetCurrentThreadId () returned 0x970 [0081.423] GetCurrentThreadId () returned 0x970 [0081.423] GetCurrentThreadId () returned 0x970 [0081.423] GetCurrentThreadId () returned 0x970 [0081.423] GetCurrentThreadId () returned 0x970 [0081.423] GetCurrentThreadId () returned 0x970 [0081.423] GetCurrentThreadId () returned 0x970 [0081.423] GetCurrentThreadId () returned 0x970 [0081.423] GetCurrentThreadId () returned 0x970 [0081.423] GetCurrentThreadId () returned 0x970 [0081.423] GetCurrentThreadId () returned 0x970 [0081.423] GetCurrentThreadId () returned 0x970 [0081.423] GetCurrentThreadId () returned 0x970 [0081.423] GetCurrentThreadId () returned 0x970 [0081.423] GetCurrentThreadId () returned 0x970 [0081.423] GetCurrentThreadId () returned 0x970 [0081.423] GetCurrentThreadId () returned 0x970 [0081.424] GetCurrentThreadId () returned 0x970 [0081.424] GetCurrentThreadId () returned 0x970 [0081.424] GetCurrentThreadId () returned 0x970 [0081.424] GetCurrentThreadId () returned 0x970 [0081.424] GetCurrentThreadId () returned 0x970 [0081.424] GetCurrentThreadId () returned 0x970 [0081.424] GetCurrentThreadId () returned 0x970 [0081.424] GetCurrentThreadId () returned 0x970 [0081.424] GetCurrentThreadId () returned 0x970 [0081.424] GetCurrentThreadId () returned 0x970 [0081.424] GetCurrentThreadId () returned 0x970 [0081.424] GetCurrentThreadId () returned 0x970 [0081.424] GetCurrentThreadId () returned 0x970 [0081.424] GetCurrentThreadId () returned 0x970 [0081.424] GetCurrentThreadId () returned 0x970 [0081.424] GetCurrentThreadId () returned 0x970 [0081.424] GetCurrentThreadId () returned 0x970 [0081.424] GetCurrentThreadId () returned 0x970 [0081.424] GetCurrentThreadId () returned 0x970 [0081.424] GetCurrentThreadId () returned 0x970 [0081.424] GetCurrentThreadId () returned 0x970 [0081.424] GetCurrentThreadId () returned 0x970 [0081.424] GetCurrentThreadId () returned 0x970 [0081.424] GetCurrentThreadId () returned 0x970 [0081.424] GetCurrentThreadId () returned 0x970 [0081.424] GetCurrentThreadId () returned 0x970 [0081.424] GetCurrentThreadId () returned 0x970 [0081.424] GetCurrentThreadId () returned 0x970 [0081.424] GetCurrentThreadId () returned 0x970 [0081.424] GetCurrentThreadId () returned 0x970 [0081.424] GetCurrentThreadId () returned 0x970 [0081.424] GetCurrentThreadId () returned 0x970 [0081.424] GetCurrentThreadId () returned 0x970 [0081.424] GetCurrentThreadId () returned 0x970 [0081.424] GetCurrentThreadId () returned 0x970 [0081.424] GetCurrentThreadId () returned 0x970 [0081.424] GetCurrentThreadId () returned 0x970 [0081.424] GetCurrentThreadId () returned 0x970 [0081.424] GetCurrentThreadId () returned 0x970 [0081.424] GetCurrentThreadId () returned 0x970 [0081.424] GetCurrentThreadId () returned 0x970 [0081.424] GetCurrentThreadId () returned 0x970 [0081.424] GetCurrentThreadId () returned 0x970 [0081.424] GetCurrentThreadId () returned 0x970 [0081.424] GetCurrentThreadId () returned 0x970 [0081.425] GetCurrentThreadId () returned 0x970 [0081.425] GetCurrentThreadId () returned 0x970 [0081.425] GetCurrentThreadId () returned 0x970 [0081.425] GetCurrentThreadId () returned 0x970 [0081.425] GetCurrentThreadId () returned 0x970 [0081.425] GetCurrentThreadId () returned 0x970 [0081.425] GetCurrentThreadId () returned 0x970 [0081.425] GetCurrentThreadId () returned 0x970 [0081.425] GetCurrentThreadId () returned 0x970 [0081.425] GetCurrentThreadId () returned 0x970 [0081.425] GetCurrentThreadId () returned 0x970 [0081.425] GetCurrentThreadId () returned 0x970 [0081.425] GetCurrentThreadId () returned 0x970 [0081.425] GetCurrentThreadId () returned 0x970 [0081.425] GetCurrentThreadId () returned 0x970 [0081.425] GetCurrentThreadId () returned 0x970 [0081.425] GetCurrentThreadId () returned 0x970 [0081.425] GetCurrentThreadId () returned 0x970 [0081.425] GetCurrentThreadId () returned 0x970 [0081.425] GetCurrentThreadId () returned 0x970 [0081.425] GetCurrentThreadId () returned 0x970 [0081.425] GetCurrentThreadId () returned 0x970 [0081.425] GetCurrentThreadId () returned 0x970 [0081.425] GetCurrentThreadId () returned 0x970 [0081.425] GetCurrentThreadId () returned 0x970 [0081.425] GetCurrentThreadId () returned 0x970 [0081.425] GetCurrentThreadId () returned 0x970 [0081.425] GetCurrentThreadId () returned 0x970 [0081.425] GetCurrentThreadId () returned 0x970 [0081.425] GetCurrentThreadId () returned 0x970 [0081.425] GetCurrentThreadId () returned 0x970 [0081.425] GetCurrentThreadId () returned 0x970 [0081.425] GetCurrentThreadId () returned 0x970 [0081.425] GetCurrentThreadId () returned 0x970 [0081.425] GetCurrentThreadId () returned 0x970 [0081.425] GetCurrentThreadId () returned 0x970 [0081.425] GetCurrentThreadId () returned 0x970 [0081.425] GetCurrentThreadId () returned 0x970 [0081.425] GetCurrentThreadId () returned 0x970 [0081.425] GetCurrentThreadId () returned 0x970 [0081.425] GetCurrentThreadId () returned 0x970 [0081.425] GetCurrentThreadId () returned 0x970 [0081.425] GetCurrentThreadId () returned 0x970 [0081.425] GetCurrentThreadId () returned 0x970 [0081.426] GetCurrentThreadId () returned 0x970 [0081.426] GetCurrentThreadId () returned 0x970 [0081.426] GetCurrentThreadId () returned 0x970 [0081.426] GetCurrentThreadId () returned 0x970 [0081.426] GetCurrentThreadId () returned 0x970 [0081.426] GetCurrentThreadId () returned 0x970 [0081.426] GetCurrentThreadId () returned 0x970 [0081.426] GetCurrentThreadId () returned 0x970 [0081.426] GetCurrentThreadId () returned 0x970 [0081.426] GetCurrentThreadId () returned 0x970 [0081.426] GetCurrentThreadId () returned 0x970 [0081.426] GetCurrentThreadId () returned 0x970 [0081.426] GetCurrentThreadId () returned 0x970 [0081.426] GetCurrentThreadId () returned 0x970 [0081.426] GetCurrentThreadId () returned 0x970 [0081.426] GetCurrentThreadId () returned 0x970 [0081.426] GetCurrentThreadId () returned 0x970 [0081.426] GetCurrentThreadId () returned 0x970 [0081.426] GetCurrentThreadId () returned 0x970 [0081.426] GetCurrentThreadId () returned 0x970 [0081.426] GetCurrentThreadId () returned 0x970 [0081.426] GetCurrentThreadId () returned 0x970 [0081.426] GetCurrentThreadId () returned 0x970 [0081.426] GetCurrentThreadId () returned 0x970 [0081.426] GetCurrentThreadId () returned 0x970 [0081.426] GetCurrentThreadId () returned 0x970 [0081.426] GetCurrentThreadId () returned 0x970 [0081.426] GetCurrentThreadId () returned 0x970 [0081.426] GetCurrentThreadId () returned 0x970 [0081.426] GetCurrentThreadId () returned 0x970 [0081.426] GetCurrentThreadId () returned 0x970 [0081.426] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0081.426] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0081.426] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5c5b0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0081.426] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0081.426] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0081.426] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5c5b0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0081.426] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0081.426] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0081.426] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b530, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0081.426] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0081.427] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0081.427] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b530, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0081.427] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0081.427] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0081.427] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5c610, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0081.427] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0081.427] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0081.427] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5c610, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0081.427] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0081.427] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0081.427] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5c610, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0081.427] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x1c, wMilliseconds=0x2b6)) [0081.427] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="M{siRaT2&uL>Y9DY%?L3CYSa.C89W#$z", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0081.427] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="M{siRaT2&uL>Y9DY%?L3CYSa.C89W#$z", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0081.427] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="M{siRaT2&uL>Y9DY%?L3CYSa.C89W#$z", cchWideChar=32, lpMultiByteStr=0x3b550e8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M{siRaT2&uL>Y9DY%?L3CYSa.C89W#$z", lpUsedDefaultChar=0x0) returned 32 [0081.427] GetCurrentThreadId () returned 0x970 [0081.427] GetCurrentThreadId () returned 0x970 [0081.427] GetCurrentThreadId () returned 0x970 [0081.427] GetCurrentThreadId () returned 0x970 [0081.427] GetCurrentThreadId () returned 0x970 [0081.427] GetCurrentThreadId () returned 0x970 [0081.435] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0081.435] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0081.435] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3b646a8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0081.435] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0081.435] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAFBGRdKEDSzDVnkK6LNsfNOGFGb5gNX+U3AGJHj6cBC8G+GlqcXvusUK0tZQ7H3ZMSTLNSVXZvUwOYi0NRUo7SozhvbriyEe6f5yuMVymyN0cWYIv2At48fWRpOd2i+uI79c6/iJI3HbPl1ZVjlodUyK4MBH7pOhsvmc42Oktuo/QPa9C8XDWZi4oTezKK+By9YFuXRaTsTlkZns2CTflQ2SNh7QYeGpMA==") returned 232 [0081.435] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x1c, wMilliseconds=0x2c5)) [0081.435] GetCurrentThreadId () returned 0x970 [0081.435] GetCurrentThreadId () returned 0x970 [0081.435] GetCurrentThreadId () returned 0x970 [0081.435] GetCurrentThreadId () returned 0x970 [0081.435] GetCurrentThreadId () returned 0x970 [0081.435] GetCurrentThreadId () returned 0x970 [0081.435] GetCurrentThreadId () returned 0x970 [0081.435] GetCurrentThreadId () returned 0x970 [0081.435] GetCurrentThreadId () returned 0x970 [0081.435] GetCurrentThreadId () returned 0x970 [0081.435] GetCurrentThreadId () returned 0x970 [0081.435] GetCurrentThreadId () returned 0x970 [0081.435] GetCurrentThreadId () returned 0x970 [0081.435] GetCurrentThreadId () returned 0x970 [0081.435] GetCurrentThreadId () returned 0x970 [0081.435] GetCurrentThreadId () returned 0x970 [0081.435] GetCurrentThreadId () returned 0x970 [0081.435] GetCurrentThreadId () returned 0x970 [0081.435] GetCurrentThreadId () returned 0x970 [0081.435] GetCurrentThreadId () returned 0x970 [0081.436] GetCurrentThreadId () returned 0x970 [0081.436] GetCurrentThreadId () returned 0x970 [0081.436] GetCurrentThreadId () returned 0x970 [0081.436] GetCurrentThreadId () returned 0x970 [0081.436] GetCurrentThreadId () returned 0x970 [0081.436] GetCurrentThreadId () returned 0x970 [0081.436] GetCurrentThreadId () returned 0x970 [0081.436] GetCurrentThreadId () returned 0x970 [0081.436] GetCurrentThreadId () returned 0x970 [0081.436] GetCurrentThreadId () returned 0x970 [0081.436] GetCurrentThreadId () returned 0x970 [0081.436] GetCurrentThreadId () returned 0x970 [0081.436] GetCurrentThreadId () returned 0x970 [0081.436] GetCurrentThreadId () returned 0x970 [0081.436] GetCurrentThreadId () returned 0x970 [0081.436] GetCurrentThreadId () returned 0x970 [0081.436] GetCurrentThreadId () returned 0x970 [0081.436] GetCurrentThreadId () returned 0x970 [0081.436] GetCurrentThreadId () returned 0x970 [0081.436] GetCurrentThreadId () returned 0x970 [0081.436] GetCurrentThreadId () returned 0x970 [0081.436] GetCurrentThreadId () returned 0x970 [0081.436] GetCurrentThreadId () returned 0x970 [0081.436] GetCurrentThreadId () returned 0x970 [0081.436] GetCurrentThreadId () returned 0x970 [0081.436] GetCurrentThreadId () returned 0x970 [0081.436] GetCurrentThreadId () returned 0x970 [0081.436] GetCurrentThreadId () returned 0x970 [0081.436] GetCurrentThreadId () returned 0x970 [0081.436] GetCurrentThreadId () returned 0x970 [0081.436] GetCurrentThreadId () returned 0x970 [0081.436] GetCurrentThreadId () returned 0x970 [0081.436] GetCurrentThreadId () returned 0x970 [0081.436] GetCurrentThreadId () returned 0x970 [0081.436] GetCurrentThreadId () returned 0x970 [0081.436] GetCurrentThreadId () returned 0x970 [0081.436] GetCurrentThreadId () returned 0x970 [0081.437] GetCurrentThreadId () returned 0x970 [0081.437] GetCurrentThreadId () returned 0x970 [0081.437] GetCurrentThreadId () returned 0x970 [0081.437] GetCurrentThreadId () returned 0x970 [0081.437] GetCurrentThreadId () returned 0x970 [0081.437] GetCurrentThreadId () returned 0x970 [0081.437] GetCurrentThreadId () returned 0x970 [0081.437] GetCurrentThreadId () returned 0x970 [0081.437] GetCurrentThreadId () returned 0x970 [0081.437] GetCurrentThreadId () returned 0x970 [0081.437] GetCurrentThreadId () returned 0x970 [0081.437] GetCurrentThreadId () returned 0x970 [0081.437] GetCurrentThreadId () returned 0x970 [0081.437] GetCurrentThreadId () returned 0x970 [0081.437] GetCurrentThreadId () returned 0x970 [0081.437] GetCurrentThreadId () returned 0x970 [0081.437] GetCurrentThreadId () returned 0x970 [0081.437] GetCurrentThreadId () returned 0x970 [0081.437] GetCurrentThreadId () returned 0x970 [0081.437] GetCurrentThreadId () returned 0x970 [0081.437] GetCurrentThreadId () returned 0x970 [0081.437] GetCurrentThreadId () returned 0x970 [0081.437] GetCurrentThreadId () returned 0x970 [0081.437] GetCurrentThreadId () returned 0x970 [0081.437] GetCurrentThreadId () returned 0x970 [0081.437] GetCurrentThreadId () returned 0x970 [0081.437] GetCurrentThreadId () returned 0x970 [0081.437] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAFBGRdKEDSzDVnkK6LNsfNOGFGb5gNX+U3AGJHj6cBC8G+GlqcXvusUK0tZQ7H3ZMSTLNSVXZvUwOYi0NRUo7SozhvbriyEe6f5yuMVymyN0cWYIv2At48fWRpOd2i+uI79c6/iJI3HbPl1ZVjlodUyK4MBH7pOhsvmc42Oktuo/QPa9C8XDWZi4oTezKK+By9YFuXRaTsTlkZns2CTflQ2SNh7QYeGpMA==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0081.437] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAFBGRdKEDSzDVnkK6LNsfNOGFGb5gNX+U3AGJHj6cBC8G+GlqcXvusUK0tZQ7H3ZMSTLNSVXZvUwOYi0NRUo7SozhvbriyEe6f5yuMVymyN0cWYIv2At48fWRpOd2i+uI79c6/iJI3HbPl1ZVjlodUyK4MBH7pOhsvmc42Oktuo/QPa9C8XDWZi4oTezKK+By9YFuXRaTsTlkZns2CTflQ2SNh7QYeGpMA==", cchWideChar=245, lpMultiByteStr=0x3b4d08c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAFBGRdKEDSzDVnkK6LNsfNOGFGb5gNX+U3AGJHj6cBC8G+GlqcXvusUK0tZQ7H3ZMSTLNSVXZvUwOYi0NRUo7SozhvbriyEe6f5yuMVymyN0cWYIv2At48fWRpOd2i+uI79c6/iJI3HbPl1ZVjlodUyK4MBH7pOhsvmc42Oktuo/QPa9C8XDWZi4oTezKK+By9YFuXRaTsTlkZns2CTflQ2SNh7QYeGpMA==", lpUsedDefaultChar=0x0) returned 245 [0081.437] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0081.438] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0081.438] CloseHandle (hObject=0x158) returned 1 [0081.438] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg")) returned 1 [0081.439] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=20170267787) returned 1 [0081.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [J0099188.JPG].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [j0099188.jpg].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0081.440] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0081.440] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0081.440] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0081.440] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0081.440] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0081.440] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0081.440] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0081.440] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0081.440] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0081.441] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0081.441] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0081.441] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0081.441] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0081.441] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0081.441] SetEndOfFile (hFile=0x158) returned 1 [0081.441] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0081.441] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0081.441] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0081.441] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0081.441] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0081.443] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0081.443] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Xl)!4jX)m=6Kskg*/@i-NRvQfCG*-8s@", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0081.443] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Xl)!4jX)m=6Kskg*/@i-NRvQfCG*-8s@", cchWideChar=32, lpMultiByteStr=0x203abdc, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Xl)!4jX)m=6Kskg*/@i-NRvQfCG*-8s@", lpUsedDefaultChar=0x0) returned 32 [0081.443] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0081.443] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0081.443] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x2378, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099188.JPG", cAlternateFileName="")) returned 0x295098 [0081.444] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0081.444] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0081.444] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg")) returned 0x20 [0081.444] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg")) returned 0x20 [0081.444] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg")) returned 0x20 [0081.444] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg")) returned 0x20 [0081.444] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x2378)) returned 1 [0081.444] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0081.444] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0081.444] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg")) returned 0x20 [0081.444] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg")) returned 0x20 [0081.444] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0081.444] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0081.444] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0081.444] SetEndOfFile (hFile=0x158) returned 1 [0081.446] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099188.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0081.446] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099188.JPG", cchWideChar=12, lpMultiByteStr=0x1fe44ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0099188.JPG", lpUsedDefaultChar=0x0) returned 12 [0081.446] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099188.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0081.446] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099188.JPG", cchWideChar=12, lpMultiByteStr=0x1fe64ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0099188.JPG", lpUsedDefaultChar=0x0) returned 12 [0081.446] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe64ec, cbMultiByte=12, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="J0099188.JPGg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0081.446] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099188.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0081.446] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099188.JPG", cchWideChar=12, lpMultiByteStr=0x1fe44ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0099188.JPG", lpUsedDefaultChar=0x0) returned 12 [0081.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0081.446] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0081.446] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2378 [0081.446] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0081.447] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0081.447] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0081.447] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099188.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0081.447] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099188.JPG", cchWideChar=12, lpMultiByteStr=0x1fe44ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0099188.JPG", lpUsedDefaultChar=0x0) returned 12 [0081.447] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099188.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0081.447] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099188.JPG", cchWideChar=12, lpMultiByteStr=0x1fe64ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0099188.JPG", lpUsedDefaultChar=0x0) returned 12 [0081.447] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe64ec, cbMultiByte=12, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="J0099188.JPG88.JPGg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0081.447] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099188.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0081.447] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099188.JPG", cchWideChar=12, lpMultiByteStr=0x1fe44ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0099188.JPG", lpUsedDefaultChar=0x0) returned 12 [0081.447] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0081.449] CharToOemA (in: pSrc="J0099188.JPG", pDst=0x1fe64ec | out: pDst="J0099188.JPG") returned 1 [0081.449] WriteFile (in: hFile=0x158, lpBuffer=0x1fe64ec*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe64ec*, lpNumberOfBytesWritten=0x18e048*=0xc, lpOverlapped=0x0) returned 1 [0081.449] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0081.449] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0081.449] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0081.449] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=20171268006) returned 1 [0081.449] ReadFile (in: hFile=0x11c, lpBuffer=0x3b9c6d0, nNumberOfBytesToRead=0x2378, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b9c6d0*, lpNumberOfBytesRead=0x18dd7c*=0x2378, lpOverlapped=0x0) returned 1 [0081.451] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0081.451] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=20171649203) returned 1 [0081.462] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b450*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b5b450*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0081.462] ReadFile (in: hFile=0x11c, lpBuffer=0x3b9c6d0, nNumberOfBytesToRead=0x2378, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3b9c6d0*, lpNumberOfBytesRead=0x18de38*=0x2378, lpOverlapped=0x0) returned 1 [0081.462] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x47 [0081.463] WriteFile (in: hFile=0x158, lpBuffer=0x3800220*, nNumberOfBytesToWrite=0x2378, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3800220*, lpNumberOfBytesWritten=0x18de10*=0x2378, lpOverlapped=0x0) returned 1 [0081.463] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x23bf [0081.463] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0081.463] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0081.463] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0081.463] SetFilePointer (in: hFile=0x158, lDistanceToMove=12, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2a [0081.463] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x23c9 [0081.463] CloseHandle (hObject=0x11c) returned 1 [0081.463] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x23c9 [0081.464] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x23c9 [0081.464] SetFilePointer (in: hFile=0x158, lDistanceToMove=9161, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x23c9 [0081.464] SetFilePointer (in: hFile=0x158, lDistanceToMove=9161, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x23c9 [0081.464] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x23c9 [0081.464] SetFilePointer (in: hFile=0x158, lDistanceToMove=9161, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x23c9 [0081.464] SetEndOfFile (hFile=0x158) returned 1 [0081.464] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x23c9 [0081.464] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x23c9 [0081.464] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099188.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0081.464] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099188.JPG", cchWideChar=12, lpMultiByteStr=0x1fe44ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0099188.JPG", lpUsedDefaultChar=0x0) returned 12 [0081.464] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099188.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0081.464] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099188.JPG", cchWideChar=12, lpMultiByteStr=0x1fe3a2c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0099188.JPG", lpUsedDefaultChar=0x0) returned 12 [0081.464] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe3a2c, cbMultiByte=12, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="J0099188.JPGꞗ@涤(\x18믉`믑`") returned 12 [0081.464] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099188.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0081.464] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099188.JPG", cchWideChar=12, lpMultiByteStr=0x1fe44ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0099188.JPG", lpUsedDefaultChar=0x0) returned 12 [0081.464] WriteFile (in: hFile=0x158, lpBuffer=0x3b801a8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3b801a8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0081.465] CharToOemA (in: pSrc="J0099188.JPG", pDst=0x1fe3a2c | out: pDst="J0099188.JPG") returned 1 [0081.465] WriteFile (in: hFile=0x158, lpBuffer=0x1fe3a2c*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe3a2c*, lpNumberOfBytesWritten=0x18efcc*=0xc, lpOverlapped=0x0) returned 1 [0081.465] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b3b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x3b5b3b0*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0081.465] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0081.465] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0081.465] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x240e [0081.465] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x240e [0081.465] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0081.465] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0081.465] DeleteFileW (lpFileName="") returned 0 [0081.465] GetLastError () returned 0x3 [0081.465] GetFileAttributesW (lpFileName="") returned 0xffffffff [0081.465] SetLastError (dwErrCode=0x3) [0081.465] FlushFileBuffers (hFile=0x158) returned 1 [0081.468] GetCurrentThreadId () returned 0x970 [0081.468] GetCurrentThreadId () returned 0x970 [0081.468] GetCurrentThreadId () returned 0x970 [0081.468] GetCurrentThreadId () returned 0x970 [0081.468] GetCurrentThreadId () returned 0x970 [0081.468] GetCurrentThreadId () returned 0x970 [0081.468] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x24c5 [0081.468] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x24c5 [0081.469] SetFilePointer (in: hFile=0x158, lDistanceToMove=9413, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x24c5 [0081.469] CloseHandle (hObject=0x158) returned 1 [0081.469] GetCurrentThreadId () returned 0x970 [0081.469] GetCurrentThreadId () returned 0x970 [0081.469] GetCurrentThreadId () returned 0x970 [0081.469] GetCurrentThreadId () returned 0x970 [0081.469] GetCurrentThreadId () returned 0x970 [0081.469] GetCurrentThreadId () returned 0x970 [0081.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [J0099188.JPG].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [j0099188.jpg].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0081.469] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x24c5 [0081.469] SetFilePointer (in: hFile=0x158, lDistanceToMove=9285, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2445 [0081.469] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0081.469] GetFileType (hFile=0x158) returned 0x1 [0081.469] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x1c, wMilliseconds=0x2e4)) [0081.469] GetCurrentThreadId () returned 0x970 [0081.469] GetCurrentThreadId () returned 0x970 [0081.469] GetCurrentThreadId () returned 0x970 [0081.469] GetCurrentThreadId () returned 0x970 [0081.469] GetCurrentThreadId () returned 0x970 [0081.469] GetCurrentThreadId () returned 0x970 [0081.469] GetCurrentThreadId () returned 0x970 [0081.469] GetCurrentThreadId () returned 0x970 [0081.470] GetCurrentThreadId () returned 0x970 [0081.470] GetCurrentThreadId () returned 0x970 [0081.470] GetCurrentThreadId () returned 0x970 [0081.470] GetCurrentThreadId () returned 0x970 [0081.470] GetCurrentThreadId () returned 0x970 [0081.470] GetCurrentThreadId () returned 0x970 [0081.470] GetCurrentThreadId () returned 0x970 [0081.470] GetCurrentThreadId () returned 0x970 [0081.470] GetCurrentThreadId () returned 0x970 [0081.470] GetCurrentThreadId () returned 0x970 [0081.470] GetCurrentThreadId () returned 0x970 [0081.470] GetCurrentThreadId () returned 0x970 [0081.470] GetCurrentThreadId () returned 0x970 [0081.470] GetCurrentThreadId () returned 0x970 [0081.470] GetCurrentThreadId () returned 0x970 [0081.470] GetCurrentThreadId () returned 0x970 [0081.470] GetCurrentThreadId () returned 0x970 [0081.470] GetCurrentThreadId () returned 0x970 [0081.470] GetCurrentThreadId () returned 0x970 [0081.470] GetCurrentThreadId () returned 0x970 [0081.470] GetCurrentThreadId () returned 0x970 [0081.470] GetCurrentThreadId () returned 0x970 [0081.470] GetCurrentThreadId () returned 0x970 [0081.470] GetCurrentThreadId () returned 0x970 [0081.470] GetCurrentThreadId () returned 0x970 [0081.470] GetCurrentThreadId () returned 0x970 [0081.470] GetCurrentThreadId () returned 0x970 [0081.470] GetCurrentThreadId () returned 0x970 [0081.470] GetCurrentThreadId () returned 0x970 [0081.470] GetCurrentThreadId () returned 0x970 [0081.470] GetCurrentThreadId () returned 0x970 [0081.470] GetCurrentThreadId () returned 0x970 [0081.470] GetCurrentThreadId () returned 0x970 [0081.470] GetCurrentThreadId () returned 0x970 [0081.470] GetCurrentThreadId () returned 0x970 [0081.470] GetCurrentThreadId () returned 0x970 [0081.470] GetCurrentThreadId () returned 0x970 [0081.470] GetCurrentThreadId () returned 0x970 [0081.470] GetCurrentThreadId () returned 0x970 [0081.470] GetCurrentThreadId () returned 0x970 [0081.470] GetCurrentThreadId () returned 0x970 [0081.470] GetCurrentThreadId () returned 0x970 [0081.470] GetCurrentThreadId () returned 0x970 [0081.471] GetCurrentThreadId () returned 0x970 [0081.471] GetCurrentThreadId () returned 0x970 [0081.471] GetCurrentThreadId () returned 0x970 [0081.471] GetCurrentThreadId () returned 0x970 [0081.471] GetCurrentThreadId () returned 0x970 [0081.471] GetCurrentThreadId () returned 0x970 [0081.471] GetCurrentThreadId () returned 0x970 [0081.471] GetCurrentThreadId () returned 0x970 [0081.471] GetCurrentThreadId () returned 0x970 [0081.471] GetCurrentThreadId () returned 0x970 [0081.471] GetCurrentThreadId () returned 0x970 [0081.471] GetCurrentThreadId () returned 0x970 [0081.471] GetCurrentThreadId () returned 0x970 [0081.471] GetCurrentThreadId () returned 0x970 [0081.471] GetCurrentThreadId () returned 0x970 [0081.471] GetCurrentThreadId () returned 0x970 [0081.471] GetCurrentThreadId () returned 0x970 [0081.471] GetCurrentThreadId () returned 0x970 [0081.471] GetCurrentThreadId () returned 0x970 [0081.471] GetCurrentThreadId () returned 0x970 [0081.471] GetCurrentThreadId () returned 0x970 [0081.471] GetCurrentThreadId () returned 0x970 [0081.471] GetCurrentThreadId () returned 0x970 [0081.471] GetCurrentThreadId () returned 0x970 [0081.471] GetCurrentThreadId () returned 0x970 [0081.471] GetCurrentThreadId () returned 0x970 [0081.471] GetCurrentThreadId () returned 0x970 [0081.471] GetCurrentThreadId () returned 0x970 [0081.471] GetCurrentThreadId () returned 0x970 [0081.471] GetCurrentThreadId () returned 0x970 [0081.471] GetCurrentThreadId () returned 0x970 [0081.471] GetCurrentThreadId () returned 0x970 [0081.471] GetCurrentThreadId () returned 0x970 [0081.471] GetCurrentThreadId () returned 0x970 [0081.471] GetCurrentThreadId () returned 0x970 [0081.471] GetCurrentThreadId () returned 0x970 [0081.471] GetCurrentThreadId () returned 0x970 [0081.471] GetCurrentThreadId () returned 0x970 [0081.471] GetCurrentThreadId () returned 0x970 [0081.471] GetCurrentThreadId () returned 0x970 [0081.471] GetCurrentThreadId () returned 0x970 [0081.471] GetCurrentThreadId () returned 0x970 [0081.471] GetCurrentThreadId () returned 0x970 [0081.471] GetCurrentThreadId () returned 0x970 [0081.472] GetCurrentThreadId () returned 0x970 [0081.472] GetCurrentThreadId () returned 0x970 [0081.472] GetCurrentThreadId () returned 0x970 [0081.472] GetCurrentThreadId () returned 0x970 [0081.472] GetCurrentThreadId () returned 0x970 [0081.472] GetCurrentThreadId () returned 0x970 [0081.472] GetCurrentThreadId () returned 0x970 [0081.472] GetCurrentThreadId () returned 0x970 [0081.472] GetCurrentThreadId () returned 0x970 [0081.472] GetCurrentThreadId () returned 0x970 [0081.472] GetCurrentThreadId () returned 0x970 [0081.472] GetCurrentThreadId () returned 0x970 [0081.472] GetCurrentThreadId () returned 0x970 [0081.472] GetCurrentThreadId () returned 0x970 [0081.472] GetCurrentThreadId () returned 0x970 [0081.472] GetCurrentThreadId () returned 0x970 [0081.472] GetCurrentThreadId () returned 0x970 [0081.472] GetCurrentThreadId () returned 0x970 [0081.472] GetCurrentThreadId () returned 0x970 [0081.472] GetCurrentThreadId () returned 0x970 [0081.472] GetCurrentThreadId () returned 0x970 [0081.472] GetCurrentThreadId () returned 0x970 [0081.472] GetCurrentThreadId () returned 0x970 [0081.472] GetCurrentThreadId () returned 0x970 [0081.472] GetCurrentThreadId () returned 0x970 [0081.472] GetCurrentThreadId () returned 0x970 [0081.472] GetCurrentThreadId () returned 0x970 [0081.472] GetCurrentThreadId () returned 0x970 [0081.472] GetCurrentThreadId () returned 0x970 [0081.472] GetCurrentThreadId () returned 0x970 [0081.472] GetCurrentThreadId () returned 0x970 [0081.472] GetCurrentThreadId () returned 0x970 [0081.472] GetCurrentThreadId () returned 0x970 [0081.472] GetCurrentThreadId () returned 0x970 [0081.472] GetCurrentThreadId () returned 0x970 [0081.472] GetCurrentThreadId () returned 0x970 [0081.472] GetCurrentThreadId () returned 0x970 [0081.472] GetCurrentThreadId () returned 0x970 [0081.472] GetCurrentThreadId () returned 0x970 [0081.472] GetCurrentThreadId () returned 0x970 [0081.472] GetCurrentThreadId () returned 0x970 [0081.472] GetCurrentThreadId () returned 0x970 [0081.472] GetCurrentThreadId () returned 0x970 [0081.473] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0081.473] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0081.473] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5c610, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0081.473] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0081.473] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0081.473] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5c610, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0081.473] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0081.473] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0081.473] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b548, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0081.473] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0081.473] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0081.473] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b548, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0081.473] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0081.473] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0081.473] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5c670, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0081.473] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0081.473] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0081.473] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5c670, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0081.473] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0081.473] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0081.473] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5c670, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0081.473] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x1c, wMilliseconds=0x2e4)) [0081.473] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Xl)!4jX)m=6Kskg*/@i-NRvQfCG*-8s@", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0081.473] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Xl)!4jX)m=6Kskg*/@i-NRvQfCG*-8s@", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0081.473] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Xl)!4jX)m=6Kskg*/@i-NRvQfCG*-8s@", cchWideChar=32, lpMultiByteStr=0x3b55118, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Xl)!4jX)m=6Kskg*/@i-NRvQfCG*-8s@", lpUsedDefaultChar=0x0) returned 32 [0081.473] GetCurrentThreadId () returned 0x970 [0081.473] GetCurrentThreadId () returned 0x970 [0081.473] GetCurrentThreadId () returned 0x970 [0081.473] GetCurrentThreadId () returned 0x970 [0081.474] GetCurrentThreadId () returned 0x970 [0081.474] GetCurrentThreadId () returned 0x970 [0081.481] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0081.481] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0081.481] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3b64798, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0081.481] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0081.481] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAH5kPh4BGHkfgFxeyONBaq0kTLckijdQ5wqBxTXc5KuVE39iyf+fJZ0EEtP8wAXwsYLFQqtzSIRCkyquAA4gPeCUIxVJ8L0CJumFfmy+rPkPpPsI/LWZfzj2DyzC+R2OVSoQ9aRCNr7MURbaYhfyi9zhO7EVIdWWnyTOs77mundRjofekhjz2CfFAjlDJU7fbXmg388o1ElnLk8gadB0cpoe9Nsw9LiZ0A==") returned 232 [0081.481] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x1c, wMilliseconds=0x2f4)) [0081.481] GetCurrentThreadId () returned 0x970 [0081.481] GetCurrentThreadId () returned 0x970 [0081.481] GetCurrentThreadId () returned 0x970 [0081.481] GetCurrentThreadId () returned 0x970 [0081.481] GetCurrentThreadId () returned 0x970 [0081.481] GetCurrentThreadId () returned 0x970 [0081.481] GetCurrentThreadId () returned 0x970 [0081.481] GetCurrentThreadId () returned 0x970 [0081.481] GetCurrentThreadId () returned 0x970 [0081.481] GetCurrentThreadId () returned 0x970 [0081.481] GetCurrentThreadId () returned 0x970 [0081.481] GetCurrentThreadId () returned 0x970 [0081.482] GetCurrentThreadId () returned 0x970 [0081.482] GetCurrentThreadId () returned 0x970 [0081.482] GetCurrentThreadId () returned 0x970 [0081.482] GetCurrentThreadId () returned 0x970 [0081.482] GetCurrentThreadId () returned 0x970 [0081.482] GetCurrentThreadId () returned 0x970 [0081.482] GetCurrentThreadId () returned 0x970 [0081.482] GetCurrentThreadId () returned 0x970 [0081.482] GetCurrentThreadId () returned 0x970 [0081.482] GetCurrentThreadId () returned 0x970 [0081.482] GetCurrentThreadId () returned 0x970 [0081.482] GetCurrentThreadId () returned 0x970 [0081.482] GetCurrentThreadId () returned 0x970 [0081.482] GetCurrentThreadId () returned 0x970 [0081.482] GetCurrentThreadId () returned 0x970 [0081.482] GetCurrentThreadId () returned 0x970 [0081.482] GetCurrentThreadId () returned 0x970 [0081.482] GetCurrentThreadId () returned 0x970 [0081.482] GetCurrentThreadId () returned 0x970 [0081.482] GetCurrentThreadId () returned 0x970 [0081.482] GetCurrentThreadId () returned 0x970 [0081.482] GetCurrentThreadId () returned 0x970 [0081.482] GetCurrentThreadId () returned 0x970 [0081.482] GetCurrentThreadId () returned 0x970 [0081.482] GetCurrentThreadId () returned 0x970 [0081.482] GetCurrentThreadId () returned 0x970 [0081.482] GetCurrentThreadId () returned 0x970 [0081.482] GetCurrentThreadId () returned 0x970 [0081.482] GetCurrentThreadId () returned 0x970 [0081.482] GetCurrentThreadId () returned 0x970 [0081.482] GetCurrentThreadId () returned 0x970 [0081.482] GetCurrentThreadId () returned 0x970 [0081.482] GetCurrentThreadId () returned 0x970 [0081.482] GetCurrentThreadId () returned 0x970 [0081.482] GetCurrentThreadId () returned 0x970 [0081.482] GetCurrentThreadId () returned 0x970 [0081.482] GetCurrentThreadId () returned 0x970 [0081.482] GetCurrentThreadId () returned 0x970 [0081.482] GetCurrentThreadId () returned 0x970 [0081.482] GetCurrentThreadId () returned 0x970 [0081.482] GetCurrentThreadId () returned 0x970 [0081.482] GetCurrentThreadId () returned 0x970 [0081.482] GetCurrentThreadId () returned 0x970 [0081.482] GetCurrentThreadId () returned 0x970 [0081.482] GetCurrentThreadId () returned 0x970 [0081.483] GetCurrentThreadId () returned 0x970 [0081.483] GetCurrentThreadId () returned 0x970 [0081.483] GetCurrentThreadId () returned 0x970 [0081.483] GetCurrentThreadId () returned 0x970 [0081.483] GetCurrentThreadId () returned 0x970 [0081.483] GetCurrentThreadId () returned 0x970 [0081.483] GetCurrentThreadId () returned 0x970 [0081.483] GetCurrentThreadId () returned 0x970 [0081.483] GetCurrentThreadId () returned 0x970 [0081.483] GetCurrentThreadId () returned 0x970 [0081.483] GetCurrentThreadId () returned 0x970 [0081.483] GetCurrentThreadId () returned 0x970 [0081.483] GetCurrentThreadId () returned 0x970 [0081.483] GetCurrentThreadId () returned 0x970 [0081.483] GetCurrentThreadId () returned 0x970 [0081.483] GetCurrentThreadId () returned 0x970 [0081.483] GetCurrentThreadId () returned 0x970 [0081.483] GetCurrentThreadId () returned 0x970 [0081.483] GetCurrentThreadId () returned 0x970 [0081.483] GetCurrentThreadId () returned 0x970 [0081.483] GetCurrentThreadId () returned 0x970 [0081.483] GetCurrentThreadId () returned 0x970 [0081.483] GetCurrentThreadId () returned 0x970 [0081.483] GetCurrentThreadId () returned 0x970 [0081.483] GetCurrentThreadId () returned 0x970 [0081.483] GetCurrentThreadId () returned 0x970 [0081.483] GetCurrentThreadId () returned 0x970 [0081.483] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAH5kPh4BGHkfgFxeyONBaq0kTLckijdQ5wqBxTXc5KuVE39iyf+fJZ0EEtP8wAXwsYLFQqtzSIRCkyquAA4gPeCUIxVJ8L0CJumFfmy+rPkPpPsI/LWZfzj2DyzC+R2OVSoQ9aRCNr7MURbaYhfyi9zhO7EVIdWWnyTOs77mundRjofekhjz2CfFAjlDJU7fbXmg388o1ElnLk8gadB0cpoe9Nsw9LiZ0A==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0081.483] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAH5kPh4BGHkfgFxeyONBaq0kTLckijdQ5wqBxTXc5KuVE39iyf+fJZ0EEtP8wAXwsYLFQqtzSIRCkyquAA4gPeCUIxVJ8L0CJumFfmy+rPkPpPsI/LWZfzj2DyzC+R2OVSoQ9aRCNr7MURbaYhfyi9zhO7EVIdWWnyTOs77mundRjofekhjz2CfFAjlDJU7fbXmg388o1ElnLk8gadB0cpoe9Nsw9LiZ0A==", cchWideChar=245, lpMultiByteStr=0x3b4d08c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAH5kPh4BGHkfgFxeyONBaq0kTLckijdQ5wqBxTXc5KuVE39iyf+fJZ0EEtP8wAXwsYLFQqtzSIRCkyquAA4gPeCUIxVJ8L0CJumFfmy+rPkPpPsI/LWZfzj2DyzC+R2OVSoQ9aRCNr7MURbaYhfyi9zhO7EVIdWWnyTOs77mundRjofekhjz2CfFAjlDJU7fbXmg388o1ElnLk8gadB0cpoe9Nsw9LiZ0A==", lpUsedDefaultChar=0x0) returned 245 [0081.483] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0081.483] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0081.484] CloseHandle (hObject=0x158) returned 1 [0081.484] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg")) returned 1 [0081.485] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=20174821607) returned 1 [0081.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [J0099189.JPG].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [j0099189.jpg].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0081.486] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0081.486] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0081.486] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0081.486] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0081.486] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0081.486] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0081.486] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0081.486] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0081.486] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0081.486] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0081.486] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0081.486] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0081.486] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0081.486] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0081.486] SetEndOfFile (hFile=0x158) returned 1 [0081.486] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0081.487] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0081.487] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0081.487] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0081.487] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0081.488] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0081.488] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3?j1v%?/w:M@Yi32bS$1Cro?uhD$M\\pd", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0081.488] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3?j1v%?/w:M@Yi32bS$1Cro?uhD$M\\pd", cchWideChar=32, lpMultiByteStr=0x203ac14, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3?j1v%?/w:M@Yi32bS$1Cro?uhD$M\\pd", lpUsedDefaultChar=0x0) returned 32 [0081.488] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0081.488] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0081.488] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x1f8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099189.JPG", cAlternateFileName="")) returned 0x295098 [0081.488] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0081.488] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0081.488] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg")) returned 0x20 [0081.489] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg")) returned 0x20 [0081.489] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg")) returned 0x20 [0081.489] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg")) returned 0x20 [0081.489] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x1f8c)) returned 1 [0081.489] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0081.489] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0081.490] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg")) returned 0x20 [0081.490] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg")) returned 0x20 [0081.490] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0081.490] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0081.490] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0081.490] SetEndOfFile (hFile=0x158) returned 1 [0081.491] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099189.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0081.491] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099189.JPG", cchWideChar=12, lpMultiByteStr=0x1fe430c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0099189.JPG", lpUsedDefaultChar=0x0) returned 12 [0081.491] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099189.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0081.491] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099189.JPG", cchWideChar=12, lpMultiByteStr=0x1fe472c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0099189.JPG", lpUsedDefaultChar=0x0) returned 12 [0081.491] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe472c, cbMultiByte=12, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="J0099189.JPGg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0081.491] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099189.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0081.491] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099189.JPG", cchWideChar=12, lpMultiByteStr=0x1fe430c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0099189.JPG", lpUsedDefaultChar=0x0) returned 12 [0081.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0081.491] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0081.491] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x1f8c [0081.491] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0081.491] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0081.492] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0081.492] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099189.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0081.492] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099189.JPG", cchWideChar=12, lpMultiByteStr=0x1fe430c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0099189.JPG", lpUsedDefaultChar=0x0) returned 12 [0081.492] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099189.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0081.492] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099189.JPG", cchWideChar=12, lpMultiByteStr=0x1fe472c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0099189.JPG", lpUsedDefaultChar=0x0) returned 12 [0081.492] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe472c, cbMultiByte=12, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="J0099189.JPG89.JPGg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0081.492] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099189.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0081.492] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099189.JPG", cchWideChar=12, lpMultiByteStr=0x1fe430c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0099189.JPG", lpUsedDefaultChar=0x0) returned 12 [0081.492] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0081.493] CharToOemA (in: pSrc="J0099189.JPG", pDst=0x1fe472c | out: pDst="J0099189.JPG") returned 1 [0081.493] WriteFile (in: hFile=0x158, lpBuffer=0x1fe472c*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe472c*, lpNumberOfBytesWritten=0x18e048*=0xc, lpOverlapped=0x0) returned 1 [0081.493] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0081.493] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0081.493] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0081.493] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=20175683052) returned 1 [0081.493] ReadFile (in: hFile=0x11c, lpBuffer=0x3b9c6d0, nNumberOfBytesToRead=0x1f8c, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b9c6d0*, lpNumberOfBytesRead=0x18dd7c*=0x1f8c, lpOverlapped=0x0) returned 1 [0081.763] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0081.764] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=20202704281) returned 1 [0081.774] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b438*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b5b438*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0081.775] ReadFile (in: hFile=0x11c, lpBuffer=0x3b9c6d0, nNumberOfBytesToRead=0x1f8c, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3b9c6d0*, lpNumberOfBytesRead=0x18de38*=0x1f8c, lpOverlapped=0x0) returned 1 [0081.775] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x47 [0081.775] WriteFile (in: hFile=0x158, lpBuffer=0x37feaf0*, nNumberOfBytesToWrite=0x1f8c, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x37feaf0*, lpNumberOfBytesWritten=0x18de10*=0x1f8c, lpOverlapped=0x0) returned 1 [0081.775] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x1fd3 [0081.775] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0081.775] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0081.775] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0081.776] SetFilePointer (in: hFile=0x158, lDistanceToMove=12, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2a [0081.776] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x1fdd [0081.776] CloseHandle (hObject=0x11c) returned 1 [0081.776] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1fdd [0081.776] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1fdd [0081.776] SetFilePointer (in: hFile=0x158, lDistanceToMove=8157, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1fdd [0081.776] SetFilePointer (in: hFile=0x158, lDistanceToMove=8157, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x1fdd [0081.776] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1fdd [0081.776] SetFilePointer (in: hFile=0x158, lDistanceToMove=8157, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x1fdd [0081.776] SetEndOfFile (hFile=0x158) returned 1 [0081.776] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1fdd [0081.776] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1fdd [0081.776] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099189.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0081.776] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099189.JPG", cchWideChar=12, lpMultiByteStr=0x1fe430c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0099189.JPG", lpUsedDefaultChar=0x0) returned 12 [0081.777] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099189.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0081.777] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099189.JPG", cchWideChar=12, lpMultiByteStr=0x1fe43ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0099189.JPG", lpUsedDefaultChar=0x0) returned 12 [0081.777] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe43ac, cbMultiByte=12, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="J0099189.JPGꞗ@涤(\x18믉`믑`") returned 12 [0081.777] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099189.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0081.777] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099189.JPG", cchWideChar=12, lpMultiByteStr=0x1fe430c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0099189.JPG", lpUsedDefaultChar=0x0) returned 12 [0081.777] WriteFile (in: hFile=0x158, lpBuffer=0x3b801a8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3b801a8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0081.777] CharToOemA (in: pSrc="J0099189.JPG", pDst=0x1fe43ac | out: pDst="J0099189.JPG") returned 1 [0081.777] WriteFile (in: hFile=0x158, lpBuffer=0x1fe43ac*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe43ac*, lpNumberOfBytesWritten=0x18efcc*=0xc, lpOverlapped=0x0) returned 1 [0081.777] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b470*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x3b5b470*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0081.777] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0081.777] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0081.777] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x2022 [0081.777] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x2022 [0081.777] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0081.778] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0081.778] DeleteFileW (lpFileName="") returned 0 [0081.778] GetLastError () returned 0x3 [0081.778] GetFileAttributesW (lpFileName="") returned 0xffffffff [0081.778] SetLastError (dwErrCode=0x3) [0081.778] FlushFileBuffers (hFile=0x158) returned 1 [0081.783] GetCurrentThreadId () returned 0x970 [0081.783] GetCurrentThreadId () returned 0x970 [0081.783] GetCurrentThreadId () returned 0x970 [0081.783] GetCurrentThreadId () returned 0x970 [0081.783] GetCurrentThreadId () returned 0x970 [0081.783] GetCurrentThreadId () returned 0x970 [0081.783] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x20d9 [0081.783] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x20d9 [0081.783] SetFilePointer (in: hFile=0x158, lDistanceToMove=8409, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x20d9 [0081.783] CloseHandle (hObject=0x158) returned 1 [0081.783] GetCurrentThreadId () returned 0x970 [0081.783] GetCurrentThreadId () returned 0x970 [0081.783] GetCurrentThreadId () returned 0x970 [0081.783] GetCurrentThreadId () returned 0x970 [0081.783] GetCurrentThreadId () returned 0x970 [0081.783] GetCurrentThreadId () returned 0x970 [0081.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [J0099189.JPG].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [j0099189.jpg].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0081.784] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x20d9 [0081.784] SetFilePointer (in: hFile=0x158, lDistanceToMove=8281, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2059 [0081.784] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0081.784] GetFileType (hFile=0x158) returned 0x1 [0081.784] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x1d, wMilliseconds=0x34)) [0081.784] GetCurrentThreadId () returned 0x970 [0081.784] GetCurrentThreadId () returned 0x970 [0081.784] GetCurrentThreadId () returned 0x970 [0081.784] GetCurrentThreadId () returned 0x970 [0081.784] GetCurrentThreadId () returned 0x970 [0081.784] GetCurrentThreadId () returned 0x970 [0081.784] GetCurrentThreadId () returned 0x970 [0081.784] GetCurrentThreadId () returned 0x970 [0081.784] GetCurrentThreadId () returned 0x970 [0081.784] GetCurrentThreadId () returned 0x970 [0081.784] GetCurrentThreadId () returned 0x970 [0081.784] GetCurrentThreadId () returned 0x970 [0081.784] GetCurrentThreadId () returned 0x970 [0081.784] GetCurrentThreadId () returned 0x970 [0081.784] GetCurrentThreadId () returned 0x970 [0081.784] GetCurrentThreadId () returned 0x970 [0081.784] GetCurrentThreadId () returned 0x970 [0081.784] GetCurrentThreadId () returned 0x970 [0081.784] GetCurrentThreadId () returned 0x970 [0081.784] GetCurrentThreadId () returned 0x970 [0081.784] GetCurrentThreadId () returned 0x970 [0081.784] GetCurrentThreadId () returned 0x970 [0081.784] GetCurrentThreadId () returned 0x970 [0081.784] GetCurrentThreadId () returned 0x970 [0081.784] GetCurrentThreadId () returned 0x970 [0081.784] GetCurrentThreadId () returned 0x970 [0081.784] GetCurrentThreadId () returned 0x970 [0081.784] GetCurrentThreadId () returned 0x970 [0081.785] GetCurrentThreadId () returned 0x970 [0081.785] GetCurrentThreadId () returned 0x970 [0081.785] GetCurrentThreadId () returned 0x970 [0081.785] GetCurrentThreadId () returned 0x970 [0081.785] GetCurrentThreadId () returned 0x970 [0081.785] GetCurrentThreadId () returned 0x970 [0081.785] GetCurrentThreadId () returned 0x970 [0081.785] GetCurrentThreadId () returned 0x970 [0081.785] GetCurrentThreadId () returned 0x970 [0081.785] GetCurrentThreadId () returned 0x970 [0081.785] GetCurrentThreadId () returned 0x970 [0081.785] GetCurrentThreadId () returned 0x970 [0081.785] GetCurrentThreadId () returned 0x970 [0081.785] GetCurrentThreadId () returned 0x970 [0081.785] GetCurrentThreadId () returned 0x970 [0081.785] GetCurrentThreadId () returned 0x970 [0081.785] GetCurrentThreadId () returned 0x970 [0081.785] GetCurrentThreadId () returned 0x970 [0081.785] GetCurrentThreadId () returned 0x970 [0081.785] GetCurrentThreadId () returned 0x970 [0081.785] GetCurrentThreadId () returned 0x970 [0081.785] GetCurrentThreadId () returned 0x970 [0081.785] GetCurrentThreadId () returned 0x970 [0081.785] GetCurrentThreadId () returned 0x970 [0081.785] GetCurrentThreadId () returned 0x970 [0081.785] GetCurrentThreadId () returned 0x970 [0081.785] GetCurrentThreadId () returned 0x970 [0081.785] GetCurrentThreadId () returned 0x970 [0081.785] GetCurrentThreadId () returned 0x970 [0081.785] GetCurrentThreadId () returned 0x970 [0081.785] GetCurrentThreadId () returned 0x970 [0081.785] GetCurrentThreadId () returned 0x970 [0081.785] GetCurrentThreadId () returned 0x970 [0081.785] GetCurrentThreadId () returned 0x970 [0081.786] GetCurrentThreadId () returned 0x970 [0081.786] GetCurrentThreadId () returned 0x970 [0081.786] GetCurrentThreadId () returned 0x970 [0081.786] GetCurrentThreadId () returned 0x970 [0081.786] GetCurrentThreadId () returned 0x970 [0081.786] GetCurrentThreadId () returned 0x970 [0081.786] GetCurrentThreadId () returned 0x970 [0081.786] GetCurrentThreadId () returned 0x970 [0081.786] GetCurrentThreadId () returned 0x970 [0081.786] GetCurrentThreadId () returned 0x970 [0081.786] GetCurrentThreadId () returned 0x970 [0081.786] GetCurrentThreadId () returned 0x970 [0081.786] GetCurrentThreadId () returned 0x970 [0081.786] GetCurrentThreadId () returned 0x970 [0081.786] GetCurrentThreadId () returned 0x970 [0081.786] GetCurrentThreadId () returned 0x970 [0081.786] GetCurrentThreadId () returned 0x970 [0081.786] GetCurrentThreadId () returned 0x970 [0081.786] GetCurrentThreadId () returned 0x970 [0081.786] GetCurrentThreadId () returned 0x970 [0081.786] GetCurrentThreadId () returned 0x970 [0081.786] GetCurrentThreadId () returned 0x970 [0081.786] GetCurrentThreadId () returned 0x970 [0081.786] GetCurrentThreadId () returned 0x970 [0081.786] GetCurrentThreadId () returned 0x970 [0081.786] GetCurrentThreadId () returned 0x970 [0081.786] GetCurrentThreadId () returned 0x970 [0081.786] GetCurrentThreadId () returned 0x970 [0081.786] GetCurrentThreadId () returned 0x970 [0081.786] GetCurrentThreadId () returned 0x970 [0081.786] GetCurrentThreadId () returned 0x970 [0081.786] GetCurrentThreadId () returned 0x970 [0081.786] GetCurrentThreadId () returned 0x970 [0081.786] GetCurrentThreadId () returned 0x970 [0081.786] GetCurrentThreadId () returned 0x970 [0081.786] GetCurrentThreadId () returned 0x970 [0081.786] GetCurrentThreadId () returned 0x970 [0081.786] GetCurrentThreadId () returned 0x970 [0081.786] GetCurrentThreadId () returned 0x970 [0081.786] GetCurrentThreadId () returned 0x970 [0081.786] GetCurrentThreadId () returned 0x970 [0081.786] GetCurrentThreadId () returned 0x970 [0081.786] GetCurrentThreadId () returned 0x970 [0081.786] GetCurrentThreadId () returned 0x970 [0081.786] GetCurrentThreadId () returned 0x970 [0081.787] GetCurrentThreadId () returned 0x970 [0081.787] GetCurrentThreadId () returned 0x970 [0081.787] GetCurrentThreadId () returned 0x970 [0081.787] GetCurrentThreadId () returned 0x970 [0081.787] GetCurrentThreadId () returned 0x970 [0081.787] GetCurrentThreadId () returned 0x970 [0081.787] GetCurrentThreadId () returned 0x970 [0081.787] GetCurrentThreadId () returned 0x970 [0081.787] GetCurrentThreadId () returned 0x970 [0081.787] GetCurrentThreadId () returned 0x970 [0081.787] GetCurrentThreadId () returned 0x970 [0081.787] GetCurrentThreadId () returned 0x970 [0081.787] GetCurrentThreadId () returned 0x970 [0081.787] GetCurrentThreadId () returned 0x970 [0081.787] GetCurrentThreadId () returned 0x970 [0081.787] GetCurrentThreadId () returned 0x970 [0081.787] GetCurrentThreadId () returned 0x970 [0081.787] GetCurrentThreadId () returned 0x970 [0081.787] GetCurrentThreadId () returned 0x970 [0081.787] GetCurrentThreadId () returned 0x970 [0081.787] GetCurrentThreadId () returned 0x970 [0081.787] GetCurrentThreadId () returned 0x970 [0081.787] GetCurrentThreadId () returned 0x970 [0081.787] GetCurrentThreadId () returned 0x970 [0081.787] GetCurrentThreadId () returned 0x970 [0081.787] GetCurrentThreadId () returned 0x970 [0081.787] GetCurrentThreadId () returned 0x970 [0081.787] GetCurrentThreadId () returned 0x970 [0081.787] GetCurrentThreadId () returned 0x970 [0081.787] GetCurrentThreadId () returned 0x970 [0081.787] GetCurrentThreadId () returned 0x970 [0081.787] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0081.787] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0081.787] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5c670, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0081.787] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0081.787] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0081.787] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5c670, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0081.787] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0081.787] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0081.787] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b530, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0081.788] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0081.788] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0081.788] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b530, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0081.788] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0081.788] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0081.788] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5c6d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0081.788] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0081.788] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0081.788] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5c6d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0081.788] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0081.788] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0081.788] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5c6d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0081.788] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x1d, wMilliseconds=0x34)) [0081.788] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="3?j1v%?/w:M@Yi32bS$1Cro?uhD$M\\pd", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0081.788] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="3?j1v%?/w:M@Yi32bS$1Cro?uhD$M\\pd", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0081.788] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="3?j1v%?/w:M@Yi32bS$1Cro?uhD$M\\pd", cchWideChar=32, lpMultiByteStr=0x3b55148, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3?j1v%?/w:M@Yi32bS$1Cro?uhD$M\\pd", lpUsedDefaultChar=0x0) returned 32 [0081.788] GetCurrentThreadId () returned 0x970 [0081.788] GetCurrentThreadId () returned 0x970 [0081.788] GetCurrentThreadId () returned 0x970 [0081.788] GetCurrentThreadId () returned 0x970 [0081.788] GetCurrentThreadId () returned 0x970 [0081.788] GetCurrentThreadId () returned 0x970 [0081.796] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0081.796] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0081.796] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3b64888, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0081.796] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0081.796] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAAffivZYvi1XIDbvMMQMgTpehOuTi0nPMuZsT3vgQU8uvzBICnNKLvlaWAT8wLHKMrN/r3zTBXeAqpTb5/facB5okW+AuQjyi/xXc260WoVGKOKIa/PIz0h1yxrwcDWINB4z7YT5wi/IVsgOXD2RGbS8U4K9aWEVVQGlN5KMn9uhCzzwwmDHOQcRRwuTJ0K9XG2cFaI8pVtQi1XaH72ebfOpgKQeJXreHQ==") returned 232 [0081.796] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x1d, wMilliseconds=0x44)) [0081.796] GetCurrentThreadId () returned 0x970 [0081.796] GetCurrentThreadId () returned 0x970 [0081.796] GetCurrentThreadId () returned 0x970 [0081.796] GetCurrentThreadId () returned 0x970 [0081.796] GetCurrentThreadId () returned 0x970 [0081.796] GetCurrentThreadId () returned 0x970 [0081.797] GetCurrentThreadId () returned 0x970 [0081.797] GetCurrentThreadId () returned 0x970 [0081.797] GetCurrentThreadId () returned 0x970 [0081.797] GetCurrentThreadId () returned 0x970 [0081.797] GetCurrentThreadId () returned 0x970 [0081.797] GetCurrentThreadId () returned 0x970 [0081.797] GetCurrentThreadId () returned 0x970 [0081.797] GetCurrentThreadId () returned 0x970 [0081.797] GetCurrentThreadId () returned 0x970 [0081.797] GetCurrentThreadId () returned 0x970 [0081.797] GetCurrentThreadId () returned 0x970 [0081.797] GetCurrentThreadId () returned 0x970 [0081.797] GetCurrentThreadId () returned 0x970 [0081.797] GetCurrentThreadId () returned 0x970 [0081.797] GetCurrentThreadId () returned 0x970 [0081.797] GetCurrentThreadId () returned 0x970 [0081.797] GetCurrentThreadId () returned 0x970 [0081.797] GetCurrentThreadId () returned 0x970 [0081.797] GetCurrentThreadId () returned 0x970 [0081.797] GetCurrentThreadId () returned 0x970 [0081.797] GetCurrentThreadId () returned 0x970 [0081.797] GetCurrentThreadId () returned 0x970 [0081.797] GetCurrentThreadId () returned 0x970 [0081.797] GetCurrentThreadId () returned 0x970 [0081.797] GetCurrentThreadId () returned 0x970 [0081.797] GetCurrentThreadId () returned 0x970 [0081.797] GetCurrentThreadId () returned 0x970 [0081.797] GetCurrentThreadId () returned 0x970 [0081.797] GetCurrentThreadId () returned 0x970 [0081.797] GetCurrentThreadId () returned 0x970 [0081.797] GetCurrentThreadId () returned 0x970 [0081.797] GetCurrentThreadId () returned 0x970 [0081.797] GetCurrentThreadId () returned 0x970 [0081.797] GetCurrentThreadId () returned 0x970 [0081.797] GetCurrentThreadId () returned 0x970 [0081.797] GetCurrentThreadId () returned 0x970 [0081.797] GetCurrentThreadId () returned 0x970 [0081.797] GetCurrentThreadId () returned 0x970 [0081.797] GetCurrentThreadId () returned 0x970 [0081.797] GetCurrentThreadId () returned 0x970 [0081.797] GetCurrentThreadId () returned 0x970 [0081.797] GetCurrentThreadId () returned 0x970 [0081.797] GetCurrentThreadId () returned 0x970 [0081.797] GetCurrentThreadId () returned 0x970 [0081.798] GetCurrentThreadId () returned 0x970 [0081.798] GetCurrentThreadId () returned 0x970 [0081.798] GetCurrentThreadId () returned 0x970 [0081.798] GetCurrentThreadId () returned 0x970 [0081.798] GetCurrentThreadId () returned 0x970 [0081.798] GetCurrentThreadId () returned 0x970 [0081.798] GetCurrentThreadId () returned 0x970 [0081.798] GetCurrentThreadId () returned 0x970 [0081.798] GetCurrentThreadId () returned 0x970 [0081.798] GetCurrentThreadId () returned 0x970 [0081.798] GetCurrentThreadId () returned 0x970 [0081.798] GetCurrentThreadId () returned 0x970 [0081.798] GetCurrentThreadId () returned 0x970 [0081.798] GetCurrentThreadId () returned 0x970 [0081.798] GetCurrentThreadId () returned 0x970 [0081.798] GetCurrentThreadId () returned 0x970 [0081.798] GetCurrentThreadId () returned 0x970 [0081.798] GetCurrentThreadId () returned 0x970 [0081.798] GetCurrentThreadId () returned 0x970 [0081.798] GetCurrentThreadId () returned 0x970 [0081.798] GetCurrentThreadId () returned 0x970 [0081.798] GetCurrentThreadId () returned 0x970 [0081.798] GetCurrentThreadId () returned 0x970 [0081.798] GetCurrentThreadId () returned 0x970 [0081.798] GetCurrentThreadId () returned 0x970 [0081.798] GetCurrentThreadId () returned 0x970 [0081.798] GetCurrentThreadId () returned 0x970 [0081.798] GetCurrentThreadId () returned 0x970 [0081.798] GetCurrentThreadId () returned 0x970 [0081.798] GetCurrentThreadId () returned 0x970 [0081.798] GetCurrentThreadId () returned 0x970 [0081.798] GetCurrentThreadId () returned 0x970 [0081.798] GetCurrentThreadId () returned 0x970 [0081.798] GetCurrentThreadId () returned 0x970 [0081.798] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAAffivZYvi1XIDbvMMQMgTpehOuTi0nPMuZsT3vgQU8uvzBICnNKLvlaWAT8wLHKMrN/r3zTBXeAqpTb5/facB5okW+AuQjyi/xXc260WoVGKOKIa/PIz0h1yxrwcDWINB4z7YT5wi/IVsgOXD2RGbS8U4K9aWEVVQGlN5KMn9uhCzzwwmDHOQcRRwuTJ0K9XG2cFaI8pVtQi1XaH72ebfOpgKQeJXreHQ==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0081.798] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAAffivZYvi1XIDbvMMQMgTpehOuTi0nPMuZsT3vgQU8uvzBICnNKLvlaWAT8wLHKMrN/r3zTBXeAqpTb5/facB5okW+AuQjyi/xXc260WoVGKOKIa/PIz0h1yxrwcDWINB4z7YT5wi/IVsgOXD2RGbS8U4K9aWEVVQGlN5KMn9uhCzzwwmDHOQcRRwuTJ0K9XG2cFaI8pVtQi1XaH72ebfOpgKQeJXreHQ==", cchWideChar=245, lpMultiByteStr=0x3b4d08c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAAffivZYvi1XIDbvMMQMgTpehOuTi0nPMuZsT3vgQU8uvzBICnNKLvlaWAT8wLHKMrN/r3zTBXeAqpTb5/facB5okW+AuQjyi/xXc260WoVGKOKIa/PIz0h1yxrwcDWINB4z7YT5wi/IVsgOXD2RGbS8U4K9aWEVVQGlN5KMn9uhCzzwwmDHOQcRRwuTJ0K9XG2cFaI8pVtQi1XaH72ebfOpgKQeJXreHQ==", lpUsedDefaultChar=0x0) returned 245 [0081.798] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0081.799] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0081.799] CloseHandle (hObject=0x158) returned 1 [0081.799] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg")) returned 1 [0081.800] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=20206327723) returned 1 [0081.800] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [J0099190.JPG].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [j0099190.jpg].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0081.800] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0081.800] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0081.801] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0081.801] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0081.801] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0081.801] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0081.801] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0081.801] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0081.801] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0081.801] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0081.801] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0081.801] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0081.801] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0081.801] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0081.801] SetEndOfFile (hFile=0x158) returned 1 [0081.801] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0081.801] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0081.801] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0081.802] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0081.802] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0081.802] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0081.803] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="W%cK6m:BcL\\{~Vesi&iB\"4*Oq-*8D4{@", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0081.803] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="W%cK6m:BcL\\{~Vesi&iB\"4*Oq-*8D4{@", cchWideChar=32, lpMultiByteStr=0x203ac4c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="W%cK6m:BcL\\{~Vesi&iB\"4*Oq-*8D4{@", lpUsedDefaultChar=0x0) returned 32 [0081.803] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0081.803] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0081.803] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xab74, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099190.JPG", cAlternateFileName="")) returned 0x295098 [0081.803] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0081.803] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0081.803] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg")) returned 0x20 [0081.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg")) returned 0x20 [0081.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg")) returned 0x20 [0081.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg")) returned 0x20 [0081.804] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xab74)) returned 1 [0081.804] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0081.804] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0081.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg")) returned 0x20 [0081.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg")) returned 0x20 [0081.804] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0081.804] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0081.804] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0081.804] SetEndOfFile (hFile=0x158) returned 1 [0081.805] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099190.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0081.805] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099190.JPG", cchWideChar=12, lpMultiByteStr=0x1fe3c4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0099190.JPG", lpUsedDefaultChar=0x0) returned 12 [0081.805] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099190.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0081.805] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099190.JPG", cchWideChar=12, lpMultiByteStr=0x1fe484c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0099190.JPG", lpUsedDefaultChar=0x0) returned 12 [0081.805] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe484c, cbMultiByte=12, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="J0099190.JPGg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0081.806] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099190.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0081.806] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099190.JPG", cchWideChar=12, lpMultiByteStr=0x1fe3c4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0099190.JPG", lpUsedDefaultChar=0x0) returned 12 [0081.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0081.806] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0081.806] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0xab74 [0081.806] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0081.806] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0081.806] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0081.806] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099190.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0081.806] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099190.JPG", cchWideChar=12, lpMultiByteStr=0x1fe3c4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0099190.JPG", lpUsedDefaultChar=0x0) returned 12 [0081.806] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099190.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0081.806] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099190.JPG", cchWideChar=12, lpMultiByteStr=0x1fe484c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0099190.JPG", lpUsedDefaultChar=0x0) returned 12 [0081.806] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe484c, cbMultiByte=12, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="J0099190.JPG90.JPGg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0081.807] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099190.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0081.807] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099190.JPG", cchWideChar=12, lpMultiByteStr=0x1fe3c4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0099190.JPG", lpUsedDefaultChar=0x0) returned 12 [0081.807] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0081.807] CharToOemA (in: pSrc="J0099190.JPG", pDst=0x1fe484c | out: pDst="J0099190.JPG") returned 1 [0081.807] WriteFile (in: hFile=0x158, lpBuffer=0x1fe484c*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe484c*, lpNumberOfBytesWritten=0x18e048*=0xc, lpOverlapped=0x0) returned 1 [0081.808] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0081.808] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0081.808] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0081.808] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=20207128377) returned 1 [0081.808] ReadFile (in: hFile=0x11c, lpBuffer=0x37bea30, nNumberOfBytesToRead=0xab74, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37bea30*, lpNumberOfBytesRead=0x18dd7c*=0xab74, lpOverlapped=0x0) returned 1 [0081.985] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0081.985] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=20224836467) returned 1 [0081.994] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b420*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b5b420*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0081.994] ReadFile (in: hFile=0x11c, lpBuffer=0x37bea30, nNumberOfBytesToRead=0xab74, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x37bea30*, lpNumberOfBytesRead=0x18de38*=0xab74, lpOverlapped=0x0) returned 1 [0081.996] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x47 [0081.996] WriteFile (in: hFile=0x158, lpBuffer=0x3809720*, nNumberOfBytesToWrite=0xab74, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3809720*, lpNumberOfBytesWritten=0x18de10*=0xab74, lpOverlapped=0x0) returned 1 [0081.997] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0xabbb [0081.997] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0081.997] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0081.997] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0081.997] SetFilePointer (in: hFile=0x158, lDistanceToMove=12, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2a [0081.997] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0xabc5 [0081.997] CloseHandle (hObject=0x11c) returned 1 [0081.997] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xabc5 [0081.997] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xabc5 [0081.998] SetFilePointer (in: hFile=0x158, lDistanceToMove=43973, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xabc5 [0081.998] SetFilePointer (in: hFile=0x158, lDistanceToMove=43973, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0xabc5 [0081.998] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xabc5 [0081.998] SetFilePointer (in: hFile=0x158, lDistanceToMove=43973, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0xabc5 [0081.998] SetEndOfFile (hFile=0x158) returned 1 [0081.998] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xabc5 [0081.998] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xabc5 [0081.998] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099190.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0081.998] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099190.JPG", cchWideChar=12, lpMultiByteStr=0x1fe3c4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0099190.JPG", lpUsedDefaultChar=0x0) returned 12 [0081.998] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099190.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0081.998] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099190.JPG", cchWideChar=12, lpMultiByteStr=0x1fe3a2c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0099190.JPG", lpUsedDefaultChar=0x0) returned 12 [0081.998] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe3a2c, cbMultiByte=12, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="J0099190.JPGꞗ@涤(\x18믉`믑`") returned 12 [0081.998] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099190.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0081.998] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099190.JPG", cchWideChar=12, lpMultiByteStr=0x1fe3c4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0099190.JPG", lpUsedDefaultChar=0x0) returned 12 [0081.998] WriteFile (in: hFile=0x158, lpBuffer=0x3b801a8*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3b801a8*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0081.998] CharToOemA (in: pSrc="J0099190.JPG", pDst=0x1fe3a2c | out: pDst="J0099190.JPG") returned 1 [0081.998] WriteFile (in: hFile=0x158, lpBuffer=0x1fe3a2c*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe3a2c*, lpNumberOfBytesWritten=0x18efcc*=0xc, lpOverlapped=0x0) returned 1 [0081.999] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b350*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x3b5b350*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0081.999] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0081.999] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0081.999] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xac0a [0081.999] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xac0a [0081.999] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0081.999] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0081.999] DeleteFileW (lpFileName="") returned 0 [0081.999] GetLastError () returned 0x3 [0081.999] GetFileAttributesW (lpFileName="") returned 0xffffffff [0081.999] SetLastError (dwErrCode=0x3) [0081.999] FlushFileBuffers (hFile=0x158) returned 1 [0082.035] GetCurrentThreadId () returned 0x970 [0082.035] GetCurrentThreadId () returned 0x970 [0082.035] GetCurrentThreadId () returned 0x970 [0082.035] GetCurrentThreadId () returned 0x970 [0082.036] GetCurrentThreadId () returned 0x970 [0082.036] GetCurrentThreadId () returned 0x970 [0082.036] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xacc1 [0082.036] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xacc1 [0082.036] SetFilePointer (in: hFile=0x158, lDistanceToMove=44225, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xacc1 [0082.036] CloseHandle (hObject=0x158) returned 1 [0082.036] GetCurrentThreadId () returned 0x970 [0082.036] GetCurrentThreadId () returned 0x970 [0082.036] GetCurrentThreadId () returned 0x970 [0082.036] GetCurrentThreadId () returned 0x970 [0082.036] GetCurrentThreadId () returned 0x970 [0082.036] GetCurrentThreadId () returned 0x970 [0082.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [J0099190.JPG].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [j0099190.jpg].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0082.037] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xacc1 [0082.037] SetFilePointer (in: hFile=0x158, lDistanceToMove=44097, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xac41 [0082.037] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0082.037] GetFileType (hFile=0x158) returned 0x1 [0082.037] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x1d, wMilliseconds=0x12e)) [0082.037] GetCurrentThreadId () returned 0x970 [0082.037] GetCurrentThreadId () returned 0x970 [0082.037] GetCurrentThreadId () returned 0x970 [0082.037] GetCurrentThreadId () returned 0x970 [0082.037] GetCurrentThreadId () returned 0x970 [0082.037] GetCurrentThreadId () returned 0x970 [0082.037] GetCurrentThreadId () returned 0x970 [0082.037] GetCurrentThreadId () returned 0x970 [0082.037] GetCurrentThreadId () returned 0x970 [0082.037] GetCurrentThreadId () returned 0x970 [0082.037] GetCurrentThreadId () returned 0x970 [0082.037] GetCurrentThreadId () returned 0x970 [0082.037] GetCurrentThreadId () returned 0x970 [0082.037] GetCurrentThreadId () returned 0x970 [0082.037] GetCurrentThreadId () returned 0x970 [0082.037] GetCurrentThreadId () returned 0x970 [0082.037] GetCurrentThreadId () returned 0x970 [0082.037] GetCurrentThreadId () returned 0x970 [0082.037] GetCurrentThreadId () returned 0x970 [0082.037] GetCurrentThreadId () returned 0x970 [0082.037] GetCurrentThreadId () returned 0x970 [0082.037] GetCurrentThreadId () returned 0x970 [0082.037] GetCurrentThreadId () returned 0x970 [0082.037] GetCurrentThreadId () returned 0x970 [0082.037] GetCurrentThreadId () returned 0x970 [0082.037] GetCurrentThreadId () returned 0x970 [0082.037] GetCurrentThreadId () returned 0x970 [0082.037] GetCurrentThreadId () returned 0x970 [0082.037] GetCurrentThreadId () returned 0x970 [0082.037] GetCurrentThreadId () returned 0x970 [0082.038] GetCurrentThreadId () returned 0x970 [0082.038] GetCurrentThreadId () returned 0x970 [0082.038] GetCurrentThreadId () returned 0x970 [0082.038] GetCurrentThreadId () returned 0x970 [0082.038] GetCurrentThreadId () returned 0x970 [0082.038] GetCurrentThreadId () returned 0x970 [0082.038] GetCurrentThreadId () returned 0x970 [0082.038] GetCurrentThreadId () returned 0x970 [0082.038] GetCurrentThreadId () returned 0x970 [0082.038] GetCurrentThreadId () returned 0x970 [0082.038] GetCurrentThreadId () returned 0x970 [0082.038] GetCurrentThreadId () returned 0x970 [0082.038] GetCurrentThreadId () returned 0x970 [0082.038] GetCurrentThreadId () returned 0x970 [0082.038] GetCurrentThreadId () returned 0x970 [0082.038] GetCurrentThreadId () returned 0x970 [0082.038] GetCurrentThreadId () returned 0x970 [0082.038] GetCurrentThreadId () returned 0x970 [0082.038] GetCurrentThreadId () returned 0x970 [0082.038] GetCurrentThreadId () returned 0x970 [0082.038] GetCurrentThreadId () returned 0x970 [0082.038] GetCurrentThreadId () returned 0x970 [0082.038] GetCurrentThreadId () returned 0x970 [0082.038] GetCurrentThreadId () returned 0x970 [0082.038] GetCurrentThreadId () returned 0x970 [0082.038] GetCurrentThreadId () returned 0x970 [0082.038] GetCurrentThreadId () returned 0x970 [0082.038] GetCurrentThreadId () returned 0x970 [0082.038] GetCurrentThreadId () returned 0x970 [0082.038] GetCurrentThreadId () returned 0x970 [0082.038] GetCurrentThreadId () returned 0x970 [0082.038] GetCurrentThreadId () returned 0x970 [0082.038] GetCurrentThreadId () returned 0x970 [0082.038] GetCurrentThreadId () returned 0x970 [0082.038] GetCurrentThreadId () returned 0x970 [0082.038] GetCurrentThreadId () returned 0x970 [0082.038] GetCurrentThreadId () returned 0x970 [0082.038] GetCurrentThreadId () returned 0x970 [0082.038] GetCurrentThreadId () returned 0x970 [0082.038] GetCurrentThreadId () returned 0x970 [0082.038] GetCurrentThreadId () returned 0x970 [0082.038] GetCurrentThreadId () returned 0x970 [0082.039] GetCurrentThreadId () returned 0x970 [0082.039] GetCurrentThreadId () returned 0x970 [0082.039] GetCurrentThreadId () returned 0x970 [0082.039] GetCurrentThreadId () returned 0x970 [0082.039] GetCurrentThreadId () returned 0x970 [0082.039] GetCurrentThreadId () returned 0x970 [0082.039] GetCurrentThreadId () returned 0x970 [0082.039] GetCurrentThreadId () returned 0x970 [0082.039] GetCurrentThreadId () returned 0x970 [0082.039] GetCurrentThreadId () returned 0x970 [0082.039] GetCurrentThreadId () returned 0x970 [0082.039] GetCurrentThreadId () returned 0x970 [0082.039] GetCurrentThreadId () returned 0x970 [0082.039] GetCurrentThreadId () returned 0x970 [0082.039] GetCurrentThreadId () returned 0x970 [0082.039] GetCurrentThreadId () returned 0x970 [0082.039] GetCurrentThreadId () returned 0x970 [0082.039] GetCurrentThreadId () returned 0x970 [0082.039] GetCurrentThreadId () returned 0x970 [0082.039] GetCurrentThreadId () returned 0x970 [0082.039] GetCurrentThreadId () returned 0x970 [0082.039] GetCurrentThreadId () returned 0x970 [0082.039] GetCurrentThreadId () returned 0x970 [0082.039] GetCurrentThreadId () returned 0x970 [0082.039] GetCurrentThreadId () returned 0x970 [0082.039] GetCurrentThreadId () returned 0x970 [0082.039] GetCurrentThreadId () returned 0x970 [0082.039] GetCurrentThreadId () returned 0x970 [0082.039] GetCurrentThreadId () returned 0x970 [0082.039] GetCurrentThreadId () returned 0x970 [0082.039] GetCurrentThreadId () returned 0x970 [0082.039] GetCurrentThreadId () returned 0x970 [0082.039] GetCurrentThreadId () returned 0x970 [0082.039] GetCurrentThreadId () returned 0x970 [0082.039] GetCurrentThreadId () returned 0x970 [0082.039] GetCurrentThreadId () returned 0x970 [0082.039] GetCurrentThreadId () returned 0x970 [0082.039] GetCurrentThreadId () returned 0x970 [0082.039] GetCurrentThreadId () returned 0x970 [0082.039] GetCurrentThreadId () returned 0x970 [0082.039] GetCurrentThreadId () returned 0x970 [0082.039] GetCurrentThreadId () returned 0x970 [0082.039] GetCurrentThreadId () returned 0x970 [0082.039] GetCurrentThreadId () returned 0x970 [0082.040] GetCurrentThreadId () returned 0x970 [0082.040] GetCurrentThreadId () returned 0x970 [0082.040] GetCurrentThreadId () returned 0x970 [0082.040] GetCurrentThreadId () returned 0x970 [0082.040] GetCurrentThreadId () returned 0x970 [0082.040] GetCurrentThreadId () returned 0x970 [0082.040] GetCurrentThreadId () returned 0x970 [0082.040] GetCurrentThreadId () returned 0x970 [0082.040] GetCurrentThreadId () returned 0x970 [0082.040] GetCurrentThreadId () returned 0x970 [0082.040] GetCurrentThreadId () returned 0x970 [0082.040] GetCurrentThreadId () returned 0x970 [0082.040] GetCurrentThreadId () returned 0x970 [0082.040] GetCurrentThreadId () returned 0x970 [0082.040] GetCurrentThreadId () returned 0x970 [0082.040] GetCurrentThreadId () returned 0x970 [0082.040] GetCurrentThreadId () returned 0x970 [0082.040] GetCurrentThreadId () returned 0x970 [0082.040] GetCurrentThreadId () returned 0x970 [0082.040] GetCurrentThreadId () returned 0x970 [0082.040] GetCurrentThreadId () returned 0x970 [0082.040] GetCurrentThreadId () returned 0x970 [0082.040] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0082.040] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0082.040] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5c6d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0082.040] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0082.040] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0082.040] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5c6d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0082.040] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0082.040] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0082.040] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b548, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0082.040] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0082.040] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0082.040] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b548, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0082.040] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0082.040] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0082.040] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5c730, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0082.040] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0082.041] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0082.041] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5c730, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0082.041] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0082.041] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0082.041] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5c730, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0082.041] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x1d, wMilliseconds=0x13e)) [0082.041] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="W%cK6m:BcL\\{~Vesi&iB\"4*Oq-*8D4{@", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0082.041] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="W%cK6m:BcL\\{~Vesi&iB\"4*Oq-*8D4{@", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0082.041] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="W%cK6m:BcL\\{~Vesi&iB\"4*Oq-*8D4{@", cchWideChar=32, lpMultiByteStr=0x3b55178, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="W%cK6m:BcL\\{~Vesi&iB\"4*Oq-*8D4{@", lpUsedDefaultChar=0x0) returned 32 [0082.041] GetCurrentThreadId () returned 0x970 [0082.041] GetCurrentThreadId () returned 0x970 [0082.041] GetCurrentThreadId () returned 0x970 [0082.041] GetCurrentThreadId () returned 0x970 [0082.041] GetCurrentThreadId () returned 0x970 [0082.041] GetCurrentThreadId () returned 0x970 [0082.048] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0082.048] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0082.048] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3b64978, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0082.048] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0082.049] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAGhY1v5vTOv/yUVLuxFxH10uNvMrhk5IkwuwoijAzMbFVaeKtd6dO2YBKM37CN5YrD0lABevijg7EXILrmkIYVyWrOZLHd5ZE1K28YMUbhgsA9nv6VaFloA85ggsSLUcr7yCiucMORsuUqxQRoJEXiIm9PjomVnGfprO+Qwu+x84anVcUENRgOATGU6gAXeLgr/AUlY6UBHtCkmTCXaEWaLUDNDJEVLsSw==") returned 232 [0082.049] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x1d, wMilliseconds=0x13e)) [0082.049] GetCurrentThreadId () returned 0x970 [0082.049] GetCurrentThreadId () returned 0x970 [0082.049] GetCurrentThreadId () returned 0x970 [0082.049] GetCurrentThreadId () returned 0x970 [0082.049] GetCurrentThreadId () returned 0x970 [0082.049] GetCurrentThreadId () returned 0x970 [0082.049] GetCurrentThreadId () returned 0x970 [0082.049] GetCurrentThreadId () returned 0x970 [0082.049] GetCurrentThreadId () returned 0x970 [0082.049] GetCurrentThreadId () returned 0x970 [0082.049] GetCurrentThreadId () returned 0x970 [0082.049] GetCurrentThreadId () returned 0x970 [0082.049] GetCurrentThreadId () returned 0x970 [0082.049] GetCurrentThreadId () returned 0x970 [0082.049] GetCurrentThreadId () returned 0x970 [0082.049] GetCurrentThreadId () returned 0x970 [0082.049] GetCurrentThreadId () returned 0x970 [0082.049] GetCurrentThreadId () returned 0x970 [0082.049] GetCurrentThreadId () returned 0x970 [0082.049] GetCurrentThreadId () returned 0x970 [0082.049] GetCurrentThreadId () returned 0x970 [0082.049] GetCurrentThreadId () returned 0x970 [0082.049] GetCurrentThreadId () returned 0x970 [0082.049] GetCurrentThreadId () returned 0x970 [0082.049] GetCurrentThreadId () returned 0x970 [0082.049] GetCurrentThreadId () returned 0x970 [0082.049] GetCurrentThreadId () returned 0x970 [0082.049] GetCurrentThreadId () returned 0x970 [0082.049] GetCurrentThreadId () returned 0x970 [0082.049] GetCurrentThreadId () returned 0x970 [0082.049] GetCurrentThreadId () returned 0x970 [0082.049] GetCurrentThreadId () returned 0x970 [0082.049] GetCurrentThreadId () returned 0x970 [0082.049] GetCurrentThreadId () returned 0x970 [0082.049] GetCurrentThreadId () returned 0x970 [0082.049] GetCurrentThreadId () returned 0x970 [0082.049] GetCurrentThreadId () returned 0x970 [0082.049] GetCurrentThreadId () returned 0x970 [0082.049] GetCurrentThreadId () returned 0x970 [0082.049] GetCurrentThreadId () returned 0x970 [0082.050] GetCurrentThreadId () returned 0x970 [0082.050] GetCurrentThreadId () returned 0x970 [0082.050] GetCurrentThreadId () returned 0x970 [0082.050] GetCurrentThreadId () returned 0x970 [0082.050] GetCurrentThreadId () returned 0x970 [0082.050] GetCurrentThreadId () returned 0x970 [0082.050] GetCurrentThreadId () returned 0x970 [0082.050] GetCurrentThreadId () returned 0x970 [0082.050] GetCurrentThreadId () returned 0x970 [0082.050] GetCurrentThreadId () returned 0x970 [0082.050] GetCurrentThreadId () returned 0x970 [0082.050] GetCurrentThreadId () returned 0x970 [0082.050] GetCurrentThreadId () returned 0x970 [0082.050] GetCurrentThreadId () returned 0x970 [0082.050] GetCurrentThreadId () returned 0x970 [0082.050] GetCurrentThreadId () returned 0x970 [0082.050] GetCurrentThreadId () returned 0x970 [0082.050] GetCurrentThreadId () returned 0x970 [0082.050] GetCurrentThreadId () returned 0x970 [0082.050] GetCurrentThreadId () returned 0x970 [0082.050] GetCurrentThreadId () returned 0x970 [0082.050] GetCurrentThreadId () returned 0x970 [0082.050] GetCurrentThreadId () returned 0x970 [0082.050] GetCurrentThreadId () returned 0x970 [0082.050] GetCurrentThreadId () returned 0x970 [0082.050] GetCurrentThreadId () returned 0x970 [0082.050] GetCurrentThreadId () returned 0x970 [0082.050] GetCurrentThreadId () returned 0x970 [0082.050] GetCurrentThreadId () returned 0x970 [0082.050] GetCurrentThreadId () returned 0x970 [0082.050] GetCurrentThreadId () returned 0x970 [0082.050] GetCurrentThreadId () returned 0x970 [0082.050] GetCurrentThreadId () returned 0x970 [0082.050] GetCurrentThreadId () returned 0x970 [0082.050] GetCurrentThreadId () returned 0x970 [0082.050] GetCurrentThreadId () returned 0x970 [0082.050] GetCurrentThreadId () returned 0x970 [0082.050] GetCurrentThreadId () returned 0x970 [0082.050] GetCurrentThreadId () returned 0x970 [0082.050] GetCurrentThreadId () returned 0x970 [0082.050] GetCurrentThreadId () returned 0x970 [0082.050] GetCurrentThreadId () returned 0x970 [0082.050] GetCurrentThreadId () returned 0x970 [0082.050] GetCurrentThreadId () returned 0x970 [0082.050] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAGhY1v5vTOv/yUVLuxFxH10uNvMrhk5IkwuwoijAzMbFVaeKtd6dO2YBKM37CN5YrD0lABevijg7EXILrmkIYVyWrOZLHd5ZE1K28YMUbhgsA9nv6VaFloA85ggsSLUcr7yCiucMORsuUqxQRoJEXiIm9PjomVnGfprO+Qwu+x84anVcUENRgOATGU6gAXeLgr/AUlY6UBHtCkmTCXaEWaLUDNDJEVLsSw==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0082.051] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAGhY1v5vTOv/yUVLuxFxH10uNvMrhk5IkwuwoijAzMbFVaeKtd6dO2YBKM37CN5YrD0lABevijg7EXILrmkIYVyWrOZLHd5ZE1K28YMUbhgsA9nv6VaFloA85ggsSLUcr7yCiucMORsuUqxQRoJEXiIm9PjomVnGfprO+Qwu+x84anVcUENRgOATGU6gAXeLgr/AUlY6UBHtCkmTCXaEWaLUDNDJEVLsSw==", cchWideChar=245, lpMultiByteStr=0x3b4d08c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAGhY1v5vTOv/yUVLuxFxH10uNvMrhk5IkwuwoijAzMbFVaeKtd6dO2YBKM37CN5YrD0lABevijg7EXILrmkIYVyWrOZLHd5ZE1K28YMUbhgsA9nv6VaFloA85ggsSLUcr7yCiucMORsuUqxQRoJEXiIm9PjomVnGfprO+Qwu+x84anVcUENRgOATGU6gAXeLgr/AUlY6UBHtCkmTCXaEWaLUDNDJEVLsSw==", lpUsedDefaultChar=0x0) returned 245 [0082.051] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0082.051] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0082.051] CloseHandle (hObject=0x158) returned 1 [0082.051] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg")) returned 1 [0082.052] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=20231561667) returned 1 [0082.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [J0099191.JPG].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [j0099191.jpg].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0082.053] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0082.053] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0082.053] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0082.053] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0082.053] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0082.053] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0082.053] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0082.053] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0082.053] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0082.053] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0082.054] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0082.054] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0082.054] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0082.054] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0082.054] SetEndOfFile (hFile=0x158) returned 1 [0082.054] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0082.054] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0082.054] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0082.054] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0082.054] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0082.055] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0082.055] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3U-7HX6X)84afuc)&@b^6dPA#,*g", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0085.934] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v23MVamC)i(\"Y#JB@nw\"{ZXCcWU>#,*g", cchWideChar=32, lpMultiByteStr=0x203beac, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="v23MVamC)i(\"Y#JB@nw\"{ZXCcWU>#,*g", lpUsedDefaultChar=0x0) returned 32 [0085.934] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0085.934] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0085.934] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3260, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0337280.JPG", cAlternateFileName="")) returned 0x295098 [0085.934] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0085.934] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0085.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0337280.jpg")) returned 0x20 [0085.935] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0337280.jpg")) returned 0x20 [0085.935] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0337280.jpg")) returned 0x20 [0085.935] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0337280.jpg")) returned 0x20 [0085.936] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0337280.jpg"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3260)) returned 1 [0085.936] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0085.936] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0085.936] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0337280.jpg")) returned 0x20 [0085.936] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0337280.jpg")) returned 0x20 [0085.936] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0085.936] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0085.936] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0085.936] SetEndOfFile (hFile=0x158) returned 1 [0085.937] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0337280.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0085.937] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0337280.JPG", cchWideChar=12, lpMultiByteStr=0x1fe3c4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0337280.JPG", lpUsedDefaultChar=0x0) returned 12 [0085.937] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0337280.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0085.937] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0337280.JPG", cchWideChar=12, lpMultiByteStr=0x1fe35ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0337280.JPG", lpUsedDefaultChar=0x0) returned 12 [0085.937] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe35ac, cbMultiByte=12, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="J0337280.JPGg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0085.937] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0337280.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0085.937] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0337280.JPG", cchWideChar=12, lpMultiByteStr=0x1fe3c4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0337280.JPG", lpUsedDefaultChar=0x0) returned 12 [0085.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0337280.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0085.938] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0085.938] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x3260 [0085.938] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0085.938] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0085.938] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0085.938] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0337280.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0085.938] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0337280.JPG", cchWideChar=12, lpMultiByteStr=0x1fe3c4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0337280.JPG", lpUsedDefaultChar=0x0) returned 12 [0085.938] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0337280.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0085.938] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0337280.JPG", cchWideChar=12, lpMultiByteStr=0x1fe35ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0337280.JPG", lpUsedDefaultChar=0x0) returned 12 [0085.938] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe35ac, cbMultiByte=12, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="J0337280.JPG80.JPGg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0085.938] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0337280.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0085.938] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0337280.JPG", cchWideChar=12, lpMultiByteStr=0x1fe3c4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0337280.JPG", lpUsedDefaultChar=0x0) returned 12 [0085.938] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0085.939] CharToOemA (in: pSrc="J0337280.JPG", pDst=0x1fe35ac | out: pDst="J0337280.JPG") returned 1 [0085.939] WriteFile (in: hFile=0x158, lpBuffer=0x1fe35ac*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe35ac*, lpNumberOfBytesWritten=0x18e048*=0xc, lpOverlapped=0x0) returned 1 [0085.939] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0085.939] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0085.939] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0085.939] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=20620292615) returned 1 [0085.940] ReadFile (in: hFile=0x11c, lpBuffer=0x3b95a30, nNumberOfBytesToRead=0x3260, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b95a30*, lpNumberOfBytesRead=0x18dd7c*=0x3260, lpOverlapped=0x0) returned 1 [0085.941] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0085.941] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=20620484401) returned 1 [0085.950] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b438*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b5b438*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0085.950] ReadFile (in: hFile=0x11c, lpBuffer=0x3b95a30, nNumberOfBytesToRead=0x3260, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3b95a30*, lpNumberOfBytesRead=0x18de38*=0x3260, lpOverlapped=0x0) returned 1 [0085.951] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x47 [0085.951] WriteFile (in: hFile=0x158, lpBuffer=0x3b9a490*, nNumberOfBytesToWrite=0x3260, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3b9a490*, lpNumberOfBytesWritten=0x18de10*=0x3260, lpOverlapped=0x0) returned 1 [0085.951] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x32a7 [0085.951] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0085.951] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0085.951] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0085.951] SetFilePointer (in: hFile=0x158, lDistanceToMove=12, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2a [0085.951] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x32b1 [0085.952] CloseHandle (hObject=0x11c) returned 1 [0085.952] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x32b1 [0085.952] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x32b1 [0085.952] SetFilePointer (in: hFile=0x158, lDistanceToMove=12977, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x32b1 [0085.952] SetFilePointer (in: hFile=0x158, lDistanceToMove=12977, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x32b1 [0085.952] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x32b1 [0085.952] SetFilePointer (in: hFile=0x158, lDistanceToMove=12977, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x32b1 [0085.952] SetEndOfFile (hFile=0x158) returned 1 [0085.952] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x32b1 [0085.952] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x32b1 [0085.952] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0337280.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0085.952] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0337280.JPG", cchWideChar=12, lpMultiByteStr=0x1fe3c4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0337280.JPG", lpUsedDefaultChar=0x0) returned 12 [0085.952] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0337280.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0085.952] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0337280.JPG", cchWideChar=12, lpMultiByteStr=0x1fe3a2c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0337280.JPG", lpUsedDefaultChar=0x0) returned 12 [0085.952] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe3a2c, cbMultiByte=12, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="J0337280.JPGꞗ@涤(\x18믉`믑`") returned 12 [0085.952] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0337280.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0085.953] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0337280.JPG", cchWideChar=12, lpMultiByteStr=0x1fe3c4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0337280.JPG", lpUsedDefaultChar=0x0) returned 12 [0085.953] WriteFile (in: hFile=0x158, lpBuffer=0x37bea38*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x37bea38*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0085.953] CharToOemA (in: pSrc="J0337280.JPG", pDst=0x1fe3a2c | out: pDst="J0337280.JPG") returned 1 [0085.953] WriteFile (in: hFile=0x158, lpBuffer=0x1fe3a2c*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe3a2c*, lpNumberOfBytesWritten=0x18efcc*=0xc, lpOverlapped=0x0) returned 1 [0085.953] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b350*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x3b5b350*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0085.953] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0085.953] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0085.953] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x32f6 [0085.953] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x32f6 [0085.953] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0085.953] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0085.953] DeleteFileW (lpFileName="") returned 0 [0085.953] GetLastError () returned 0x3 [0085.953] GetFileAttributesW (lpFileName="") returned 0xffffffff [0085.953] SetLastError (dwErrCode=0x3) [0085.953] FlushFileBuffers (hFile=0x158) returned 1 [0085.957] GetCurrentThreadId () returned 0x970 [0085.957] GetCurrentThreadId () returned 0x970 [0085.957] GetCurrentThreadId () returned 0x970 [0085.957] GetCurrentThreadId () returned 0x970 [0085.957] GetCurrentThreadId () returned 0x970 [0085.957] GetCurrentThreadId () returned 0x970 [0085.957] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x33ad [0085.957] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x33ad [0085.957] SetFilePointer (in: hFile=0x158, lDistanceToMove=13229, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x33ad [0085.957] CloseHandle (hObject=0x158) returned 1 [0085.957] GetCurrentThreadId () returned 0x970 [0085.957] GetCurrentThreadId () returned 0x970 [0085.957] GetCurrentThreadId () returned 0x970 [0085.957] GetCurrentThreadId () returned 0x970 [0085.957] GetCurrentThreadId () returned 0x970 [0085.957] GetCurrentThreadId () returned 0x970 [0085.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [J0337280.JPG].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [j0337280.jpg].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0085.958] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x33ad [0085.958] SetFilePointer (in: hFile=0x158, lDistanceToMove=13101, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x332d [0085.958] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0085.958] GetFileType (hFile=0x158) returned 0x1 [0085.958] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x21, wMilliseconds=0xe9)) [0085.958] GetCurrentThreadId () returned 0x970 [0085.958] GetCurrentThreadId () returned 0x970 [0085.958] GetCurrentThreadId () returned 0x970 [0085.958] GetCurrentThreadId () returned 0x970 [0085.958] GetCurrentThreadId () returned 0x970 [0085.958] GetCurrentThreadId () returned 0x970 [0085.958] GetCurrentThreadId () returned 0x970 [0085.958] GetCurrentThreadId () returned 0x970 [0085.958] GetCurrentThreadId () returned 0x970 [0085.958] GetCurrentThreadId () returned 0x970 [0085.958] GetCurrentThreadId () returned 0x970 [0085.958] GetCurrentThreadId () returned 0x970 [0085.958] GetCurrentThreadId () returned 0x970 [0085.958] GetCurrentThreadId () returned 0x970 [0085.958] GetCurrentThreadId () returned 0x970 [0085.958] GetCurrentThreadId () returned 0x970 [0085.958] GetCurrentThreadId () returned 0x970 [0085.958] GetCurrentThreadId () returned 0x970 [0085.958] GetCurrentThreadId () returned 0x970 [0085.958] GetCurrentThreadId () returned 0x970 [0085.958] GetCurrentThreadId () returned 0x970 [0085.958] GetCurrentThreadId () returned 0x970 [0085.958] GetCurrentThreadId () returned 0x970 [0085.958] GetCurrentThreadId () returned 0x970 [0085.958] GetCurrentThreadId () returned 0x970 [0085.958] GetCurrentThreadId () returned 0x970 [0085.958] GetCurrentThreadId () returned 0x970 [0085.958] GetCurrentThreadId () returned 0x970 [0085.958] GetCurrentThreadId () returned 0x970 [0085.958] GetCurrentThreadId () returned 0x970 [0085.959] GetCurrentThreadId () returned 0x970 [0085.959] GetCurrentThreadId () returned 0x970 [0085.959] GetCurrentThreadId () returned 0x970 [0085.959] GetCurrentThreadId () returned 0x970 [0085.959] GetCurrentThreadId () returned 0x970 [0085.959] GetCurrentThreadId () returned 0x970 [0085.959] GetCurrentThreadId () returned 0x970 [0085.959] GetCurrentThreadId () returned 0x970 [0085.959] GetCurrentThreadId () returned 0x970 [0085.959] GetCurrentThreadId () returned 0x970 [0085.959] GetCurrentThreadId () returned 0x970 [0085.959] GetCurrentThreadId () returned 0x970 [0085.959] GetCurrentThreadId () returned 0x970 [0085.959] GetCurrentThreadId () returned 0x970 [0085.959] GetCurrentThreadId () returned 0x970 [0085.959] GetCurrentThreadId () returned 0x970 [0085.959] GetCurrentThreadId () returned 0x970 [0085.959] GetCurrentThreadId () returned 0x970 [0085.959] GetCurrentThreadId () returned 0x970 [0085.959] GetCurrentThreadId () returned 0x970 [0085.959] GetCurrentThreadId () returned 0x970 [0085.959] GetCurrentThreadId () returned 0x970 [0085.959] GetCurrentThreadId () returned 0x970 [0085.959] GetCurrentThreadId () returned 0x970 [0085.959] GetCurrentThreadId () returned 0x970 [0085.959] GetCurrentThreadId () returned 0x970 [0085.959] GetCurrentThreadId () returned 0x970 [0085.959] GetCurrentThreadId () returned 0x970 [0085.959] GetCurrentThreadId () returned 0x970 [0085.959] GetCurrentThreadId () returned 0x970 [0085.959] GetCurrentThreadId () returned 0x970 [0085.959] GetCurrentThreadId () returned 0x970 [0085.959] GetCurrentThreadId () returned 0x970 [0085.959] GetCurrentThreadId () returned 0x970 [0085.959] GetCurrentThreadId () returned 0x970 [0085.959] GetCurrentThreadId () returned 0x970 [0085.959] GetCurrentThreadId () returned 0x970 [0085.959] GetCurrentThreadId () returned 0x970 [0085.959] GetCurrentThreadId () returned 0x970 [0085.959] GetCurrentThreadId () returned 0x970 [0085.959] GetCurrentThreadId () returned 0x970 [0085.959] GetCurrentThreadId () returned 0x970 [0085.959] GetCurrentThreadId () returned 0x970 [0085.959] GetCurrentThreadId () returned 0x970 [0085.959] GetCurrentThreadId () returned 0x970 [0085.960] GetCurrentThreadId () returned 0x970 [0085.960] GetCurrentThreadId () returned 0x970 [0085.960] GetCurrentThreadId () returned 0x970 [0085.960] GetCurrentThreadId () returned 0x970 [0085.960] GetCurrentThreadId () returned 0x970 [0085.960] GetCurrentThreadId () returned 0x970 [0085.960] GetCurrentThreadId () returned 0x970 [0085.960] GetCurrentThreadId () returned 0x970 [0085.960] GetCurrentThreadId () returned 0x970 [0085.960] GetCurrentThreadId () returned 0x970 [0085.960] GetCurrentThreadId () returned 0x970 [0085.960] GetCurrentThreadId () returned 0x970 [0085.960] GetCurrentThreadId () returned 0x970 [0085.960] GetCurrentThreadId () returned 0x970 [0085.960] GetCurrentThreadId () returned 0x970 [0085.960] GetCurrentThreadId () returned 0x970 [0085.960] GetCurrentThreadId () returned 0x970 [0085.960] GetCurrentThreadId () returned 0x970 [0085.960] GetCurrentThreadId () returned 0x970 [0085.960] GetCurrentThreadId () returned 0x970 [0085.960] GetCurrentThreadId () returned 0x970 [0085.960] GetCurrentThreadId () returned 0x970 [0085.960] GetCurrentThreadId () returned 0x970 [0085.960] GetCurrentThreadId () returned 0x970 [0085.960] GetCurrentThreadId () returned 0x970 [0085.960] GetCurrentThreadId () returned 0x970 [0085.960] GetCurrentThreadId () returned 0x970 [0085.960] GetCurrentThreadId () returned 0x970 [0085.960] GetCurrentThreadId () returned 0x970 [0085.960] GetCurrentThreadId () returned 0x970 [0085.960] GetCurrentThreadId () returned 0x970 [0085.960] GetCurrentThreadId () returned 0x970 [0085.960] GetCurrentThreadId () returned 0x970 [0085.960] GetCurrentThreadId () returned 0x970 [0085.960] GetCurrentThreadId () returned 0x970 [0085.960] GetCurrentThreadId () returned 0x970 [0085.960] GetCurrentThreadId () returned 0x970 [0085.960] GetCurrentThreadId () returned 0x970 [0085.960] GetCurrentThreadId () returned 0x970 [0085.960] GetCurrentThreadId () returned 0x970 [0085.960] GetCurrentThreadId () returned 0x970 [0085.960] GetCurrentThreadId () returned 0x970 [0085.960] GetCurrentThreadId () returned 0x970 [0085.960] GetCurrentThreadId () returned 0x970 [0085.960] GetCurrentThreadId () returned 0x970 [0085.961] GetCurrentThreadId () returned 0x970 [0085.961] GetCurrentThreadId () returned 0x970 [0085.961] GetCurrentThreadId () returned 0x970 [0085.961] GetCurrentThreadId () returned 0x970 [0085.961] GetCurrentThreadId () returned 0x970 [0085.961] GetCurrentThreadId () returned 0x970 [0085.961] GetCurrentThreadId () returned 0x970 [0085.961] GetCurrentThreadId () returned 0x970 [0085.961] GetCurrentThreadId () returned 0x970 [0085.961] GetCurrentThreadId () returned 0x970 [0085.961] GetCurrentThreadId () returned 0x970 [0085.961] GetCurrentThreadId () returned 0x970 [0085.961] GetCurrentThreadId () returned 0x970 [0085.961] GetCurrentThreadId () returned 0x970 [0085.961] GetCurrentThreadId () returned 0x970 [0085.961] GetCurrentThreadId () returned 0x970 [0085.961] GetCurrentThreadId () returned 0x970 [0085.961] GetCurrentThreadId () returned 0x970 [0085.961] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0085.961] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0085.961] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5e650, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0085.961] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0085.961] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0085.961] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5e650, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0085.961] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0085.961] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0085.961] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b548, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0085.961] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0085.962] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0085.962] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b548, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0085.962] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0085.962] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0085.962] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5e6b0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0085.962] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0085.962] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0085.962] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5e6b0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0085.962] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0085.962] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0085.962] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5e6b0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0085.962] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x21, wMilliseconds=0xe9)) [0085.962] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="v23MVamC)i(\"Y#JB@nw\"{ZXCcWU>#,*g", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0085.962] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="v23MVamC)i(\"Y#JB@nw\"{ZXCcWU>#,*g", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0085.962] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="v23MVamC)i(\"Y#JB@nw\"{ZXCcWU>#,*g", cchWideChar=32, lpMultiByteStr=0x3b56138, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="v23MVamC)i(\"Y#JB@nw\"{ZXCcWU>#,*g", lpUsedDefaultChar=0x0) returned 32 [0085.962] GetCurrentThreadId () returned 0x970 [0085.962] GetCurrentThreadId () returned 0x970 [0085.962] GetCurrentThreadId () returned 0x970 [0085.962] GetCurrentThreadId () returned 0x970 [0085.962] GetCurrentThreadId () returned 0x970 [0085.962] GetCurrentThreadId () returned 0x970 [0085.970] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0085.970] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0085.970] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3b9cfe8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/ÜØçQþá=\x15ñ\x1e\x9f[6à)¿\x86Ýóx\x9e\x82|6»;ùÓñæv\x17\x15T²À\x8c\x05£\x91Àu\\Ü{\x91\x9bô#~\x99E`\"«<ÞÃ!h\x15ë0¿\x1cU!\x86=¡\x90-\x94\x19\x06î×\x19#°w;mCAFº²²3\x97ü`Ú\x10YÜ\x93\x8bn\x02\x9c\x93ÏZ\x94\x87\x01Ú¤å\x9d;xÁ\x0c\x88\x16t¶7På&v$4S'\rÂ\x0b¾\x86Ù\x95ª{ø\x16+\x7f\x04½,\x8f\x9d©/\x8eÅ;3\x86\x84}±1x", lpUsedDefaultChar=0x0) returned 64 [0085.970] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0085.970] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAAfrfAU0fnChtz40cT//FGWq/lElVy9xSoAkbId+kBMtZMTN/Y3IKdjmjVGQshmJk2dSTVfzY5t8pEWglgjtHvRYhvYdX3Kzs1TxsCFtDE6q/oXzTJOZxpndkYDHKeSwXkTRgnaYiyo2HVB3zSJPb+DMsfQI6FjLmClZasnhOx1LBEhgO1UIkxvbNtX7VWXo7fEvGHVxZaHMv2BNLys+2bhXOvrYgdDeAA==") returned 232 [0085.970] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x21, wMilliseconds=0xf9)) [0085.970] GetCurrentThreadId () returned 0x970 [0085.970] GetCurrentThreadId () returned 0x970 [0085.970] GetCurrentThreadId () returned 0x970 [0085.970] GetCurrentThreadId () returned 0x970 [0085.970] GetCurrentThreadId () returned 0x970 [0085.970] GetCurrentThreadId () returned 0x970 [0085.970] GetCurrentThreadId () returned 0x970 [0085.970] GetCurrentThreadId () returned 0x970 [0085.970] GetCurrentThreadId () returned 0x970 [0085.970] GetCurrentThreadId () returned 0x970 [0085.970] GetCurrentThreadId () returned 0x970 [0085.970] GetCurrentThreadId () returned 0x970 [0085.970] GetCurrentThreadId () returned 0x970 [0085.970] GetCurrentThreadId () returned 0x970 [0085.971] GetCurrentThreadId () returned 0x970 [0085.971] GetCurrentThreadId () returned 0x970 [0085.971] GetCurrentThreadId () returned 0x970 [0085.971] GetCurrentThreadId () returned 0x970 [0085.971] GetCurrentThreadId () returned 0x970 [0085.971] GetCurrentThreadId () returned 0x970 [0085.971] GetCurrentThreadId () returned 0x970 [0085.971] GetCurrentThreadId () returned 0x970 [0085.971] GetCurrentThreadId () returned 0x970 [0085.971] GetCurrentThreadId () returned 0x970 [0085.971] GetCurrentThreadId () returned 0x970 [0085.971] GetCurrentThreadId () returned 0x970 [0085.971] GetCurrentThreadId () returned 0x970 [0085.971] GetCurrentThreadId () returned 0x970 [0085.971] GetCurrentThreadId () returned 0x970 [0085.971] GetCurrentThreadId () returned 0x970 [0085.971] GetCurrentThreadId () returned 0x970 [0085.971] GetCurrentThreadId () returned 0x970 [0085.971] GetCurrentThreadId () returned 0x970 [0085.971] GetCurrentThreadId () returned 0x970 [0085.971] GetCurrentThreadId () returned 0x970 [0085.971] GetCurrentThreadId () returned 0x970 [0085.971] GetCurrentThreadId () returned 0x970 [0085.971] GetCurrentThreadId () returned 0x970 [0085.971] GetCurrentThreadId () returned 0x970 [0085.971] GetCurrentThreadId () returned 0x970 [0085.971] GetCurrentThreadId () returned 0x970 [0085.971] GetCurrentThreadId () returned 0x970 [0085.971] GetCurrentThreadId () returned 0x970 [0085.971] GetCurrentThreadId () returned 0x970 [0085.971] GetCurrentThreadId () returned 0x970 [0085.971] GetCurrentThreadId () returned 0x970 [0085.971] GetCurrentThreadId () returned 0x970 [0085.971] GetCurrentThreadId () returned 0x970 [0085.971] GetCurrentThreadId () returned 0x970 [0085.971] GetCurrentThreadId () returned 0x970 [0085.971] GetCurrentThreadId () returned 0x970 [0085.971] GetCurrentThreadId () returned 0x970 [0085.971] GetCurrentThreadId () returned 0x970 [0085.971] GetCurrentThreadId () returned 0x970 [0085.971] GetCurrentThreadId () returned 0x970 [0085.971] GetCurrentThreadId () returned 0x970 [0085.971] GetCurrentThreadId () returned 0x970 [0085.971] GetCurrentThreadId () returned 0x970 [0085.972] GetCurrentThreadId () returned 0x970 [0085.972] GetCurrentThreadId () returned 0x970 [0085.972] GetCurrentThreadId () returned 0x970 [0085.972] GetCurrentThreadId () returned 0x970 [0085.972] GetCurrentThreadId () returned 0x970 [0085.972] GetCurrentThreadId () returned 0x970 [0085.972] GetCurrentThreadId () returned 0x970 [0085.972] GetCurrentThreadId () returned 0x970 [0085.972] GetCurrentThreadId () returned 0x970 [0085.972] GetCurrentThreadId () returned 0x970 [0085.972] GetCurrentThreadId () returned 0x970 [0085.972] GetCurrentThreadId () returned 0x970 [0085.972] GetCurrentThreadId () returned 0x970 [0085.972] GetCurrentThreadId () returned 0x970 [0085.972] GetCurrentThreadId () returned 0x970 [0085.972] GetCurrentThreadId () returned 0x970 [0085.972] GetCurrentThreadId () returned 0x970 [0085.972] GetCurrentThreadId () returned 0x970 [0085.972] GetCurrentThreadId () returned 0x970 [0085.972] GetCurrentThreadId () returned 0x970 [0085.972] GetCurrentThreadId () returned 0x970 [0085.972] GetCurrentThreadId () returned 0x970 [0085.972] GetCurrentThreadId () returned 0x970 [0085.972] GetCurrentThreadId () returned 0x970 [0085.972] GetCurrentThreadId () returned 0x970 [0085.972] GetCurrentThreadId () returned 0x970 [0085.972] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAAfrfAU0fnChtz40cT//FGWq/lElVy9xSoAkbId+kBMtZMTN/Y3IKdjmjVGQshmJk2dSTVfzY5t8pEWglgjtHvRYhvYdX3Kzs1TxsCFtDE6q/oXzTJOZxpndkYDHKeSwXkTRgnaYiyo2HVB3zSJPb+DMsfQI6FjLmClZasnhOx1LBEhgO1UIkxvbNtX7VWXo7fEvGHVxZaHMv2BNLys+2bhXOvrYgdDeAA==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0085.972] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAAfrfAU0fnChtz40cT//FGWq/lElVy9xSoAkbId+kBMtZMTN/Y3IKdjmjVGQshmJk2dSTVfzY5t8pEWglgjtHvRYhvYdX3Kzs1TxsCFtDE6q/oXzTJOZxpndkYDHKeSwXkTRgnaYiyo2HVB3zSJPb+DMsfQI6FjLmClZasnhOx1LBEhgO1UIkxvbNtX7VWXo7fEvGHVxZaHMv2BNLys+2bhXOvrYgdDeAA==", cchWideChar=245, lpMultiByteStr=0x3b4d08c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAAfrfAU0fnChtz40cT//FGWq/lElVy9xSoAkbId+kBMtZMTN/Y3IKdjmjVGQshmJk2dSTVfzY5t8pEWglgjtHvRYhvYdX3Kzs1TxsCFtDE6q/oXzTJOZxpndkYDHKeSwXkTRgnaYiyo2HVB3zSJPb+DMsfQI6FjLmClZasnhOx1LBEhgO1UIkxvbNtX7VWXo7fEvGHVxZaHMv2BNLys+2bhXOvrYgdDeAA==", lpUsedDefaultChar=0x0) returned 245 [0085.972] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0085.973] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0085.973] CloseHandle (hObject=0x158) returned 1 [0085.973] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0337280.jpg")) returned 1 [0085.974] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=20623723181) returned 1 [0085.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [J0341328.JPG].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [j0341328.jpg].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0085.974] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0085.974] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0085.975] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0085.975] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0085.975] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0085.975] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0085.975] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0085.975] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0085.975] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0085.975] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0085.975] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0085.975] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0085.975] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0085.975] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0085.975] SetEndOfFile (hFile=0x158) returned 1 [0085.975] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0085.975] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0085.975] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0085.975] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0085.976] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0085.976] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0085.976] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MJ4FwYw2wY8i%)BNK>N66vQuWieJJHU8", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0085.977] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MJ4FwYw2wY8i%)BNK>N66vQuWieJJHU8", cchWideChar=32, lpMultiByteStr=0x203bee4, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MJ4FwYw2wY8i%)BNK>N66vQuWieJJHU8", lpUsedDefaultChar=0x0) returned 32 [0085.977] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0085.977] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0085.977] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x27d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341328.JPG", cAlternateFileName="")) returned 0x295098 [0085.977] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0085.977] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0085.977] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341328.jpg")) returned 0x20 [0085.978] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341328.jpg")) returned 0x20 [0085.978] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341328.jpg")) returned 0x20 [0085.978] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341328.jpg")) returned 0x20 [0085.978] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341328.jpg"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x27d4)) returned 1 [0085.978] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0085.978] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0085.978] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341328.jpg")) returned 0x20 [0085.978] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341328.jpg")) returned 0x20 [0085.978] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0085.978] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0085.978] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0085.978] SetEndOfFile (hFile=0x158) returned 1 [0085.979] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341328.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0085.979] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341328.JPG", cchWideChar=12, lpMultiByteStr=0x1fe37ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341328.JPG", lpUsedDefaultChar=0x0) returned 12 [0085.979] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341328.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0085.979] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341328.JPG", cchWideChar=12, lpMultiByteStr=0x1fe368c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341328.JPG", lpUsedDefaultChar=0x0) returned 12 [0085.979] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe368c, cbMultiByte=12, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="J0341328.JPGg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0085.979] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341328.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0085.979] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341328.JPG", cchWideChar=12, lpMultiByteStr=0x1fe37ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341328.JPG", lpUsedDefaultChar=0x0) returned 12 [0085.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341328.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0085.980] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0085.980] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x27d4 [0085.980] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0085.980] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0085.980] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0085.980] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341328.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0085.980] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341328.JPG", cchWideChar=12, lpMultiByteStr=0x1fe37ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341328.JPG", lpUsedDefaultChar=0x0) returned 12 [0085.980] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341328.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0085.980] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341328.JPG", cchWideChar=12, lpMultiByteStr=0x1fe368c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341328.JPG", lpUsedDefaultChar=0x0) returned 12 [0085.980] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe368c, cbMultiByte=12, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="J0341328.JPG28.JPGg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0085.980] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341328.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0085.980] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341328.JPG", cchWideChar=12, lpMultiByteStr=0x1fe37ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341328.JPG", lpUsedDefaultChar=0x0) returned 12 [0085.980] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0085.981] CharToOemA (in: pSrc="J0341328.JPG", pDst=0x1fe368c | out: pDst="J0341328.JPG") returned 1 [0085.981] WriteFile (in: hFile=0x158, lpBuffer=0x1fe368c*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe368c*, lpNumberOfBytesWritten=0x18e048*=0xc, lpOverlapped=0x0) returned 1 [0085.981] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0085.981] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0085.982] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0085.982] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=20624512727) returned 1 [0085.982] ReadFile (in: hFile=0x11c, lpBuffer=0x3b95a30, nNumberOfBytesToRead=0x27d4, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b95a30*, lpNumberOfBytesRead=0x18dd7c*=0x27d4, lpOverlapped=0x0) returned 1 [0085.986] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0085.986] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=20624912910) returned 1 [0085.994] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b420*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b5b420*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0085.994] ReadFile (in: hFile=0x11c, lpBuffer=0x3b95a30, nNumberOfBytesToRead=0x27d4, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3b95a30*, lpNumberOfBytesRead=0x18de38*=0x27d4, lpOverlapped=0x0) returned 1 [0085.995] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x47 [0085.995] WriteFile (in: hFile=0x158, lpBuffer=0x3b99990*, nNumberOfBytesToWrite=0x27d4, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3b99990*, lpNumberOfBytesWritten=0x18de10*=0x27d4, lpOverlapped=0x0) returned 1 [0085.995] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x281b [0085.995] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0085.995] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0085.995] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0085.995] SetFilePointer (in: hFile=0x158, lDistanceToMove=12, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2a [0085.996] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x2825 [0085.996] CloseHandle (hObject=0x11c) returned 1 [0085.996] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x2825 [0085.996] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x2825 [0085.996] SetFilePointer (in: hFile=0x158, lDistanceToMove=10277, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x2825 [0085.996] SetFilePointer (in: hFile=0x158, lDistanceToMove=10277, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x2825 [0085.996] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x2825 [0085.996] SetFilePointer (in: hFile=0x158, lDistanceToMove=10277, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x2825 [0085.996] SetEndOfFile (hFile=0x158) returned 1 [0085.996] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x2825 [0085.996] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x2825 [0085.996] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341328.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0085.996] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341328.JPG", cchWideChar=12, lpMultiByteStr=0x1fe37ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341328.JPG", lpUsedDefaultChar=0x0) returned 12 [0085.996] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341328.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0085.996] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341328.JPG", cchWideChar=12, lpMultiByteStr=0x1fe43ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341328.JPG", lpUsedDefaultChar=0x0) returned 12 [0085.996] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe43ac, cbMultiByte=12, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="J0341328.JPGꞗ@涤(\x18믉`믑`") returned 12 [0085.997] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341328.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0085.997] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341328.JPG", cchWideChar=12, lpMultiByteStr=0x1fe37ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341328.JPG", lpUsedDefaultChar=0x0) returned 12 [0085.997] WriteFile (in: hFile=0x158, lpBuffer=0x37bea38*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x37bea38*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0085.997] CharToOemA (in: pSrc="J0341328.JPG", pDst=0x1fe43ac | out: pDst="J0341328.JPG") returned 1 [0085.997] WriteFile (in: hFile=0x158, lpBuffer=0x1fe43ac*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe43ac*, lpNumberOfBytesWritten=0x18efcc*=0xc, lpOverlapped=0x0) returned 1 [0085.997] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b3b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x3b5b3b0*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0085.997] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0085.997] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0085.997] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x286a [0085.997] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x286a [0085.997] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0085.997] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0085.997] DeleteFileW (lpFileName="") returned 0 [0085.997] GetLastError () returned 0x3 [0085.997] GetFileAttributesW (lpFileName="") returned 0xffffffff [0085.997] SetLastError (dwErrCode=0x3) [0085.998] FlushFileBuffers (hFile=0x158) returned 1 [0086.001] GetCurrentThreadId () returned 0x970 [0086.001] GetCurrentThreadId () returned 0x970 [0086.001] GetCurrentThreadId () returned 0x970 [0086.001] GetCurrentThreadId () returned 0x970 [0086.001] GetCurrentThreadId () returned 0x970 [0086.001] GetCurrentThreadId () returned 0x970 [0086.001] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x2921 [0086.002] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x2921 [0086.002] SetFilePointer (in: hFile=0x158, lDistanceToMove=10529, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x2921 [0086.002] CloseHandle (hObject=0x158) returned 1 [0086.002] GetCurrentThreadId () returned 0x970 [0086.002] GetCurrentThreadId () returned 0x970 [0086.002] GetCurrentThreadId () returned 0x970 [0086.002] GetCurrentThreadId () returned 0x970 [0086.002] GetCurrentThreadId () returned 0x970 [0086.002] GetCurrentThreadId () returned 0x970 [0086.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [J0341328.JPG].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [j0341328.jpg].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0086.002] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2921 [0086.002] SetFilePointer (in: hFile=0x158, lDistanceToMove=10401, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x28a1 [0086.002] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0086.002] GetFileType (hFile=0x158) returned 0x1 [0086.002] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x21, wMilliseconds=0x118)) [0086.002] GetCurrentThreadId () returned 0x970 [0086.002] GetCurrentThreadId () returned 0x970 [0086.002] GetCurrentThreadId () returned 0x970 [0086.002] GetCurrentThreadId () returned 0x970 [0086.002] GetCurrentThreadId () returned 0x970 [0086.002] GetCurrentThreadId () returned 0x970 [0086.002] GetCurrentThreadId () returned 0x970 [0086.002] GetCurrentThreadId () returned 0x970 [0086.002] GetCurrentThreadId () returned 0x970 [0086.003] GetCurrentThreadId () returned 0x970 [0086.003] GetCurrentThreadId () returned 0x970 [0086.003] GetCurrentThreadId () returned 0x970 [0086.003] GetCurrentThreadId () returned 0x970 [0086.003] GetCurrentThreadId () returned 0x970 [0086.003] GetCurrentThreadId () returned 0x970 [0086.003] GetCurrentThreadId () returned 0x970 [0086.003] GetCurrentThreadId () returned 0x970 [0086.003] GetCurrentThreadId () returned 0x970 [0086.003] GetCurrentThreadId () returned 0x970 [0086.003] GetCurrentThreadId () returned 0x970 [0086.003] GetCurrentThreadId () returned 0x970 [0086.003] GetCurrentThreadId () returned 0x970 [0086.003] GetCurrentThreadId () returned 0x970 [0086.003] GetCurrentThreadId () returned 0x970 [0086.003] GetCurrentThreadId () returned 0x970 [0086.003] GetCurrentThreadId () returned 0x970 [0086.003] GetCurrentThreadId () returned 0x970 [0086.003] GetCurrentThreadId () returned 0x970 [0086.003] GetCurrentThreadId () returned 0x970 [0086.003] GetCurrentThreadId () returned 0x970 [0086.003] GetCurrentThreadId () returned 0x970 [0086.003] GetCurrentThreadId () returned 0x970 [0086.003] GetCurrentThreadId () returned 0x970 [0086.003] GetCurrentThreadId () returned 0x970 [0086.003] GetCurrentThreadId () returned 0x970 [0086.003] GetCurrentThreadId () returned 0x970 [0086.003] GetCurrentThreadId () returned 0x970 [0086.003] GetCurrentThreadId () returned 0x970 [0086.003] GetCurrentThreadId () returned 0x970 [0086.003] GetCurrentThreadId () returned 0x970 [0086.003] GetCurrentThreadId () returned 0x970 [0086.003] GetCurrentThreadId () returned 0x970 [0086.003] GetCurrentThreadId () returned 0x970 [0086.003] GetCurrentThreadId () returned 0x970 [0086.003] GetCurrentThreadId () returned 0x970 [0086.003] GetCurrentThreadId () returned 0x970 [0086.003] GetCurrentThreadId () returned 0x970 [0086.003] GetCurrentThreadId () returned 0x970 [0086.003] GetCurrentThreadId () returned 0x970 [0086.003] GetCurrentThreadId () returned 0x970 [0086.003] GetCurrentThreadId () returned 0x970 [0086.003] GetCurrentThreadId () returned 0x970 [0086.003] GetCurrentThreadId () returned 0x970 [0086.003] GetCurrentThreadId () returned 0x970 [0086.004] GetCurrentThreadId () returned 0x970 [0086.004] GetCurrentThreadId () returned 0x970 [0086.004] GetCurrentThreadId () returned 0x970 [0086.004] GetCurrentThreadId () returned 0x970 [0086.004] GetCurrentThreadId () returned 0x970 [0086.004] GetCurrentThreadId () returned 0x970 [0086.004] GetCurrentThreadId () returned 0x970 [0086.004] GetCurrentThreadId () returned 0x970 [0086.004] GetCurrentThreadId () returned 0x970 [0086.004] GetCurrentThreadId () returned 0x970 [0086.004] GetCurrentThreadId () returned 0x970 [0086.004] GetCurrentThreadId () returned 0x970 [0086.004] GetCurrentThreadId () returned 0x970 [0086.004] GetCurrentThreadId () returned 0x970 [0086.004] GetCurrentThreadId () returned 0x970 [0086.004] GetCurrentThreadId () returned 0x970 [0086.004] GetCurrentThreadId () returned 0x970 [0086.004] GetCurrentThreadId () returned 0x970 [0086.004] GetCurrentThreadId () returned 0x970 [0086.004] GetCurrentThreadId () returned 0x970 [0086.004] GetCurrentThreadId () returned 0x970 [0086.004] GetCurrentThreadId () returned 0x970 [0086.004] GetCurrentThreadId () returned 0x970 [0086.004] GetCurrentThreadId () returned 0x970 [0086.004] GetCurrentThreadId () returned 0x970 [0086.004] GetCurrentThreadId () returned 0x970 [0086.004] GetCurrentThreadId () returned 0x970 [0086.004] GetCurrentThreadId () returned 0x970 [0086.004] GetCurrentThreadId () returned 0x970 [0086.004] GetCurrentThreadId () returned 0x970 [0086.004] GetCurrentThreadId () returned 0x970 [0086.004] GetCurrentThreadId () returned 0x970 [0086.004] GetCurrentThreadId () returned 0x970 [0086.004] GetCurrentThreadId () returned 0x970 [0086.004] GetCurrentThreadId () returned 0x970 [0086.004] GetCurrentThreadId () returned 0x970 [0086.004] GetCurrentThreadId () returned 0x970 [0086.004] GetCurrentThreadId () returned 0x970 [0086.004] GetCurrentThreadId () returned 0x970 [0086.004] GetCurrentThreadId () returned 0x970 [0086.004] GetCurrentThreadId () returned 0x970 [0086.004] GetCurrentThreadId () returned 0x970 [0086.004] GetCurrentThreadId () returned 0x970 [0086.004] GetCurrentThreadId () returned 0x970 [0086.004] GetCurrentThreadId () returned 0x970 [0086.005] GetCurrentThreadId () returned 0x970 [0086.005] GetCurrentThreadId () returned 0x970 [0086.005] GetCurrentThreadId () returned 0x970 [0086.005] GetCurrentThreadId () returned 0x970 [0086.005] GetCurrentThreadId () returned 0x970 [0086.005] GetCurrentThreadId () returned 0x970 [0086.005] GetCurrentThreadId () returned 0x970 [0086.005] GetCurrentThreadId () returned 0x970 [0086.005] GetCurrentThreadId () returned 0x970 [0086.005] GetCurrentThreadId () returned 0x970 [0086.005] GetCurrentThreadId () returned 0x970 [0086.005] GetCurrentThreadId () returned 0x970 [0086.005] GetCurrentThreadId () returned 0x970 [0086.005] GetCurrentThreadId () returned 0x970 [0086.005] GetCurrentThreadId () returned 0x970 [0086.005] GetCurrentThreadId () returned 0x970 [0086.005] GetCurrentThreadId () returned 0x970 [0086.005] GetCurrentThreadId () returned 0x970 [0086.005] GetCurrentThreadId () returned 0x970 [0086.005] GetCurrentThreadId () returned 0x970 [0086.005] GetCurrentThreadId () returned 0x970 [0086.005] GetCurrentThreadId () returned 0x970 [0086.005] GetCurrentThreadId () returned 0x970 [0086.005] GetCurrentThreadId () returned 0x970 [0086.005] GetCurrentThreadId () returned 0x970 [0086.005] GetCurrentThreadId () returned 0x970 [0086.005] GetCurrentThreadId () returned 0x970 [0086.005] GetCurrentThreadId () returned 0x970 [0086.005] GetCurrentThreadId () returned 0x970 [0086.005] GetCurrentThreadId () returned 0x970 [0086.005] GetCurrentThreadId () returned 0x970 [0086.005] GetCurrentThreadId () returned 0x970 [0086.005] GetCurrentThreadId () returned 0x970 [0086.005] GetCurrentThreadId () returned 0x970 [0086.005] GetCurrentThreadId () returned 0x970 [0086.005] GetCurrentThreadId () returned 0x970 [0086.005] GetCurrentThreadId () returned 0x970 [0086.005] GetCurrentThreadId () returned 0x970 [0086.005] GetCurrentThreadId () returned 0x970 [0086.005] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.005] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.005] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5e6b0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0086.005] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.006] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.006] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5e6b0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0086.006] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.006] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.006] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b530, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0086.006] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.006] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.006] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b530, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0086.006] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.006] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.006] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5e710, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0086.006] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.006] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.006] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5e710, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0086.006] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.006] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.006] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5e710, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0086.006] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x21, wMilliseconds=0x118)) [0086.006] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MJ4FwYw2wY8i%)BNK>N66vQuWieJJHU8", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0086.006] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MJ4FwYw2wY8i%)BNK>N66vQuWieJJHU8", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0086.006] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MJ4FwYw2wY8i%)BNK>N66vQuWieJJHU8", cchWideChar=32, lpMultiByteStr=0x3b56168, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MJ4FwYw2wY8i%)BNK>N66vQuWieJJHU8", lpUsedDefaultChar=0x0) returned 32 [0086.006] GetCurrentThreadId () returned 0x970 [0086.006] GetCurrentThreadId () returned 0x970 [0086.006] GetCurrentThreadId () returned 0x970 [0086.006] GetCurrentThreadId () returned 0x970 [0086.006] GetCurrentThreadId () returned 0x970 [0086.006] GetCurrentThreadId () returned 0x970 [0086.014] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0086.014] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0086.014] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3b86418, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0086.014] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0086.014] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAABB9tn0EyZ7zCfUMYoIBYWf9i2ewp8mcxHeOfEyr8uu5Vb07dbTT3EDhdz1VvwnS3/nyPz/+2QqxVVnTMBfOymsugLEtmvI2ja3r3v3iUYnfAyY1F33ZMX62mVNNtr8Ci9N2SXZvyFE5E8RUgiEgx7g8h6WCoU/lGCOceSyNd6SYfMu6DB1evN4NQvJR+AxgapGUOzDFkp0LE510ewQt7YK79H4gqbCbWA==") returned 232 [0086.014] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x21, wMilliseconds=0x118)) [0086.014] GetCurrentThreadId () returned 0x970 [0086.014] GetCurrentThreadId () returned 0x970 [0086.014] GetCurrentThreadId () returned 0x970 [0086.014] GetCurrentThreadId () returned 0x970 [0086.014] GetCurrentThreadId () returned 0x970 [0086.014] GetCurrentThreadId () returned 0x970 [0086.014] GetCurrentThreadId () returned 0x970 [0086.014] GetCurrentThreadId () returned 0x970 [0086.014] GetCurrentThreadId () returned 0x970 [0086.014] GetCurrentThreadId () returned 0x970 [0086.014] GetCurrentThreadId () returned 0x970 [0086.014] GetCurrentThreadId () returned 0x970 [0086.014] GetCurrentThreadId () returned 0x970 [0086.014] GetCurrentThreadId () returned 0x970 [0086.014] GetCurrentThreadId () returned 0x970 [0086.014] GetCurrentThreadId () returned 0x970 [0086.014] GetCurrentThreadId () returned 0x970 [0086.014] GetCurrentThreadId () returned 0x970 [0086.014] GetCurrentThreadId () returned 0x970 [0086.014] GetCurrentThreadId () returned 0x970 [0086.014] GetCurrentThreadId () returned 0x970 [0086.014] GetCurrentThreadId () returned 0x970 [0086.014] GetCurrentThreadId () returned 0x970 [0086.014] GetCurrentThreadId () returned 0x970 [0086.014] GetCurrentThreadId () returned 0x970 [0086.014] GetCurrentThreadId () returned 0x970 [0086.014] GetCurrentThreadId () returned 0x970 [0086.015] GetCurrentThreadId () returned 0x970 [0086.015] GetCurrentThreadId () returned 0x970 [0086.015] GetCurrentThreadId () returned 0x970 [0086.015] GetCurrentThreadId () returned 0x970 [0086.015] GetCurrentThreadId () returned 0x970 [0086.015] GetCurrentThreadId () returned 0x970 [0086.015] GetCurrentThreadId () returned 0x970 [0086.015] GetCurrentThreadId () returned 0x970 [0086.015] GetCurrentThreadId () returned 0x970 [0086.015] GetCurrentThreadId () returned 0x970 [0086.015] GetCurrentThreadId () returned 0x970 [0086.015] GetCurrentThreadId () returned 0x970 [0086.015] GetCurrentThreadId () returned 0x970 [0086.015] GetCurrentThreadId () returned 0x970 [0086.015] GetCurrentThreadId () returned 0x970 [0086.015] GetCurrentThreadId () returned 0x970 [0086.015] GetCurrentThreadId () returned 0x970 [0086.015] GetCurrentThreadId () returned 0x970 [0086.015] GetCurrentThreadId () returned 0x970 [0086.015] GetCurrentThreadId () returned 0x970 [0086.015] GetCurrentThreadId () returned 0x970 [0086.015] GetCurrentThreadId () returned 0x970 [0086.015] GetCurrentThreadId () returned 0x970 [0086.015] GetCurrentThreadId () returned 0x970 [0086.015] GetCurrentThreadId () returned 0x970 [0086.015] GetCurrentThreadId () returned 0x970 [0086.015] GetCurrentThreadId () returned 0x970 [0086.015] GetCurrentThreadId () returned 0x970 [0086.015] GetCurrentThreadId () returned 0x970 [0086.015] GetCurrentThreadId () returned 0x970 [0086.015] GetCurrentThreadId () returned 0x970 [0086.015] GetCurrentThreadId () returned 0x970 [0086.015] GetCurrentThreadId () returned 0x970 [0086.015] GetCurrentThreadId () returned 0x970 [0086.015] GetCurrentThreadId () returned 0x970 [0086.015] GetCurrentThreadId () returned 0x970 [0086.015] GetCurrentThreadId () returned 0x970 [0086.015] GetCurrentThreadId () returned 0x970 [0086.015] GetCurrentThreadId () returned 0x970 [0086.015] GetCurrentThreadId () returned 0x970 [0086.015] GetCurrentThreadId () returned 0x970 [0086.015] GetCurrentThreadId () returned 0x970 [0086.015] GetCurrentThreadId () returned 0x970 [0086.015] GetCurrentThreadId () returned 0x970 [0086.015] GetCurrentThreadId () returned 0x970 [0086.016] GetCurrentThreadId () returned 0x970 [0086.016] GetCurrentThreadId () returned 0x970 [0086.016] GetCurrentThreadId () returned 0x970 [0086.016] GetCurrentThreadId () returned 0x970 [0086.016] GetCurrentThreadId () returned 0x970 [0086.016] GetCurrentThreadId () returned 0x970 [0086.016] GetCurrentThreadId () returned 0x970 [0086.016] GetCurrentThreadId () returned 0x970 [0086.016] GetCurrentThreadId () returned 0x970 [0086.016] GetCurrentThreadId () returned 0x970 [0086.016] GetCurrentThreadId () returned 0x970 [0086.016] GetCurrentThreadId () returned 0x970 [0086.016] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAABB9tn0EyZ7zCfUMYoIBYWf9i2ewp8mcxHeOfEyr8uu5Vb07dbTT3EDhdz1VvwnS3/nyPz/+2QqxVVnTMBfOymsugLEtmvI2ja3r3v3iUYnfAyY1F33ZMX62mVNNtr8Ci9N2SXZvyFE5E8RUgiEgx7g8h6WCoU/lGCOceSyNd6SYfMu6DB1evN4NQvJR+AxgapGUOzDFkp0LE510ewQt7YK79H4gqbCbWA==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0086.016] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAABB9tn0EyZ7zCfUMYoIBYWf9i2ewp8mcxHeOfEyr8uu5Vb07dbTT3EDhdz1VvwnS3/nyPz/+2QqxVVnTMBfOymsugLEtmvI2ja3r3v3iUYnfAyY1F33ZMX62mVNNtr8Ci9N2SXZvyFE5E8RUgiEgx7g8h6WCoU/lGCOceSyNd6SYfMu6DB1evN4NQvJR+AxgapGUOzDFkp0LE510ewQt7YK79H4gqbCbWA==", cchWideChar=245, lpMultiByteStr=0x3b4d08c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAABB9tn0EyZ7zCfUMYoIBYWf9i2ewp8mcxHeOfEyr8uu5Vb07dbTT3EDhdz1VvwnS3/nyPz/+2QqxVVnTMBfOymsugLEtmvI2ja3r3v3iUYnfAyY1F33ZMX62mVNNtr8Ci9N2SXZvyFE5E8RUgiEgx7g8h6WCoU/lGCOceSyNd6SYfMu6DB1evN4NQvJR+AxgapGUOzDFkp0LE510ewQt7YK79H4gqbCbWA==", lpUsedDefaultChar=0x0) returned 245 [0086.016] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0086.016] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0086.016] CloseHandle (hObject=0x158) returned 1 [0086.016] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341328.jpg")) returned 1 [0086.017] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=20628093163) returned 1 [0086.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [J0341344.JPG].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [j0341344.jpg].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0086.018] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0086.018] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0086.018] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0086.018] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0086.018] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0086.018] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0086.018] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0086.019] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0086.019] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0086.019] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0086.019] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0086.019] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0086.019] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0086.019] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0086.019] SetEndOfFile (hFile=0x158) returned 1 [0086.019] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0086.019] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0086.019] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0086.019] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0086.019] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0086.020] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0086.020] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="7nWwA@", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0086.103] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N8\"&REJICXl/:o^b4yz*zyODi>7nWwA@", cchWideChar=32, lpMultiByteStr=0x203bf8c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N8\"&REJICXl/:o^b4yz*zyODi>7nWwA@", lpUsedDefaultChar=0x0) returned 32 [0086.103] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0086.103] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0086.103] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4ad8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341447.JPG", cAlternateFileName="")) returned 0x295098 [0086.103] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0086.103] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0086.103] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341447.jpg")) returned 0x20 [0086.104] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341447.jpg")) returned 0x20 [0086.104] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341447.jpg")) returned 0x20 [0086.104] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341447.jpg")) returned 0x20 [0086.104] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341447.jpg"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4ad8)) returned 1 [0086.104] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0086.104] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0086.104] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341447.jpg")) returned 0x20 [0086.104] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341447.jpg")) returned 0x20 [0086.104] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0086.104] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0086.104] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0086.104] SetEndOfFile (hFile=0x158) returned 1 [0086.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341447.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341447.JPG", cchWideChar=12, lpMultiByteStr=0x1fe3c4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341447.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341447.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341447.JPG", cchWideChar=12, lpMultiByteStr=0x1fe47cc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341447.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.105] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe47cc, cbMultiByte=12, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="J0341447.JPGg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0086.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341447.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341447.JPG", cchWideChar=12, lpMultiByteStr=0x1fe3c4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341447.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341447.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0086.106] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0086.106] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x4ad8 [0086.106] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0086.106] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0086.106] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0086.106] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341447.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.106] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341447.JPG", cchWideChar=12, lpMultiByteStr=0x1fe3c4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341447.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.106] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341447.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.106] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341447.JPG", cchWideChar=12, lpMultiByteStr=0x1fe47cc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341447.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.106] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe47cc, cbMultiByte=12, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="J0341447.JPG47.JPGg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0086.106] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341447.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.106] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341447.JPG", cchWideChar=12, lpMultiByteStr=0x1fe3c4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341447.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.106] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0086.107] CharToOemA (in: pSrc="J0341447.JPG", pDst=0x1fe47cc | out: pDst="J0341447.JPG") returned 1 [0086.107] WriteFile (in: hFile=0x158, lpBuffer=0x1fe47cc*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe47cc*, lpNumberOfBytesWritten=0x18e048*=0xc, lpOverlapped=0x0) returned 1 [0086.107] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0086.107] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0086.107] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0086.108] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=20637100327) returned 1 [0086.108] ReadFile (in: hFile=0x11c, lpBuffer=0x3b95a30, nNumberOfBytesToRead=0x4ad8, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b95a30*, lpNumberOfBytesRead=0x18dd7c*=0x4ad8, lpOverlapped=0x0) returned 1 [0086.109] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0086.109] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=20637290017) returned 1 [0086.118] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b450*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b5b450*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0086.118] ReadFile (in: hFile=0x11c, lpBuffer=0x3b95a30, nNumberOfBytesToRead=0x4ad8, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3b95a30*, lpNumberOfBytesRead=0x18de38*=0x4ad8, lpOverlapped=0x0) returned 1 [0086.119] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x47 [0086.119] WriteFile (in: hFile=0x158, lpBuffer=0x381b020*, nNumberOfBytesToWrite=0x4ad8, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x381b020*, lpNumberOfBytesWritten=0x18de10*=0x4ad8, lpOverlapped=0x0) returned 1 [0086.120] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x4b1f [0086.120] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0086.120] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0086.120] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0086.120] SetFilePointer (in: hFile=0x158, lDistanceToMove=12, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2a [0086.120] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x4b29 [0086.120] CloseHandle (hObject=0x11c) returned 1 [0086.120] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x4b29 [0086.120] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x4b29 [0086.121] SetFilePointer (in: hFile=0x158, lDistanceToMove=19241, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x4b29 [0086.121] SetFilePointer (in: hFile=0x158, lDistanceToMove=19241, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x4b29 [0086.121] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x4b29 [0086.121] SetFilePointer (in: hFile=0x158, lDistanceToMove=19241, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x4b29 [0086.121] SetEndOfFile (hFile=0x158) returned 1 [0086.121] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x4b29 [0086.121] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x4b29 [0086.121] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341447.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.121] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341447.JPG", cchWideChar=12, lpMultiByteStr=0x1fe3c4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341447.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.121] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341447.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.121] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341447.JPG", cchWideChar=12, lpMultiByteStr=0x1fe3a2c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341447.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.121] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe3a2c, cbMultiByte=12, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="J0341447.JPGꞗ@涤(\x18믉`믑`") returned 12 [0086.121] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341447.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.121] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341447.JPG", cchWideChar=12, lpMultiByteStr=0x1fe3c4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341447.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.122] WriteFile (in: hFile=0x158, lpBuffer=0x37bea38*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x37bea38*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0086.122] CharToOemA (in: pSrc="J0341447.JPG", pDst=0x1fe3a2c | out: pDst="J0341447.JPG") returned 1 [0086.122] WriteFile (in: hFile=0x158, lpBuffer=0x1fe3a2c*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe3a2c*, lpNumberOfBytesWritten=0x18efcc*=0xc, lpOverlapped=0x0) returned 1 [0086.122] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b3b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x3b5b3b0*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0086.122] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0086.122] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0086.122] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x4b6e [0086.122] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x4b6e [0086.122] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0086.122] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0086.122] DeleteFileW (lpFileName="") returned 0 [0086.122] GetLastError () returned 0x3 [0086.122] GetFileAttributesW (lpFileName="") returned 0xffffffff [0086.122] SetLastError (dwErrCode=0x3) [0086.122] FlushFileBuffers (hFile=0x158) returned 1 [0086.126] GetCurrentThreadId () returned 0x970 [0086.126] GetCurrentThreadId () returned 0x970 [0086.126] GetCurrentThreadId () returned 0x970 [0086.126] GetCurrentThreadId () returned 0x970 [0086.126] GetCurrentThreadId () returned 0x970 [0086.126] GetCurrentThreadId () returned 0x970 [0086.126] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x4c25 [0086.126] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x4c25 [0086.126] SetFilePointer (in: hFile=0x158, lDistanceToMove=19493, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x4c25 [0086.126] CloseHandle (hObject=0x158) returned 1 [0086.126] GetCurrentThreadId () returned 0x970 [0086.126] GetCurrentThreadId () returned 0x970 [0086.126] GetCurrentThreadId () returned 0x970 [0086.126] GetCurrentThreadId () returned 0x970 [0086.126] GetCurrentThreadId () returned 0x970 [0086.126] GetCurrentThreadId () returned 0x970 [0086.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [J0341447.JPG].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [j0341447.jpg].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0086.127] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4c25 [0086.127] SetFilePointer (in: hFile=0x158, lDistanceToMove=19365, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4ba5 [0086.127] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0086.127] GetFileType (hFile=0x158) returned 0x1 [0086.127] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x21, wMilliseconds=0x195)) [0086.127] GetCurrentThreadId () returned 0x970 [0086.127] GetCurrentThreadId () returned 0x970 [0086.127] GetCurrentThreadId () returned 0x970 [0086.127] GetCurrentThreadId () returned 0x970 [0086.127] GetCurrentThreadId () returned 0x970 [0086.127] GetCurrentThreadId () returned 0x970 [0086.127] GetCurrentThreadId () returned 0x970 [0086.127] GetCurrentThreadId () returned 0x970 [0086.127] GetCurrentThreadId () returned 0x970 [0086.127] GetCurrentThreadId () returned 0x970 [0086.127] GetCurrentThreadId () returned 0x970 [0086.127] GetCurrentThreadId () returned 0x970 [0086.127] GetCurrentThreadId () returned 0x970 [0086.127] GetCurrentThreadId () returned 0x970 [0086.127] GetCurrentThreadId () returned 0x970 [0086.127] GetCurrentThreadId () returned 0x970 [0086.127] GetCurrentThreadId () returned 0x970 [0086.127] GetCurrentThreadId () returned 0x970 [0086.127] GetCurrentThreadId () returned 0x970 [0086.127] GetCurrentThreadId () returned 0x970 [0086.127] GetCurrentThreadId () returned 0x970 [0086.127] GetCurrentThreadId () returned 0x970 [0086.127] GetCurrentThreadId () returned 0x970 [0086.127] GetCurrentThreadId () returned 0x970 [0086.127] GetCurrentThreadId () returned 0x970 [0086.127] GetCurrentThreadId () returned 0x970 [0086.127] GetCurrentThreadId () returned 0x970 [0086.127] GetCurrentThreadId () returned 0x970 [0086.128] GetCurrentThreadId () returned 0x970 [0086.128] GetCurrentThreadId () returned 0x970 [0086.128] GetCurrentThreadId () returned 0x970 [0086.128] GetCurrentThreadId () returned 0x970 [0086.128] GetCurrentThreadId () returned 0x970 [0086.128] GetCurrentThreadId () returned 0x970 [0086.128] GetCurrentThreadId () returned 0x970 [0086.128] GetCurrentThreadId () returned 0x970 [0086.128] GetCurrentThreadId () returned 0x970 [0086.128] GetCurrentThreadId () returned 0x970 [0086.128] GetCurrentThreadId () returned 0x970 [0086.128] GetCurrentThreadId () returned 0x970 [0086.128] GetCurrentThreadId () returned 0x970 [0086.128] GetCurrentThreadId () returned 0x970 [0086.128] GetCurrentThreadId () returned 0x970 [0086.128] GetCurrentThreadId () returned 0x970 [0086.128] GetCurrentThreadId () returned 0x970 [0086.128] GetCurrentThreadId () returned 0x970 [0086.128] GetCurrentThreadId () returned 0x970 [0086.128] GetCurrentThreadId () returned 0x970 [0086.128] GetCurrentThreadId () returned 0x970 [0086.128] GetCurrentThreadId () returned 0x970 [0086.128] GetCurrentThreadId () returned 0x970 [0086.128] GetCurrentThreadId () returned 0x970 [0086.128] GetCurrentThreadId () returned 0x970 [0086.128] GetCurrentThreadId () returned 0x970 [0086.128] GetCurrentThreadId () returned 0x970 [0086.128] GetCurrentThreadId () returned 0x970 [0086.128] GetCurrentThreadId () returned 0x970 [0086.128] GetCurrentThreadId () returned 0x970 [0086.128] GetCurrentThreadId () returned 0x970 [0086.128] GetCurrentThreadId () returned 0x970 [0086.128] GetCurrentThreadId () returned 0x970 [0086.128] GetCurrentThreadId () returned 0x970 [0086.128] GetCurrentThreadId () returned 0x970 [0086.128] GetCurrentThreadId () returned 0x970 [0086.128] GetCurrentThreadId () returned 0x970 [0086.128] GetCurrentThreadId () returned 0x970 [0086.128] GetCurrentThreadId () returned 0x970 [0086.128] GetCurrentThreadId () returned 0x970 [0086.128] GetCurrentThreadId () returned 0x970 [0086.128] GetCurrentThreadId () returned 0x970 [0086.128] GetCurrentThreadId () returned 0x970 [0086.128] GetCurrentThreadId () returned 0x970 [0086.128] GetCurrentThreadId () returned 0x970 [0086.129] GetCurrentThreadId () returned 0x970 [0086.129] GetCurrentThreadId () returned 0x970 [0086.129] GetCurrentThreadId () returned 0x970 [0086.129] GetCurrentThreadId () returned 0x970 [0086.129] GetCurrentThreadId () returned 0x970 [0086.129] GetCurrentThreadId () returned 0x970 [0086.129] GetCurrentThreadId () returned 0x970 [0086.129] GetCurrentThreadId () returned 0x970 [0086.129] GetCurrentThreadId () returned 0x970 [0086.129] GetCurrentThreadId () returned 0x970 [0086.129] GetCurrentThreadId () returned 0x970 [0086.129] GetCurrentThreadId () returned 0x970 [0086.129] GetCurrentThreadId () returned 0x970 [0086.129] GetCurrentThreadId () returned 0x970 [0086.129] GetCurrentThreadId () returned 0x970 [0086.129] GetCurrentThreadId () returned 0x970 [0086.129] GetCurrentThreadId () returned 0x970 [0086.129] GetCurrentThreadId () returned 0x970 [0086.129] GetCurrentThreadId () returned 0x970 [0086.129] GetCurrentThreadId () returned 0x970 [0086.129] GetCurrentThreadId () returned 0x970 [0086.129] GetCurrentThreadId () returned 0x970 [0086.129] GetCurrentThreadId () returned 0x970 [0086.129] GetCurrentThreadId () returned 0x970 [0086.129] GetCurrentThreadId () returned 0x970 [0086.129] GetCurrentThreadId () returned 0x970 [0086.129] GetCurrentThreadId () returned 0x970 [0086.129] GetCurrentThreadId () returned 0x970 [0086.129] GetCurrentThreadId () returned 0x970 [0086.129] GetCurrentThreadId () returned 0x970 [0086.129] GetCurrentThreadId () returned 0x970 [0086.129] GetCurrentThreadId () returned 0x970 [0086.129] GetCurrentThreadId () returned 0x970 [0086.129] GetCurrentThreadId () returned 0x970 [0086.129] GetCurrentThreadId () returned 0x970 [0086.129] GetCurrentThreadId () returned 0x970 [0086.129] GetCurrentThreadId () returned 0x970 [0086.129] GetCurrentThreadId () returned 0x970 [0086.129] GetCurrentThreadId () returned 0x970 [0086.129] GetCurrentThreadId () returned 0x970 [0086.129] GetCurrentThreadId () returned 0x970 [0086.129] GetCurrentThreadId () returned 0x970 [0086.129] GetCurrentThreadId () returned 0x970 [0086.130] GetCurrentThreadId () returned 0x970 [0086.130] GetCurrentThreadId () returned 0x970 [0086.130] GetCurrentThreadId () returned 0x970 [0086.130] GetCurrentThreadId () returned 0x970 [0086.130] GetCurrentThreadId () returned 0x970 [0086.130] GetCurrentThreadId () returned 0x970 [0086.130] GetCurrentThreadId () returned 0x970 [0086.130] GetCurrentThreadId () returned 0x970 [0086.130] GetCurrentThreadId () returned 0x970 [0086.130] GetCurrentThreadId () returned 0x970 [0086.130] GetCurrentThreadId () returned 0x970 [0086.130] GetCurrentThreadId () returned 0x970 [0086.130] GetCurrentThreadId () returned 0x970 [0086.130] GetCurrentThreadId () returned 0x970 [0086.130] GetCurrentThreadId () returned 0x970 [0086.130] GetCurrentThreadId () returned 0x970 [0086.130] GetCurrentThreadId () returned 0x970 [0086.130] GetCurrentThreadId () returned 0x970 [0086.130] GetCurrentThreadId () returned 0x970 [0086.130] GetCurrentThreadId () returned 0x970 [0086.130] GetCurrentThreadId () returned 0x970 [0086.130] GetCurrentThreadId () returned 0x970 [0086.130] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.130] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.130] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5e7d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0086.130] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.130] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.130] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5e7d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0086.130] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.130] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.130] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b548, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0086.130] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.130] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.130] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b548, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0086.130] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.130] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.130] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5e830, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0086.130] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.131] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.131] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5e830, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0086.131] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.131] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.131] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5e830, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0086.131] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x21, wMilliseconds=0x195)) [0086.131] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N8\"&REJICXl/:o^b4yz*zyODi>7nWwA@", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0086.131] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N8\"&REJICXl/:o^b4yz*zyODi>7nWwA@", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0086.131] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N8\"&REJICXl/:o^b4yz*zyODi>7nWwA@", cchWideChar=32, lpMultiByteStr=0x3b561f8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N8\"&REJICXl/:o^b4yz*zyODi>7nWwA@", lpUsedDefaultChar=0x0) returned 32 [0086.131] GetCurrentThreadId () returned 0x970 [0086.131] GetCurrentThreadId () returned 0x970 [0086.131] GetCurrentThreadId () returned 0x970 [0086.131] GetCurrentThreadId () returned 0x970 [0086.131] GetCurrentThreadId () returned 0x970 [0086.131] GetCurrentThreadId () returned 0x970 [0086.138] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0086.139] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0086.139] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3b866e8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0086.139] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0086.139] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAABe7e9HuFnhQbb7cQugi9h+AJ9yAsl+V/3NBvMG/gUV3Gss3JSclmcQW4An6gGB85fjpM3p/hoOMvYHR/xrTleR//cwJ71m0c8wQtZC9i+Fnf+iOpzhwANptk6joUMUOAEKTp5/Da9gZkrNcxNPs7HT7IYRlAp3HvvUOd/OVCvFvJaKYm8F2JyhHg6Tqgzhi5IMondhGvAXGvwzLSkimFzVuQOGxm4EOQ==") returned 232 [0086.139] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x21, wMilliseconds=0x195)) [0086.139] GetCurrentThreadId () returned 0x970 [0086.139] GetCurrentThreadId () returned 0x970 [0086.139] GetCurrentThreadId () returned 0x970 [0086.139] GetCurrentThreadId () returned 0x970 [0086.139] GetCurrentThreadId () returned 0x970 [0086.139] GetCurrentThreadId () returned 0x970 [0086.139] GetCurrentThreadId () returned 0x970 [0086.139] GetCurrentThreadId () returned 0x970 [0086.139] GetCurrentThreadId () returned 0x970 [0086.139] GetCurrentThreadId () returned 0x970 [0086.139] GetCurrentThreadId () returned 0x970 [0086.139] GetCurrentThreadId () returned 0x970 [0086.139] GetCurrentThreadId () returned 0x970 [0086.139] GetCurrentThreadId () returned 0x970 [0086.139] GetCurrentThreadId () returned 0x970 [0086.139] GetCurrentThreadId () returned 0x970 [0086.139] GetCurrentThreadId () returned 0x970 [0086.139] GetCurrentThreadId () returned 0x970 [0086.139] GetCurrentThreadId () returned 0x970 [0086.139] GetCurrentThreadId () returned 0x970 [0086.139] GetCurrentThreadId () returned 0x970 [0086.139] GetCurrentThreadId () returned 0x970 [0086.139] GetCurrentThreadId () returned 0x970 [0086.139] GetCurrentThreadId () returned 0x970 [0086.139] GetCurrentThreadId () returned 0x970 [0086.139] GetCurrentThreadId () returned 0x970 [0086.139] GetCurrentThreadId () returned 0x970 [0086.139] GetCurrentThreadId () returned 0x970 [0086.139] GetCurrentThreadId () returned 0x970 [0086.139] GetCurrentThreadId () returned 0x970 [0086.139] GetCurrentThreadId () returned 0x970 [0086.139] GetCurrentThreadId () returned 0x970 [0086.139] GetCurrentThreadId () returned 0x970 [0086.139] GetCurrentThreadId () returned 0x970 [0086.139] GetCurrentThreadId () returned 0x970 [0086.139] GetCurrentThreadId () returned 0x970 [0086.139] GetCurrentThreadId () returned 0x970 [0086.139] GetCurrentThreadId () returned 0x970 [0086.140] GetCurrentThreadId () returned 0x970 [0086.140] GetCurrentThreadId () returned 0x970 [0086.140] GetCurrentThreadId () returned 0x970 [0086.140] GetCurrentThreadId () returned 0x970 [0086.140] GetCurrentThreadId () returned 0x970 [0086.140] GetCurrentThreadId () returned 0x970 [0086.140] GetCurrentThreadId () returned 0x970 [0086.140] GetCurrentThreadId () returned 0x970 [0086.140] GetCurrentThreadId () returned 0x970 [0086.140] GetCurrentThreadId () returned 0x970 [0086.140] GetCurrentThreadId () returned 0x970 [0086.140] GetCurrentThreadId () returned 0x970 [0086.140] GetCurrentThreadId () returned 0x970 [0086.140] GetCurrentThreadId () returned 0x970 [0086.140] GetCurrentThreadId () returned 0x970 [0086.140] GetCurrentThreadId () returned 0x970 [0086.140] GetCurrentThreadId () returned 0x970 [0086.140] GetCurrentThreadId () returned 0x970 [0086.140] GetCurrentThreadId () returned 0x970 [0086.140] GetCurrentThreadId () returned 0x970 [0086.140] GetCurrentThreadId () returned 0x970 [0086.140] GetCurrentThreadId () returned 0x970 [0086.140] GetCurrentThreadId () returned 0x970 [0086.140] GetCurrentThreadId () returned 0x970 [0086.140] GetCurrentThreadId () returned 0x970 [0086.140] GetCurrentThreadId () returned 0x970 [0086.140] GetCurrentThreadId () returned 0x970 [0086.140] GetCurrentThreadId () returned 0x970 [0086.140] GetCurrentThreadId () returned 0x970 [0086.140] GetCurrentThreadId () returned 0x970 [0086.140] GetCurrentThreadId () returned 0x970 [0086.140] GetCurrentThreadId () returned 0x970 [0086.140] GetCurrentThreadId () returned 0x970 [0086.140] GetCurrentThreadId () returned 0x970 [0086.140] GetCurrentThreadId () returned 0x970 [0086.140] GetCurrentThreadId () returned 0x970 [0086.140] GetCurrentThreadId () returned 0x970 [0086.140] GetCurrentThreadId () returned 0x970 [0086.140] GetCurrentThreadId () returned 0x970 [0086.140] GetCurrentThreadId () returned 0x970 [0086.140] GetCurrentThreadId () returned 0x970 [0086.140] GetCurrentThreadId () returned 0x970 [0086.140] GetCurrentThreadId () returned 0x970 [0086.140] GetCurrentThreadId () returned 0x970 [0086.141] GetCurrentThreadId () returned 0x970 [0086.141] GetCurrentThreadId () returned 0x970 [0086.141] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAABe7e9HuFnhQbb7cQugi9h+AJ9yAsl+V/3NBvMG/gUV3Gss3JSclmcQW4An6gGB85fjpM3p/hoOMvYHR/xrTleR//cwJ71m0c8wQtZC9i+Fnf+iOpzhwANptk6joUMUOAEKTp5/Da9gZkrNcxNPs7HT7IYRlAp3HvvUOd/OVCvFvJaKYm8F2JyhHg6Tqgzhi5IMondhGvAXGvwzLSkimFzVuQOGxm4EOQ==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0086.141] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAABe7e9HuFnhQbb7cQugi9h+AJ9yAsl+V/3NBvMG/gUV3Gss3JSclmcQW4An6gGB85fjpM3p/hoOMvYHR/xrTleR//cwJ71m0c8wQtZC9i+Fnf+iOpzhwANptk6joUMUOAEKTp5/Da9gZkrNcxNPs7HT7IYRlAp3HvvUOd/OVCvFvJaKYm8F2JyhHg6Tqgzhi5IMondhGvAXGvwzLSkimFzVuQOGxm4EOQ==", cchWideChar=245, lpMultiByteStr=0x3b4d08c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAABe7e9HuFnhQbb7cQugi9h+AJ9yAsl+V/3NBvMG/gUV3Gss3JSclmcQW4An6gGB85fjpM3p/hoOMvYHR/xrTleR//cwJ71m0c8wQtZC9i+Fnf+iOpzhwANptk6joUMUOAEKTp5/Da9gZkrNcxNPs7HT7IYRlAp3HvvUOd/OVCvFvJaKYm8F2JyhHg6Tqgzhi5IMondhGvAXGvwzLSkimFzVuQOGxm4EOQ==", lpUsedDefaultChar=0x0) returned 245 [0086.141] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0086.141] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0086.141] CloseHandle (hObject=0x158) returned 1 [0086.141] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341447.jpg")) returned 1 [0086.142] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=20640564093) returned 1 [0086.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [J0341448.JPG].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [j0341448.jpg].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0086.143] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0086.143] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0086.143] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0086.143] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0086.143] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0086.143] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0086.143] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0086.143] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0086.143] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0086.143] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0086.143] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0086.143] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0086.144] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0086.144] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0086.144] SetEndOfFile (hFile=0x158) returned 1 [0086.144] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0086.144] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0086.144] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0086.144] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0086.144] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0086.145] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0086.145] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="~gG2vM,?D@1\"u\\vf:B,HuI+v*=i+3&,h", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0086.145] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="~gG2vM,?D@1\"u\\vf:B,HuI+v*=i+3&,h", cchWideChar=32, lpMultiByteStr=0x203bfc4, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="~gG2vM,?D@1\"u\\vf:B,HuI+v*=i+3&,h", lpUsedDefaultChar=0x0) returned 32 [0086.145] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0086.145] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0086.145] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x52c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341448.JPG", cAlternateFileName="")) returned 0x295098 [0086.145] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0086.145] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0086.145] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341448.jpg")) returned 0x20 [0086.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341448.jpg")) returned 0x20 [0086.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341448.jpg")) returned 0x20 [0086.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341448.jpg")) returned 0x20 [0086.146] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341448.jpg"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x52c3)) returned 1 [0086.146] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0086.146] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0086.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341448.jpg")) returned 0x20 [0086.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341448.jpg")) returned 0x20 [0086.146] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0086.146] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0086.146] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0086.146] SetEndOfFile (hFile=0x158) returned 1 [0086.147] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341448.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.147] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341448.JPG", cchWideChar=12, lpMultiByteStr=0x1fe37ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341448.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.147] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341448.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.147] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341448.JPG", cchWideChar=12, lpMultiByteStr=0x1fe39cc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341448.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.147] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe39cc, cbMultiByte=12, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="J0341448.JPGg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0086.147] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341448.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.147] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341448.JPG", cchWideChar=12, lpMultiByteStr=0x1fe37ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341448.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341448.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0086.148] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0086.148] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x52c3 [0086.148] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0086.148] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0086.148] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0086.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341448.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341448.JPG", cchWideChar=12, lpMultiByteStr=0x1fe37ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341448.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341448.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341448.JPG", cchWideChar=12, lpMultiByteStr=0x1fe39cc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341448.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.148] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe39cc, cbMultiByte=12, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="J0341448.JPG48.JPGg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0086.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341448.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341448.JPG", cchWideChar=12, lpMultiByteStr=0x1fe37ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341448.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.148] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0086.149] CharToOemA (in: pSrc="J0341448.JPG", pDst=0x1fe39cc | out: pDst="J0341448.JPG") returned 1 [0086.149] WriteFile (in: hFile=0x158, lpBuffer=0x1fe39cc*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe39cc*, lpNumberOfBytesWritten=0x18e048*=0xc, lpOverlapped=0x0) returned 1 [0086.149] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0086.149] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0086.150] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0086.150] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=20641311030) returned 1 [0086.150] ReadFile (in: hFile=0x11c, lpBuffer=0x3b95a30, nNumberOfBytesToRead=0x52c3, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b95a30*, lpNumberOfBytesRead=0x18dd7c*=0x52c3, lpOverlapped=0x0) returned 1 [0086.151] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0086.151] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=20641471822) returned 1 [0086.160] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b438*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b5b438*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0086.160] ReadFile (in: hFile=0x11c, lpBuffer=0x3b95a30, nNumberOfBytesToRead=0x52c3, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3b95a30*, lpNumberOfBytesRead=0x18de38*=0x52c3, lpOverlapped=0x0) returned 1 [0086.161] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x47 [0086.161] WriteFile (in: hFile=0x158, lpBuffer=0x381b020*, nNumberOfBytesToWrite=0x52c3, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x381b020*, lpNumberOfBytesWritten=0x18de10*=0x52c3, lpOverlapped=0x0) returned 1 [0086.161] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x530a [0086.161] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0086.162] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0086.162] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0086.162] SetFilePointer (in: hFile=0x158, lDistanceToMove=12, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2a [0086.162] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x5314 [0086.162] CloseHandle (hObject=0x11c) returned 1 [0086.162] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x5314 [0086.162] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x5314 [0086.162] SetFilePointer (in: hFile=0x158, lDistanceToMove=21268, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x5314 [0086.162] SetFilePointer (in: hFile=0x158, lDistanceToMove=21268, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x5314 [0086.162] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x5314 [0086.162] SetFilePointer (in: hFile=0x158, lDistanceToMove=21268, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x5314 [0086.162] SetEndOfFile (hFile=0x158) returned 1 [0086.162] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x5314 [0086.162] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x5314 [0086.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341448.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341448.JPG", cchWideChar=12, lpMultiByteStr=0x1fe37ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341448.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341448.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341448.JPG", cchWideChar=12, lpMultiByteStr=0x1fe43ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341448.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.163] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe43ac, cbMultiByte=12, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="J0341448.JPGꞗ@涤(\x18믉`믑`") returned 12 [0086.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341448.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341448.JPG", cchWideChar=12, lpMultiByteStr=0x1fe37ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341448.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.163] WriteFile (in: hFile=0x158, lpBuffer=0x37bea38*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x37bea38*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0086.163] CharToOemA (in: pSrc="J0341448.JPG", pDst=0x1fe43ac | out: pDst="J0341448.JPG") returned 1 [0086.163] WriteFile (in: hFile=0x158, lpBuffer=0x1fe43ac*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe43ac*, lpNumberOfBytesWritten=0x18efcc*=0xc, lpOverlapped=0x0) returned 1 [0086.163] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b470*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x3b5b470*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0086.163] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0086.163] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0086.163] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x5359 [0086.163] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x5359 [0086.163] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0086.164] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0086.164] DeleteFileW (lpFileName="") returned 0 [0086.164] GetLastError () returned 0x3 [0086.164] GetFileAttributesW (lpFileName="") returned 0xffffffff [0086.164] SetLastError (dwErrCode=0x3) [0086.164] FlushFileBuffers (hFile=0x158) returned 1 [0086.167] GetCurrentThreadId () returned 0x970 [0086.167] GetCurrentThreadId () returned 0x970 [0086.167] GetCurrentThreadId () returned 0x970 [0086.167] GetCurrentThreadId () returned 0x970 [0086.167] GetCurrentThreadId () returned 0x970 [0086.167] GetCurrentThreadId () returned 0x970 [0086.167] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x5410 [0086.167] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x5410 [0086.167] SetFilePointer (in: hFile=0x158, lDistanceToMove=21520, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x5410 [0086.167] CloseHandle (hObject=0x158) returned 1 [0086.167] GetCurrentThreadId () returned 0x970 [0086.168] GetCurrentThreadId () returned 0x970 [0086.168] GetCurrentThreadId () returned 0x970 [0086.168] GetCurrentThreadId () returned 0x970 [0086.168] GetCurrentThreadId () returned 0x970 [0086.168] GetCurrentThreadId () returned 0x970 [0086.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [J0341448.JPG].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [j0341448.jpg].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0086.168] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5410 [0086.168] SetFilePointer (in: hFile=0x158, lDistanceToMove=21392, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5390 [0086.168] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0086.168] GetFileType (hFile=0x158) returned 0x1 [0086.168] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x21, wMilliseconds=0x1b4)) [0086.168] GetCurrentThreadId () returned 0x970 [0086.168] GetCurrentThreadId () returned 0x970 [0086.168] GetCurrentThreadId () returned 0x970 [0086.168] GetCurrentThreadId () returned 0x970 [0086.168] GetCurrentThreadId () returned 0x970 [0086.168] GetCurrentThreadId () returned 0x970 [0086.168] GetCurrentThreadId () returned 0x970 [0086.168] GetCurrentThreadId () returned 0x970 [0086.168] GetCurrentThreadId () returned 0x970 [0086.168] GetCurrentThreadId () returned 0x970 [0086.168] GetCurrentThreadId () returned 0x970 [0086.168] GetCurrentThreadId () returned 0x970 [0086.168] GetCurrentThreadId () returned 0x970 [0086.168] GetCurrentThreadId () returned 0x970 [0086.168] GetCurrentThreadId () returned 0x970 [0086.168] GetCurrentThreadId () returned 0x970 [0086.168] GetCurrentThreadId () returned 0x970 [0086.168] GetCurrentThreadId () returned 0x970 [0086.168] GetCurrentThreadId () returned 0x970 [0086.168] GetCurrentThreadId () returned 0x970 [0086.169] GetCurrentThreadId () returned 0x970 [0086.169] GetCurrentThreadId () returned 0x970 [0086.169] GetCurrentThreadId () returned 0x970 [0086.169] GetCurrentThreadId () returned 0x970 [0086.169] GetCurrentThreadId () returned 0x970 [0086.169] GetCurrentThreadId () returned 0x970 [0086.169] GetCurrentThreadId () returned 0x970 [0086.169] GetCurrentThreadId () returned 0x970 [0086.169] GetCurrentThreadId () returned 0x970 [0086.169] GetCurrentThreadId () returned 0x970 [0086.169] GetCurrentThreadId () returned 0x970 [0086.169] GetCurrentThreadId () returned 0x970 [0086.169] GetCurrentThreadId () returned 0x970 [0086.169] GetCurrentThreadId () returned 0x970 [0086.169] GetCurrentThreadId () returned 0x970 [0086.169] GetCurrentThreadId () returned 0x970 [0086.169] GetCurrentThreadId () returned 0x970 [0086.169] GetCurrentThreadId () returned 0x970 [0086.169] GetCurrentThreadId () returned 0x970 [0086.169] GetCurrentThreadId () returned 0x970 [0086.169] GetCurrentThreadId () returned 0x970 [0086.169] GetCurrentThreadId () returned 0x970 [0086.169] GetCurrentThreadId () returned 0x970 [0086.169] GetCurrentThreadId () returned 0x970 [0086.169] GetCurrentThreadId () returned 0x970 [0086.169] GetCurrentThreadId () returned 0x970 [0086.169] GetCurrentThreadId () returned 0x970 [0086.169] GetCurrentThreadId () returned 0x970 [0086.169] GetCurrentThreadId () returned 0x970 [0086.169] GetCurrentThreadId () returned 0x970 [0086.169] GetCurrentThreadId () returned 0x970 [0086.169] GetCurrentThreadId () returned 0x970 [0086.169] GetCurrentThreadId () returned 0x970 [0086.169] GetCurrentThreadId () returned 0x970 [0086.169] GetCurrentThreadId () returned 0x970 [0086.169] GetCurrentThreadId () returned 0x970 [0086.169] GetCurrentThreadId () returned 0x970 [0086.169] GetCurrentThreadId () returned 0x970 [0086.169] GetCurrentThreadId () returned 0x970 [0086.169] GetCurrentThreadId () returned 0x970 [0086.169] GetCurrentThreadId () returned 0x970 [0086.169] GetCurrentThreadId () returned 0x970 [0086.169] GetCurrentThreadId () returned 0x970 [0086.170] GetCurrentThreadId () returned 0x970 [0086.170] GetCurrentThreadId () returned 0x970 [0086.170] GetCurrentThreadId () returned 0x970 [0086.170] GetCurrentThreadId () returned 0x970 [0086.170] GetCurrentThreadId () returned 0x970 [0086.170] GetCurrentThreadId () returned 0x970 [0086.170] GetCurrentThreadId () returned 0x970 [0086.170] GetCurrentThreadId () returned 0x970 [0086.170] GetCurrentThreadId () returned 0x970 [0086.170] GetCurrentThreadId () returned 0x970 [0086.170] GetCurrentThreadId () returned 0x970 [0086.170] GetCurrentThreadId () returned 0x970 [0086.170] GetCurrentThreadId () returned 0x970 [0086.170] GetCurrentThreadId () returned 0x970 [0086.170] GetCurrentThreadId () returned 0x970 [0086.170] GetCurrentThreadId () returned 0x970 [0086.170] GetCurrentThreadId () returned 0x970 [0086.170] GetCurrentThreadId () returned 0x970 [0086.170] GetCurrentThreadId () returned 0x970 [0086.170] GetCurrentThreadId () returned 0x970 [0086.170] GetCurrentThreadId () returned 0x970 [0086.170] GetCurrentThreadId () returned 0x970 [0086.170] GetCurrentThreadId () returned 0x970 [0086.170] GetCurrentThreadId () returned 0x970 [0086.170] GetCurrentThreadId () returned 0x970 [0086.170] GetCurrentThreadId () returned 0x970 [0086.170] GetCurrentThreadId () returned 0x970 [0086.170] GetCurrentThreadId () returned 0x970 [0086.170] GetCurrentThreadId () returned 0x970 [0086.170] GetCurrentThreadId () returned 0x970 [0086.170] GetCurrentThreadId () returned 0x970 [0086.170] GetCurrentThreadId () returned 0x970 [0086.170] GetCurrentThreadId () returned 0x970 [0086.170] GetCurrentThreadId () returned 0x970 [0086.170] GetCurrentThreadId () returned 0x970 [0086.170] GetCurrentThreadId () returned 0x970 [0086.170] GetCurrentThreadId () returned 0x970 [0086.170] GetCurrentThreadId () returned 0x970 [0086.170] GetCurrentThreadId () returned 0x970 [0086.170] GetCurrentThreadId () returned 0x970 [0086.170] GetCurrentThreadId () returned 0x970 [0086.170] GetCurrentThreadId () returned 0x970 [0086.170] GetCurrentThreadId () returned 0x970 [0086.170] GetCurrentThreadId () returned 0x970 [0086.170] GetCurrentThreadId () returned 0x970 [0086.170] GetCurrentThreadId () returned 0x970 [0086.171] GetCurrentThreadId () returned 0x970 [0086.171] GetCurrentThreadId () returned 0x970 [0086.171] GetCurrentThreadId () returned 0x970 [0086.171] GetCurrentThreadId () returned 0x970 [0086.171] GetCurrentThreadId () returned 0x970 [0086.171] GetCurrentThreadId () returned 0x970 [0086.171] GetCurrentThreadId () returned 0x970 [0086.171] GetCurrentThreadId () returned 0x970 [0086.171] GetCurrentThreadId () returned 0x970 [0086.171] GetCurrentThreadId () returned 0x970 [0086.171] GetCurrentThreadId () returned 0x970 [0086.171] GetCurrentThreadId () returned 0x970 [0086.171] GetCurrentThreadId () returned 0x970 [0086.171] GetCurrentThreadId () returned 0x970 [0086.171] GetCurrentThreadId () returned 0x970 [0086.171] GetCurrentThreadId () returned 0x970 [0086.171] GetCurrentThreadId () returned 0x970 [0086.171] GetCurrentThreadId () returned 0x970 [0086.171] GetCurrentThreadId () returned 0x970 [0086.171] GetCurrentThreadId () returned 0x970 [0086.171] GetCurrentThreadId () returned 0x970 [0086.171] GetCurrentThreadId () returned 0x970 [0086.171] GetCurrentThreadId () returned 0x970 [0086.171] GetCurrentThreadId () returned 0x970 [0086.171] GetCurrentThreadId () returned 0x970 [0086.171] GetCurrentThreadId () returned 0x970 [0086.171] GetCurrentThreadId () returned 0x970 [0086.171] GetCurrentThreadId () returned 0x970 [0086.171] GetCurrentThreadId () returned 0x970 [0086.171] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.171] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.171] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5e830, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0086.171] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.171] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.171] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5e830, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0086.171] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.171] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.171] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b530, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0086.171] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.171] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.172] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b530, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0086.172] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.172] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.172] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0086.172] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.172] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.172] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0086.172] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.172] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.172] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0086.172] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x21, wMilliseconds=0x1b4)) [0086.172] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="~gG2vM,?D@1\"u\\vf:B,HuI+v*=i+3&,h", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0086.172] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="~gG2vM,?D@1\"u\\vf:B,HuI+v*=i+3&,h", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0086.172] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="~gG2vM,?D@1\"u\\vf:B,HuI+v*=i+3&,h", cchWideChar=32, lpMultiByteStr=0x3b56228, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="~gG2vM,?D@1\"u\\vf:B,HuI+v*=i+3&,h", lpUsedDefaultChar=0x0) returned 32 [0086.172] GetCurrentThreadId () returned 0x970 [0086.172] GetCurrentThreadId () returned 0x970 [0086.172] GetCurrentThreadId () returned 0x970 [0086.172] GetCurrentThreadId () returned 0x970 [0086.172] GetCurrentThreadId () returned 0x970 [0086.172] GetCurrentThreadId () returned 0x970 [0086.180] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0086.180] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0086.180] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3b867d8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0086.180] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0086.180] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAABqOpm/MHXClgN8Nz7gxrgho3cXt4P0MQwQfCyC3UvwGJIi33W2N6/a9WQye+peQx/i/AYUgDDlDT2ssEeiVkn4RcxQ4mwG/Nz9SBnvjKsvjqgdze8fBoSDRiW6+jgmL1/U87uy/Ptba5GD4KPoo/MNwALaH2dHEsZfZDGW1+qPtfm/NgjiYa7PfEqrxokW0CbLDNQDdmEZCckMFQfSPQTkFJCZFWH98kg==") returned 232 [0086.180] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x21, wMilliseconds=0x1c4)) [0086.180] GetCurrentThreadId () returned 0x970 [0086.180] GetCurrentThreadId () returned 0x970 [0086.180] GetCurrentThreadId () returned 0x970 [0086.180] GetCurrentThreadId () returned 0x970 [0086.180] GetCurrentThreadId () returned 0x970 [0086.180] GetCurrentThreadId () returned 0x970 [0086.180] GetCurrentThreadId () returned 0x970 [0086.180] GetCurrentThreadId () returned 0x970 [0086.180] GetCurrentThreadId () returned 0x970 [0086.180] GetCurrentThreadId () returned 0x970 [0086.180] GetCurrentThreadId () returned 0x970 [0086.180] GetCurrentThreadId () returned 0x970 [0086.180] GetCurrentThreadId () returned 0x970 [0086.180] GetCurrentThreadId () returned 0x970 [0086.180] GetCurrentThreadId () returned 0x970 [0086.180] GetCurrentThreadId () returned 0x970 [0086.180] GetCurrentThreadId () returned 0x970 [0086.180] GetCurrentThreadId () returned 0x970 [0086.180] GetCurrentThreadId () returned 0x970 [0086.180] GetCurrentThreadId () returned 0x970 [0086.180] GetCurrentThreadId () returned 0x970 [0086.180] GetCurrentThreadId () returned 0x970 [0086.180] GetCurrentThreadId () returned 0x970 [0086.181] GetCurrentThreadId () returned 0x970 [0086.181] GetCurrentThreadId () returned 0x970 [0086.181] GetCurrentThreadId () returned 0x970 [0086.181] GetCurrentThreadId () returned 0x970 [0086.181] GetCurrentThreadId () returned 0x970 [0086.181] GetCurrentThreadId () returned 0x970 [0086.181] GetCurrentThreadId () returned 0x970 [0086.181] GetCurrentThreadId () returned 0x970 [0086.181] GetCurrentThreadId () returned 0x970 [0086.181] GetCurrentThreadId () returned 0x970 [0086.181] GetCurrentThreadId () returned 0x970 [0086.181] GetCurrentThreadId () returned 0x970 [0086.181] GetCurrentThreadId () returned 0x970 [0086.181] GetCurrentThreadId () returned 0x970 [0086.181] GetCurrentThreadId () returned 0x970 [0086.181] GetCurrentThreadId () returned 0x970 [0086.181] GetCurrentThreadId () returned 0x970 [0086.181] GetCurrentThreadId () returned 0x970 [0086.181] GetCurrentThreadId () returned 0x970 [0086.181] GetCurrentThreadId () returned 0x970 [0086.181] GetCurrentThreadId () returned 0x970 [0086.181] GetCurrentThreadId () returned 0x970 [0086.181] GetCurrentThreadId () returned 0x970 [0086.181] GetCurrentThreadId () returned 0x970 [0086.181] GetCurrentThreadId () returned 0x970 [0086.181] GetCurrentThreadId () returned 0x970 [0086.181] GetCurrentThreadId () returned 0x970 [0086.181] GetCurrentThreadId () returned 0x970 [0086.181] GetCurrentThreadId () returned 0x970 [0086.181] GetCurrentThreadId () returned 0x970 [0086.181] GetCurrentThreadId () returned 0x970 [0086.181] GetCurrentThreadId () returned 0x970 [0086.181] GetCurrentThreadId () returned 0x970 [0086.181] GetCurrentThreadId () returned 0x970 [0086.181] GetCurrentThreadId () returned 0x970 [0086.181] GetCurrentThreadId () returned 0x970 [0086.181] GetCurrentThreadId () returned 0x970 [0086.181] GetCurrentThreadId () returned 0x970 [0086.181] GetCurrentThreadId () returned 0x970 [0086.181] GetCurrentThreadId () returned 0x970 [0086.181] GetCurrentThreadId () returned 0x970 [0086.181] GetCurrentThreadId () returned 0x970 [0086.181] GetCurrentThreadId () returned 0x970 [0086.182] GetCurrentThreadId () returned 0x970 [0086.182] GetCurrentThreadId () returned 0x970 [0086.182] GetCurrentThreadId () returned 0x970 [0086.182] GetCurrentThreadId () returned 0x970 [0086.182] GetCurrentThreadId () returned 0x970 [0086.182] GetCurrentThreadId () returned 0x970 [0086.182] GetCurrentThreadId () returned 0x970 [0086.182] GetCurrentThreadId () returned 0x970 [0086.182] GetCurrentThreadId () returned 0x970 [0086.182] GetCurrentThreadId () returned 0x970 [0086.182] GetCurrentThreadId () returned 0x970 [0086.182] GetCurrentThreadId () returned 0x970 [0086.182] GetCurrentThreadId () returned 0x970 [0086.182] GetCurrentThreadId () returned 0x970 [0086.182] GetCurrentThreadId () returned 0x970 [0086.182] GetCurrentThreadId () returned 0x970 [0086.182] GetCurrentThreadId () returned 0x970 [0086.182] GetCurrentThreadId () returned 0x970 [0086.182] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAABqOpm/MHXClgN8Nz7gxrgho3cXt4P0MQwQfCyC3UvwGJIi33W2N6/a9WQye+peQx/i/AYUgDDlDT2ssEeiVkn4RcxQ4mwG/Nz9SBnvjKsvjqgdze8fBoSDRiW6+jgmL1/U87uy/Ptba5GD4KPoo/MNwALaH2dHEsZfZDGW1+qPtfm/NgjiYa7PfEqrxokW0CbLDNQDdmEZCckMFQfSPQTkFJCZFWH98kg==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0086.182] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAABqOpm/MHXClgN8Nz7gxrgho3cXt4P0MQwQfCyC3UvwGJIi33W2N6/a9WQye+peQx/i/AYUgDDlDT2ssEeiVkn4RcxQ4mwG/Nz9SBnvjKsvjqgdze8fBoSDRiW6+jgmL1/U87uy/Ptba5GD4KPoo/MNwALaH2dHEsZfZDGW1+qPtfm/NgjiYa7PfEqrxokW0CbLDNQDdmEZCckMFQfSPQTkFJCZFWH98kg==", cchWideChar=245, lpMultiByteStr=0x3b4d08c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAABqOpm/MHXClgN8Nz7gxrgho3cXt4P0MQwQfCyC3UvwGJIi33W2N6/a9WQye+peQx/i/AYUgDDlDT2ssEeiVkn4RcxQ4mwG/Nz9SBnvjKsvjqgdze8fBoSDRiW6+jgmL1/U87uy/Ptba5GD4KPoo/MNwALaH2dHEsZfZDGW1+qPtfm/NgjiYa7PfEqrxokW0CbLDNQDdmEZCckMFQfSPQTkFJCZFWH98kg==", lpUsedDefaultChar=0x0) returned 245 [0086.182] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0086.182] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0086.182] CloseHandle (hObject=0x158) returned 1 [0086.182] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341448.jpg")) returned 1 [0086.184] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=20644702174) returned 1 [0086.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [J0341455.JPG].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [j0341455.jpg].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0086.184] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0086.184] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0086.185] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0086.185] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0086.185] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0086.185] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0086.185] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0086.185] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0086.185] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0086.185] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0086.185] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0086.185] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0086.185] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0086.185] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0086.185] SetEndOfFile (hFile=0x158) returned 1 [0086.186] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0086.186] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0086.186] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0086.186] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0086.186] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0086.187] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0086.187] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="*%xtm:W2s4jMVxU#$sfc\\O2aG?eRT50g", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0086.187] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="*%xtm:W2s4jMVxU#$sfc\\O2aG?eRT50g", cchWideChar=32, lpMultiByteStr=0x203bffc, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*%xtm:W2s4jMVxU#$sfc\\O2aG?eRT50g", lpUsedDefaultChar=0x0) returned 32 [0086.187] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0086.187] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0086.187] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7457, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341455.JPG", cAlternateFileName="")) returned 0x295098 [0086.187] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0086.187] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0086.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341455.jpg")) returned 0x20 [0086.188] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341455.jpg")) returned 0x20 [0086.188] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341455.jpg")) returned 0x20 [0086.188] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341455.jpg")) returned 0x20 [0086.189] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341455.jpg"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7457)) returned 1 [0086.189] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0086.189] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0086.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341455.jpg")) returned 0x20 [0086.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341455.jpg")) returned 0x20 [0086.189] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0086.189] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0086.189] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0086.189] SetEndOfFile (hFile=0x158) returned 1 [0086.190] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341455.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.190] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341455.JPG", cchWideChar=12, lpMultiByteStr=0x1fe44ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341455.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.190] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341455.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.190] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341455.JPG", cchWideChar=12, lpMultiByteStr=0x1fe376c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341455.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.190] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe376c, cbMultiByte=12, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="J0341455.JPGg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0086.190] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341455.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.190] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341455.JPG", cchWideChar=12, lpMultiByteStr=0x1fe44ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341455.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341455.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0086.190] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0086.191] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x7457 [0086.191] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0086.191] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0086.191] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0086.191] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341455.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.191] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341455.JPG", cchWideChar=12, lpMultiByteStr=0x1fe44ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341455.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.191] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341455.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.191] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341455.JPG", cchWideChar=12, lpMultiByteStr=0x1fe376c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341455.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.191] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe376c, cbMultiByte=12, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="J0341455.JPG55.JPGg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0086.191] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341455.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.191] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341455.JPG", cchWideChar=12, lpMultiByteStr=0x1fe44ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341455.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.191] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0086.192] CharToOemA (in: pSrc="J0341455.JPG", pDst=0x1fe376c | out: pDst="J0341455.JPG") returned 1 [0086.192] WriteFile (in: hFile=0x158, lpBuffer=0x1fe376c*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe376c*, lpNumberOfBytesWritten=0x18e048*=0xc, lpOverlapped=0x0) returned 1 [0086.192] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0086.192] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0086.192] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0086.192] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=20645584133) returned 1 [0086.192] ReadFile (in: hFile=0x11c, lpBuffer=0x3b95a30, nNumberOfBytesToRead=0x7457, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b95a30*, lpNumberOfBytesRead=0x18dd7c*=0x7457, lpOverlapped=0x0) returned 1 [0086.194] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0086.194] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=20645784299) returned 1 [0086.203] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b420*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b5b420*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0086.203] ReadFile (in: hFile=0x11c, lpBuffer=0x3b95a30, nNumberOfBytesToRead=0x7457, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3b95a30*, lpNumberOfBytesRead=0x18de38*=0x7457, lpOverlapped=0x0) returned 1 [0086.204] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x47 [0086.205] WriteFile (in: hFile=0x158, lpBuffer=0x381b020*, nNumberOfBytesToWrite=0x7457, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x381b020*, lpNumberOfBytesWritten=0x18de10*=0x7457, lpOverlapped=0x0) returned 1 [0086.205] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x749e [0086.205] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0086.205] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0086.206] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0086.206] SetFilePointer (in: hFile=0x158, lDistanceToMove=12, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2a [0086.206] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x74a8 [0086.206] CloseHandle (hObject=0x11c) returned 1 [0086.206] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x74a8 [0086.206] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x74a8 [0086.206] SetFilePointer (in: hFile=0x158, lDistanceToMove=29864, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x74a8 [0086.206] SetFilePointer (in: hFile=0x158, lDistanceToMove=29864, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x74a8 [0086.206] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x74a8 [0086.206] SetFilePointer (in: hFile=0x158, lDistanceToMove=29864, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x74a8 [0086.206] SetEndOfFile (hFile=0x158) returned 1 [0086.207] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x74a8 [0086.207] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x74a8 [0086.207] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341455.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.207] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341455.JPG", cchWideChar=12, lpMultiByteStr=0x1fe44ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341455.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.207] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341455.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.207] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341455.JPG", cchWideChar=12, lpMultiByteStr=0x1fe3a2c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341455.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.207] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe3a2c, cbMultiByte=12, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="J0341455.JPGꞗ@涤(\x18믉`믑`") returned 12 [0086.207] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341455.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.207] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341455.JPG", cchWideChar=12, lpMultiByteStr=0x1fe44ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341455.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.207] WriteFile (in: hFile=0x158, lpBuffer=0x37bea38*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x37bea38*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0086.207] CharToOemA (in: pSrc="J0341455.JPG", pDst=0x1fe3a2c | out: pDst="J0341455.JPG") returned 1 [0086.207] WriteFile (in: hFile=0x158, lpBuffer=0x1fe3a2c*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe3a2c*, lpNumberOfBytesWritten=0x18efcc*=0xc, lpOverlapped=0x0) returned 1 [0086.207] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b350*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x3b5b350*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0086.208] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0086.208] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0086.208] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x74ed [0086.208] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x74ed [0086.208] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0086.208] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0086.208] DeleteFileW (lpFileName="") returned 0 [0086.208] GetLastError () returned 0x3 [0086.208] GetFileAttributesW (lpFileName="") returned 0xffffffff [0086.208] SetLastError (dwErrCode=0x3) [0086.208] FlushFileBuffers (hFile=0x158) returned 1 [0086.211] GetCurrentThreadId () returned 0x970 [0086.211] GetCurrentThreadId () returned 0x970 [0086.211] GetCurrentThreadId () returned 0x970 [0086.211] GetCurrentThreadId () returned 0x970 [0086.211] GetCurrentThreadId () returned 0x970 [0086.211] GetCurrentThreadId () returned 0x970 [0086.211] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x75a4 [0086.211] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x75a4 [0086.211] SetFilePointer (in: hFile=0x158, lDistanceToMove=30116, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x75a4 [0086.211] CloseHandle (hObject=0x158) returned 1 [0086.211] GetCurrentThreadId () returned 0x970 [0086.211] GetCurrentThreadId () returned 0x970 [0086.211] GetCurrentThreadId () returned 0x970 [0086.211] GetCurrentThreadId () returned 0x970 [0086.211] GetCurrentThreadId () returned 0x970 [0086.211] GetCurrentThreadId () returned 0x970 [0086.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [J0341455.JPG].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [j0341455.jpg].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0086.211] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x75a4 [0086.211] SetFilePointer (in: hFile=0x158, lDistanceToMove=29988, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7524 [0086.211] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0086.211] GetFileType (hFile=0x158) returned 0x1 [0086.212] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x21, wMilliseconds=0x1e3)) [0086.212] GetCurrentThreadId () returned 0x970 [0086.212] GetCurrentThreadId () returned 0x970 [0086.212] GetCurrentThreadId () returned 0x970 [0086.212] GetCurrentThreadId () returned 0x970 [0086.212] GetCurrentThreadId () returned 0x970 [0086.212] GetCurrentThreadId () returned 0x970 [0086.212] GetCurrentThreadId () returned 0x970 [0086.212] GetCurrentThreadId () returned 0x970 [0086.212] GetCurrentThreadId () returned 0x970 [0086.212] GetCurrentThreadId () returned 0x970 [0086.212] GetCurrentThreadId () returned 0x970 [0086.212] GetCurrentThreadId () returned 0x970 [0086.212] GetCurrentThreadId () returned 0x970 [0086.212] GetCurrentThreadId () returned 0x970 [0086.212] GetCurrentThreadId () returned 0x970 [0086.212] GetCurrentThreadId () returned 0x970 [0086.212] GetCurrentThreadId () returned 0x970 [0086.212] GetCurrentThreadId () returned 0x970 [0086.212] GetCurrentThreadId () returned 0x970 [0086.212] GetCurrentThreadId () returned 0x970 [0086.212] GetCurrentThreadId () returned 0x970 [0086.212] GetCurrentThreadId () returned 0x970 [0086.212] GetCurrentThreadId () returned 0x970 [0086.212] GetCurrentThreadId () returned 0x970 [0086.212] GetCurrentThreadId () returned 0x970 [0086.212] GetCurrentThreadId () returned 0x970 [0086.212] GetCurrentThreadId () returned 0x970 [0086.212] GetCurrentThreadId () returned 0x970 [0086.212] GetCurrentThreadId () returned 0x970 [0086.212] GetCurrentThreadId () returned 0x970 [0086.212] GetCurrentThreadId () returned 0x970 [0086.212] GetCurrentThreadId () returned 0x970 [0086.212] GetCurrentThreadId () returned 0x970 [0086.212] GetCurrentThreadId () returned 0x970 [0086.212] GetCurrentThreadId () returned 0x970 [0086.212] GetCurrentThreadId () returned 0x970 [0086.212] GetCurrentThreadId () returned 0x970 [0086.212] GetCurrentThreadId () returned 0x970 [0086.212] GetCurrentThreadId () returned 0x970 [0086.212] GetCurrentThreadId () returned 0x970 [0086.212] GetCurrentThreadId () returned 0x970 [0086.212] GetCurrentThreadId () returned 0x970 [0086.213] GetCurrentThreadId () returned 0x970 [0086.213] GetCurrentThreadId () returned 0x970 [0086.213] GetCurrentThreadId () returned 0x970 [0086.213] GetCurrentThreadId () returned 0x970 [0086.213] GetCurrentThreadId () returned 0x970 [0086.213] GetCurrentThreadId () returned 0x970 [0086.213] GetCurrentThreadId () returned 0x970 [0086.213] GetCurrentThreadId () returned 0x970 [0086.213] GetCurrentThreadId () returned 0x970 [0086.213] GetCurrentThreadId () returned 0x970 [0086.213] GetCurrentThreadId () returned 0x970 [0086.213] GetCurrentThreadId () returned 0x970 [0086.213] GetCurrentThreadId () returned 0x970 [0086.213] GetCurrentThreadId () returned 0x970 [0086.213] GetCurrentThreadId () returned 0x970 [0086.213] GetCurrentThreadId () returned 0x970 [0086.213] GetCurrentThreadId () returned 0x970 [0086.213] GetCurrentThreadId () returned 0x970 [0086.213] GetCurrentThreadId () returned 0x970 [0086.213] GetCurrentThreadId () returned 0x970 [0086.213] GetCurrentThreadId () returned 0x970 [0086.213] GetCurrentThreadId () returned 0x970 [0086.213] GetCurrentThreadId () returned 0x970 [0086.213] GetCurrentThreadId () returned 0x970 [0086.213] GetCurrentThreadId () returned 0x970 [0086.213] GetCurrentThreadId () returned 0x970 [0086.213] GetCurrentThreadId () returned 0x970 [0086.213] GetCurrentThreadId () returned 0x970 [0086.213] GetCurrentThreadId () returned 0x970 [0086.213] GetCurrentThreadId () returned 0x970 [0086.213] GetCurrentThreadId () returned 0x970 [0086.213] GetCurrentThreadId () returned 0x970 [0086.213] GetCurrentThreadId () returned 0x970 [0086.213] GetCurrentThreadId () returned 0x970 [0086.213] GetCurrentThreadId () returned 0x970 [0086.213] GetCurrentThreadId () returned 0x970 [0086.213] GetCurrentThreadId () returned 0x970 [0086.213] GetCurrentThreadId () returned 0x970 [0086.213] GetCurrentThreadId () returned 0x970 [0086.213] GetCurrentThreadId () returned 0x970 [0086.213] GetCurrentThreadId () returned 0x970 [0086.213] GetCurrentThreadId () returned 0x970 [0086.214] GetCurrentThreadId () returned 0x970 [0086.214] GetCurrentThreadId () returned 0x970 [0086.214] GetCurrentThreadId () returned 0x970 [0086.214] GetCurrentThreadId () returned 0x970 [0086.214] GetCurrentThreadId () returned 0x970 [0086.214] GetCurrentThreadId () returned 0x970 [0086.214] GetCurrentThreadId () returned 0x970 [0086.214] GetCurrentThreadId () returned 0x970 [0086.214] GetCurrentThreadId () returned 0x970 [0086.214] GetCurrentThreadId () returned 0x970 [0086.214] GetCurrentThreadId () returned 0x970 [0086.215] GetCurrentThreadId () returned 0x970 [0086.215] GetCurrentThreadId () returned 0x970 [0086.215] GetCurrentThreadId () returned 0x970 [0086.215] GetCurrentThreadId () returned 0x970 [0086.215] GetCurrentThreadId () returned 0x970 [0086.215] GetCurrentThreadId () returned 0x970 [0086.215] GetCurrentThreadId () returned 0x970 [0086.215] GetCurrentThreadId () returned 0x970 [0086.215] GetCurrentThreadId () returned 0x970 [0086.215] GetCurrentThreadId () returned 0x970 [0086.215] GetCurrentThreadId () returned 0x970 [0086.215] GetCurrentThreadId () returned 0x970 [0086.215] GetCurrentThreadId () returned 0x970 [0086.215] GetCurrentThreadId () returned 0x970 [0086.215] GetCurrentThreadId () returned 0x970 [0086.215] GetCurrentThreadId () returned 0x970 [0086.215] GetCurrentThreadId () returned 0x970 [0086.215] GetCurrentThreadId () returned 0x970 [0086.215] GetCurrentThreadId () returned 0x970 [0086.215] GetCurrentThreadId () returned 0x970 [0086.215] GetCurrentThreadId () returned 0x970 [0086.215] GetCurrentThreadId () returned 0x970 [0086.215] GetCurrentThreadId () returned 0x970 [0086.215] GetCurrentThreadId () returned 0x970 [0086.215] GetCurrentThreadId () returned 0x970 [0086.215] GetCurrentThreadId () returned 0x970 [0086.215] GetCurrentThreadId () returned 0x970 [0086.215] GetCurrentThreadId () returned 0x970 [0086.215] GetCurrentThreadId () returned 0x970 [0086.215] GetCurrentThreadId () returned 0x970 [0086.215] GetCurrentThreadId () returned 0x970 [0086.215] GetCurrentThreadId () returned 0x970 [0086.215] GetCurrentThreadId () returned 0x970 [0086.215] GetCurrentThreadId () returned 0x970 [0086.215] GetCurrentThreadId () returned 0x970 [0086.215] GetCurrentThreadId () returned 0x970 [0086.215] GetCurrentThreadId () returned 0x970 [0086.216] GetCurrentThreadId () returned 0x970 [0086.216] GetCurrentThreadId () returned 0x970 [0086.216] GetCurrentThreadId () returned 0x970 [0086.216] GetCurrentThreadId () returned 0x970 [0086.216] GetCurrentThreadId () returned 0x970 [0086.216] GetCurrentThreadId () returned 0x970 [0086.216] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.216] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.216] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0086.216] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.216] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.216] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5e890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0086.216] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.216] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.216] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b548, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0086.216] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.216] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.216] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b548, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0086.216] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.216] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.216] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5e8f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0086.216] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.216] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.216] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5e8f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0086.216] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.216] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.216] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5e8f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0086.216] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x21, wMilliseconds=0x1e3)) [0086.216] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="*%xtm:W2s4jMVxU#$sfc\\O2aG?eRT50g", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0086.216] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="*%xtm:W2s4jMVxU#$sfc\\O2aG?eRT50g", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0086.216] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="*%xtm:W2s4jMVxU#$sfc\\O2aG?eRT50g", cchWideChar=32, lpMultiByteStr=0x3b56258, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*%xtm:W2s4jMVxU#$sfc\\O2aG?eRT50g", lpUsedDefaultChar=0x0) returned 32 [0086.217] GetCurrentThreadId () returned 0x970 [0086.217] GetCurrentThreadId () returned 0x970 [0086.217] GetCurrentThreadId () returned 0x970 [0086.217] GetCurrentThreadId () returned 0x970 [0086.217] GetCurrentThreadId () returned 0x970 [0086.217] GetCurrentThreadId () returned 0x970 [0086.224] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0086.224] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0086.224] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3b868c8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0086.224] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0086.224] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAFSL3KKj3Y+eWbVVIWzAEPZgfZv0sGwkV7LR5zXTixiEi9h5JmJG0hzf0/wiyLvlQm+0UOBu5ktfMTeny2ULj1lmYxACLzyh1LjGcQvlJinZXJ39+L1d/RbheKHPHtqqRKYd9uO4/q9XjzWXWmaYNtqkbvuuGyvwOg6daakDGFspayS9KRZaeYnWHMf1OqAJ2+09CXdDzoeFn4lrelzl0eQeSp1NgN8/mQ==") returned 232 [0086.224] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x21, wMilliseconds=0x1f2)) [0086.224] GetCurrentThreadId () returned 0x970 [0086.224] GetCurrentThreadId () returned 0x970 [0086.224] GetCurrentThreadId () returned 0x970 [0086.224] GetCurrentThreadId () returned 0x970 [0086.224] GetCurrentThreadId () returned 0x970 [0086.224] GetCurrentThreadId () returned 0x970 [0086.224] GetCurrentThreadId () returned 0x970 [0086.225] GetCurrentThreadId () returned 0x970 [0086.225] GetCurrentThreadId () returned 0x970 [0086.225] GetCurrentThreadId () returned 0x970 [0086.225] GetCurrentThreadId () returned 0x970 [0086.225] GetCurrentThreadId () returned 0x970 [0086.225] GetCurrentThreadId () returned 0x970 [0086.225] GetCurrentThreadId () returned 0x970 [0086.225] GetCurrentThreadId () returned 0x970 [0086.225] GetCurrentThreadId () returned 0x970 [0086.225] GetCurrentThreadId () returned 0x970 [0086.225] GetCurrentThreadId () returned 0x970 [0086.225] GetCurrentThreadId () returned 0x970 [0086.225] GetCurrentThreadId () returned 0x970 [0086.225] GetCurrentThreadId () returned 0x970 [0086.225] GetCurrentThreadId () returned 0x970 [0086.225] GetCurrentThreadId () returned 0x970 [0086.225] GetCurrentThreadId () returned 0x970 [0086.225] GetCurrentThreadId () returned 0x970 [0086.225] GetCurrentThreadId () returned 0x970 [0086.225] GetCurrentThreadId () returned 0x970 [0086.225] GetCurrentThreadId () returned 0x970 [0086.225] GetCurrentThreadId () returned 0x970 [0086.225] GetCurrentThreadId () returned 0x970 [0086.225] GetCurrentThreadId () returned 0x970 [0086.225] GetCurrentThreadId () returned 0x970 [0086.225] GetCurrentThreadId () returned 0x970 [0086.225] GetCurrentThreadId () returned 0x970 [0086.225] GetCurrentThreadId () returned 0x970 [0086.225] GetCurrentThreadId () returned 0x970 [0086.225] GetCurrentThreadId () returned 0x970 [0086.225] GetCurrentThreadId () returned 0x970 [0086.225] GetCurrentThreadId () returned 0x970 [0086.225] GetCurrentThreadId () returned 0x970 [0086.225] GetCurrentThreadId () returned 0x970 [0086.225] GetCurrentThreadId () returned 0x970 [0086.225] GetCurrentThreadId () returned 0x970 [0086.225] GetCurrentThreadId () returned 0x970 [0086.225] GetCurrentThreadId () returned 0x970 [0086.225] GetCurrentThreadId () returned 0x970 [0086.225] GetCurrentThreadId () returned 0x970 [0086.225] GetCurrentThreadId () returned 0x970 [0086.225] GetCurrentThreadId () returned 0x970 [0086.225] GetCurrentThreadId () returned 0x970 [0086.225] GetCurrentThreadId () returned 0x970 [0086.225] GetCurrentThreadId () returned 0x970 [0086.226] GetCurrentThreadId () returned 0x970 [0086.226] GetCurrentThreadId () returned 0x970 [0086.226] GetCurrentThreadId () returned 0x970 [0086.226] GetCurrentThreadId () returned 0x970 [0086.226] GetCurrentThreadId () returned 0x970 [0086.226] GetCurrentThreadId () returned 0x970 [0086.226] GetCurrentThreadId () returned 0x970 [0086.226] GetCurrentThreadId () returned 0x970 [0086.226] GetCurrentThreadId () returned 0x970 [0086.226] GetCurrentThreadId () returned 0x970 [0086.226] GetCurrentThreadId () returned 0x970 [0086.226] GetCurrentThreadId () returned 0x970 [0086.226] GetCurrentThreadId () returned 0x970 [0086.226] GetCurrentThreadId () returned 0x970 [0086.226] GetCurrentThreadId () returned 0x970 [0086.226] GetCurrentThreadId () returned 0x970 [0086.226] GetCurrentThreadId () returned 0x970 [0086.226] GetCurrentThreadId () returned 0x970 [0086.226] GetCurrentThreadId () returned 0x970 [0086.226] GetCurrentThreadId () returned 0x970 [0086.226] GetCurrentThreadId () returned 0x970 [0086.226] GetCurrentThreadId () returned 0x970 [0086.226] GetCurrentThreadId () returned 0x970 [0086.226] GetCurrentThreadId () returned 0x970 [0086.226] GetCurrentThreadId () returned 0x970 [0086.226] GetCurrentThreadId () returned 0x970 [0086.226] GetCurrentThreadId () returned 0x970 [0086.226] GetCurrentThreadId () returned 0x970 [0086.226] GetCurrentThreadId () returned 0x970 [0086.226] GetCurrentThreadId () returned 0x970 [0086.226] GetCurrentThreadId () returned 0x970 [0086.226] GetCurrentThreadId () returned 0x970 [0086.226] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAFSL3KKj3Y+eWbVVIWzAEPZgfZv0sGwkV7LR5zXTixiEi9h5JmJG0hzf0/wiyLvlQm+0UOBu5ktfMTeny2ULj1lmYxACLzyh1LjGcQvlJinZXJ39+L1d/RbheKHPHtqqRKYd9uO4/q9XjzWXWmaYNtqkbvuuGyvwOg6daakDGFspayS9KRZaeYnWHMf1OqAJ2+09CXdDzoeFn4lrelzl0eQeSp1NgN8/mQ==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0086.226] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAFSL3KKj3Y+eWbVVIWzAEPZgfZv0sGwkV7LR5zXTixiEi9h5JmJG0hzf0/wiyLvlQm+0UOBu5ktfMTeny2ULj1lmYxACLzyh1LjGcQvlJinZXJ39+L1d/RbheKHPHtqqRKYd9uO4/q9XjzWXWmaYNtqkbvuuGyvwOg6daakDGFspayS9KRZaeYnWHMf1OqAJ2+09CXdDzoeFn4lrelzl0eQeSp1NgN8/mQ==", cchWideChar=245, lpMultiByteStr=0x3b4d08c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAFSL3KKj3Y+eWbVVIWzAEPZgfZv0sGwkV7LR5zXTixiEi9h5JmJG0hzf0/wiyLvlQm+0UOBu5ktfMTeny2ULj1lmYxACLzyh1LjGcQvlJinZXJ39+L1d/RbheKHPHtqqRKYd9uO4/q9XjzWXWmaYNtqkbvuuGyvwOg6daakDGFspayS9KRZaeYnWHMf1OqAJ2+09CXdDzoeFn4lrelzl0eQeSp1NgN8/mQ==", lpUsedDefaultChar=0x0) returned 245 [0086.226] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0086.226] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0086.227] CloseHandle (hObject=0x158) returned 1 [0086.227] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341455.jpg")) returned 1 [0086.229] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=20649278519) returned 1 [0086.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [J0341475.JPG].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [j0341475.jpg].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0086.230] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0086.230] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0086.230] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0086.230] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0086.230] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0086.230] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0086.230] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0086.231] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0086.231] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0086.231] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0086.231] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0086.231] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0086.231] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0086.231] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0086.231] SetEndOfFile (hFile=0x158) returned 1 [0086.231] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0086.231] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0086.231] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0086.231] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0086.231] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0086.232] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0086.232] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="chAhskx*}$@WFB&L-\"c%AM*sip9+\"&84", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0086.232] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="chAhskx*}$@WFB&L-\"c%AM*sip9+\"&84", cchWideChar=32, lpMultiByteStr=0x203c034, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="chAhskx*}$@WFB&L-\"c%AM*sip9+\"&84", lpUsedDefaultChar=0x0) returned 32 [0086.232] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0086.232] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0086.232] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa9e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341475.JPG", cAlternateFileName="")) returned 0x295098 [0086.233] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0086.233] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0086.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341475.jpg")) returned 0x20 [0086.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341475.jpg")) returned 0x20 [0086.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341475.jpg")) returned 0x20 [0086.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341475.jpg")) returned 0x20 [0086.233] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341475.jpg"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa9e2)) returned 1 [0086.233] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0086.233] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0086.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341475.jpg")) returned 0x20 [0086.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341475.jpg")) returned 0x20 [0086.233] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0086.233] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0086.233] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0086.234] SetEndOfFile (hFile=0x158) returned 1 [0086.234] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341475.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.234] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341475.JPG", cchWideChar=12, lpMultiByteStr=0x1fe430c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341475.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.234] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341475.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.234] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341475.JPG", cchWideChar=12, lpMultiByteStr=0x1fe35cc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341475.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.234] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe35cc, cbMultiByte=12, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="J0341475.JPGg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0086.235] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341475.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.235] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341475.JPG", cchWideChar=12, lpMultiByteStr=0x1fe430c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341475.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341475.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0086.235] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0086.235] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0xa9e2 [0086.235] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0086.235] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0086.235] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0086.235] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341475.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.236] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341475.JPG", cchWideChar=12, lpMultiByteStr=0x1fe430c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341475.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.236] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341475.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.236] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341475.JPG", cchWideChar=12, lpMultiByteStr=0x1fe35cc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341475.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.236] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe35cc, cbMultiByte=12, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="J0341475.JPG75.JPGg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0086.236] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341475.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.236] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341475.JPG", cchWideChar=12, lpMultiByteStr=0x1fe430c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341475.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.236] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0086.237] CharToOemA (in: pSrc="J0341475.JPG", pDst=0x1fe35cc | out: pDst="J0341475.JPG") returned 1 [0086.237] WriteFile (in: hFile=0x158, lpBuffer=0x1fe35cc*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe35cc*, lpNumberOfBytesWritten=0x18e048*=0xc, lpOverlapped=0x0) returned 1 [0086.237] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0086.237] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0086.237] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0086.237] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=20650055814) returned 1 [0086.237] ReadFile (in: hFile=0x11c, lpBuffer=0x37daf60, nNumberOfBytesToRead=0xa9e2, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37daf60*, lpNumberOfBytesRead=0x18dd7c*=0xa9e2, lpOverlapped=0x0) returned 1 [0086.239] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0086.239] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=20650272109) returned 1 [0086.249] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b3d8*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b5b3d8*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0086.249] ReadFile (in: hFile=0x11c, lpBuffer=0x37daf60, nNumberOfBytesToRead=0xa9e2, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x37daf60*, lpNumberOfBytesRead=0x18de38*=0xa9e2, lpOverlapped=0x0) returned 1 [0086.267] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x47 [0086.267] WriteFile (in: hFile=0x158, lpBuffer=0x3825a50*, nNumberOfBytesToWrite=0xa9e2, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3825a50*, lpNumberOfBytesWritten=0x18de10*=0xa9e2, lpOverlapped=0x0) returned 1 [0086.268] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0xaa29 [0086.268] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0086.268] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0086.268] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0086.268] SetFilePointer (in: hFile=0x158, lDistanceToMove=12, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2a [0086.268] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0xaa33 [0086.268] CloseHandle (hObject=0x11c) returned 1 [0086.268] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xaa33 [0086.268] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xaa33 [0086.269] SetFilePointer (in: hFile=0x158, lDistanceToMove=43571, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xaa33 [0086.269] SetFilePointer (in: hFile=0x158, lDistanceToMove=43571, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0xaa33 [0086.269] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xaa33 [0086.269] SetFilePointer (in: hFile=0x158, lDistanceToMove=43571, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0xaa33 [0086.269] SetEndOfFile (hFile=0x158) returned 1 [0086.269] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xaa33 [0086.269] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xaa33 [0086.269] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341475.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.269] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341475.JPG", cchWideChar=12, lpMultiByteStr=0x1fe430c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341475.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.269] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341475.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.269] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341475.JPG", cchWideChar=12, lpMultiByteStr=0x1fe43ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341475.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.269] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe43ac, cbMultiByte=12, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="J0341475.JPGꞗ@涤(\x18믉`믑`") returned 12 [0086.269] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341475.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.269] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341475.JPG", cchWideChar=12, lpMultiByteStr=0x1fe430c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341475.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.269] WriteFile (in: hFile=0x158, lpBuffer=0x37bea38*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x37bea38*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0086.269] CharToOemA (in: pSrc="J0341475.JPG", pDst=0x1fe43ac | out: pDst="J0341475.JPG") returned 1 [0086.270] WriteFile (in: hFile=0x158, lpBuffer=0x1fe43ac*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe43ac*, lpNumberOfBytesWritten=0x18efcc*=0xc, lpOverlapped=0x0) returned 1 [0086.270] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b3b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x3b5b3b0*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0086.270] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0086.270] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0086.270] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xaa78 [0086.270] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xaa78 [0086.270] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0086.270] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0086.270] DeleteFileW (lpFileName="") returned 0 [0086.270] GetLastError () returned 0x3 [0086.270] GetFileAttributesW (lpFileName="") returned 0xffffffff [0086.270] SetLastError (dwErrCode=0x3) [0086.270] FlushFileBuffers (hFile=0x158) returned 1 [0086.301] GetCurrentThreadId () returned 0x970 [0086.301] GetCurrentThreadId () returned 0x970 [0086.301] GetCurrentThreadId () returned 0x970 [0086.301] GetCurrentThreadId () returned 0x970 [0086.301] GetCurrentThreadId () returned 0x970 [0086.301] GetCurrentThreadId () returned 0x970 [0086.301] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xab2f [0086.301] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xab2f [0086.301] SetFilePointer (in: hFile=0x158, lDistanceToMove=43823, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xab2f [0086.301] CloseHandle (hObject=0x158) returned 1 [0086.301] GetCurrentThreadId () returned 0x970 [0086.301] GetCurrentThreadId () returned 0x970 [0086.302] GetCurrentThreadId () returned 0x970 [0086.302] GetCurrentThreadId () returned 0x970 [0086.302] GetCurrentThreadId () returned 0x970 [0086.302] GetCurrentThreadId () returned 0x970 [0086.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [J0341475.JPG].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [j0341475.jpg].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0086.302] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xab2f [0086.302] SetFilePointer (in: hFile=0x158, lDistanceToMove=43695, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xaaaf [0086.302] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0086.302] GetFileType (hFile=0x158) returned 0x1 [0086.302] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x21, wMilliseconds=0x240)) [0086.302] GetCurrentThreadId () returned 0x970 [0086.302] GetCurrentThreadId () returned 0x970 [0086.302] GetCurrentThreadId () returned 0x970 [0086.302] GetCurrentThreadId () returned 0x970 [0086.302] GetCurrentThreadId () returned 0x970 [0086.302] GetCurrentThreadId () returned 0x970 [0086.302] GetCurrentThreadId () returned 0x970 [0086.302] GetCurrentThreadId () returned 0x970 [0086.302] GetCurrentThreadId () returned 0x970 [0086.303] GetCurrentThreadId () returned 0x970 [0086.303] GetCurrentThreadId () returned 0x970 [0086.303] GetCurrentThreadId () returned 0x970 [0086.303] GetCurrentThreadId () returned 0x970 [0086.303] GetCurrentThreadId () returned 0x970 [0086.303] GetCurrentThreadId () returned 0x970 [0086.303] GetCurrentThreadId () returned 0x970 [0086.303] GetCurrentThreadId () returned 0x970 [0086.303] GetCurrentThreadId () returned 0x970 [0086.303] GetCurrentThreadId () returned 0x970 [0086.303] GetCurrentThreadId () returned 0x970 [0086.303] GetCurrentThreadId () returned 0x970 [0086.303] GetCurrentThreadId () returned 0x970 [0086.303] GetCurrentThreadId () returned 0x970 [0086.303] GetCurrentThreadId () returned 0x970 [0086.303] GetCurrentThreadId () returned 0x970 [0086.303] GetCurrentThreadId () returned 0x970 [0086.303] GetCurrentThreadId () returned 0x970 [0086.303] GetCurrentThreadId () returned 0x970 [0086.303] GetCurrentThreadId () returned 0x970 [0086.303] GetCurrentThreadId () returned 0x970 [0086.303] GetCurrentThreadId () returned 0x970 [0086.303] GetCurrentThreadId () returned 0x970 [0086.303] GetCurrentThreadId () returned 0x970 [0086.303] GetCurrentThreadId () returned 0x970 [0086.303] GetCurrentThreadId () returned 0x970 [0086.303] GetCurrentThreadId () returned 0x970 [0086.303] GetCurrentThreadId () returned 0x970 [0086.303] GetCurrentThreadId () returned 0x970 [0086.303] GetCurrentThreadId () returned 0x970 [0086.303] GetCurrentThreadId () returned 0x970 [0086.303] GetCurrentThreadId () returned 0x970 [0086.303] GetCurrentThreadId () returned 0x970 [0086.303] GetCurrentThreadId () returned 0x970 [0086.304] GetCurrentThreadId () returned 0x970 [0086.304] GetCurrentThreadId () returned 0x970 [0086.304] GetCurrentThreadId () returned 0x970 [0086.304] GetCurrentThreadId () returned 0x970 [0086.304] GetCurrentThreadId () returned 0x970 [0086.304] GetCurrentThreadId () returned 0x970 [0086.304] GetCurrentThreadId () returned 0x970 [0086.304] GetCurrentThreadId () returned 0x970 [0086.304] GetCurrentThreadId () returned 0x970 [0086.304] GetCurrentThreadId () returned 0x970 [0086.304] GetCurrentThreadId () returned 0x970 [0086.304] GetCurrentThreadId () returned 0x970 [0086.304] GetCurrentThreadId () returned 0x970 [0086.304] GetCurrentThreadId () returned 0x970 [0086.304] GetCurrentThreadId () returned 0x970 [0086.304] GetCurrentThreadId () returned 0x970 [0086.304] GetCurrentThreadId () returned 0x970 [0086.304] GetCurrentThreadId () returned 0x970 [0086.304] GetCurrentThreadId () returned 0x970 [0086.304] GetCurrentThreadId () returned 0x970 [0086.304] GetCurrentThreadId () returned 0x970 [0086.304] GetCurrentThreadId () returned 0x970 [0086.304] GetCurrentThreadId () returned 0x970 [0086.304] GetCurrentThreadId () returned 0x970 [0086.304] GetCurrentThreadId () returned 0x970 [0086.304] GetCurrentThreadId () returned 0x970 [0086.304] GetCurrentThreadId () returned 0x970 [0086.304] GetCurrentThreadId () returned 0x970 [0086.304] GetCurrentThreadId () returned 0x970 [0086.304] GetCurrentThreadId () returned 0x970 [0086.304] GetCurrentThreadId () returned 0x970 [0086.304] GetCurrentThreadId () returned 0x970 [0086.304] GetCurrentThreadId () returned 0x970 [0086.304] GetCurrentThreadId () returned 0x970 [0086.304] GetCurrentThreadId () returned 0x970 [0086.305] GetCurrentThreadId () returned 0x970 [0086.305] GetCurrentThreadId () returned 0x970 [0086.305] GetCurrentThreadId () returned 0x970 [0086.305] GetCurrentThreadId () returned 0x970 [0086.305] GetCurrentThreadId () returned 0x970 [0086.305] GetCurrentThreadId () returned 0x970 [0086.305] GetCurrentThreadId () returned 0x970 [0086.305] GetCurrentThreadId () returned 0x970 [0086.305] GetCurrentThreadId () returned 0x970 [0086.305] GetCurrentThreadId () returned 0x970 [0086.305] GetCurrentThreadId () returned 0x970 [0086.305] GetCurrentThreadId () returned 0x970 [0086.305] GetCurrentThreadId () returned 0x970 [0086.305] GetCurrentThreadId () returned 0x970 [0086.305] GetCurrentThreadId () returned 0x970 [0086.305] GetCurrentThreadId () returned 0x970 [0086.305] GetCurrentThreadId () returned 0x970 [0086.305] GetCurrentThreadId () returned 0x970 [0086.305] GetCurrentThreadId () returned 0x970 [0086.305] GetCurrentThreadId () returned 0x970 [0086.305] GetCurrentThreadId () returned 0x970 [0086.305] GetCurrentThreadId () returned 0x970 [0086.305] GetCurrentThreadId () returned 0x970 [0086.305] GetCurrentThreadId () returned 0x970 [0086.305] GetCurrentThreadId () returned 0x970 [0086.305] GetCurrentThreadId () returned 0x970 [0086.305] GetCurrentThreadId () returned 0x970 [0086.305] GetCurrentThreadId () returned 0x970 [0086.305] GetCurrentThreadId () returned 0x970 [0086.305] GetCurrentThreadId () returned 0x970 [0086.305] GetCurrentThreadId () returned 0x970 [0086.305] GetCurrentThreadId () returned 0x970 [0086.305] GetCurrentThreadId () returned 0x970 [0086.306] GetCurrentThreadId () returned 0x970 [0086.306] GetCurrentThreadId () returned 0x970 [0086.306] GetCurrentThreadId () returned 0x970 [0086.306] GetCurrentThreadId () returned 0x970 [0086.306] GetCurrentThreadId () returned 0x970 [0086.306] GetCurrentThreadId () returned 0x970 [0086.306] GetCurrentThreadId () returned 0x970 [0086.306] GetCurrentThreadId () returned 0x970 [0086.306] GetCurrentThreadId () returned 0x970 [0086.306] GetCurrentThreadId () returned 0x970 [0086.306] GetCurrentThreadId () returned 0x970 [0086.306] GetCurrentThreadId () returned 0x970 [0086.306] GetCurrentThreadId () returned 0x970 [0086.306] GetCurrentThreadId () returned 0x970 [0086.306] GetCurrentThreadId () returned 0x970 [0086.306] GetCurrentThreadId () returned 0x970 [0086.306] GetCurrentThreadId () returned 0x970 [0086.306] GetCurrentThreadId () returned 0x970 [0086.306] GetCurrentThreadId () returned 0x970 [0086.306] GetCurrentThreadId () returned 0x970 [0086.306] GetCurrentThreadId () returned 0x970 [0086.306] GetCurrentThreadId () returned 0x970 [0086.306] GetCurrentThreadId () returned 0x970 [0086.306] GetCurrentThreadId () returned 0x970 [0086.306] GetCurrentThreadId () returned 0x970 [0086.306] GetCurrentThreadId () returned 0x970 [0086.306] GetCurrentThreadId () returned 0x970 [0086.306] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.306] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.306] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5e8f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0086.306] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.306] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.307] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5e8f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0086.307] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.307] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.307] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b530, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0086.307] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.307] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.307] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b530, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0086.307] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.307] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.307] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5e950, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0086.307] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.307] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.307] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5e950, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0086.307] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.307] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.307] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5e950, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0086.307] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x21, wMilliseconds=0x240)) [0086.307] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="chAhskx*}$@WFB&L-\"c%AM*sip9+\"&84", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0086.307] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="chAhskx*}$@WFB&L-\"c%AM*sip9+\"&84", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0086.307] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="chAhskx*}$@WFB&L-\"c%AM*sip9+\"&84", cchWideChar=32, lpMultiByteStr=0x3b56288, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="chAhskx*}$@WFB&L-\"c%AM*sip9+\"&84", lpUsedDefaultChar=0x0) returned 32 [0086.307] GetCurrentThreadId () returned 0x970 [0086.307] GetCurrentThreadId () returned 0x970 [0086.308] GetCurrentThreadId () returned 0x970 [0086.308] GetCurrentThreadId () returned 0x970 [0086.308] GetCurrentThreadId () returned 0x970 [0086.308] GetCurrentThreadId () returned 0x970 [0086.320] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0086.320] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0086.320] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3b869b8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0086.320] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0086.320] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAAuMmw64Vqg5QvQQGJ6DfGgEgg3BPAnk0aQK/bkHHn5yKwsUNbUtEvV7cqhgCH/wJ0Vte6cf/57MTr7ez0T+ebQmNlz9HMo460G/jcA8H3R0q/lgvG/26RXVRFQb11d+gISMLZRa5DgGW9Kqjas+FFBGNY3omwUJ27/m1qwicvyMgeJeLeNNNW7Ff+WI/ZXYUkLSqK6hgen5aoKRqStit/Z0AYDWlD7M6g==") returned 232 [0086.320] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x21, wMilliseconds=0x250)) [0086.320] GetCurrentThreadId () returned 0x970 [0086.320] GetCurrentThreadId () returned 0x970 [0086.320] GetCurrentThreadId () returned 0x970 [0086.320] GetCurrentThreadId () returned 0x970 [0086.321] GetCurrentThreadId () returned 0x970 [0086.321] GetCurrentThreadId () returned 0x970 [0086.321] GetCurrentThreadId () returned 0x970 [0086.321] GetCurrentThreadId () returned 0x970 [0086.321] GetCurrentThreadId () returned 0x970 [0086.321] GetCurrentThreadId () returned 0x970 [0086.321] GetCurrentThreadId () returned 0x970 [0086.321] GetCurrentThreadId () returned 0x970 [0086.321] GetCurrentThreadId () returned 0x970 [0086.321] GetCurrentThreadId () returned 0x970 [0086.321] GetCurrentThreadId () returned 0x970 [0086.321] GetCurrentThreadId () returned 0x970 [0086.321] GetCurrentThreadId () returned 0x970 [0086.321] GetCurrentThreadId () returned 0x970 [0086.321] GetCurrentThreadId () returned 0x970 [0086.321] GetCurrentThreadId () returned 0x970 [0086.321] GetCurrentThreadId () returned 0x970 [0086.321] GetCurrentThreadId () returned 0x970 [0086.321] GetCurrentThreadId () returned 0x970 [0086.321] GetCurrentThreadId () returned 0x970 [0086.321] GetCurrentThreadId () returned 0x970 [0086.321] GetCurrentThreadId () returned 0x970 [0086.321] GetCurrentThreadId () returned 0x970 [0086.321] GetCurrentThreadId () returned 0x970 [0086.321] GetCurrentThreadId () returned 0x970 [0086.321] GetCurrentThreadId () returned 0x970 [0086.321] GetCurrentThreadId () returned 0x970 [0086.321] GetCurrentThreadId () returned 0x970 [0086.321] GetCurrentThreadId () returned 0x970 [0086.321] GetCurrentThreadId () returned 0x970 [0086.321] GetCurrentThreadId () returned 0x970 [0086.321] GetCurrentThreadId () returned 0x970 [0086.321] GetCurrentThreadId () returned 0x970 [0086.321] GetCurrentThreadId () returned 0x970 [0086.322] GetCurrentThreadId () returned 0x970 [0086.322] GetCurrentThreadId () returned 0x970 [0086.322] GetCurrentThreadId () returned 0x970 [0086.322] GetCurrentThreadId () returned 0x970 [0086.322] GetCurrentThreadId () returned 0x970 [0086.322] GetCurrentThreadId () returned 0x970 [0086.322] GetCurrentThreadId () returned 0x970 [0086.322] GetCurrentThreadId () returned 0x970 [0086.322] GetCurrentThreadId () returned 0x970 [0086.322] GetCurrentThreadId () returned 0x970 [0086.322] GetCurrentThreadId () returned 0x970 [0086.322] GetCurrentThreadId () returned 0x970 [0086.322] GetCurrentThreadId () returned 0x970 [0086.322] GetCurrentThreadId () returned 0x970 [0086.322] GetCurrentThreadId () returned 0x970 [0086.322] GetCurrentThreadId () returned 0x970 [0086.322] GetCurrentThreadId () returned 0x970 [0086.322] GetCurrentThreadId () returned 0x970 [0086.322] GetCurrentThreadId () returned 0x970 [0086.322] GetCurrentThreadId () returned 0x970 [0086.322] GetCurrentThreadId () returned 0x970 [0086.322] GetCurrentThreadId () returned 0x970 [0086.322] GetCurrentThreadId () returned 0x970 [0086.322] GetCurrentThreadId () returned 0x970 [0086.322] GetCurrentThreadId () returned 0x970 [0086.322] GetCurrentThreadId () returned 0x970 [0086.322] GetCurrentThreadId () returned 0x970 [0086.322] GetCurrentThreadId () returned 0x970 [0086.322] GetCurrentThreadId () returned 0x970 [0086.322] GetCurrentThreadId () returned 0x970 [0086.322] GetCurrentThreadId () returned 0x970 [0086.322] GetCurrentThreadId () returned 0x970 [0086.322] GetCurrentThreadId () returned 0x970 [0086.322] GetCurrentThreadId () returned 0x970 [0086.322] GetCurrentThreadId () returned 0x970 [0086.323] GetCurrentThreadId () returned 0x970 [0086.323] GetCurrentThreadId () returned 0x970 [0086.323] GetCurrentThreadId () returned 0x970 [0086.323] GetCurrentThreadId () returned 0x970 [0086.323] GetCurrentThreadId () returned 0x970 [0086.323] GetCurrentThreadId () returned 0x970 [0086.323] GetCurrentThreadId () returned 0x970 [0086.323] GetCurrentThreadId () returned 0x970 [0086.323] GetCurrentThreadId () returned 0x970 [0086.323] GetCurrentThreadId () returned 0x970 [0086.323] GetCurrentThreadId () returned 0x970 [0086.323] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAAuMmw64Vqg5QvQQGJ6DfGgEgg3BPAnk0aQK/bkHHn5yKwsUNbUtEvV7cqhgCH/wJ0Vte6cf/57MTr7ez0T+ebQmNlz9HMo460G/jcA8H3R0q/lgvG/26RXVRFQb11d+gISMLZRa5DgGW9Kqjas+FFBGNY3omwUJ27/m1qwicvyMgeJeLeNNNW7Ff+WI/ZXYUkLSqK6hgen5aoKRqStit/Z0AYDWlD7M6g==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0086.323] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAAuMmw64Vqg5QvQQGJ6DfGgEgg3BPAnk0aQK/bkHHn5yKwsUNbUtEvV7cqhgCH/wJ0Vte6cf/57MTr7ez0T+ebQmNlz9HMo460G/jcA8H3R0q/lgvG/26RXVRFQb11d+gISMLZRa5DgGW9Kqjas+FFBGNY3omwUJ27/m1qwicvyMgeJeLeNNNW7Ff+WI/ZXYUkLSqK6hgen5aoKRqStit/Z0AYDWlD7M6g==", cchWideChar=245, lpMultiByteStr=0x3b4d08c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAAuMmw64Vqg5QvQQGJ6DfGgEgg3BPAnk0aQK/bkHHn5yKwsUNbUtEvV7cqhgCH/wJ0Vte6cf/57MTr7ez0T+ebQmNlz9HMo460G/jcA8H3R0q/lgvG/26RXVRFQb11d+gISMLZRa5DgGW9Kqjas+FFBGNY3omwUJ27/m1qwicvyMgeJeLeNNNW7Ff+WI/ZXYUkLSqK6hgen5aoKRqStit/Z0AYDWlD7M6g==", lpUsedDefaultChar=0x0) returned 245 [0086.323] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0086.323] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0086.323] CloseHandle (hObject=0x158) returned 1 [0086.324] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341475.jpg")) returned 1 [0086.325] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=20658858295) returned 1 [0086.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [J0341499.JPG].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [j0341499.jpg].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0086.326] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0086.326] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0086.326] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0086.326] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0086.326] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0086.327] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0086.327] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0086.327] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0086.327] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0086.327] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0086.327] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0086.327] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0086.327] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0086.327] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0086.327] SetEndOfFile (hFile=0x158) returned 1 [0086.327] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0086.327] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0086.328] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0086.328] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0086.328] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0086.329] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0086.329] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="/Am4Unj6:DtnJe7Cte.u3lsyK1a-?FC,", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0086.329] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="/Am4Unj6:DtnJe7Cte.u3lsyK1a-?FC,", cchWideChar=32, lpMultiByteStr=0x203c06c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="/Am4Unj6:DtnJe7Cte.u3lsyK1a-?FC,", lpUsedDefaultChar=0x0) returned 32 [0086.329] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0086.329] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0086.329] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3ee3, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341499.JPG", cAlternateFileName="")) returned 0x295098 [0086.330] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0086.330] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0086.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341499.jpg")) returned 0x20 [0086.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341499.jpg")) returned 0x20 [0086.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341499.jpg")) returned 0x20 [0086.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341499.jpg")) returned 0x20 [0086.330] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341499.jpg"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3ee3)) returned 1 [0086.330] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0086.330] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0086.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341499.jpg")) returned 0x20 [0086.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341499.jpg")) returned 0x20 [0086.330] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0086.330] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0086.330] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0086.331] SetEndOfFile (hFile=0x158) returned 1 [0086.331] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341499.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.331] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341499.JPG", cchWideChar=12, lpMultiByteStr=0x1fe3c4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341499.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.331] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341499.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.331] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341499.JPG", cchWideChar=12, lpMultiByteStr=0x1fe658c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341499.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.331] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe658c, cbMultiByte=12, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="J0341499.JPGg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0086.332] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341499.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.332] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341499.JPG", cchWideChar=12, lpMultiByteStr=0x1fe3c4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341499.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.332] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341499.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0086.332] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0086.332] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x3ee3 [0086.332] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0086.332] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0086.332] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0086.332] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341499.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.332] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341499.JPG", cchWideChar=12, lpMultiByteStr=0x1fe3c4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341499.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.332] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341499.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.333] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341499.JPG", cchWideChar=12, lpMultiByteStr=0x1fe658c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341499.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.333] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe658c, cbMultiByte=12, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="J0341499.JPG99.JPGg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0086.333] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341499.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.333] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341499.JPG", cchWideChar=12, lpMultiByteStr=0x1fe3c4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341499.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.333] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0086.334] CharToOemA (in: pSrc="J0341499.JPG", pDst=0x1fe658c | out: pDst="J0341499.JPG") returned 1 [0086.334] WriteFile (in: hFile=0x158, lpBuffer=0x1fe658c*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe658c*, lpNumberOfBytesWritten=0x18e048*=0xc, lpOverlapped=0x0) returned 1 [0086.334] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0086.334] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0086.334] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0086.334] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=20659742983) returned 1 [0086.334] ReadFile (in: hFile=0x11c, lpBuffer=0x3b95a30, nNumberOfBytesToRead=0x3ee3, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b95a30*, lpNumberOfBytesRead=0x18dd7c*=0x3ee3, lpOverlapped=0x0) returned 1 [0086.336] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0086.336] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=20659930487) returned 1 [0086.345] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b3c0*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b5b3c0*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0086.345] ReadFile (in: hFile=0x11c, lpBuffer=0x3b95a30, nNumberOfBytesToRead=0x3ee3, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3b95a30*, lpNumberOfBytesRead=0x18de38*=0x3ee3, lpOverlapped=0x0) returned 1 [0086.345] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x47 [0086.346] WriteFile (in: hFile=0x158, lpBuffer=0x3b9b090*, nNumberOfBytesToWrite=0x3ee3, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3b9b090*, lpNumberOfBytesWritten=0x18de10*=0x3ee3, lpOverlapped=0x0) returned 1 [0086.346] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x3f2a [0086.346] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0086.346] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0086.346] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0086.346] SetFilePointer (in: hFile=0x158, lDistanceToMove=12, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2a [0086.346] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x3f34 [0086.346] CloseHandle (hObject=0x11c) returned 1 [0086.347] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x3f34 [0086.347] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x3f34 [0086.347] SetFilePointer (in: hFile=0x158, lDistanceToMove=16180, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x3f34 [0086.347] SetFilePointer (in: hFile=0x158, lDistanceToMove=16180, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x3f34 [0086.347] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x3f34 [0086.347] SetFilePointer (in: hFile=0x158, lDistanceToMove=16180, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x3f34 [0086.347] SetEndOfFile (hFile=0x158) returned 1 [0086.347] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x3f34 [0086.347] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x3f34 [0086.347] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341499.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.347] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341499.JPG", cchWideChar=12, lpMultiByteStr=0x1fe3c4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341499.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.347] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341499.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.347] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341499.JPG", cchWideChar=12, lpMultiByteStr=0x1fe3a2c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341499.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.347] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe3a2c, cbMultiByte=12, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="J0341499.JPGꞗ@涤(\x18믉`믑`") returned 12 [0086.347] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341499.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.347] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341499.JPG", cchWideChar=12, lpMultiByteStr=0x1fe3c4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341499.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.348] WriteFile (in: hFile=0x158, lpBuffer=0x37bea38*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x37bea38*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0086.348] CharToOemA (in: pSrc="J0341499.JPG", pDst=0x1fe3a2c | out: pDst="J0341499.JPG") returned 1 [0086.348] WriteFile (in: hFile=0x158, lpBuffer=0x1fe3a2c*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe3a2c*, lpNumberOfBytesWritten=0x18efcc*=0xc, lpOverlapped=0x0) returned 1 [0086.348] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b470*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x3b5b470*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0086.348] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0086.348] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0086.348] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x3f79 [0086.348] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x3f79 [0086.348] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0086.348] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0086.348] DeleteFileW (lpFileName="") returned 0 [0086.348] GetLastError () returned 0x3 [0086.348] GetFileAttributesW (lpFileName="") returned 0xffffffff [0086.348] SetLastError (dwErrCode=0x3) [0086.349] FlushFileBuffers (hFile=0x158) returned 1 [0086.352] GetCurrentThreadId () returned 0x970 [0086.353] GetCurrentThreadId () returned 0x970 [0086.353] GetCurrentThreadId () returned 0x970 [0086.353] GetCurrentThreadId () returned 0x970 [0086.353] GetCurrentThreadId () returned 0x970 [0086.353] GetCurrentThreadId () returned 0x970 [0086.353] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x4030 [0086.353] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x4030 [0086.353] SetFilePointer (in: hFile=0x158, lDistanceToMove=16432, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x4030 [0086.353] CloseHandle (hObject=0x158) returned 1 [0086.353] GetCurrentThreadId () returned 0x970 [0086.353] GetCurrentThreadId () returned 0x970 [0086.353] GetCurrentThreadId () returned 0x970 [0086.353] GetCurrentThreadId () returned 0x970 [0086.353] GetCurrentThreadId () returned 0x970 [0086.353] GetCurrentThreadId () returned 0x970 [0086.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [J0341499.JPG].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [j0341499.jpg].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0086.354] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4030 [0086.354] SetFilePointer (in: hFile=0x158, lDistanceToMove=16304, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3fb0 [0086.354] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0086.354] GetFileType (hFile=0x158) returned 0x1 [0086.354] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x21, wMilliseconds=0x26f)) [0086.354] GetCurrentThreadId () returned 0x970 [0086.354] GetCurrentThreadId () returned 0x970 [0086.354] GetCurrentThreadId () returned 0x970 [0086.354] GetCurrentThreadId () returned 0x970 [0086.354] GetCurrentThreadId () returned 0x970 [0086.354] GetCurrentThreadId () returned 0x970 [0086.354] GetCurrentThreadId () returned 0x970 [0086.354] GetCurrentThreadId () returned 0x970 [0086.354] GetCurrentThreadId () returned 0x970 [0086.354] GetCurrentThreadId () returned 0x970 [0086.354] GetCurrentThreadId () returned 0x970 [0086.354] GetCurrentThreadId () returned 0x970 [0086.354] GetCurrentThreadId () returned 0x970 [0086.354] GetCurrentThreadId () returned 0x970 [0086.354] GetCurrentThreadId () returned 0x970 [0086.354] GetCurrentThreadId () returned 0x970 [0086.354] GetCurrentThreadId () returned 0x970 [0086.354] GetCurrentThreadId () returned 0x970 [0086.354] GetCurrentThreadId () returned 0x970 [0086.354] GetCurrentThreadId () returned 0x970 [0086.354] GetCurrentThreadId () returned 0x970 [0086.355] GetCurrentThreadId () returned 0x970 [0086.355] GetCurrentThreadId () returned 0x970 [0086.355] GetCurrentThreadId () returned 0x970 [0086.355] GetCurrentThreadId () returned 0x970 [0086.355] GetCurrentThreadId () returned 0x970 [0086.355] GetCurrentThreadId () returned 0x970 [0086.355] GetCurrentThreadId () returned 0x970 [0086.355] GetCurrentThreadId () returned 0x970 [0086.355] GetCurrentThreadId () returned 0x970 [0086.355] GetCurrentThreadId () returned 0x970 [0086.355] GetCurrentThreadId () returned 0x970 [0086.355] GetCurrentThreadId () returned 0x970 [0086.355] GetCurrentThreadId () returned 0x970 [0086.355] GetCurrentThreadId () returned 0x970 [0086.355] GetCurrentThreadId () returned 0x970 [0086.355] GetCurrentThreadId () returned 0x970 [0086.355] GetCurrentThreadId () returned 0x970 [0086.355] GetCurrentThreadId () returned 0x970 [0086.355] GetCurrentThreadId () returned 0x970 [0086.355] GetCurrentThreadId () returned 0x970 [0086.355] GetCurrentThreadId () returned 0x970 [0086.355] GetCurrentThreadId () returned 0x970 [0086.355] GetCurrentThreadId () returned 0x970 [0086.355] GetCurrentThreadId () returned 0x970 [0086.355] GetCurrentThreadId () returned 0x970 [0086.355] GetCurrentThreadId () returned 0x970 [0086.355] GetCurrentThreadId () returned 0x970 [0086.355] GetCurrentThreadId () returned 0x970 [0086.355] GetCurrentThreadId () returned 0x970 [0086.355] GetCurrentThreadId () returned 0x970 [0086.355] GetCurrentThreadId () returned 0x970 [0086.355] GetCurrentThreadId () returned 0x970 [0086.355] GetCurrentThreadId () returned 0x970 [0086.355] GetCurrentThreadId () returned 0x970 [0086.355] GetCurrentThreadId () returned 0x970 [0086.355] GetCurrentThreadId () returned 0x970 [0086.355] GetCurrentThreadId () returned 0x970 [0086.356] GetCurrentThreadId () returned 0x970 [0086.356] GetCurrentThreadId () returned 0x970 [0086.356] GetCurrentThreadId () returned 0x970 [0086.356] GetCurrentThreadId () returned 0x970 [0086.356] GetCurrentThreadId () returned 0x970 [0086.356] GetCurrentThreadId () returned 0x970 [0086.356] GetCurrentThreadId () returned 0x970 [0086.356] GetCurrentThreadId () returned 0x970 [0086.356] GetCurrentThreadId () returned 0x970 [0086.356] GetCurrentThreadId () returned 0x970 [0086.356] GetCurrentThreadId () returned 0x970 [0086.356] GetCurrentThreadId () returned 0x970 [0086.356] GetCurrentThreadId () returned 0x970 [0086.356] GetCurrentThreadId () returned 0x970 [0086.356] GetCurrentThreadId () returned 0x970 [0086.356] GetCurrentThreadId () returned 0x970 [0086.356] GetCurrentThreadId () returned 0x970 [0086.356] GetCurrentThreadId () returned 0x970 [0086.356] GetCurrentThreadId () returned 0x970 [0086.356] GetCurrentThreadId () returned 0x970 [0086.356] GetCurrentThreadId () returned 0x970 [0086.356] GetCurrentThreadId () returned 0x970 [0086.356] GetCurrentThreadId () returned 0x970 [0086.356] GetCurrentThreadId () returned 0x970 [0086.356] GetCurrentThreadId () returned 0x970 [0086.356] GetCurrentThreadId () returned 0x970 [0086.356] GetCurrentThreadId () returned 0x970 [0086.356] GetCurrentThreadId () returned 0x970 [0086.356] GetCurrentThreadId () returned 0x970 [0086.356] GetCurrentThreadId () returned 0x970 [0086.356] GetCurrentThreadId () returned 0x970 [0086.356] GetCurrentThreadId () returned 0x970 [0086.356] GetCurrentThreadId () returned 0x970 [0086.356] GetCurrentThreadId () returned 0x970 [0086.356] GetCurrentThreadId () returned 0x970 [0086.356] GetCurrentThreadId () returned 0x970 [0086.357] GetCurrentThreadId () returned 0x970 [0086.357] GetCurrentThreadId () returned 0x970 [0086.357] GetCurrentThreadId () returned 0x970 [0086.357] GetCurrentThreadId () returned 0x970 [0086.357] GetCurrentThreadId () returned 0x970 [0086.357] GetCurrentThreadId () returned 0x970 [0086.357] GetCurrentThreadId () returned 0x970 [0086.357] GetCurrentThreadId () returned 0x970 [0086.357] GetCurrentThreadId () returned 0x970 [0086.357] GetCurrentThreadId () returned 0x970 [0086.357] GetCurrentThreadId () returned 0x970 [0086.357] GetCurrentThreadId () returned 0x970 [0086.357] GetCurrentThreadId () returned 0x970 [0086.357] GetCurrentThreadId () returned 0x970 [0086.357] GetCurrentThreadId () returned 0x970 [0086.357] GetCurrentThreadId () returned 0x970 [0086.357] GetCurrentThreadId () returned 0x970 [0086.357] GetCurrentThreadId () returned 0x970 [0086.357] GetCurrentThreadId () returned 0x970 [0086.357] GetCurrentThreadId () returned 0x970 [0086.357] GetCurrentThreadId () returned 0x970 [0086.357] GetCurrentThreadId () returned 0x970 [0086.357] GetCurrentThreadId () returned 0x970 [0086.357] GetCurrentThreadId () returned 0x970 [0086.357] GetCurrentThreadId () returned 0x970 [0086.357] GetCurrentThreadId () returned 0x970 [0086.357] GetCurrentThreadId () returned 0x970 [0086.357] GetCurrentThreadId () returned 0x970 [0086.357] GetCurrentThreadId () returned 0x970 [0086.357] GetCurrentThreadId () returned 0x970 [0086.357] GetCurrentThreadId () returned 0x970 [0086.357] GetCurrentThreadId () returned 0x970 [0086.357] GetCurrentThreadId () returned 0x970 [0086.357] GetCurrentThreadId () returned 0x970 [0086.357] GetCurrentThreadId () returned 0x970 [0086.357] GetCurrentThreadId () returned 0x970 [0086.358] GetCurrentThreadId () returned 0x970 [0086.358] GetCurrentThreadId () returned 0x970 [0086.358] GetCurrentThreadId () returned 0x970 [0086.358] GetCurrentThreadId () returned 0x970 [0086.358] GetCurrentThreadId () returned 0x970 [0086.358] GetCurrentThreadId () returned 0x970 [0086.358] GetCurrentThreadId () returned 0x970 [0086.358] GetCurrentThreadId () returned 0x970 [0086.358] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.358] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.358] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5e950, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0086.358] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.358] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.358] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5e950, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0086.358] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.358] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.358] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b548, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0086.358] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.358] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.358] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b548, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0086.358] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.358] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.358] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5e9b0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3ôo", lpUsedDefaultChar=0x0) returned 10 [0086.358] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.358] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.358] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5e9b0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3ôo", lpUsedDefaultChar=0x0) returned 10 [0086.358] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.358] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.359] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5e9b0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3ôo", lpUsedDefaultChar=0x0) returned 10 [0086.359] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x21, wMilliseconds=0x26f)) [0086.359] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="/Am4Unj6:DtnJe7Cte.u3lsyK1a-?FC,", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0086.359] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="/Am4Unj6:DtnJe7Cte.u3lsyK1a-?FC,", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0086.359] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="/Am4Unj6:DtnJe7Cte.u3lsyK1a-?FC,", cchWideChar=32, lpMultiByteStr=0x3b562b8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="/Am4Unj6:DtnJe7Cte.u3lsyK1a-?FC,", lpUsedDefaultChar=0x0) returned 32 [0086.359] GetCurrentThreadId () returned 0x970 [0086.359] GetCurrentThreadId () returned 0x970 [0086.359] GetCurrentThreadId () returned 0x970 [0086.359] GetCurrentThreadId () returned 0x970 [0086.359] GetCurrentThreadId () returned 0x970 [0086.359] GetCurrentThreadId () returned 0x970 [0086.369] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0086.369] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0086.369] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3b86aa8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0086.369] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0086.369] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAEZHlNW3Sz1yz75Q28E1KKV6AhmJE5A6Pyx3DwQHQCcXEqNByYSRA+TT3Y9oY/LjVezguYENo76jf4ff86ibddw28vtdTaMnfss604vV/tYUBHHoBD5oQjeDXek5AcQWheJVma1hKsnFx0UtCxKNwZz0c9ZZPxyOA6Avhv01g59ZGCBUOnnkYwpCD20vV1EVsn0Wf9qfryxxngplMvikRwvuTqszzK69og==") returned 232 [0086.369] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x21, wMilliseconds=0x27f)) [0086.369] GetCurrentThreadId () returned 0x970 [0086.369] GetCurrentThreadId () returned 0x970 [0086.369] GetCurrentThreadId () returned 0x970 [0086.369] GetCurrentThreadId () returned 0x970 [0086.369] GetCurrentThreadId () returned 0x970 [0086.369] GetCurrentThreadId () returned 0x970 [0086.369] GetCurrentThreadId () returned 0x970 [0086.369] GetCurrentThreadId () returned 0x970 [0086.369] GetCurrentThreadId () returned 0x970 [0086.369] GetCurrentThreadId () returned 0x970 [0086.369] GetCurrentThreadId () returned 0x970 [0086.369] GetCurrentThreadId () returned 0x970 [0086.369] GetCurrentThreadId () returned 0x970 [0086.369] GetCurrentThreadId () returned 0x970 [0086.369] GetCurrentThreadId () returned 0x970 [0086.369] GetCurrentThreadId () returned 0x970 [0086.369] GetCurrentThreadId () returned 0x970 [0086.369] GetCurrentThreadId () returned 0x970 [0086.369] GetCurrentThreadId () returned 0x970 [0086.369] GetCurrentThreadId () returned 0x970 [0086.369] GetCurrentThreadId () returned 0x970 [0086.370] GetCurrentThreadId () returned 0x970 [0086.370] GetCurrentThreadId () returned 0x970 [0086.370] GetCurrentThreadId () returned 0x970 [0086.370] GetCurrentThreadId () returned 0x970 [0086.370] GetCurrentThreadId () returned 0x970 [0086.370] GetCurrentThreadId () returned 0x970 [0086.370] GetCurrentThreadId () returned 0x970 [0086.370] GetCurrentThreadId () returned 0x970 [0086.370] GetCurrentThreadId () returned 0x970 [0086.370] GetCurrentThreadId () returned 0x970 [0086.370] GetCurrentThreadId () returned 0x970 [0086.370] GetCurrentThreadId () returned 0x970 [0086.370] GetCurrentThreadId () returned 0x970 [0086.370] GetCurrentThreadId () returned 0x970 [0086.370] GetCurrentThreadId () returned 0x970 [0086.370] GetCurrentThreadId () returned 0x970 [0086.370] GetCurrentThreadId () returned 0x970 [0086.370] GetCurrentThreadId () returned 0x970 [0086.370] GetCurrentThreadId () returned 0x970 [0086.370] GetCurrentThreadId () returned 0x970 [0086.370] GetCurrentThreadId () returned 0x970 [0086.370] GetCurrentThreadId () returned 0x970 [0086.370] GetCurrentThreadId () returned 0x970 [0086.370] GetCurrentThreadId () returned 0x970 [0086.370] GetCurrentThreadId () returned 0x970 [0086.370] GetCurrentThreadId () returned 0x970 [0086.370] GetCurrentThreadId () returned 0x970 [0086.370] GetCurrentThreadId () returned 0x970 [0086.370] GetCurrentThreadId () returned 0x970 [0086.370] GetCurrentThreadId () returned 0x970 [0086.370] GetCurrentThreadId () returned 0x970 [0086.370] GetCurrentThreadId () returned 0x970 [0086.370] GetCurrentThreadId () returned 0x970 [0086.370] GetCurrentThreadId () returned 0x970 [0086.370] GetCurrentThreadId () returned 0x970 [0086.370] GetCurrentThreadId () returned 0x970 [0086.371] GetCurrentThreadId () returned 0x970 [0086.371] GetCurrentThreadId () returned 0x970 [0086.371] GetCurrentThreadId () returned 0x970 [0086.371] GetCurrentThreadId () returned 0x970 [0086.371] GetCurrentThreadId () returned 0x970 [0086.371] GetCurrentThreadId () returned 0x970 [0086.371] GetCurrentThreadId () returned 0x970 [0086.371] GetCurrentThreadId () returned 0x970 [0086.371] GetCurrentThreadId () returned 0x970 [0086.371] GetCurrentThreadId () returned 0x970 [0086.371] GetCurrentThreadId () returned 0x970 [0086.371] GetCurrentThreadId () returned 0x970 [0086.371] GetCurrentThreadId () returned 0x970 [0086.371] GetCurrentThreadId () returned 0x970 [0086.371] GetCurrentThreadId () returned 0x970 [0086.371] GetCurrentThreadId () returned 0x970 [0086.371] GetCurrentThreadId () returned 0x970 [0086.371] GetCurrentThreadId () returned 0x970 [0086.371] GetCurrentThreadId () returned 0x970 [0086.371] GetCurrentThreadId () returned 0x970 [0086.371] GetCurrentThreadId () returned 0x970 [0086.371] GetCurrentThreadId () returned 0x970 [0086.371] GetCurrentThreadId () returned 0x970 [0086.371] GetCurrentThreadId () returned 0x970 [0086.371] GetCurrentThreadId () returned 0x970 [0086.371] GetCurrentThreadId () returned 0x970 [0086.371] GetCurrentThreadId () returned 0x970 [0086.371] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAEZHlNW3Sz1yz75Q28E1KKV6AhmJE5A6Pyx3DwQHQCcXEqNByYSRA+TT3Y9oY/LjVezguYENo76jf4ff86ibddw28vtdTaMnfss604vV/tYUBHHoBD5oQjeDXek5AcQWheJVma1hKsnFx0UtCxKNwZz0c9ZZPxyOA6Avhv01g59ZGCBUOnnkYwpCD20vV1EVsn0Wf9qfryxxngplMvikRwvuTqszzK69og==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0086.371] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAEZHlNW3Sz1yz75Q28E1KKV6AhmJE5A6Pyx3DwQHQCcXEqNByYSRA+TT3Y9oY/LjVezguYENo76jf4ff86ibddw28vtdTaMnfss604vV/tYUBHHoBD5oQjeDXek5AcQWheJVma1hKsnFx0UtCxKNwZz0c9ZZPxyOA6Avhv01g59ZGCBUOnnkYwpCD20vV1EVsn0Wf9qfryxxngplMvikRwvuTqszzK69og==", cchWideChar=245, lpMultiByteStr=0x3b4d08c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAEZHlNW3Sz1yz75Q28E1KKV6AhmJE5A6Pyx3DwQHQCcXEqNByYSRA+TT3Y9oY/LjVezguYENo76jf4ff86ibddw28vtdTaMnfss604vV/tYUBHHoBD5oQjeDXek5AcQWheJVma1hKsnFx0UtCxKNwZz0c9ZZPxyOA6Avhv01g59ZGCBUOnnkYwpCD20vV1EVsn0Wf9qfryxxngplMvikRwvuTqszzK69og==", lpUsedDefaultChar=0x0) returned 245 [0086.371] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0086.372] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0086.372] CloseHandle (hObject=0x158) returned 1 [0086.372] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341499.jpg")) returned 1 [0086.373] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=20663678878) returned 1 [0086.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [J0341534.JPG].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [j0341534.jpg].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0086.374] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0086.374] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0086.374] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0086.375] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0086.375] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0086.375] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0086.375] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0086.375] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0086.375] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0086.375] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0086.375] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0086.375] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0086.375] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0086.375] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0086.375] SetEndOfFile (hFile=0x158) returned 1 [0086.375] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0086.375] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0086.376] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0086.376] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0086.376] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0086.377] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0086.377] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="}/gayjmE>@nmKrDp4jVZ7uE$a-5stz1a", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0086.377] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="}/gayjmE>@nmKrDp4jVZ7uE$a-5stz1a", cchWideChar=32, lpMultiByteStr=0x203c0a4, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="}/gayjmE>@nmKrDp4jVZ7uE$a-5stz1a", lpUsedDefaultChar=0x0) returned 32 [0086.377] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0086.377] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0086.377] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f8a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341534.JPG", cAlternateFileName="")) returned 0x295098 [0086.377] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0086.377] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0086.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341534.jpg")) returned 0x20 [0086.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341534.jpg")) returned 0x20 [0086.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341534.jpg")) returned 0x20 [0086.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341534.jpg")) returned 0x20 [0086.378] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341534.jpg"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f8a)) returned 1 [0086.378] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0086.378] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0086.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341534.jpg")) returned 0x20 [0086.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341534.jpg")) returned 0x20 [0086.378] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0086.378] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0086.378] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0086.378] SetEndOfFile (hFile=0x158) returned 1 [0086.379] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341534.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.379] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341534.JPG", cchWideChar=12, lpMultiByteStr=0x1fe37ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341534.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.380] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341534.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.380] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341534.JPG", cchWideChar=12, lpMultiByteStr=0x1fe43ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341534.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.380] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe43ec, cbMultiByte=12, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="J0341534.JPGg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0086.380] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341534.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.380] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341534.JPG", cchWideChar=12, lpMultiByteStr=0x1fe37ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341534.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341534.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0086.380] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0086.380] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x1f8a [0086.381] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0086.381] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0086.381] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0086.381] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341534.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.381] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341534.JPG", cchWideChar=12, lpMultiByteStr=0x1fe37ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341534.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.381] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341534.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.381] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341534.JPG", cchWideChar=12, lpMultiByteStr=0x1fe43ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341534.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.381] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe43ec, cbMultiByte=12, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="J0341534.JPG34.JPGg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0086.381] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341534.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.381] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341534.JPG", cchWideChar=12, lpMultiByteStr=0x1fe37ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341534.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.381] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0086.382] CharToOemA (in: pSrc="J0341534.JPG", pDst=0x1fe43ec | out: pDst="J0341534.JPG") returned 1 [0086.382] WriteFile (in: hFile=0x158, lpBuffer=0x1fe43ec*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe43ec*, lpNumberOfBytesWritten=0x18e048*=0xc, lpOverlapped=0x0) returned 1 [0086.382] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0086.383] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0086.383] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0086.383] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=20664620248) returned 1 [0086.383] ReadFile (in: hFile=0x11c, lpBuffer=0x3b95a30, nNumberOfBytesToRead=0x1f8a, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b95a30*, lpNumberOfBytesRead=0x18dd7c*=0x1f8a, lpOverlapped=0x0) returned 1 [0086.384] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0086.385] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=20664799921) returned 1 [0086.395] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b450*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b5b450*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0086.396] ReadFile (in: hFile=0x11c, lpBuffer=0x3b95a30, nNumberOfBytesToRead=0x1f8a, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3b95a30*, lpNumberOfBytesRead=0x18de38*=0x1f8a, lpOverlapped=0x0) returned 1 [0086.396] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x47 [0086.396] WriteFile (in: hFile=0x158, lpBuffer=0x3b99190*, nNumberOfBytesToWrite=0x1f8a, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3b99190*, lpNumberOfBytesWritten=0x18de10*=0x1f8a, lpOverlapped=0x0) returned 1 [0086.396] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x1fd1 [0086.397] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0086.397] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0086.397] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0086.397] SetFilePointer (in: hFile=0x158, lDistanceToMove=12, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2a [0086.397] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x1fdb [0086.397] CloseHandle (hObject=0x11c) returned 1 [0086.397] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1fdb [0086.397] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1fdb [0086.397] SetFilePointer (in: hFile=0x158, lDistanceToMove=8155, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1fdb [0086.397] SetFilePointer (in: hFile=0x158, lDistanceToMove=8155, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x1fdb [0086.398] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1fdb [0086.398] SetFilePointer (in: hFile=0x158, lDistanceToMove=8155, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x1fdb [0086.398] SetEndOfFile (hFile=0x158) returned 1 [0086.398] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1fdb [0086.398] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1fdb [0086.398] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341534.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.398] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341534.JPG", cchWideChar=12, lpMultiByteStr=0x1fe37ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341534.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.398] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341534.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.398] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341534.JPG", cchWideChar=12, lpMultiByteStr=0x1fe43ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341534.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.398] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe43ac, cbMultiByte=12, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="J0341534.JPGꞗ@涤(\x18믉`믑`") returned 12 [0086.398] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341534.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.398] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341534.JPG", cchWideChar=12, lpMultiByteStr=0x1fe37ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341534.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.398] WriteFile (in: hFile=0x158, lpBuffer=0x37bea38*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x37bea38*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0086.399] CharToOemA (in: pSrc="J0341534.JPG", pDst=0x1fe43ac | out: pDst="J0341534.JPG") returned 1 [0086.399] WriteFile (in: hFile=0x158, lpBuffer=0x1fe43ac*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe43ac*, lpNumberOfBytesWritten=0x18efcc*=0xc, lpOverlapped=0x0) returned 1 [0086.399] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b350*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x3b5b350*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0086.399] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0086.399] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0086.399] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x2020 [0086.399] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x2020 [0086.399] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0086.399] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0086.400] DeleteFileW (lpFileName="") returned 0 [0086.400] GetLastError () returned 0x3 [0086.400] GetFileAttributesW (lpFileName="") returned 0xffffffff [0086.400] SetLastError (dwErrCode=0x3) [0086.400] FlushFileBuffers (hFile=0x158) returned 1 [0086.403] GetCurrentThreadId () returned 0x970 [0086.403] GetCurrentThreadId () returned 0x970 [0086.403] GetCurrentThreadId () returned 0x970 [0086.403] GetCurrentThreadId () returned 0x970 [0086.403] GetCurrentThreadId () returned 0x970 [0086.403] GetCurrentThreadId () returned 0x970 [0086.403] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x20d7 [0086.403] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x20d7 [0086.403] SetFilePointer (in: hFile=0x158, lDistanceToMove=8407, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x20d7 [0086.403] CloseHandle (hObject=0x158) returned 1 [0086.403] GetCurrentThreadId () returned 0x970 [0086.403] GetCurrentThreadId () returned 0x970 [0086.403] GetCurrentThreadId () returned 0x970 [0086.403] GetCurrentThreadId () returned 0x970 [0086.403] GetCurrentThreadId () returned 0x970 [0086.403] GetCurrentThreadId () returned 0x970 [0086.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [J0341534.JPG].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [j0341534.jpg].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0086.404] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x20d7 [0086.404] SetFilePointer (in: hFile=0x158, lDistanceToMove=8279, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2057 [0086.404] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0086.404] GetFileType (hFile=0x158) returned 0x1 [0086.404] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x21, wMilliseconds=0x29e)) [0086.404] GetCurrentThreadId () returned 0x970 [0086.404] GetCurrentThreadId () returned 0x970 [0086.404] GetCurrentThreadId () returned 0x970 [0086.404] GetCurrentThreadId () returned 0x970 [0086.404] GetCurrentThreadId () returned 0x970 [0086.404] GetCurrentThreadId () returned 0x970 [0086.404] GetCurrentThreadId () returned 0x970 [0086.404] GetCurrentThreadId () returned 0x970 [0086.404] GetCurrentThreadId () returned 0x970 [0086.404] GetCurrentThreadId () returned 0x970 [0086.404] GetCurrentThreadId () returned 0x970 [0086.404] GetCurrentThreadId () returned 0x970 [0086.404] GetCurrentThreadId () returned 0x970 [0086.404] GetCurrentThreadId () returned 0x970 [0086.404] GetCurrentThreadId () returned 0x970 [0086.404] GetCurrentThreadId () returned 0x970 [0086.404] GetCurrentThreadId () returned 0x970 [0086.404] GetCurrentThreadId () returned 0x970 [0086.405] GetCurrentThreadId () returned 0x970 [0086.405] GetCurrentThreadId () returned 0x970 [0086.405] GetCurrentThreadId () returned 0x970 [0086.405] GetCurrentThreadId () returned 0x970 [0086.405] GetCurrentThreadId () returned 0x970 [0086.405] GetCurrentThreadId () returned 0x970 [0086.405] GetCurrentThreadId () returned 0x970 [0086.405] GetCurrentThreadId () returned 0x970 [0086.405] GetCurrentThreadId () returned 0x970 [0086.405] GetCurrentThreadId () returned 0x970 [0086.405] GetCurrentThreadId () returned 0x970 [0086.405] GetCurrentThreadId () returned 0x970 [0086.405] GetCurrentThreadId () returned 0x970 [0086.405] GetCurrentThreadId () returned 0x970 [0086.405] GetCurrentThreadId () returned 0x970 [0086.405] GetCurrentThreadId () returned 0x970 [0086.405] GetCurrentThreadId () returned 0x970 [0086.405] GetCurrentThreadId () returned 0x970 [0086.405] GetCurrentThreadId () returned 0x970 [0086.405] GetCurrentThreadId () returned 0x970 [0086.405] GetCurrentThreadId () returned 0x970 [0086.405] GetCurrentThreadId () returned 0x970 [0086.405] GetCurrentThreadId () returned 0x970 [0086.405] GetCurrentThreadId () returned 0x970 [0086.405] GetCurrentThreadId () returned 0x970 [0086.405] GetCurrentThreadId () returned 0x970 [0086.405] GetCurrentThreadId () returned 0x970 [0086.405] GetCurrentThreadId () returned 0x970 [0086.405] GetCurrentThreadId () returned 0x970 [0086.405] GetCurrentThreadId () returned 0x970 [0086.405] GetCurrentThreadId () returned 0x970 [0086.405] GetCurrentThreadId () returned 0x970 [0086.406] GetCurrentThreadId () returned 0x970 [0086.406] GetCurrentThreadId () returned 0x970 [0086.406] GetCurrentThreadId () returned 0x970 [0086.406] GetCurrentThreadId () returned 0x970 [0086.406] GetCurrentThreadId () returned 0x970 [0086.406] GetCurrentThreadId () returned 0x970 [0086.406] GetCurrentThreadId () returned 0x970 [0086.406] GetCurrentThreadId () returned 0x970 [0086.406] GetCurrentThreadId () returned 0x970 [0086.406] GetCurrentThreadId () returned 0x970 [0086.406] GetCurrentThreadId () returned 0x970 [0086.406] GetCurrentThreadId () returned 0x970 [0086.406] GetCurrentThreadId () returned 0x970 [0086.406] GetCurrentThreadId () returned 0x970 [0086.406] GetCurrentThreadId () returned 0x970 [0086.406] GetCurrentThreadId () returned 0x970 [0086.406] GetCurrentThreadId () returned 0x970 [0086.406] GetCurrentThreadId () returned 0x970 [0086.406] GetCurrentThreadId () returned 0x970 [0086.406] GetCurrentThreadId () returned 0x970 [0086.406] GetCurrentThreadId () returned 0x970 [0086.406] GetCurrentThreadId () returned 0x970 [0086.406] GetCurrentThreadId () returned 0x970 [0086.406] GetCurrentThreadId () returned 0x970 [0086.406] GetCurrentThreadId () returned 0x970 [0086.406] GetCurrentThreadId () returned 0x970 [0086.406] GetCurrentThreadId () returned 0x970 [0086.406] GetCurrentThreadId () returned 0x970 [0086.406] GetCurrentThreadId () returned 0x970 [0086.406] GetCurrentThreadId () returned 0x970 [0086.406] GetCurrentThreadId () returned 0x970 [0086.406] GetCurrentThreadId () returned 0x970 [0086.406] GetCurrentThreadId () returned 0x970 [0086.406] GetCurrentThreadId () returned 0x970 [0086.407] GetCurrentThreadId () returned 0x970 [0086.407] GetCurrentThreadId () returned 0x970 [0086.407] GetCurrentThreadId () returned 0x970 [0086.407] GetCurrentThreadId () returned 0x970 [0086.407] GetCurrentThreadId () returned 0x970 [0086.407] GetCurrentThreadId () returned 0x970 [0086.407] GetCurrentThreadId () returned 0x970 [0086.407] GetCurrentThreadId () returned 0x970 [0086.407] GetCurrentThreadId () returned 0x970 [0086.407] GetCurrentThreadId () returned 0x970 [0086.407] GetCurrentThreadId () returned 0x970 [0086.407] GetCurrentThreadId () returned 0x970 [0086.407] GetCurrentThreadId () returned 0x970 [0086.407] GetCurrentThreadId () returned 0x970 [0086.407] GetCurrentThreadId () returned 0x970 [0086.407] GetCurrentThreadId () returned 0x970 [0086.407] GetCurrentThreadId () returned 0x970 [0086.407] GetCurrentThreadId () returned 0x970 [0086.407] GetCurrentThreadId () returned 0x970 [0086.407] GetCurrentThreadId () returned 0x970 [0086.407] GetCurrentThreadId () returned 0x970 [0086.407] GetCurrentThreadId () returned 0x970 [0086.407] GetCurrentThreadId () returned 0x970 [0086.407] GetCurrentThreadId () returned 0x970 [0086.407] GetCurrentThreadId () returned 0x970 [0086.407] GetCurrentThreadId () returned 0x970 [0086.407] GetCurrentThreadId () returned 0x970 [0086.407] GetCurrentThreadId () returned 0x970 [0086.407] GetCurrentThreadId () returned 0x970 [0086.407] GetCurrentThreadId () returned 0x970 [0086.407] GetCurrentThreadId () returned 0x970 [0086.407] GetCurrentThreadId () returned 0x970 [0086.407] GetCurrentThreadId () returned 0x970 [0086.407] GetCurrentThreadId () returned 0x970 [0086.407] GetCurrentThreadId () returned 0x970 [0086.407] GetCurrentThreadId () returned 0x970 [0086.408] GetCurrentThreadId () returned 0x970 [0086.408] GetCurrentThreadId () returned 0x970 [0086.408] GetCurrentThreadId () returned 0x970 [0086.408] GetCurrentThreadId () returned 0x970 [0086.408] GetCurrentThreadId () returned 0x970 [0086.408] GetCurrentThreadId () returned 0x970 [0086.408] GetCurrentThreadId () returned 0x970 [0086.408] GetCurrentThreadId () returned 0x970 [0086.408] GetCurrentThreadId () returned 0x970 [0086.408] GetCurrentThreadId () returned 0x970 [0086.408] GetCurrentThreadId () returned 0x970 [0086.408] GetCurrentThreadId () returned 0x970 [0086.408] GetCurrentThreadId () returned 0x970 [0086.408] GetCurrentThreadId () returned 0x970 [0086.408] GetCurrentThreadId () returned 0x970 [0086.408] GetCurrentThreadId () returned 0x970 [0086.408] GetCurrentThreadId () returned 0x970 [0086.408] GetCurrentThreadId () returned 0x970 [0086.408] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.408] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.408] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5e9b0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0086.408] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.408] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.408] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5e9b0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0086.408] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.408] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.408] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b530, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0086.408] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.408] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.409] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b530, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0086.409] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.409] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.409] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5ea10, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0086.409] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.409] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.409] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5ea10, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0086.409] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.409] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.409] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5ea10, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0086.409] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x21, wMilliseconds=0x2ae)) [0086.409] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="}/gayjmE>@nmKrDp4jVZ7uE$a-5stz1a", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0086.409] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="}/gayjmE>@nmKrDp4jVZ7uE$a-5stz1a", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0086.409] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="}/gayjmE>@nmKrDp4jVZ7uE$a-5stz1a", cchWideChar=32, lpMultiByteStr=0x3b562e8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="}/gayjmE>@nmKrDp4jVZ7uE$a-5stz1a", lpUsedDefaultChar=0x0) returned 32 [0086.409] GetCurrentThreadId () returned 0x970 [0086.409] GetCurrentThreadId () returned 0x970 [0086.409] GetCurrentThreadId () returned 0x970 [0086.409] GetCurrentThreadId () returned 0x970 [0086.409] GetCurrentThreadId () returned 0x970 [0086.409] GetCurrentThreadId () returned 0x970 [0086.419] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0086.419] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0086.419] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3b86b98, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0086.419] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0086.419] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAGAmHIU5YEIcn9pHR+nb/xbzOvCH1NRzJkUEwtDyOvmQi9OgJ79koX/dSb8Y++ex+gdHbDI0m1uWl+35PpLmP1k/3tZ659K34BxM8dararwn59HIQv4uaHItu6kKkoMNQdfNZ9dWFmuJMJpszpC06E19iXPwZb60DHKD21EAmzklMBneB8vZMpdDOYtApT/6G+OtyNDeP2ZSEsInmMtPcUvWik65qYnMjA==") returned 232 [0086.419] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x21, wMilliseconds=0x2ae)) [0086.420] GetCurrentThreadId () returned 0x970 [0086.420] GetCurrentThreadId () returned 0x970 [0086.420] GetCurrentThreadId () returned 0x970 [0086.420] GetCurrentThreadId () returned 0x970 [0086.420] GetCurrentThreadId () returned 0x970 [0086.420] GetCurrentThreadId () returned 0x970 [0086.420] GetCurrentThreadId () returned 0x970 [0086.420] GetCurrentThreadId () returned 0x970 [0086.420] GetCurrentThreadId () returned 0x970 [0086.420] GetCurrentThreadId () returned 0x970 [0086.420] GetCurrentThreadId () returned 0x970 [0086.420] GetCurrentThreadId () returned 0x970 [0086.420] GetCurrentThreadId () returned 0x970 [0086.420] GetCurrentThreadId () returned 0x970 [0086.420] GetCurrentThreadId () returned 0x970 [0086.420] GetCurrentThreadId () returned 0x970 [0086.420] GetCurrentThreadId () returned 0x970 [0086.420] GetCurrentThreadId () returned 0x970 [0086.420] GetCurrentThreadId () returned 0x970 [0086.420] GetCurrentThreadId () returned 0x970 [0086.420] GetCurrentThreadId () returned 0x970 [0086.420] GetCurrentThreadId () returned 0x970 [0086.420] GetCurrentThreadId () returned 0x970 [0086.420] GetCurrentThreadId () returned 0x970 [0086.420] GetCurrentThreadId () returned 0x970 [0086.420] GetCurrentThreadId () returned 0x970 [0086.420] GetCurrentThreadId () returned 0x970 [0086.420] GetCurrentThreadId () returned 0x970 [0086.420] GetCurrentThreadId () returned 0x970 [0086.420] GetCurrentThreadId () returned 0x970 [0086.420] GetCurrentThreadId () returned 0x970 [0086.420] GetCurrentThreadId () returned 0x970 [0086.420] GetCurrentThreadId () returned 0x970 [0086.420] GetCurrentThreadId () returned 0x970 [0086.421] GetCurrentThreadId () returned 0x970 [0086.421] GetCurrentThreadId () returned 0x970 [0086.421] GetCurrentThreadId () returned 0x970 [0086.421] GetCurrentThreadId () returned 0x970 [0086.421] GetCurrentThreadId () returned 0x970 [0086.421] GetCurrentThreadId () returned 0x970 [0086.421] GetCurrentThreadId () returned 0x970 [0086.421] GetCurrentThreadId () returned 0x970 [0086.421] GetCurrentThreadId () returned 0x970 [0086.421] GetCurrentThreadId () returned 0x970 [0086.421] GetCurrentThreadId () returned 0x970 [0086.421] GetCurrentThreadId () returned 0x970 [0086.421] GetCurrentThreadId () returned 0x970 [0086.421] GetCurrentThreadId () returned 0x970 [0086.421] GetCurrentThreadId () returned 0x970 [0086.421] GetCurrentThreadId () returned 0x970 [0086.421] GetCurrentThreadId () returned 0x970 [0086.421] GetCurrentThreadId () returned 0x970 [0086.421] GetCurrentThreadId () returned 0x970 [0086.421] GetCurrentThreadId () returned 0x970 [0086.421] GetCurrentThreadId () returned 0x970 [0086.421] GetCurrentThreadId () returned 0x970 [0086.421] GetCurrentThreadId () returned 0x970 [0086.421] GetCurrentThreadId () returned 0x970 [0086.421] GetCurrentThreadId () returned 0x970 [0086.421] GetCurrentThreadId () returned 0x970 [0086.421] GetCurrentThreadId () returned 0x970 [0086.421] GetCurrentThreadId () returned 0x970 [0086.421] GetCurrentThreadId () returned 0x970 [0086.421] GetCurrentThreadId () returned 0x970 [0086.421] GetCurrentThreadId () returned 0x970 [0086.421] GetCurrentThreadId () returned 0x970 [0086.421] GetCurrentThreadId () returned 0x970 [0086.421] GetCurrentThreadId () returned 0x970 [0086.421] GetCurrentThreadId () returned 0x970 [0086.422] GetCurrentThreadId () returned 0x970 [0086.422] GetCurrentThreadId () returned 0x970 [0086.422] GetCurrentThreadId () returned 0x970 [0086.422] GetCurrentThreadId () returned 0x970 [0086.422] GetCurrentThreadId () returned 0x970 [0086.422] GetCurrentThreadId () returned 0x970 [0086.422] GetCurrentThreadId () returned 0x970 [0086.422] GetCurrentThreadId () returned 0x970 [0086.422] GetCurrentThreadId () returned 0x970 [0086.422] GetCurrentThreadId () returned 0x970 [0086.422] GetCurrentThreadId () returned 0x970 [0086.422] GetCurrentThreadId () returned 0x970 [0086.422] GetCurrentThreadId () returned 0x970 [0086.422] GetCurrentThreadId () returned 0x970 [0086.422] GetCurrentThreadId () returned 0x970 [0086.422] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAGAmHIU5YEIcn9pHR+nb/xbzOvCH1NRzJkUEwtDyOvmQi9OgJ79koX/dSb8Y++ex+gdHbDI0m1uWl+35PpLmP1k/3tZ659K34BxM8dararwn59HIQv4uaHItu6kKkoMNQdfNZ9dWFmuJMJpszpC06E19iXPwZb60DHKD21EAmzklMBneB8vZMpdDOYtApT/6G+OtyNDeP2ZSEsInmMtPcUvWik65qYnMjA==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0086.422] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAGAmHIU5YEIcn9pHR+nb/xbzOvCH1NRzJkUEwtDyOvmQi9OgJ79koX/dSb8Y++ex+gdHbDI0m1uWl+35PpLmP1k/3tZ659K34BxM8dararwn59HIQv4uaHItu6kKkoMNQdfNZ9dWFmuJMJpszpC06E19iXPwZb60DHKD21EAmzklMBneB8vZMpdDOYtApT/6G+OtyNDeP2ZSEsInmMtPcUvWik65qYnMjA==", cchWideChar=245, lpMultiByteStr=0x3b4d08c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAGAmHIU5YEIcn9pHR+nb/xbzOvCH1NRzJkUEwtDyOvmQi9OgJ79koX/dSb8Y++ex+gdHbDI0m1uWl+35PpLmP1k/3tZ659K34BxM8dararwn59HIQv4uaHItu6kKkoMNQdfNZ9dWFmuJMJpszpC06E19iXPwZb60DHKD21EAmzklMBneB8vZMpdDOYtApT/6G+OtyNDeP2ZSEsInmMtPcUvWik65qYnMjA==", lpUsedDefaultChar=0x0) returned 245 [0086.422] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0086.422] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0086.422] CloseHandle (hObject=0x158) returned 1 [0086.423] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341534.jpg")) returned 1 [0086.424] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=20668726129) returned 1 [0086.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [J0341551.JPG].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [j0341551.jpg].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0086.425] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0086.425] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0086.425] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0086.425] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0086.425] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0086.425] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0086.425] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0086.425] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0086.425] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0086.425] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0086.425] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0086.426] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0086.426] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0086.426] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0086.426] SetEndOfFile (hFile=0x158) returned 1 [0086.426] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0086.426] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0086.426] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0086.426] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0086.426] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0086.427] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0086.428] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="j./vwL25p!bRR{:387\\P", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0086.428] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="j./vwL25p!bRR{:387\\P", cchWideChar=32, lpMultiByteStr=0x203c0dc, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="j./vwL25p!bRR{:387\\P", lpUsedDefaultChar=0x0) returned 32 [0086.428] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0086.428] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0086.428] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5a56, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341551.JPG", cAlternateFileName="")) returned 0x295098 [0086.428] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0086.428] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0086.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341551.jpg")) returned 0x20 [0086.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341551.jpg")) returned 0x20 [0086.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341551.jpg")) returned 0x20 [0086.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341551.jpg")) returned 0x20 [0086.428] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341551.jpg"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5a56)) returned 1 [0086.429] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0086.429] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0086.429] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341551.jpg")) returned 0x20 [0086.429] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341551.jpg")) returned 0x20 [0086.429] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0086.429] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0086.429] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0086.429] SetEndOfFile (hFile=0x158) returned 1 [0086.430] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341551.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.430] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341551.JPG", cchWideChar=12, lpMultiByteStr=0x1fe44ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341551.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.430] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341551.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.430] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341551.JPG", cchWideChar=12, lpMultiByteStr=0x1fe36ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341551.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.430] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe36ec, cbMultiByte=12, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="J0341551.JPGg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0086.430] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341551.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.430] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341551.JPG", cchWideChar=12, lpMultiByteStr=0x1fe44ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341551.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341551.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0086.431] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0086.431] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x5a56 [0086.431] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0086.431] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0086.431] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0086.431] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341551.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.431] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341551.JPG", cchWideChar=12, lpMultiByteStr=0x1fe44ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341551.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.432] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341551.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.432] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341551.JPG", cchWideChar=12, lpMultiByteStr=0x1fe36ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341551.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.432] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe36ec, cbMultiByte=12, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="J0341551.JPG51.JPGg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0086.432] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341551.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.432] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341551.JPG", cchWideChar=12, lpMultiByteStr=0x1fe44ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341551.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.432] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0086.433] CharToOemA (in: pSrc="J0341551.JPG", pDst=0x1fe36ec | out: pDst="J0341551.JPG") returned 1 [0086.433] WriteFile (in: hFile=0x158, lpBuffer=0x1fe36ec*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe36ec*, lpNumberOfBytesWritten=0x18e048*=0xc, lpOverlapped=0x0) returned 1 [0086.433] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0086.434] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0086.434] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0086.434] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=20669727026) returned 1 [0086.434] ReadFile (in: hFile=0x11c, lpBuffer=0x3b95a30, nNumberOfBytesToRead=0x5a56, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b95a30*, lpNumberOfBytesRead=0x18dd7c*=0x5a56, lpOverlapped=0x0) returned 1 [0086.436] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0086.436] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=20669985622) returned 1 [0086.447] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b438*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b5b438*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0086.447] ReadFile (in: hFile=0x11c, lpBuffer=0x3b95a30, nNumberOfBytesToRead=0x5a56, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3b95a30*, lpNumberOfBytesRead=0x18de38*=0x5a56, lpOverlapped=0x0) returned 1 [0086.448] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x47 [0086.448] WriteFile (in: hFile=0x158, lpBuffer=0x381b020*, nNumberOfBytesToWrite=0x5a56, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x381b020*, lpNumberOfBytesWritten=0x18de10*=0x5a56, lpOverlapped=0x0) returned 1 [0086.449] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x5a9d [0086.449] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0086.449] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0086.449] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0086.449] SetFilePointer (in: hFile=0x158, lDistanceToMove=12, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2a [0086.449] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x5aa7 [0086.449] CloseHandle (hObject=0x11c) returned 1 [0086.450] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x5aa7 [0086.450] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x5aa7 [0086.450] SetFilePointer (in: hFile=0x158, lDistanceToMove=23207, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x5aa7 [0086.450] SetFilePointer (in: hFile=0x158, lDistanceToMove=23207, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x5aa7 [0086.450] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x5aa7 [0086.450] SetFilePointer (in: hFile=0x158, lDistanceToMove=23207, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x5aa7 [0086.450] SetEndOfFile (hFile=0x158) returned 1 [0086.450] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x5aa7 [0086.450] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x5aa7 [0086.450] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341551.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.450] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341551.JPG", cchWideChar=12, lpMultiByteStr=0x1fe44ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341551.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.450] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341551.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.450] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341551.JPG", cchWideChar=12, lpMultiByteStr=0x1fe3a2c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341551.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.451] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe3a2c, cbMultiByte=12, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="J0341551.JPGꞗ@涤(\x18믉`믑`") returned 12 [0086.451] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341551.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.451] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341551.JPG", cchWideChar=12, lpMultiByteStr=0x1fe44ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341551.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.451] WriteFile (in: hFile=0x158, lpBuffer=0x37bea38*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x37bea38*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0086.451] CharToOemA (in: pSrc="J0341551.JPG", pDst=0x1fe3a2c | out: pDst="J0341551.JPG") returned 1 [0086.451] WriteFile (in: hFile=0x158, lpBuffer=0x1fe3a2c*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe3a2c*, lpNumberOfBytesWritten=0x18efcc*=0xc, lpOverlapped=0x0) returned 1 [0086.451] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b3b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x3b5b3b0*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0086.451] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0086.451] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0086.451] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x5aec [0086.451] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x5aec [0086.451] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0086.452] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0086.452] DeleteFileW (lpFileName="") returned 0 [0086.452] GetLastError () returned 0x3 [0086.452] GetFileAttributesW (lpFileName="") returned 0xffffffff [0086.452] SetLastError (dwErrCode=0x3) [0086.452] FlushFileBuffers (hFile=0x158) returned 1 [0086.455] GetCurrentThreadId () returned 0x970 [0086.455] GetCurrentThreadId () returned 0x970 [0086.455] GetCurrentThreadId () returned 0x970 [0086.455] GetCurrentThreadId () returned 0x970 [0086.455] GetCurrentThreadId () returned 0x970 [0086.455] GetCurrentThreadId () returned 0x970 [0086.455] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x5ba3 [0086.455] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x5ba3 [0086.455] SetFilePointer (in: hFile=0x158, lDistanceToMove=23459, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x5ba3 [0086.455] CloseHandle (hObject=0x158) returned 1 [0086.456] GetCurrentThreadId () returned 0x970 [0086.456] GetCurrentThreadId () returned 0x970 [0086.456] GetCurrentThreadId () returned 0x970 [0086.456] GetCurrentThreadId () returned 0x970 [0086.456] GetCurrentThreadId () returned 0x970 [0086.456] GetCurrentThreadId () returned 0x970 [0086.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [J0341551.JPG].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [j0341551.jpg].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0086.456] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5ba3 [0086.456] SetFilePointer (in: hFile=0x158, lDistanceToMove=23331, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5b23 [0086.456] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0086.456] GetFileType (hFile=0x158) returned 0x1 [0086.456] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x21, wMilliseconds=0x2dc)) [0086.456] GetCurrentThreadId () returned 0x970 [0086.456] GetCurrentThreadId () returned 0x970 [0086.456] GetCurrentThreadId () returned 0x970 [0086.456] GetCurrentThreadId () returned 0x970 [0086.456] GetCurrentThreadId () returned 0x970 [0086.456] GetCurrentThreadId () returned 0x970 [0086.456] GetCurrentThreadId () returned 0x970 [0086.457] GetCurrentThreadId () returned 0x970 [0086.457] GetCurrentThreadId () returned 0x970 [0086.457] GetCurrentThreadId () returned 0x970 [0086.457] GetCurrentThreadId () returned 0x970 [0086.457] GetCurrentThreadId () returned 0x970 [0086.457] GetCurrentThreadId () returned 0x970 [0086.457] GetCurrentThreadId () returned 0x970 [0086.457] GetCurrentThreadId () returned 0x970 [0086.457] GetCurrentThreadId () returned 0x970 [0086.457] GetCurrentThreadId () returned 0x970 [0086.457] GetCurrentThreadId () returned 0x970 [0086.457] GetCurrentThreadId () returned 0x970 [0086.457] GetCurrentThreadId () returned 0x970 [0086.457] GetCurrentThreadId () returned 0x970 [0086.457] GetCurrentThreadId () returned 0x970 [0086.457] GetCurrentThreadId () returned 0x970 [0086.457] GetCurrentThreadId () returned 0x970 [0086.457] GetCurrentThreadId () returned 0x970 [0086.457] GetCurrentThreadId () returned 0x970 [0086.457] GetCurrentThreadId () returned 0x970 [0086.457] GetCurrentThreadId () returned 0x970 [0086.457] GetCurrentThreadId () returned 0x970 [0086.457] GetCurrentThreadId () returned 0x970 [0086.457] GetCurrentThreadId () returned 0x970 [0086.457] GetCurrentThreadId () returned 0x970 [0086.457] GetCurrentThreadId () returned 0x970 [0086.457] GetCurrentThreadId () returned 0x970 [0086.458] GetCurrentThreadId () returned 0x970 [0086.458] GetCurrentThreadId () returned 0x970 [0086.458] GetCurrentThreadId () returned 0x970 [0086.458] GetCurrentThreadId () returned 0x970 [0086.458] GetCurrentThreadId () returned 0x970 [0086.458] GetCurrentThreadId () returned 0x970 [0086.458] GetCurrentThreadId () returned 0x970 [0086.458] GetCurrentThreadId () returned 0x970 [0086.458] GetCurrentThreadId () returned 0x970 [0086.458] GetCurrentThreadId () returned 0x970 [0086.458] GetCurrentThreadId () returned 0x970 [0086.458] GetCurrentThreadId () returned 0x970 [0086.458] GetCurrentThreadId () returned 0x970 [0086.458] GetCurrentThreadId () returned 0x970 [0086.458] GetCurrentThreadId () returned 0x970 [0086.458] GetCurrentThreadId () returned 0x970 [0086.458] GetCurrentThreadId () returned 0x970 [0086.458] GetCurrentThreadId () returned 0x970 [0086.458] GetCurrentThreadId () returned 0x970 [0086.458] GetCurrentThreadId () returned 0x970 [0086.458] GetCurrentThreadId () returned 0x970 [0086.458] GetCurrentThreadId () returned 0x970 [0086.458] GetCurrentThreadId () returned 0x970 [0086.458] GetCurrentThreadId () returned 0x970 [0086.458] GetCurrentThreadId () returned 0x970 [0086.458] GetCurrentThreadId () returned 0x970 [0086.458] GetCurrentThreadId () returned 0x970 [0086.458] GetCurrentThreadId () returned 0x970 [0086.458] GetCurrentThreadId () returned 0x970 [0086.458] GetCurrentThreadId () returned 0x970 [0086.458] GetCurrentThreadId () returned 0x970 [0086.458] GetCurrentThreadId () returned 0x970 [0086.458] GetCurrentThreadId () returned 0x970 [0086.458] GetCurrentThreadId () returned 0x970 [0086.458] GetCurrentThreadId () returned 0x970 [0086.458] GetCurrentThreadId () returned 0x970 [0086.459] GetCurrentThreadId () returned 0x970 [0086.459] GetCurrentThreadId () returned 0x970 [0086.459] GetCurrentThreadId () returned 0x970 [0086.459] GetCurrentThreadId () returned 0x970 [0086.459] GetCurrentThreadId () returned 0x970 [0086.459] GetCurrentThreadId () returned 0x970 [0086.459] GetCurrentThreadId () returned 0x970 [0086.459] GetCurrentThreadId () returned 0x970 [0086.459] GetCurrentThreadId () returned 0x970 [0086.459] GetCurrentThreadId () returned 0x970 [0086.459] GetCurrentThreadId () returned 0x970 [0086.459] GetCurrentThreadId () returned 0x970 [0086.459] GetCurrentThreadId () returned 0x970 [0086.459] GetCurrentThreadId () returned 0x970 [0086.459] GetCurrentThreadId () returned 0x970 [0086.459] GetCurrentThreadId () returned 0x970 [0086.459] GetCurrentThreadId () returned 0x970 [0086.459] GetCurrentThreadId () returned 0x970 [0086.459] GetCurrentThreadId () returned 0x970 [0086.459] GetCurrentThreadId () returned 0x970 [0086.459] GetCurrentThreadId () returned 0x970 [0086.459] GetCurrentThreadId () returned 0x970 [0086.459] GetCurrentThreadId () returned 0x970 [0086.459] GetCurrentThreadId () returned 0x970 [0086.459] GetCurrentThreadId () returned 0x970 [0086.459] GetCurrentThreadId () returned 0x970 [0086.459] GetCurrentThreadId () returned 0x970 [0086.459] GetCurrentThreadId () returned 0x970 [0086.459] GetCurrentThreadId () returned 0x970 [0086.459] GetCurrentThreadId () returned 0x970 [0086.459] GetCurrentThreadId () returned 0x970 [0086.459] GetCurrentThreadId () returned 0x970 [0086.459] GetCurrentThreadId () returned 0x970 [0086.459] GetCurrentThreadId () returned 0x970 [0086.459] GetCurrentThreadId () returned 0x970 [0086.459] GetCurrentThreadId () returned 0x970 [0086.460] GetCurrentThreadId () returned 0x970 [0086.460] GetCurrentThreadId () returned 0x970 [0086.460] GetCurrentThreadId () returned 0x970 [0086.460] GetCurrentThreadId () returned 0x970 [0086.460] GetCurrentThreadId () returned 0x970 [0086.460] GetCurrentThreadId () returned 0x970 [0086.460] GetCurrentThreadId () returned 0x970 [0086.460] GetCurrentThreadId () returned 0x970 [0086.460] GetCurrentThreadId () returned 0x970 [0086.460] GetCurrentThreadId () returned 0x970 [0086.460] GetCurrentThreadId () returned 0x970 [0086.460] GetCurrentThreadId () returned 0x970 [0086.460] GetCurrentThreadId () returned 0x970 [0086.460] GetCurrentThreadId () returned 0x970 [0086.460] GetCurrentThreadId () returned 0x970 [0086.460] GetCurrentThreadId () returned 0x970 [0086.460] GetCurrentThreadId () returned 0x970 [0086.460] GetCurrentThreadId () returned 0x970 [0086.460] GetCurrentThreadId () returned 0x970 [0086.460] GetCurrentThreadId () returned 0x970 [0086.460] GetCurrentThreadId () returned 0x970 [0086.460] GetCurrentThreadId () returned 0x970 [0086.460] GetCurrentThreadId () returned 0x970 [0086.460] GetCurrentThreadId () returned 0x970 [0086.460] GetCurrentThreadId () returned 0x970 [0086.460] GetCurrentThreadId () returned 0x970 [0086.460] GetCurrentThreadId () returned 0x970 [0086.460] GetCurrentThreadId () returned 0x970 [0086.460] GetCurrentThreadId () returned 0x970 [0086.460] GetCurrentThreadId () returned 0x970 [0086.460] GetCurrentThreadId () returned 0x970 [0086.460] GetCurrentThreadId () returned 0x970 [0086.460] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.460] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.460] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5ea10, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0086.461] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.461] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.461] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5ea10, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0086.461] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.461] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.461] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b548, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0086.461] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.461] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.461] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b548, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0086.461] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.461] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.461] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5ea70, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0086.461] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.461] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.461] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5ea70, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0086.461] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.461] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.461] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5ea70, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0086.461] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x21, wMilliseconds=0x2dc)) [0086.461] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="j./vwL25p!bRR{:387\\P", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0086.461] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="j./vwL25p!bRR{:387\\P", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0086.461] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="j./vwL25p!bRR{:387\\P", cchWideChar=32, lpMultiByteStr=0x3b56318, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="j./vwL25p!bRR{:387\\P", lpUsedDefaultChar=0x0) returned 32 [0086.461] GetCurrentThreadId () returned 0x970 [0086.462] GetCurrentThreadId () returned 0x970 [0086.462] GetCurrentThreadId () returned 0x970 [0086.462] GetCurrentThreadId () returned 0x970 [0086.462] GetCurrentThreadId () returned 0x970 [0086.462] GetCurrentThreadId () returned 0x970 [0086.471] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0086.471] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0086.471] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3b86c88, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0086.472] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0086.472] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAC5+qjGvSLt5B+mqOe5INkguVFvB9SIGBmi1a3hoGyiZewjrEQxm67Ek99V7SCS6/+FLpulZi3X40Eu0JurB/a1sb5VBvUQXAJUjDfHzUsy+cgjtNbLKpbWC8mj3RsWR5klmgZHdINPYtEedCsCoF++wC8GlfxOzggiPQZLeqZuAebEyowikQK9A1RKf6o8u4hTVMgKplWGF+VSCgJZx0oImfz58C0jDWw==") returned 232 [0086.472] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x21, wMilliseconds=0x2ec)) [0086.472] GetCurrentThreadId () returned 0x970 [0086.472] GetCurrentThreadId () returned 0x970 [0086.472] GetCurrentThreadId () returned 0x970 [0086.472] GetCurrentThreadId () returned 0x970 [0086.472] GetCurrentThreadId () returned 0x970 [0086.472] GetCurrentThreadId () returned 0x970 [0086.472] GetCurrentThreadId () returned 0x970 [0086.472] GetCurrentThreadId () returned 0x970 [0086.472] GetCurrentThreadId () returned 0x970 [0086.472] GetCurrentThreadId () returned 0x970 [0086.472] GetCurrentThreadId () returned 0x970 [0086.472] GetCurrentThreadId () returned 0x970 [0086.472] GetCurrentThreadId () returned 0x970 [0086.472] GetCurrentThreadId () returned 0x970 [0086.472] GetCurrentThreadId () returned 0x970 [0086.472] GetCurrentThreadId () returned 0x970 [0086.472] GetCurrentThreadId () returned 0x970 [0086.472] GetCurrentThreadId () returned 0x970 [0086.472] GetCurrentThreadId () returned 0x970 [0086.472] GetCurrentThreadId () returned 0x970 [0086.472] GetCurrentThreadId () returned 0x970 [0086.472] GetCurrentThreadId () returned 0x970 [0086.472] GetCurrentThreadId () returned 0x970 [0086.472] GetCurrentThreadId () returned 0x970 [0086.472] GetCurrentThreadId () returned 0x970 [0086.472] GetCurrentThreadId () returned 0x970 [0086.472] GetCurrentThreadId () returned 0x970 [0086.472] GetCurrentThreadId () returned 0x970 [0086.472] GetCurrentThreadId () returned 0x970 [0086.472] GetCurrentThreadId () returned 0x970 [0086.473] GetCurrentThreadId () returned 0x970 [0086.473] GetCurrentThreadId () returned 0x970 [0086.473] GetCurrentThreadId () returned 0x970 [0086.473] GetCurrentThreadId () returned 0x970 [0086.473] GetCurrentThreadId () returned 0x970 [0086.473] GetCurrentThreadId () returned 0x970 [0086.473] GetCurrentThreadId () returned 0x970 [0086.473] GetCurrentThreadId () returned 0x970 [0086.473] GetCurrentThreadId () returned 0x970 [0086.473] GetCurrentThreadId () returned 0x970 [0086.473] GetCurrentThreadId () returned 0x970 [0086.473] GetCurrentThreadId () returned 0x970 [0086.473] GetCurrentThreadId () returned 0x970 [0086.473] GetCurrentThreadId () returned 0x970 [0086.473] GetCurrentThreadId () returned 0x970 [0086.473] GetCurrentThreadId () returned 0x970 [0086.473] GetCurrentThreadId () returned 0x970 [0086.473] GetCurrentThreadId () returned 0x970 [0086.473] GetCurrentThreadId () returned 0x970 [0086.473] GetCurrentThreadId () returned 0x970 [0086.473] GetCurrentThreadId () returned 0x970 [0086.473] GetCurrentThreadId () returned 0x970 [0086.473] GetCurrentThreadId () returned 0x970 [0086.473] GetCurrentThreadId () returned 0x970 [0086.473] GetCurrentThreadId () returned 0x970 [0086.473] GetCurrentThreadId () returned 0x970 [0086.473] GetCurrentThreadId () returned 0x970 [0086.473] GetCurrentThreadId () returned 0x970 [0086.473] GetCurrentThreadId () returned 0x970 [0086.473] GetCurrentThreadId () returned 0x970 [0086.473] GetCurrentThreadId () returned 0x970 [0086.473] GetCurrentThreadId () returned 0x970 [0086.473] GetCurrentThreadId () returned 0x970 [0086.473] GetCurrentThreadId () returned 0x970 [0086.473] GetCurrentThreadId () returned 0x970 [0086.473] GetCurrentThreadId () returned 0x970 [0086.474] GetCurrentThreadId () returned 0x970 [0086.474] GetCurrentThreadId () returned 0x970 [0086.474] GetCurrentThreadId () returned 0x970 [0086.474] GetCurrentThreadId () returned 0x970 [0086.474] GetCurrentThreadId () returned 0x970 [0086.474] GetCurrentThreadId () returned 0x970 [0086.474] GetCurrentThreadId () returned 0x970 [0086.474] GetCurrentThreadId () returned 0x970 [0086.474] GetCurrentThreadId () returned 0x970 [0086.474] GetCurrentThreadId () returned 0x970 [0086.474] GetCurrentThreadId () returned 0x970 [0086.474] GetCurrentThreadId () returned 0x970 [0086.474] GetCurrentThreadId () returned 0x970 [0086.474] GetCurrentThreadId () returned 0x970 [0086.474] GetCurrentThreadId () returned 0x970 [0086.474] GetCurrentThreadId () returned 0x970 [0086.474] GetCurrentThreadId () returned 0x970 [0086.474] GetCurrentThreadId () returned 0x970 [0086.474] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAC5+qjGvSLt5B+mqOe5INkguVFvB9SIGBmi1a3hoGyiZewjrEQxm67Ek99V7SCS6/+FLpulZi3X40Eu0JurB/a1sb5VBvUQXAJUjDfHzUsy+cgjtNbLKpbWC8mj3RsWR5klmgZHdINPYtEedCsCoF++wC8GlfxOzggiPQZLeqZuAebEyowikQK9A1RKf6o8u4hTVMgKplWGF+VSCgJZx0oImfz58C0jDWw==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0086.474] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAC5+qjGvSLt5B+mqOe5INkguVFvB9SIGBmi1a3hoGyiZewjrEQxm67Ek99V7SCS6/+FLpulZi3X40Eu0JurB/a1sb5VBvUQXAJUjDfHzUsy+cgjtNbLKpbWC8mj3RsWR5klmgZHdINPYtEedCsCoF++wC8GlfxOzggiPQZLeqZuAebEyowikQK9A1RKf6o8u4hTVMgKplWGF+VSCgJZx0oImfz58C0jDWw==", cchWideChar=245, lpMultiByteStr=0x3b4d08c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAC5+qjGvSLt5B+mqOe5INkguVFvB9SIGBmi1a3hoGyiZewjrEQxm67Ek99V7SCS6/+FLpulZi3X40Eu0JurB/a1sb5VBvUQXAJUjDfHzUsy+cgjtNbLKpbWC8mj3RsWR5klmgZHdINPYtEedCsCoF++wC8GlfxOzggiPQZLeqZuAebEyowikQK9A1RKf6o8u4hTVMgKplWGF+VSCgJZx0oImfz58C0jDWw==", lpUsedDefaultChar=0x0) returned 245 [0086.474] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0086.474] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0086.475] CloseHandle (hObject=0x158) returned 1 [0086.475] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341551.jpg")) returned 1 [0086.476] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=20673946881) returned 1 [0086.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [J0341554.JPG].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [j0341554.jpg].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0086.477] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0086.477] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0086.477] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0086.477] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0086.477] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0086.478] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0086.478] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0086.478] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0086.478] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0086.478] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0086.478] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0086.478] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0086.478] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0086.478] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0086.478] SetEndOfFile (hFile=0x158) returned 1 [0086.478] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0086.478] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0086.478] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0086.479] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0086.479] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0086.481] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0086.481] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="wP$JN~n,3P)f5\\Kmh!\\N^<{i.8f@a~??", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0086.481] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="wP$JN~n,3P)f5\\Kmh!\\N^<{i.8f@a~??", cchWideChar=32, lpMultiByteStr=0x203c114, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wP$JN~n,3P)f5\\Kmh!\\N^<{i.8f@a~??", lpUsedDefaultChar=0x0) returned 32 [0086.481] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0086.481] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0086.481] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6f43, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341554.JPG", cAlternateFileName="")) returned 0x295098 [0086.482] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0086.482] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0086.482] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341554.jpg")) returned 0x20 [0086.483] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341554.jpg")) returned 0x20 [0086.483] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341554.jpg")) returned 0x20 [0086.483] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341554.jpg")) returned 0x20 [0086.483] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341554.jpg"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6f43)) returned 1 [0086.483] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0086.483] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0086.483] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341554.jpg")) returned 0x20 [0086.483] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341554.jpg")) returned 0x20 [0086.483] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0086.483] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0086.483] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0086.484] SetEndOfFile (hFile=0x158) returned 1 [0086.485] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341554.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.485] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341554.JPG", cchWideChar=12, lpMultiByteStr=0x1fe430c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341554.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.485] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341554.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.485] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341554.JPG", cchWideChar=12, lpMultiByteStr=0x1fe664c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341554.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.485] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe664c, cbMultiByte=12, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="J0341554.JPGg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0086.485] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341554.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.485] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341554.JPG", cchWideChar=12, lpMultiByteStr=0x1fe430c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341554.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341554.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0086.486] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0086.486] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x6f43 [0086.486] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0086.486] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0086.486] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0086.486] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341554.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.486] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341554.JPG", cchWideChar=12, lpMultiByteStr=0x1fe430c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341554.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.486] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341554.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.486] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341554.JPG", cchWideChar=12, lpMultiByteStr=0x1fe664c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341554.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.486] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe664c, cbMultiByte=12, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="J0341554.JPG54.JPGg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0086.486] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341554.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.486] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341554.JPG", cchWideChar=12, lpMultiByteStr=0x1fe430c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341554.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.486] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0086.487] CharToOemA (in: pSrc="J0341554.JPG", pDst=0x1fe664c | out: pDst="J0341554.JPG") returned 1 [0086.487] WriteFile (in: hFile=0x158, lpBuffer=0x1fe664c*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe664c*, lpNumberOfBytesWritten=0x18e048*=0xc, lpOverlapped=0x0) returned 1 [0086.487] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0086.487] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0086.488] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0086.488] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=20675113335) returned 1 [0086.488] ReadFile (in: hFile=0x11c, lpBuffer=0x3b95a30, nNumberOfBytesToRead=0x6f43, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b95a30*, lpNumberOfBytesRead=0x18dd7c*=0x6f43, lpOverlapped=0x0) returned 1 [0086.490] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0086.490] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=20675322102) returned 1 [0086.498] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b420*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b5b420*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0086.499] ReadFile (in: hFile=0x11c, lpBuffer=0x3b95a30, nNumberOfBytesToRead=0x6f43, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3b95a30*, lpNumberOfBytesRead=0x18de38*=0x6f43, lpOverlapped=0x0) returned 1 [0086.499] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x47 [0086.499] WriteFile (in: hFile=0x158, lpBuffer=0x381b020*, nNumberOfBytesToWrite=0x6f43, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x381b020*, lpNumberOfBytesWritten=0x18de10*=0x6f43, lpOverlapped=0x0) returned 1 [0086.500] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x6f8a [0086.500] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0086.500] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0086.500] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0086.500] SetFilePointer (in: hFile=0x158, lDistanceToMove=12, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2a [0086.500] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x6f94 [0086.501] CloseHandle (hObject=0x11c) returned 1 [0086.501] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x6f94 [0086.501] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x6f94 [0086.501] SetFilePointer (in: hFile=0x158, lDistanceToMove=28564, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x6f94 [0086.501] SetFilePointer (in: hFile=0x158, lDistanceToMove=28564, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x6f94 [0086.501] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x6f94 [0086.501] SetFilePointer (in: hFile=0x158, lDistanceToMove=28564, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x6f94 [0086.501] SetEndOfFile (hFile=0x158) returned 1 [0086.501] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x6f94 [0086.501] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x6f94 [0086.501] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341554.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.501] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341554.JPG", cchWideChar=12, lpMultiByteStr=0x1fe430c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341554.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.501] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341554.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.501] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341554.JPG", cchWideChar=12, lpMultiByteStr=0x1fe43ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341554.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.501] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe43ac, cbMultiByte=12, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="J0341554.JPGꞗ@涤(\x18믉`믑`") returned 12 [0086.502] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341554.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.502] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341554.JPG", cchWideChar=12, lpMultiByteStr=0x1fe430c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341554.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.502] WriteFile (in: hFile=0x158, lpBuffer=0x37bea38*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x37bea38*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0086.502] CharToOemA (in: pSrc="J0341554.JPG", pDst=0x1fe43ac | out: pDst="J0341554.JPG") returned 1 [0086.502] WriteFile (in: hFile=0x158, lpBuffer=0x1fe43ac*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe43ac*, lpNumberOfBytesWritten=0x18efcc*=0xc, lpOverlapped=0x0) returned 1 [0086.502] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b470*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x3b5b470*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0086.502] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0086.502] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0086.502] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x6fd9 [0086.502] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x6fd9 [0086.502] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0086.502] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0086.502] DeleteFileW (lpFileName="") returned 0 [0086.502] GetLastError () returned 0x3 [0086.502] GetFileAttributesW (lpFileName="") returned 0xffffffff [0086.503] SetLastError (dwErrCode=0x3) [0086.503] FlushFileBuffers (hFile=0x158) returned 1 [0086.510] GetCurrentThreadId () returned 0x970 [0086.510] GetCurrentThreadId () returned 0x970 [0086.510] GetCurrentThreadId () returned 0x970 [0086.510] GetCurrentThreadId () returned 0x970 [0086.510] GetCurrentThreadId () returned 0x970 [0086.510] GetCurrentThreadId () returned 0x970 [0086.510] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x7090 [0086.510] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x7090 [0086.510] SetFilePointer (in: hFile=0x158, lDistanceToMove=28816, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x7090 [0086.511] CloseHandle (hObject=0x158) returned 1 [0086.511] GetCurrentThreadId () returned 0x970 [0086.511] GetCurrentThreadId () returned 0x970 [0086.511] GetCurrentThreadId () returned 0x970 [0086.511] GetCurrentThreadId () returned 0x970 [0086.511] GetCurrentThreadId () returned 0x970 [0086.511] GetCurrentThreadId () returned 0x970 [0086.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [J0341554.JPG].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [j0341554.jpg].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0086.511] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7090 [0086.511] SetFilePointer (in: hFile=0x158, lDistanceToMove=28688, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7010 [0086.511] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0086.511] GetFileType (hFile=0x158) returned 0x1 [0086.511] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x21, wMilliseconds=0x30b)) [0086.511] GetCurrentThreadId () returned 0x970 [0086.511] GetCurrentThreadId () returned 0x970 [0086.511] GetCurrentThreadId () returned 0x970 [0086.511] GetCurrentThreadId () returned 0x970 [0086.511] GetCurrentThreadId () returned 0x970 [0086.511] GetCurrentThreadId () returned 0x970 [0086.511] GetCurrentThreadId () returned 0x970 [0086.512] GetCurrentThreadId () returned 0x970 [0086.512] GetCurrentThreadId () returned 0x970 [0086.512] GetCurrentThreadId () returned 0x970 [0086.512] GetCurrentThreadId () returned 0x970 [0086.512] GetCurrentThreadId () returned 0x970 [0086.512] GetCurrentThreadId () returned 0x970 [0086.512] GetCurrentThreadId () returned 0x970 [0086.512] GetCurrentThreadId () returned 0x970 [0086.512] GetCurrentThreadId () returned 0x970 [0086.512] GetCurrentThreadId () returned 0x970 [0086.512] GetCurrentThreadId () returned 0x970 [0086.512] GetCurrentThreadId () returned 0x970 [0086.512] GetCurrentThreadId () returned 0x970 [0086.512] GetCurrentThreadId () returned 0x970 [0086.512] GetCurrentThreadId () returned 0x970 [0086.512] GetCurrentThreadId () returned 0x970 [0086.512] GetCurrentThreadId () returned 0x970 [0086.512] GetCurrentThreadId () returned 0x970 [0086.512] GetCurrentThreadId () returned 0x970 [0086.512] GetCurrentThreadId () returned 0x970 [0086.512] GetCurrentThreadId () returned 0x970 [0086.512] GetCurrentThreadId () returned 0x970 [0086.512] GetCurrentThreadId () returned 0x970 [0086.512] GetCurrentThreadId () returned 0x970 [0086.512] GetCurrentThreadId () returned 0x970 [0086.512] GetCurrentThreadId () returned 0x970 [0086.512] GetCurrentThreadId () returned 0x970 [0086.512] GetCurrentThreadId () returned 0x970 [0086.512] GetCurrentThreadId () returned 0x970 [0086.512] GetCurrentThreadId () returned 0x970 [0086.512] GetCurrentThreadId () returned 0x970 [0086.512] GetCurrentThreadId () returned 0x970 [0086.512] GetCurrentThreadId () returned 0x970 [0086.512] GetCurrentThreadId () returned 0x970 [0086.512] GetCurrentThreadId () returned 0x970 [0086.512] GetCurrentThreadId () returned 0x970 [0086.512] GetCurrentThreadId () returned 0x970 [0086.512] GetCurrentThreadId () returned 0x970 [0086.512] GetCurrentThreadId () returned 0x970 [0086.512] GetCurrentThreadId () returned 0x970 [0086.512] GetCurrentThreadId () returned 0x970 [0086.512] GetCurrentThreadId () returned 0x970 [0086.512] GetCurrentThreadId () returned 0x970 [0086.512] GetCurrentThreadId () returned 0x970 [0086.512] GetCurrentThreadId () returned 0x970 [0086.513] GetCurrentThreadId () returned 0x970 [0086.513] GetCurrentThreadId () returned 0x970 [0086.513] GetCurrentThreadId () returned 0x970 [0086.513] GetCurrentThreadId () returned 0x970 [0086.513] GetCurrentThreadId () returned 0x970 [0086.513] GetCurrentThreadId () returned 0x970 [0086.513] GetCurrentThreadId () returned 0x970 [0086.513] GetCurrentThreadId () returned 0x970 [0086.513] GetCurrentThreadId () returned 0x970 [0086.513] GetCurrentThreadId () returned 0x970 [0086.513] GetCurrentThreadId () returned 0x970 [0086.513] GetCurrentThreadId () returned 0x970 [0086.513] GetCurrentThreadId () returned 0x970 [0086.513] GetCurrentThreadId () returned 0x970 [0086.513] GetCurrentThreadId () returned 0x970 [0086.513] GetCurrentThreadId () returned 0x970 [0086.513] GetCurrentThreadId () returned 0x970 [0086.513] GetCurrentThreadId () returned 0x970 [0086.513] GetCurrentThreadId () returned 0x970 [0086.513] GetCurrentThreadId () returned 0x970 [0086.513] GetCurrentThreadId () returned 0x970 [0086.513] GetCurrentThreadId () returned 0x970 [0086.513] GetCurrentThreadId () returned 0x970 [0086.513] GetCurrentThreadId () returned 0x970 [0086.513] GetCurrentThreadId () returned 0x970 [0086.513] GetCurrentThreadId () returned 0x970 [0086.513] GetCurrentThreadId () returned 0x970 [0086.513] GetCurrentThreadId () returned 0x970 [0086.513] GetCurrentThreadId () returned 0x970 [0086.513] GetCurrentThreadId () returned 0x970 [0086.513] GetCurrentThreadId () returned 0x970 [0086.513] GetCurrentThreadId () returned 0x970 [0086.513] GetCurrentThreadId () returned 0x970 [0086.513] GetCurrentThreadId () returned 0x970 [0086.513] GetCurrentThreadId () returned 0x970 [0086.513] GetCurrentThreadId () returned 0x970 [0086.513] GetCurrentThreadId () returned 0x970 [0086.513] GetCurrentThreadId () returned 0x970 [0086.513] GetCurrentThreadId () returned 0x970 [0086.513] GetCurrentThreadId () returned 0x970 [0086.513] GetCurrentThreadId () returned 0x970 [0086.513] GetCurrentThreadId () returned 0x970 [0086.513] GetCurrentThreadId () returned 0x970 [0086.513] GetCurrentThreadId () returned 0x970 [0086.513] GetCurrentThreadId () returned 0x970 [0086.514] GetCurrentThreadId () returned 0x970 [0086.514] GetCurrentThreadId () returned 0x970 [0086.514] GetCurrentThreadId () returned 0x970 [0086.514] GetCurrentThreadId () returned 0x970 [0086.514] GetCurrentThreadId () returned 0x970 [0086.514] GetCurrentThreadId () returned 0x970 [0086.514] GetCurrentThreadId () returned 0x970 [0086.514] GetCurrentThreadId () returned 0x970 [0086.514] GetCurrentThreadId () returned 0x970 [0086.514] GetCurrentThreadId () returned 0x970 [0086.514] GetCurrentThreadId () returned 0x970 [0086.514] GetCurrentThreadId () returned 0x970 [0086.514] GetCurrentThreadId () returned 0x970 [0086.514] GetCurrentThreadId () returned 0x970 [0086.514] GetCurrentThreadId () returned 0x970 [0086.514] GetCurrentThreadId () returned 0x970 [0086.514] GetCurrentThreadId () returned 0x970 [0086.514] GetCurrentThreadId () returned 0x970 [0086.514] GetCurrentThreadId () returned 0x970 [0086.514] GetCurrentThreadId () returned 0x970 [0086.514] GetCurrentThreadId () returned 0x970 [0086.514] GetCurrentThreadId () returned 0x970 [0086.514] GetCurrentThreadId () returned 0x970 [0086.514] GetCurrentThreadId () returned 0x970 [0086.514] GetCurrentThreadId () returned 0x970 [0086.514] GetCurrentThreadId () returned 0x970 [0086.514] GetCurrentThreadId () returned 0x970 [0086.514] GetCurrentThreadId () returned 0x970 [0086.514] GetCurrentThreadId () returned 0x970 [0086.514] GetCurrentThreadId () returned 0x970 [0086.514] GetCurrentThreadId () returned 0x970 [0086.514] GetCurrentThreadId () returned 0x970 [0086.514] GetCurrentThreadId () returned 0x970 [0086.514] GetCurrentThreadId () returned 0x970 [0086.514] GetCurrentThreadId () returned 0x970 [0086.514] GetCurrentThreadId () returned 0x970 [0086.514] GetCurrentThreadId () returned 0x970 [0086.514] GetCurrentThreadId () returned 0x970 [0086.514] GetCurrentThreadId () returned 0x970 [0086.514] GetCurrentThreadId () returned 0x970 [0086.514] GetCurrentThreadId () returned 0x970 [0086.514] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.514] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.514] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5ea70, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0086.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5ea70, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0086.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b530, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0086.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b530, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0086.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5ead0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0086.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5ead0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0086.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5ead0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0086.515] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x21, wMilliseconds=0x30b)) [0086.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wP$JN~n,3P)f5\\Kmh!\\N^<{i.8f@a~??", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0086.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wP$JN~n,3P)f5\\Kmh!\\N^<{i.8f@a~??", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0086.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wP$JN~n,3P)f5\\Kmh!\\N^<{i.8f@a~??", cchWideChar=32, lpMultiByteStr=0x3b56348, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wP$JN~n,3P)f5\\Kmh!\\N^<{i.8f@a~??", lpUsedDefaultChar=0x0) returned 32 [0086.515] GetCurrentThreadId () returned 0x970 [0086.515] GetCurrentThreadId () returned 0x970 [0086.515] GetCurrentThreadId () returned 0x970 [0086.515] GetCurrentThreadId () returned 0x970 [0086.515] GetCurrentThreadId () returned 0x970 [0086.515] GetCurrentThreadId () returned 0x970 [0086.523] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0086.523] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0086.523] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3b86d78, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0086.523] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0086.523] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAGpqHxZas/5wY+tCRV23EZq2XPg1iz9tlvXKfL1b1vsHQjy/RRfPw51g6DRzzXqXHj48czqiTK+mgdGh5/A8PqIIya3Lmw2qeWkebIA1jW+/yF6hl8STQoFXSDCpwvUWPulagbgM3DWQbXOxaTxnyBJSi83cEqcx8ckYjH4npdubuwyYjV9pPADQPKVNqWNOVemyNvd3a7Tq/7RYyvBWsUA0Q2ESLSqdFA==") returned 232 [0086.523] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x21, wMilliseconds=0x31b)) [0086.523] GetCurrentThreadId () returned 0x970 [0086.523] GetCurrentThreadId () returned 0x970 [0086.523] GetCurrentThreadId () returned 0x970 [0086.523] GetCurrentThreadId () returned 0x970 [0086.523] GetCurrentThreadId () returned 0x970 [0086.523] GetCurrentThreadId () returned 0x970 [0086.523] GetCurrentThreadId () returned 0x970 [0086.523] GetCurrentThreadId () returned 0x970 [0086.523] GetCurrentThreadId () returned 0x970 [0086.524] GetCurrentThreadId () returned 0x970 [0086.524] GetCurrentThreadId () returned 0x970 [0086.524] GetCurrentThreadId () returned 0x970 [0086.524] GetCurrentThreadId () returned 0x970 [0086.524] GetCurrentThreadId () returned 0x970 [0086.524] GetCurrentThreadId () returned 0x970 [0086.524] GetCurrentThreadId () returned 0x970 [0086.524] GetCurrentThreadId () returned 0x970 [0086.524] GetCurrentThreadId () returned 0x970 [0086.524] GetCurrentThreadId () returned 0x970 [0086.524] GetCurrentThreadId () returned 0x970 [0086.524] GetCurrentThreadId () returned 0x970 [0086.524] GetCurrentThreadId () returned 0x970 [0086.524] GetCurrentThreadId () returned 0x970 [0086.524] GetCurrentThreadId () returned 0x970 [0086.524] GetCurrentThreadId () returned 0x970 [0086.524] GetCurrentThreadId () returned 0x970 [0086.524] GetCurrentThreadId () returned 0x970 [0086.524] GetCurrentThreadId () returned 0x970 [0086.524] GetCurrentThreadId () returned 0x970 [0086.524] GetCurrentThreadId () returned 0x970 [0086.524] GetCurrentThreadId () returned 0x970 [0086.524] GetCurrentThreadId () returned 0x970 [0086.524] GetCurrentThreadId () returned 0x970 [0086.524] GetCurrentThreadId () returned 0x970 [0086.524] GetCurrentThreadId () returned 0x970 [0086.524] GetCurrentThreadId () returned 0x970 [0086.524] GetCurrentThreadId () returned 0x970 [0086.524] GetCurrentThreadId () returned 0x970 [0086.524] GetCurrentThreadId () returned 0x970 [0086.524] GetCurrentThreadId () returned 0x970 [0086.524] GetCurrentThreadId () returned 0x970 [0086.524] GetCurrentThreadId () returned 0x970 [0086.524] GetCurrentThreadId () returned 0x970 [0086.524] GetCurrentThreadId () returned 0x970 [0086.524] GetCurrentThreadId () returned 0x970 [0086.524] GetCurrentThreadId () returned 0x970 [0086.524] GetCurrentThreadId () returned 0x970 [0086.524] GetCurrentThreadId () returned 0x970 [0086.524] GetCurrentThreadId () returned 0x970 [0086.524] GetCurrentThreadId () returned 0x970 [0086.524] GetCurrentThreadId () returned 0x970 [0086.524] GetCurrentThreadId () returned 0x970 [0086.524] GetCurrentThreadId () returned 0x970 [0086.524] GetCurrentThreadId () returned 0x970 [0086.524] GetCurrentThreadId () returned 0x970 [0086.525] GetCurrentThreadId () returned 0x970 [0086.525] GetCurrentThreadId () returned 0x970 [0086.525] GetCurrentThreadId () returned 0x970 [0086.525] GetCurrentThreadId () returned 0x970 [0086.525] GetCurrentThreadId () returned 0x970 [0086.525] GetCurrentThreadId () returned 0x970 [0086.525] GetCurrentThreadId () returned 0x970 [0086.525] GetCurrentThreadId () returned 0x970 [0086.525] GetCurrentThreadId () returned 0x970 [0086.525] GetCurrentThreadId () returned 0x970 [0086.525] GetCurrentThreadId () returned 0x970 [0086.525] GetCurrentThreadId () returned 0x970 [0086.525] GetCurrentThreadId () returned 0x970 [0086.525] GetCurrentThreadId () returned 0x970 [0086.525] GetCurrentThreadId () returned 0x970 [0086.525] GetCurrentThreadId () returned 0x970 [0086.525] GetCurrentThreadId () returned 0x970 [0086.525] GetCurrentThreadId () returned 0x970 [0086.525] GetCurrentThreadId () returned 0x970 [0086.525] GetCurrentThreadId () returned 0x970 [0086.525] GetCurrentThreadId () returned 0x970 [0086.525] GetCurrentThreadId () returned 0x970 [0086.525] GetCurrentThreadId () returned 0x970 [0086.525] GetCurrentThreadId () returned 0x970 [0086.525] GetCurrentThreadId () returned 0x970 [0086.525] GetCurrentThreadId () returned 0x970 [0086.525] GetCurrentThreadId () returned 0x970 [0086.525] GetCurrentThreadId () returned 0x970 [0086.525] GetCurrentThreadId () returned 0x970 [0086.525] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAGpqHxZas/5wY+tCRV23EZq2XPg1iz9tlvXKfL1b1vsHQjy/RRfPw51g6DRzzXqXHj48czqiTK+mgdGh5/A8PqIIya3Lmw2qeWkebIA1jW+/yF6hl8STQoFXSDCpwvUWPulagbgM3DWQbXOxaTxnyBJSi83cEqcx8ckYjH4npdubuwyYjV9pPADQPKVNqWNOVemyNvd3a7Tq/7RYyvBWsUA0Q2ESLSqdFA==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0086.525] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAGpqHxZas/5wY+tCRV23EZq2XPg1iz9tlvXKfL1b1vsHQjy/RRfPw51g6DRzzXqXHj48czqiTK+mgdGh5/A8PqIIya3Lmw2qeWkebIA1jW+/yF6hl8STQoFXSDCpwvUWPulagbgM3DWQbXOxaTxnyBJSi83cEqcx8ckYjH4npdubuwyYjV9pPADQPKVNqWNOVemyNvd3a7Tq/7RYyvBWsUA0Q2ESLSqdFA==", cchWideChar=245, lpMultiByteStr=0x3b4d08c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAGpqHxZas/5wY+tCRV23EZq2XPg1iz9tlvXKfL1b1vsHQjy/RRfPw51g6DRzzXqXHj48czqiTK+mgdGh5/A8PqIIya3Lmw2qeWkebIA1jW+/yF6hl8STQoFXSDCpwvUWPulagbgM3DWQbXOxaTxnyBJSi83cEqcx8ckYjH4npdubuwyYjV9pPADQPKVNqWNOVemyNvd3a7Tq/7RYyvBWsUA0Q2ESLSqdFA==", lpUsedDefaultChar=0x0) returned 245 [0086.525] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0086.525] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0086.526] CloseHandle (hObject=0x158) returned 1 [0086.526] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341554.jpg")) returned 1 [0086.527] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=20679021873) returned 1 [0086.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [J0341557.JPG].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [j0341557.jpg].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0086.528] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0086.528] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0086.528] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0086.528] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0086.528] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0086.528] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0086.528] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0086.528] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0086.528] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0086.528] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0086.528] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0086.529] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0086.529] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0086.529] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0086.529] SetEndOfFile (hFile=0x158) returned 1 [0086.529] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0086.529] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0086.529] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0086.529] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0086.529] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0086.530] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0086.530] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="mbBYkSrarm0vYMk6>>p\"}dK*Pl^~Fh8U", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0086.530] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="mbBYkSrarm0vYMk6>>p\"}dK*Pl^~Fh8U", cchWideChar=32, lpMultiByteStr=0x203c14c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mbBYkSrarm0vYMk6>>p\"}dK*Pl^~Fh8U", lpUsedDefaultChar=0x0) returned 32 [0086.530] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0086.530] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0086.530] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6aa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341557.JPG", cAlternateFileName="")) returned 0x295098 [0086.530] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0086.530] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0086.530] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341557.jpg")) returned 0x20 [0086.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341557.jpg")) returned 0x20 [0086.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341557.jpg")) returned 0x20 [0086.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341557.jpg")) returned 0x20 [0086.531] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341557.jpg"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6aa8)) returned 1 [0086.531] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0086.531] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0086.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341557.jpg")) returned 0x20 [0086.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341557.jpg")) returned 0x20 [0086.531] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0086.531] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0086.531] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0086.531] SetEndOfFile (hFile=0x158) returned 1 [0086.539] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341557.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.539] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341557.JPG", cchWideChar=12, lpMultiByteStr=0x1fe3c4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341557.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.539] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341557.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.539] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341557.JPG", cchWideChar=12, lpMultiByteStr=0x1fe432c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341557.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.539] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe432c, cbMultiByte=12, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="J0341557.JPGg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0086.539] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341557.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.539] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341557.JPG", cchWideChar=12, lpMultiByteStr=0x1fe3c4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341557.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341557.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0086.540] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0086.540] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x6aa8 [0086.540] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0086.540] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0086.540] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0086.540] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341557.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.540] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341557.JPG", cchWideChar=12, lpMultiByteStr=0x1fe3c4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341557.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.540] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341557.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.540] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341557.JPG", cchWideChar=12, lpMultiByteStr=0x1fe432c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341557.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.540] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe432c, cbMultiByte=12, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="J0341557.JPG57.JPGg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0086.540] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341557.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.540] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341557.JPG", cchWideChar=12, lpMultiByteStr=0x1fe3c4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341557.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.541] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0086.541] CharToOemA (in: pSrc="J0341557.JPG", pDst=0x1fe432c | out: pDst="J0341557.JPG") returned 1 [0086.541] WriteFile (in: hFile=0x158, lpBuffer=0x1fe432c*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe432c*, lpNumberOfBytesWritten=0x18e048*=0xc, lpOverlapped=0x0) returned 1 [0086.542] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0086.542] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0086.542] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0086.542] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=20680531804) returned 1 [0086.542] ReadFile (in: hFile=0x11c, lpBuffer=0x3b95a30, nNumberOfBytesToRead=0x6aa8, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b95a30*, lpNumberOfBytesRead=0x18dd7c*=0x6aa8, lpOverlapped=0x0) returned 1 [0086.544] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0086.544] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=20680725837) returned 1 [0086.554] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b3d8*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b5b3d8*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0086.555] ReadFile (in: hFile=0x11c, lpBuffer=0x3b95a30, nNumberOfBytesToRead=0x6aa8, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3b95a30*, lpNumberOfBytesRead=0x18de38*=0x6aa8, lpOverlapped=0x0) returned 1 [0086.556] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x47 [0086.556] WriteFile (in: hFile=0x158, lpBuffer=0x381b020*, nNumberOfBytesToWrite=0x6aa8, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x381b020*, lpNumberOfBytesWritten=0x18de10*=0x6aa8, lpOverlapped=0x0) returned 1 [0086.557] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x6aef [0086.557] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0086.557] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0086.557] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0086.557] SetFilePointer (in: hFile=0x158, lDistanceToMove=12, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2a [0086.557] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x6af9 [0086.557] CloseHandle (hObject=0x11c) returned 1 [0086.557] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x6af9 [0086.557] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x6af9 [0086.558] SetFilePointer (in: hFile=0x158, lDistanceToMove=27385, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x6af9 [0086.558] SetFilePointer (in: hFile=0x158, lDistanceToMove=27385, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x6af9 [0086.558] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x6af9 [0086.558] SetFilePointer (in: hFile=0x158, lDistanceToMove=27385, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x6af9 [0086.558] SetEndOfFile (hFile=0x158) returned 1 [0086.558] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x6af9 [0086.558] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x6af9 [0086.558] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341557.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.558] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341557.JPG", cchWideChar=12, lpMultiByteStr=0x1fe3c4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341557.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.558] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341557.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.558] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341557.JPG", cchWideChar=12, lpMultiByteStr=0x1fe3a2c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341557.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.558] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe3a2c, cbMultiByte=12, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="J0341557.JPGꞗ@涤(\x18믉`믑`") returned 12 [0086.558] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341557.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.559] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341557.JPG", cchWideChar=12, lpMultiByteStr=0x1fe3c4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341557.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.559] WriteFile (in: hFile=0x158, lpBuffer=0x37bea38*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x37bea38*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0086.559] CharToOemA (in: pSrc="J0341557.JPG", pDst=0x1fe3a2c | out: pDst="J0341557.JPG") returned 1 [0086.559] WriteFile (in: hFile=0x158, lpBuffer=0x1fe3a2c*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe3a2c*, lpNumberOfBytesWritten=0x18efcc*=0xc, lpOverlapped=0x0) returned 1 [0086.559] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b350*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x3b5b350*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0086.559] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0086.559] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0086.559] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x6b3e [0086.559] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x6b3e [0086.559] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0086.559] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0086.560] DeleteFileW (lpFileName="") returned 0 [0086.560] GetLastError () returned 0x3 [0086.560] GetFileAttributesW (lpFileName="") returned 0xffffffff [0086.560] SetLastError (dwErrCode=0x3) [0086.560] FlushFileBuffers (hFile=0x158) returned 1 [0086.564] GetCurrentThreadId () returned 0x970 [0086.564] GetCurrentThreadId () returned 0x970 [0086.564] GetCurrentThreadId () returned 0x970 [0086.564] GetCurrentThreadId () returned 0x970 [0086.564] GetCurrentThreadId () returned 0x970 [0086.564] GetCurrentThreadId () returned 0x970 [0086.564] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x6bf5 [0086.564] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x6bf5 [0086.564] SetFilePointer (in: hFile=0x158, lDistanceToMove=27637, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x6bf5 [0086.564] CloseHandle (hObject=0x158) returned 1 [0086.564] GetCurrentThreadId () returned 0x970 [0086.564] GetCurrentThreadId () returned 0x970 [0086.565] GetCurrentThreadId () returned 0x970 [0086.565] GetCurrentThreadId () returned 0x970 [0086.565] GetCurrentThreadId () returned 0x970 [0086.565] GetCurrentThreadId () returned 0x970 [0086.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [J0341557.JPG].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [j0341557.jpg].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0086.565] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6bf5 [0086.565] SetFilePointer (in: hFile=0x158, lDistanceToMove=27509, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6b75 [0086.565] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0086.565] GetFileType (hFile=0x158) returned 0x1 [0086.565] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x21, wMilliseconds=0x34a)) [0086.565] GetCurrentThreadId () returned 0x970 [0086.565] GetCurrentThreadId () returned 0x970 [0086.565] GetCurrentThreadId () returned 0x970 [0086.565] GetCurrentThreadId () returned 0x970 [0086.565] GetCurrentThreadId () returned 0x970 [0086.565] GetCurrentThreadId () returned 0x970 [0086.565] GetCurrentThreadId () returned 0x970 [0086.565] GetCurrentThreadId () returned 0x970 [0086.565] GetCurrentThreadId () returned 0x970 [0086.565] GetCurrentThreadId () returned 0x970 [0086.565] GetCurrentThreadId () returned 0x970 [0086.565] GetCurrentThreadId () returned 0x970 [0086.565] GetCurrentThreadId () returned 0x970 [0086.566] GetCurrentThreadId () returned 0x970 [0086.566] GetCurrentThreadId () returned 0x970 [0086.566] GetCurrentThreadId () returned 0x970 [0086.566] GetCurrentThreadId () returned 0x970 [0086.566] GetCurrentThreadId () returned 0x970 [0086.566] GetCurrentThreadId () returned 0x970 [0086.566] GetCurrentThreadId () returned 0x970 [0086.566] GetCurrentThreadId () returned 0x970 [0086.566] GetCurrentThreadId () returned 0x970 [0086.566] GetCurrentThreadId () returned 0x970 [0086.566] GetCurrentThreadId () returned 0x970 [0086.566] GetCurrentThreadId () returned 0x970 [0086.566] GetCurrentThreadId () returned 0x970 [0086.566] GetCurrentThreadId () returned 0x970 [0086.566] GetCurrentThreadId () returned 0x970 [0086.566] GetCurrentThreadId () returned 0x970 [0086.566] GetCurrentThreadId () returned 0x970 [0086.566] GetCurrentThreadId () returned 0x970 [0086.566] GetCurrentThreadId () returned 0x970 [0086.566] GetCurrentThreadId () returned 0x970 [0086.566] GetCurrentThreadId () returned 0x970 [0086.566] GetCurrentThreadId () returned 0x970 [0086.566] GetCurrentThreadId () returned 0x970 [0086.566] GetCurrentThreadId () returned 0x970 [0086.566] GetCurrentThreadId () returned 0x970 [0086.566] GetCurrentThreadId () returned 0x970 [0086.566] GetCurrentThreadId () returned 0x970 [0086.566] GetCurrentThreadId () returned 0x970 [0086.566] GetCurrentThreadId () returned 0x970 [0086.566] GetCurrentThreadId () returned 0x970 [0086.566] GetCurrentThreadId () returned 0x970 [0086.566] GetCurrentThreadId () returned 0x970 [0086.566] GetCurrentThreadId () returned 0x970 [0086.566] GetCurrentThreadId () returned 0x970 [0086.566] GetCurrentThreadId () returned 0x970 [0086.566] GetCurrentThreadId () returned 0x970 [0086.566] GetCurrentThreadId () returned 0x970 [0086.566] GetCurrentThreadId () returned 0x970 [0086.566] GetCurrentThreadId () returned 0x970 [0086.566] GetCurrentThreadId () returned 0x970 [0086.566] GetCurrentThreadId () returned 0x970 [0086.566] GetCurrentThreadId () returned 0x970 [0086.566] GetCurrentThreadId () returned 0x970 [0086.566] GetCurrentThreadId () returned 0x970 [0086.566] GetCurrentThreadId () returned 0x970 [0086.566] GetCurrentThreadId () returned 0x970 [0086.567] GetCurrentThreadId () returned 0x970 [0086.567] GetCurrentThreadId () returned 0x970 [0086.567] GetCurrentThreadId () returned 0x970 [0086.567] GetCurrentThreadId () returned 0x970 [0086.567] GetCurrentThreadId () returned 0x970 [0086.567] GetCurrentThreadId () returned 0x970 [0086.567] GetCurrentThreadId () returned 0x970 [0086.567] GetCurrentThreadId () returned 0x970 [0086.567] GetCurrentThreadId () returned 0x970 [0086.567] GetCurrentThreadId () returned 0x970 [0086.567] GetCurrentThreadId () returned 0x970 [0086.567] GetCurrentThreadId () returned 0x970 [0086.567] GetCurrentThreadId () returned 0x970 [0086.567] GetCurrentThreadId () returned 0x970 [0086.567] GetCurrentThreadId () returned 0x970 [0086.567] GetCurrentThreadId () returned 0x970 [0086.567] GetCurrentThreadId () returned 0x970 [0086.567] GetCurrentThreadId () returned 0x970 [0086.567] GetCurrentThreadId () returned 0x970 [0086.567] GetCurrentThreadId () returned 0x970 [0086.567] GetCurrentThreadId () returned 0x970 [0086.567] GetCurrentThreadId () returned 0x970 [0086.567] GetCurrentThreadId () returned 0x970 [0086.567] GetCurrentThreadId () returned 0x970 [0086.567] GetCurrentThreadId () returned 0x970 [0086.567] GetCurrentThreadId () returned 0x970 [0086.567] GetCurrentThreadId () returned 0x970 [0086.567] GetCurrentThreadId () returned 0x970 [0086.567] GetCurrentThreadId () returned 0x970 [0086.567] GetCurrentThreadId () returned 0x970 [0086.567] GetCurrentThreadId () returned 0x970 [0086.567] GetCurrentThreadId () returned 0x970 [0086.567] GetCurrentThreadId () returned 0x970 [0086.567] GetCurrentThreadId () returned 0x970 [0086.567] GetCurrentThreadId () returned 0x970 [0086.567] GetCurrentThreadId () returned 0x970 [0086.567] GetCurrentThreadId () returned 0x970 [0086.567] GetCurrentThreadId () returned 0x970 [0086.567] GetCurrentThreadId () returned 0x970 [0086.567] GetCurrentThreadId () returned 0x970 [0086.567] GetCurrentThreadId () returned 0x970 [0086.567] GetCurrentThreadId () returned 0x970 [0086.567] GetCurrentThreadId () returned 0x970 [0086.567] GetCurrentThreadId () returned 0x970 [0086.568] GetCurrentThreadId () returned 0x970 [0086.568] GetCurrentThreadId () returned 0x970 [0086.568] GetCurrentThreadId () returned 0x970 [0086.568] GetCurrentThreadId () returned 0x970 [0086.568] GetCurrentThreadId () returned 0x970 [0086.568] GetCurrentThreadId () returned 0x970 [0086.568] GetCurrentThreadId () returned 0x970 [0086.568] GetCurrentThreadId () returned 0x970 [0086.568] GetCurrentThreadId () returned 0x970 [0086.568] GetCurrentThreadId () returned 0x970 [0086.568] GetCurrentThreadId () returned 0x970 [0086.568] GetCurrentThreadId () returned 0x970 [0086.568] GetCurrentThreadId () returned 0x970 [0086.568] GetCurrentThreadId () returned 0x970 [0086.568] GetCurrentThreadId () returned 0x970 [0086.568] GetCurrentThreadId () returned 0x970 [0086.568] GetCurrentThreadId () returned 0x970 [0086.568] GetCurrentThreadId () returned 0x970 [0086.568] GetCurrentThreadId () returned 0x970 [0086.568] GetCurrentThreadId () returned 0x970 [0086.568] GetCurrentThreadId () returned 0x970 [0086.568] GetCurrentThreadId () returned 0x970 [0086.568] GetCurrentThreadId () returned 0x970 [0086.568] GetCurrentThreadId () returned 0x970 [0086.568] GetCurrentThreadId () returned 0x970 [0086.568] GetCurrentThreadId () returned 0x970 [0086.568] GetCurrentThreadId () returned 0x970 [0086.568] GetCurrentThreadId () returned 0x970 [0086.568] GetCurrentThreadId () returned 0x970 [0086.568] GetCurrentThreadId () returned 0x970 [0086.568] GetCurrentThreadId () returned 0x970 [0086.568] GetCurrentThreadId () returned 0x970 [0086.568] GetCurrentThreadId () returned 0x970 [0086.568] GetCurrentThreadId () returned 0x970 [0086.568] GetCurrentThreadId () returned 0x970 [0086.568] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.568] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.568] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5ead0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0086.568] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.568] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.569] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5ead0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0086.569] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.569] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.569] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b548, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0086.569] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.569] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.569] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b548, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0086.569] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.569] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.569] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5eb30, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0086.569] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.569] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.569] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5eb30, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0086.569] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.569] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.569] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5eb30, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0086.569] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x21, wMilliseconds=0x34a)) [0086.569] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="mbBYkSrarm0vYMk6>>p\"}dK*Pl^~Fh8U", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0086.569] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="mbBYkSrarm0vYMk6>>p\"}dK*Pl^~Fh8U", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0086.569] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="mbBYkSrarm0vYMk6>>p\"}dK*Pl^~Fh8U", cchWideChar=32, lpMultiByteStr=0x3b56378, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mbBYkSrarm0vYMk6>>p\"}dK*Pl^~Fh8U", lpUsedDefaultChar=0x0) returned 32 [0086.569] GetCurrentThreadId () returned 0x970 [0086.569] GetCurrentThreadId () returned 0x970 [0086.569] GetCurrentThreadId () returned 0x970 [0086.569] GetCurrentThreadId () returned 0x970 [0086.569] GetCurrentThreadId () returned 0x970 [0086.569] GetCurrentThreadId () returned 0x970 [0086.577] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0086.577] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0086.577] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3b86e68, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0086.577] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0086.577] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAD2fmYdOHBNf+ZUuhpAHhqtDq9jOkdjCGd8e49U1xTPrN4dgsuMsP8G5TwJ4iNCw6I+UWeDyTD37rZVkZEltDDO6AnyB8uu0gygA3k+GX1SlJX1vs9fJNoSo3fwh4vrBvweAxQqErIvYNCfm0U8UIKMYg13EP/jdahQfclITXOvFyKyjLPMnjHl8XXuFOWh3NphZR3cILYtS6154AhgoFjoLnh3zFKKncg==") returned 232 [0086.577] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x21, wMilliseconds=0x34a)) [0086.577] GetCurrentThreadId () returned 0x970 [0086.577] GetCurrentThreadId () returned 0x970 [0086.577] GetCurrentThreadId () returned 0x970 [0086.577] GetCurrentThreadId () returned 0x970 [0086.577] GetCurrentThreadId () returned 0x970 [0086.577] GetCurrentThreadId () returned 0x970 [0086.578] GetCurrentThreadId () returned 0x970 [0086.578] GetCurrentThreadId () returned 0x970 [0086.578] GetCurrentThreadId () returned 0x970 [0086.578] GetCurrentThreadId () returned 0x970 [0086.578] GetCurrentThreadId () returned 0x970 [0086.578] GetCurrentThreadId () returned 0x970 [0086.578] GetCurrentThreadId () returned 0x970 [0086.578] GetCurrentThreadId () returned 0x970 [0086.578] GetCurrentThreadId () returned 0x970 [0086.578] GetCurrentThreadId () returned 0x970 [0086.578] GetCurrentThreadId () returned 0x970 [0086.578] GetCurrentThreadId () returned 0x970 [0086.578] GetCurrentThreadId () returned 0x970 [0086.578] GetCurrentThreadId () returned 0x970 [0086.578] GetCurrentThreadId () returned 0x970 [0086.578] GetCurrentThreadId () returned 0x970 [0086.578] GetCurrentThreadId () returned 0x970 [0086.578] GetCurrentThreadId () returned 0x970 [0086.578] GetCurrentThreadId () returned 0x970 [0086.578] GetCurrentThreadId () returned 0x970 [0086.578] GetCurrentThreadId () returned 0x970 [0086.578] GetCurrentThreadId () returned 0x970 [0086.578] GetCurrentThreadId () returned 0x970 [0086.578] GetCurrentThreadId () returned 0x970 [0086.578] GetCurrentThreadId () returned 0x970 [0086.578] GetCurrentThreadId () returned 0x970 [0086.578] GetCurrentThreadId () returned 0x970 [0086.578] GetCurrentThreadId () returned 0x970 [0086.578] GetCurrentThreadId () returned 0x970 [0086.578] GetCurrentThreadId () returned 0x970 [0086.578] GetCurrentThreadId () returned 0x970 [0086.578] GetCurrentThreadId () returned 0x970 [0086.578] GetCurrentThreadId () returned 0x970 [0086.578] GetCurrentThreadId () returned 0x970 [0086.578] GetCurrentThreadId () returned 0x970 [0086.579] GetCurrentThreadId () returned 0x970 [0086.579] GetCurrentThreadId () returned 0x970 [0086.579] GetCurrentThreadId () returned 0x970 [0086.579] GetCurrentThreadId () returned 0x970 [0086.579] GetCurrentThreadId () returned 0x970 [0086.579] GetCurrentThreadId () returned 0x970 [0086.579] GetCurrentThreadId () returned 0x970 [0086.579] GetCurrentThreadId () returned 0x970 [0086.579] GetCurrentThreadId () returned 0x970 [0086.579] GetCurrentThreadId () returned 0x970 [0086.579] GetCurrentThreadId () returned 0x970 [0086.579] GetCurrentThreadId () returned 0x970 [0086.579] GetCurrentThreadId () returned 0x970 [0086.579] GetCurrentThreadId () returned 0x970 [0086.579] GetCurrentThreadId () returned 0x970 [0086.579] GetCurrentThreadId () returned 0x970 [0086.579] GetCurrentThreadId () returned 0x970 [0086.579] GetCurrentThreadId () returned 0x970 [0086.579] GetCurrentThreadId () returned 0x970 [0086.579] GetCurrentThreadId () returned 0x970 [0086.579] GetCurrentThreadId () returned 0x970 [0086.579] GetCurrentThreadId () returned 0x970 [0086.579] GetCurrentThreadId () returned 0x970 [0086.579] GetCurrentThreadId () returned 0x970 [0086.579] GetCurrentThreadId () returned 0x970 [0086.579] GetCurrentThreadId () returned 0x970 [0086.579] GetCurrentThreadId () returned 0x970 [0086.579] GetCurrentThreadId () returned 0x970 [0086.579] GetCurrentThreadId () returned 0x970 [0086.579] GetCurrentThreadId () returned 0x970 [0086.579] GetCurrentThreadId () returned 0x970 [0086.579] GetCurrentThreadId () returned 0x970 [0086.579] GetCurrentThreadId () returned 0x970 [0086.579] GetCurrentThreadId () returned 0x970 [0086.579] GetCurrentThreadId () returned 0x970 [0086.579] GetCurrentThreadId () returned 0x970 [0086.579] GetCurrentThreadId () returned 0x970 [0086.579] GetCurrentThreadId () returned 0x970 [0086.579] GetCurrentThreadId () returned 0x970 [0086.579] GetCurrentThreadId () returned 0x970 [0086.579] GetCurrentThreadId () returned 0x970 [0086.579] GetCurrentThreadId () returned 0x970 [0086.580] GetCurrentThreadId () returned 0x970 [0086.580] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAD2fmYdOHBNf+ZUuhpAHhqtDq9jOkdjCGd8e49U1xTPrN4dgsuMsP8G5TwJ4iNCw6I+UWeDyTD37rZVkZEltDDO6AnyB8uu0gygA3k+GX1SlJX1vs9fJNoSo3fwh4vrBvweAxQqErIvYNCfm0U8UIKMYg13EP/jdahQfclITXOvFyKyjLPMnjHl8XXuFOWh3NphZR3cILYtS6154AhgoFjoLnh3zFKKncg==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0086.580] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAD2fmYdOHBNf+ZUuhpAHhqtDq9jOkdjCGd8e49U1xTPrN4dgsuMsP8G5TwJ4iNCw6I+UWeDyTD37rZVkZEltDDO6AnyB8uu0gygA3k+GX1SlJX1vs9fJNoSo3fwh4vrBvweAxQqErIvYNCfm0U8UIKMYg13EP/jdahQfclITXOvFyKyjLPMnjHl8XXuFOWh3NphZR3cILYtS6154AhgoFjoLnh3zFKKncg==", cchWideChar=245, lpMultiByteStr=0x3b4d08c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAD2fmYdOHBNf+ZUuhpAHhqtDq9jOkdjCGd8e49U1xTPrN4dgsuMsP8G5TwJ4iNCw6I+UWeDyTD37rZVkZEltDDO6AnyB8uu0gygA3k+GX1SlJX1vs9fJNoSo3fwh4vrBvweAxQqErIvYNCfm0U8UIKMYg13EP/jdahQfclITXOvFyKyjLPMnjHl8XXuFOWh3NphZR3cILYtS6154AhgoFjoLnh3zFKKncg==", lpUsedDefaultChar=0x0) returned 245 [0086.580] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0086.580] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0086.580] CloseHandle (hObject=0x158) returned 1 [0086.580] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341557.jpg")) returned 1 [0086.581] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=20684458692) returned 1 [0086.581] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [J0341559.JPG].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [j0341559.jpg].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0086.582] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0086.582] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0086.582] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0086.582] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0086.582] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0086.582] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0086.582] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0086.582] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0086.582] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0086.582] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0086.583] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0086.583] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0086.583] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0086.583] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0086.583] SetEndOfFile (hFile=0x158) returned 1 [0086.583] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0086.583] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0086.583] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0086.583] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0086.583] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0086.584] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0086.584] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="9rcrobQgD^P@+@arQI3b-nJw-&sZRN\":", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0086.584] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="9rcrobQgD^P@+@arQI3b-nJw-&sZRN\":", cchWideChar=32, lpMultiByteStr=0x203c184, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="9rcrobQgD^P@+@arQI3b-nJw-&sZRN\":", lpUsedDefaultChar=0x0) returned 32 [0086.584] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0086.584] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0086.584] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6873, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0341559.JPG", cAlternateFileName="")) returned 0x295098 [0086.584] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0086.584] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0086.584] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341559.jpg")) returned 0x20 [0086.585] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341559.jpg")) returned 0x20 [0086.585] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341559.jpg")) returned 0x20 [0086.585] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341559.jpg")) returned 0x20 [0086.585] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341559.jpg"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6873)) returned 1 [0086.585] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0086.585] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0086.585] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341559.jpg")) returned 0x20 [0086.585] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341559.jpg")) returned 0x20 [0086.585] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0086.585] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0086.585] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0086.585] SetEndOfFile (hFile=0x158) returned 1 [0086.586] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341559.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.586] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341559.JPG", cchWideChar=12, lpMultiByteStr=0x1fe37ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341559.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.586] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341559.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.586] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341559.JPG", cchWideChar=12, lpMultiByteStr=0x1fe358c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341559.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.586] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe358c, cbMultiByte=12, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="J0341559.JPGg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0086.586] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341559.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.586] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341559.JPG", cchWideChar=12, lpMultiByteStr=0x1fe37ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341559.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341559.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0086.587] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0086.587] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x6873 [0086.587] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0086.587] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0086.587] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0086.587] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341559.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.587] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341559.JPG", cchWideChar=12, lpMultiByteStr=0x1fe37ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341559.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.587] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341559.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.587] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341559.JPG", cchWideChar=12, lpMultiByteStr=0x1fe358c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341559.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.587] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe358c, cbMultiByte=12, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="J0341559.JPG59.JPGg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0086.587] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341559.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.587] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341559.JPG", cchWideChar=12, lpMultiByteStr=0x1fe37ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341559.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.588] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0086.588] CharToOemA (in: pSrc="J0341559.JPG", pDst=0x1fe358c | out: pDst="J0341559.JPG") returned 1 [0086.588] WriteFile (in: hFile=0x158, lpBuffer=0x1fe358c*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe358c*, lpNumberOfBytesWritten=0x18e048*=0xc, lpOverlapped=0x0) returned 1 [0086.589] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0086.589] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0086.589] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0086.589] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=20685226625) returned 1 [0086.589] ReadFile (in: hFile=0x11c, lpBuffer=0x3b95a30, nNumberOfBytesToRead=0x6873, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b95a30*, lpNumberOfBytesRead=0x18dd7c*=0x6873, lpOverlapped=0x0) returned 1 [0086.591] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0086.591] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=20685429406) returned 1 [0086.600] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b3c0*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b5b3c0*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0086.600] ReadFile (in: hFile=0x11c, lpBuffer=0x3b95a30, nNumberOfBytesToRead=0x6873, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3b95a30*, lpNumberOfBytesRead=0x18de38*=0x6873, lpOverlapped=0x0) returned 1 [0086.601] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x47 [0086.601] WriteFile (in: hFile=0x158, lpBuffer=0x381b020*, nNumberOfBytesToWrite=0x6873, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x381b020*, lpNumberOfBytesWritten=0x18de10*=0x6873, lpOverlapped=0x0) returned 1 [0086.602] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x68ba [0086.602] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0086.602] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0086.602] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0086.602] SetFilePointer (in: hFile=0x158, lDistanceToMove=12, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2a [0086.602] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x68c4 [0086.602] CloseHandle (hObject=0x11c) returned 1 [0086.602] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x68c4 [0086.602] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x68c4 [0086.602] SetFilePointer (in: hFile=0x158, lDistanceToMove=26820, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x68c4 [0086.602] SetFilePointer (in: hFile=0x158, lDistanceToMove=26820, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x68c4 [0086.602] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x68c4 [0086.602] SetFilePointer (in: hFile=0x158, lDistanceToMove=26820, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x68c4 [0086.603] SetEndOfFile (hFile=0x158) returned 1 [0086.603] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x68c4 [0086.603] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x68c4 [0086.603] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341559.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.603] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341559.JPG", cchWideChar=12, lpMultiByteStr=0x1fe37ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341559.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.603] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341559.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.603] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341559.JPG", cchWideChar=12, lpMultiByteStr=0x1fe43ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341559.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.603] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe43ac, cbMultiByte=12, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="J0341559.JPGꞗ@涤(\x18믉`믑`") returned 12 [0086.603] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341559.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.603] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341559.JPG", cchWideChar=12, lpMultiByteStr=0x1fe37ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0341559.JPG", lpUsedDefaultChar=0x0) returned 12 [0086.603] WriteFile (in: hFile=0x158, lpBuffer=0x37bea38*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x37bea38*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0086.603] CharToOemA (in: pSrc="J0341559.JPG", pDst=0x1fe43ac | out: pDst="J0341559.JPG") returned 1 [0086.603] WriteFile (in: hFile=0x158, lpBuffer=0x1fe43ac*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe43ac*, lpNumberOfBytesWritten=0x18efcc*=0xc, lpOverlapped=0x0) returned 1 [0086.603] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b3b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x3b5b3b0*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0086.603] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0086.604] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0086.604] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x6909 [0086.604] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x6909 [0086.604] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0086.604] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0086.604] DeleteFileW (lpFileName="") returned 0 [0086.604] GetLastError () returned 0x3 [0086.604] GetFileAttributesW (lpFileName="") returned 0xffffffff [0086.604] SetLastError (dwErrCode=0x3) [0086.604] FlushFileBuffers (hFile=0x158) returned 1 [0086.607] GetCurrentThreadId () returned 0x970 [0086.607] GetCurrentThreadId () returned 0x970 [0086.607] GetCurrentThreadId () returned 0x970 [0086.607] GetCurrentThreadId () returned 0x970 [0086.607] GetCurrentThreadId () returned 0x970 [0086.607] GetCurrentThreadId () returned 0x970 [0086.607] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x69c0 [0086.607] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x69c0 [0086.607] SetFilePointer (in: hFile=0x158, lDistanceToMove=27072, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x69c0 [0086.607] CloseHandle (hObject=0x158) returned 1 [0086.608] GetCurrentThreadId () returned 0x970 [0086.608] GetCurrentThreadId () returned 0x970 [0086.608] GetCurrentThreadId () returned 0x970 [0086.608] GetCurrentThreadId () returned 0x970 [0086.608] GetCurrentThreadId () returned 0x970 [0086.608] GetCurrentThreadId () returned 0x970 [0086.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [J0341559.JPG].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [j0341559.jpg].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0086.608] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x69c0 [0086.608] SetFilePointer (in: hFile=0x158, lDistanceToMove=26944, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6940 [0086.608] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0086.608] GetFileType (hFile=0x158) returned 0x1 [0086.608] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x21, wMilliseconds=0x369)) [0086.608] GetCurrentThreadId () returned 0x970 [0086.608] GetCurrentThreadId () returned 0x970 [0086.608] GetCurrentThreadId () returned 0x970 [0086.608] GetCurrentThreadId () returned 0x970 [0086.608] GetCurrentThreadId () returned 0x970 [0086.608] GetCurrentThreadId () returned 0x970 [0086.608] GetCurrentThreadId () returned 0x970 [0086.608] GetCurrentThreadId () returned 0x970 [0086.608] GetCurrentThreadId () returned 0x970 [0086.608] GetCurrentThreadId () returned 0x970 [0086.608] GetCurrentThreadId () returned 0x970 [0086.608] GetCurrentThreadId () returned 0x970 [0086.608] GetCurrentThreadId () returned 0x970 [0086.608] GetCurrentThreadId () returned 0x970 [0086.608] GetCurrentThreadId () returned 0x970 [0086.609] GetCurrentThreadId () returned 0x970 [0086.609] GetCurrentThreadId () returned 0x970 [0086.609] GetCurrentThreadId () returned 0x970 [0086.609] GetCurrentThreadId () returned 0x970 [0086.609] GetCurrentThreadId () returned 0x970 [0086.609] GetCurrentThreadId () returned 0x970 [0086.609] GetCurrentThreadId () returned 0x970 [0086.609] GetCurrentThreadId () returned 0x970 [0086.609] GetCurrentThreadId () returned 0x970 [0086.609] GetCurrentThreadId () returned 0x970 [0086.609] GetCurrentThreadId () returned 0x970 [0086.609] GetCurrentThreadId () returned 0x970 [0086.609] GetCurrentThreadId () returned 0x970 [0086.609] GetCurrentThreadId () returned 0x970 [0086.609] GetCurrentThreadId () returned 0x970 [0086.609] GetCurrentThreadId () returned 0x970 [0086.609] GetCurrentThreadId () returned 0x970 [0086.609] GetCurrentThreadId () returned 0x970 [0086.609] GetCurrentThreadId () returned 0x970 [0086.609] GetCurrentThreadId () returned 0x970 [0086.609] GetCurrentThreadId () returned 0x970 [0086.609] GetCurrentThreadId () returned 0x970 [0086.609] GetCurrentThreadId () returned 0x970 [0086.609] GetCurrentThreadId () returned 0x970 [0086.609] GetCurrentThreadId () returned 0x970 [0086.609] GetCurrentThreadId () returned 0x970 [0086.609] GetCurrentThreadId () returned 0x970 [0086.609] GetCurrentThreadId () returned 0x970 [0086.609] GetCurrentThreadId () returned 0x970 [0086.609] GetCurrentThreadId () returned 0x970 [0086.609] GetCurrentThreadId () returned 0x970 [0086.609] GetCurrentThreadId () returned 0x970 [0086.609] GetCurrentThreadId () returned 0x970 [0086.609] GetCurrentThreadId () returned 0x970 [0086.609] GetCurrentThreadId () returned 0x970 [0086.609] GetCurrentThreadId () returned 0x970 [0086.609] GetCurrentThreadId () returned 0x970 [0086.609] GetCurrentThreadId () returned 0x970 [0086.610] GetCurrentThreadId () returned 0x970 [0086.610] GetCurrentThreadId () returned 0x970 [0086.610] GetCurrentThreadId () returned 0x970 [0086.610] GetCurrentThreadId () returned 0x970 [0086.610] GetCurrentThreadId () returned 0x970 [0086.610] GetCurrentThreadId () returned 0x970 [0086.610] GetCurrentThreadId () returned 0x970 [0086.610] GetCurrentThreadId () returned 0x970 [0086.610] GetCurrentThreadId () returned 0x970 [0086.610] GetCurrentThreadId () returned 0x970 [0086.610] GetCurrentThreadId () returned 0x970 [0086.610] GetCurrentThreadId () returned 0x970 [0086.610] GetCurrentThreadId () returned 0x970 [0086.610] GetCurrentThreadId () returned 0x970 [0086.610] GetCurrentThreadId () returned 0x970 [0086.610] GetCurrentThreadId () returned 0x970 [0086.610] GetCurrentThreadId () returned 0x970 [0086.610] GetCurrentThreadId () returned 0x970 [0086.610] GetCurrentThreadId () returned 0x970 [0086.610] GetCurrentThreadId () returned 0x970 [0086.610] GetCurrentThreadId () returned 0x970 [0086.610] GetCurrentThreadId () returned 0x970 [0086.610] GetCurrentThreadId () returned 0x970 [0086.610] GetCurrentThreadId () returned 0x970 [0086.610] GetCurrentThreadId () returned 0x970 [0086.610] GetCurrentThreadId () returned 0x970 [0086.610] GetCurrentThreadId () returned 0x970 [0086.610] GetCurrentThreadId () returned 0x970 [0086.610] GetCurrentThreadId () returned 0x970 [0086.610] GetCurrentThreadId () returned 0x970 [0086.610] GetCurrentThreadId () returned 0x970 [0086.610] GetCurrentThreadId () returned 0x970 [0086.610] GetCurrentThreadId () returned 0x970 [0086.610] GetCurrentThreadId () returned 0x970 [0086.610] GetCurrentThreadId () returned 0x970 [0086.610] GetCurrentThreadId () returned 0x970 [0086.610] GetCurrentThreadId () returned 0x970 [0086.610] GetCurrentThreadId () returned 0x970 [0086.610] GetCurrentThreadId () returned 0x970 [0086.610] GetCurrentThreadId () returned 0x970 [0086.610] GetCurrentThreadId () returned 0x970 [0086.610] GetCurrentThreadId () returned 0x970 [0086.611] GetCurrentThreadId () returned 0x970 [0086.611] GetCurrentThreadId () returned 0x970 [0086.611] GetCurrentThreadId () returned 0x970 [0086.611] GetCurrentThreadId () returned 0x970 [0086.611] GetCurrentThreadId () returned 0x970 [0086.611] GetCurrentThreadId () returned 0x970 [0086.611] GetCurrentThreadId () returned 0x970 [0086.611] GetCurrentThreadId () returned 0x970 [0086.611] GetCurrentThreadId () returned 0x970 [0086.611] GetCurrentThreadId () returned 0x970 [0086.611] GetCurrentThreadId () returned 0x970 [0086.611] GetCurrentThreadId () returned 0x970 [0086.611] GetCurrentThreadId () returned 0x970 [0086.611] GetCurrentThreadId () returned 0x970 [0086.611] GetCurrentThreadId () returned 0x970 [0086.611] GetCurrentThreadId () returned 0x970 [0086.611] GetCurrentThreadId () returned 0x970 [0086.611] GetCurrentThreadId () returned 0x970 [0086.611] GetCurrentThreadId () returned 0x970 [0086.611] GetCurrentThreadId () returned 0x970 [0086.611] GetCurrentThreadId () returned 0x970 [0086.611] GetCurrentThreadId () returned 0x970 [0086.611] GetCurrentThreadId () returned 0x970 [0086.611] GetCurrentThreadId () returned 0x970 [0086.611] GetCurrentThreadId () returned 0x970 [0086.611] GetCurrentThreadId () returned 0x970 [0086.611] GetCurrentThreadId () returned 0x970 [0086.611] GetCurrentThreadId () returned 0x970 [0086.611] GetCurrentThreadId () returned 0x970 [0086.611] GetCurrentThreadId () returned 0x970 [0086.611] GetCurrentThreadId () returned 0x970 [0086.611] GetCurrentThreadId () returned 0x970 [0086.611] GetCurrentThreadId () returned 0x970 [0086.611] GetCurrentThreadId () returned 0x970 [0086.611] GetCurrentThreadId () returned 0x970 [0086.611] GetCurrentThreadId () returned 0x970 [0086.611] GetCurrentThreadId () returned 0x970 [0086.611] GetCurrentThreadId () returned 0x970 [0086.611] GetCurrentThreadId () returned 0x970 [0086.611] GetCurrentThreadId () returned 0x970 [0086.611] GetCurrentThreadId () returned 0x970 [0086.612] GetCurrentThreadId () returned 0x970 [0086.612] GetCurrentThreadId () returned 0x970 [0086.612] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.612] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.612] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5eb30, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0086.612] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.612] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.612] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5eb30, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0086.612] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.612] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.612] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b530, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0086.612] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.612] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.612] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b530, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0086.612] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.612] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.612] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5eb90, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0086.612] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.612] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.612] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5eb90, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0086.612] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.612] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0086.612] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5eb90, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0086.612] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x21, wMilliseconds=0x378)) [0086.612] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="9rcrobQgD^P@+@arQI3b-nJw-&sZRN\":", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0086.612] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="9rcrobQgD^P@+@arQI3b-nJw-&sZRN\":", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0086.612] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="9rcrobQgD^P@+@arQI3b-nJw-&sZRN\":", cchWideChar=32, lpMultiByteStr=0x3b563a8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="9rcrobQgD^P@+@arQI3b-nJw-&sZRN\":", lpUsedDefaultChar=0x0) returned 32 [0086.612] GetCurrentThreadId () returned 0x970 [0086.613] GetCurrentThreadId () returned 0x970 [0086.613] GetCurrentThreadId () returned 0x970 [0086.613] GetCurrentThreadId () returned 0x970 [0086.613] GetCurrentThreadId () returned 0x970 [0086.613] GetCurrentThreadId () returned 0x970 [0086.620] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0086.620] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0086.620] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3b86f58, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0086.620] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0086.620] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAHOJXxcv1JX81sjkwYCktb/EhzcHurN3rcXpriWXeIwu3mXzQ0LuGZ19PLDaUGIwgtU7keLbJRhMuh89m3ysaOpPSR+gA4TKcLUpRRF+5mFJXPAwX59eq4c4pqlSblv2XDseBWasNsnkHZRESlYKYMlX2tf8QheBNUs8Lrf3yLnPEvXbM+c1kKVlKi+xnrAcBoOg8yE/0b0rrgEXOBFAjZYaViSVa78AxA==") returned 232 [0086.620] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x21, wMilliseconds=0x378)) [0086.620] GetCurrentThreadId () returned 0x970 [0086.620] GetCurrentThreadId () returned 0x970 [0086.620] GetCurrentThreadId () returned 0x970 [0086.620] GetCurrentThreadId () returned 0x970 [0086.620] GetCurrentThreadId () returned 0x970 [0086.620] GetCurrentThreadId () returned 0x970 [0086.620] GetCurrentThreadId () returned 0x970 [0086.620] GetCurrentThreadId () returned 0x970 [0086.620] GetCurrentThreadId () returned 0x970 [0086.620] GetCurrentThreadId () returned 0x970 [0086.621] GetCurrentThreadId () returned 0x970 [0086.621] GetCurrentThreadId () returned 0x970 [0086.621] GetCurrentThreadId () returned 0x970 [0086.621] GetCurrentThreadId () returned 0x970 [0086.621] GetCurrentThreadId () returned 0x970 [0086.621] GetCurrentThreadId () returned 0x970 [0086.621] GetCurrentThreadId () returned 0x970 [0086.621] GetCurrentThreadId () returned 0x970 [0086.621] GetCurrentThreadId () returned 0x970 [0086.621] GetCurrentThreadId () returned 0x970 [0086.621] GetCurrentThreadId () returned 0x970 [0086.621] GetCurrentThreadId () returned 0x970 [0086.621] GetCurrentThreadId () returned 0x970 [0086.621] GetCurrentThreadId () returned 0x970 [0086.621] GetCurrentThreadId () returned 0x970 [0086.621] GetCurrentThreadId () returned 0x970 [0086.621] GetCurrentThreadId () returned 0x970 [0086.621] GetCurrentThreadId () returned 0x970 [0086.621] GetCurrentThreadId () returned 0x970 [0086.621] GetCurrentThreadId () returned 0x970 [0086.621] GetCurrentThreadId () returned 0x970 [0086.621] GetCurrentThreadId () returned 0x970 [0086.621] GetCurrentThreadId () returned 0x970 [0086.621] GetCurrentThreadId () returned 0x970 [0086.621] GetCurrentThreadId () returned 0x970 [0086.621] GetCurrentThreadId () returned 0x970 [0086.621] GetCurrentThreadId () returned 0x970 [0086.621] GetCurrentThreadId () returned 0x970 [0086.621] GetCurrentThreadId () returned 0x970 [0086.621] GetCurrentThreadId () returned 0x970 [0086.621] GetCurrentThreadId () returned 0x970 [0086.621] GetCurrentThreadId () returned 0x970 [0086.621] GetCurrentThreadId () returned 0x970 [0086.621] GetCurrentThreadId () returned 0x970 [0086.621] GetCurrentThreadId () returned 0x970 [0086.621] GetCurrentThreadId () returned 0x970 [0086.621] GetCurrentThreadId () returned 0x970 [0086.621] GetCurrentThreadId () returned 0x970 [0086.621] GetCurrentThreadId () returned 0x970 [0086.621] GetCurrentThreadId () returned 0x970 [0086.621] GetCurrentThreadId () returned 0x970 [0086.622] GetCurrentThreadId () returned 0x970 [0086.622] GetCurrentThreadId () returned 0x970 [0086.622] GetCurrentThreadId () returned 0x970 [0086.622] GetCurrentThreadId () returned 0x970 [0086.622] GetCurrentThreadId () returned 0x970 [0086.622] GetCurrentThreadId () returned 0x970 [0086.622] GetCurrentThreadId () returned 0x970 [0086.622] GetCurrentThreadId () returned 0x970 [0086.622] GetCurrentThreadId () returned 0x970 [0086.622] GetCurrentThreadId () returned 0x970 [0086.622] GetCurrentThreadId () returned 0x970 [0086.622] GetCurrentThreadId () returned 0x970 [0086.622] GetCurrentThreadId () returned 0x970 [0086.622] GetCurrentThreadId () returned 0x970 [0086.622] GetCurrentThreadId () returned 0x970 [0086.622] GetCurrentThreadId () returned 0x970 [0086.622] GetCurrentThreadId () returned 0x970 [0086.622] GetCurrentThreadId () returned 0x970 [0086.622] GetCurrentThreadId () returned 0x970 [0086.622] GetCurrentThreadId () returned 0x970 [0086.622] GetCurrentThreadId () returned 0x970 [0086.622] GetCurrentThreadId () returned 0x970 [0086.622] GetCurrentThreadId () returned 0x970 [0086.622] GetCurrentThreadId () returned 0x970 [0086.622] GetCurrentThreadId () returned 0x970 [0086.622] GetCurrentThreadId () returned 0x970 [0086.622] GetCurrentThreadId () returned 0x970 [0086.622] GetCurrentThreadId () returned 0x970 [0086.622] GetCurrentThreadId () returned 0x970 [0086.622] GetCurrentThreadId () returned 0x970 [0086.622] GetCurrentThreadId () returned 0x970 [0086.622] GetCurrentThreadId () returned 0x970 [0086.622] GetCurrentThreadId () returned 0x970 [0086.622] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAHOJXxcv1JX81sjkwYCktb/EhzcHurN3rcXpriWXeIwu3mXzQ0LuGZ19PLDaUGIwgtU7keLbJRhMuh89m3ysaOpPSR+gA4TKcLUpRRF+5mFJXPAwX59eq4c4pqlSblv2XDseBWasNsnkHZRESlYKYMlX2tf8QheBNUs8Lrf3yLnPEvXbM+c1kKVlKi+xnrAcBoOg8yE/0b0rrgEXOBFAjZYaViSVa78AxA==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0086.622] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAHOJXxcv1JX81sjkwYCktb/EhzcHurN3rcXpriWXeIwu3mXzQ0LuGZ19PLDaUGIwgtU7keLbJRhMuh89m3ysaOpPSR+gA4TKcLUpRRF+5mFJXPAwX59eq4c4pqlSblv2XDseBWasNsnkHZRESlYKYMlX2tf8QheBNUs8Lrf3yLnPEvXbM+c1kKVlKi+xnrAcBoOg8yE/0b0rrgEXOBFAjZYaViSVa78AxA==", cchWideChar=245, lpMultiByteStr=0x3b4d08c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAHOJXxcv1JX81sjkwYCktb/EhzcHurN3rcXpriWXeIwu3mXzQ0LuGZ19PLDaUGIwgtU7keLbJRhMuh89m3ysaOpPSR+gA4TKcLUpRRF+5mFJXPAwX59eq4c4pqlSblv2XDseBWasNsnkHZRESlYKYMlX2tf8QheBNUs8Lrf3yLnPEvXbM+c1kKVlKi+xnrAcBoOg8yE/0b0rrgEXOBFAjZYaViSVa78AxA==", lpUsedDefaultChar=0x0) returned 245 [0086.622] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0086.623] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0086.623] CloseHandle (hObject=0x158) returned 1 [0086.623] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341559.jpg")) returned 1 [0086.624] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=20688735065) returned 1 [0086.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [J0341561.JPG].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [j0341561.jpg].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0086.625] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0086.625] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0086.625] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0086.625] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0086.625] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0086.625] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0086.625] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0086.625] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0086.625] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0086.625] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0086.625] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0086.625] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0086.625] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0086.625] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0086.626] SetEndOfFile (hFile=0x158) returned 1 [0086.626] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0086.626] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0086.626] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0086.626] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0086.626] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0086.627] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0086.627] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="\"XBmE(:K&Fu7f+d$o?DsL&GUeMGwulj>M@jiWK.iaesXN", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0089.467] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="\"kcA70N\\D?:>MGwulj>M@jiWK.iaesXN", cchWideChar=32, lpMultiByteStr=0x203cab4, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\"kcA70N\\D?:>MGwulj>M@jiWK.iaesXN", lpUsedDefaultChar=0x0) returned 32 [0089.467] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0089.468] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0089.468] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x11780, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0384900.JPG", cAlternateFileName="")) returned 0x295098 [0089.468] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0089.468] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0089.468] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384900.jpg")) returned 0x20 [0089.469] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384900.jpg")) returned 0x20 [0089.469] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384900.jpg")) returned 0x20 [0089.469] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384900.jpg")) returned 0x20 [0089.469] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384900.jpg"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x11780)) returned 1 [0089.469] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0089.469] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0089.469] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384900.jpg")) returned 0x20 [0089.469] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384900.jpg")) returned 0x20 [0089.469] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0089.469] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0089.469] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0089.469] SetEndOfFile (hFile=0x158) returned 1 [0089.470] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0384900.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0089.470] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0384900.JPG", cchWideChar=12, lpMultiByteStr=0x1fe98cc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0384900.JPG", lpUsedDefaultChar=0x0) returned 12 [0089.470] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0384900.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0089.470] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0384900.JPG", cchWideChar=12, lpMultiByteStr=0x1fe37ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0384900.JPG", lpUsedDefaultChar=0x0) returned 12 [0089.470] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe37ac, cbMultiByte=12, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="J0384900.JPGg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0089.470] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0384900.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0089.470] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0384900.JPG", cchWideChar=12, lpMultiByteStr=0x1fe98cc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0384900.JPG", lpUsedDefaultChar=0x0) returned 12 [0089.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384900.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0089.471] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0089.471] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x11780 [0089.471] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0089.471] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0089.471] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0089.471] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0384900.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0089.471] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0384900.JPG", cchWideChar=12, lpMultiByteStr=0x1fe98cc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0384900.JPG", lpUsedDefaultChar=0x0) returned 12 [0089.471] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0384900.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0089.471] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0384900.JPG", cchWideChar=12, lpMultiByteStr=0x1fe37ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0384900.JPG", lpUsedDefaultChar=0x0) returned 12 [0089.471] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe37ac, cbMultiByte=12, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="J0384900.JPG00.JPGg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0089.471] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0384900.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0089.471] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0384900.JPG", cchWideChar=12, lpMultiByteStr=0x1fe98cc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0384900.JPG", lpUsedDefaultChar=0x0) returned 12 [0089.471] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0089.472] CharToOemA (in: pSrc="J0384900.JPG", pDst=0x1fe37ac | out: pDst="J0384900.JPG") returned 1 [0089.472] WriteFile (in: hFile=0x158, lpBuffer=0x1fe37ac*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe37ac*, lpNumberOfBytesWritten=0x18e048*=0xc, lpOverlapped=0x0) returned 1 [0089.472] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0089.473] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0089.473] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0089.473] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=20973616096) returned 1 [0089.473] ReadFile (in: hFile=0x11c, lpBuffer=0x37e32c0, nNumberOfBytesToRead=0x11780, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37e32c0*, lpNumberOfBytesRead=0x18dd7c*=0x11780, lpOverlapped=0x0) returned 1 [0089.485] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0089.485] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=20974808420) returned 1 [0089.493] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b438*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b5b438*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0089.493] ReadFile (in: hFile=0x11c, lpBuffer=0x37e32c0, nNumberOfBytesToRead=0x11780, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x37e32c0*, lpNumberOfBytesRead=0x18de38*=0x11780, lpOverlapped=0x0) returned 1 [0089.496] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x47 [0089.496] WriteFile (in: hFile=0x158, lpBuffer=0x38362e0*, nNumberOfBytesToWrite=0x11780, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x38362e0*, lpNumberOfBytesWritten=0x18de10*=0x11780, lpOverlapped=0x0) returned 1 [0089.497] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x117c7 [0089.497] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0089.497] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0089.497] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0089.497] SetFilePointer (in: hFile=0x158, lDistanceToMove=12, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2a [0089.497] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x117d1 [0089.497] CloseHandle (hObject=0x11c) returned 1 [0089.497] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x117d1 [0089.498] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x117d1 [0089.498] SetFilePointer (in: hFile=0x158, lDistanceToMove=71633, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x117d1 [0089.498] SetFilePointer (in: hFile=0x158, lDistanceToMove=71633, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x117d1 [0089.498] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x117d1 [0089.498] SetFilePointer (in: hFile=0x158, lDistanceToMove=71633, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x117d1 [0089.498] SetEndOfFile (hFile=0x158) returned 1 [0089.498] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x117d1 [0089.498] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x117d1 [0089.498] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0384900.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0089.498] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0384900.JPG", cchWideChar=12, lpMultiByteStr=0x1fe98cc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0384900.JPG", lpUsedDefaultChar=0x0) returned 12 [0089.498] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0384900.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0089.498] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0384900.JPG", cchWideChar=12, lpMultiByteStr=0x1fe394c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0384900.JPG", lpUsedDefaultChar=0x0) returned 12 [0089.498] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe394c, cbMultiByte=12, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="J0384900.JPGꞗ@涤(\x18믉`믑`") returned 12 [0089.498] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0384900.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0089.498] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0384900.JPG", cchWideChar=12, lpMultiByteStr=0x1fe98cc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0384900.JPG", lpUsedDefaultChar=0x0) returned 12 [0089.498] WriteFile (in: hFile=0x158, lpBuffer=0x37c6d98*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x37c6d98*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0089.499] CharToOemA (in: pSrc="J0384900.JPG", pDst=0x1fe394c | out: pDst="J0384900.JPG") returned 1 [0089.499] WriteFile (in: hFile=0x158, lpBuffer=0x1fe394c*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe394c*, lpNumberOfBytesWritten=0x18efcc*=0xc, lpOverlapped=0x0) returned 1 [0089.499] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b3b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x3b5b3b0*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0089.499] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0089.499] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0089.499] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x11816 [0089.499] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x11816 [0089.499] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0089.499] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0089.499] DeleteFileW (lpFileName="") returned 0 [0089.499] GetLastError () returned 0x3 [0089.499] GetFileAttributesW (lpFileName="") returned 0xffffffff [0089.499] SetLastError (dwErrCode=0x3) [0089.499] FlushFileBuffers (hFile=0x158) returned 1 [0089.505] GetCurrentThreadId () returned 0x970 [0089.505] GetCurrentThreadId () returned 0x970 [0089.505] GetCurrentThreadId () returned 0x970 [0089.505] GetCurrentThreadId () returned 0x970 [0089.505] GetCurrentThreadId () returned 0x970 [0089.505] GetCurrentThreadId () returned 0x970 [0089.505] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x118cd [0089.506] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x118cd [0089.506] SetFilePointer (in: hFile=0x158, lDistanceToMove=71885, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x118cd [0089.506] CloseHandle (hObject=0x158) returned 1 [0089.506] GetCurrentThreadId () returned 0x970 [0089.506] GetCurrentThreadId () returned 0x970 [0089.506] GetCurrentThreadId () returned 0x970 [0089.506] GetCurrentThreadId () returned 0x970 [0089.506] GetCurrentThreadId () returned 0x970 [0089.506] GetCurrentThreadId () returned 0x970 [0089.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [J0384900.JPG].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [j0384900.jpg].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0089.506] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x118cd [0089.506] SetFilePointer (in: hFile=0x158, lDistanceToMove=71757, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1184d [0089.506] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0089.506] GetFileType (hFile=0x158) returned 0x1 [0089.506] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x24, wMilliseconds=0x306)) [0089.506] GetCurrentThreadId () returned 0x970 [0089.506] GetCurrentThreadId () returned 0x970 [0089.506] GetCurrentThreadId () returned 0x970 [0089.506] GetCurrentThreadId () returned 0x970 [0089.506] GetCurrentThreadId () returned 0x970 [0089.506] GetCurrentThreadId () returned 0x970 [0089.506] GetCurrentThreadId () returned 0x970 [0089.507] GetCurrentThreadId () returned 0x970 [0089.507] GetCurrentThreadId () returned 0x970 [0089.507] GetCurrentThreadId () returned 0x970 [0089.507] GetCurrentThreadId () returned 0x970 [0089.507] GetCurrentThreadId () returned 0x970 [0089.507] GetCurrentThreadId () returned 0x970 [0089.507] GetCurrentThreadId () returned 0x970 [0089.507] GetCurrentThreadId () returned 0x970 [0089.507] GetCurrentThreadId () returned 0x970 [0089.507] GetCurrentThreadId () returned 0x970 [0089.507] GetCurrentThreadId () returned 0x970 [0089.507] GetCurrentThreadId () returned 0x970 [0089.507] GetCurrentThreadId () returned 0x970 [0089.507] GetCurrentThreadId () returned 0x970 [0089.507] GetCurrentThreadId () returned 0x970 [0089.507] GetCurrentThreadId () returned 0x970 [0089.507] GetCurrentThreadId () returned 0x970 [0089.507] GetCurrentThreadId () returned 0x970 [0089.507] GetCurrentThreadId () returned 0x970 [0089.507] GetCurrentThreadId () returned 0x970 [0089.507] GetCurrentThreadId () returned 0x970 [0089.507] GetCurrentThreadId () returned 0x970 [0089.507] GetCurrentThreadId () returned 0x970 [0089.507] GetCurrentThreadId () returned 0x970 [0089.507] GetCurrentThreadId () returned 0x970 [0089.507] GetCurrentThreadId () returned 0x970 [0089.507] GetCurrentThreadId () returned 0x970 [0089.507] GetCurrentThreadId () returned 0x970 [0089.507] GetCurrentThreadId () returned 0x970 [0089.507] GetCurrentThreadId () returned 0x970 [0089.507] GetCurrentThreadId () returned 0x970 [0089.507] GetCurrentThreadId () returned 0x970 [0089.507] GetCurrentThreadId () returned 0x970 [0089.507] GetCurrentThreadId () returned 0x970 [0089.507] GetCurrentThreadId () returned 0x970 [0089.507] GetCurrentThreadId () returned 0x970 [0089.507] GetCurrentThreadId () returned 0x970 [0089.507] GetCurrentThreadId () returned 0x970 [0089.507] GetCurrentThreadId () returned 0x970 [0089.507] GetCurrentThreadId () returned 0x970 [0089.507] GetCurrentThreadId () returned 0x970 [0089.507] GetCurrentThreadId () returned 0x970 [0089.507] GetCurrentThreadId () returned 0x970 [0089.508] GetCurrentThreadId () returned 0x970 [0089.508] GetCurrentThreadId () returned 0x970 [0089.508] GetCurrentThreadId () returned 0x970 [0089.508] GetCurrentThreadId () returned 0x970 [0089.508] GetCurrentThreadId () returned 0x970 [0089.508] GetCurrentThreadId () returned 0x970 [0089.508] GetCurrentThreadId () returned 0x970 [0089.508] GetCurrentThreadId () returned 0x970 [0089.508] GetCurrentThreadId () returned 0x970 [0089.508] GetCurrentThreadId () returned 0x970 [0089.508] GetCurrentThreadId () returned 0x970 [0089.508] GetCurrentThreadId () returned 0x970 [0089.508] GetCurrentThreadId () returned 0x970 [0089.508] GetCurrentThreadId () returned 0x970 [0089.508] GetCurrentThreadId () returned 0x970 [0089.508] GetCurrentThreadId () returned 0x970 [0089.508] GetCurrentThreadId () returned 0x970 [0089.508] GetCurrentThreadId () returned 0x970 [0089.508] GetCurrentThreadId () returned 0x970 [0089.508] GetCurrentThreadId () returned 0x970 [0089.508] GetCurrentThreadId () returned 0x970 [0089.508] GetCurrentThreadId () returned 0x970 [0089.508] GetCurrentThreadId () returned 0x970 [0089.508] GetCurrentThreadId () returned 0x970 [0089.508] GetCurrentThreadId () returned 0x970 [0089.508] GetCurrentThreadId () returned 0x970 [0089.508] GetCurrentThreadId () returned 0x970 [0089.508] GetCurrentThreadId () returned 0x970 [0089.508] GetCurrentThreadId () returned 0x970 [0089.508] GetCurrentThreadId () returned 0x970 [0089.508] GetCurrentThreadId () returned 0x970 [0089.508] GetCurrentThreadId () returned 0x970 [0089.508] GetCurrentThreadId () returned 0x970 [0089.508] GetCurrentThreadId () returned 0x970 [0089.508] GetCurrentThreadId () returned 0x970 [0089.508] GetCurrentThreadId () returned 0x970 [0089.508] GetCurrentThreadId () returned 0x970 [0089.508] GetCurrentThreadId () returned 0x970 [0089.508] GetCurrentThreadId () returned 0x970 [0089.508] GetCurrentThreadId () returned 0x970 [0089.508] GetCurrentThreadId () returned 0x970 [0089.508] GetCurrentThreadId () returned 0x970 [0089.509] GetCurrentThreadId () returned 0x970 [0089.509] GetCurrentThreadId () returned 0x970 [0089.509] GetCurrentThreadId () returned 0x970 [0089.509] GetCurrentThreadId () returned 0x970 [0089.509] GetCurrentThreadId () returned 0x970 [0089.509] GetCurrentThreadId () returned 0x970 [0089.509] GetCurrentThreadId () returned 0x970 [0089.509] GetCurrentThreadId () returned 0x970 [0089.509] GetCurrentThreadId () returned 0x970 [0089.509] GetCurrentThreadId () returned 0x970 [0089.509] GetCurrentThreadId () returned 0x970 [0089.509] GetCurrentThreadId () returned 0x970 [0089.509] GetCurrentThreadId () returned 0x970 [0089.509] GetCurrentThreadId () returned 0x970 [0089.509] GetCurrentThreadId () returned 0x970 [0089.509] GetCurrentThreadId () returned 0x970 [0089.509] GetCurrentThreadId () returned 0x970 [0089.509] GetCurrentThreadId () returned 0x970 [0089.509] GetCurrentThreadId () returned 0x970 [0089.509] GetCurrentThreadId () returned 0x970 [0089.509] GetCurrentThreadId () returned 0x970 [0089.509] GetCurrentThreadId () returned 0x970 [0089.509] GetCurrentThreadId () returned 0x970 [0089.509] GetCurrentThreadId () returned 0x970 [0089.509] GetCurrentThreadId () returned 0x970 [0089.509] GetCurrentThreadId () returned 0x970 [0089.509] GetCurrentThreadId () returned 0x970 [0089.509] GetCurrentThreadId () returned 0x970 [0089.509] GetCurrentThreadId () returned 0x970 [0089.509] GetCurrentThreadId () returned 0x970 [0089.509] GetCurrentThreadId () returned 0x970 [0089.509] GetCurrentThreadId () returned 0x970 [0089.509] GetCurrentThreadId () returned 0x970 [0089.509] GetCurrentThreadId () returned 0x970 [0089.509] GetCurrentThreadId () returned 0x970 [0089.509] GetCurrentThreadId () returned 0x970 [0089.509] GetCurrentThreadId () returned 0x970 [0089.509] GetCurrentThreadId () returned 0x970 [0089.509] GetCurrentThreadId () returned 0x970 [0089.509] GetCurrentThreadId () returned 0x970 [0089.509] GetCurrentThreadId () returned 0x970 [0089.510] GetCurrentThreadId () returned 0x970 [0089.510] GetCurrentThreadId () returned 0x970 [0089.510] GetCurrentThreadId () returned 0x970 [0089.510] GetCurrentThreadId () returned 0x970 [0089.510] GetCurrentThreadId () returned 0x970 [0089.510] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0089.510] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0089.510] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5faf0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0089.510] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0089.510] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0089.510] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5faf0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0089.510] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0089.510] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0089.510] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b530, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0089.510] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0089.510] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0089.510] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b530, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0089.510] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0089.510] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0089.510] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5fb50, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0089.510] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0089.510] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0089.510] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5fb50, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0089.510] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0089.510] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0089.510] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5fb50, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0089.510] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x24, wMilliseconds=0x306)) [0089.510] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="\"kcA70N\\D?:>MGwulj>M@jiWK.iaesXN", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0089.510] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="\"kcA70N\\D?:>MGwulj>M@jiWK.iaesXN", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0089.510] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="\"kcA70N\\D?:>MGwulj>M@jiWK.iaesXN", cchWideChar=32, lpMultiByteStr=0x3b56b88, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\"kcA70N\\D?:>MGwulj>M@jiWK.iaesXN", lpUsedDefaultChar=0x0) returned 32 [0089.511] GetCurrentThreadId () returned 0x970 [0089.511] GetCurrentThreadId () returned 0x970 [0089.511] GetCurrentThreadId () returned 0x970 [0089.511] GetCurrentThreadId () returned 0x970 [0089.511] GetCurrentThreadId () returned 0x970 [0089.511] GetCurrentThreadId () returned 0x970 [0089.518] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0089.518] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0089.518] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3b896b8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0089.518] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0089.518] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAAemyaRZzjFGczyc5o/IsuzjgbJ1A0fTiBf482mbZZa+us5E3llhLx2VUOlF6YmulBf5e3Th3dUMO7G16FB6uTgTl12Qv8BQqqhrlKviXnxZIDEZ8aJvLQOyFrkw66dnSmzJmfBAuX46UJRQr7297yREsIhmKEUc/4CcY50w4EZ1Ge1qxmeP0php6G1GNr+dFHqdIUVShEf1ZboUgEaMJUGlj9oAgKiN/A==") returned 232 [0089.518] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x24, wMilliseconds=0x316)) [0089.519] GetCurrentThreadId () returned 0x970 [0089.519] GetCurrentThreadId () returned 0x970 [0089.519] GetCurrentThreadId () returned 0x970 [0089.519] GetCurrentThreadId () returned 0x970 [0089.519] GetCurrentThreadId () returned 0x970 [0089.519] GetCurrentThreadId () returned 0x970 [0089.519] GetCurrentThreadId () returned 0x970 [0089.519] GetCurrentThreadId () returned 0x970 [0089.519] GetCurrentThreadId () returned 0x970 [0089.519] GetCurrentThreadId () returned 0x970 [0089.519] GetCurrentThreadId () returned 0x970 [0089.519] GetCurrentThreadId () returned 0x970 [0089.519] GetCurrentThreadId () returned 0x970 [0089.519] GetCurrentThreadId () returned 0x970 [0089.519] GetCurrentThreadId () returned 0x970 [0089.519] GetCurrentThreadId () returned 0x970 [0089.519] GetCurrentThreadId () returned 0x970 [0089.519] GetCurrentThreadId () returned 0x970 [0089.519] GetCurrentThreadId () returned 0x970 [0089.519] GetCurrentThreadId () returned 0x970 [0089.519] GetCurrentThreadId () returned 0x970 [0089.519] GetCurrentThreadId () returned 0x970 [0089.519] GetCurrentThreadId () returned 0x970 [0089.519] GetCurrentThreadId () returned 0x970 [0089.519] GetCurrentThreadId () returned 0x970 [0089.519] GetCurrentThreadId () returned 0x970 [0089.519] GetCurrentThreadId () returned 0x970 [0089.519] GetCurrentThreadId () returned 0x970 [0089.519] GetCurrentThreadId () returned 0x970 [0089.519] GetCurrentThreadId () returned 0x970 [0089.519] GetCurrentThreadId () returned 0x970 [0089.519] GetCurrentThreadId () returned 0x970 [0089.519] GetCurrentThreadId () returned 0x970 [0089.519] GetCurrentThreadId () returned 0x970 [0089.519] GetCurrentThreadId () returned 0x970 [0089.519] GetCurrentThreadId () returned 0x970 [0089.519] GetCurrentThreadId () returned 0x970 [0089.519] GetCurrentThreadId () returned 0x970 [0089.519] GetCurrentThreadId () returned 0x970 [0089.519] GetCurrentThreadId () returned 0x970 [0089.519] GetCurrentThreadId () returned 0x970 [0089.520] GetCurrentThreadId () returned 0x970 [0089.520] GetCurrentThreadId () returned 0x970 [0089.520] GetCurrentThreadId () returned 0x970 [0089.520] GetCurrentThreadId () returned 0x970 [0089.520] GetCurrentThreadId () returned 0x970 [0089.520] GetCurrentThreadId () returned 0x970 [0089.520] GetCurrentThreadId () returned 0x970 [0089.520] GetCurrentThreadId () returned 0x970 [0089.520] GetCurrentThreadId () returned 0x970 [0089.520] GetCurrentThreadId () returned 0x970 [0089.520] GetCurrentThreadId () returned 0x970 [0089.520] GetCurrentThreadId () returned 0x970 [0089.520] GetCurrentThreadId () returned 0x970 [0089.520] GetCurrentThreadId () returned 0x970 [0089.520] GetCurrentThreadId () returned 0x970 [0089.520] GetCurrentThreadId () returned 0x970 [0089.520] GetCurrentThreadId () returned 0x970 [0089.520] GetCurrentThreadId () returned 0x970 [0089.520] GetCurrentThreadId () returned 0x970 [0089.520] GetCurrentThreadId () returned 0x970 [0089.520] GetCurrentThreadId () returned 0x970 [0089.520] GetCurrentThreadId () returned 0x970 [0089.520] GetCurrentThreadId () returned 0x970 [0089.520] GetCurrentThreadId () returned 0x970 [0089.520] GetCurrentThreadId () returned 0x970 [0089.520] GetCurrentThreadId () returned 0x970 [0089.520] GetCurrentThreadId () returned 0x970 [0089.520] GetCurrentThreadId () returned 0x970 [0089.520] GetCurrentThreadId () returned 0x970 [0089.520] GetCurrentThreadId () returned 0x970 [0089.520] GetCurrentThreadId () returned 0x970 [0089.520] GetCurrentThreadId () returned 0x970 [0089.520] GetCurrentThreadId () returned 0x970 [0089.520] GetCurrentThreadId () returned 0x970 [0089.520] GetCurrentThreadId () returned 0x970 [0089.520] GetCurrentThreadId () returned 0x970 [0089.520] GetCurrentThreadId () returned 0x970 [0089.520] GetCurrentThreadId () returned 0x970 [0089.520] GetCurrentThreadId () returned 0x970 [0089.520] GetCurrentThreadId () returned 0x970 [0089.520] GetCurrentThreadId () returned 0x970 [0089.521] GetCurrentThreadId () returned 0x970 [0089.521] GetCurrentThreadId () returned 0x970 [0089.521] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAAemyaRZzjFGczyc5o/IsuzjgbJ1A0fTiBf482mbZZa+us5E3llhLx2VUOlF6YmulBf5e3Th3dUMO7G16FB6uTgTl12Qv8BQqqhrlKviXnxZIDEZ8aJvLQOyFrkw66dnSmzJmfBAuX46UJRQr7297yREsIhmKEUc/4CcY50w4EZ1Ge1qxmeP0php6G1GNr+dFHqdIUVShEf1ZboUgEaMJUGlj9oAgKiN/A==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0089.521] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAAemyaRZzjFGczyc5o/IsuzjgbJ1A0fTiBf482mbZZa+us5E3llhLx2VUOlF6YmulBf5e3Th3dUMO7G16FB6uTgTl12Qv8BQqqhrlKviXnxZIDEZ8aJvLQOyFrkw66dnSmzJmfBAuX46UJRQr7297yREsIhmKEUc/4CcY50w4EZ1Ge1qxmeP0php6G1GNr+dFHqdIUVShEf1ZboUgEaMJUGlj9oAgKiN/A==", cchWideChar=245, lpMultiByteStr=0x3b4d08c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAAemyaRZzjFGczyc5o/IsuzjgbJ1A0fTiBf482mbZZa+us5E3llhLx2VUOlF6YmulBf5e3Th3dUMO7G16FB6uTgTl12Qv8BQqqhrlKviXnxZIDEZ8aJvLQOyFrkw66dnSmzJmfBAuX46UJRQr7297yREsIhmKEUc/4CcY50w4EZ1Ge1qxmeP0php6G1GNr+dFHqdIUVShEf1ZboUgEaMJUGlj9oAgKiN/A==", lpUsedDefaultChar=0x0) returned 245 [0089.521] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0089.521] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0089.521] CloseHandle (hObject=0x158) returned 1 [0089.521] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384900.jpg")) returned 1 [0089.522] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=20978584229) returned 1 [0089.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [J0386120.JPG].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [j0386120.jpg].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0089.523] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0089.523] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0089.523] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0089.523] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0089.523] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0089.523] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0089.523] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0089.523] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0089.524] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0089.524] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0089.524] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0089.524] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0089.524] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0089.524] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0089.524] SetEndOfFile (hFile=0x158) returned 1 [0089.524] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0089.524] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0089.524] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0089.524] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0089.524] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0089.525] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0089.525] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=",B.QxKplh+*6y?7&C>).W^Ukcj-lQ}R#", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0089.525] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=",B.QxKplh+*6y?7&C>).W^Ukcj-lQ}R#", cchWideChar=32, lpMultiByteStr=0x203caec, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=",B.QxKplh+*6y?7&C>).W^Ukcj-lQ}R#", lpUsedDefaultChar=0x0) returned 32 [0089.525] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0089.525] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0089.525] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x787a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0386120.JPG", cAlternateFileName="")) returned 0x295098 [0089.526] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0089.526] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0089.526] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386120.jpg")) returned 0x20 [0089.526] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386120.jpg")) returned 0x20 [0089.526] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386120.jpg")) returned 0x20 [0089.526] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386120.jpg")) returned 0x20 [0089.526] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386120.jpg"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x787a)) returned 1 [0089.526] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0089.526] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0089.526] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386120.jpg")) returned 0x20 [0089.527] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386120.jpg")) returned 0x20 [0089.527] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0089.528] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0089.528] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0089.528] SetEndOfFile (hFile=0x158) returned 1 [0089.529] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0386120.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0089.529] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0386120.JPG", cchWideChar=12, lpMultiByteStr=0x1fe992c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0386120.JPG", lpUsedDefaultChar=0x0) returned 12 [0089.529] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0386120.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0089.529] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0386120.JPG", cchWideChar=12, lpMultiByteStr=0x1fe3c4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0386120.JPG", lpUsedDefaultChar=0x0) returned 12 [0089.529] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe3c4c, cbMultiByte=12, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="J0386120.JPGg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0089.529] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0386120.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0089.529] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0386120.JPG", cchWideChar=12, lpMultiByteStr=0x1fe992c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0386120.JPG", lpUsedDefaultChar=0x0) returned 12 [0089.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386120.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0089.529] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0089.530] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x787a [0089.530] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0089.530] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0089.530] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0089.530] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0386120.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0089.530] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0386120.JPG", cchWideChar=12, lpMultiByteStr=0x1fe992c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0386120.JPG", lpUsedDefaultChar=0x0) returned 12 [0089.530] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0386120.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0089.530] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0386120.JPG", cchWideChar=12, lpMultiByteStr=0x1fe3c4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0386120.JPG", lpUsedDefaultChar=0x0) returned 12 [0089.530] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe3c4c, cbMultiByte=12, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="J0386120.JPG20.JPGg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0089.530] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0386120.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0089.530] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0386120.JPG", cchWideChar=12, lpMultiByteStr=0x1fe992c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0386120.JPG", lpUsedDefaultChar=0x0) returned 12 [0089.530] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0089.531] CharToOemA (in: pSrc="J0386120.JPG", pDst=0x1fe3c4c | out: pDst="J0386120.JPG") returned 1 [0089.531] WriteFile (in: hFile=0x158, lpBuffer=0x1fe3c4c*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe3c4c*, lpNumberOfBytesWritten=0x18e048*=0xc, lpOverlapped=0x0) returned 1 [0089.531] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0089.531] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0089.531] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0089.531] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=20979484133) returned 1 [0089.531] ReadFile (in: hFile=0x11c, lpBuffer=0x37e32c0, nNumberOfBytesToRead=0x787a, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37e32c0*, lpNumberOfBytesRead=0x18dd7c*=0x787a, lpOverlapped=0x0) returned 1 [0089.588] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0089.588] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=20985188024) returned 1 [0089.598] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b420*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b5b420*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0089.599] ReadFile (in: hFile=0x11c, lpBuffer=0x37e32c0, nNumberOfBytesToRead=0x787a, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x37e32c0*, lpNumberOfBytesRead=0x18de38*=0x787a, lpOverlapped=0x0) returned 1 [0089.599] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x47 [0089.600] WriteFile (in: hFile=0x158, lpBuffer=0x382c3e0*, nNumberOfBytesToWrite=0x787a, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x382c3e0*, lpNumberOfBytesWritten=0x18de10*=0x787a, lpOverlapped=0x0) returned 1 [0089.601] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x78c1 [0089.601] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0089.601] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0089.601] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0089.601] SetFilePointer (in: hFile=0x158, lDistanceToMove=12, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2a [0089.601] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x78cb [0089.601] CloseHandle (hObject=0x11c) returned 1 [0089.601] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x78cb [0089.601] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x78cb [0089.601] SetFilePointer (in: hFile=0x158, lDistanceToMove=30923, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x78cb [0089.601] SetFilePointer (in: hFile=0x158, lDistanceToMove=30923, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x78cb [0089.601] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x78cb [0089.601] SetFilePointer (in: hFile=0x158, lDistanceToMove=30923, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x78cb [0089.602] SetEndOfFile (hFile=0x158) returned 1 [0089.602] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x78cb [0089.602] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x78cb [0089.602] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0386120.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0089.602] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0386120.JPG", cchWideChar=12, lpMultiByteStr=0x1fe992c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0386120.JPG", lpUsedDefaultChar=0x0) returned 12 [0089.602] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0386120.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0089.602] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0386120.JPG", cchWideChar=12, lpMultiByteStr=0x1fe42ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0386120.JPG", lpUsedDefaultChar=0x0) returned 12 [0089.602] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe42ac, cbMultiByte=12, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="J0386120.JPGꞗ@涤(\x18믉`믑`") returned 12 [0089.602] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0386120.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0089.602] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0386120.JPG", cchWideChar=12, lpMultiByteStr=0x1fe992c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0386120.JPG", lpUsedDefaultChar=0x0) returned 12 [0089.602] WriteFile (in: hFile=0x158, lpBuffer=0x37c6d98*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x37c6d98*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0089.602] CharToOemA (in: pSrc="J0386120.JPG", pDst=0x1fe42ac | out: pDst="J0386120.JPG") returned 1 [0089.602] WriteFile (in: hFile=0x158, lpBuffer=0x1fe42ac*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe42ac*, lpNumberOfBytesWritten=0x18efcc*=0xc, lpOverlapped=0x0) returned 1 [0089.603] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b470*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x3b5b470*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0089.603] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0089.603] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0089.603] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x7910 [0089.603] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x7910 [0089.603] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0089.603] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0089.603] DeleteFileW (lpFileName="") returned 0 [0089.603] GetLastError () returned 0x3 [0089.603] GetFileAttributesW (lpFileName="") returned 0xffffffff [0089.603] SetLastError (dwErrCode=0x3) [0089.603] FlushFileBuffers (hFile=0x158) returned 1 [0089.760] GetCurrentThreadId () returned 0x970 [0089.760] GetCurrentThreadId () returned 0x970 [0089.760] GetCurrentThreadId () returned 0x970 [0089.760] GetCurrentThreadId () returned 0x970 [0089.760] GetCurrentThreadId () returned 0x970 [0089.760] GetCurrentThreadId () returned 0x970 [0089.760] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x79c7 [0089.761] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x79c7 [0089.761] SetFilePointer (in: hFile=0x158, lDistanceToMove=31175, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x79c7 [0089.761] CloseHandle (hObject=0x158) returned 1 [0089.761] GetCurrentThreadId () returned 0x970 [0089.761] GetCurrentThreadId () returned 0x970 [0089.761] GetCurrentThreadId () returned 0x970 [0089.761] GetCurrentThreadId () returned 0x970 [0089.761] GetCurrentThreadId () returned 0x970 [0089.761] GetCurrentThreadId () returned 0x970 [0089.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [J0386120.JPG].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [j0386120.jpg].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0089.761] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x79c7 [0089.762] SetFilePointer (in: hFile=0x158, lDistanceToMove=31047, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7947 [0089.762] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0089.762] GetFileType (hFile=0x158) returned 0x1 [0089.762] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x25, wMilliseconds=0x28)) [0089.762] GetCurrentThreadId () returned 0x970 [0089.762] GetCurrentThreadId () returned 0x970 [0089.762] GetCurrentThreadId () returned 0x970 [0089.762] GetCurrentThreadId () returned 0x970 [0089.762] GetCurrentThreadId () returned 0x970 [0089.762] GetCurrentThreadId () returned 0x970 [0089.762] GetCurrentThreadId () returned 0x970 [0089.762] GetCurrentThreadId () returned 0x970 [0089.762] GetCurrentThreadId () returned 0x970 [0089.762] GetCurrentThreadId () returned 0x970 [0089.762] GetCurrentThreadId () returned 0x970 [0089.762] GetCurrentThreadId () returned 0x970 [0089.762] GetCurrentThreadId () returned 0x970 [0089.762] GetCurrentThreadId () returned 0x970 [0089.762] GetCurrentThreadId () returned 0x970 [0089.762] GetCurrentThreadId () returned 0x970 [0089.762] GetCurrentThreadId () returned 0x970 [0089.762] GetCurrentThreadId () returned 0x970 [0089.762] GetCurrentThreadId () returned 0x970 [0089.762] GetCurrentThreadId () returned 0x970 [0089.762] GetCurrentThreadId () returned 0x970 [0089.762] GetCurrentThreadId () returned 0x970 [0089.762] GetCurrentThreadId () returned 0x970 [0089.763] GetCurrentThreadId () returned 0x970 [0089.763] GetCurrentThreadId () returned 0x970 [0089.763] GetCurrentThreadId () returned 0x970 [0089.763] GetCurrentThreadId () returned 0x970 [0089.763] GetCurrentThreadId () returned 0x970 [0089.763] GetCurrentThreadId () returned 0x970 [0089.763] GetCurrentThreadId () returned 0x970 [0089.763] GetCurrentThreadId () returned 0x970 [0089.763] GetCurrentThreadId () returned 0x970 [0089.763] GetCurrentThreadId () returned 0x970 [0089.763] GetCurrentThreadId () returned 0x970 [0089.763] GetCurrentThreadId () returned 0x970 [0089.763] GetCurrentThreadId () returned 0x970 [0089.763] GetCurrentThreadId () returned 0x970 [0089.763] GetCurrentThreadId () returned 0x970 [0089.763] GetCurrentThreadId () returned 0x970 [0089.763] GetCurrentThreadId () returned 0x970 [0089.763] GetCurrentThreadId () returned 0x970 [0089.763] GetCurrentThreadId () returned 0x970 [0089.763] GetCurrentThreadId () returned 0x970 [0089.763] GetCurrentThreadId () returned 0x970 [0089.763] GetCurrentThreadId () returned 0x970 [0089.763] GetCurrentThreadId () returned 0x970 [0089.763] GetCurrentThreadId () returned 0x970 [0089.763] GetCurrentThreadId () returned 0x970 [0089.763] GetCurrentThreadId () returned 0x970 [0089.763] GetCurrentThreadId () returned 0x970 [0089.763] GetCurrentThreadId () returned 0x970 [0089.763] GetCurrentThreadId () returned 0x970 [0089.763] GetCurrentThreadId () returned 0x970 [0089.763] GetCurrentThreadId () returned 0x970 [0089.763] GetCurrentThreadId () returned 0x970 [0089.764] GetCurrentThreadId () returned 0x970 [0089.764] GetCurrentThreadId () returned 0x970 [0089.764] GetCurrentThreadId () returned 0x970 [0089.764] GetCurrentThreadId () returned 0x970 [0089.764] GetCurrentThreadId () returned 0x970 [0089.764] GetCurrentThreadId () returned 0x970 [0089.764] GetCurrentThreadId () returned 0x970 [0089.764] GetCurrentThreadId () returned 0x970 [0089.764] GetCurrentThreadId () returned 0x970 [0089.764] GetCurrentThreadId () returned 0x970 [0089.764] GetCurrentThreadId () returned 0x970 [0089.764] GetCurrentThreadId () returned 0x970 [0089.764] GetCurrentThreadId () returned 0x970 [0089.764] GetCurrentThreadId () returned 0x970 [0089.764] GetCurrentThreadId () returned 0x970 [0089.764] GetCurrentThreadId () returned 0x970 [0089.764] GetCurrentThreadId () returned 0x970 [0089.764] GetCurrentThreadId () returned 0x970 [0089.764] GetCurrentThreadId () returned 0x970 [0089.764] GetCurrentThreadId () returned 0x970 [0089.764] GetCurrentThreadId () returned 0x970 [0089.764] GetCurrentThreadId () returned 0x970 [0089.764] GetCurrentThreadId () returned 0x970 [0089.764] GetCurrentThreadId () returned 0x970 [0089.764] GetCurrentThreadId () returned 0x970 [0089.764] GetCurrentThreadId () returned 0x970 [0089.764] GetCurrentThreadId () returned 0x970 [0089.764] GetCurrentThreadId () returned 0x970 [0089.764] GetCurrentThreadId () returned 0x970 [0089.764] GetCurrentThreadId () returned 0x970 [0089.764] GetCurrentThreadId () returned 0x970 [0089.764] GetCurrentThreadId () returned 0x970 [0089.765] GetCurrentThreadId () returned 0x970 [0089.765] GetCurrentThreadId () returned 0x970 [0089.765] GetCurrentThreadId () returned 0x970 [0089.765] GetCurrentThreadId () returned 0x970 [0089.765] GetCurrentThreadId () returned 0x970 [0089.765] GetCurrentThreadId () returned 0x970 [0089.765] GetCurrentThreadId () returned 0x970 [0089.765] GetCurrentThreadId () returned 0x970 [0089.765] GetCurrentThreadId () returned 0x970 [0089.765] GetCurrentThreadId () returned 0x970 [0089.765] GetCurrentThreadId () returned 0x970 [0089.765] GetCurrentThreadId () returned 0x970 [0089.765] GetCurrentThreadId () returned 0x970 [0089.765] GetCurrentThreadId () returned 0x970 [0089.765] GetCurrentThreadId () returned 0x970 [0089.765] GetCurrentThreadId () returned 0x970 [0089.765] GetCurrentThreadId () returned 0x970 [0089.765] GetCurrentThreadId () returned 0x970 [0089.765] GetCurrentThreadId () returned 0x970 [0089.765] GetCurrentThreadId () returned 0x970 [0089.765] GetCurrentThreadId () returned 0x970 [0089.765] GetCurrentThreadId () returned 0x970 [0089.765] GetCurrentThreadId () returned 0x970 [0089.765] GetCurrentThreadId () returned 0x970 [0089.765] GetCurrentThreadId () returned 0x970 [0089.765] GetCurrentThreadId () returned 0x970 [0089.765] GetCurrentThreadId () returned 0x970 [0089.765] GetCurrentThreadId () returned 0x970 [0089.765] GetCurrentThreadId () returned 0x970 [0089.765] GetCurrentThreadId () returned 0x970 [0089.765] GetCurrentThreadId () returned 0x970 [0089.765] GetCurrentThreadId () returned 0x970 [0089.766] GetCurrentThreadId () returned 0x970 [0089.766] GetCurrentThreadId () returned 0x970 [0089.766] GetCurrentThreadId () returned 0x970 [0089.766] GetCurrentThreadId () returned 0x970 [0089.766] GetCurrentThreadId () returned 0x970 [0089.766] GetCurrentThreadId () returned 0x970 [0089.766] GetCurrentThreadId () returned 0x970 [0089.766] GetCurrentThreadId () returned 0x970 [0089.766] GetCurrentThreadId () returned 0x970 [0089.766] GetCurrentThreadId () returned 0x970 [0089.766] GetCurrentThreadId () returned 0x970 [0089.766] GetCurrentThreadId () returned 0x970 [0089.766] GetCurrentThreadId () returned 0x970 [0089.766] GetCurrentThreadId () returned 0x970 [0089.766] GetCurrentThreadId () returned 0x970 [0089.766] GetCurrentThreadId () returned 0x970 [0089.766] GetCurrentThreadId () returned 0x970 [0089.766] GetCurrentThreadId () returned 0x970 [0089.766] GetCurrentThreadId () returned 0x970 [0089.766] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0089.766] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0089.766] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5fb50, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0089.766] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0089.766] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0089.766] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5fb50, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0089.766] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0089.766] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0089.767] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b548, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0089.767] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0089.767] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0089.767] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b548, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0089.767] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0089.767] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0089.767] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5fbb0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0089.767] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0089.767] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0089.767] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5fbb0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0089.767] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0089.767] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0089.767] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5fbb0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0089.767] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x25, wMilliseconds=0x28)) [0089.767] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr=",B.QxKplh+*6y?7&C>).W^Ukcj-lQ}R#", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0089.767] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr=",B.QxKplh+*6y?7&C>).W^Ukcj-lQ}R#", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0089.767] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr=",B.QxKplh+*6y?7&C>).W^Ukcj-lQ}R#", cchWideChar=32, lpMultiByteStr=0x3b56bb8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=",B.QxKplh+*6y?7&C>).W^Ukcj-lQ}R#", lpUsedDefaultChar=0x0) returned 32 [0089.767] GetCurrentThreadId () returned 0x970 [0089.767] GetCurrentThreadId () returned 0x970 [0089.767] GetCurrentThreadId () returned 0x970 [0089.767] GetCurrentThreadId () returned 0x970 [0089.767] GetCurrentThreadId () returned 0x970 [0089.768] GetCurrentThreadId () returned 0x970 [0089.778] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0089.778] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0089.778] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3b897a8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0089.778] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0089.778] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAAdrY077MhTh+yqGC721ZJKwGFB1hNhszEnbPvKUlR3AtzdnbuCx2uRruepLe/iPKNzq/6HMgv2q+SM9HEkcOHYpMMU938Gl3IDPLKoTB52kRDeYdtYTSMfilzubpCvsyB8lBuSKFuEzIhaombtoVEDOLegS94frbGUGUkcPOj9iTS/y9RF6D5SOKYV7KeHdJVZnjwEnx6nOPK0/nre4+HAH/XVhZaoKYg==") returned 232 [0089.778] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x25, wMilliseconds=0x37)) [0089.778] GetCurrentThreadId () returned 0x970 [0089.779] GetCurrentThreadId () returned 0x970 [0089.779] GetCurrentThreadId () returned 0x970 [0089.779] GetCurrentThreadId () returned 0x970 [0089.779] GetCurrentThreadId () returned 0x970 [0089.779] GetCurrentThreadId () returned 0x970 [0089.779] GetCurrentThreadId () returned 0x970 [0089.779] GetCurrentThreadId () returned 0x970 [0089.779] GetCurrentThreadId () returned 0x970 [0089.779] GetCurrentThreadId () returned 0x970 [0089.779] GetCurrentThreadId () returned 0x970 [0089.779] GetCurrentThreadId () returned 0x970 [0089.779] GetCurrentThreadId () returned 0x970 [0089.779] GetCurrentThreadId () returned 0x970 [0089.779] GetCurrentThreadId () returned 0x970 [0089.779] GetCurrentThreadId () returned 0x970 [0089.779] GetCurrentThreadId () returned 0x970 [0089.779] GetCurrentThreadId () returned 0x970 [0089.779] GetCurrentThreadId () returned 0x970 [0089.779] GetCurrentThreadId () returned 0x970 [0089.779] GetCurrentThreadId () returned 0x970 [0089.779] GetCurrentThreadId () returned 0x970 [0089.779] GetCurrentThreadId () returned 0x970 [0089.779] GetCurrentThreadId () returned 0x970 [0089.779] GetCurrentThreadId () returned 0x970 [0089.779] GetCurrentThreadId () returned 0x970 [0089.779] GetCurrentThreadId () returned 0x970 [0089.779] GetCurrentThreadId () returned 0x970 [0089.779] GetCurrentThreadId () returned 0x970 [0089.779] GetCurrentThreadId () returned 0x970 [0089.779] GetCurrentThreadId () returned 0x970 [0089.779] GetCurrentThreadId () returned 0x970 [0089.779] GetCurrentThreadId () returned 0x970 [0089.780] GetCurrentThreadId () returned 0x970 [0089.780] GetCurrentThreadId () returned 0x970 [0089.780] GetCurrentThreadId () returned 0x970 [0089.780] GetCurrentThreadId () returned 0x970 [0089.780] GetCurrentThreadId () returned 0x970 [0089.780] GetCurrentThreadId () returned 0x970 [0089.780] GetCurrentThreadId () returned 0x970 [0089.780] GetCurrentThreadId () returned 0x970 [0089.780] GetCurrentThreadId () returned 0x970 [0089.780] GetCurrentThreadId () returned 0x970 [0089.780] GetCurrentThreadId () returned 0x970 [0089.780] GetCurrentThreadId () returned 0x970 [0089.780] GetCurrentThreadId () returned 0x970 [0089.780] GetCurrentThreadId () returned 0x970 [0089.780] GetCurrentThreadId () returned 0x970 [0089.780] GetCurrentThreadId () returned 0x970 [0089.780] GetCurrentThreadId () returned 0x970 [0089.780] GetCurrentThreadId () returned 0x970 [0089.780] GetCurrentThreadId () returned 0x970 [0089.780] GetCurrentThreadId () returned 0x970 [0089.780] GetCurrentThreadId () returned 0x970 [0089.780] GetCurrentThreadId () returned 0x970 [0089.780] GetCurrentThreadId () returned 0x970 [0089.780] GetCurrentThreadId () returned 0x970 [0089.780] GetCurrentThreadId () returned 0x970 [0089.780] GetCurrentThreadId () returned 0x970 [0089.780] GetCurrentThreadId () returned 0x970 [0089.780] GetCurrentThreadId () returned 0x970 [0089.780] GetCurrentThreadId () returned 0x970 [0089.780] GetCurrentThreadId () returned 0x970 [0089.780] GetCurrentThreadId () returned 0x970 [0089.780] GetCurrentThreadId () returned 0x970 [0089.781] GetCurrentThreadId () returned 0x970 [0089.781] GetCurrentThreadId () returned 0x970 [0089.781] GetCurrentThreadId () returned 0x970 [0089.781] GetCurrentThreadId () returned 0x970 [0089.781] GetCurrentThreadId () returned 0x970 [0089.781] GetCurrentThreadId () returned 0x970 [0089.781] GetCurrentThreadId () returned 0x970 [0089.781] GetCurrentThreadId () returned 0x970 [0089.781] GetCurrentThreadId () returned 0x970 [0089.781] GetCurrentThreadId () returned 0x970 [0089.781] GetCurrentThreadId () returned 0x970 [0089.781] GetCurrentThreadId () returned 0x970 [0089.781] GetCurrentThreadId () returned 0x970 [0089.781] GetCurrentThreadId () returned 0x970 [0089.781] GetCurrentThreadId () returned 0x970 [0089.781] GetCurrentThreadId () returned 0x970 [0089.781] GetCurrentThreadId () returned 0x970 [0089.781] GetCurrentThreadId () returned 0x970 [0089.781] GetCurrentThreadId () returned 0x970 [0089.781] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAAdrY077MhTh+yqGC721ZJKwGFB1hNhszEnbPvKUlR3AtzdnbuCx2uRruepLe/iPKNzq/6HMgv2q+SM9HEkcOHYpMMU938Gl3IDPLKoTB52kRDeYdtYTSMfilzubpCvsyB8lBuSKFuEzIhaombtoVEDOLegS94frbGUGUkcPOj9iTS/y9RF6D5SOKYV7KeHdJVZnjwEnx6nOPK0/nre4+HAH/XVhZaoKYg==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0089.781] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAAdrY077MhTh+yqGC721ZJKwGFB1hNhszEnbPvKUlR3AtzdnbuCx2uRruepLe/iPKNzq/6HMgv2q+SM9HEkcOHYpMMU938Gl3IDPLKoTB52kRDeYdtYTSMfilzubpCvsyB8lBuSKFuEzIhaombtoVEDOLegS94frbGUGUkcPOj9iTS/y9RF6D5SOKYV7KeHdJVZnjwEnx6nOPK0/nre4+HAH/XVhZaoKYg==", cchWideChar=245, lpMultiByteStr=0x3b4d08c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAAdrY077MhTh+yqGC721ZJKwGFB1hNhszEnbPvKUlR3AtzdnbuCx2uRruepLe/iPKNzq/6HMgv2q+SM9HEkcOHYpMMU938Gl3IDPLKoTB52kRDeYdtYTSMfilzubpCvsyB8lBuSKFuEzIhaombtoVEDOLegS94frbGUGUkcPOj9iTS/y9RF6D5SOKYV7KeHdJVZnjwEnx6nOPK0/nre4+HAH/XVhZaoKYg==", lpUsedDefaultChar=0x0) returned 245 [0089.781] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0089.782] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0089.782] CloseHandle (hObject=0x158) returned 1 [0089.782] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386120.jpg")) returned 1 [0089.783] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=21004678383) returned 1 [0089.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [J0386267.JPG].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [j0386267.jpg].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0089.784] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0089.784] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0089.784] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0089.785] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0089.785] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0089.785] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0089.785] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0089.785] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0089.785] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0089.785] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0089.785] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0089.785] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0089.785] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0089.785] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0089.785] SetEndOfFile (hFile=0x158) returned 1 [0089.786] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0089.786] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0089.786] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0089.786] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0089.786] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0089.787] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0089.787] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="K7LD.mMv09QPik.}-ZdDeW6,cd.vhlQi", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0089.787] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="K7LD.mMv09QPik.}-ZdDeW6,cd.vhlQi", cchWideChar=32, lpMultiByteStr=0x203cb24, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="K7LD.mMv09QPik.}-ZdDeW6,cd.vhlQi", lpUsedDefaultChar=0x0) returned 32 [0089.787] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0089.787] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0089.787] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa91e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0386267.JPG", cAlternateFileName="")) returned 0x295098 [0089.788] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0089.788] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0089.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386267.jpg")) returned 0x20 [0089.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386267.jpg")) returned 0x20 [0089.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386267.jpg")) returned 0x20 [0089.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386267.jpg")) returned 0x20 [0089.788] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386267.jpg"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa91e)) returned 1 [0089.788] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0089.788] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0089.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386267.jpg")) returned 0x20 [0089.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386267.jpg")) returned 0x20 [0089.789] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0089.789] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0089.789] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0089.789] SetEndOfFile (hFile=0x158) returned 1 [0089.790] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0386267.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0089.790] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0386267.JPG", cchWideChar=12, lpMultiByteStr=0x1fe660c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0386267.JPG", lpUsedDefaultChar=0x0) returned 12 [0089.790] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0386267.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0089.790] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0386267.JPG", cchWideChar=12, lpMultiByteStr=0x1fe39ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0386267.JPG", lpUsedDefaultChar=0x0) returned 12 [0089.790] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe39ac, cbMultiByte=12, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="J0386267.JPGg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0089.790] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0386267.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0089.790] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0386267.JPG", cchWideChar=12, lpMultiByteStr=0x1fe660c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0386267.JPG", lpUsedDefaultChar=0x0) returned 12 [0089.790] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386267.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0089.791] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0089.791] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0xa91e [0089.791] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0089.791] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0089.791] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0089.791] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0386267.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0089.791] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0386267.JPG", cchWideChar=12, lpMultiByteStr=0x1fe660c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0386267.JPG", lpUsedDefaultChar=0x0) returned 12 [0089.791] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0386267.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0089.794] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0386267.JPG", cchWideChar=12, lpMultiByteStr=0x1fe39ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0386267.JPG", lpUsedDefaultChar=0x0) returned 12 [0089.794] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe39ac, cbMultiByte=12, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="J0386267.JPG67.JPGg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0089.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0386267.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0089.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0386267.JPG", cchWideChar=12, lpMultiByteStr=0x1fe660c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0386267.JPG", lpUsedDefaultChar=0x0) returned 12 [0089.795] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0089.796] CharToOemA (in: pSrc="J0386267.JPG", pDst=0x1fe39ac | out: pDst="J0386267.JPG") returned 1 [0089.796] WriteFile (in: hFile=0x158, lpBuffer=0x1fe39ac*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe39ac*, lpNumberOfBytesWritten=0x18e048*=0xc, lpOverlapped=0x0) returned 1 [0089.796] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0089.796] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0089.796] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0089.796] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=21005986595) returned 1 [0089.796] ReadFile (in: hFile=0x11c, lpBuffer=0x37e32c0, nNumberOfBytesToRead=0xa91e, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37e32c0*, lpNumberOfBytesRead=0x18dd7c*=0xa91e, lpOverlapped=0x0) returned 1 [0089.800] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0089.800] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=21006356706) returned 1 [0089.812] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b3d8*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b5b3d8*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0089.812] ReadFile (in: hFile=0x11c, lpBuffer=0x37e32c0, nNumberOfBytesToRead=0xa91e, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x37e32c0*, lpNumberOfBytesRead=0x18de38*=0xa91e, lpOverlapped=0x0) returned 1 [0089.814] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x47 [0089.814] WriteFile (in: hFile=0x158, lpBuffer=0x382f3e0*, nNumberOfBytesToWrite=0xa91e, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x382f3e0*, lpNumberOfBytesWritten=0x18de10*=0xa91e, lpOverlapped=0x0) returned 1 [0089.815] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0xa965 [0089.815] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0089.815] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0089.815] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0089.816] SetFilePointer (in: hFile=0x158, lDistanceToMove=12, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2a [0089.816] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0xa96f [0089.816] CloseHandle (hObject=0x11c) returned 1 [0089.816] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xa96f [0089.816] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xa96f [0089.816] SetFilePointer (in: hFile=0x158, lDistanceToMove=43375, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xa96f [0089.816] SetFilePointer (in: hFile=0x158, lDistanceToMove=43375, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0xa96f [0089.816] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xa96f [0089.816] SetFilePointer (in: hFile=0x158, lDistanceToMove=43375, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0xa96f [0089.816] SetEndOfFile (hFile=0x158) returned 1 [0089.817] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xa96f [0089.817] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xa96f [0089.817] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0386267.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0089.817] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0386267.JPG", cchWideChar=12, lpMultiByteStr=0x1fe660c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0386267.JPG", lpUsedDefaultChar=0x0) returned 12 [0089.817] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0386267.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0089.817] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0386267.JPG", cchWideChar=12, lpMultiByteStr=0x1fe358c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0386267.JPG", lpUsedDefaultChar=0x0) returned 12 [0089.817] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe358c, cbMultiByte=12, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="J0386267.JPGꞗ@涤(\x18믉`믑`") returned 12 [0089.817] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0386267.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0089.817] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0386267.JPG", cchWideChar=12, lpMultiByteStr=0x1fe660c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0386267.JPG", lpUsedDefaultChar=0x0) returned 12 [0089.817] WriteFile (in: hFile=0x158, lpBuffer=0x37c6d98*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x37c6d98*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0089.817] CharToOemA (in: pSrc="J0386267.JPG", pDst=0x1fe358c | out: pDst="J0386267.JPG") returned 1 [0089.817] WriteFile (in: hFile=0x158, lpBuffer=0x1fe358c*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe358c*, lpNumberOfBytesWritten=0x18efcc*=0xc, lpOverlapped=0x0) returned 1 [0089.818] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b350*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x3b5b350*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0089.818] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0089.818] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0089.818] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xa9b4 [0089.818] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xa9b4 [0089.818] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0089.818] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0089.818] DeleteFileW (lpFileName="") returned 0 [0089.818] GetLastError () returned 0x3 [0089.818] GetFileAttributesW (lpFileName="") returned 0xffffffff [0089.818] SetLastError (dwErrCode=0x3) [0089.818] FlushFileBuffers (hFile=0x158) returned 1 [0089.821] GetCurrentThreadId () returned 0x970 [0089.821] GetCurrentThreadId () returned 0x970 [0089.821] GetCurrentThreadId () returned 0x970 [0089.821] GetCurrentThreadId () returned 0x970 [0089.821] GetCurrentThreadId () returned 0x970 [0089.821] GetCurrentThreadId () returned 0x970 [0089.821] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xaa6b [0089.822] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xaa6b [0089.822] SetFilePointer (in: hFile=0x158, lDistanceToMove=43627, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xaa6b [0089.822] CloseHandle (hObject=0x158) returned 1 [0089.822] GetCurrentThreadId () returned 0x970 [0089.822] GetCurrentThreadId () returned 0x970 [0089.822] GetCurrentThreadId () returned 0x970 [0089.822] GetCurrentThreadId () returned 0x970 [0089.822] GetCurrentThreadId () returned 0x970 [0089.822] GetCurrentThreadId () returned 0x970 [0089.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [J0386267.JPG].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [j0386267.jpg].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0089.822] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xaa6b [0089.822] SetFilePointer (in: hFile=0x158, lDistanceToMove=43499, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa9eb [0089.822] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0089.822] GetFileType (hFile=0x158) returned 0x1 [0089.822] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x25, wMilliseconds=0x56)) [0089.822] GetCurrentThreadId () returned 0x970 [0089.822] GetCurrentThreadId () returned 0x970 [0089.823] GetCurrentThreadId () returned 0x970 [0089.823] GetCurrentThreadId () returned 0x970 [0089.823] GetCurrentThreadId () returned 0x970 [0089.823] GetCurrentThreadId () returned 0x970 [0089.823] GetCurrentThreadId () returned 0x970 [0089.823] GetCurrentThreadId () returned 0x970 [0089.823] GetCurrentThreadId () returned 0x970 [0089.823] GetCurrentThreadId () returned 0x970 [0089.823] GetCurrentThreadId () returned 0x970 [0089.823] GetCurrentThreadId () returned 0x970 [0089.823] GetCurrentThreadId () returned 0x970 [0089.823] GetCurrentThreadId () returned 0x970 [0089.823] GetCurrentThreadId () returned 0x970 [0089.823] GetCurrentThreadId () returned 0x970 [0089.823] GetCurrentThreadId () returned 0x970 [0089.823] GetCurrentThreadId () returned 0x970 [0089.823] GetCurrentThreadId () returned 0x970 [0089.823] GetCurrentThreadId () returned 0x970 [0089.823] GetCurrentThreadId () returned 0x970 [0089.823] GetCurrentThreadId () returned 0x970 [0089.823] GetCurrentThreadId () returned 0x970 [0089.823] GetCurrentThreadId () returned 0x970 [0089.823] GetCurrentThreadId () returned 0x970 [0089.823] GetCurrentThreadId () returned 0x970 [0089.823] GetCurrentThreadId () returned 0x970 [0089.823] GetCurrentThreadId () returned 0x970 [0089.823] GetCurrentThreadId () returned 0x970 [0089.823] GetCurrentThreadId () returned 0x970 [0089.823] GetCurrentThreadId () returned 0x970 [0089.823] GetCurrentThreadId () returned 0x970 [0089.823] GetCurrentThreadId () returned 0x970 [0089.823] GetCurrentThreadId () returned 0x970 [0089.823] GetCurrentThreadId () returned 0x970 [0089.824] GetCurrentThreadId () returned 0x970 [0089.824] GetCurrentThreadId () returned 0x970 [0089.824] GetCurrentThreadId () returned 0x970 [0089.824] GetCurrentThreadId () returned 0x970 [0089.824] GetCurrentThreadId () returned 0x970 [0089.824] GetCurrentThreadId () returned 0x970 [0089.824] GetCurrentThreadId () returned 0x970 [0089.824] GetCurrentThreadId () returned 0x970 [0089.824] GetCurrentThreadId () returned 0x970 [0089.824] GetCurrentThreadId () returned 0x970 [0089.824] GetCurrentThreadId () returned 0x970 [0089.824] GetCurrentThreadId () returned 0x970 [0089.824] GetCurrentThreadId () returned 0x970 [0089.824] GetCurrentThreadId () returned 0x970 [0089.824] GetCurrentThreadId () returned 0x970 [0089.824] GetCurrentThreadId () returned 0x970 [0089.824] GetCurrentThreadId () returned 0x970 [0089.824] GetCurrentThreadId () returned 0x970 [0089.824] GetCurrentThreadId () returned 0x970 [0089.824] GetCurrentThreadId () returned 0x970 [0089.824] GetCurrentThreadId () returned 0x970 [0089.824] GetCurrentThreadId () returned 0x970 [0089.824] GetCurrentThreadId () returned 0x970 [0089.824] GetCurrentThreadId () returned 0x970 [0089.824] GetCurrentThreadId () returned 0x970 [0089.824] GetCurrentThreadId () returned 0x970 [0089.824] GetCurrentThreadId () returned 0x970 [0089.824] GetCurrentThreadId () returned 0x970 [0089.824] GetCurrentThreadId () returned 0x970 [0089.824] GetCurrentThreadId () returned 0x970 [0089.824] GetCurrentThreadId () returned 0x970 [0089.824] GetCurrentThreadId () returned 0x970 [0089.824] GetCurrentThreadId () returned 0x970 [0089.824] GetCurrentThreadId () returned 0x970 [0089.824] GetCurrentThreadId () returned 0x970 [0089.824] GetCurrentThreadId () returned 0x970 [0089.824] GetCurrentThreadId () returned 0x970 [0089.824] GetCurrentThreadId () returned 0x970 [0089.824] GetCurrentThreadId () returned 0x970 [0089.825] GetCurrentThreadId () returned 0x970 [0089.825] GetCurrentThreadId () returned 0x970 [0089.825] GetCurrentThreadId () returned 0x970 [0089.825] GetCurrentThreadId () returned 0x970 [0089.825] GetCurrentThreadId () returned 0x970 [0089.825] GetCurrentThreadId () returned 0x970 [0089.825] GetCurrentThreadId () returned 0x970 [0089.825] GetCurrentThreadId () returned 0x970 [0089.825] GetCurrentThreadId () returned 0x970 [0089.825] GetCurrentThreadId () returned 0x970 [0089.825] GetCurrentThreadId () returned 0x970 [0089.825] GetCurrentThreadId () returned 0x970 [0089.825] GetCurrentThreadId () returned 0x970 [0089.825] GetCurrentThreadId () returned 0x970 [0089.825] GetCurrentThreadId () returned 0x970 [0089.825] GetCurrentThreadId () returned 0x970 [0089.825] GetCurrentThreadId () returned 0x970 [0089.825] GetCurrentThreadId () returned 0x970 [0089.825] GetCurrentThreadId () returned 0x970 [0089.825] GetCurrentThreadId () returned 0x970 [0089.825] GetCurrentThreadId () returned 0x970 [0089.825] GetCurrentThreadId () returned 0x970 [0089.825] GetCurrentThreadId () returned 0x970 [0089.825] GetCurrentThreadId () returned 0x970 [0089.825] GetCurrentThreadId () returned 0x970 [0089.825] GetCurrentThreadId () returned 0x970 [0089.825] GetCurrentThreadId () returned 0x970 [0089.825] GetCurrentThreadId () returned 0x970 [0089.825] GetCurrentThreadId () returned 0x970 [0089.825] GetCurrentThreadId () returned 0x970 [0089.825] GetCurrentThreadId () returned 0x970 [0089.825] GetCurrentThreadId () returned 0x970 [0089.825] GetCurrentThreadId () returned 0x970 [0089.825] GetCurrentThreadId () returned 0x970 [0089.825] GetCurrentThreadId () returned 0x970 [0089.825] GetCurrentThreadId () returned 0x970 [0089.825] GetCurrentThreadId () returned 0x970 [0089.825] GetCurrentThreadId () returned 0x970 [0089.825] GetCurrentThreadId () returned 0x970 [0089.826] GetCurrentThreadId () returned 0x970 [0089.826] GetCurrentThreadId () returned 0x970 [0089.826] GetCurrentThreadId () returned 0x970 [0089.826] GetCurrentThreadId () returned 0x970 [0089.826] GetCurrentThreadId () returned 0x970 [0089.826] GetCurrentThreadId () returned 0x970 [0089.826] GetCurrentThreadId () returned 0x970 [0089.826] GetCurrentThreadId () returned 0x970 [0089.826] GetCurrentThreadId () returned 0x970 [0089.826] GetCurrentThreadId () returned 0x970 [0089.826] GetCurrentThreadId () returned 0x970 [0089.826] GetCurrentThreadId () returned 0x970 [0089.826] GetCurrentThreadId () returned 0x970 [0089.826] GetCurrentThreadId () returned 0x970 [0089.826] GetCurrentThreadId () returned 0x970 [0089.826] GetCurrentThreadId () returned 0x970 [0089.826] GetCurrentThreadId () returned 0x970 [0089.826] GetCurrentThreadId () returned 0x970 [0089.826] GetCurrentThreadId () returned 0x970 [0089.826] GetCurrentThreadId () returned 0x970 [0089.826] GetCurrentThreadId () returned 0x970 [0089.826] GetCurrentThreadId () returned 0x970 [0089.826] GetCurrentThreadId () returned 0x970 [0089.826] GetCurrentThreadId () returned 0x970 [0089.826] GetCurrentThreadId () returned 0x970 [0089.826] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0089.827] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0089.827] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5fbb0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0089.827] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0089.827] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0089.827] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5fbb0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0089.827] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0089.827] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0089.827] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b530, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0089.827] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0089.827] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0089.827] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b530, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0089.827] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0089.827] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0089.827] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5fc10, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0089.827] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0089.827] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0089.827] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5fc10, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0089.827] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0089.827] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0089.827] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5fc10, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0089.827] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x25, wMilliseconds=0x66)) [0089.827] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="K7LD.mMv09QPik.}-ZdDeW6,cd.vhlQi", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0089.827] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="K7LD.mMv09QPik.}-ZdDeW6,cd.vhlQi", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0089.827] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="K7LD.mMv09QPik.}-ZdDeW6,cd.vhlQi", cchWideChar=32, lpMultiByteStr=0x3b56be8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="K7LD.mMv09QPik.}-ZdDeW6,cd.vhlQi", lpUsedDefaultChar=0x0) returned 32 [0089.827] GetCurrentThreadId () returned 0x970 [0089.827] GetCurrentThreadId () returned 0x970 [0089.828] GetCurrentThreadId () returned 0x970 [0089.828] GetCurrentThreadId () returned 0x970 [0089.828] GetCurrentThreadId () returned 0x970 [0089.828] GetCurrentThreadId () returned 0x970 [0089.835] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0089.836] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0089.836] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3b89898, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0089.836] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0089.836] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAF5l5v/dj/+bCfrpou7kXHXH1QqH/hGX9Xsm96Ko9FFgZaeJbeXhJIR1JVsPmWw59+f0m/qOldOvepjjfA3I8mWtFCDXn2u/PgaJMFju6HRsW/82dWEnUYSp/b1dFIeTvjqPIY/S1G853RQJv1OGjDq1+u5dJzIYS7Szqg6VON6JKLu/DZdJXhQIa4Zb/9jA8CyRW0K5+WvJXx4ZokueNGN2e7ACXCho7g==") returned 232 [0089.836] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x25, wMilliseconds=0x66)) [0089.836] GetCurrentThreadId () returned 0x970 [0089.836] GetCurrentThreadId () returned 0x970 [0089.836] GetCurrentThreadId () returned 0x970 [0089.836] GetCurrentThreadId () returned 0x970 [0089.836] GetCurrentThreadId () returned 0x970 [0089.836] GetCurrentThreadId () returned 0x970 [0089.836] GetCurrentThreadId () returned 0x970 [0089.836] GetCurrentThreadId () returned 0x970 [0089.836] GetCurrentThreadId () returned 0x970 [0089.836] GetCurrentThreadId () returned 0x970 [0089.836] GetCurrentThreadId () returned 0x970 [0089.836] GetCurrentThreadId () returned 0x970 [0089.836] GetCurrentThreadId () returned 0x970 [0089.836] GetCurrentThreadId () returned 0x970 [0089.836] GetCurrentThreadId () returned 0x970 [0089.836] GetCurrentThreadId () returned 0x970 [0089.836] GetCurrentThreadId () returned 0x970 [0089.836] GetCurrentThreadId () returned 0x970 [0089.837] GetCurrentThreadId () returned 0x970 [0089.837] GetCurrentThreadId () returned 0x970 [0089.837] GetCurrentThreadId () returned 0x970 [0089.837] GetCurrentThreadId () returned 0x970 [0089.837] GetCurrentThreadId () returned 0x970 [0089.837] GetCurrentThreadId () returned 0x970 [0089.837] GetCurrentThreadId () returned 0x970 [0089.837] GetCurrentThreadId () returned 0x970 [0089.837] GetCurrentThreadId () returned 0x970 [0089.837] GetCurrentThreadId () returned 0x970 [0089.837] GetCurrentThreadId () returned 0x970 [0089.837] GetCurrentThreadId () returned 0x970 [0089.837] GetCurrentThreadId () returned 0x970 [0089.837] GetCurrentThreadId () returned 0x970 [0089.837] GetCurrentThreadId () returned 0x970 [0089.837] GetCurrentThreadId () returned 0x970 [0089.837] GetCurrentThreadId () returned 0x970 [0089.837] GetCurrentThreadId () returned 0x970 [0089.837] GetCurrentThreadId () returned 0x970 [0089.837] GetCurrentThreadId () returned 0x970 [0089.837] GetCurrentThreadId () returned 0x970 [0089.837] GetCurrentThreadId () returned 0x970 [0089.837] GetCurrentThreadId () returned 0x970 [0089.837] GetCurrentThreadId () returned 0x970 [0089.837] GetCurrentThreadId () returned 0x970 [0089.837] GetCurrentThreadId () returned 0x970 [0089.837] GetCurrentThreadId () returned 0x970 [0089.837] GetCurrentThreadId () returned 0x970 [0089.837] GetCurrentThreadId () returned 0x970 [0089.837] GetCurrentThreadId () returned 0x970 [0089.837] GetCurrentThreadId () returned 0x970 [0089.837] GetCurrentThreadId () returned 0x970 [0089.837] GetCurrentThreadId () returned 0x970 [0089.837] GetCurrentThreadId () returned 0x970 [0089.837] GetCurrentThreadId () returned 0x970 [0089.837] GetCurrentThreadId () returned 0x970 [0089.837] GetCurrentThreadId () returned 0x970 [0089.837] GetCurrentThreadId () returned 0x970 [0089.837] GetCurrentThreadId () returned 0x970 [0089.838] GetCurrentThreadId () returned 0x970 [0089.838] GetCurrentThreadId () returned 0x970 [0089.838] GetCurrentThreadId () returned 0x970 [0089.838] GetCurrentThreadId () returned 0x970 [0089.838] GetCurrentThreadId () returned 0x970 [0089.838] GetCurrentThreadId () returned 0x970 [0089.838] GetCurrentThreadId () returned 0x970 [0089.838] GetCurrentThreadId () returned 0x970 [0089.838] GetCurrentThreadId () returned 0x970 [0089.838] GetCurrentThreadId () returned 0x970 [0089.838] GetCurrentThreadId () returned 0x970 [0089.838] GetCurrentThreadId () returned 0x970 [0089.838] GetCurrentThreadId () returned 0x970 [0089.838] GetCurrentThreadId () returned 0x970 [0089.838] GetCurrentThreadId () returned 0x970 [0089.838] GetCurrentThreadId () returned 0x970 [0089.838] GetCurrentThreadId () returned 0x970 [0089.838] GetCurrentThreadId () returned 0x970 [0089.838] GetCurrentThreadId () returned 0x970 [0089.838] GetCurrentThreadId () returned 0x970 [0089.838] GetCurrentThreadId () returned 0x970 [0089.838] GetCurrentThreadId () returned 0x970 [0089.838] GetCurrentThreadId () returned 0x970 [0089.838] GetCurrentThreadId () returned 0x970 [0089.838] GetCurrentThreadId () returned 0x970 [0089.838] GetCurrentThreadId () returned 0x970 [0089.838] GetCurrentThreadId () returned 0x970 [0089.838] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAF5l5v/dj/+bCfrpou7kXHXH1QqH/hGX9Xsm96Ko9FFgZaeJbeXhJIR1JVsPmWw59+f0m/qOldOvepjjfA3I8mWtFCDXn2u/PgaJMFju6HRsW/82dWEnUYSp/b1dFIeTvjqPIY/S1G853RQJv1OGjDq1+u5dJzIYS7Szqg6VON6JKLu/DZdJXhQIa4Zb/9jA8CyRW0K5+WvJXx4ZokueNGN2e7ACXCho7g==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0089.838] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAF5l5v/dj/+bCfrpou7kXHXH1QqH/hGX9Xsm96Ko9FFgZaeJbeXhJIR1JVsPmWw59+f0m/qOldOvepjjfA3I8mWtFCDXn2u/PgaJMFju6HRsW/82dWEnUYSp/b1dFIeTvjqPIY/S1G853RQJv1OGjDq1+u5dJzIYS7Szqg6VON6JKLu/DZdJXhQIa4Zb/9jA8CyRW0K5+WvJXx4ZokueNGN2e7ACXCho7g==", cchWideChar=245, lpMultiByteStr=0x3b4d08c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAF5l5v/dj/+bCfrpou7kXHXH1QqH/hGX9Xsm96Ko9FFgZaeJbeXhJIR1JVsPmWw59+f0m/qOldOvepjjfA3I8mWtFCDXn2u/PgaJMFju6HRsW/82dWEnUYSp/b1dFIeTvjqPIY/S1G853RQJv1OGjDq1+u5dJzIYS7Szqg6VON6JKLu/DZdJXhQIa4Zb/9jA8CyRW0K5+WvJXx4ZokueNGN2e7ACXCho7g==", lpUsedDefaultChar=0x0) returned 245 [0089.838] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0089.839] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0089.839] CloseHandle (hObject=0x158) returned 1 [0089.839] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386267.jpg")) returned 1 [0089.840] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=21010373081) returned 1 [0089.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [J0386270.JPG].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [j0386270.jpg].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0089.841] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0089.841] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0089.841] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0089.841] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0089.841] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0089.841] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0089.841] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0089.842] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0089.842] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0089.842] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0089.842] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0089.842] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0089.842] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0089.842] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0089.842] SetEndOfFile (hFile=0x158) returned 1 [0089.842] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0089.842] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0089.842] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0089.842] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0089.842] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0089.843] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0089.844] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b5YrflX\\Xg1v\\o+y)w,Rpj#5iu^4wxZR", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0089.844] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b5YrflX\\Xg1v\\o+y)w,Rpj#5iu^4wxZR", cchWideChar=32, lpMultiByteStr=0x203cb5c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b5YrflX\\Xg1v\\o+y)w,Rpj#5iu^4wxZR", lpUsedDefaultChar=0x0) returned 32 [0089.844] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0089.844] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0089.844] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3b43, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0386270.JPG", cAlternateFileName="")) returned 0x295098 [0089.844] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0089.844] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0089.844] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386270.jpg")) returned 0x20 [0089.845] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386270.jpg")) returned 0x20 [0089.845] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386270.jpg")) returned 0x20 [0089.845] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386270.jpg")) returned 0x20 [0089.845] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386270.jpg"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3b43)) returned 1 [0089.845] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0089.845] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0089.845] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386270.jpg")) returned 0x20 [0089.845] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386270.jpg")) returned 0x20 [0089.846] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0089.846] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0089.846] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0089.846] SetEndOfFile (hFile=0x158) returned 1 [0089.847] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0386270.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0089.847] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0386270.JPG", cchWideChar=12, lpMultiByteStr=0x1fe658c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0386270.JPG", lpUsedDefaultChar=0x0) returned 12 [0089.847] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0386270.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0089.847] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0386270.JPG", cchWideChar=12, lpMultiByteStr=0x1fe432c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0386270.JPG", lpUsedDefaultChar=0x0) returned 12 [0089.847] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe432c, cbMultiByte=12, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="J0386270.JPGg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0089.847] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0386270.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0089.847] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0386270.JPG", cchWideChar=12, lpMultiByteStr=0x1fe658c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0386270.JPG", lpUsedDefaultChar=0x0) returned 12 [0089.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386270.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0089.847] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0089.847] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x3b43 [0089.847] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0089.847] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0089.847] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0089.848] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0386270.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0089.848] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0386270.JPG", cchWideChar=12, lpMultiByteStr=0x1fe658c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0386270.JPG", lpUsedDefaultChar=0x0) returned 12 [0089.848] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0386270.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0089.848] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0386270.JPG", cchWideChar=12, lpMultiByteStr=0x1fe432c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0386270.JPG", lpUsedDefaultChar=0x0) returned 12 [0089.848] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe432c, cbMultiByte=12, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="J0386270.JPG70.JPGg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0089.848] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0386270.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0089.848] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0386270.JPG", cchWideChar=12, lpMultiByteStr=0x1fe658c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0386270.JPG", lpUsedDefaultChar=0x0) returned 12 [0089.848] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0089.849] CharToOemA (in: pSrc="J0386270.JPG", pDst=0x1fe432c | out: pDst="J0386270.JPG") returned 1 [0089.849] WriteFile (in: hFile=0x158, lpBuffer=0x1fe432c*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe432c*, lpNumberOfBytesWritten=0x18e048*=0xc, lpOverlapped=0x0) returned 1 [0089.849] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0089.849] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0089.849] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0089.849] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=21011265302) returned 1 [0089.849] ReadFile (in: hFile=0x11c, lpBuffer=0x37e32c0, nNumberOfBytesToRead=0x3b43, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37e32c0*, lpNumberOfBytesRead=0x18dd7c*=0x3b43, lpOverlapped=0x0) returned 1 [0089.872] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0089.872] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=21013564959) returned 1 [0089.881] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b3c0*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b5b3c0*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0089.881] ReadFile (in: hFile=0x11c, lpBuffer=0x37e32c0, nNumberOfBytesToRead=0x3b43, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x37e32c0*, lpNumberOfBytesRead=0x18de38*=0x3b43, lpOverlapped=0x0) returned 1 [0089.882] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x47 [0089.882] WriteFile (in: hFile=0x158, lpBuffer=0x38286e0*, nNumberOfBytesToWrite=0x3b43, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x38286e0*, lpNumberOfBytesWritten=0x18de10*=0x3b43, lpOverlapped=0x0) returned 1 [0089.882] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x3b8a [0089.882] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0089.882] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0089.882] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0089.882] SetFilePointer (in: hFile=0x158, lDistanceToMove=12, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2a [0089.882] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x3b94 [0089.882] CloseHandle (hObject=0x11c) returned 1 [0089.883] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x3b94 [0089.883] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x3b94 [0089.883] SetFilePointer (in: hFile=0x158, lDistanceToMove=15252, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x3b94 [0089.883] SetFilePointer (in: hFile=0x158, lDistanceToMove=15252, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x3b94 [0089.883] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x3b94 [0089.883] SetFilePointer (in: hFile=0x158, lDistanceToMove=15252, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x3b94 [0089.883] SetEndOfFile (hFile=0x158) returned 1 [0089.883] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x3b94 [0089.883] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x3b94 [0089.883] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0386270.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0089.883] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0386270.JPG", cchWideChar=12, lpMultiByteStr=0x1fe658c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0386270.JPG", lpUsedDefaultChar=0x0) returned 12 [0089.883] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0386270.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0089.883] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0386270.JPG", cchWideChar=12, lpMultiByteStr=0x1fe98cc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0386270.JPG", lpUsedDefaultChar=0x0) returned 12 [0089.883] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe98cc, cbMultiByte=12, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="J0386270.JPGꞗ@涤(\x18믉`믑`") returned 12 [0089.883] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0386270.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0089.883] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0386270.JPG", cchWideChar=12, lpMultiByteStr=0x1fe658c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0386270.JPG", lpUsedDefaultChar=0x0) returned 12 [0089.884] WriteFile (in: hFile=0x158, lpBuffer=0x37c6d98*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x37c6d98*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0089.884] CharToOemA (in: pSrc="J0386270.JPG", pDst=0x1fe98cc | out: pDst="J0386270.JPG") returned 1 [0089.884] WriteFile (in: hFile=0x158, lpBuffer=0x1fe98cc*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe98cc*, lpNumberOfBytesWritten=0x18efcc*=0xc, lpOverlapped=0x0) returned 1 [0089.884] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b3b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x3b5b3b0*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0089.884] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0089.884] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0089.884] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x3bd9 [0089.884] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x3bd9 [0089.884] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0089.884] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0089.884] DeleteFileW (lpFileName="") returned 0 [0089.884] GetLastError () returned 0x3 [0089.884] GetFileAttributesW (lpFileName="") returned 0xffffffff [0089.884] SetLastError (dwErrCode=0x3) [0089.884] FlushFileBuffers (hFile=0x158) returned 1 [0089.888] GetCurrentThreadId () returned 0x970 [0089.888] GetCurrentThreadId () returned 0x970 [0089.888] GetCurrentThreadId () returned 0x970 [0089.888] GetCurrentThreadId () returned 0x970 [0089.888] GetCurrentThreadId () returned 0x970 [0089.888] GetCurrentThreadId () returned 0x970 [0089.888] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x3c90 [0089.888] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x3c90 [0089.888] SetFilePointer (in: hFile=0x158, lDistanceToMove=15504, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x3c90 [0089.888] CloseHandle (hObject=0x158) returned 1 [0089.888] GetCurrentThreadId () returned 0x970 [0089.888] GetCurrentThreadId () returned 0x970 [0089.888] GetCurrentThreadId () returned 0x970 [0089.888] GetCurrentThreadId () returned 0x970 [0089.888] GetCurrentThreadId () returned 0x970 [0089.888] GetCurrentThreadId () returned 0x970 [0089.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [J0386270.JPG].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [j0386270.jpg].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0089.888] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3c90 [0089.888] SetFilePointer (in: hFile=0x158, lDistanceToMove=15376, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3c10 [0089.888] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0089.889] GetFileType (hFile=0x158) returned 0x1 [0089.889] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x25, wMilliseconds=0xa4)) [0089.889] GetCurrentThreadId () returned 0x970 [0089.889] GetCurrentThreadId () returned 0x970 [0089.889] GetCurrentThreadId () returned 0x970 [0089.889] GetCurrentThreadId () returned 0x970 [0089.889] GetCurrentThreadId () returned 0x970 [0089.889] GetCurrentThreadId () returned 0x970 [0089.889] GetCurrentThreadId () returned 0x970 [0089.889] GetCurrentThreadId () returned 0x970 [0089.889] GetCurrentThreadId () returned 0x970 [0089.889] GetCurrentThreadId () returned 0x970 [0089.889] GetCurrentThreadId () returned 0x970 [0089.889] GetCurrentThreadId () returned 0x970 [0089.889] GetCurrentThreadId () returned 0x970 [0089.889] GetCurrentThreadId () returned 0x970 [0089.889] GetCurrentThreadId () returned 0x970 [0089.889] GetCurrentThreadId () returned 0x970 [0089.889] GetCurrentThreadId () returned 0x970 [0089.889] GetCurrentThreadId () returned 0x970 [0089.889] GetCurrentThreadId () returned 0x970 [0089.889] GetCurrentThreadId () returned 0x970 [0089.889] GetCurrentThreadId () returned 0x970 [0089.889] GetCurrentThreadId () returned 0x970 [0089.889] GetCurrentThreadId () returned 0x970 [0089.889] GetCurrentThreadId () returned 0x970 [0089.889] GetCurrentThreadId () returned 0x970 [0089.889] GetCurrentThreadId () returned 0x970 [0089.889] GetCurrentThreadId () returned 0x970 [0089.889] GetCurrentThreadId () returned 0x970 [0089.889] GetCurrentThreadId () returned 0x970 [0089.889] GetCurrentThreadId () returned 0x970 [0089.889] GetCurrentThreadId () returned 0x970 [0089.889] GetCurrentThreadId () returned 0x970 [0089.889] GetCurrentThreadId () returned 0x970 [0089.889] GetCurrentThreadId () returned 0x970 [0089.889] GetCurrentThreadId () returned 0x970 [0089.889] GetCurrentThreadId () returned 0x970 [0089.889] GetCurrentThreadId () returned 0x970 [0089.889] GetCurrentThreadId () returned 0x970 [0089.889] GetCurrentThreadId () returned 0x970 [0089.890] GetCurrentThreadId () returned 0x970 [0089.890] GetCurrentThreadId () returned 0x970 [0089.890] GetCurrentThreadId () returned 0x970 [0089.890] GetCurrentThreadId () returned 0x970 [0089.890] GetCurrentThreadId () returned 0x970 [0089.890] GetCurrentThreadId () returned 0x970 [0089.890] GetCurrentThreadId () returned 0x970 [0089.890] GetCurrentThreadId () returned 0x970 [0089.890] GetCurrentThreadId () returned 0x970 [0089.890] GetCurrentThreadId () returned 0x970 [0089.890] GetCurrentThreadId () returned 0x970 [0089.890] GetCurrentThreadId () returned 0x970 [0089.890] GetCurrentThreadId () returned 0x970 [0089.890] GetCurrentThreadId () returned 0x970 [0089.890] GetCurrentThreadId () returned 0x970 [0089.890] GetCurrentThreadId () returned 0x970 [0089.890] GetCurrentThreadId () returned 0x970 [0089.890] GetCurrentThreadId () returned 0x970 [0089.890] GetCurrentThreadId () returned 0x970 [0089.890] GetCurrentThreadId () returned 0x970 [0089.890] GetCurrentThreadId () returned 0x970 [0089.890] GetCurrentThreadId () returned 0x970 [0089.890] GetCurrentThreadId () returned 0x970 [0089.890] GetCurrentThreadId () returned 0x970 [0089.890] GetCurrentThreadId () returned 0x970 [0089.890] GetCurrentThreadId () returned 0x970 [0089.890] GetCurrentThreadId () returned 0x970 [0089.890] GetCurrentThreadId () returned 0x970 [0089.890] GetCurrentThreadId () returned 0x970 [0089.890] GetCurrentThreadId () returned 0x970 [0089.890] GetCurrentThreadId () returned 0x970 [0089.890] GetCurrentThreadId () returned 0x970 [0089.890] GetCurrentThreadId () returned 0x970 [0089.890] GetCurrentThreadId () returned 0x970 [0089.890] GetCurrentThreadId () returned 0x970 [0089.890] GetCurrentThreadId () returned 0x970 [0089.890] GetCurrentThreadId () returned 0x970 [0089.890] GetCurrentThreadId () returned 0x970 [0089.890] GetCurrentThreadId () returned 0x970 [0089.890] GetCurrentThreadId () returned 0x970 [0089.890] GetCurrentThreadId () returned 0x970 [0089.890] GetCurrentThreadId () returned 0x970 [0089.890] GetCurrentThreadId () returned 0x970 [0089.890] GetCurrentThreadId () returned 0x970 [0089.890] GetCurrentThreadId () returned 0x970 [0089.891] GetCurrentThreadId () returned 0x970 [0089.891] GetCurrentThreadId () returned 0x970 [0089.891] GetCurrentThreadId () returned 0x970 [0089.891] GetCurrentThreadId () returned 0x970 [0089.891] GetCurrentThreadId () returned 0x970 [0089.891] GetCurrentThreadId () returned 0x970 [0089.891] GetCurrentThreadId () returned 0x970 [0089.891] GetCurrentThreadId () returned 0x970 [0089.891] GetCurrentThreadId () returned 0x970 [0089.891] GetCurrentThreadId () returned 0x970 [0089.891] GetCurrentThreadId () returned 0x970 [0089.891] GetCurrentThreadId () returned 0x970 [0089.891] GetCurrentThreadId () returned 0x970 [0089.891] GetCurrentThreadId () returned 0x970 [0089.891] GetCurrentThreadId () returned 0x970 [0089.891] GetCurrentThreadId () returned 0x970 [0089.891] GetCurrentThreadId () returned 0x970 [0089.891] GetCurrentThreadId () returned 0x970 [0089.891] GetCurrentThreadId () returned 0x970 [0089.891] GetCurrentThreadId () returned 0x970 [0089.891] GetCurrentThreadId () returned 0x970 [0089.891] GetCurrentThreadId () returned 0x970 [0089.891] GetCurrentThreadId () returned 0x970 [0089.891] GetCurrentThreadId () returned 0x970 [0089.891] GetCurrentThreadId () returned 0x970 [0089.891] GetCurrentThreadId () returned 0x970 [0089.891] GetCurrentThreadId () returned 0x970 [0089.891] GetCurrentThreadId () returned 0x970 [0089.891] GetCurrentThreadId () returned 0x970 [0089.891] GetCurrentThreadId () returned 0x970 [0089.891] GetCurrentThreadId () returned 0x970 [0089.891] GetCurrentThreadId () returned 0x970 [0089.891] GetCurrentThreadId () returned 0x970 [0089.891] GetCurrentThreadId () returned 0x970 [0089.891] GetCurrentThreadId () returned 0x970 [0089.891] GetCurrentThreadId () returned 0x970 [0089.891] GetCurrentThreadId () returned 0x970 [0089.891] GetCurrentThreadId () returned 0x970 [0089.891] GetCurrentThreadId () returned 0x970 [0089.891] GetCurrentThreadId () returned 0x970 [0089.891] GetCurrentThreadId () returned 0x970 [0089.891] GetCurrentThreadId () returned 0x970 [0089.891] GetCurrentThreadId () returned 0x970 [0089.891] GetCurrentThreadId () returned 0x970 [0089.891] GetCurrentThreadId () returned 0x970 [0089.892] GetCurrentThreadId () returned 0x970 [0089.892] GetCurrentThreadId () returned 0x970 [0089.892] GetCurrentThreadId () returned 0x970 [0089.892] GetCurrentThreadId () returned 0x970 [0089.892] GetCurrentThreadId () returned 0x970 [0089.892] GetCurrentThreadId () returned 0x970 [0089.892] GetCurrentThreadId () returned 0x970 [0089.892] GetCurrentThreadId () returned 0x970 [0089.892] GetCurrentThreadId () returned 0x970 [0089.892] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0089.892] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0089.892] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5fc10, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0089.892] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0089.892] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0089.892] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5fc10, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0089.892] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0089.892] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0089.892] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b548, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0089.892] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0089.892] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0089.892] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b548, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0089.892] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0089.892] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0089.892] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5fc70, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0089.892] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0089.892] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0089.892] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5fc70, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0089.892] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0089.892] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0089.892] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5fc70, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0089.892] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x25, wMilliseconds=0xa4)) [0089.893] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="b5YrflX\\Xg1v\\o+y)w,Rpj#5iu^4wxZR", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0089.893] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="b5YrflX\\Xg1v\\o+y)w,Rpj#5iu^4wxZR", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0089.893] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="b5YrflX\\Xg1v\\o+y)w,Rpj#5iu^4wxZR", cchWideChar=32, lpMultiByteStr=0x3b56c18, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b5YrflX\\Xg1v\\o+y)w,Rpj#5iu^4wxZR", lpUsedDefaultChar=0x0) returned 32 [0089.893] GetCurrentThreadId () returned 0x970 [0089.893] GetCurrentThreadId () returned 0x970 [0089.893] GetCurrentThreadId () returned 0x970 [0089.893] GetCurrentThreadId () returned 0x970 [0089.893] GetCurrentThreadId () returned 0x970 [0089.893] GetCurrentThreadId () returned 0x970 [0089.901] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0089.901] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0089.901] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3b89988, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0089.901] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0089.901] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAFQRpoGYdSM9+xci4svvzztFC6NcwJsEbfAvsHkNCTQy7AGnFqbZRF3AiUPnAb3AgwxHRLFwTJ8y/tvv9MgaLNnBkvKPXS9g5F+o4IEpBeXMjv4MiPO2zpMhB80dz7fccYIaJvGEbEU9Q2/JAng/n4/PqFVMKbrgt1nVMRP+SmQR5sicswCd5pSIN/Z+Z9aRA5DkEldA5BHWXELAW9iYo9CzT/Wu9DjZdw==") returned 232 [0089.901] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x25, wMilliseconds=0xb4)) [0089.901] GetCurrentThreadId () returned 0x970 [0089.901] GetCurrentThreadId () returned 0x970 [0089.901] GetCurrentThreadId () returned 0x970 [0089.901] GetCurrentThreadId () returned 0x970 [0089.901] GetCurrentThreadId () returned 0x970 [0089.901] GetCurrentThreadId () returned 0x970 [0089.901] GetCurrentThreadId () returned 0x970 [0089.901] GetCurrentThreadId () returned 0x970 [0089.901] GetCurrentThreadId () returned 0x970 [0089.901] GetCurrentThreadId () returned 0x970 [0089.901] GetCurrentThreadId () returned 0x970 [0089.901] GetCurrentThreadId () returned 0x970 [0089.901] GetCurrentThreadId () returned 0x970 [0089.901] GetCurrentThreadId () returned 0x970 [0089.901] GetCurrentThreadId () returned 0x970 [0089.901] GetCurrentThreadId () returned 0x970 [0089.902] GetCurrentThreadId () returned 0x970 [0089.902] GetCurrentThreadId () returned 0x970 [0089.902] GetCurrentThreadId () returned 0x970 [0089.902] GetCurrentThreadId () returned 0x970 [0089.902] GetCurrentThreadId () returned 0x970 [0089.902] GetCurrentThreadId () returned 0x970 [0089.902] GetCurrentThreadId () returned 0x970 [0089.902] GetCurrentThreadId () returned 0x970 [0089.902] GetCurrentThreadId () returned 0x970 [0089.902] GetCurrentThreadId () returned 0x970 [0089.902] GetCurrentThreadId () returned 0x970 [0089.902] GetCurrentThreadId () returned 0x970 [0089.902] GetCurrentThreadId () returned 0x970 [0089.902] GetCurrentThreadId () returned 0x970 [0089.902] GetCurrentThreadId () returned 0x970 [0089.902] GetCurrentThreadId () returned 0x970 [0089.902] GetCurrentThreadId () returned 0x970 [0089.902] GetCurrentThreadId () returned 0x970 [0089.902] GetCurrentThreadId () returned 0x970 [0089.902] GetCurrentThreadId () returned 0x970 [0089.902] GetCurrentThreadId () returned 0x970 [0089.902] GetCurrentThreadId () returned 0x970 [0089.902] GetCurrentThreadId () returned 0x970 [0089.902] GetCurrentThreadId () returned 0x970 [0089.902] GetCurrentThreadId () returned 0x970 [0089.902] GetCurrentThreadId () returned 0x970 [0089.902] GetCurrentThreadId () returned 0x970 [0089.902] GetCurrentThreadId () returned 0x970 [0089.902] GetCurrentThreadId () returned 0x970 [0089.902] GetCurrentThreadId () returned 0x970 [0089.902] GetCurrentThreadId () returned 0x970 [0089.902] GetCurrentThreadId () returned 0x970 [0089.902] GetCurrentThreadId () returned 0x970 [0089.902] GetCurrentThreadId () returned 0x970 [0089.902] GetCurrentThreadId () returned 0x970 [0089.902] GetCurrentThreadId () returned 0x970 [0089.902] GetCurrentThreadId () returned 0x970 [0089.902] GetCurrentThreadId () returned 0x970 [0089.902] GetCurrentThreadId () returned 0x970 [0089.902] GetCurrentThreadId () returned 0x970 [0089.902] GetCurrentThreadId () returned 0x970 [0089.902] GetCurrentThreadId () returned 0x970 [0089.902] GetCurrentThreadId () returned 0x970 [0089.902] GetCurrentThreadId () returned 0x970 [0089.903] GetCurrentThreadId () returned 0x970 [0089.903] GetCurrentThreadId () returned 0x970 [0089.903] GetCurrentThreadId () returned 0x970 [0089.903] GetCurrentThreadId () returned 0x970 [0089.903] GetCurrentThreadId () returned 0x970 [0089.903] GetCurrentThreadId () returned 0x970 [0089.903] GetCurrentThreadId () returned 0x970 [0089.903] GetCurrentThreadId () returned 0x970 [0089.903] GetCurrentThreadId () returned 0x970 [0089.903] GetCurrentThreadId () returned 0x970 [0089.903] GetCurrentThreadId () returned 0x970 [0089.903] GetCurrentThreadId () returned 0x970 [0089.903] GetCurrentThreadId () returned 0x970 [0089.903] GetCurrentThreadId () returned 0x970 [0089.903] GetCurrentThreadId () returned 0x970 [0089.903] GetCurrentThreadId () returned 0x970 [0089.903] GetCurrentThreadId () returned 0x970 [0089.903] GetCurrentThreadId () returned 0x970 [0089.903] GetCurrentThreadId () returned 0x970 [0089.903] GetCurrentThreadId () returned 0x970 [0089.903] GetCurrentThreadId () returned 0x970 [0089.903] GetCurrentThreadId () returned 0x970 [0089.903] GetCurrentThreadId () returned 0x970 [0089.903] GetCurrentThreadId () returned 0x970 [0089.903] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAFQRpoGYdSM9+xci4svvzztFC6NcwJsEbfAvsHkNCTQy7AGnFqbZRF3AiUPnAb3AgwxHRLFwTJ8y/tvv9MgaLNnBkvKPXS9g5F+o4IEpBeXMjv4MiPO2zpMhB80dz7fccYIaJvGEbEU9Q2/JAng/n4/PqFVMKbrgt1nVMRP+SmQR5sicswCd5pSIN/Z+Z9aRA5DkEldA5BHWXELAW9iYo9CzT/Wu9DjZdw==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0089.903] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAFQRpoGYdSM9+xci4svvzztFC6NcwJsEbfAvsHkNCTQy7AGnFqbZRF3AiUPnAb3AgwxHRLFwTJ8y/tvv9MgaLNnBkvKPXS9g5F+o4IEpBeXMjv4MiPO2zpMhB80dz7fccYIaJvGEbEU9Q2/JAng/n4/PqFVMKbrgt1nVMRP+SmQR5sicswCd5pSIN/Z+Z9aRA5DkEldA5BHWXELAW9iYo9CzT/Wu9DjZdw==", cchWideChar=245, lpMultiByteStr=0x3b4d08c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAFQRpoGYdSM9+xci4svvzztFC6NcwJsEbfAvsHkNCTQy7AGnFqbZRF3AiUPnAb3AgwxHRLFwTJ8y/tvv9MgaLNnBkvKPXS9g5F+o4IEpBeXMjv4MiPO2zpMhB80dz7fccYIaJvGEbEU9Q2/JAng/n4/PqFVMKbrgt1nVMRP+SmQR5sicswCd5pSIN/Z+Z9aRA5DkEldA5BHWXELAW9iYo9CzT/Wu9DjZdw==", lpUsedDefaultChar=0x0) returned 245 [0089.903] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0089.903] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0089.903] CloseHandle (hObject=0x158) returned 1 [0089.904] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386270.jpg")) returned 1 [0089.905] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=21016801623) returned 1 [0089.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [J0386485.JPG].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [j0386485.jpg].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0089.905] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0089.905] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0089.905] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0089.905] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0089.906] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0089.906] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0089.906] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0089.906] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0089.906] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0089.906] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0089.906] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0089.906] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0089.906] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0089.906] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0089.906] SetEndOfFile (hFile=0x158) returned 1 [0089.906] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0089.906] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0089.906] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0089.906] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0089.906] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0089.907] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0089.907] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="EJ>8\"mcJ-b{Ti+VxIl)qReq-~*N$hGU!", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0089.907] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="EJ>8\"mcJ-b{Ti+VxIl)qReq-~*N$hGU!", cchWideChar=32, lpMultiByteStr=0x203cb94, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EJ>8\"mcJ-b{Ti+VxIl)qReq-~*N$hGU!", lpUsedDefaultChar=0x0) returned 32 [0089.908] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0089.908] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0089.908] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x396a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0386485.JPG", cAlternateFileName="")) returned 0x295098 [0089.908] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0089.908] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0089.908] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386485.jpg")) returned 0x20 [0089.908] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386485.jpg")) returned 0x20 [0089.908] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386485.jpg")) returned 0x20 [0089.908] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386485.jpg")) returned 0x20 [0089.908] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386485.jpg"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x396a)) returned 1 [0089.908] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0089.908] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0089.908] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386485.jpg")) returned 0x20 [0089.908] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386485.jpg")) returned 0x20 [0089.908] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0089.909] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0089.909] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0089.909] SetEndOfFile (hFile=0x158) returned 1 [0089.909] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0386485.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0089.909] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0386485.JPG", cchWideChar=12, lpMultiByteStr=0x1fe37ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0386485.JPG", lpUsedDefaultChar=0x0) returned 12 [0089.910] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0386485.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0089.910] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0386485.JPG", cchWideChar=12, lpMultiByteStr=0x1fe42ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0386485.JPG", lpUsedDefaultChar=0x0) returned 12 [0089.910] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe42ac, cbMultiByte=12, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="J0386485.JPGg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0089.910] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0386485.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0089.910] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0386485.JPG", cchWideChar=12, lpMultiByteStr=0x1fe37ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0386485.JPG", lpUsedDefaultChar=0x0) returned 12 [0089.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386485.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0089.910] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0089.910] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x396a [0089.910] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0089.910] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0089.911] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0089.911] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0386485.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0089.911] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0386485.JPG", cchWideChar=12, lpMultiByteStr=0x1fe37ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0386485.JPG", lpUsedDefaultChar=0x0) returned 12 [0089.911] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0386485.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0089.911] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0386485.JPG", cchWideChar=12, lpMultiByteStr=0x1fe42ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0386485.JPG", lpUsedDefaultChar=0x0) returned 12 [0089.911] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe42ac, cbMultiByte=12, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="J0386485.JPG85.JPGg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0089.911] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0386485.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0089.911] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0386485.JPG", cchWideChar=12, lpMultiByteStr=0x1fe37ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0386485.JPG", lpUsedDefaultChar=0x0) returned 12 [0089.911] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0089.912] CharToOemA (in: pSrc="J0386485.JPG", pDst=0x1fe42ac | out: pDst="J0386485.JPG") returned 1 [0089.912] WriteFile (in: hFile=0x158, lpBuffer=0x1fe42ac*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x1fe42ac*, lpNumberOfBytesWritten=0x18e048*=0xc, lpOverlapped=0x0) returned 1 [0089.912] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0089.912] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0089.912] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0089.912] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=21017568826) returned 1 [0089.912] ReadFile (in: hFile=0x11c, lpBuffer=0x37e32c0, nNumberOfBytesToRead=0x396a, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x37e32c0*, lpNumberOfBytesRead=0x18dd7c*=0x396a, lpOverlapped=0x0) returned 1 [0089.964] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0089.964] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=21022771836) returned 1 [0089.973] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b450*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b5b450*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0089.973] ReadFile (in: hFile=0x11c, lpBuffer=0x37e32c0, nNumberOfBytesToRead=0x396a, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x37e32c0*, lpNumberOfBytesRead=0x18de38*=0x396a, lpOverlapped=0x0) returned 1 [0089.974] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x47 [0089.974] WriteFile (in: hFile=0x158, lpBuffer=0x38284e0*, nNumberOfBytesToWrite=0x396a, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x38284e0*, lpNumberOfBytesWritten=0x18de10*=0x396a, lpOverlapped=0x0) returned 1 [0089.974] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x39b1 [0089.974] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0089.974] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0089.974] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0089.974] SetFilePointer (in: hFile=0x158, lDistanceToMove=12, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2a [0089.974] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x39bb [0089.975] CloseHandle (hObject=0x11c) returned 1 [0089.975] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x39bb [0089.975] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x39bb [0089.975] SetFilePointer (in: hFile=0x158, lDistanceToMove=14779, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x39bb [0089.975] SetFilePointer (in: hFile=0x158, lDistanceToMove=14779, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x39bb [0089.975] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x39bb [0089.975] SetFilePointer (in: hFile=0x158, lDistanceToMove=14779, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x39bb [0089.975] SetEndOfFile (hFile=0x158) returned 1 [0089.975] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x39bb [0089.975] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x39bb [0089.975] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0386485.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0089.975] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0386485.JPG", cchWideChar=12, lpMultiByteStr=0x1fe37ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0386485.JPG", lpUsedDefaultChar=0x0) returned 12 [0089.975] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0386485.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0089.975] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0386485.JPG", cchWideChar=12, lpMultiByteStr=0x1fe992c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0386485.JPG", lpUsedDefaultChar=0x0) returned 12 [0089.975] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1fe992c, cbMultiByte=12, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="J0386485.JPGꞗ@涤(\x18믉`믑`") returned 12 [0089.976] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0386485.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0089.976] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0386485.JPG", cchWideChar=12, lpMultiByteStr=0x1fe37ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J0386485.JPG", lpUsedDefaultChar=0x0) returned 12 [0089.976] WriteFile (in: hFile=0x158, lpBuffer=0x37c6d98*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x37c6d98*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0089.976] CharToOemA (in: pSrc="J0386485.JPG", pDst=0x1fe992c | out: pDst="J0386485.JPG") returned 1 [0089.976] WriteFile (in: hFile=0x158, lpBuffer=0x1fe992c*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x1fe992c*, lpNumberOfBytesWritten=0x18efcc*=0xc, lpOverlapped=0x0) returned 1 [0089.976] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b470*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x3b5b470*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0089.976] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0089.976] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0089.976] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x3a00 [0089.976] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x3a00 [0089.976] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0089.976] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0089.976] DeleteFileW (lpFileName="") returned 0 [0089.976] GetLastError () returned 0x3 [0089.976] GetFileAttributesW (lpFileName="") returned 0xffffffff [0089.976] SetLastError (dwErrCode=0x3) [0089.976] FlushFileBuffers (hFile=0x158) returned 1 [0089.979] GetCurrentThreadId () returned 0x970 [0089.979] GetCurrentThreadId () returned 0x970 [0089.979] GetCurrentThreadId () returned 0x970 [0089.979] GetCurrentThreadId () returned 0x970 [0089.979] GetCurrentThreadId () returned 0x970 [0089.979] GetCurrentThreadId () returned 0x970 [0089.979] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x3ab7 [0089.979] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x3ab7 [0089.980] SetFilePointer (in: hFile=0x158, lDistanceToMove=15031, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x3ab7 [0089.980] CloseHandle (hObject=0x158) returned 1 [0089.980] GetCurrentThreadId () returned 0x970 [0089.980] GetCurrentThreadId () returned 0x970 [0089.980] GetCurrentThreadId () returned 0x970 [0089.980] GetCurrentThreadId () returned 0x970 [0089.980] GetCurrentThreadId () returned 0x970 [0089.980] GetCurrentThreadId () returned 0x970 [0089.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [J0386485.JPG].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [j0386485.jpg].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0089.980] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3ab7 [0089.980] SetFilePointer (in: hFile=0x158, lDistanceToMove=14903, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3a37 [0089.980] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0089.980] GetFileType (hFile=0x158) returned 0x1 [0089.980] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x25, wMilliseconds=0x102)) [0089.980] GetCurrentThreadId () returned 0x970 [0089.980] GetCurrentThreadId () returned 0x970 [0089.980] GetCurrentThreadId () returned 0x970 [0089.980] GetCurrentThreadId () returned 0x970 [0089.980] GetCurrentThreadId () returned 0x970 [0089.980] GetCurrentThreadId () returned 0x970 [0089.980] GetCurrentThreadId () returned 0x970 [0089.980] GetCurrentThreadId () returned 0x970 [0089.981] GetCurrentThreadId () returned 0x970 [0089.981] GetCurrentThreadId () returned 0x970 [0089.981] GetCurrentThreadId () returned 0x970 [0089.981] GetCurrentThreadId () returned 0x970 [0089.981] GetCurrentThreadId () returned 0x970 [0089.981] GetCurrentThreadId () returned 0x970 [0089.981] GetCurrentThreadId () returned 0x970 [0089.981] GetCurrentThreadId () returned 0x970 [0089.981] GetCurrentThreadId () returned 0x970 [0089.981] GetCurrentThreadId () returned 0x970 [0089.981] GetCurrentThreadId () returned 0x970 [0089.981] GetCurrentThreadId () returned 0x970 [0089.981] GetCurrentThreadId () returned 0x970 [0089.981] GetCurrentThreadId () returned 0x970 [0089.981] GetCurrentThreadId () returned 0x970 [0089.981] GetCurrentThreadId () returned 0x970 [0089.981] GetCurrentThreadId () returned 0x970 [0089.981] GetCurrentThreadId () returned 0x970 [0089.981] GetCurrentThreadId () returned 0x970 [0089.981] GetCurrentThreadId () returned 0x970 [0089.981] GetCurrentThreadId () returned 0x970 [0089.981] GetCurrentThreadId () returned 0x970 [0089.981] GetCurrentThreadId () returned 0x970 [0089.981] GetCurrentThreadId () returned 0x970 [0089.981] GetCurrentThreadId () returned 0x970 [0089.981] GetCurrentThreadId () returned 0x970 [0089.981] GetCurrentThreadId () returned 0x970 [0089.981] GetCurrentThreadId () returned 0x970 [0089.981] GetCurrentThreadId () returned 0x970 [0089.981] GetCurrentThreadId () returned 0x970 [0089.981] GetCurrentThreadId () returned 0x970 [0089.981] GetCurrentThreadId () returned 0x970 [0089.981] GetCurrentThreadId () returned 0x970 [0089.981] GetCurrentThreadId () returned 0x970 [0089.981] GetCurrentThreadId () returned 0x970 [0089.981] GetCurrentThreadId () returned 0x970 [0089.981] GetCurrentThreadId () returned 0x970 [0089.981] GetCurrentThreadId () returned 0x970 [0089.981] GetCurrentThreadId () returned 0x970 [0089.981] GetCurrentThreadId () returned 0x970 [0089.981] GetCurrentThreadId () returned 0x970 [0089.981] GetCurrentThreadId () returned 0x970 [0089.981] GetCurrentThreadId () returned 0x970 [0089.981] GetCurrentThreadId () returned 0x970 [0089.981] GetCurrentThreadId () returned 0x970 [0089.982] GetCurrentThreadId () returned 0x970 [0089.982] GetCurrentThreadId () returned 0x970 [0089.982] GetCurrentThreadId () returned 0x970 [0089.982] GetCurrentThreadId () returned 0x970 [0089.982] GetCurrentThreadId () returned 0x970 [0089.982] GetCurrentThreadId () returned 0x970 [0089.982] GetCurrentThreadId () returned 0x970 [0089.982] GetCurrentThreadId () returned 0x970 [0089.982] GetCurrentThreadId () returned 0x970 [0089.982] GetCurrentThreadId () returned 0x970 [0089.982] GetCurrentThreadId () returned 0x970 [0089.982] GetCurrentThreadId () returned 0x970 [0089.982] GetCurrentThreadId () returned 0x970 [0089.982] GetCurrentThreadId () returned 0x970 [0089.982] GetCurrentThreadId () returned 0x970 [0089.982] GetCurrentThreadId () returned 0x970 [0089.982] GetCurrentThreadId () returned 0x970 [0089.982] GetCurrentThreadId () returned 0x970 [0089.982] GetCurrentThreadId () returned 0x970 [0089.982] GetCurrentThreadId () returned 0x970 [0089.982] GetCurrentThreadId () returned 0x970 [0089.982] GetCurrentThreadId () returned 0x970 [0089.982] GetCurrentThreadId () returned 0x970 [0089.982] GetCurrentThreadId () returned 0x970 [0089.982] GetCurrentThreadId () returned 0x970 [0089.982] GetCurrentThreadId () returned 0x970 [0089.982] GetCurrentThreadId () returned 0x970 [0089.982] GetCurrentThreadId () returned 0x970 [0089.982] GetCurrentThreadId () returned 0x970 [0089.982] GetCurrentThreadId () returned 0x970 [0089.982] GetCurrentThreadId () returned 0x970 [0089.982] GetCurrentThreadId () returned 0x970 [0089.982] GetCurrentThreadId () returned 0x970 [0089.982] GetCurrentThreadId () returned 0x970 [0089.982] GetCurrentThreadId () returned 0x970 [0089.982] GetCurrentThreadId () returned 0x970 [0089.982] GetCurrentThreadId () returned 0x970 [0089.982] GetCurrentThreadId () returned 0x970 [0089.982] GetCurrentThreadId () returned 0x970 [0089.982] GetCurrentThreadId () returned 0x970 [0089.982] GetCurrentThreadId () returned 0x970 [0089.982] GetCurrentThreadId () returned 0x970 [0089.982] GetCurrentThreadId () returned 0x970 [0089.982] GetCurrentThreadId () returned 0x970 [0089.982] GetCurrentThreadId () returned 0x970 [0089.983] GetCurrentThreadId () returned 0x970 [0089.983] GetCurrentThreadId () returned 0x970 [0089.983] GetCurrentThreadId () returned 0x970 [0089.983] GetCurrentThreadId () returned 0x970 [0089.983] GetCurrentThreadId () returned 0x970 [0089.983] GetCurrentThreadId () returned 0x970 [0089.983] GetCurrentThreadId () returned 0x970 [0089.983] GetCurrentThreadId () returned 0x970 [0089.983] GetCurrentThreadId () returned 0x970 [0089.983] GetCurrentThreadId () returned 0x970 [0089.983] GetCurrentThreadId () returned 0x970 [0089.983] GetCurrentThreadId () returned 0x970 [0089.983] GetCurrentThreadId () returned 0x970 [0089.983] GetCurrentThreadId () returned 0x970 [0089.983] GetCurrentThreadId () returned 0x970 [0089.983] GetCurrentThreadId () returned 0x970 [0089.983] GetCurrentThreadId () returned 0x970 [0089.983] GetCurrentThreadId () returned 0x970 [0089.983] GetCurrentThreadId () returned 0x970 [0089.983] GetCurrentThreadId () returned 0x970 [0089.983] GetCurrentThreadId () returned 0x970 [0089.983] GetCurrentThreadId () returned 0x970 [0089.983] GetCurrentThreadId () returned 0x970 [0089.983] GetCurrentThreadId () returned 0x970 [0089.983] GetCurrentThreadId () returned 0x970 [0089.983] GetCurrentThreadId () returned 0x970 [0089.983] GetCurrentThreadId () returned 0x970 [0089.983] GetCurrentThreadId () returned 0x970 [0089.983] GetCurrentThreadId () returned 0x970 [0089.983] GetCurrentThreadId () returned 0x970 [0089.983] GetCurrentThreadId () returned 0x970 [0089.983] GetCurrentThreadId () returned 0x970 [0089.983] GetCurrentThreadId () returned 0x970 [0089.983] GetCurrentThreadId () returned 0x970 [0089.983] GetCurrentThreadId () returned 0x970 [0089.983] GetCurrentThreadId () returned 0x970 [0089.983] GetCurrentThreadId () returned 0x970 [0089.983] GetCurrentThreadId () returned 0x970 [0089.983] GetCurrentThreadId () returned 0x970 [0089.983] GetCurrentThreadId () returned 0x970 [0089.983] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0089.983] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0089.983] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5fc70, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0089.984] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0089.984] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0089.984] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5fc70, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0089.984] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0089.984] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0089.984] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b530, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0089.984] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0089.984] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0089.984] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b530, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0089.984] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0089.984] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0089.984] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5fcd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0089.984] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0089.984] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0089.984] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5fcd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0089.984] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0089.984] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0089.984] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5fcd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0089.984] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x25, wMilliseconds=0x102)) [0089.984] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EJ>8\"mcJ-b{Ti+VxIl)qReq-~*N$hGU!", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0089.984] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EJ>8\"mcJ-b{Ti+VxIl)qReq-~*N$hGU!", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0089.984] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EJ>8\"mcJ-b{Ti+VxIl)qReq-~*N$hGU!", cchWideChar=32, lpMultiByteStr=0x3b56c48, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EJ>8\"mcJ-b{Ti+VxIl)qReq-~*N$hGU!", lpUsedDefaultChar=0x0) returned 32 [0089.984] GetCurrentThreadId () returned 0x970 [0089.984] GetCurrentThreadId () returned 0x970 [0089.984] GetCurrentThreadId () returned 0x970 [0089.984] GetCurrentThreadId () returned 0x970 [0089.984] GetCurrentThreadId () returned 0x970 [0089.984] GetCurrentThreadId () returned 0x970 [0089.992] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0089.992] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0089.992] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3b89a78, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0089.992] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0089.992] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAACGAywuidKyMal/1/QslCmXCHcHkj9PZKFLGc4YL1kv+aSDXKeaF2s3iw30jfZwx3FpUEZsBDWB69d5mUOnqu/8kBrLVrYwOQKFp0Jjf6G9ObeBXx7Gwat8ITZb07H1DMD5k0OycJNOQU6lBcei4Oh4j6aqBGShpSaKwjesGbYnHk7e1wqOn9SdBsAxb+yNQbixuNtB3l4uNAFcWwUFGIinmaxrpDdp6sA==") returned 232 [0089.992] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x25, wMilliseconds=0x102)) [0089.992] GetCurrentThreadId () returned 0x970 [0089.992] GetCurrentThreadId () returned 0x970 [0089.992] GetCurrentThreadId () returned 0x970 [0089.992] GetCurrentThreadId () returned 0x970 [0089.992] GetCurrentThreadId () returned 0x970 [0089.992] GetCurrentThreadId () returned 0x970 [0089.993] GetCurrentThreadId () returned 0x970 [0089.993] GetCurrentThreadId () returned 0x970 [0089.993] GetCurrentThreadId () returned 0x970 [0089.993] GetCurrentThreadId () returned 0x970 [0089.993] GetCurrentThreadId () returned 0x970 [0089.993] GetCurrentThreadId () returned 0x970 [0089.993] GetCurrentThreadId () returned 0x970 [0089.993] GetCurrentThreadId () returned 0x970 [0089.993] GetCurrentThreadId () returned 0x970 [0089.993] GetCurrentThreadId () returned 0x970 [0089.993] GetCurrentThreadId () returned 0x970 [0089.993] GetCurrentThreadId () returned 0x970 [0089.993] GetCurrentThreadId () returned 0x970 [0089.993] GetCurrentThreadId () returned 0x970 [0089.993] GetCurrentThreadId () returned 0x970 [0089.993] GetCurrentThreadId () returned 0x970 [0089.993] GetCurrentThreadId () returned 0x970 [0089.993] GetCurrentThreadId () returned 0x970 [0089.993] GetCurrentThreadId () returned 0x970 [0089.993] GetCurrentThreadId () returned 0x970 [0089.993] GetCurrentThreadId () returned 0x970 [0089.993] GetCurrentThreadId () returned 0x970 [0089.993] GetCurrentThreadId () returned 0x970 [0089.993] GetCurrentThreadId () returned 0x970 [0089.993] GetCurrentThreadId () returned 0x970 [0089.993] GetCurrentThreadId () returned 0x970 [0089.993] GetCurrentThreadId () returned 0x970 [0089.993] GetCurrentThreadId () returned 0x970 [0089.993] GetCurrentThreadId () returned 0x970 [0089.993] GetCurrentThreadId () returned 0x970 [0089.993] GetCurrentThreadId () returned 0x970 [0089.993] GetCurrentThreadId () returned 0x970 [0089.993] GetCurrentThreadId () returned 0x970 [0089.993] GetCurrentThreadId () returned 0x970 [0089.993] GetCurrentThreadId () returned 0x970 [0089.993] GetCurrentThreadId () returned 0x970 [0089.993] GetCurrentThreadId () returned 0x970 [0089.993] GetCurrentThreadId () returned 0x970 [0089.993] GetCurrentThreadId () returned 0x970 [0089.993] GetCurrentThreadId () returned 0x970 [0089.993] GetCurrentThreadId () returned 0x970 [0089.993] GetCurrentThreadId () returned 0x970 [0089.993] GetCurrentThreadId () returned 0x970 [0089.993] GetCurrentThreadId () returned 0x970 [0089.994] GetCurrentThreadId () returned 0x970 [0089.994] GetCurrentThreadId () returned 0x970 [0089.994] GetCurrentThreadId () returned 0x970 [0089.994] GetCurrentThreadId () returned 0x970 [0089.994] GetCurrentThreadId () returned 0x970 [0089.994] GetCurrentThreadId () returned 0x970 [0089.994] GetCurrentThreadId () returned 0x970 [0089.994] GetCurrentThreadId () returned 0x970 [0089.994] GetCurrentThreadId () returned 0x970 [0089.994] GetCurrentThreadId () returned 0x970 [0089.994] GetCurrentThreadId () returned 0x970 [0089.994] GetCurrentThreadId () returned 0x970 [0089.994] GetCurrentThreadId () returned 0x970 [0089.994] GetCurrentThreadId () returned 0x970 [0089.994] GetCurrentThreadId () returned 0x970 [0089.994] GetCurrentThreadId () returned 0x970 [0089.994] GetCurrentThreadId () returned 0x970 [0089.994] GetCurrentThreadId () returned 0x970 [0089.994] GetCurrentThreadId () returned 0x970 [0089.994] GetCurrentThreadId () returned 0x970 [0089.994] GetCurrentThreadId () returned 0x970 [0089.994] GetCurrentThreadId () returned 0x970 [0089.994] GetCurrentThreadId () returned 0x970 [0089.994] GetCurrentThreadId () returned 0x970 [0089.994] GetCurrentThreadId () returned 0x970 [0089.994] GetCurrentThreadId () returned 0x970 [0089.994] GetCurrentThreadId () returned 0x970 [0089.994] GetCurrentThreadId () returned 0x970 [0089.994] GetCurrentThreadId () returned 0x970 [0089.994] GetCurrentThreadId () returned 0x970 [0089.994] GetCurrentThreadId () returned 0x970 [0089.994] GetCurrentThreadId () returned 0x970 [0089.994] GetCurrentThreadId () returned 0x970 [0089.994] GetCurrentThreadId () returned 0x970 [0089.994] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAACGAywuidKyMal/1/QslCmXCHcHkj9PZKFLGc4YL1kv+aSDXKeaF2s3iw30jfZwx3FpUEZsBDWB69d5mUOnqu/8kBrLVrYwOQKFp0Jjf6G9ObeBXx7Gwat8ITZb07H1DMD5k0OycJNOQU6lBcei4Oh4j6aqBGShpSaKwjesGbYnHk7e1wqOn9SdBsAxb+yNQbixuNtB3l4uNAFcWwUFGIinmaxrpDdp6sA==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0089.994] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAACGAywuidKyMal/1/QslCmXCHcHkj9PZKFLGc4YL1kv+aSDXKeaF2s3iw30jfZwx3FpUEZsBDWB69d5mUOnqu/8kBrLVrYwOQKFp0Jjf6G9ObeBXx7Gwat8ITZb07H1DMD5k0OycJNOQU6lBcei4Oh4j6aqBGShpSaKwjesGbYnHk7e1wqOn9SdBsAxb+yNQbixuNtB3l4uNAFcWwUFGIinmaxrpDdp6sA==", cchWideChar=245, lpMultiByteStr=0x3b4d08c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAACGAywuidKyMal/1/QslCmXCHcHkj9PZKFLGc4YL1kv+aSDXKeaF2s3iw30jfZwx3FpUEZsBDWB69d5mUOnqu/8kBrLVrYwOQKFp0Jjf6G9ObeBXx7Gwat8ITZb07H1DMD5k0OycJNOQU6lBcei4Oh4j6aqBGShpSaKwjesGbYnHk7e1wqOn9SdBsAxb+yNQbixuNtB3l4uNAFcWwUFGIinmaxrpDdp6sA==", lpUsedDefaultChar=0x0) returned 245 [0089.994] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0089.995] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0089.995] CloseHandle (hObject=0x158) returned 1 [0089.995] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386485.jpg")) returned 1 [0089.996] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=21025933818) returned 1 [0089.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [J0386764.JPG].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [j0386764.jpg].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0089.997] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0089.997] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0089.997] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0089.997] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0089.997] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0089.997] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0089.997] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0089.997] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0089.997] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0089.997] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0089.997] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0089.997] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0089.997] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0089.997] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0089.998] SetEndOfFile (hFile=0x158) returned 1 [0089.998] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0089.998] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0089.998] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0089.998] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0089.998] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0089.999] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0089.999] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0?IMHNER&Jp$e2:SCqD}3.Cly~#I^e,=IrpuN5YY-H\\A", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0095.708] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6ZK\"dJ>}3.Cly~#I^e,=IrpuN5YY-H\\A", cchWideChar=32, lpMultiByteStr=0x203dbfc, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6ZK\"dJ>}3.Cly~#I^e,=IrpuN5YY-H\\A", lpUsedDefaultChar=0x0) returned 32 [0095.709] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0095.709] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0095.709] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2322a600, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2322a600, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0xa0d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02759J.JPG", cAlternateFileName="")) returned 0x295098 [0095.709] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0095.709] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0095.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02759j.jpg")) returned 0x20 [0095.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02759j.jpg")) returned 0x20 [0095.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02759j.jpg")) returned 0x20 [0095.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02759j.jpg")) returned 0x20 [0095.709] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02759j.jpg"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2322a600, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2322a600, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0xa0d2)) returned 1 [0095.709] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0095.709] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0095.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02759j.jpg")) returned 0x20 [0095.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02759j.jpg")) returned 0x20 [0095.710] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0095.710] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0095.710] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0095.710] SetEndOfFile (hFile=0x158) returned 1 [0095.710] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02759J.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0095.711] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02759J.JPG", cchWideChar=12, lpMultiByteStr=0x3b94dcc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PH02759J.JPG", lpUsedDefaultChar=0x0) returned 12 [0095.711] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02759J.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0095.711] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02759J.JPG", cchWideChar=12, lpMultiByteStr=0x3b94d4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PH02759J.JPG", lpUsedDefaultChar=0x0) returned 12 [0095.711] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3b94d4c, cbMultiByte=12, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="PH02759J.JPGg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0095.711] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02759J.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0095.711] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02759J.JPG", cchWideChar=12, lpMultiByteStr=0x3b94dcc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PH02759J.JPG", lpUsedDefaultChar=0x0) returned 12 [0095.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02759j.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0095.711] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0095.711] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0xa0d2 [0095.711] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0095.711] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0095.711] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0095.712] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02759J.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0095.712] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02759J.JPG", cchWideChar=12, lpMultiByteStr=0x3b94dcc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PH02759J.JPG", lpUsedDefaultChar=0x0) returned 12 [0095.712] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02759J.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0095.712] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02759J.JPG", cchWideChar=12, lpMultiByteStr=0x3b94d4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PH02759J.JPG", lpUsedDefaultChar=0x0) returned 12 [0095.712] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3b94d4c, cbMultiByte=12, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="PH02759J.JPG9J.JPGg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0095.712] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02759J.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0095.712] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02759J.JPG", cchWideChar=12, lpMultiByteStr=0x3b94dcc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PH02759J.JPG", lpUsedDefaultChar=0x0) returned 12 [0095.712] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0095.713] CharToOemA (in: pSrc="PH02759J.JPG", pDst=0x3b94d4c | out: pDst="PH02759J.JPG") returned 1 [0095.713] WriteFile (in: hFile=0x158, lpBuffer=0x3b94d4c*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x3b94d4c*, lpNumberOfBytesWritten=0x18e048*=0xc, lpOverlapped=0x0) returned 1 [0095.713] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0095.713] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0095.713] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0095.713] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=21597661508) returned 1 [0095.713] ReadFile (in: hFile=0x11c, lpBuffer=0x3af1c60, nNumberOfBytesToRead=0xa0d2, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3af1c60*, lpNumberOfBytesRead=0x18dd7c*=0xa0d2, lpOverlapped=0x0) returned 1 [0095.715] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0095.715] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=21597839302) returned 1 [0095.724] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b450*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b5b450*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0095.724] ReadFile (in: hFile=0x11c, lpBuffer=0x3af1c60, nNumberOfBytesToRead=0xa0d2, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3af1c60*, lpNumberOfBytesRead=0x18de38*=0xa0d2, lpOverlapped=0x0) returned 1 [0095.725] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x47 [0095.725] WriteFile (in: hFile=0x158, lpBuffer=0x3b2c450*, nNumberOfBytesToWrite=0xa0d2, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3b2c450*, lpNumberOfBytesWritten=0x18de10*=0xa0d2, lpOverlapped=0x0) returned 1 [0095.726] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0xa119 [0095.726] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0095.726] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0095.726] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0095.726] SetFilePointer (in: hFile=0x158, lDistanceToMove=12, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2a [0095.726] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0xa123 [0095.726] CloseHandle (hObject=0x11c) returned 1 [0095.726] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xa123 [0095.726] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xa123 [0095.726] SetFilePointer (in: hFile=0x158, lDistanceToMove=41251, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xa123 [0095.726] SetFilePointer (in: hFile=0x158, lDistanceToMove=41251, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0xa123 [0095.727] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xa123 [0095.727] SetFilePointer (in: hFile=0x158, lDistanceToMove=41251, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0xa123 [0095.727] SetEndOfFile (hFile=0x158) returned 1 [0095.727] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xa123 [0095.727] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xa123 [0095.727] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02759J.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0095.727] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02759J.JPG", cchWideChar=12, lpMultiByteStr=0x3b94dcc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PH02759J.JPG", lpUsedDefaultChar=0x0) returned 12 [0095.727] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02759J.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0095.727] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02759J.JPG", cchWideChar=12, lpMultiByteStr=0x3b94dec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PH02759J.JPG", lpUsedDefaultChar=0x0) returned 12 [0095.727] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3b94dec, cbMultiByte=12, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="PH02759J.JPGꞗ@涤(\x18믉`믑`") returned 12 [0095.727] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02759J.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0095.727] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02759J.JPG", cchWideChar=12, lpMultiByteStr=0x3b94dcc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PH02759J.JPG", lpUsedDefaultChar=0x0) returned 12 [0095.727] WriteFile (in: hFile=0x158, lpBuffer=0x3ad5738*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5738*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0095.727] CharToOemA (in: pSrc="PH02759J.JPG", pDst=0x3b94dec | out: pDst="PH02759J.JPG") returned 1 [0095.727] WriteFile (in: hFile=0x158, lpBuffer=0x3b94dec*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3b94dec*, lpNumberOfBytesWritten=0x18efcc*=0xc, lpOverlapped=0x0) returned 1 [0095.727] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b470*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x3b5b470*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0095.728] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0095.728] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0095.728] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xa168 [0095.728] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xa168 [0095.728] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0095.728] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0095.728] DeleteFileW (lpFileName="") returned 0 [0095.728] GetLastError () returned 0x3 [0095.728] GetFileAttributesW (lpFileName="") returned 0xffffffff [0095.728] SetLastError (dwErrCode=0x3) [0095.728] FlushFileBuffers (hFile=0x158) returned 1 [0095.733] GetCurrentThreadId () returned 0x970 [0095.733] GetCurrentThreadId () returned 0x970 [0095.733] GetCurrentThreadId () returned 0x970 [0095.733] GetCurrentThreadId () returned 0x970 [0095.733] GetCurrentThreadId () returned 0x970 [0095.733] GetCurrentThreadId () returned 0x970 [0095.733] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xa21f [0095.733] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xa21f [0095.733] SetFilePointer (in: hFile=0x158, lDistanceToMove=41503, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xa21f [0095.733] CloseHandle (hObject=0x158) returned 1 [0095.733] GetCurrentThreadId () returned 0x970 [0095.733] GetCurrentThreadId () returned 0x970 [0095.733] GetCurrentThreadId () returned 0x970 [0095.733] GetCurrentThreadId () returned 0x970 [0095.733] GetCurrentThreadId () returned 0x970 [0095.733] GetCurrentThreadId () returned 0x970 [0095.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [PH02759J.JPG].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [ph02759j.jpg].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0095.733] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa21f [0095.734] SetFilePointer (in: hFile=0x158, lDistanceToMove=41375, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa19f [0095.734] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0095.734] GetFileType (hFile=0x158) returned 0x1 [0095.734] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2a, wMilliseconds=0x3e7)) [0095.734] GetCurrentThreadId () returned 0x970 [0095.734] GetCurrentThreadId () returned 0x970 [0095.734] GetCurrentThreadId () returned 0x970 [0095.734] GetCurrentThreadId () returned 0x970 [0095.734] GetCurrentThreadId () returned 0x970 [0095.734] GetCurrentThreadId () returned 0x970 [0095.734] GetCurrentThreadId () returned 0x970 [0095.734] GetCurrentThreadId () returned 0x970 [0095.734] GetCurrentThreadId () returned 0x970 [0095.734] GetCurrentThreadId () returned 0x970 [0095.734] GetCurrentThreadId () returned 0x970 [0095.734] GetCurrentThreadId () returned 0x970 [0095.734] GetCurrentThreadId () returned 0x970 [0095.734] GetCurrentThreadId () returned 0x970 [0095.734] GetCurrentThreadId () returned 0x970 [0095.734] GetCurrentThreadId () returned 0x970 [0095.734] GetCurrentThreadId () returned 0x970 [0095.734] GetCurrentThreadId () returned 0x970 [0095.734] GetCurrentThreadId () returned 0x970 [0095.734] GetCurrentThreadId () returned 0x970 [0095.734] GetCurrentThreadId () returned 0x970 [0095.734] GetCurrentThreadId () returned 0x970 [0095.734] GetCurrentThreadId () returned 0x970 [0095.734] GetCurrentThreadId () returned 0x970 [0095.734] GetCurrentThreadId () returned 0x970 [0095.734] GetCurrentThreadId () returned 0x970 [0095.734] GetCurrentThreadId () returned 0x970 [0095.734] GetCurrentThreadId () returned 0x970 [0095.734] GetCurrentThreadId () returned 0x970 [0095.734] GetCurrentThreadId () returned 0x970 [0095.734] GetCurrentThreadId () returned 0x970 [0095.734] GetCurrentThreadId () returned 0x970 [0095.734] GetCurrentThreadId () returned 0x970 [0095.734] GetCurrentThreadId () returned 0x970 [0095.734] GetCurrentThreadId () returned 0x970 [0095.735] GetCurrentThreadId () returned 0x970 [0095.735] GetCurrentThreadId () returned 0x970 [0095.735] GetCurrentThreadId () returned 0x970 [0095.735] GetCurrentThreadId () returned 0x970 [0095.735] GetCurrentThreadId () returned 0x970 [0095.735] GetCurrentThreadId () returned 0x970 [0095.735] GetCurrentThreadId () returned 0x970 [0095.735] GetCurrentThreadId () returned 0x970 [0095.735] GetCurrentThreadId () returned 0x970 [0095.735] GetCurrentThreadId () returned 0x970 [0095.735] GetCurrentThreadId () returned 0x970 [0095.735] GetCurrentThreadId () returned 0x970 [0095.735] GetCurrentThreadId () returned 0x970 [0095.735] GetCurrentThreadId () returned 0x970 [0095.735] GetCurrentThreadId () returned 0x970 [0095.735] GetCurrentThreadId () returned 0x970 [0095.735] GetCurrentThreadId () returned 0x970 [0095.735] GetCurrentThreadId () returned 0x970 [0095.735] GetCurrentThreadId () returned 0x970 [0095.735] GetCurrentThreadId () returned 0x970 [0095.735] GetCurrentThreadId () returned 0x970 [0095.735] GetCurrentThreadId () returned 0x970 [0095.735] GetCurrentThreadId () returned 0x970 [0095.735] GetCurrentThreadId () returned 0x970 [0095.735] GetCurrentThreadId () returned 0x970 [0095.735] GetCurrentThreadId () returned 0x970 [0095.735] GetCurrentThreadId () returned 0x970 [0095.735] GetCurrentThreadId () returned 0x970 [0095.735] GetCurrentThreadId () returned 0x970 [0095.735] GetCurrentThreadId () returned 0x970 [0095.735] GetCurrentThreadId () returned 0x970 [0095.735] GetCurrentThreadId () returned 0x970 [0095.735] GetCurrentThreadId () returned 0x970 [0095.735] GetCurrentThreadId () returned 0x970 [0095.735] GetCurrentThreadId () returned 0x970 [0095.735] GetCurrentThreadId () returned 0x970 [0095.735] GetCurrentThreadId () returned 0x970 [0095.735] GetCurrentThreadId () returned 0x970 [0095.735] GetCurrentThreadId () returned 0x970 [0095.735] GetCurrentThreadId () returned 0x970 [0095.735] GetCurrentThreadId () returned 0x970 [0095.735] GetCurrentThreadId () returned 0x970 [0095.735] GetCurrentThreadId () returned 0x970 [0095.736] GetCurrentThreadId () returned 0x970 [0095.736] GetCurrentThreadId () returned 0x970 [0095.736] GetCurrentThreadId () returned 0x970 [0095.736] GetCurrentThreadId () returned 0x970 [0095.736] GetCurrentThreadId () returned 0x970 [0095.736] GetCurrentThreadId () returned 0x970 [0095.736] GetCurrentThreadId () returned 0x970 [0095.736] GetCurrentThreadId () returned 0x970 [0095.736] GetCurrentThreadId () returned 0x970 [0095.736] GetCurrentThreadId () returned 0x970 [0095.736] GetCurrentThreadId () returned 0x970 [0095.736] GetCurrentThreadId () returned 0x970 [0095.736] GetCurrentThreadId () returned 0x970 [0095.736] GetCurrentThreadId () returned 0x970 [0095.736] GetCurrentThreadId () returned 0x970 [0095.736] GetCurrentThreadId () returned 0x970 [0095.736] GetCurrentThreadId () returned 0x970 [0095.736] GetCurrentThreadId () returned 0x970 [0095.736] GetCurrentThreadId () returned 0x970 [0095.736] GetCurrentThreadId () returned 0x970 [0095.736] GetCurrentThreadId () returned 0x970 [0095.736] GetCurrentThreadId () returned 0x970 [0095.736] GetCurrentThreadId () returned 0x970 [0095.736] GetCurrentThreadId () returned 0x970 [0095.736] GetCurrentThreadId () returned 0x970 [0095.736] GetCurrentThreadId () returned 0x970 [0095.736] GetCurrentThreadId () returned 0x970 [0095.736] GetCurrentThreadId () returned 0x970 [0095.736] GetCurrentThreadId () returned 0x970 [0095.736] GetCurrentThreadId () returned 0x970 [0095.736] GetCurrentThreadId () returned 0x970 [0095.736] GetCurrentThreadId () returned 0x970 [0095.736] GetCurrentThreadId () returned 0x970 [0095.736] GetCurrentThreadId () returned 0x970 [0095.736] GetCurrentThreadId () returned 0x970 [0095.736] GetCurrentThreadId () returned 0x970 [0095.736] GetCurrentThreadId () returned 0x970 [0095.736] GetCurrentThreadId () returned 0x970 [0095.736] GetCurrentThreadId () returned 0x970 [0095.736] GetCurrentThreadId () returned 0x970 [0095.736] GetCurrentThreadId () returned 0x970 [0095.736] GetCurrentThreadId () returned 0x970 [0095.736] GetCurrentThreadId () returned 0x970 [0095.736] GetCurrentThreadId () returned 0x970 [0095.737] GetCurrentThreadId () returned 0x970 [0095.737] GetCurrentThreadId () returned 0x970 [0095.737] GetCurrentThreadId () returned 0x970 [0095.737] GetCurrentThreadId () returned 0x970 [0095.737] GetCurrentThreadId () returned 0x970 [0095.737] GetCurrentThreadId () returned 0x970 [0095.737] GetCurrentThreadId () returned 0x970 [0095.737] GetCurrentThreadId () returned 0x970 [0095.737] GetCurrentThreadId () returned 0x970 [0095.737] GetCurrentThreadId () returned 0x970 [0095.737] GetCurrentThreadId () returned 0x970 [0095.737] GetCurrentThreadId () returned 0x970 [0095.737] GetCurrentThreadId () returned 0x970 [0095.737] GetCurrentThreadId () returned 0x970 [0095.737] GetCurrentThreadId () returned 0x970 [0095.737] GetCurrentThreadId () returned 0x970 [0095.737] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0095.737] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0095.737] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b61890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0095.737] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0095.737] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0095.737] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b61890, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0095.737] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0095.737] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0095.737] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b548, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0095.737] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0095.737] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0095.737] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b548, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0095.737] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0095.737] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0095.737] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b618f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0095.737] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0095.737] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0095.737] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b618f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0095.737] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0095.737] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0095.738] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b618f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0095.738] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2b, wMilliseconds=0xe)) [0095.738] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="6ZK\"dJ>}3.Cly~#I^e,=IrpuN5YY-H\\A", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0095.738] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="6ZK\"dJ>}3.Cly~#I^e,=IrpuN5YY-H\\A", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0095.738] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="6ZK\"dJ>}3.Cly~#I^e,=IrpuN5YY-H\\A", cchWideChar=32, lpMultiByteStr=0x3b57a58, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6ZK\"dJ>}3.Cly~#I^e,=IrpuN5YY-H\\A", lpUsedDefaultChar=0x0) returned 32 [0095.738] GetCurrentThreadId () returned 0x970 [0095.738] GetCurrentThreadId () returned 0x970 [0095.738] GetCurrentThreadId () returned 0x970 [0095.738] GetCurrentThreadId () returned 0x970 [0095.738] GetCurrentThreadId () returned 0x970 [0095.738] GetCurrentThreadId () returned 0x970 [0095.745] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0095.745] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0095.745] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3b14ae8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0095.745] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0095.745] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAG9suoqA4uOdo4+V52jI9qzX9vi38F5hlOPsS04dULSyVNjqAaFqswRDQlY/62uXRqCG06q3HSj1D9XScSrtF4pYZru98ID0n3Qw++PtbCByYG3mHU1D/LFVdb67eX8XZx5VNKTM5hiOM2LnyqVsrdjYrolCIHqQLShTpy1IqJhe/Fa1VlbFWQ98Y5atiDEsCRGFluMinj1lrOdbN5H1gHkeQxGnorGflA==") returned 232 [0095.745] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2b, wMilliseconds=0xe)) [0095.746] GetCurrentThreadId () returned 0x970 [0095.746] GetCurrentThreadId () returned 0x970 [0095.746] GetCurrentThreadId () returned 0x970 [0095.746] GetCurrentThreadId () returned 0x970 [0095.746] GetCurrentThreadId () returned 0x970 [0095.746] GetCurrentThreadId () returned 0x970 [0095.746] GetCurrentThreadId () returned 0x970 [0095.746] GetCurrentThreadId () returned 0x970 [0095.746] GetCurrentThreadId () returned 0x970 [0095.746] GetCurrentThreadId () returned 0x970 [0095.746] GetCurrentThreadId () returned 0x970 [0095.746] GetCurrentThreadId () returned 0x970 [0095.746] GetCurrentThreadId () returned 0x970 [0095.746] GetCurrentThreadId () returned 0x970 [0095.746] GetCurrentThreadId () returned 0x970 [0095.746] GetCurrentThreadId () returned 0x970 [0095.746] GetCurrentThreadId () returned 0x970 [0095.746] GetCurrentThreadId () returned 0x970 [0095.746] GetCurrentThreadId () returned 0x970 [0095.746] GetCurrentThreadId () returned 0x970 [0095.746] GetCurrentThreadId () returned 0x970 [0095.746] GetCurrentThreadId () returned 0x970 [0095.746] GetCurrentThreadId () returned 0x970 [0095.746] GetCurrentThreadId () returned 0x970 [0095.746] GetCurrentThreadId () returned 0x970 [0095.746] GetCurrentThreadId () returned 0x970 [0095.746] GetCurrentThreadId () returned 0x970 [0095.746] GetCurrentThreadId () returned 0x970 [0095.746] GetCurrentThreadId () returned 0x970 [0095.746] GetCurrentThreadId () returned 0x970 [0095.746] GetCurrentThreadId () returned 0x970 [0095.746] GetCurrentThreadId () returned 0x970 [0095.746] GetCurrentThreadId () returned 0x970 [0095.746] GetCurrentThreadId () returned 0x970 [0095.746] GetCurrentThreadId () returned 0x970 [0095.746] GetCurrentThreadId () returned 0x970 [0095.746] GetCurrentThreadId () returned 0x970 [0095.746] GetCurrentThreadId () returned 0x970 [0095.746] GetCurrentThreadId () returned 0x970 [0095.746] GetCurrentThreadId () returned 0x970 [0095.746] GetCurrentThreadId () returned 0x970 [0095.746] GetCurrentThreadId () returned 0x970 [0095.747] GetCurrentThreadId () returned 0x970 [0095.747] GetCurrentThreadId () returned 0x970 [0095.747] GetCurrentThreadId () returned 0x970 [0095.747] GetCurrentThreadId () returned 0x970 [0095.747] GetCurrentThreadId () returned 0x970 [0095.747] GetCurrentThreadId () returned 0x970 [0095.747] GetCurrentThreadId () returned 0x970 [0095.747] GetCurrentThreadId () returned 0x970 [0095.747] GetCurrentThreadId () returned 0x970 [0095.747] GetCurrentThreadId () returned 0x970 [0095.747] GetCurrentThreadId () returned 0x970 [0095.747] GetCurrentThreadId () returned 0x970 [0095.747] GetCurrentThreadId () returned 0x970 [0095.747] GetCurrentThreadId () returned 0x970 [0095.747] GetCurrentThreadId () returned 0x970 [0095.747] GetCurrentThreadId () returned 0x970 [0095.747] GetCurrentThreadId () returned 0x970 [0095.747] GetCurrentThreadId () returned 0x970 [0095.747] GetCurrentThreadId () returned 0x970 [0095.747] GetCurrentThreadId () returned 0x970 [0095.747] GetCurrentThreadId () returned 0x970 [0095.747] GetCurrentThreadId () returned 0x970 [0095.747] GetCurrentThreadId () returned 0x970 [0095.747] GetCurrentThreadId () returned 0x970 [0095.747] GetCurrentThreadId () returned 0x970 [0095.747] GetCurrentThreadId () returned 0x970 [0095.747] GetCurrentThreadId () returned 0x970 [0095.747] GetCurrentThreadId () returned 0x970 [0095.747] GetCurrentThreadId () returned 0x970 [0095.747] GetCurrentThreadId () returned 0x970 [0095.747] GetCurrentThreadId () returned 0x970 [0095.747] GetCurrentThreadId () returned 0x970 [0095.747] GetCurrentThreadId () returned 0x970 [0095.747] GetCurrentThreadId () returned 0x970 [0095.747] GetCurrentThreadId () returned 0x970 [0095.747] GetCurrentThreadId () returned 0x970 [0095.747] GetCurrentThreadId () returned 0x970 [0095.747] GetCurrentThreadId () returned 0x970 [0095.747] GetCurrentThreadId () returned 0x970 [0095.747] GetCurrentThreadId () returned 0x970 [0095.747] GetCurrentThreadId () returned 0x970 [0095.747] GetCurrentThreadId () returned 0x970 [0095.747] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAG9suoqA4uOdo4+V52jI9qzX9vi38F5hlOPsS04dULSyVNjqAaFqswRDQlY/62uXRqCG06q3HSj1D9XScSrtF4pYZru98ID0n3Qw++PtbCByYG3mHU1D/LFVdb67eX8XZx5VNKTM5hiOM2LnyqVsrdjYrolCIHqQLShTpy1IqJhe/Fa1VlbFWQ98Y5atiDEsCRGFluMinj1lrOdbN5H1gHkeQxGnorGflA==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0095.747] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAG9suoqA4uOdo4+V52jI9qzX9vi38F5hlOPsS04dULSyVNjqAaFqswRDQlY/62uXRqCG06q3HSj1D9XScSrtF4pYZru98ID0n3Qw++PtbCByYG3mHU1D/LFVdb67eX8XZx5VNKTM5hiOM2LnyqVsrdjYrolCIHqQLShTpy1IqJhe/Fa1VlbFWQ98Y5atiDEsCRGFluMinj1lrOdbN5H1gHkeQxGnorGflA==", cchWideChar=245, lpMultiByteStr=0x3b4d08c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAG9suoqA4uOdo4+V52jI9qzX9vi38F5hlOPsS04dULSyVNjqAaFqswRDQlY/62uXRqCG06q3HSj1D9XScSrtF4pYZru98ID0n3Qw++PtbCByYG3mHU1D/LFVdb67eX8XZx5VNKTM5hiOM2LnyqVsrdjYrolCIHqQLShTpy1IqJhe/Fa1VlbFWQ98Y5atiDEsCRGFluMinj1lrOdbN5H1gHkeQxGnorGflA==", lpUsedDefaultChar=0x0) returned 245 [0095.748] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0095.748] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0095.748] CloseHandle (hObject=0x158) returned 1 [0095.751] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02759j.jpg")) returned 1 [0095.752] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=21601579298) returned 1 [0095.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [PH02810J.JPG].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [ph02810j.jpg].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0095.753] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0095.753] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0095.753] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0095.753] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0095.753] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0095.753] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0095.753] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0095.753] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0095.754] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0095.754] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0095.754] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0095.754] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0095.754] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0095.754] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0095.754] SetEndOfFile (hFile=0x158) returned 1 [0095.754] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0095.754] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0095.754] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0095.754] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0095.754] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0095.755] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0095.755] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Rmj%6J7QaM,6GYs6i8bAx{%ivYuY7/GU", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0095.755] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Rmj%6J7QaM,6GYs6i8bAx{%ivYuY7/GU", cchWideChar=32, lpMultiByteStr=0x203dc34, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Rmj%6J7QaM,6GYs6i8bAx{%ivYuY7/GU", lpUsedDefaultChar=0x0) returned 32 [0095.755] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0095.755] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0095.755] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfcb03b00, ftCreationTime.dwHighDateTime=0x1bd4e50, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfcb03b00, ftLastWriteTime.dwHighDateTime=0x1bd4e50, nFileSizeHigh=0x0, nFileSizeLow=0xc5d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02810J.JPG", cAlternateFileName="")) returned 0x295098 [0095.756] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0095.756] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0095.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02810j.jpg")) returned 0x20 [0095.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02810j.jpg")) returned 0x20 [0095.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02810j.jpg")) returned 0x20 [0095.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02810j.jpg")) returned 0x20 [0095.756] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02810j.jpg"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfcb03b00, ftCreationTime.dwHighDateTime=0x1bd4e50, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfcb03b00, ftLastWriteTime.dwHighDateTime=0x1bd4e50, nFileSizeHigh=0x0, nFileSizeLow=0xc5d7)) returned 1 [0095.756] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0095.756] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0095.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02810j.jpg")) returned 0x20 [0095.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02810j.jpg")) returned 0x20 [0095.756] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0095.756] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0095.756] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0095.756] SetEndOfFile (hFile=0x158) returned 1 [0095.757] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02810J.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0095.757] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02810J.JPG", cchWideChar=12, lpMultiByteStr=0x3b9494c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PH02810J.JPG", lpUsedDefaultChar=0x0) returned 12 [0095.757] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02810J.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0095.757] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02810J.JPG", cchWideChar=12, lpMultiByteStr=0x3b94a6c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PH02810J.JPG", lpUsedDefaultChar=0x0) returned 12 [0095.757] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3b94a6c, cbMultiByte=12, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="PH02810J.JPGg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0095.757] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02810J.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0095.758] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02810J.JPG", cchWideChar=12, lpMultiByteStr=0x3b9494c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PH02810J.JPG", lpUsedDefaultChar=0x0) returned 12 [0095.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02810j.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0095.758] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0095.758] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0xc5d7 [0095.758] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0095.758] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0095.758] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0095.758] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02810J.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0095.758] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02810J.JPG", cchWideChar=12, lpMultiByteStr=0x3b9494c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PH02810J.JPG", lpUsedDefaultChar=0x0) returned 12 [0095.758] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02810J.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0095.758] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02810J.JPG", cchWideChar=12, lpMultiByteStr=0x3b94a6c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PH02810J.JPG", lpUsedDefaultChar=0x0) returned 12 [0095.758] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3b94a6c, cbMultiByte=12, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="PH02810J.JPG0J.JPGg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0095.759] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02810J.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0095.759] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02810J.JPG", cchWideChar=12, lpMultiByteStr=0x3b9494c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PH02810J.JPG", lpUsedDefaultChar=0x0) returned 12 [0095.759] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0095.759] CharToOemA (in: pSrc="PH02810J.JPG", pDst=0x3b94a6c | out: pDst="PH02810J.JPG") returned 1 [0095.759] WriteFile (in: hFile=0x158, lpBuffer=0x3b94a6c*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x3b94a6c*, lpNumberOfBytesWritten=0x18e048*=0xc, lpOverlapped=0x0) returned 1 [0095.760] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0095.760] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0095.760] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0095.760] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=21602332867) returned 1 [0095.760] ReadFile (in: hFile=0x11c, lpBuffer=0x3af1c60, nNumberOfBytesToRead=0xc5d7, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3af1c60*, lpNumberOfBytesRead=0x18dd7c*=0xc5d7, lpOverlapped=0x0) returned 1 [0095.762] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0095.762] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=21602521990) returned 1 [0095.771] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b438*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b5b438*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0095.771] ReadFile (in: hFile=0x11c, lpBuffer=0x3af1c60, nNumberOfBytesToRead=0xc5d7, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3af1c60*, lpNumberOfBytesRead=0x18de38*=0xc5d7, lpOverlapped=0x0) returned 1 [0095.773] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x47 [0095.773] WriteFile (in: hFile=0x158, lpBuffer=0x37f5df0*, nNumberOfBytesToWrite=0xc5d7, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x37f5df0*, lpNumberOfBytesWritten=0x18de10*=0xc5d7, lpOverlapped=0x0) returned 1 [0095.774] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0xc61e [0095.774] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0095.774] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0095.774] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0095.774] SetFilePointer (in: hFile=0x158, lDistanceToMove=12, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2a [0095.774] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0xc628 [0095.774] CloseHandle (hObject=0x11c) returned 1 [0095.774] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xc628 [0095.774] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xc628 [0095.774] SetFilePointer (in: hFile=0x158, lDistanceToMove=50728, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xc628 [0095.774] SetFilePointer (in: hFile=0x158, lDistanceToMove=50728, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0xc628 [0095.774] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xc628 [0095.775] SetFilePointer (in: hFile=0x158, lDistanceToMove=50728, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0xc628 [0095.775] SetEndOfFile (hFile=0x158) returned 1 [0095.775] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xc628 [0095.775] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xc628 [0095.775] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02810J.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0095.775] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02810J.JPG", cchWideChar=12, lpMultiByteStr=0x3b9494c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PH02810J.JPG", lpUsedDefaultChar=0x0) returned 12 [0095.775] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02810J.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0095.775] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02810J.JPG", cchWideChar=12, lpMultiByteStr=0x3b9498c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PH02810J.JPG", lpUsedDefaultChar=0x0) returned 12 [0095.775] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3b9498c, cbMultiByte=12, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="PH02810J.JPGꞗ@涤(\x18믉`믑`") returned 12 [0095.775] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02810J.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0095.775] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02810J.JPG", cchWideChar=12, lpMultiByteStr=0x3b9494c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PH02810J.JPG", lpUsedDefaultChar=0x0) returned 12 [0095.775] WriteFile (in: hFile=0x158, lpBuffer=0x3ad5738*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5738*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0095.775] CharToOemA (in: pSrc="PH02810J.JPG", pDst=0x3b9498c | out: pDst="PH02810J.JPG") returned 1 [0095.775] WriteFile (in: hFile=0x158, lpBuffer=0x3b9498c*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3b9498c*, lpNumberOfBytesWritten=0x18efcc*=0xc, lpOverlapped=0x0) returned 1 [0095.775] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b350*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x3b5b350*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0095.775] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0095.776] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0095.776] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xc66d [0095.776] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xc66d [0095.776] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0095.776] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0095.776] DeleteFileW (lpFileName="") returned 0 [0095.776] GetLastError () returned 0x3 [0095.776] GetFileAttributesW (lpFileName="") returned 0xffffffff [0095.776] SetLastError (dwErrCode=0x3) [0095.776] FlushFileBuffers (hFile=0x158) returned 1 [0095.779] GetCurrentThreadId () returned 0x970 [0095.779] GetCurrentThreadId () returned 0x970 [0095.779] GetCurrentThreadId () returned 0x970 [0095.779] GetCurrentThreadId () returned 0x970 [0095.779] GetCurrentThreadId () returned 0x970 [0095.779] GetCurrentThreadId () returned 0x970 [0095.779] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xc724 [0095.779] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xc724 [0095.779] SetFilePointer (in: hFile=0x158, lDistanceToMove=50980, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xc724 [0095.779] CloseHandle (hObject=0x158) returned 1 [0095.780] GetCurrentThreadId () returned 0x970 [0095.780] GetCurrentThreadId () returned 0x970 [0095.780] GetCurrentThreadId () returned 0x970 [0095.780] GetCurrentThreadId () returned 0x970 [0095.780] GetCurrentThreadId () returned 0x970 [0095.780] GetCurrentThreadId () returned 0x970 [0095.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [PH02810J.JPG].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [ph02810j.jpg].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0095.780] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc724 [0095.780] SetFilePointer (in: hFile=0x158, lDistanceToMove=50852, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc6a4 [0095.780] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0095.780] GetFileType (hFile=0x158) returned 0x1 [0095.780] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2b, wMilliseconds=0x2e)) [0095.780] GetCurrentThreadId () returned 0x970 [0095.780] GetCurrentThreadId () returned 0x970 [0095.780] GetCurrentThreadId () returned 0x970 [0095.780] GetCurrentThreadId () returned 0x970 [0095.780] GetCurrentThreadId () returned 0x970 [0095.780] GetCurrentThreadId () returned 0x970 [0095.780] GetCurrentThreadId () returned 0x970 [0095.780] GetCurrentThreadId () returned 0x970 [0095.780] GetCurrentThreadId () returned 0x970 [0095.780] GetCurrentThreadId () returned 0x970 [0095.780] GetCurrentThreadId () returned 0x970 [0095.780] GetCurrentThreadId () returned 0x970 [0095.780] GetCurrentThreadId () returned 0x970 [0095.780] GetCurrentThreadId () returned 0x970 [0095.780] GetCurrentThreadId () returned 0x970 [0095.780] GetCurrentThreadId () returned 0x970 [0095.780] GetCurrentThreadId () returned 0x970 [0095.780] GetCurrentThreadId () returned 0x970 [0095.781] GetCurrentThreadId () returned 0x970 [0095.781] GetCurrentThreadId () returned 0x970 [0095.781] GetCurrentThreadId () returned 0x970 [0095.781] GetCurrentThreadId () returned 0x970 [0095.781] GetCurrentThreadId () returned 0x970 [0095.781] GetCurrentThreadId () returned 0x970 [0095.781] GetCurrentThreadId () returned 0x970 [0095.781] GetCurrentThreadId () returned 0x970 [0095.781] GetCurrentThreadId () returned 0x970 [0095.781] GetCurrentThreadId () returned 0x970 [0095.781] GetCurrentThreadId () returned 0x970 [0095.781] GetCurrentThreadId () returned 0x970 [0095.781] GetCurrentThreadId () returned 0x970 [0095.781] GetCurrentThreadId () returned 0x970 [0095.781] GetCurrentThreadId () returned 0x970 [0095.781] GetCurrentThreadId () returned 0x970 [0095.781] GetCurrentThreadId () returned 0x970 [0095.781] GetCurrentThreadId () returned 0x970 [0095.781] GetCurrentThreadId () returned 0x970 [0095.781] GetCurrentThreadId () returned 0x970 [0095.781] GetCurrentThreadId () returned 0x970 [0095.781] GetCurrentThreadId () returned 0x970 [0095.781] GetCurrentThreadId () returned 0x970 [0095.781] GetCurrentThreadId () returned 0x970 [0095.781] GetCurrentThreadId () returned 0x970 [0095.781] GetCurrentThreadId () returned 0x970 [0095.781] GetCurrentThreadId () returned 0x970 [0095.781] GetCurrentThreadId () returned 0x970 [0095.781] GetCurrentThreadId () returned 0x970 [0095.781] GetCurrentThreadId () returned 0x970 [0095.781] GetCurrentThreadId () returned 0x970 [0095.781] GetCurrentThreadId () returned 0x970 [0095.781] GetCurrentThreadId () returned 0x970 [0095.781] GetCurrentThreadId () returned 0x970 [0095.781] GetCurrentThreadId () returned 0x970 [0095.781] GetCurrentThreadId () returned 0x970 [0095.781] GetCurrentThreadId () returned 0x970 [0095.781] GetCurrentThreadId () returned 0x970 [0095.781] GetCurrentThreadId () returned 0x970 [0095.781] GetCurrentThreadId () returned 0x970 [0095.781] GetCurrentThreadId () returned 0x970 [0095.781] GetCurrentThreadId () returned 0x970 [0095.781] GetCurrentThreadId () returned 0x970 [0095.781] GetCurrentThreadId () returned 0x970 [0095.782] GetCurrentThreadId () returned 0x970 [0095.782] GetCurrentThreadId () returned 0x970 [0095.782] GetCurrentThreadId () returned 0x970 [0095.782] GetCurrentThreadId () returned 0x970 [0095.782] GetCurrentThreadId () returned 0x970 [0095.782] GetCurrentThreadId () returned 0x970 [0095.782] GetCurrentThreadId () returned 0x970 [0095.782] GetCurrentThreadId () returned 0x970 [0095.782] GetCurrentThreadId () returned 0x970 [0095.782] GetCurrentThreadId () returned 0x970 [0095.782] GetCurrentThreadId () returned 0x970 [0095.782] GetCurrentThreadId () returned 0x970 [0095.782] GetCurrentThreadId () returned 0x970 [0095.782] GetCurrentThreadId () returned 0x970 [0095.782] GetCurrentThreadId () returned 0x970 [0095.782] GetCurrentThreadId () returned 0x970 [0095.782] GetCurrentThreadId () returned 0x970 [0095.782] GetCurrentThreadId () returned 0x970 [0095.782] GetCurrentThreadId () returned 0x970 [0095.782] GetCurrentThreadId () returned 0x970 [0095.782] GetCurrentThreadId () returned 0x970 [0095.782] GetCurrentThreadId () returned 0x970 [0095.782] GetCurrentThreadId () returned 0x970 [0095.782] GetCurrentThreadId () returned 0x970 [0095.782] GetCurrentThreadId () returned 0x970 [0095.782] GetCurrentThreadId () returned 0x970 [0095.782] GetCurrentThreadId () returned 0x970 [0095.782] GetCurrentThreadId () returned 0x970 [0095.782] GetCurrentThreadId () returned 0x970 [0095.782] GetCurrentThreadId () returned 0x970 [0095.782] GetCurrentThreadId () returned 0x970 [0095.782] GetCurrentThreadId () returned 0x970 [0095.782] GetCurrentThreadId () returned 0x970 [0095.782] GetCurrentThreadId () returned 0x970 [0095.782] GetCurrentThreadId () returned 0x970 [0095.782] GetCurrentThreadId () returned 0x970 [0095.782] GetCurrentThreadId () returned 0x970 [0095.782] GetCurrentThreadId () returned 0x970 [0095.782] GetCurrentThreadId () returned 0x970 [0095.782] GetCurrentThreadId () returned 0x970 [0095.782] GetCurrentThreadId () returned 0x970 [0095.782] GetCurrentThreadId () returned 0x970 [0095.783] GetCurrentThreadId () returned 0x970 [0095.783] GetCurrentThreadId () returned 0x970 [0095.783] GetCurrentThreadId () returned 0x970 [0095.783] GetCurrentThreadId () returned 0x970 [0095.783] GetCurrentThreadId () returned 0x970 [0095.783] GetCurrentThreadId () returned 0x970 [0095.783] GetCurrentThreadId () returned 0x970 [0095.783] GetCurrentThreadId () returned 0x970 [0095.783] GetCurrentThreadId () returned 0x970 [0095.783] GetCurrentThreadId () returned 0x970 [0095.783] GetCurrentThreadId () returned 0x970 [0095.783] GetCurrentThreadId () returned 0x970 [0095.783] GetCurrentThreadId () returned 0x970 [0095.783] GetCurrentThreadId () returned 0x970 [0095.783] GetCurrentThreadId () returned 0x970 [0095.783] GetCurrentThreadId () returned 0x970 [0095.783] GetCurrentThreadId () returned 0x970 [0095.783] GetCurrentThreadId () returned 0x970 [0095.783] GetCurrentThreadId () returned 0x970 [0095.783] GetCurrentThreadId () returned 0x970 [0095.783] GetCurrentThreadId () returned 0x970 [0095.783] GetCurrentThreadId () returned 0x970 [0095.783] GetCurrentThreadId () returned 0x970 [0095.783] GetCurrentThreadId () returned 0x970 [0095.783] GetCurrentThreadId () returned 0x970 [0095.783] GetCurrentThreadId () returned 0x970 [0095.783] GetCurrentThreadId () returned 0x970 [0095.783] GetCurrentThreadId () returned 0x970 [0095.783] GetCurrentThreadId () returned 0x970 [0095.783] GetCurrentThreadId () returned 0x970 [0095.783] GetCurrentThreadId () returned 0x970 [0095.783] GetCurrentThreadId () returned 0x970 [0095.783] GetCurrentThreadId () returned 0x970 [0095.783] GetCurrentThreadId () returned 0x970 [0095.783] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0095.783] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0095.783] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b618f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0095.783] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0095.783] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0095.783] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b618f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0095.783] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0095.784] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0095.784] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b530, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0095.784] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0095.784] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0095.784] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b530, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0095.784] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0095.784] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0095.784] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b61950, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0095.784] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0095.784] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0095.784] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b61950, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0095.784] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0095.784] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0095.784] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b61950, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0095.784] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2b, wMilliseconds=0x3d)) [0095.784] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Rmj%6J7QaM,6GYs6i8bAx{%ivYuY7/GU", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0095.784] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Rmj%6J7QaM,6GYs6i8bAx{%ivYuY7/GU", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0095.784] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Rmj%6J7QaM,6GYs6i8bAx{%ivYuY7/GU", cchWideChar=32, lpMultiByteStr=0x3b57a88, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Rmj%6J7QaM,6GYs6i8bAx{%ivYuY7/GU", lpUsedDefaultChar=0x0) returned 32 [0095.784] GetCurrentThreadId () returned 0x970 [0095.784] GetCurrentThreadId () returned 0x970 [0095.784] GetCurrentThreadId () returned 0x970 [0095.784] GetCurrentThreadId () returned 0x970 [0095.784] GetCurrentThreadId () returned 0x970 [0095.784] GetCurrentThreadId () returned 0x970 [0095.792] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0095.792] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0095.792] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3b14bd8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0095.792] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0095.792] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAADT3X72hRcRDK+fHvUVj6z8wqhzaucTSmTFEuNGtCLMRXaiusZ80LFWy1pun8QsGOzvDo2kHdANEWKlIRoZGdfT7pRZrxtCeGVMmU7zpnwgS7HSB6uRR1Y9/vBYxN2K1KS9mTv+rATQDebBZJ+Gx9mKty/iSnlUBxbE/lU8C0XOTwUoZ+ehuKjMOrAyUWA710AbGQ+jo5gkA3PM8MIRr7kiRzNZMtuL2GA==") returned 232 [0095.792] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2b, wMilliseconds=0x3d)) [0095.792] GetCurrentThreadId () returned 0x970 [0095.792] GetCurrentThreadId () returned 0x970 [0095.792] GetCurrentThreadId () returned 0x970 [0095.792] GetCurrentThreadId () returned 0x970 [0095.792] GetCurrentThreadId () returned 0x970 [0095.792] GetCurrentThreadId () returned 0x970 [0095.792] GetCurrentThreadId () returned 0x970 [0095.792] GetCurrentThreadId () returned 0x970 [0095.792] GetCurrentThreadId () returned 0x970 [0095.792] GetCurrentThreadId () returned 0x970 [0095.792] GetCurrentThreadId () returned 0x970 [0095.792] GetCurrentThreadId () returned 0x970 [0095.792] GetCurrentThreadId () returned 0x970 [0095.792] GetCurrentThreadId () returned 0x970 [0095.792] GetCurrentThreadId () returned 0x970 [0095.792] GetCurrentThreadId () returned 0x970 [0095.792] GetCurrentThreadId () returned 0x970 [0095.792] GetCurrentThreadId () returned 0x970 [0095.792] GetCurrentThreadId () returned 0x970 [0095.792] GetCurrentThreadId () returned 0x970 [0095.792] GetCurrentThreadId () returned 0x970 [0095.792] GetCurrentThreadId () returned 0x970 [0095.792] GetCurrentThreadId () returned 0x970 [0095.792] GetCurrentThreadId () returned 0x970 [0095.792] GetCurrentThreadId () returned 0x970 [0095.792] GetCurrentThreadId () returned 0x970 [0095.792] GetCurrentThreadId () returned 0x970 [0095.793] GetCurrentThreadId () returned 0x970 [0095.793] GetCurrentThreadId () returned 0x970 [0095.793] GetCurrentThreadId () returned 0x970 [0095.793] GetCurrentThreadId () returned 0x970 [0095.793] GetCurrentThreadId () returned 0x970 [0095.793] GetCurrentThreadId () returned 0x970 [0095.793] GetCurrentThreadId () returned 0x970 [0095.793] GetCurrentThreadId () returned 0x970 [0095.793] GetCurrentThreadId () returned 0x970 [0095.793] GetCurrentThreadId () returned 0x970 [0095.793] GetCurrentThreadId () returned 0x970 [0095.793] GetCurrentThreadId () returned 0x970 [0095.793] GetCurrentThreadId () returned 0x970 [0095.793] GetCurrentThreadId () returned 0x970 [0095.793] GetCurrentThreadId () returned 0x970 [0095.793] GetCurrentThreadId () returned 0x970 [0095.793] GetCurrentThreadId () returned 0x970 [0095.793] GetCurrentThreadId () returned 0x970 [0095.793] GetCurrentThreadId () returned 0x970 [0095.793] GetCurrentThreadId () returned 0x970 [0095.793] GetCurrentThreadId () returned 0x970 [0095.793] GetCurrentThreadId () returned 0x970 [0095.793] GetCurrentThreadId () returned 0x970 [0095.793] GetCurrentThreadId () returned 0x970 [0095.793] GetCurrentThreadId () returned 0x970 [0095.793] GetCurrentThreadId () returned 0x970 [0095.793] GetCurrentThreadId () returned 0x970 [0095.793] GetCurrentThreadId () returned 0x970 [0095.793] GetCurrentThreadId () returned 0x970 [0095.793] GetCurrentThreadId () returned 0x970 [0095.793] GetCurrentThreadId () returned 0x970 [0095.793] GetCurrentThreadId () returned 0x970 [0095.793] GetCurrentThreadId () returned 0x970 [0095.793] GetCurrentThreadId () returned 0x970 [0095.793] GetCurrentThreadId () returned 0x970 [0095.793] GetCurrentThreadId () returned 0x970 [0095.793] GetCurrentThreadId () returned 0x970 [0095.793] GetCurrentThreadId () returned 0x970 [0095.793] GetCurrentThreadId () returned 0x970 [0095.793] GetCurrentThreadId () returned 0x970 [0095.793] GetCurrentThreadId () returned 0x970 [0095.793] GetCurrentThreadId () returned 0x970 [0095.793] GetCurrentThreadId () returned 0x970 [0095.793] GetCurrentThreadId () returned 0x970 [0095.793] GetCurrentThreadId () returned 0x970 [0095.793] GetCurrentThreadId () returned 0x970 [0095.794] GetCurrentThreadId () returned 0x970 [0095.794] GetCurrentThreadId () returned 0x970 [0095.794] GetCurrentThreadId () returned 0x970 [0095.794] GetCurrentThreadId () returned 0x970 [0095.794] GetCurrentThreadId () returned 0x970 [0095.794] GetCurrentThreadId () returned 0x970 [0095.794] GetCurrentThreadId () returned 0x970 [0095.794] GetCurrentThreadId () returned 0x970 [0095.794] GetCurrentThreadId () returned 0x970 [0095.794] GetCurrentThreadId () returned 0x970 [0095.794] GetCurrentThreadId () returned 0x970 [0095.794] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAADT3X72hRcRDK+fHvUVj6z8wqhzaucTSmTFEuNGtCLMRXaiusZ80LFWy1pun8QsGOzvDo2kHdANEWKlIRoZGdfT7pRZrxtCeGVMmU7zpnwgS7HSB6uRR1Y9/vBYxN2K1KS9mTv+rATQDebBZJ+Gx9mKty/iSnlUBxbE/lU8C0XOTwUoZ+ehuKjMOrAyUWA710AbGQ+jo5gkA3PM8MIRr7kiRzNZMtuL2GA==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0095.794] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAADT3X72hRcRDK+fHvUVj6z8wqhzaucTSmTFEuNGtCLMRXaiusZ80LFWy1pun8QsGOzvDo2kHdANEWKlIRoZGdfT7pRZrxtCeGVMmU7zpnwgS7HSB6uRR1Y9/vBYxN2K1KS9mTv+rATQDebBZJ+Gx9mKty/iSnlUBxbE/lU8C0XOTwUoZ+ehuKjMOrAyUWA710AbGQ+jo5gkA3PM8MIRr7kiRzNZMtuL2GA==", cchWideChar=245, lpMultiByteStr=0x3b4d08c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAADT3X72hRcRDK+fHvUVj6z8wqhzaucTSmTFEuNGtCLMRXaiusZ80LFWy1pun8QsGOzvDo2kHdANEWKlIRoZGdfT7pRZrxtCeGVMmU7zpnwgS7HSB6uRR1Y9/vBYxN2K1KS9mTv+rATQDebBZJ+Gx9mKty/iSnlUBxbE/lU8C0XOTwUoZ+ehuKjMOrAyUWA710AbGQ+jo5gkA3PM8MIRr7kiRzNZMtuL2GA==", lpUsedDefaultChar=0x0) returned 245 [0095.794] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0095.794] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0095.794] CloseHandle (hObject=0x158) returned 1 [0095.794] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02810j.jpg")) returned 1 [0095.795] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=21605887213) returned 1 [0095.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [PH02829J.JPG].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [ph02829j.jpg].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0095.796] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0095.796] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0095.796] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0095.796] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0095.796] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0095.796] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0095.797] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0095.797] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0095.797] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0095.797] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0095.797] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0095.797] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0095.797] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0095.797] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0095.797] SetEndOfFile (hFile=0x158) returned 1 [0095.797] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0095.797] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0095.797] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0095.797] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0095.797] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0095.798] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0095.798] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bp6l-GQ<9I\\k(C/}dm.K>8k/T/Yz>d,I", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0095.798] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bp6l-GQ<9I\\k(C/}dm.K>8k/T/Yz>d,I", cchWideChar=32, lpMultiByteStr=0x203dc6c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bp6l-GQ<9I\\k(C/}dm.K>8k/T/Yz>d,I", lpUsedDefaultChar=0x0) returned 32 [0095.798] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0095.798] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0095.799] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81187900, ftCreationTime.dwHighDateTime=0x1bd4c19, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81187900, ftLastWriteTime.dwHighDateTime=0x1bd4c19, nFileSizeHigh=0x0, nFileSizeLow=0xf438, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH02829J.JPG", cAlternateFileName="")) returned 0x295098 [0095.799] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0095.799] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0095.799] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02829j.jpg")) returned 0x20 [0095.799] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02829j.jpg")) returned 0x20 [0095.799] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02829j.jpg")) returned 0x20 [0095.799] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02829j.jpg")) returned 0x20 [0095.799] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02829j.jpg"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81187900, ftCreationTime.dwHighDateTime=0x1bd4c19, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81187900, ftLastWriteTime.dwHighDateTime=0x1bd4c19, nFileSizeHigh=0x0, nFileSizeLow=0xf438)) returned 1 [0095.799] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0095.799] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0095.799] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02829j.jpg")) returned 0x20 [0095.799] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02829j.jpg")) returned 0x20 [0095.799] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0095.799] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0095.800] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0095.800] SetEndOfFile (hFile=0x158) returned 1 [0095.800] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02829J.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0095.800] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02829J.JPG", cchWideChar=12, lpMultiByteStr=0x3b94d2c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PH02829J.JPG", lpUsedDefaultChar=0x0) returned 12 [0095.800] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02829J.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0095.800] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02829J.JPG", cchWideChar=12, lpMultiByteStr=0x3b94e4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PH02829J.JPG", lpUsedDefaultChar=0x0) returned 12 [0095.801] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3b94e4c, cbMultiByte=12, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="PH02829J.JPGg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0095.801] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02829J.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0095.801] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02829J.JPG", cchWideChar=12, lpMultiByteStr=0x3b94d2c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PH02829J.JPG", lpUsedDefaultChar=0x0) returned 12 [0095.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02829j.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0095.801] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0095.801] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0xf438 [0095.801] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0095.801] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0095.801] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0095.801] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02829J.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0095.801] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02829J.JPG", cchWideChar=12, lpMultiByteStr=0x3b94d2c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PH02829J.JPG", lpUsedDefaultChar=0x0) returned 12 [0095.802] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02829J.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0095.802] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02829J.JPG", cchWideChar=12, lpMultiByteStr=0x3b94e4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PH02829J.JPG", lpUsedDefaultChar=0x0) returned 12 [0095.802] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3b94e4c, cbMultiByte=12, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="PH02829J.JPG9J.JPGg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0095.802] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02829J.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0095.802] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02829J.JPG", cchWideChar=12, lpMultiByteStr=0x3b94d2c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PH02829J.JPG", lpUsedDefaultChar=0x0) returned 12 [0095.802] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0095.803] CharToOemA (in: pSrc="PH02829J.JPG", pDst=0x3b94e4c | out: pDst="PH02829J.JPG") returned 1 [0095.803] WriteFile (in: hFile=0x158, lpBuffer=0x3b94e4c*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x3b94e4c*, lpNumberOfBytesWritten=0x18e048*=0xc, lpOverlapped=0x0) returned 1 [0095.803] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0095.803] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0095.803] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0095.803] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=21606646329) returned 1 [0095.803] ReadFile (in: hFile=0x11c, lpBuffer=0x3af1c60, nNumberOfBytesToRead=0xf438, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3af1c60*, lpNumberOfBytesRead=0x18dd7c*=0xf438, lpOverlapped=0x0) returned 1 [0095.805] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0095.805] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=21606843969) returned 1 [0095.814] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b420*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b5b420*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0095.814] ReadFile (in: hFile=0x11c, lpBuffer=0x3af1c60, nNumberOfBytesToRead=0xf438, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3af1c60*, lpNumberOfBytesRead=0x18de38*=0xf438, lpOverlapped=0x0) returned 1 [0095.816] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x47 [0095.816] WriteFile (in: hFile=0x158, lpBuffer=0x37f5df0*, nNumberOfBytesToWrite=0xf438, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x37f5df0*, lpNumberOfBytesWritten=0x18de10*=0xf438, lpOverlapped=0x0) returned 1 [0095.817] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0xf47f [0095.817] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0095.817] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0095.817] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0095.818] SetFilePointer (in: hFile=0x158, lDistanceToMove=12, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2a [0095.818] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0xf489 [0095.818] CloseHandle (hObject=0x11c) returned 1 [0095.818] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xf489 [0095.818] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xf489 [0095.818] SetFilePointer (in: hFile=0x158, lDistanceToMove=62601, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xf489 [0095.818] SetFilePointer (in: hFile=0x158, lDistanceToMove=62601, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0xf489 [0095.818] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xf489 [0095.818] SetFilePointer (in: hFile=0x158, lDistanceToMove=62601, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0xf489 [0095.818] SetEndOfFile (hFile=0x158) returned 1 [0095.818] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xf489 [0095.818] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xf489 [0095.818] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02829J.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0095.818] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02829J.JPG", cchWideChar=12, lpMultiByteStr=0x3b94d2c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PH02829J.JPG", lpUsedDefaultChar=0x0) returned 12 [0095.818] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02829J.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0095.819] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02829J.JPG", cchWideChar=12, lpMultiByteStr=0x3b94dec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PH02829J.JPG", lpUsedDefaultChar=0x0) returned 12 [0095.819] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3b94dec, cbMultiByte=12, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="PH02829J.JPGꞗ@涤(\x18믉`믑`") returned 12 [0095.819] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02829J.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0095.819] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02829J.JPG", cchWideChar=12, lpMultiByteStr=0x3b94d2c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PH02829J.JPG", lpUsedDefaultChar=0x0) returned 12 [0095.819] WriteFile (in: hFile=0x158, lpBuffer=0x3ad5738*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5738*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0095.819] CharToOemA (in: pSrc="PH02829J.JPG", pDst=0x3b94dec | out: pDst="PH02829J.JPG") returned 1 [0095.819] WriteFile (in: hFile=0x158, lpBuffer=0x3b94dec*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3b94dec*, lpNumberOfBytesWritten=0x18efcc*=0xc, lpOverlapped=0x0) returned 1 [0095.819] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b3b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x3b5b3b0*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0095.819] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0095.819] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0095.819] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xf4ce [0095.819] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xf4ce [0095.819] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0095.819] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0095.819] DeleteFileW (lpFileName="") returned 0 [0095.819] GetLastError () returned 0x3 [0095.820] GetFileAttributesW (lpFileName="") returned 0xffffffff [0095.820] SetLastError (dwErrCode=0x3) [0095.820] FlushFileBuffers (hFile=0x158) returned 1 [0095.823] GetCurrentThreadId () returned 0x970 [0095.823] GetCurrentThreadId () returned 0x970 [0095.823] GetCurrentThreadId () returned 0x970 [0095.823] GetCurrentThreadId () returned 0x970 [0095.823] GetCurrentThreadId () returned 0x970 [0095.823] GetCurrentThreadId () returned 0x970 [0095.823] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xf585 [0095.823] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xf585 [0095.823] SetFilePointer (in: hFile=0x158, lDistanceToMove=62853, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xf585 [0095.823] CloseHandle (hObject=0x158) returned 1 [0095.823] GetCurrentThreadId () returned 0x970 [0095.823] GetCurrentThreadId () returned 0x970 [0095.823] GetCurrentThreadId () returned 0x970 [0095.823] GetCurrentThreadId () returned 0x970 [0095.823] GetCurrentThreadId () returned 0x970 [0095.823] GetCurrentThreadId () returned 0x970 [0095.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [PH02829J.JPG].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [ph02829j.jpg].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0095.823] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf585 [0095.823] SetFilePointer (in: hFile=0x158, lDistanceToMove=62725, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf505 [0095.823] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0095.823] GetFileType (hFile=0x158) returned 0x1 [0095.824] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2b, wMilliseconds=0x5c)) [0095.824] GetCurrentThreadId () returned 0x970 [0095.824] GetCurrentThreadId () returned 0x970 [0095.824] GetCurrentThreadId () returned 0x970 [0095.824] GetCurrentThreadId () returned 0x970 [0095.824] GetCurrentThreadId () returned 0x970 [0095.824] GetCurrentThreadId () returned 0x970 [0095.824] GetCurrentThreadId () returned 0x970 [0095.824] GetCurrentThreadId () returned 0x970 [0095.824] GetCurrentThreadId () returned 0x970 [0095.824] GetCurrentThreadId () returned 0x970 [0095.824] GetCurrentThreadId () returned 0x970 [0095.824] GetCurrentThreadId () returned 0x970 [0095.824] GetCurrentThreadId () returned 0x970 [0095.824] GetCurrentThreadId () returned 0x970 [0095.824] GetCurrentThreadId () returned 0x970 [0095.824] GetCurrentThreadId () returned 0x970 [0095.824] GetCurrentThreadId () returned 0x970 [0095.824] GetCurrentThreadId () returned 0x970 [0095.824] GetCurrentThreadId () returned 0x970 [0095.824] GetCurrentThreadId () returned 0x970 [0095.824] GetCurrentThreadId () returned 0x970 [0095.824] GetCurrentThreadId () returned 0x970 [0095.824] GetCurrentThreadId () returned 0x970 [0095.824] GetCurrentThreadId () returned 0x970 [0095.824] GetCurrentThreadId () returned 0x970 [0095.824] GetCurrentThreadId () returned 0x970 [0095.824] GetCurrentThreadId () returned 0x970 [0095.824] GetCurrentThreadId () returned 0x970 [0095.824] GetCurrentThreadId () returned 0x970 [0095.824] GetCurrentThreadId () returned 0x970 [0095.824] GetCurrentThreadId () returned 0x970 [0095.824] GetCurrentThreadId () returned 0x970 [0095.824] GetCurrentThreadId () returned 0x970 [0095.824] GetCurrentThreadId () returned 0x970 [0095.824] GetCurrentThreadId () returned 0x970 [0095.824] GetCurrentThreadId () returned 0x970 [0095.824] GetCurrentThreadId () returned 0x970 [0095.824] GetCurrentThreadId () returned 0x970 [0095.824] GetCurrentThreadId () returned 0x970 [0095.824] GetCurrentThreadId () returned 0x970 [0095.824] GetCurrentThreadId () returned 0x970 [0095.824] GetCurrentThreadId () returned 0x970 [0095.824] GetCurrentThreadId () returned 0x970 [0095.825] GetCurrentThreadId () returned 0x970 [0095.825] GetCurrentThreadId () returned 0x970 [0095.825] GetCurrentThreadId () returned 0x970 [0095.825] GetCurrentThreadId () returned 0x970 [0095.825] GetCurrentThreadId () returned 0x970 [0095.825] GetCurrentThreadId () returned 0x970 [0095.825] GetCurrentThreadId () returned 0x970 [0095.825] GetCurrentThreadId () returned 0x970 [0095.825] GetCurrentThreadId () returned 0x970 [0095.825] GetCurrentThreadId () returned 0x970 [0095.825] GetCurrentThreadId () returned 0x970 [0095.825] GetCurrentThreadId () returned 0x970 [0095.825] GetCurrentThreadId () returned 0x970 [0095.825] GetCurrentThreadId () returned 0x970 [0095.825] GetCurrentThreadId () returned 0x970 [0095.825] GetCurrentThreadId () returned 0x970 [0095.825] GetCurrentThreadId () returned 0x970 [0095.825] GetCurrentThreadId () returned 0x970 [0095.825] GetCurrentThreadId () returned 0x970 [0095.825] GetCurrentThreadId () returned 0x970 [0095.825] GetCurrentThreadId () returned 0x970 [0095.825] GetCurrentThreadId () returned 0x970 [0095.825] GetCurrentThreadId () returned 0x970 [0095.825] GetCurrentThreadId () returned 0x970 [0095.825] GetCurrentThreadId () returned 0x970 [0095.825] GetCurrentThreadId () returned 0x970 [0095.825] GetCurrentThreadId () returned 0x970 [0095.825] GetCurrentThreadId () returned 0x970 [0095.825] GetCurrentThreadId () returned 0x970 [0095.825] GetCurrentThreadId () returned 0x970 [0095.825] GetCurrentThreadId () returned 0x970 [0095.825] GetCurrentThreadId () returned 0x970 [0095.825] GetCurrentThreadId () returned 0x970 [0095.825] GetCurrentThreadId () returned 0x970 [0095.825] GetCurrentThreadId () returned 0x970 [0095.825] GetCurrentThreadId () returned 0x970 [0095.825] GetCurrentThreadId () returned 0x970 [0095.825] GetCurrentThreadId () returned 0x970 [0095.825] GetCurrentThreadId () returned 0x970 [0095.825] GetCurrentThreadId () returned 0x970 [0095.825] GetCurrentThreadId () returned 0x970 [0095.825] GetCurrentThreadId () returned 0x970 [0095.825] GetCurrentThreadId () returned 0x970 [0095.825] GetCurrentThreadId () returned 0x970 [0095.826] GetCurrentThreadId () returned 0x970 [0095.826] GetCurrentThreadId () returned 0x970 [0095.826] GetCurrentThreadId () returned 0x970 [0095.826] GetCurrentThreadId () returned 0x970 [0095.826] GetCurrentThreadId () returned 0x970 [0095.826] GetCurrentThreadId () returned 0x970 [0095.826] GetCurrentThreadId () returned 0x970 [0095.826] GetCurrentThreadId () returned 0x970 [0095.826] GetCurrentThreadId () returned 0x970 [0095.826] GetCurrentThreadId () returned 0x970 [0095.826] GetCurrentThreadId () returned 0x970 [0095.826] GetCurrentThreadId () returned 0x970 [0095.826] GetCurrentThreadId () returned 0x970 [0095.826] GetCurrentThreadId () returned 0x970 [0095.826] GetCurrentThreadId () returned 0x970 [0095.826] GetCurrentThreadId () returned 0x970 [0095.826] GetCurrentThreadId () returned 0x970 [0095.826] GetCurrentThreadId () returned 0x970 [0095.826] GetCurrentThreadId () returned 0x970 [0095.826] GetCurrentThreadId () returned 0x970 [0095.826] GetCurrentThreadId () returned 0x970 [0095.826] GetCurrentThreadId () returned 0x970 [0095.826] GetCurrentThreadId () returned 0x970 [0095.826] GetCurrentThreadId () returned 0x970 [0095.826] GetCurrentThreadId () returned 0x970 [0095.826] GetCurrentThreadId () returned 0x970 [0095.826] GetCurrentThreadId () returned 0x970 [0095.826] GetCurrentThreadId () returned 0x970 [0095.826] GetCurrentThreadId () returned 0x970 [0095.826] GetCurrentThreadId () returned 0x970 [0095.826] GetCurrentThreadId () returned 0x970 [0095.826] GetCurrentThreadId () returned 0x970 [0095.826] GetCurrentThreadId () returned 0x970 [0095.826] GetCurrentThreadId () returned 0x970 [0095.826] GetCurrentThreadId () returned 0x970 [0095.826] GetCurrentThreadId () returned 0x970 [0095.826] GetCurrentThreadId () returned 0x970 [0095.826] GetCurrentThreadId () returned 0x970 [0095.826] GetCurrentThreadId () returned 0x970 [0095.826] GetCurrentThreadId () returned 0x970 [0095.826] GetCurrentThreadId () returned 0x970 [0095.826] GetCurrentThreadId () returned 0x970 [0095.826] GetCurrentThreadId () returned 0x970 [0095.826] GetCurrentThreadId () returned 0x970 [0095.826] GetCurrentThreadId () returned 0x970 [0095.827] GetCurrentThreadId () returned 0x970 [0095.827] GetCurrentThreadId () returned 0x970 [0095.827] GetCurrentThreadId () returned 0x970 [0095.827] GetCurrentThreadId () returned 0x970 [0095.827] GetCurrentThreadId () returned 0x970 [0095.827] GetCurrentThreadId () returned 0x970 [0095.827] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0095.827] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0095.827] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b61950, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0095.827] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0095.827] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0095.827] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b61950, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0095.827] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0095.827] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0095.827] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b548, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0095.827] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0095.827] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0095.827] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b548, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0095.827] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0095.827] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0095.827] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b619b0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0095.827] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0095.827] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0095.827] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b619b0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0095.827] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0095.827] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0095.827] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b619b0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0095.827] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2b, wMilliseconds=0x5c)) [0095.827] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bp6l-GQ<9I\\k(C/}dm.K>8k/T/Yz>d,I", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0095.827] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bp6l-GQ<9I\\k(C/}dm.K>8k/T/Yz>d,I", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0095.827] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bp6l-GQ<9I\\k(C/}dm.K>8k/T/Yz>d,I", cchWideChar=32, lpMultiByteStr=0x3b57ab8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bp6l-GQ<9I\\k(C/}dm.K>8k/T/Yz>d,I", lpUsedDefaultChar=0x0) returned 32 [0095.828] GetCurrentThreadId () returned 0x970 [0095.828] GetCurrentThreadId () returned 0x970 [0095.828] GetCurrentThreadId () returned 0x970 [0095.828] GetCurrentThreadId () returned 0x970 [0095.828] GetCurrentThreadId () returned 0x970 [0095.828] GetCurrentThreadId () returned 0x970 [0095.835] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0095.835] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0095.835] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3b14cc8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0095.835] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0095.835] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAAI2v7lIWXdxvEqX27tSIq4CGLap8hi6ljwwXwtiUs9dtZ5UAPySuTjG44kU05mCLpoaAWDtLrWDb2STFDGRuxtOo5ARea+OKXLrvj9/qtmNw4NTCfU0zVz6hrcb4/5Y3fxgsTgC6Zw8j+IwoMu15AngkI2dudTsrjVdMPw3GAeoRKZ/1LmUgjDMl6oKt3ciZvnbTMiRWoBS3IAnepu4D3+vwj2gb8sdiA==") returned 232 [0095.835] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2b, wMilliseconds=0x6c)) [0095.835] GetCurrentThreadId () returned 0x970 [0095.835] GetCurrentThreadId () returned 0x970 [0095.835] GetCurrentThreadId () returned 0x970 [0095.835] GetCurrentThreadId () returned 0x970 [0095.835] GetCurrentThreadId () returned 0x970 [0095.835] GetCurrentThreadId () returned 0x970 [0095.835] GetCurrentThreadId () returned 0x970 [0095.835] GetCurrentThreadId () returned 0x970 [0095.835] GetCurrentThreadId () returned 0x970 [0095.835] GetCurrentThreadId () returned 0x970 [0095.835] GetCurrentThreadId () returned 0x970 [0095.835] GetCurrentThreadId () returned 0x970 [0095.835] GetCurrentThreadId () returned 0x970 [0095.836] GetCurrentThreadId () returned 0x970 [0095.836] GetCurrentThreadId () returned 0x970 [0095.836] GetCurrentThreadId () returned 0x970 [0095.836] GetCurrentThreadId () returned 0x970 [0095.836] GetCurrentThreadId () returned 0x970 [0095.836] GetCurrentThreadId () returned 0x970 [0095.836] GetCurrentThreadId () returned 0x970 [0095.836] GetCurrentThreadId () returned 0x970 [0095.836] GetCurrentThreadId () returned 0x970 [0095.836] GetCurrentThreadId () returned 0x970 [0095.836] GetCurrentThreadId () returned 0x970 [0095.836] GetCurrentThreadId () returned 0x970 [0095.836] GetCurrentThreadId () returned 0x970 [0095.836] GetCurrentThreadId () returned 0x970 [0095.836] GetCurrentThreadId () returned 0x970 [0095.836] GetCurrentThreadId () returned 0x970 [0095.836] GetCurrentThreadId () returned 0x970 [0095.836] GetCurrentThreadId () returned 0x970 [0095.836] GetCurrentThreadId () returned 0x970 [0095.836] GetCurrentThreadId () returned 0x970 [0095.836] GetCurrentThreadId () returned 0x970 [0095.836] GetCurrentThreadId () returned 0x970 [0095.836] GetCurrentThreadId () returned 0x970 [0095.836] GetCurrentThreadId () returned 0x970 [0095.836] GetCurrentThreadId () returned 0x970 [0095.836] GetCurrentThreadId () returned 0x970 [0095.836] GetCurrentThreadId () returned 0x970 [0095.836] GetCurrentThreadId () returned 0x970 [0095.836] GetCurrentThreadId () returned 0x970 [0095.836] GetCurrentThreadId () returned 0x970 [0095.836] GetCurrentThreadId () returned 0x970 [0095.836] GetCurrentThreadId () returned 0x970 [0095.836] GetCurrentThreadId () returned 0x970 [0095.836] GetCurrentThreadId () returned 0x970 [0095.836] GetCurrentThreadId () returned 0x970 [0095.836] GetCurrentThreadId () returned 0x970 [0095.836] GetCurrentThreadId () returned 0x970 [0095.836] GetCurrentThreadId () returned 0x970 [0095.836] GetCurrentThreadId () returned 0x970 [0095.836] GetCurrentThreadId () returned 0x970 [0095.836] GetCurrentThreadId () returned 0x970 [0095.836] GetCurrentThreadId () returned 0x970 [0095.836] GetCurrentThreadId () returned 0x970 [0095.836] GetCurrentThreadId () returned 0x970 [0095.836] GetCurrentThreadId () returned 0x970 [0095.837] GetCurrentThreadId () returned 0x970 [0095.837] GetCurrentThreadId () returned 0x970 [0095.837] GetCurrentThreadId () returned 0x970 [0095.837] GetCurrentThreadId () returned 0x970 [0095.837] GetCurrentThreadId () returned 0x970 [0095.837] GetCurrentThreadId () returned 0x970 [0095.837] GetCurrentThreadId () returned 0x970 [0095.837] GetCurrentThreadId () returned 0x970 [0095.837] GetCurrentThreadId () returned 0x970 [0095.837] GetCurrentThreadId () returned 0x970 [0095.837] GetCurrentThreadId () returned 0x970 [0095.837] GetCurrentThreadId () returned 0x970 [0095.837] GetCurrentThreadId () returned 0x970 [0095.837] GetCurrentThreadId () returned 0x970 [0095.837] GetCurrentThreadId () returned 0x970 [0095.837] GetCurrentThreadId () returned 0x970 [0095.837] GetCurrentThreadId () returned 0x970 [0095.837] GetCurrentThreadId () returned 0x970 [0095.837] GetCurrentThreadId () returned 0x970 [0095.837] GetCurrentThreadId () returned 0x970 [0095.837] GetCurrentThreadId () returned 0x970 [0095.837] GetCurrentThreadId () returned 0x970 [0095.837] GetCurrentThreadId () returned 0x970 [0095.837] GetCurrentThreadId () returned 0x970 [0095.837] GetCurrentThreadId () returned 0x970 [0095.837] GetCurrentThreadId () returned 0x970 [0095.837] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAAI2v7lIWXdxvEqX27tSIq4CGLap8hi6ljwwXwtiUs9dtZ5UAPySuTjG44kU05mCLpoaAWDtLrWDb2STFDGRuxtOo5ARea+OKXLrvj9/qtmNw4NTCfU0zVz6hrcb4/5Y3fxgsTgC6Zw8j+IwoMu15AngkI2dudTsrjVdMPw3GAeoRKZ/1LmUgjDMl6oKt3ciZvnbTMiRWoBS3IAnepu4D3+vwj2gb8sdiA==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0095.837] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAAI2v7lIWXdxvEqX27tSIq4CGLap8hi6ljwwXwtiUs9dtZ5UAPySuTjG44kU05mCLpoaAWDtLrWDb2STFDGRuxtOo5ARea+OKXLrvj9/qtmNw4NTCfU0zVz6hrcb4/5Y3fxgsTgC6Zw8j+IwoMu15AngkI2dudTsrjVdMPw3GAeoRKZ/1LmUgjDMl6oKt3ciZvnbTMiRWoBS3IAnepu4D3+vwj2gb8sdiA==", cchWideChar=245, lpMultiByteStr=0x3b4d08c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAAI2v7lIWXdxvEqX27tSIq4CGLap8hi6ljwwXwtiUs9dtZ5UAPySuTjG44kU05mCLpoaAWDtLrWDb2STFDGRuxtOo5ARea+OKXLrvj9/qtmNw4NTCfU0zVz6hrcb4/5Y3fxgsTgC6Zw8j+IwoMu15AngkI2dudTsrjVdMPw3GAeoRKZ/1LmUgjDMl6oKt3ciZvnbTMiRWoBS3IAnepu4D3+vwj2gb8sdiA==", lpUsedDefaultChar=0x0) returned 245 [0095.837] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0095.837] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0095.837] CloseHandle (hObject=0x158) returned 1 [0095.838] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02829j.jpg")) returned 1 [0095.839] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=21610229400) returned 1 [0095.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [PH02845G.GIF].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [ph02845g.gif].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0095.840] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0095.840] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0095.840] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0095.840] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0095.840] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0095.840] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0095.840] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0095.840] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0095.840] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0095.840] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0095.840] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0095.840] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0095.840] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0095.840] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0095.840] SetEndOfFile (hFile=0x158) returned 1 [0095.840] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0095.841] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0095.841] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0095.841] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0095.841] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0095.842] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0095.842] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o@X/e\"xURhon", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0096.194] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c=v@zY.bn)7)#tO5A}U#oI=2E5*7\"<>n", cchWideChar=32, lpMultiByteStr=0x203de64, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c=v@zY.bn)7)#tO5A}U#oI=2E5*7\"<>n", lpUsedDefaultChar=0x0) returned 32 [0096.194] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0096.194] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0096.194] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a44b570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa445, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH03224I.JPG", cAlternateFileName="")) returned 0x295098 [0096.194] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0096.194] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0096.194] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03224i.jpg")) returned 0x20 [0096.195] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03224i.jpg")) returned 0x20 [0096.195] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03224i.jpg")) returned 0x20 [0096.195] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03224i.jpg")) returned 0x20 [0096.195] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03224i.jpg"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a44b570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa445)) returned 1 [0096.195] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0096.195] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0096.195] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03224i.jpg")) returned 0x20 [0096.195] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03224i.jpg")) returned 0x20 [0096.195] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0096.195] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0096.195] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0096.195] SetEndOfFile (hFile=0x158) returned 1 [0096.196] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH03224I.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.196] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH03224I.JPG", cchWideChar=12, lpMultiByteStr=0x3b94a4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PH03224I.JPG", lpUsedDefaultChar=0x0) returned 12 [0096.196] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH03224I.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.196] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH03224I.JPG", cchWideChar=12, lpMultiByteStr=0x3b94acc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PH03224I.JPG", lpUsedDefaultChar=0x0) returned 12 [0096.196] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3b94acc, cbMultiByte=12, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="PH03224I.JPGg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0096.196] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH03224I.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.196] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH03224I.JPG", cchWideChar=12, lpMultiByteStr=0x3b94a4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PH03224I.JPG", lpUsedDefaultChar=0x0) returned 12 [0096.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03224i.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0096.197] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0096.197] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0xa445 [0096.197] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0096.197] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0096.197] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0096.197] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH03224I.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.197] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH03224I.JPG", cchWideChar=12, lpMultiByteStr=0x3b94a4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PH03224I.JPG", lpUsedDefaultChar=0x0) returned 12 [0096.197] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH03224I.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.197] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH03224I.JPG", cchWideChar=12, lpMultiByteStr=0x3b94acc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PH03224I.JPG", lpUsedDefaultChar=0x0) returned 12 [0096.197] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3b94acc, cbMultiByte=12, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="PH03224I.JPG4I.JPGg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0096.197] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH03224I.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.198] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH03224I.JPG", cchWideChar=12, lpMultiByteStr=0x3b94a4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PH03224I.JPG", lpUsedDefaultChar=0x0) returned 12 [0096.198] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0096.198] CharToOemA (in: pSrc="PH03224I.JPG", pDst=0x3b94acc | out: pDst="PH03224I.JPG") returned 1 [0096.198] WriteFile (in: hFile=0x158, lpBuffer=0x3b94acc*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x3b94acc*, lpNumberOfBytesWritten=0x18e048*=0xc, lpOverlapped=0x0) returned 1 [0096.199] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0096.199] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0096.199] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0096.199] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=21646229577) returned 1 [0096.199] ReadFile (in: hFile=0x11c, lpBuffer=0x3af1c60, nNumberOfBytesToRead=0xa445, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3af1c60*, lpNumberOfBytesRead=0x18dd7c*=0xa445, lpOverlapped=0x0) returned 1 [0096.201] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0096.201] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=21646409193) returned 1 [0096.210] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b438*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b5b438*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0096.210] ReadFile (in: hFile=0x11c, lpBuffer=0x3af1c60, nNumberOfBytesToRead=0xa445, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3af1c60*, lpNumberOfBytesRead=0x18de38*=0xa445, lpOverlapped=0x0) returned 1 [0096.211] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x47 [0096.211] WriteFile (in: hFile=0x158, lpBuffer=0x3b2c450*, nNumberOfBytesToWrite=0xa445, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3b2c450*, lpNumberOfBytesWritten=0x18de10*=0xa445, lpOverlapped=0x0) returned 1 [0096.212] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0xa48c [0096.212] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0096.212] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0096.212] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0096.212] SetFilePointer (in: hFile=0x158, lDistanceToMove=12, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2a [0096.212] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0xa496 [0096.212] CloseHandle (hObject=0x11c) returned 1 [0096.212] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xa496 [0096.212] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xa496 [0096.213] SetFilePointer (in: hFile=0x158, lDistanceToMove=42134, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xa496 [0096.213] SetFilePointer (in: hFile=0x158, lDistanceToMove=42134, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0xa496 [0096.213] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xa496 [0096.213] SetFilePointer (in: hFile=0x158, lDistanceToMove=42134, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0xa496 [0096.213] SetEndOfFile (hFile=0x158) returned 1 [0096.213] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xa496 [0096.213] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xa496 [0096.213] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH03224I.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.213] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH03224I.JPG", cchWideChar=12, lpMultiByteStr=0x3b94a4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PH03224I.JPG", lpUsedDefaultChar=0x0) returned 12 [0096.213] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH03224I.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.213] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH03224I.JPG", cchWideChar=12, lpMultiByteStr=0x3b9498c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PH03224I.JPG", lpUsedDefaultChar=0x0) returned 12 [0096.213] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3b9498c, cbMultiByte=12, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="PH03224I.JPGꞗ@涤(\x18믉`믑`") returned 12 [0096.213] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH03224I.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.213] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH03224I.JPG", cchWideChar=12, lpMultiByteStr=0x3b94a4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PH03224I.JPG", lpUsedDefaultChar=0x0) returned 12 [0096.213] WriteFile (in: hFile=0x158, lpBuffer=0x3ad5738*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5738*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0096.213] CharToOemA (in: pSrc="PH03224I.JPG", pDst=0x3b9498c | out: pDst="PH03224I.JPG") returned 1 [0096.213] WriteFile (in: hFile=0x158, lpBuffer=0x3b9498c*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3b9498c*, lpNumberOfBytesWritten=0x18efcc*=0xc, lpOverlapped=0x0) returned 1 [0096.214] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b3b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x3b5b3b0*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0096.214] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0096.214] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0096.214] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xa4db [0096.214] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xa4db [0096.214] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0096.214] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0096.214] DeleteFileW (lpFileName="") returned 0 [0096.214] GetLastError () returned 0x3 [0096.214] GetFileAttributesW (lpFileName="") returned 0xffffffff [0096.214] SetLastError (dwErrCode=0x3) [0096.214] FlushFileBuffers (hFile=0x158) returned 1 [0096.217] GetCurrentThreadId () returned 0x970 [0096.217] GetCurrentThreadId () returned 0x970 [0096.217] GetCurrentThreadId () returned 0x970 [0096.217] GetCurrentThreadId () returned 0x970 [0096.217] GetCurrentThreadId () returned 0x970 [0096.217] GetCurrentThreadId () returned 0x970 [0096.217] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xa592 [0096.217] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xa592 [0096.217] SetFilePointer (in: hFile=0x158, lDistanceToMove=42386, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xa592 [0096.217] CloseHandle (hObject=0x158) returned 1 [0096.217] GetCurrentThreadId () returned 0x970 [0096.217] GetCurrentThreadId () returned 0x970 [0096.217] GetCurrentThreadId () returned 0x970 [0096.217] GetCurrentThreadId () returned 0x970 [0096.217] GetCurrentThreadId () returned 0x970 [0096.217] GetCurrentThreadId () returned 0x970 [0096.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [PH03224I.JPG].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [ph03224i.jpg].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0096.218] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa592 [0096.218] SetFilePointer (in: hFile=0x158, lDistanceToMove=42258, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa512 [0096.218] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0096.218] GetFileType (hFile=0x158) returned 0x1 [0096.218] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2b, wMilliseconds=0x1e2)) [0096.218] GetCurrentThreadId () returned 0x970 [0096.218] GetCurrentThreadId () returned 0x970 [0096.218] GetCurrentThreadId () returned 0x970 [0096.218] GetCurrentThreadId () returned 0x970 [0096.218] GetCurrentThreadId () returned 0x970 [0096.218] GetCurrentThreadId () returned 0x970 [0096.218] GetCurrentThreadId () returned 0x970 [0096.218] GetCurrentThreadId () returned 0x970 [0096.218] GetCurrentThreadId () returned 0x970 [0096.218] GetCurrentThreadId () returned 0x970 [0096.218] GetCurrentThreadId () returned 0x970 [0096.218] GetCurrentThreadId () returned 0x970 [0096.218] GetCurrentThreadId () returned 0x970 [0096.218] GetCurrentThreadId () returned 0x970 [0096.218] GetCurrentThreadId () returned 0x970 [0096.218] GetCurrentThreadId () returned 0x970 [0096.218] GetCurrentThreadId () returned 0x970 [0096.218] GetCurrentThreadId () returned 0x970 [0096.218] GetCurrentThreadId () returned 0x970 [0096.218] GetCurrentThreadId () returned 0x970 [0096.218] GetCurrentThreadId () returned 0x970 [0096.218] GetCurrentThreadId () returned 0x970 [0096.218] GetCurrentThreadId () returned 0x970 [0096.218] GetCurrentThreadId () returned 0x970 [0096.218] GetCurrentThreadId () returned 0x970 [0096.218] GetCurrentThreadId () returned 0x970 [0096.218] GetCurrentThreadId () returned 0x970 [0096.218] GetCurrentThreadId () returned 0x970 [0096.218] GetCurrentThreadId () returned 0x970 [0096.219] GetCurrentThreadId () returned 0x970 [0096.219] GetCurrentThreadId () returned 0x970 [0096.219] GetCurrentThreadId () returned 0x970 [0096.219] GetCurrentThreadId () returned 0x970 [0096.219] GetCurrentThreadId () returned 0x970 [0096.219] GetCurrentThreadId () returned 0x970 [0096.219] GetCurrentThreadId () returned 0x970 [0096.219] GetCurrentThreadId () returned 0x970 [0096.219] GetCurrentThreadId () returned 0x970 [0096.219] GetCurrentThreadId () returned 0x970 [0096.219] GetCurrentThreadId () returned 0x970 [0096.219] GetCurrentThreadId () returned 0x970 [0096.219] GetCurrentThreadId () returned 0x970 [0096.219] GetCurrentThreadId () returned 0x970 [0096.219] GetCurrentThreadId () returned 0x970 [0096.219] GetCurrentThreadId () returned 0x970 [0096.219] GetCurrentThreadId () returned 0x970 [0096.219] GetCurrentThreadId () returned 0x970 [0096.219] GetCurrentThreadId () returned 0x970 [0096.219] GetCurrentThreadId () returned 0x970 [0096.219] GetCurrentThreadId () returned 0x970 [0096.219] GetCurrentThreadId () returned 0x970 [0096.219] GetCurrentThreadId () returned 0x970 [0096.219] GetCurrentThreadId () returned 0x970 [0096.219] GetCurrentThreadId () returned 0x970 [0096.219] GetCurrentThreadId () returned 0x970 [0096.219] GetCurrentThreadId () returned 0x970 [0096.219] GetCurrentThreadId () returned 0x970 [0096.219] GetCurrentThreadId () returned 0x970 [0096.219] GetCurrentThreadId () returned 0x970 [0096.219] GetCurrentThreadId () returned 0x970 [0096.219] GetCurrentThreadId () returned 0x970 [0096.219] GetCurrentThreadId () returned 0x970 [0096.219] GetCurrentThreadId () returned 0x970 [0096.219] GetCurrentThreadId () returned 0x970 [0096.219] GetCurrentThreadId () returned 0x970 [0096.219] GetCurrentThreadId () returned 0x970 [0096.219] GetCurrentThreadId () returned 0x970 [0096.219] GetCurrentThreadId () returned 0x970 [0096.219] GetCurrentThreadId () returned 0x970 [0096.219] GetCurrentThreadId () returned 0x970 [0096.219] GetCurrentThreadId () returned 0x970 [0096.219] GetCurrentThreadId () returned 0x970 [0096.220] GetCurrentThreadId () returned 0x970 [0096.220] GetCurrentThreadId () returned 0x970 [0096.220] GetCurrentThreadId () returned 0x970 [0096.220] GetCurrentThreadId () returned 0x970 [0096.220] GetCurrentThreadId () returned 0x970 [0096.220] GetCurrentThreadId () returned 0x970 [0096.220] GetCurrentThreadId () returned 0x970 [0096.220] GetCurrentThreadId () returned 0x970 [0096.220] GetCurrentThreadId () returned 0x970 [0096.220] GetCurrentThreadId () returned 0x970 [0096.220] GetCurrentThreadId () returned 0x970 [0096.220] GetCurrentThreadId () returned 0x970 [0096.220] GetCurrentThreadId () returned 0x970 [0096.220] GetCurrentThreadId () returned 0x970 [0096.220] GetCurrentThreadId () returned 0x970 [0096.220] GetCurrentThreadId () returned 0x970 [0096.220] GetCurrentThreadId () returned 0x970 [0096.220] GetCurrentThreadId () returned 0x970 [0096.220] GetCurrentThreadId () returned 0x970 [0096.220] GetCurrentThreadId () returned 0x970 [0096.220] GetCurrentThreadId () returned 0x970 [0096.220] GetCurrentThreadId () returned 0x970 [0096.220] GetCurrentThreadId () returned 0x970 [0096.220] GetCurrentThreadId () returned 0x970 [0096.220] GetCurrentThreadId () returned 0x970 [0096.220] GetCurrentThreadId () returned 0x970 [0096.220] GetCurrentThreadId () returned 0x970 [0096.220] GetCurrentThreadId () returned 0x970 [0096.220] GetCurrentThreadId () returned 0x970 [0096.220] GetCurrentThreadId () returned 0x970 [0096.220] GetCurrentThreadId () returned 0x970 [0096.220] GetCurrentThreadId () returned 0x970 [0096.220] GetCurrentThreadId () returned 0x970 [0096.220] GetCurrentThreadId () returned 0x970 [0096.220] GetCurrentThreadId () returned 0x970 [0096.220] GetCurrentThreadId () returned 0x970 [0096.220] GetCurrentThreadId () returned 0x970 [0096.220] GetCurrentThreadId () returned 0x970 [0096.220] GetCurrentThreadId () returned 0x970 [0096.220] GetCurrentThreadId () returned 0x970 [0096.220] GetCurrentThreadId () returned 0x970 [0096.220] GetCurrentThreadId () returned 0x970 [0096.220] GetCurrentThreadId () returned 0x970 [0096.220] GetCurrentThreadId () returned 0x970 [0096.221] GetCurrentThreadId () returned 0x970 [0096.221] GetCurrentThreadId () returned 0x970 [0096.221] GetCurrentThreadId () returned 0x970 [0096.221] GetCurrentThreadId () returned 0x970 [0096.221] GetCurrentThreadId () returned 0x970 [0096.221] GetCurrentThreadId () returned 0x970 [0096.221] GetCurrentThreadId () returned 0x970 [0096.221] GetCurrentThreadId () returned 0x970 [0096.221] GetCurrentThreadId () returned 0x970 [0096.221] GetCurrentThreadId () returned 0x970 [0096.221] GetCurrentThreadId () returned 0x970 [0096.221] GetCurrentThreadId () returned 0x970 [0096.221] GetCurrentThreadId () returned 0x970 [0096.221] GetCurrentThreadId () returned 0x970 [0096.221] GetCurrentThreadId () returned 0x970 [0096.221] GetCurrentThreadId () returned 0x970 [0096.221] GetCurrentThreadId () returned 0x970 [0096.221] GetCurrentThreadId () returned 0x970 [0096.221] GetCurrentThreadId () returned 0x970 [0096.221] GetCurrentThreadId () returned 0x970 [0096.221] GetCurrentThreadId () returned 0x970 [0096.221] GetCurrentThreadId () returned 0x970 [0096.221] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.221] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.221] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b61cb0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0096.221] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.221] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.221] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b61cb0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0096.221] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.221] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.221] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b530, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0096.221] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.221] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.221] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b530, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0096.221] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.221] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.221] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b61d10, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0096.221] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.222] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.222] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b61d10, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0096.222] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.222] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.222] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b61d10, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0096.222] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2b, wMilliseconds=0x1f2)) [0096.222] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c=v@zY.bn)7)#tO5A}U#oI=2E5*7\"<>n", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0096.222] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c=v@zY.bn)7)#tO5A}U#oI=2E5*7\"<>n", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0096.222] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c=v@zY.bn)7)#tO5A}U#oI=2E5*7\"<>n", cchWideChar=32, lpMultiByteStr=0x3b57c68, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c=v@zY.bn)7)#tO5A}U#oI=2E5*7\"<>n", lpUsedDefaultChar=0x0) returned 32 [0096.222] GetCurrentThreadId () returned 0x970 [0096.222] GetCurrentThreadId () returned 0x970 [0096.222] GetCurrentThreadId () returned 0x970 [0096.222] GetCurrentThreadId () returned 0x970 [0096.222] GetCurrentThreadId () returned 0x970 [0096.222] GetCurrentThreadId () returned 0x970 [0096.230] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0096.230] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0096.230] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3b15538, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0096.230] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0096.230] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAIBqqnaAU6jJrfp++a0AnL8Q5IyjYhDEQCrEuDEnk21po6zre3USaGEr1WUEwIGi/j4RVUjcK21DP7qaXioGlXIgN8MVJynylyQq8VAlXAgTcP0dMkywHOxjHJBAiWm0zTl4a5wkcV64Hw/IYyFCc3av7U0B3FnfRTQJSyHty5Ag5Kgobvj6NSBkY9vvlhHLYeZ0TYfEb1TGPy5iigZqdmV2J0h0aqvOEg==") returned 232 [0096.230] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2b, wMilliseconds=0x1f2)) [0096.230] GetCurrentThreadId () returned 0x970 [0096.230] GetCurrentThreadId () returned 0x970 [0096.230] GetCurrentThreadId () returned 0x970 [0096.230] GetCurrentThreadId () returned 0x970 [0096.230] GetCurrentThreadId () returned 0x970 [0096.230] GetCurrentThreadId () returned 0x970 [0096.230] GetCurrentThreadId () returned 0x970 [0096.230] GetCurrentThreadId () returned 0x970 [0096.230] GetCurrentThreadId () returned 0x970 [0096.230] GetCurrentThreadId () returned 0x970 [0096.230] GetCurrentThreadId () returned 0x970 [0096.230] GetCurrentThreadId () returned 0x970 [0096.230] GetCurrentThreadId () returned 0x970 [0096.230] GetCurrentThreadId () returned 0x970 [0096.230] GetCurrentThreadId () returned 0x970 [0096.230] GetCurrentThreadId () returned 0x970 [0096.230] GetCurrentThreadId () returned 0x970 [0096.230] GetCurrentThreadId () returned 0x970 [0096.230] GetCurrentThreadId () returned 0x970 [0096.230] GetCurrentThreadId () returned 0x970 [0096.230] GetCurrentThreadId () returned 0x970 [0096.230] GetCurrentThreadId () returned 0x970 [0096.230] GetCurrentThreadId () returned 0x970 [0096.230] GetCurrentThreadId () returned 0x970 [0096.230] GetCurrentThreadId () returned 0x970 [0096.231] GetCurrentThreadId () returned 0x970 [0096.231] GetCurrentThreadId () returned 0x970 [0096.231] GetCurrentThreadId () returned 0x970 [0096.231] GetCurrentThreadId () returned 0x970 [0096.231] GetCurrentThreadId () returned 0x970 [0096.231] GetCurrentThreadId () returned 0x970 [0096.231] GetCurrentThreadId () returned 0x970 [0096.231] GetCurrentThreadId () returned 0x970 [0096.231] GetCurrentThreadId () returned 0x970 [0096.231] GetCurrentThreadId () returned 0x970 [0096.231] GetCurrentThreadId () returned 0x970 [0096.231] GetCurrentThreadId () returned 0x970 [0096.231] GetCurrentThreadId () returned 0x970 [0096.231] GetCurrentThreadId () returned 0x970 [0096.231] GetCurrentThreadId () returned 0x970 [0096.231] GetCurrentThreadId () returned 0x970 [0096.231] GetCurrentThreadId () returned 0x970 [0096.231] GetCurrentThreadId () returned 0x970 [0096.231] GetCurrentThreadId () returned 0x970 [0096.231] GetCurrentThreadId () returned 0x970 [0096.231] GetCurrentThreadId () returned 0x970 [0096.231] GetCurrentThreadId () returned 0x970 [0096.231] GetCurrentThreadId () returned 0x970 [0096.231] GetCurrentThreadId () returned 0x970 [0096.231] GetCurrentThreadId () returned 0x970 [0096.231] GetCurrentThreadId () returned 0x970 [0096.231] GetCurrentThreadId () returned 0x970 [0096.231] GetCurrentThreadId () returned 0x970 [0096.231] GetCurrentThreadId () returned 0x970 [0096.231] GetCurrentThreadId () returned 0x970 [0096.231] GetCurrentThreadId () returned 0x970 [0096.231] GetCurrentThreadId () returned 0x970 [0096.231] GetCurrentThreadId () returned 0x970 [0096.231] GetCurrentThreadId () returned 0x970 [0096.231] GetCurrentThreadId () returned 0x970 [0096.231] GetCurrentThreadId () returned 0x970 [0096.231] GetCurrentThreadId () returned 0x970 [0096.231] GetCurrentThreadId () returned 0x970 [0096.231] GetCurrentThreadId () returned 0x970 [0096.231] GetCurrentThreadId () returned 0x970 [0096.231] GetCurrentThreadId () returned 0x970 [0096.231] GetCurrentThreadId () returned 0x970 [0096.231] GetCurrentThreadId () returned 0x970 [0096.231] GetCurrentThreadId () returned 0x970 [0096.231] GetCurrentThreadId () returned 0x970 [0096.232] GetCurrentThreadId () returned 0x970 [0096.232] GetCurrentThreadId () returned 0x970 [0096.232] GetCurrentThreadId () returned 0x970 [0096.232] GetCurrentThreadId () returned 0x970 [0096.232] GetCurrentThreadId () returned 0x970 [0096.232] GetCurrentThreadId () returned 0x970 [0096.232] GetCurrentThreadId () returned 0x970 [0096.232] GetCurrentThreadId () returned 0x970 [0096.232] GetCurrentThreadId () returned 0x970 [0096.232] GetCurrentThreadId () returned 0x970 [0096.232] GetCurrentThreadId () returned 0x970 [0096.232] GetCurrentThreadId () returned 0x970 [0096.232] GetCurrentThreadId () returned 0x970 [0096.232] GetCurrentThreadId () returned 0x970 [0096.232] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAIBqqnaAU6jJrfp++a0AnL8Q5IyjYhDEQCrEuDEnk21po6zre3USaGEr1WUEwIGi/j4RVUjcK21DP7qaXioGlXIgN8MVJynylyQq8VAlXAgTcP0dMkywHOxjHJBAiWm0zTl4a5wkcV64Hw/IYyFCc3av7U0B3FnfRTQJSyHty5Ag5Kgobvj6NSBkY9vvlhHLYeZ0TYfEb1TGPy5iigZqdmV2J0h0aqvOEg==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0096.232] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAIBqqnaAU6jJrfp++a0AnL8Q5IyjYhDEQCrEuDEnk21po6zre3USaGEr1WUEwIGi/j4RVUjcK21DP7qaXioGlXIgN8MVJynylyQq8VAlXAgTcP0dMkywHOxjHJBAiWm0zTl4a5wkcV64Hw/IYyFCc3av7U0B3FnfRTQJSyHty5Ag5Kgobvj6NSBkY9vvlhHLYeZ0TYfEb1TGPy5iigZqdmV2J0h0aqvOEg==", cchWideChar=245, lpMultiByteStr=0x3b4d08c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAIBqqnaAU6jJrfp++a0AnL8Q5IyjYhDEQCrEuDEnk21po6zre3USaGEr1WUEwIGi/j4RVUjcK21DP7qaXioGlXIgN8MVJynylyQq8VAlXAgTcP0dMkywHOxjHJBAiWm0zTl4a5wkcV64Hw/IYyFCc3av7U0B3FnfRTQJSyHty5Ag5Kgobvj6NSBkY9vvlhHLYeZ0TYfEb1TGPy5iigZqdmV2J0h0aqvOEg==", lpUsedDefaultChar=0x0) returned 245 [0096.232] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0096.232] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0096.232] CloseHandle (hObject=0x158) returned 1 [0096.232] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03224i.jpg")) returned 1 [0096.233] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=21649692578) returned 1 [0096.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [PH03379I.JPG].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [ph03379i.jpg].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0096.234] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0096.234] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0096.234] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0096.234] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0096.234] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0096.234] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0096.235] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0096.235] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0096.235] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0096.235] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0096.235] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0096.235] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0096.235] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0096.235] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0096.235] SetEndOfFile (hFile=0x158) returned 1 [0096.235] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0096.235] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0096.235] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0096.235] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0096.235] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0096.236] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0096.236] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="\"9cdv#iji?XqO-W%!%p1C.?dnzjR@8Qr", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0096.236] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="\"9cdv#iji?XqO-W%!%p1C.?dnzjR@8Qr", cchWideChar=32, lpMultiByteStr=0x203de9c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\"9cdv#iji?XqO-W%!%p1C.?dnzjR@8Qr", lpUsedDefaultChar=0x0) returned 32 [0096.236] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0096.236] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0096.236] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a44b570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2ba2, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH03379I.JPG", cAlternateFileName="")) returned 0x295098 [0096.237] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0096.237] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0096.237] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03379i.jpg")) returned 0x20 [0096.238] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03379i.jpg")) returned 0x20 [0096.238] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03379i.jpg")) returned 0x20 [0096.238] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03379i.jpg")) returned 0x20 [0096.238] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03379i.jpg"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a44b570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2ba2)) returned 1 [0096.238] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0096.238] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0096.238] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03379i.jpg")) returned 0x20 [0096.238] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03379i.jpg")) returned 0x20 [0096.238] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0096.238] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0096.238] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0096.238] SetEndOfFile (hFile=0x158) returned 1 [0096.239] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH03379I.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.239] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH03379I.JPG", cchWideChar=12, lpMultiByteStr=0x3b94dcc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PH03379I.JPG", lpUsedDefaultChar=0x0) returned 12 [0096.239] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH03379I.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.239] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH03379I.JPG", cchWideChar=12, lpMultiByteStr=0x3b94c8c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PH03379I.JPG", lpUsedDefaultChar=0x0) returned 12 [0096.239] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3b94c8c, cbMultiByte=12, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="PH03379I.JPGg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0096.239] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH03379I.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.239] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH03379I.JPG", cchWideChar=12, lpMultiByteStr=0x3b94dcc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PH03379I.JPG", lpUsedDefaultChar=0x0) returned 12 [0096.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03379i.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0096.240] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0096.240] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2ba2 [0096.240] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0096.240] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0096.240] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0096.240] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH03379I.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.240] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH03379I.JPG", cchWideChar=12, lpMultiByteStr=0x3b94dcc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PH03379I.JPG", lpUsedDefaultChar=0x0) returned 12 [0096.240] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH03379I.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.240] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH03379I.JPG", cchWideChar=12, lpMultiByteStr=0x3b94c8c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PH03379I.JPG", lpUsedDefaultChar=0x0) returned 12 [0096.240] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3b94c8c, cbMultiByte=12, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="PH03379I.JPG9I.JPGg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0096.240] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH03379I.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.240] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH03379I.JPG", cchWideChar=12, lpMultiByteStr=0x3b94dcc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PH03379I.JPG", lpUsedDefaultChar=0x0) returned 12 [0096.240] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0096.241] CharToOemA (in: pSrc="PH03379I.JPG", pDst=0x3b94c8c | out: pDst="PH03379I.JPG") returned 1 [0096.241] WriteFile (in: hFile=0x158, lpBuffer=0x3b94c8c*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x3b94c8c*, lpNumberOfBytesWritten=0x18e048*=0xc, lpOverlapped=0x0) returned 1 [0096.241] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0096.241] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0096.242] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0096.242] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=21650513331) returned 1 [0096.242] ReadFile (in: hFile=0x11c, lpBuffer=0x3af1c60, nNumberOfBytesToRead=0x2ba2, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3af1c60*, lpNumberOfBytesRead=0x18dd7c*=0x2ba2, lpOverlapped=0x0) returned 1 [0096.243] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0096.244] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=21650699282) returned 1 [0096.292] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b420*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b5b420*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0096.292] ReadFile (in: hFile=0x11c, lpBuffer=0x3af1c60, nNumberOfBytesToRead=0x2ba2, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3af1c60*, lpNumberOfBytesRead=0x18de38*=0x2ba2, lpOverlapped=0x0) returned 1 [0096.292] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x47 [0096.292] WriteFile (in: hFile=0x158, lpBuffer=0x3b2c450*, nNumberOfBytesToWrite=0x2ba2, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3b2c450*, lpNumberOfBytesWritten=0x18de10*=0x2ba2, lpOverlapped=0x0) returned 1 [0096.293] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x2be9 [0096.293] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0096.293] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0096.293] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0096.293] SetFilePointer (in: hFile=0x158, lDistanceToMove=12, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2a [0096.293] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x2bf3 [0096.294] CloseHandle (hObject=0x11c) returned 1 [0096.294] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x2bf3 [0096.294] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x2bf3 [0096.294] SetFilePointer (in: hFile=0x158, lDistanceToMove=11251, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x2bf3 [0096.294] SetFilePointer (in: hFile=0x158, lDistanceToMove=11251, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x2bf3 [0096.294] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x2bf3 [0096.294] SetFilePointer (in: hFile=0x158, lDistanceToMove=11251, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x2bf3 [0096.294] SetEndOfFile (hFile=0x158) returned 1 [0096.294] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x2bf3 [0096.294] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x2bf3 [0096.294] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH03379I.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.295] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH03379I.JPG", cchWideChar=12, lpMultiByteStr=0x3b94dcc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PH03379I.JPG", lpUsedDefaultChar=0x0) returned 12 [0096.295] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH03379I.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.295] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH03379I.JPG", cchWideChar=12, lpMultiByteStr=0x3b94dec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PH03379I.JPG", lpUsedDefaultChar=0x0) returned 12 [0096.295] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3b94dec, cbMultiByte=12, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="PH03379I.JPGꞗ@涤(\x18믉`믑`") returned 12 [0096.295] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH03379I.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.295] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH03379I.JPG", cchWideChar=12, lpMultiByteStr=0x3b94dcc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PH03379I.JPG", lpUsedDefaultChar=0x0) returned 12 [0096.295] WriteFile (in: hFile=0x158, lpBuffer=0x3ad5738*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5738*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0096.295] CharToOemA (in: pSrc="PH03379I.JPG", pDst=0x3b94dec | out: pDst="PH03379I.JPG") returned 1 [0096.295] WriteFile (in: hFile=0x158, lpBuffer=0x3b94dec*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3b94dec*, lpNumberOfBytesWritten=0x18efcc*=0xc, lpOverlapped=0x0) returned 1 [0096.295] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b470*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x3b5b470*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0096.295] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0096.295] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0096.296] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x2c38 [0096.296] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x2c38 [0096.296] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0096.296] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0096.296] DeleteFileW (lpFileName="") returned 0 [0096.296] GetLastError () returned 0x3 [0096.296] GetFileAttributesW (lpFileName="") returned 0xffffffff [0096.296] SetLastError (dwErrCode=0x3) [0096.296] FlushFileBuffers (hFile=0x158) returned 1 [0096.300] GetCurrentThreadId () returned 0x970 [0096.300] GetCurrentThreadId () returned 0x970 [0096.300] GetCurrentThreadId () returned 0x970 [0096.300] GetCurrentThreadId () returned 0x970 [0096.300] GetCurrentThreadId () returned 0x970 [0096.300] GetCurrentThreadId () returned 0x970 [0096.300] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x2cef [0096.300] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x2cef [0096.300] SetFilePointer (in: hFile=0x158, lDistanceToMove=11503, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x2cef [0096.300] CloseHandle (hObject=0x158) returned 1 [0096.300] GetCurrentThreadId () returned 0x970 [0096.300] GetCurrentThreadId () returned 0x970 [0096.300] GetCurrentThreadId () returned 0x970 [0096.300] GetCurrentThreadId () returned 0x970 [0096.300] GetCurrentThreadId () returned 0x970 [0096.300] GetCurrentThreadId () returned 0x970 [0096.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [PH03379I.JPG].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [ph03379i.jpg].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0096.301] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2cef [0096.301] SetFilePointer (in: hFile=0x158, lDistanceToMove=11375, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2c6f [0096.301] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0096.301] GetFileType (hFile=0x158) returned 0x1 [0096.301] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2b, wMilliseconds=0x240)) [0096.301] GetCurrentThreadId () returned 0x970 [0096.301] GetCurrentThreadId () returned 0x970 [0096.301] GetCurrentThreadId () returned 0x970 [0096.301] GetCurrentThreadId () returned 0x970 [0096.301] GetCurrentThreadId () returned 0x970 [0096.301] GetCurrentThreadId () returned 0x970 [0096.301] GetCurrentThreadId () returned 0x970 [0096.301] GetCurrentThreadId () returned 0x970 [0096.301] GetCurrentThreadId () returned 0x970 [0096.301] GetCurrentThreadId () returned 0x970 [0096.301] GetCurrentThreadId () returned 0x970 [0096.301] GetCurrentThreadId () returned 0x970 [0096.301] GetCurrentThreadId () returned 0x970 [0096.301] GetCurrentThreadId () returned 0x970 [0096.301] GetCurrentThreadId () returned 0x970 [0096.301] GetCurrentThreadId () returned 0x970 [0096.301] GetCurrentThreadId () returned 0x970 [0096.301] GetCurrentThreadId () returned 0x970 [0096.301] GetCurrentThreadId () returned 0x970 [0096.302] GetCurrentThreadId () returned 0x970 [0096.302] GetCurrentThreadId () returned 0x970 [0096.302] GetCurrentThreadId () returned 0x970 [0096.302] GetCurrentThreadId () returned 0x970 [0096.302] GetCurrentThreadId () returned 0x970 [0096.302] GetCurrentThreadId () returned 0x970 [0096.302] GetCurrentThreadId () returned 0x970 [0096.302] GetCurrentThreadId () returned 0x970 [0096.302] GetCurrentThreadId () returned 0x970 [0096.302] GetCurrentThreadId () returned 0x970 [0096.302] GetCurrentThreadId () returned 0x970 [0096.302] GetCurrentThreadId () returned 0x970 [0096.302] GetCurrentThreadId () returned 0x970 [0096.302] GetCurrentThreadId () returned 0x970 [0096.302] GetCurrentThreadId () returned 0x970 [0096.302] GetCurrentThreadId () returned 0x970 [0096.302] GetCurrentThreadId () returned 0x970 [0096.302] GetCurrentThreadId () returned 0x970 [0096.302] GetCurrentThreadId () returned 0x970 [0096.302] GetCurrentThreadId () returned 0x970 [0096.302] GetCurrentThreadId () returned 0x970 [0096.302] GetCurrentThreadId () returned 0x970 [0096.302] GetCurrentThreadId () returned 0x970 [0096.302] GetCurrentThreadId () returned 0x970 [0096.302] GetCurrentThreadId () returned 0x970 [0096.302] GetCurrentThreadId () returned 0x970 [0096.302] GetCurrentThreadId () returned 0x970 [0096.302] GetCurrentThreadId () returned 0x970 [0096.302] GetCurrentThreadId () returned 0x970 [0096.302] GetCurrentThreadId () returned 0x970 [0096.302] GetCurrentThreadId () returned 0x970 [0096.302] GetCurrentThreadId () returned 0x970 [0096.302] GetCurrentThreadId () returned 0x970 [0096.302] GetCurrentThreadId () returned 0x970 [0096.302] GetCurrentThreadId () returned 0x970 [0096.303] GetCurrentThreadId () returned 0x970 [0096.303] GetCurrentThreadId () returned 0x970 [0096.303] GetCurrentThreadId () returned 0x970 [0096.303] GetCurrentThreadId () returned 0x970 [0096.303] GetCurrentThreadId () returned 0x970 [0096.303] GetCurrentThreadId () returned 0x970 [0096.303] GetCurrentThreadId () returned 0x970 [0096.303] GetCurrentThreadId () returned 0x970 [0096.303] GetCurrentThreadId () returned 0x970 [0096.303] GetCurrentThreadId () returned 0x970 [0096.303] GetCurrentThreadId () returned 0x970 [0096.303] GetCurrentThreadId () returned 0x970 [0096.303] GetCurrentThreadId () returned 0x970 [0096.303] GetCurrentThreadId () returned 0x970 [0096.303] GetCurrentThreadId () returned 0x970 [0096.303] GetCurrentThreadId () returned 0x970 [0096.303] GetCurrentThreadId () returned 0x970 [0096.303] GetCurrentThreadId () returned 0x970 [0096.303] GetCurrentThreadId () returned 0x970 [0096.303] GetCurrentThreadId () returned 0x970 [0096.303] GetCurrentThreadId () returned 0x970 [0096.303] GetCurrentThreadId () returned 0x970 [0096.303] GetCurrentThreadId () returned 0x970 [0096.303] GetCurrentThreadId () returned 0x970 [0096.303] GetCurrentThreadId () returned 0x970 [0096.303] GetCurrentThreadId () returned 0x970 [0096.303] GetCurrentThreadId () returned 0x970 [0096.303] GetCurrentThreadId () returned 0x970 [0096.303] GetCurrentThreadId () returned 0x970 [0096.303] GetCurrentThreadId () returned 0x970 [0096.303] GetCurrentThreadId () returned 0x970 [0096.303] GetCurrentThreadId () returned 0x970 [0096.303] GetCurrentThreadId () returned 0x970 [0096.303] GetCurrentThreadId () returned 0x970 [0096.303] GetCurrentThreadId () returned 0x970 [0096.304] GetCurrentThreadId () returned 0x970 [0096.304] GetCurrentThreadId () returned 0x970 [0096.304] GetCurrentThreadId () returned 0x970 [0096.304] GetCurrentThreadId () returned 0x970 [0096.304] GetCurrentThreadId () returned 0x970 [0096.304] GetCurrentThreadId () returned 0x970 [0096.304] GetCurrentThreadId () returned 0x970 [0096.304] GetCurrentThreadId () returned 0x970 [0096.304] GetCurrentThreadId () returned 0x970 [0096.304] GetCurrentThreadId () returned 0x970 [0096.304] GetCurrentThreadId () returned 0x970 [0096.304] GetCurrentThreadId () returned 0x970 [0096.304] GetCurrentThreadId () returned 0x970 [0096.304] GetCurrentThreadId () returned 0x970 [0096.304] GetCurrentThreadId () returned 0x970 [0096.304] GetCurrentThreadId () returned 0x970 [0096.304] GetCurrentThreadId () returned 0x970 [0096.304] GetCurrentThreadId () returned 0x970 [0096.304] GetCurrentThreadId () returned 0x970 [0096.304] GetCurrentThreadId () returned 0x970 [0096.304] GetCurrentThreadId () returned 0x970 [0096.304] GetCurrentThreadId () returned 0x970 [0096.304] GetCurrentThreadId () returned 0x970 [0096.304] GetCurrentThreadId () returned 0x970 [0096.304] GetCurrentThreadId () returned 0x970 [0096.304] GetCurrentThreadId () returned 0x970 [0096.304] GetCurrentThreadId () returned 0x970 [0096.304] GetCurrentThreadId () returned 0x970 [0096.304] GetCurrentThreadId () returned 0x970 [0096.304] GetCurrentThreadId () returned 0x970 [0096.304] GetCurrentThreadId () returned 0x970 [0096.304] GetCurrentThreadId () returned 0x970 [0096.304] GetCurrentThreadId () returned 0x970 [0096.304] GetCurrentThreadId () returned 0x970 [0096.305] GetCurrentThreadId () returned 0x970 [0096.305] GetCurrentThreadId () returned 0x970 [0096.305] GetCurrentThreadId () returned 0x970 [0096.305] GetCurrentThreadId () returned 0x970 [0096.305] GetCurrentThreadId () returned 0x970 [0096.305] GetCurrentThreadId () returned 0x970 [0096.305] GetCurrentThreadId () returned 0x970 [0096.305] GetCurrentThreadId () returned 0x970 [0096.305] GetCurrentThreadId () returned 0x970 [0096.305] GetCurrentThreadId () returned 0x970 [0096.305] GetCurrentThreadId () returned 0x970 [0096.305] GetCurrentThreadId () returned 0x970 [0096.305] GetCurrentThreadId () returned 0x970 [0096.305] GetCurrentThreadId () returned 0x970 [0096.305] GetCurrentThreadId () returned 0x970 [0096.305] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.305] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.305] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b61d10, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0096.305] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.305] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.305] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b61d10, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0096.305] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.305] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.305] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b548, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0096.305] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.305] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.305] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b548, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0096.305] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.306] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.306] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b61d70, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0096.306] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.306] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.306] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b61d70, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0096.306] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.306] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.306] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b61d70, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0096.306] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2b, wMilliseconds=0x240)) [0096.306] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="\"9cdv#iji?XqO-W%!%p1C.?dnzjR@8Qr", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0096.306] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="\"9cdv#iji?XqO-W%!%p1C.?dnzjR@8Qr", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0096.306] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="\"9cdv#iji?XqO-W%!%p1C.?dnzjR@8Qr", cchWideChar=32, lpMultiByteStr=0x3b57c98, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\"9cdv#iji?XqO-W%!%p1C.?dnzjR@8Qr", lpUsedDefaultChar=0x0) returned 32 [0096.306] GetCurrentThreadId () returned 0x970 [0096.306] GetCurrentThreadId () returned 0x970 [0096.306] GetCurrentThreadId () returned 0x970 [0096.306] GetCurrentThreadId () returned 0x970 [0096.306] GetCurrentThreadId () returned 0x970 [0096.306] GetCurrentThreadId () returned 0x970 [0096.317] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0096.317] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0096.317] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3b15628, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0096.317] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0096.317] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAAj7P63ku6clwxcF4/Bw4WXz7DisDrl0/tFiaVcj0yyStOowTe1yBzPa2XmbnUgkOXGbPFZZvveYG2njwZYoI3b1vyzMd9R6SKUibgSHsA74+v9kKHZNabTGuek/7a+ivuot5xdFYIA7Ms6/Fn2oZ649E0yBTTN+I8XJhwvcetyMdQw8OjwOz3+H+x+75YQvWVXJSwprpGiVSOhY2g8++KYzTtOQn/cx2g==") returned 232 [0096.317] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2b, wMilliseconds=0x250)) [0096.317] GetCurrentThreadId () returned 0x970 [0096.317] GetCurrentThreadId () returned 0x970 [0096.317] GetCurrentThreadId () returned 0x970 [0096.317] GetCurrentThreadId () returned 0x970 [0096.317] GetCurrentThreadId () returned 0x970 [0096.317] GetCurrentThreadId () returned 0x970 [0096.317] GetCurrentThreadId () returned 0x970 [0096.317] GetCurrentThreadId () returned 0x970 [0096.317] GetCurrentThreadId () returned 0x970 [0096.317] GetCurrentThreadId () returned 0x970 [0096.317] GetCurrentThreadId () returned 0x970 [0096.317] GetCurrentThreadId () returned 0x970 [0096.317] GetCurrentThreadId () returned 0x970 [0096.317] GetCurrentThreadId () returned 0x970 [0096.317] GetCurrentThreadId () returned 0x970 [0096.317] GetCurrentThreadId () returned 0x970 [0096.317] GetCurrentThreadId () returned 0x970 [0096.317] GetCurrentThreadId () returned 0x970 [0096.317] GetCurrentThreadId () returned 0x970 [0096.318] GetCurrentThreadId () returned 0x970 [0096.318] GetCurrentThreadId () returned 0x970 [0096.318] GetCurrentThreadId () returned 0x970 [0096.318] GetCurrentThreadId () returned 0x970 [0096.318] GetCurrentThreadId () returned 0x970 [0096.318] GetCurrentThreadId () returned 0x970 [0096.318] GetCurrentThreadId () returned 0x970 [0096.318] GetCurrentThreadId () returned 0x970 [0096.318] GetCurrentThreadId () returned 0x970 [0096.318] GetCurrentThreadId () returned 0x970 [0096.318] GetCurrentThreadId () returned 0x970 [0096.318] GetCurrentThreadId () returned 0x970 [0096.318] GetCurrentThreadId () returned 0x970 [0096.318] GetCurrentThreadId () returned 0x970 [0096.318] GetCurrentThreadId () returned 0x970 [0096.318] GetCurrentThreadId () returned 0x970 [0096.318] GetCurrentThreadId () returned 0x970 [0096.318] GetCurrentThreadId () returned 0x970 [0096.318] GetCurrentThreadId () returned 0x970 [0096.318] GetCurrentThreadId () returned 0x970 [0096.318] GetCurrentThreadId () returned 0x970 [0096.318] GetCurrentThreadId () returned 0x970 [0096.318] GetCurrentThreadId () returned 0x970 [0096.318] GetCurrentThreadId () returned 0x970 [0096.318] GetCurrentThreadId () returned 0x970 [0096.318] GetCurrentThreadId () returned 0x970 [0096.318] GetCurrentThreadId () returned 0x970 [0096.318] GetCurrentThreadId () returned 0x970 [0096.318] GetCurrentThreadId () returned 0x970 [0096.318] GetCurrentThreadId () returned 0x970 [0096.318] GetCurrentThreadId () returned 0x970 [0096.318] GetCurrentThreadId () returned 0x970 [0096.318] GetCurrentThreadId () returned 0x970 [0096.318] GetCurrentThreadId () returned 0x970 [0096.318] GetCurrentThreadId () returned 0x970 [0096.319] GetCurrentThreadId () returned 0x970 [0096.319] GetCurrentThreadId () returned 0x970 [0096.319] GetCurrentThreadId () returned 0x970 [0096.319] GetCurrentThreadId () returned 0x970 [0096.319] GetCurrentThreadId () returned 0x970 [0096.319] GetCurrentThreadId () returned 0x970 [0096.319] GetCurrentThreadId () returned 0x970 [0096.319] GetCurrentThreadId () returned 0x970 [0096.319] GetCurrentThreadId () returned 0x970 [0096.319] GetCurrentThreadId () returned 0x970 [0096.319] GetCurrentThreadId () returned 0x970 [0096.319] GetCurrentThreadId () returned 0x970 [0096.319] GetCurrentThreadId () returned 0x970 [0096.319] GetCurrentThreadId () returned 0x970 [0096.319] GetCurrentThreadId () returned 0x970 [0096.319] GetCurrentThreadId () returned 0x970 [0096.319] GetCurrentThreadId () returned 0x970 [0096.319] GetCurrentThreadId () returned 0x970 [0096.319] GetCurrentThreadId () returned 0x970 [0096.319] GetCurrentThreadId () returned 0x970 [0096.319] GetCurrentThreadId () returned 0x970 [0096.319] GetCurrentThreadId () returned 0x970 [0096.319] GetCurrentThreadId () returned 0x970 [0096.319] GetCurrentThreadId () returned 0x970 [0096.319] GetCurrentThreadId () returned 0x970 [0096.319] GetCurrentThreadId () returned 0x970 [0096.319] GetCurrentThreadId () returned 0x970 [0096.319] GetCurrentThreadId () returned 0x970 [0096.319] GetCurrentThreadId () returned 0x970 [0096.319] GetCurrentThreadId () returned 0x970 [0096.319] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAAj7P63ku6clwxcF4/Bw4WXz7DisDrl0/tFiaVcj0yyStOowTe1yBzPa2XmbnUgkOXGbPFZZvveYG2njwZYoI3b1vyzMd9R6SKUibgSHsA74+v9kKHZNabTGuek/7a+ivuot5xdFYIA7Ms6/Fn2oZ649E0yBTTN+I8XJhwvcetyMdQw8OjwOz3+H+x+75YQvWVXJSwprpGiVSOhY2g8++KYzTtOQn/cx2g==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0096.319] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAAj7P63ku6clwxcF4/Bw4WXz7DisDrl0/tFiaVcj0yyStOowTe1yBzPa2XmbnUgkOXGbPFZZvveYG2njwZYoI3b1vyzMd9R6SKUibgSHsA74+v9kKHZNabTGuek/7a+ivuot5xdFYIA7Ms6/Fn2oZ649E0yBTTN+I8XJhwvcetyMdQw8OjwOz3+H+x+75YQvWVXJSwprpGiVSOhY2g8++KYzTtOQn/cx2g==", cchWideChar=245, lpMultiByteStr=0x3b4d08c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAAj7P63ku6clwxcF4/Bw4WXz7DisDrl0/tFiaVcj0yyStOowTe1yBzPa2XmbnUgkOXGbPFZZvveYG2njwZYoI3b1vyzMd9R6SKUibgSHsA74+v9kKHZNabTGuek/7a+ivuot5xdFYIA7Ms6/Fn2oZ649E0yBTTN+I8XJhwvcetyMdQw8OjwOz3+H+x+75YQvWVXJSwprpGiVSOhY2g8++KYzTtOQn/cx2g==", lpUsedDefaultChar=0x0) returned 245 [0096.319] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0096.320] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0096.320] CloseHandle (hObject=0x158) returned 1 [0096.320] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03379i.jpg")) returned 1 [0096.321] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=21658480184) returned 1 [0096.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [PH03380I.JPG].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [ph03380i.jpg].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0096.322] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0096.322] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0096.323] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0096.323] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0096.323] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0096.323] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0096.323] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0096.323] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0096.323] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0096.323] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0096.323] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0096.323] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0096.323] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0096.323] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0096.323] SetEndOfFile (hFile=0x158) returned 1 [0096.324] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0096.324] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0096.324] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0096.324] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0096.324] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0096.325] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0096.325] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="4+-d}zLKz)\\9J/gS!1&Qz.iVo7C:5\"Nk", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0096.325] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="4+-d}zLKz)\\9J/gS!1&Qz.iVo7C:5\"Nk", cchWideChar=32, lpMultiByteStr=0x203ded4, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4+-d}zLKz)\\9J/gS!1&Qz.iVo7C:5\"Nk", lpUsedDefaultChar=0x0) returned 32 [0096.325] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0096.325] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0096.325] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6cee1d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x321f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH03380I.JPG", cAlternateFileName="")) returned 0x295098 [0096.325] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0096.326] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0096.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03380i.jpg")) returned 0x20 [0096.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03380i.jpg")) returned 0x20 [0096.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03380i.jpg")) returned 0x20 [0096.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03380i.jpg")) returned 0x20 [0096.326] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03380i.jpg"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6cee1d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x321f)) returned 1 [0096.326] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0096.326] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0096.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03380i.jpg")) returned 0x20 [0096.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03380i.jpg")) returned 0x20 [0096.326] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0096.327] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0096.327] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0096.327] SetEndOfFile (hFile=0x158) returned 1 [0096.328] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH03380I.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.328] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH03380I.JPG", cchWideChar=12, lpMultiByteStr=0x3b9494c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PH03380I.JPG", lpUsedDefaultChar=0x0) returned 12 [0096.328] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH03380I.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.328] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH03380I.JPG", cchWideChar=12, lpMultiByteStr=0x3b94aec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PH03380I.JPG", lpUsedDefaultChar=0x0) returned 12 [0096.328] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3b94aec, cbMultiByte=12, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="PH03380I.JPGg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0096.328] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH03380I.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.328] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH03380I.JPG", cchWideChar=12, lpMultiByteStr=0x3b9494c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PH03380I.JPG", lpUsedDefaultChar=0x0) returned 12 [0096.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03380i.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0096.329] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0096.329] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x321f [0096.329] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0096.329] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0096.329] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0096.329] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH03380I.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.329] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH03380I.JPG", cchWideChar=12, lpMultiByteStr=0x3b9494c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PH03380I.JPG", lpUsedDefaultChar=0x0) returned 12 [0096.329] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH03380I.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.329] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH03380I.JPG", cchWideChar=12, lpMultiByteStr=0x3b94aec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PH03380I.JPG", lpUsedDefaultChar=0x0) returned 12 [0096.329] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3b94aec, cbMultiByte=12, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="PH03380I.JPG0I.JPGg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0096.329] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH03380I.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.330] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH03380I.JPG", cchWideChar=12, lpMultiByteStr=0x3b9494c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PH03380I.JPG", lpUsedDefaultChar=0x0) returned 12 [0096.330] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0096.331] CharToOemA (in: pSrc="PH03380I.JPG", pDst=0x3b94aec | out: pDst="PH03380I.JPG") returned 1 [0096.331] WriteFile (in: hFile=0x158, lpBuffer=0x3b94aec*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x3b94aec*, lpNumberOfBytesWritten=0x18e048*=0xc, lpOverlapped=0x0) returned 1 [0096.331] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0096.331] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0096.331] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0096.331] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=21659462964) returned 1 [0096.331] ReadFile (in: hFile=0x11c, lpBuffer=0x3af1c60, nNumberOfBytesToRead=0x321f, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3af1c60*, lpNumberOfBytesRead=0x18dd7c*=0x321f, lpOverlapped=0x0) returned 1 [0096.333] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0096.333] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=21659925044) returned 1 [0096.347] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b3d8*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b5b3d8*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0096.347] ReadFile (in: hFile=0x11c, lpBuffer=0x3af1c60, nNumberOfBytesToRead=0x321f, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3af1c60*, lpNumberOfBytesRead=0x18de38*=0x321f, lpOverlapped=0x0) returned 1 [0096.347] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x47 [0096.348] WriteFile (in: hFile=0x158, lpBuffer=0x3b2c450*, nNumberOfBytesToWrite=0x321f, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3b2c450*, lpNumberOfBytesWritten=0x18de10*=0x321f, lpOverlapped=0x0) returned 1 [0096.348] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x3266 [0096.348] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0096.348] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0096.348] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0096.349] SetFilePointer (in: hFile=0x158, lDistanceToMove=12, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2a [0096.349] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x3270 [0096.349] CloseHandle (hObject=0x11c) returned 1 [0096.349] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x3270 [0096.349] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x3270 [0096.349] SetFilePointer (in: hFile=0x158, lDistanceToMove=12912, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x3270 [0096.349] SetFilePointer (in: hFile=0x158, lDistanceToMove=12912, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x3270 [0096.349] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x3270 [0096.349] SetFilePointer (in: hFile=0x158, lDistanceToMove=12912, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x3270 [0096.349] SetEndOfFile (hFile=0x158) returned 1 [0096.349] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x3270 [0096.350] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x3270 [0096.350] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH03380I.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.350] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH03380I.JPG", cchWideChar=12, lpMultiByteStr=0x3b9494c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PH03380I.JPG", lpUsedDefaultChar=0x0) returned 12 [0096.350] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH03380I.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.350] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH03380I.JPG", cchWideChar=12, lpMultiByteStr=0x3b9498c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PH03380I.JPG", lpUsedDefaultChar=0x0) returned 12 [0096.350] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3b9498c, cbMultiByte=12, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="PH03380I.JPGꞗ@涤(\x18믉`믑`") returned 12 [0096.350] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH03380I.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.350] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH03380I.JPG", cchWideChar=12, lpMultiByteStr=0x3b9494c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PH03380I.JPG", lpUsedDefaultChar=0x0) returned 12 [0096.350] WriteFile (in: hFile=0x158, lpBuffer=0x3ad5738*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5738*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0096.350] CharToOemA (in: pSrc="PH03380I.JPG", pDst=0x3b9498c | out: pDst="PH03380I.JPG") returned 1 [0096.350] WriteFile (in: hFile=0x158, lpBuffer=0x3b9498c*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3b9498c*, lpNumberOfBytesWritten=0x18efcc*=0xc, lpOverlapped=0x0) returned 1 [0096.350] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b350*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x3b5b350*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0096.351] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0096.351] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0096.351] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x32b5 [0096.351] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x32b5 [0096.351] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0096.351] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0096.351] DeleteFileW (lpFileName="") returned 0 [0096.351] GetLastError () returned 0x3 [0096.351] GetFileAttributesW (lpFileName="") returned 0xffffffff [0096.351] SetLastError (dwErrCode=0x3) [0096.351] FlushFileBuffers (hFile=0x158) returned 1 [0096.356] GetCurrentThreadId () returned 0x970 [0096.356] GetCurrentThreadId () returned 0x970 [0096.356] GetCurrentThreadId () returned 0x970 [0096.356] GetCurrentThreadId () returned 0x970 [0096.356] GetCurrentThreadId () returned 0x970 [0096.356] GetCurrentThreadId () returned 0x970 [0096.356] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x336c [0096.356] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x336c [0096.356] SetFilePointer (in: hFile=0x158, lDistanceToMove=13164, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x336c [0096.356] CloseHandle (hObject=0x158) returned 1 [0096.356] GetCurrentThreadId () returned 0x970 [0096.356] GetCurrentThreadId () returned 0x970 [0096.356] GetCurrentThreadId () returned 0x970 [0096.356] GetCurrentThreadId () returned 0x970 [0096.356] GetCurrentThreadId () returned 0x970 [0096.356] GetCurrentThreadId () returned 0x970 [0096.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [PH03380I.JPG].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [ph03380i.jpg].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0096.357] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x336c [0096.357] SetFilePointer (in: hFile=0x158, lDistanceToMove=13036, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x32ec [0096.357] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0096.357] GetFileType (hFile=0x158) returned 0x1 [0096.357] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2b, wMilliseconds=0x26f)) [0096.357] GetCurrentThreadId () returned 0x970 [0096.357] GetCurrentThreadId () returned 0x970 [0096.357] GetCurrentThreadId () returned 0x970 [0096.357] GetCurrentThreadId () returned 0x970 [0096.357] GetCurrentThreadId () returned 0x970 [0096.357] GetCurrentThreadId () returned 0x970 [0096.357] GetCurrentThreadId () returned 0x970 [0096.357] GetCurrentThreadId () returned 0x970 [0096.357] GetCurrentThreadId () returned 0x970 [0096.357] GetCurrentThreadId () returned 0x970 [0096.357] GetCurrentThreadId () returned 0x970 [0096.357] GetCurrentThreadId () returned 0x970 [0096.357] GetCurrentThreadId () returned 0x970 [0096.357] GetCurrentThreadId () returned 0x970 [0096.357] GetCurrentThreadId () returned 0x970 [0096.357] GetCurrentThreadId () returned 0x970 [0096.357] GetCurrentThreadId () returned 0x970 [0096.357] GetCurrentThreadId () returned 0x970 [0096.357] GetCurrentThreadId () returned 0x970 [0096.357] GetCurrentThreadId () returned 0x970 [0096.357] GetCurrentThreadId () returned 0x970 [0096.357] GetCurrentThreadId () returned 0x970 [0096.358] GetCurrentThreadId () returned 0x970 [0096.358] GetCurrentThreadId () returned 0x970 [0096.358] GetCurrentThreadId () returned 0x970 [0096.358] GetCurrentThreadId () returned 0x970 [0096.358] GetCurrentThreadId () returned 0x970 [0096.358] GetCurrentThreadId () returned 0x970 [0096.358] GetCurrentThreadId () returned 0x970 [0096.358] GetCurrentThreadId () returned 0x970 [0096.358] GetCurrentThreadId () returned 0x970 [0096.358] GetCurrentThreadId () returned 0x970 [0096.358] GetCurrentThreadId () returned 0x970 [0096.358] GetCurrentThreadId () returned 0x970 [0096.358] GetCurrentThreadId () returned 0x970 [0096.358] GetCurrentThreadId () returned 0x970 [0096.358] GetCurrentThreadId () returned 0x970 [0096.358] GetCurrentThreadId () returned 0x970 [0096.358] GetCurrentThreadId () returned 0x970 [0096.358] GetCurrentThreadId () returned 0x970 [0096.358] GetCurrentThreadId () returned 0x970 [0096.358] GetCurrentThreadId () returned 0x970 [0096.358] GetCurrentThreadId () returned 0x970 [0096.358] GetCurrentThreadId () returned 0x970 [0096.358] GetCurrentThreadId () returned 0x970 [0096.358] GetCurrentThreadId () returned 0x970 [0096.358] GetCurrentThreadId () returned 0x970 [0096.358] GetCurrentThreadId () returned 0x970 [0096.358] GetCurrentThreadId () returned 0x970 [0096.358] GetCurrentThreadId () returned 0x970 [0096.358] GetCurrentThreadId () returned 0x970 [0096.358] GetCurrentThreadId () returned 0x970 [0096.358] GetCurrentThreadId () returned 0x970 [0096.358] GetCurrentThreadId () returned 0x970 [0096.358] GetCurrentThreadId () returned 0x970 [0096.358] GetCurrentThreadId () returned 0x970 [0096.358] GetCurrentThreadId () returned 0x970 [0096.359] GetCurrentThreadId () returned 0x970 [0096.359] GetCurrentThreadId () returned 0x970 [0096.359] GetCurrentThreadId () returned 0x970 [0096.359] GetCurrentThreadId () returned 0x970 [0096.359] GetCurrentThreadId () returned 0x970 [0096.359] GetCurrentThreadId () returned 0x970 [0096.359] GetCurrentThreadId () returned 0x970 [0096.359] GetCurrentThreadId () returned 0x970 [0096.359] GetCurrentThreadId () returned 0x970 [0096.359] GetCurrentThreadId () returned 0x970 [0096.359] GetCurrentThreadId () returned 0x970 [0096.359] GetCurrentThreadId () returned 0x970 [0096.359] GetCurrentThreadId () returned 0x970 [0096.359] GetCurrentThreadId () returned 0x970 [0096.359] GetCurrentThreadId () returned 0x970 [0096.359] GetCurrentThreadId () returned 0x970 [0096.359] GetCurrentThreadId () returned 0x970 [0096.359] GetCurrentThreadId () returned 0x970 [0096.359] GetCurrentThreadId () returned 0x970 [0096.359] GetCurrentThreadId () returned 0x970 [0096.359] GetCurrentThreadId () returned 0x970 [0096.359] GetCurrentThreadId () returned 0x970 [0096.359] GetCurrentThreadId () returned 0x970 [0096.359] GetCurrentThreadId () returned 0x970 [0096.359] GetCurrentThreadId () returned 0x970 [0096.359] GetCurrentThreadId () returned 0x970 [0096.359] GetCurrentThreadId () returned 0x970 [0096.359] GetCurrentThreadId () returned 0x970 [0096.359] GetCurrentThreadId () returned 0x970 [0096.359] GetCurrentThreadId () returned 0x970 [0096.359] GetCurrentThreadId () returned 0x970 [0096.359] GetCurrentThreadId () returned 0x970 [0096.360] GetCurrentThreadId () returned 0x970 [0096.360] GetCurrentThreadId () returned 0x970 [0096.360] GetCurrentThreadId () returned 0x970 [0096.360] GetCurrentThreadId () returned 0x970 [0096.360] GetCurrentThreadId () returned 0x970 [0096.360] GetCurrentThreadId () returned 0x970 [0096.360] GetCurrentThreadId () returned 0x970 [0096.360] GetCurrentThreadId () returned 0x970 [0096.360] GetCurrentThreadId () returned 0x970 [0096.360] GetCurrentThreadId () returned 0x970 [0096.360] GetCurrentThreadId () returned 0x970 [0096.360] GetCurrentThreadId () returned 0x970 [0096.360] GetCurrentThreadId () returned 0x970 [0096.360] GetCurrentThreadId () returned 0x970 [0096.360] GetCurrentThreadId () returned 0x970 [0096.360] GetCurrentThreadId () returned 0x970 [0096.360] GetCurrentThreadId () returned 0x970 [0096.360] GetCurrentThreadId () returned 0x970 [0096.360] GetCurrentThreadId () returned 0x970 [0096.360] GetCurrentThreadId () returned 0x970 [0096.360] GetCurrentThreadId () returned 0x970 [0096.360] GetCurrentThreadId () returned 0x970 [0096.360] GetCurrentThreadId () returned 0x970 [0096.360] GetCurrentThreadId () returned 0x970 [0096.360] GetCurrentThreadId () returned 0x970 [0096.360] GetCurrentThreadId () returned 0x970 [0096.360] GetCurrentThreadId () returned 0x970 [0096.360] GetCurrentThreadId () returned 0x970 [0096.360] GetCurrentThreadId () returned 0x970 [0096.360] GetCurrentThreadId () returned 0x970 [0096.360] GetCurrentThreadId () returned 0x970 [0096.360] GetCurrentThreadId () returned 0x970 [0096.360] GetCurrentThreadId () returned 0x970 [0096.360] GetCurrentThreadId () returned 0x970 [0096.361] GetCurrentThreadId () returned 0x970 [0096.361] GetCurrentThreadId () returned 0x970 [0096.361] GetCurrentThreadId () returned 0x970 [0096.361] GetCurrentThreadId () returned 0x970 [0096.361] GetCurrentThreadId () returned 0x970 [0096.361] GetCurrentThreadId () returned 0x970 [0096.361] GetCurrentThreadId () returned 0x970 [0096.361] GetCurrentThreadId () returned 0x970 [0096.361] GetCurrentThreadId () returned 0x970 [0096.361] GetCurrentThreadId () returned 0x970 [0096.361] GetCurrentThreadId () returned 0x970 [0096.361] GetCurrentThreadId () returned 0x970 [0096.361] GetCurrentThreadId () returned 0x970 [0096.361] GetCurrentThreadId () returned 0x970 [0096.361] GetCurrentThreadId () returned 0x970 [0096.361] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.361] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.361] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b61d70, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0096.361] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.361] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.361] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b61d70, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0096.361] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.361] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.361] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b530, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0096.361] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.361] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.361] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b530, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0096.361] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.361] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.362] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b61dd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0096.362] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.362] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.362] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b61dd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0096.362] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.362] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.362] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b61dd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0096.362] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2b, wMilliseconds=0x27e)) [0096.362] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="4+-d}zLKz)\\9J/gS!1&Qz.iVo7C:5\"Nk", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0096.362] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="4+-d}zLKz)\\9J/gS!1&Qz.iVo7C:5\"Nk", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0096.362] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="4+-d}zLKz)\\9J/gS!1&Qz.iVo7C:5\"Nk", cchWideChar=32, lpMultiByteStr=0x3b57cc8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4+-d}zLKz)\\9J/gS!1&Qz.iVo7C:5\"Nk", lpUsedDefaultChar=0x0) returned 32 [0096.362] GetCurrentThreadId () returned 0x970 [0096.362] GetCurrentThreadId () returned 0x970 [0096.362] GetCurrentThreadId () returned 0x970 [0096.362] GetCurrentThreadId () returned 0x970 [0096.362] GetCurrentThreadId () returned 0x970 [0096.362] GetCurrentThreadId () returned 0x970 [0096.372] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0096.372] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0096.372] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3b15718, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0096.372] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0096.372] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAGjFp6ldYEyyoC1ZWWRrTX2aMCuP5EmzAItAuBoo1O9FTAqiqpMKv3qz6A1QfN1+erDXTsXPzT4kjxTvaosglmrav/QFkMrWiEiCove8NzQ0o/EvCy9WapdFw9shXth50wh5+3gmIQ/2hJfxq9NB8bcl/ihb3B9YPLiz+5w42D8lv4QPhyR/HMXjZSrOcaGq3s9f8J3PuSkP82ryyjSAEBG2X5jIeLDZvA==") returned 232 [0096.372] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2b, wMilliseconds=0x27e)) [0096.372] GetCurrentThreadId () returned 0x970 [0096.372] GetCurrentThreadId () returned 0x970 [0096.372] GetCurrentThreadId () returned 0x970 [0096.372] GetCurrentThreadId () returned 0x970 [0096.372] GetCurrentThreadId () returned 0x970 [0096.372] GetCurrentThreadId () returned 0x970 [0096.372] GetCurrentThreadId () returned 0x970 [0096.372] GetCurrentThreadId () returned 0x970 [0096.372] GetCurrentThreadId () returned 0x970 [0096.372] GetCurrentThreadId () returned 0x970 [0096.372] GetCurrentThreadId () returned 0x970 [0096.372] GetCurrentThreadId () returned 0x970 [0096.373] GetCurrentThreadId () returned 0x970 [0096.373] GetCurrentThreadId () returned 0x970 [0096.373] GetCurrentThreadId () returned 0x970 [0096.373] GetCurrentThreadId () returned 0x970 [0096.373] GetCurrentThreadId () returned 0x970 [0096.373] GetCurrentThreadId () returned 0x970 [0096.373] GetCurrentThreadId () returned 0x970 [0096.373] GetCurrentThreadId () returned 0x970 [0096.373] GetCurrentThreadId () returned 0x970 [0096.373] GetCurrentThreadId () returned 0x970 [0096.373] GetCurrentThreadId () returned 0x970 [0096.373] GetCurrentThreadId () returned 0x970 [0096.373] GetCurrentThreadId () returned 0x970 [0096.373] GetCurrentThreadId () returned 0x970 [0096.373] GetCurrentThreadId () returned 0x970 [0096.373] GetCurrentThreadId () returned 0x970 [0096.373] GetCurrentThreadId () returned 0x970 [0096.373] GetCurrentThreadId () returned 0x970 [0096.373] GetCurrentThreadId () returned 0x970 [0096.373] GetCurrentThreadId () returned 0x970 [0096.373] GetCurrentThreadId () returned 0x970 [0096.373] GetCurrentThreadId () returned 0x970 [0096.373] GetCurrentThreadId () returned 0x970 [0096.373] GetCurrentThreadId () returned 0x970 [0096.373] GetCurrentThreadId () returned 0x970 [0096.373] GetCurrentThreadId () returned 0x970 [0096.373] GetCurrentThreadId () returned 0x970 [0096.373] GetCurrentThreadId () returned 0x970 [0096.373] GetCurrentThreadId () returned 0x970 [0096.373] GetCurrentThreadId () returned 0x970 [0096.373] GetCurrentThreadId () returned 0x970 [0096.373] GetCurrentThreadId () returned 0x970 [0096.373] GetCurrentThreadId () returned 0x970 [0096.373] GetCurrentThreadId () returned 0x970 [0096.373] GetCurrentThreadId () returned 0x970 [0096.373] GetCurrentThreadId () returned 0x970 [0096.374] GetCurrentThreadId () returned 0x970 [0096.374] GetCurrentThreadId () returned 0x970 [0096.374] GetCurrentThreadId () returned 0x970 [0096.374] GetCurrentThreadId () returned 0x970 [0096.374] GetCurrentThreadId () returned 0x970 [0096.374] GetCurrentThreadId () returned 0x970 [0096.374] GetCurrentThreadId () returned 0x970 [0096.374] GetCurrentThreadId () returned 0x970 [0096.374] GetCurrentThreadId () returned 0x970 [0096.374] GetCurrentThreadId () returned 0x970 [0096.374] GetCurrentThreadId () returned 0x970 [0096.374] GetCurrentThreadId () returned 0x970 [0096.374] GetCurrentThreadId () returned 0x970 [0096.374] GetCurrentThreadId () returned 0x970 [0096.374] GetCurrentThreadId () returned 0x970 [0096.374] GetCurrentThreadId () returned 0x970 [0096.374] GetCurrentThreadId () returned 0x970 [0096.374] GetCurrentThreadId () returned 0x970 [0096.374] GetCurrentThreadId () returned 0x970 [0096.374] GetCurrentThreadId () returned 0x970 [0096.374] GetCurrentThreadId () returned 0x970 [0096.374] GetCurrentThreadId () returned 0x970 [0096.374] GetCurrentThreadId () returned 0x970 [0096.374] GetCurrentThreadId () returned 0x970 [0096.374] GetCurrentThreadId () returned 0x970 [0096.374] GetCurrentThreadId () returned 0x970 [0096.374] GetCurrentThreadId () returned 0x970 [0096.374] GetCurrentThreadId () returned 0x970 [0096.374] GetCurrentThreadId () returned 0x970 [0096.374] GetCurrentThreadId () returned 0x970 [0096.374] GetCurrentThreadId () returned 0x970 [0096.374] GetCurrentThreadId () returned 0x970 [0096.374] GetCurrentThreadId () returned 0x970 [0096.374] GetCurrentThreadId () returned 0x970 [0096.374] GetCurrentThreadId () returned 0x970 [0096.375] GetCurrentThreadId () returned 0x970 [0096.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAGjFp6ldYEyyoC1ZWWRrTX2aMCuP5EmzAItAuBoo1O9FTAqiqpMKv3qz6A1QfN1+erDXTsXPzT4kjxTvaosglmrav/QFkMrWiEiCove8NzQ0o/EvCy9WapdFw9shXth50wh5+3gmIQ/2hJfxq9NB8bcl/ihb3B9YPLiz+5w42D8lv4QPhyR/HMXjZSrOcaGq3s9f8J3PuSkP82ryyjSAEBG2X5jIeLDZvA==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0096.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAGjFp6ldYEyyoC1ZWWRrTX2aMCuP5EmzAItAuBoo1O9FTAqiqpMKv3qz6A1QfN1+erDXTsXPzT4kjxTvaosglmrav/QFkMrWiEiCove8NzQ0o/EvCy9WapdFw9shXth50wh5+3gmIQ/2hJfxq9NB8bcl/ihb3B9YPLiz+5w42D8lv4QPhyR/HMXjZSrOcaGq3s9f8J3PuSkP82ryyjSAEBG2X5jIeLDZvA==", cchWideChar=245, lpMultiByteStr=0x3b4d08c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAGjFp6ldYEyyoC1ZWWRrTX2aMCuP5EmzAItAuBoo1O9FTAqiqpMKv3qz6A1QfN1+erDXTsXPzT4kjxTvaosglmrav/QFkMrWiEiCove8NzQ0o/EvCy9WapdFw9shXth50wh5+3gmIQ/2hJfxq9NB8bcl/ihb3B9YPLiz+5w42D8lv4QPhyR/HMXjZSrOcaGq3s9f8J3PuSkP82ryyjSAEBG2X5jIeLDZvA==", lpUsedDefaultChar=0x0) returned 245 [0096.375] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0096.375] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0096.375] CloseHandle (hObject=0x158) returned 1 [0096.376] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03380i.jpg")) returned 1 [0096.377] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=21664031282) returned 1 [0096.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [PH03425I.JPG].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [ph03425i.jpg].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0096.378] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0096.378] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0096.378] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0096.378] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0096.378] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0096.378] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0096.378] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0096.378] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0096.378] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0096.379] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0096.379] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0096.379] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0096.379] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0096.379] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0096.379] SetEndOfFile (hFile=0x158) returned 1 [0096.379] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0096.379] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0096.379] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0096.379] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0096.379] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0096.380] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0096.381] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="+7CJCGu)bFIVqloTiPf6M?Cl.ntd)Fi&", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0096.381] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="+7CJCGu)bFIVqloTiPf6M?Cl.ntd)Fi&", cchWideChar=32, lpMultiByteStr=0x203df0c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="+7CJCGu)bFIVqloTiPf6M?Cl.ntd)Fi&", lpUsedDefaultChar=0x0) returned 32 [0096.381] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0096.381] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0096.381] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a44b570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbdae, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH03425I.JPG", cAlternateFileName="")) returned 0x295098 [0096.381] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0096.381] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0096.381] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03425i.jpg")) returned 0x20 [0096.381] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03425i.jpg")) returned 0x20 [0096.381] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03425i.jpg")) returned 0x20 [0096.381] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03425i.jpg")) returned 0x20 [0096.382] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03425i.jpg"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a44b570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbdae)) returned 1 [0096.382] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0096.382] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0096.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03425i.jpg")) returned 0x20 [0096.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03425i.jpg")) returned 0x20 [0096.382] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0096.382] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0096.382] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0096.382] SetEndOfFile (hFile=0x158) returned 1 [0096.383] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH03425I.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.383] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH03425I.JPG", cchWideChar=12, lpMultiByteStr=0x3b94d2c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PH03425I.JPG", lpUsedDefaultChar=0x0) returned 12 [0096.383] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH03425I.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.383] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH03425I.JPG", cchWideChar=12, lpMultiByteStr=0x3b94a2c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PH03425I.JPG", lpUsedDefaultChar=0x0) returned 12 [0096.383] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3b94a2c, cbMultiByte=12, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="PH03425I.JPGg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0096.383] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH03425I.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.383] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH03425I.JPG", cchWideChar=12, lpMultiByteStr=0x3b94d2c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PH03425I.JPG", lpUsedDefaultChar=0x0) returned 12 [0096.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03425i.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0096.384] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0096.384] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0xbdae [0096.384] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0096.384] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0096.384] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0096.384] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH03425I.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.385] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH03425I.JPG", cchWideChar=12, lpMultiByteStr=0x3b94d2c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PH03425I.JPG", lpUsedDefaultChar=0x0) returned 12 [0096.385] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH03425I.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.385] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH03425I.JPG", cchWideChar=12, lpMultiByteStr=0x3b94a2c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PH03425I.JPG", lpUsedDefaultChar=0x0) returned 12 [0096.385] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3b94a2c, cbMultiByte=12, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="PH03425I.JPG5I.JPGg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0096.385] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH03425I.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.385] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH03425I.JPG", cchWideChar=12, lpMultiByteStr=0x3b94d2c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PH03425I.JPG", lpUsedDefaultChar=0x0) returned 12 [0096.385] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0096.386] CharToOemA (in: pSrc="PH03425I.JPG", pDst=0x3b94a2c | out: pDst="PH03425I.JPG") returned 1 [0096.386] WriteFile (in: hFile=0x158, lpBuffer=0x3b94a2c*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x3b94a2c*, lpNumberOfBytesWritten=0x18e048*=0xc, lpOverlapped=0x0) returned 1 [0096.386] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0096.386] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0096.386] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0096.387] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=21664998297) returned 1 [0096.387] ReadFile (in: hFile=0x11c, lpBuffer=0x3af1c60, nNumberOfBytesToRead=0xbdae, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3af1c60*, lpNumberOfBytesRead=0x18dd7c*=0xbdae, lpOverlapped=0x0) returned 1 [0096.389] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0096.389] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=21665246185) returned 1 [0096.400] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b3c0*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b5b3c0*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0096.400] ReadFile (in: hFile=0x11c, lpBuffer=0x3af1c60, nNumberOfBytesToRead=0xbdae, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3af1c60*, lpNumberOfBytesRead=0x18de38*=0xbdae, lpOverlapped=0x0) returned 1 [0096.402] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x47 [0096.402] WriteFile (in: hFile=0x158, lpBuffer=0x37f5df0*, nNumberOfBytesToWrite=0xbdae, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x37f5df0*, lpNumberOfBytesWritten=0x18de10*=0xbdae, lpOverlapped=0x0) returned 1 [0096.403] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0xbdf5 [0096.403] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0096.403] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0096.403] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0096.403] SetFilePointer (in: hFile=0x158, lDistanceToMove=12, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2a [0096.403] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0xbdff [0096.403] CloseHandle (hObject=0x11c) returned 1 [0096.404] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xbdff [0096.404] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xbdff [0096.404] SetFilePointer (in: hFile=0x158, lDistanceToMove=48639, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xbdff [0096.404] SetFilePointer (in: hFile=0x158, lDistanceToMove=48639, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0xbdff [0096.404] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xbdff [0096.404] SetFilePointer (in: hFile=0x158, lDistanceToMove=48639, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0xbdff [0096.404] SetEndOfFile (hFile=0x158) returned 1 [0096.404] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xbdff [0096.404] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0xbdff [0096.404] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH03425I.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.404] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH03425I.JPG", cchWideChar=12, lpMultiByteStr=0x3b94d2c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PH03425I.JPG", lpUsedDefaultChar=0x0) returned 12 [0096.404] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH03425I.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.404] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH03425I.JPG", cchWideChar=12, lpMultiByteStr=0x3b94dec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PH03425I.JPG", lpUsedDefaultChar=0x0) returned 12 [0096.404] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3b94dec, cbMultiByte=12, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="PH03425I.JPGꞗ@涤(\x18믉`믑`") returned 12 [0096.405] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH03425I.JPG", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.405] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH03425I.JPG", cchWideChar=12, lpMultiByteStr=0x3b94d2c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PH03425I.JPG", lpUsedDefaultChar=0x0) returned 12 [0096.405] WriteFile (in: hFile=0x158, lpBuffer=0x3ad5738*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5738*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0096.405] CharToOemA (in: pSrc="PH03425I.JPG", pDst=0x3b94dec | out: pDst="PH03425I.JPG") returned 1 [0096.405] WriteFile (in: hFile=0x158, lpBuffer=0x3b94dec*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3b94dec*, lpNumberOfBytesWritten=0x18efcc*=0xc, lpOverlapped=0x0) returned 1 [0096.405] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b3b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x3b5b3b0*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0096.405] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0096.405] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0096.405] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xbe44 [0096.405] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0xbe44 [0096.405] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0096.406] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0096.406] DeleteFileW (lpFileName="") returned 0 [0096.406] GetLastError () returned 0x3 [0096.406] GetFileAttributesW (lpFileName="") returned 0xffffffff [0096.406] SetLastError (dwErrCode=0x3) [0096.406] FlushFileBuffers (hFile=0x158) returned 1 [0096.410] GetCurrentThreadId () returned 0x970 [0096.410] GetCurrentThreadId () returned 0x970 [0096.410] GetCurrentThreadId () returned 0x970 [0096.410] GetCurrentThreadId () returned 0x970 [0096.410] GetCurrentThreadId () returned 0x970 [0096.410] GetCurrentThreadId () returned 0x970 [0096.410] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xbefb [0096.410] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xbefb [0096.410] SetFilePointer (in: hFile=0x158, lDistanceToMove=48891, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0xbefb [0096.410] CloseHandle (hObject=0x158) returned 1 [0096.410] GetCurrentThreadId () returned 0x970 [0096.410] GetCurrentThreadId () returned 0x970 [0096.410] GetCurrentThreadId () returned 0x970 [0096.410] GetCurrentThreadId () returned 0x970 [0096.410] GetCurrentThreadId () returned 0x970 [0096.410] GetCurrentThreadId () returned 0x970 [0096.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [PH03425I.JPG].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [ph03425i.jpg].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0096.410] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbefb [0096.410] SetFilePointer (in: hFile=0x158, lDistanceToMove=48763, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbe7b [0096.410] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0096.411] GetFileType (hFile=0x158) returned 0x1 [0096.411] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2b, wMilliseconds=0x2ad)) [0096.411] GetCurrentThreadId () returned 0x970 [0096.411] GetCurrentThreadId () returned 0x970 [0096.411] GetCurrentThreadId () returned 0x970 [0096.411] GetCurrentThreadId () returned 0x970 [0096.411] GetCurrentThreadId () returned 0x970 [0096.411] GetCurrentThreadId () returned 0x970 [0096.411] GetCurrentThreadId () returned 0x970 [0096.411] GetCurrentThreadId () returned 0x970 [0096.411] GetCurrentThreadId () returned 0x970 [0096.411] GetCurrentThreadId () returned 0x970 [0096.411] GetCurrentThreadId () returned 0x970 [0096.411] GetCurrentThreadId () returned 0x970 [0096.411] GetCurrentThreadId () returned 0x970 [0096.411] GetCurrentThreadId () returned 0x970 [0096.411] GetCurrentThreadId () returned 0x970 [0096.411] GetCurrentThreadId () returned 0x970 [0096.411] GetCurrentThreadId () returned 0x970 [0096.411] GetCurrentThreadId () returned 0x970 [0096.411] GetCurrentThreadId () returned 0x970 [0096.411] GetCurrentThreadId () returned 0x970 [0096.411] GetCurrentThreadId () returned 0x970 [0096.411] GetCurrentThreadId () returned 0x970 [0096.411] GetCurrentThreadId () returned 0x970 [0096.411] GetCurrentThreadId () returned 0x970 [0096.411] GetCurrentThreadId () returned 0x970 [0096.411] GetCurrentThreadId () returned 0x970 [0096.411] GetCurrentThreadId () returned 0x970 [0096.411] GetCurrentThreadId () returned 0x970 [0096.411] GetCurrentThreadId () returned 0x970 [0096.411] GetCurrentThreadId () returned 0x970 [0096.411] GetCurrentThreadId () returned 0x970 [0096.411] GetCurrentThreadId () returned 0x970 [0096.412] GetCurrentThreadId () returned 0x970 [0096.412] GetCurrentThreadId () returned 0x970 [0096.412] GetCurrentThreadId () returned 0x970 [0096.412] GetCurrentThreadId () returned 0x970 [0096.412] GetCurrentThreadId () returned 0x970 [0096.412] GetCurrentThreadId () returned 0x970 [0096.412] GetCurrentThreadId () returned 0x970 [0096.412] GetCurrentThreadId () returned 0x970 [0096.412] GetCurrentThreadId () returned 0x970 [0096.412] GetCurrentThreadId () returned 0x970 [0096.412] GetCurrentThreadId () returned 0x970 [0096.412] GetCurrentThreadId () returned 0x970 [0096.412] GetCurrentThreadId () returned 0x970 [0096.412] GetCurrentThreadId () returned 0x970 [0096.412] GetCurrentThreadId () returned 0x970 [0096.412] GetCurrentThreadId () returned 0x970 [0096.412] GetCurrentThreadId () returned 0x970 [0096.412] GetCurrentThreadId () returned 0x970 [0096.412] GetCurrentThreadId () returned 0x970 [0096.412] GetCurrentThreadId () returned 0x970 [0096.412] GetCurrentThreadId () returned 0x970 [0096.412] GetCurrentThreadId () returned 0x970 [0096.412] GetCurrentThreadId () returned 0x970 [0096.412] GetCurrentThreadId () returned 0x970 [0096.412] GetCurrentThreadId () returned 0x970 [0096.412] GetCurrentThreadId () returned 0x970 [0096.412] GetCurrentThreadId () returned 0x970 [0096.412] GetCurrentThreadId () returned 0x970 [0096.412] GetCurrentThreadId () returned 0x970 [0096.412] GetCurrentThreadId () returned 0x970 [0096.412] GetCurrentThreadId () returned 0x970 [0096.412] GetCurrentThreadId () returned 0x970 [0096.412] GetCurrentThreadId () returned 0x970 [0096.412] GetCurrentThreadId () returned 0x970 [0096.412] GetCurrentThreadId () returned 0x970 [0096.412] GetCurrentThreadId () returned 0x970 [0096.412] GetCurrentThreadId () returned 0x970 [0096.413] GetCurrentThreadId () returned 0x970 [0096.413] GetCurrentThreadId () returned 0x970 [0096.413] GetCurrentThreadId () returned 0x970 [0096.413] GetCurrentThreadId () returned 0x970 [0096.413] GetCurrentThreadId () returned 0x970 [0096.413] GetCurrentThreadId () returned 0x970 [0096.413] GetCurrentThreadId () returned 0x970 [0096.413] GetCurrentThreadId () returned 0x970 [0096.413] GetCurrentThreadId () returned 0x970 [0096.413] GetCurrentThreadId () returned 0x970 [0096.413] GetCurrentThreadId () returned 0x970 [0096.413] GetCurrentThreadId () returned 0x970 [0096.413] GetCurrentThreadId () returned 0x970 [0096.413] GetCurrentThreadId () returned 0x970 [0096.413] GetCurrentThreadId () returned 0x970 [0096.413] GetCurrentThreadId () returned 0x970 [0096.413] GetCurrentThreadId () returned 0x970 [0096.413] GetCurrentThreadId () returned 0x970 [0096.413] GetCurrentThreadId () returned 0x970 [0096.413] GetCurrentThreadId () returned 0x970 [0096.413] GetCurrentThreadId () returned 0x970 [0096.413] GetCurrentThreadId () returned 0x970 [0096.413] GetCurrentThreadId () returned 0x970 [0096.413] GetCurrentThreadId () returned 0x970 [0096.413] GetCurrentThreadId () returned 0x970 [0096.413] GetCurrentThreadId () returned 0x970 [0096.413] GetCurrentThreadId () returned 0x970 [0096.413] GetCurrentThreadId () returned 0x970 [0096.413] GetCurrentThreadId () returned 0x970 [0096.413] GetCurrentThreadId () returned 0x970 [0096.413] GetCurrentThreadId () returned 0x970 [0096.413] GetCurrentThreadId () returned 0x970 [0096.413] GetCurrentThreadId () returned 0x970 [0096.413] GetCurrentThreadId () returned 0x970 [0096.413] GetCurrentThreadId () returned 0x970 [0096.413] GetCurrentThreadId () returned 0x970 [0096.413] GetCurrentThreadId () returned 0x970 [0096.414] GetCurrentThreadId () returned 0x970 [0096.414] GetCurrentThreadId () returned 0x970 [0096.414] GetCurrentThreadId () returned 0x970 [0096.414] GetCurrentThreadId () returned 0x970 [0096.414] GetCurrentThreadId () returned 0x970 [0096.414] GetCurrentThreadId () returned 0x970 [0096.414] GetCurrentThreadId () returned 0x970 [0096.414] GetCurrentThreadId () returned 0x970 [0096.414] GetCurrentThreadId () returned 0x970 [0096.414] GetCurrentThreadId () returned 0x970 [0096.414] GetCurrentThreadId () returned 0x970 [0096.414] GetCurrentThreadId () returned 0x970 [0096.414] GetCurrentThreadId () returned 0x970 [0096.414] GetCurrentThreadId () returned 0x970 [0096.414] GetCurrentThreadId () returned 0x970 [0096.414] GetCurrentThreadId () returned 0x970 [0096.414] GetCurrentThreadId () returned 0x970 [0096.414] GetCurrentThreadId () returned 0x970 [0096.414] GetCurrentThreadId () returned 0x970 [0096.414] GetCurrentThreadId () returned 0x970 [0096.414] GetCurrentThreadId () returned 0x970 [0096.414] GetCurrentThreadId () returned 0x970 [0096.414] GetCurrentThreadId () returned 0x970 [0096.414] GetCurrentThreadId () returned 0x970 [0096.414] GetCurrentThreadId () returned 0x970 [0096.414] GetCurrentThreadId () returned 0x970 [0096.414] GetCurrentThreadId () returned 0x970 [0096.414] GetCurrentThreadId () returned 0x970 [0096.414] GetCurrentThreadId () returned 0x970 [0096.414] GetCurrentThreadId () returned 0x970 [0096.414] GetCurrentThreadId () returned 0x970 [0096.414] GetCurrentThreadId () returned 0x970 [0096.414] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.414] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.414] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b61dd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0096.415] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.415] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.415] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b61dd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0096.415] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.415] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.415] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b548, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0096.415] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.415] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.415] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b548, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0096.415] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.415] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.415] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b61e30, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0096.415] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.415] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.415] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b61e30, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0096.415] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.415] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.415] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b61e30, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0096.415] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2b, wMilliseconds=0x2ad)) [0096.415] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="+7CJCGu)bFIVqloTiPf6M?Cl.ntd)Fi&", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0096.415] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="+7CJCGu)bFIVqloTiPf6M?Cl.ntd)Fi&", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0096.415] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="+7CJCGu)bFIVqloTiPf6M?Cl.ntd)Fi&", cchWideChar=32, lpMultiByteStr=0x3b57cf8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="+7CJCGu)bFIVqloTiPf6M?Cl.ntd)Fi&", lpUsedDefaultChar=0x0) returned 32 [0096.415] GetCurrentThreadId () returned 0x970 [0096.416] GetCurrentThreadId () returned 0x970 [0096.416] GetCurrentThreadId () returned 0x970 [0096.416] GetCurrentThreadId () returned 0x970 [0096.416] GetCurrentThreadId () returned 0x970 [0096.416] GetCurrentThreadId () returned 0x970 [0096.426] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0096.426] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0096.426] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3b15808, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0096.426] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0096.426] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAAkKiJRV7L2n1tBvwNyTcPlaB/wfdVbbF4DzhLj9ssGgGX1wkjAokXNRGMtSlKet8a+nPKeUAG6hL1bCPSWTv7fvOS78GS9/p7BovV+KW9y97Q4Txy75lb1DLNcKPG+GGiDOzlNuMImbXBZpZNjlM11OY7LXeQtvlceOfXMNfqSBHhpDvXeUj3KmSqCaQ4zf5paP4MS3JR/BtuyjX0TfN9VVXUcs8clclw==") returned 232 [0096.426] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2b, wMilliseconds=0x2bd)) [0096.426] GetCurrentThreadId () returned 0x970 [0096.426] GetCurrentThreadId () returned 0x970 [0096.426] GetCurrentThreadId () returned 0x970 [0096.426] GetCurrentThreadId () returned 0x970 [0096.426] GetCurrentThreadId () returned 0x970 [0096.426] GetCurrentThreadId () returned 0x970 [0096.426] GetCurrentThreadId () returned 0x970 [0096.426] GetCurrentThreadId () returned 0x970 [0096.426] GetCurrentThreadId () returned 0x970 [0096.426] GetCurrentThreadId () returned 0x970 [0096.426] GetCurrentThreadId () returned 0x970 [0096.426] GetCurrentThreadId () returned 0x970 [0096.426] GetCurrentThreadId () returned 0x970 [0096.426] GetCurrentThreadId () returned 0x970 [0096.426] GetCurrentThreadId () returned 0x970 [0096.426] GetCurrentThreadId () returned 0x970 [0096.426] GetCurrentThreadId () returned 0x970 [0096.426] GetCurrentThreadId () returned 0x970 [0096.426] GetCurrentThreadId () returned 0x970 [0096.426] GetCurrentThreadId () returned 0x970 [0096.426] GetCurrentThreadId () returned 0x970 [0096.426] GetCurrentThreadId () returned 0x970 [0096.426] GetCurrentThreadId () returned 0x970 [0096.426] GetCurrentThreadId () returned 0x970 [0096.426] GetCurrentThreadId () returned 0x970 [0096.426] GetCurrentThreadId () returned 0x970 [0096.426] GetCurrentThreadId () returned 0x970 [0096.427] GetCurrentThreadId () returned 0x970 [0096.427] GetCurrentThreadId () returned 0x970 [0096.427] GetCurrentThreadId () returned 0x970 [0096.427] GetCurrentThreadId () returned 0x970 [0096.427] GetCurrentThreadId () returned 0x970 [0096.427] GetCurrentThreadId () returned 0x970 [0096.427] GetCurrentThreadId () returned 0x970 [0096.427] GetCurrentThreadId () returned 0x970 [0096.427] GetCurrentThreadId () returned 0x970 [0096.427] GetCurrentThreadId () returned 0x970 [0096.427] GetCurrentThreadId () returned 0x970 [0096.427] GetCurrentThreadId () returned 0x970 [0096.427] GetCurrentThreadId () returned 0x970 [0096.427] GetCurrentThreadId () returned 0x970 [0096.427] GetCurrentThreadId () returned 0x970 [0096.427] GetCurrentThreadId () returned 0x970 [0096.427] GetCurrentThreadId () returned 0x970 [0096.427] GetCurrentThreadId () returned 0x970 [0096.427] GetCurrentThreadId () returned 0x970 [0096.427] GetCurrentThreadId () returned 0x970 [0096.427] GetCurrentThreadId () returned 0x970 [0096.427] GetCurrentThreadId () returned 0x970 [0096.427] GetCurrentThreadId () returned 0x970 [0096.427] GetCurrentThreadId () returned 0x970 [0096.427] GetCurrentThreadId () returned 0x970 [0096.427] GetCurrentThreadId () returned 0x970 [0096.427] GetCurrentThreadId () returned 0x970 [0096.427] GetCurrentThreadId () returned 0x970 [0096.427] GetCurrentThreadId () returned 0x970 [0096.427] GetCurrentThreadId () returned 0x970 [0096.427] GetCurrentThreadId () returned 0x970 [0096.427] GetCurrentThreadId () returned 0x970 [0096.427] GetCurrentThreadId () returned 0x970 [0096.427] GetCurrentThreadId () returned 0x970 [0096.427] GetCurrentThreadId () returned 0x970 [0096.427] GetCurrentThreadId () returned 0x970 [0096.427] GetCurrentThreadId () returned 0x970 [0096.427] GetCurrentThreadId () returned 0x970 [0096.427] GetCurrentThreadId () returned 0x970 [0096.427] GetCurrentThreadId () returned 0x970 [0096.427] GetCurrentThreadId () returned 0x970 [0096.427] GetCurrentThreadId () returned 0x970 [0096.427] GetCurrentThreadId () returned 0x970 [0096.428] GetCurrentThreadId () returned 0x970 [0096.428] GetCurrentThreadId () returned 0x970 [0096.428] GetCurrentThreadId () returned 0x970 [0096.428] GetCurrentThreadId () returned 0x970 [0096.428] GetCurrentThreadId () returned 0x970 [0096.428] GetCurrentThreadId () returned 0x970 [0096.428] GetCurrentThreadId () returned 0x970 [0096.428] GetCurrentThreadId () returned 0x970 [0096.428] GetCurrentThreadId () returned 0x970 [0096.428] GetCurrentThreadId () returned 0x970 [0096.428] GetCurrentThreadId () returned 0x970 [0096.428] GetCurrentThreadId () returned 0x970 [0096.428] GetCurrentThreadId () returned 0x970 [0096.428] GetCurrentThreadId () returned 0x970 [0096.428] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAAkKiJRV7L2n1tBvwNyTcPlaB/wfdVbbF4DzhLj9ssGgGX1wkjAokXNRGMtSlKet8a+nPKeUAG6hL1bCPSWTv7fvOS78GS9/p7BovV+KW9y97Q4Txy75lb1DLNcKPG+GGiDOzlNuMImbXBZpZNjlM11OY7LXeQtvlceOfXMNfqSBHhpDvXeUj3KmSqCaQ4zf5paP4MS3JR/BtuyjX0TfN9VVXUcs8clclw==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0096.428] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAAkKiJRV7L2n1tBvwNyTcPlaB/wfdVbbF4DzhLj9ssGgGX1wkjAokXNRGMtSlKet8a+nPKeUAG6hL1bCPSWTv7fvOS78GS9/p7BovV+KW9y97Q4Txy75lb1DLNcKPG+GGiDOzlNuMImbXBZpZNjlM11OY7LXeQtvlceOfXMNfqSBHhpDvXeUj3KmSqCaQ4zf5paP4MS3JR/BtuyjX0TfN9VVXUcs8clclw==", cchWideChar=245, lpMultiByteStr=0x3b4d08c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAAkKiJRV7L2n1tBvwNyTcPlaB/wfdVbbF4DzhLj9ssGgGX1wkjAokXNRGMtSlKet8a+nPKeUAG6hL1bCPSWTv7fvOS78GS9/p7BovV+KW9y97Q4Txy75lb1DLNcKPG+GGiDOzlNuMImbXBZpZNjlM11OY7LXeQtvlceOfXMNfqSBHhpDvXeUj3KmSqCaQ4zf5paP4MS3JR/BtuyjX0TfN9VVXUcs8clclw==", lpUsedDefaultChar=0x0) returned 245 [0096.428] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0096.428] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0096.428] CloseHandle (hObject=0x158) returned 1 [0096.429] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03425i.jpg")) returned 1 [0096.430] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=21669367203) returned 1 [0096.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [WB01219_.GIF].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [wb01219_.gif].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0096.431] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0096.431] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0096.431] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0096.431] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0096.432] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0096.432] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0096.432] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0096.432] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0096.432] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0096.432] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0096.432] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0096.432] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0096.432] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0096.432] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0096.432] SetEndOfFile (hFile=0x158) returned 1 [0096.432] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0096.432] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0096.433] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0096.433] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0096.433] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0096.434] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0096.434] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="kZ)e(MHH#7>6(X5#xAtlm.3vMoTY@nTP", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0096.434] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="kZ)e(MHH#7>6(X5#xAtlm.3vMoTY@nTP", cchWideChar=32, lpMultiByteStr=0x203df44, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kZ)e(MHH#7>6(X5#xAtlm.3vMoTY@nTP", lpUsedDefaultChar=0x0) returned 32 [0096.434] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0096.434] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0096.434] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ce1f900, ftCreationTime.dwHighDateTime=0x1bd4e55, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ce1f900, ftLastWriteTime.dwHighDateTime=0x1bd4e55, nFileSizeHigh=0x0, nFileSizeLow=0x2e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01219_.GIF", cAlternateFileName="")) returned 0x295098 [0096.434] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0096.434] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0096.434] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01219_.gif")) returned 0x20 [0096.436] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01219_.gif")) returned 0x20 [0096.436] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01219_.gif")) returned 0x20 [0096.436] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01219_.gif")) returned 0x20 [0096.436] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01219_.gif"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ce1f900, ftCreationTime.dwHighDateTime=0x1bd4e55, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ce1f900, ftLastWriteTime.dwHighDateTime=0x1bd4e55, nFileSizeHigh=0x0, nFileSizeLow=0x2e4)) returned 1 [0096.436] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0096.436] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0096.436] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01219_.gif")) returned 0x20 [0096.436] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01219_.gif")) returned 0x20 [0096.436] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0096.436] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0096.436] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0096.436] SetEndOfFile (hFile=0x158) returned 1 [0096.437] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01219_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.438] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01219_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94a4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01219_.GIF", lpUsedDefaultChar=0x0) returned 12 [0096.438] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01219_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.438] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01219_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94e0c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01219_.GIF", lpUsedDefaultChar=0x0) returned 12 [0096.438] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3b94e0c, cbMultiByte=12, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="WB01219_.GIFg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0096.438] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01219_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.438] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01219_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94a4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01219_.GIF", lpUsedDefaultChar=0x0) returned 12 [0096.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01219_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0096.439] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0096.439] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2e4 [0096.439] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0096.439] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0096.439] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0096.439] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01219_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.439] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01219_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94a4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01219_.GIF", lpUsedDefaultChar=0x0) returned 12 [0096.439] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01219_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.439] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01219_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94e0c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01219_.GIF", lpUsedDefaultChar=0x0) returned 12 [0096.439] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3b94e0c, cbMultiByte=12, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="WB01219_.GIF9_.GIFg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0096.439] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01219_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.439] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01219_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94a4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01219_.GIF", lpUsedDefaultChar=0x0) returned 12 [0096.439] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0096.440] CharToOemA (in: pSrc="WB01219_.GIF", pDst=0x3b94e0c | out: pDst="WB01219_.GIF") returned 1 [0096.440] WriteFile (in: hFile=0x158, lpBuffer=0x3b94e0c*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x3b94e0c*, lpNumberOfBytesWritten=0x18e048*=0xc, lpOverlapped=0x0) returned 1 [0096.441] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0096.441] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0096.441] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0096.441] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=21670435445) returned 1 [0096.441] ReadFile (in: hFile=0x11c, lpBuffer=0x3af1c80, nNumberOfBytesToRead=0x2e4, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3af1c80*, lpNumberOfBytesRead=0x18dd7c*=0x2e4, lpOverlapped=0x0) returned 1 [0096.443] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0096.443] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=21670614981) returned 1 [0096.454] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b450*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b5b450*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0096.454] ReadFile (in: hFile=0x11c, lpBuffer=0x3af1c80, nNumberOfBytesToRead=0x2e4, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3af1c80*, lpNumberOfBytesRead=0x18de38*=0x2e4, lpOverlapped=0x0) returned 1 [0096.454] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x47 [0096.454] WriteFile (in: hFile=0x158, lpBuffer=0x3af1fa0*, nNumberOfBytesToWrite=0x2e4, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3af1fa0*, lpNumberOfBytesWritten=0x18de10*=0x2e4, lpOverlapped=0x0) returned 1 [0096.455] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x32b [0096.455] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0096.455] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0096.455] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0096.455] SetFilePointer (in: hFile=0x158, lDistanceToMove=12, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2a [0096.455] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x335 [0096.455] CloseHandle (hObject=0x11c) returned 1 [0096.455] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x335 [0096.455] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x335 [0096.455] SetFilePointer (in: hFile=0x158, lDistanceToMove=821, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x335 [0096.455] SetFilePointer (in: hFile=0x158, lDistanceToMove=821, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x335 [0096.456] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x335 [0096.456] SetFilePointer (in: hFile=0x158, lDistanceToMove=821, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x335 [0096.456] SetEndOfFile (hFile=0x158) returned 1 [0096.456] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x335 [0096.456] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x335 [0096.456] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01219_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.456] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01219_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94a4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01219_.GIF", lpUsedDefaultChar=0x0) returned 12 [0096.456] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01219_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.456] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01219_.GIF", cchWideChar=12, lpMultiByteStr=0x3b9498c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01219_.GIF", lpUsedDefaultChar=0x0) returned 12 [0096.456] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3b9498c, cbMultiByte=12, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="WB01219_.GIFꞗ@涤(\x18믉`믑`") returned 12 [0096.456] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01219_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.456] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01219_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94a4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01219_.GIF", lpUsedDefaultChar=0x0) returned 12 [0096.457] WriteFile (in: hFile=0x158, lpBuffer=0x3ad5738*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5738*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0096.457] CharToOemA (in: pSrc="WB01219_.GIF", pDst=0x3b9498c | out: pDst="WB01219_.GIF") returned 1 [0096.457] WriteFile (in: hFile=0x158, lpBuffer=0x3b9498c*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3b9498c*, lpNumberOfBytesWritten=0x18efcc*=0xc, lpOverlapped=0x0) returned 1 [0096.457] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b470*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x3b5b470*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0096.457] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0096.457] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0096.457] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x37a [0096.457] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x37a [0096.457] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0096.457] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0096.458] DeleteFileW (lpFileName="") returned 0 [0096.458] GetLastError () returned 0x3 [0096.458] GetFileAttributesW (lpFileName="") returned 0xffffffff [0096.458] SetLastError (dwErrCode=0x3) [0096.458] FlushFileBuffers (hFile=0x158) returned 1 [0096.460] GetCurrentThreadId () returned 0x970 [0096.460] GetCurrentThreadId () returned 0x970 [0096.460] GetCurrentThreadId () returned 0x970 [0096.460] GetCurrentThreadId () returned 0x970 [0096.460] GetCurrentThreadId () returned 0x970 [0096.460] GetCurrentThreadId () returned 0x970 [0096.460] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x431 [0096.461] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x431 [0096.461] SetFilePointer (in: hFile=0x158, lDistanceToMove=1073, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x431 [0096.461] CloseHandle (hObject=0x158) returned 1 [0096.461] GetCurrentThreadId () returned 0x970 [0096.461] GetCurrentThreadId () returned 0x970 [0096.461] GetCurrentThreadId () returned 0x970 [0096.461] GetCurrentThreadId () returned 0x970 [0096.461] GetCurrentThreadId () returned 0x970 [0096.461] GetCurrentThreadId () returned 0x970 [0096.461] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [WB01219_.GIF].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [wb01219_.gif].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0096.461] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x431 [0096.461] SetFilePointer (in: hFile=0x158, lDistanceToMove=945, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3b1 [0096.461] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0096.461] GetFileType (hFile=0x158) returned 0x1 [0096.462] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2b, wMilliseconds=0x2dc)) [0096.462] GetCurrentThreadId () returned 0x970 [0096.462] GetCurrentThreadId () returned 0x970 [0096.462] GetCurrentThreadId () returned 0x970 [0096.462] GetCurrentThreadId () returned 0x970 [0096.462] GetCurrentThreadId () returned 0x970 [0096.462] GetCurrentThreadId () returned 0x970 [0096.462] GetCurrentThreadId () returned 0x970 [0096.462] GetCurrentThreadId () returned 0x970 [0096.462] GetCurrentThreadId () returned 0x970 [0096.462] GetCurrentThreadId () returned 0x970 [0096.462] GetCurrentThreadId () returned 0x970 [0096.462] GetCurrentThreadId () returned 0x970 [0096.462] GetCurrentThreadId () returned 0x970 [0096.462] GetCurrentThreadId () returned 0x970 [0096.462] GetCurrentThreadId () returned 0x970 [0096.462] GetCurrentThreadId () returned 0x970 [0096.462] GetCurrentThreadId () returned 0x970 [0096.462] GetCurrentThreadId () returned 0x970 [0096.462] GetCurrentThreadId () returned 0x970 [0096.462] GetCurrentThreadId () returned 0x970 [0096.462] GetCurrentThreadId () returned 0x970 [0096.462] GetCurrentThreadId () returned 0x970 [0096.462] GetCurrentThreadId () returned 0x970 [0096.462] GetCurrentThreadId () returned 0x970 [0096.462] GetCurrentThreadId () returned 0x970 [0096.462] GetCurrentThreadId () returned 0x970 [0096.462] GetCurrentThreadId () returned 0x970 [0096.462] GetCurrentThreadId () returned 0x970 [0096.462] GetCurrentThreadId () returned 0x970 [0096.462] GetCurrentThreadId () returned 0x970 [0096.462] GetCurrentThreadId () returned 0x970 [0096.462] GetCurrentThreadId () returned 0x970 [0096.463] GetCurrentThreadId () returned 0x970 [0096.463] GetCurrentThreadId () returned 0x970 [0096.463] GetCurrentThreadId () returned 0x970 [0096.463] GetCurrentThreadId () returned 0x970 [0096.463] GetCurrentThreadId () returned 0x970 [0096.463] GetCurrentThreadId () returned 0x970 [0096.463] GetCurrentThreadId () returned 0x970 [0096.463] GetCurrentThreadId () returned 0x970 [0096.463] GetCurrentThreadId () returned 0x970 [0096.463] GetCurrentThreadId () returned 0x970 [0096.463] GetCurrentThreadId () returned 0x970 [0096.463] GetCurrentThreadId () returned 0x970 [0096.463] GetCurrentThreadId () returned 0x970 [0096.463] GetCurrentThreadId () returned 0x970 [0096.463] GetCurrentThreadId () returned 0x970 [0096.463] GetCurrentThreadId () returned 0x970 [0096.463] GetCurrentThreadId () returned 0x970 [0096.463] GetCurrentThreadId () returned 0x970 [0096.463] GetCurrentThreadId () returned 0x970 [0096.463] GetCurrentThreadId () returned 0x970 [0096.463] GetCurrentThreadId () returned 0x970 [0096.463] GetCurrentThreadId () returned 0x970 [0096.463] GetCurrentThreadId () returned 0x970 [0096.463] GetCurrentThreadId () returned 0x970 [0096.463] GetCurrentThreadId () returned 0x970 [0096.463] GetCurrentThreadId () returned 0x970 [0096.463] GetCurrentThreadId () returned 0x970 [0096.463] GetCurrentThreadId () returned 0x970 [0096.463] GetCurrentThreadId () returned 0x970 [0096.463] GetCurrentThreadId () returned 0x970 [0096.463] GetCurrentThreadId () returned 0x970 [0096.463] GetCurrentThreadId () returned 0x970 [0096.463] GetCurrentThreadId () returned 0x970 [0096.463] GetCurrentThreadId () returned 0x970 [0096.463] GetCurrentThreadId () returned 0x970 [0096.463] GetCurrentThreadId () returned 0x970 [0096.464] GetCurrentThreadId () returned 0x970 [0096.464] GetCurrentThreadId () returned 0x970 [0096.464] GetCurrentThreadId () returned 0x970 [0096.464] GetCurrentThreadId () returned 0x970 [0096.464] GetCurrentThreadId () returned 0x970 [0096.464] GetCurrentThreadId () returned 0x970 [0096.464] GetCurrentThreadId () returned 0x970 [0096.464] GetCurrentThreadId () returned 0x970 [0096.464] GetCurrentThreadId () returned 0x970 [0096.464] GetCurrentThreadId () returned 0x970 [0096.464] GetCurrentThreadId () returned 0x970 [0096.464] GetCurrentThreadId () returned 0x970 [0096.464] GetCurrentThreadId () returned 0x970 [0096.464] GetCurrentThreadId () returned 0x970 [0096.464] GetCurrentThreadId () returned 0x970 [0096.464] GetCurrentThreadId () returned 0x970 [0096.464] GetCurrentThreadId () returned 0x970 [0096.464] GetCurrentThreadId () returned 0x970 [0096.464] GetCurrentThreadId () returned 0x970 [0096.464] GetCurrentThreadId () returned 0x970 [0096.464] GetCurrentThreadId () returned 0x970 [0096.464] GetCurrentThreadId () returned 0x970 [0096.464] GetCurrentThreadId () returned 0x970 [0096.464] GetCurrentThreadId () returned 0x970 [0096.464] GetCurrentThreadId () returned 0x970 [0096.464] GetCurrentThreadId () returned 0x970 [0096.464] GetCurrentThreadId () returned 0x970 [0096.464] GetCurrentThreadId () returned 0x970 [0096.464] GetCurrentThreadId () returned 0x970 [0096.464] GetCurrentThreadId () returned 0x970 [0096.464] GetCurrentThreadId () returned 0x970 [0096.464] GetCurrentThreadId () returned 0x970 [0096.464] GetCurrentThreadId () returned 0x970 [0096.464] GetCurrentThreadId () returned 0x970 [0096.464] GetCurrentThreadId () returned 0x970 [0096.464] GetCurrentThreadId () returned 0x970 [0096.464] GetCurrentThreadId () returned 0x970 [0096.464] GetCurrentThreadId () returned 0x970 [0096.465] GetCurrentThreadId () returned 0x970 [0096.465] GetCurrentThreadId () returned 0x970 [0096.465] GetCurrentThreadId () returned 0x970 [0096.465] GetCurrentThreadId () returned 0x970 [0096.465] GetCurrentThreadId () returned 0x970 [0096.465] GetCurrentThreadId () returned 0x970 [0096.465] GetCurrentThreadId () returned 0x970 [0096.465] GetCurrentThreadId () returned 0x970 [0096.465] GetCurrentThreadId () returned 0x970 [0096.465] GetCurrentThreadId () returned 0x970 [0096.465] GetCurrentThreadId () returned 0x970 [0096.465] GetCurrentThreadId () returned 0x970 [0096.465] GetCurrentThreadId () returned 0x970 [0096.465] GetCurrentThreadId () returned 0x970 [0096.465] GetCurrentThreadId () returned 0x970 [0096.465] GetCurrentThreadId () returned 0x970 [0096.465] GetCurrentThreadId () returned 0x970 [0096.465] GetCurrentThreadId () returned 0x970 [0096.465] GetCurrentThreadId () returned 0x970 [0096.465] GetCurrentThreadId () returned 0x970 [0096.465] GetCurrentThreadId () returned 0x970 [0096.465] GetCurrentThreadId () returned 0x970 [0096.465] GetCurrentThreadId () returned 0x970 [0096.465] GetCurrentThreadId () returned 0x970 [0096.465] GetCurrentThreadId () returned 0x970 [0096.465] GetCurrentThreadId () returned 0x970 [0096.465] GetCurrentThreadId () returned 0x970 [0096.465] GetCurrentThreadId () returned 0x970 [0096.465] GetCurrentThreadId () returned 0x970 [0096.465] GetCurrentThreadId () returned 0x970 [0096.465] GetCurrentThreadId () returned 0x970 [0096.465] GetCurrentThreadId () returned 0x970 [0096.465] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.465] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.466] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b61e30, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0096.466] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.466] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.466] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b61e30, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0096.466] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.466] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.466] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b530, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0096.466] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.466] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.466] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b530, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0096.466] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.466] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.466] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b61e90, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0096.466] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.466] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.466] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b61e90, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0096.466] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.466] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.466] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b61e90, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0096.466] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2b, wMilliseconds=0x2dc)) [0096.466] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="kZ)e(MHH#7>6(X5#xAtlm.3vMoTY@nTP", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0096.466] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="kZ)e(MHH#7>6(X5#xAtlm.3vMoTY@nTP", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0096.466] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="kZ)e(MHH#7>6(X5#xAtlm.3vMoTY@nTP", cchWideChar=32, lpMultiByteStr=0x3b57d28, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kZ)e(MHH#7>6(X5#xAtlm.3vMoTY@nTP", lpUsedDefaultChar=0x0) returned 32 [0096.467] GetCurrentThreadId () returned 0x970 [0096.467] GetCurrentThreadId () returned 0x970 [0096.467] GetCurrentThreadId () returned 0x970 [0096.467] GetCurrentThreadId () returned 0x970 [0096.467] GetCurrentThreadId () returned 0x970 [0096.467] GetCurrentThreadId () returned 0x970 [0096.476] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0096.476] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0096.476] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3b158f8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0096.476] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0096.476] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAC3PPgPhoPS91Ri4oZDI4wCJ2DFFA0EJx7d28OOQZ4W/ngVMiuuGZAJE1koy5WZ9/5r/XE/yhwCdDr2M5xQMxrd5sv7AP0Gwan8RWK6DuUb9t0bB3JVy/+0YQU+u0QZzH7og9LV9Vdl+8Aa1veMudnmu/Db7NAWzIWhlzL8Tfz8SpmxV51BkE4y9DtvTEF7/YvlEunocOrsUEKafs/t08ZbvjRIueDROlg==") returned 232 [0096.476] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2b, wMilliseconds=0x2ec)) [0096.476] GetCurrentThreadId () returned 0x970 [0096.476] GetCurrentThreadId () returned 0x970 [0096.476] GetCurrentThreadId () returned 0x970 [0096.476] GetCurrentThreadId () returned 0x970 [0096.476] GetCurrentThreadId () returned 0x970 [0096.476] GetCurrentThreadId () returned 0x970 [0096.476] GetCurrentThreadId () returned 0x970 [0096.476] GetCurrentThreadId () returned 0x970 [0096.476] GetCurrentThreadId () returned 0x970 [0096.476] GetCurrentThreadId () returned 0x970 [0096.477] GetCurrentThreadId () returned 0x970 [0096.477] GetCurrentThreadId () returned 0x970 [0096.477] GetCurrentThreadId () returned 0x970 [0096.477] GetCurrentThreadId () returned 0x970 [0096.477] GetCurrentThreadId () returned 0x970 [0096.477] GetCurrentThreadId () returned 0x970 [0096.477] GetCurrentThreadId () returned 0x970 [0096.477] GetCurrentThreadId () returned 0x970 [0096.477] GetCurrentThreadId () returned 0x970 [0096.477] GetCurrentThreadId () returned 0x970 [0096.477] GetCurrentThreadId () returned 0x970 [0096.477] GetCurrentThreadId () returned 0x970 [0096.477] GetCurrentThreadId () returned 0x970 [0096.477] GetCurrentThreadId () returned 0x970 [0096.477] GetCurrentThreadId () returned 0x970 [0096.477] GetCurrentThreadId () returned 0x970 [0096.477] GetCurrentThreadId () returned 0x970 [0096.477] GetCurrentThreadId () returned 0x970 [0096.477] GetCurrentThreadId () returned 0x970 [0096.477] GetCurrentThreadId () returned 0x970 [0096.477] GetCurrentThreadId () returned 0x970 [0096.477] GetCurrentThreadId () returned 0x970 [0096.477] GetCurrentThreadId () returned 0x970 [0096.477] GetCurrentThreadId () returned 0x970 [0096.477] GetCurrentThreadId () returned 0x970 [0096.477] GetCurrentThreadId () returned 0x970 [0096.477] GetCurrentThreadId () returned 0x970 [0096.477] GetCurrentThreadId () returned 0x970 [0096.477] GetCurrentThreadId () returned 0x970 [0096.477] GetCurrentThreadId () returned 0x970 [0096.477] GetCurrentThreadId () returned 0x970 [0096.477] GetCurrentThreadId () returned 0x970 [0096.477] GetCurrentThreadId () returned 0x970 [0096.477] GetCurrentThreadId () returned 0x970 [0096.477] GetCurrentThreadId () returned 0x970 [0096.477] GetCurrentThreadId () returned 0x970 [0096.478] GetCurrentThreadId () returned 0x970 [0096.478] GetCurrentThreadId () returned 0x970 [0096.478] GetCurrentThreadId () returned 0x970 [0096.478] GetCurrentThreadId () returned 0x970 [0096.478] GetCurrentThreadId () returned 0x970 [0096.478] GetCurrentThreadId () returned 0x970 [0096.478] GetCurrentThreadId () returned 0x970 [0096.478] GetCurrentThreadId () returned 0x970 [0096.478] GetCurrentThreadId () returned 0x970 [0096.478] GetCurrentThreadId () returned 0x970 [0096.478] GetCurrentThreadId () returned 0x970 [0096.478] GetCurrentThreadId () returned 0x970 [0096.478] GetCurrentThreadId () returned 0x970 [0096.478] GetCurrentThreadId () returned 0x970 [0096.478] GetCurrentThreadId () returned 0x970 [0096.478] GetCurrentThreadId () returned 0x970 [0096.478] GetCurrentThreadId () returned 0x970 [0096.478] GetCurrentThreadId () returned 0x970 [0096.478] GetCurrentThreadId () returned 0x970 [0096.478] GetCurrentThreadId () returned 0x970 [0096.478] GetCurrentThreadId () returned 0x970 [0096.478] GetCurrentThreadId () returned 0x970 [0096.478] GetCurrentThreadId () returned 0x970 [0096.478] GetCurrentThreadId () returned 0x970 [0096.478] GetCurrentThreadId () returned 0x970 [0096.478] GetCurrentThreadId () returned 0x970 [0096.478] GetCurrentThreadId () returned 0x970 [0096.478] GetCurrentThreadId () returned 0x970 [0096.478] GetCurrentThreadId () returned 0x970 [0096.478] GetCurrentThreadId () returned 0x970 [0096.478] GetCurrentThreadId () returned 0x970 [0096.478] GetCurrentThreadId () returned 0x970 [0096.478] GetCurrentThreadId () returned 0x970 [0096.478] GetCurrentThreadId () returned 0x970 [0096.478] GetCurrentThreadId () returned 0x970 [0096.479] GetCurrentThreadId () returned 0x970 [0096.479] GetCurrentThreadId () returned 0x970 [0096.479] GetCurrentThreadId () returned 0x970 [0096.479] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAC3PPgPhoPS91Ri4oZDI4wCJ2DFFA0EJx7d28OOQZ4W/ngVMiuuGZAJE1koy5WZ9/5r/XE/yhwCdDr2M5xQMxrd5sv7AP0Gwan8RWK6DuUb9t0bB3JVy/+0YQU+u0QZzH7og9LV9Vdl+8Aa1veMudnmu/Db7NAWzIWhlzL8Tfz8SpmxV51BkE4y9DtvTEF7/YvlEunocOrsUEKafs/t08ZbvjRIueDROlg==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0096.479] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAC3PPgPhoPS91Ri4oZDI4wCJ2DFFA0EJx7d28OOQZ4W/ngVMiuuGZAJE1koy5WZ9/5r/XE/yhwCdDr2M5xQMxrd5sv7AP0Gwan8RWK6DuUb9t0bB3JVy/+0YQU+u0QZzH7og9LV9Vdl+8Aa1veMudnmu/Db7NAWzIWhlzL8Tfz8SpmxV51BkE4y9DtvTEF7/YvlEunocOrsUEKafs/t08ZbvjRIueDROlg==", cchWideChar=245, lpMultiByteStr=0x3b4d08c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAC3PPgPhoPS91Ri4oZDI4wCJ2DFFA0EJx7d28OOQZ4W/ngVMiuuGZAJE1koy5WZ9/5r/XE/yhwCdDr2M5xQMxrd5sv7AP0Gwan8RWK6DuUb9t0bB3JVy/+0YQU+u0QZzH7og9LV9Vdl+8Aa1veMudnmu/Db7NAWzIWhlzL8Tfz8SpmxV51BkE4y9DtvTEF7/YvlEunocOrsUEKafs/t08ZbvjRIueDROlg==", lpUsedDefaultChar=0x0) returned 245 [0096.479] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0096.479] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0096.479] CloseHandle (hObject=0x158) returned 1 [0096.479] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01219_.gif")) returned 1 [0096.480] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=21674393481) returned 1 [0096.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [WB01237_.GIF].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [wb01237_.gif].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0096.481] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0096.482] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0096.482] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0096.482] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0096.482] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0096.482] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0096.482] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0096.482] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0096.482] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0096.482] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0096.482] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0096.482] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0096.482] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0096.482] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0096.482] SetEndOfFile (hFile=0x158) returned 1 [0096.483] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0096.483] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0096.483] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0096.483] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0096.483] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0096.484] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0096.484] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="V>E\\r1x$2Y$=m!jQbKlna2LAV4v=mKv\\", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0096.484] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="V>E\\r1x$2Y$=m!jQbKlna2LAV4v=mKv\\", cchWideChar=32, lpMultiByteStr=0x203df7c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="V>E\\r1x$2Y$=m!jQbKlna2LAV4v=mKv\\", lpUsedDefaultChar=0x0) returned 32 [0096.484] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0096.484] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0096.484] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f000, ftCreationTime.dwHighDateTime=0x1bd4e6c, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4f000, ftLastWriteTime.dwHighDateTime=0x1bd4e6c, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01237_.GIF", cAlternateFileName="")) returned 0x295098 [0096.485] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0096.485] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0096.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01237_.gif")) returned 0x20 [0096.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01237_.gif")) returned 0x20 [0096.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01237_.gif")) returned 0x20 [0096.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01237_.gif")) returned 0x20 [0096.485] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01237_.gif"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f000, ftCreationTime.dwHighDateTime=0x1bd4e6c, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4f000, ftLastWriteTime.dwHighDateTime=0x1bd4e6c, nFileSizeHigh=0x0, nFileSizeLow=0x16b)) returned 1 [0096.485] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0096.485] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0096.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01237_.gif")) returned 0x20 [0096.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01237_.gif")) returned 0x20 [0096.485] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0096.486] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0096.486] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0096.486] SetEndOfFile (hFile=0x158) returned 1 [0096.487] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01237_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.487] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01237_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94dcc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01237_.GIF", lpUsedDefaultChar=0x0) returned 12 [0096.487] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01237_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.487] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01237_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94c4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01237_.GIF", lpUsedDefaultChar=0x0) returned 12 [0096.487] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3b94c4c, cbMultiByte=12, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="WB01237_.GIFg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0096.487] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01237_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.487] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01237_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94dcc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01237_.GIF", lpUsedDefaultChar=0x0) returned 12 [0096.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01237_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0096.487] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0096.488] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x16b [0096.488] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0096.488] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0096.488] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0096.488] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01237_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.488] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01237_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94dcc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01237_.GIF", lpUsedDefaultChar=0x0) returned 12 [0096.488] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01237_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.488] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01237_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94c4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01237_.GIF", lpUsedDefaultChar=0x0) returned 12 [0096.488] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3b94c4c, cbMultiByte=12, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="WB01237_.GIF7_.GIFg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0096.488] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01237_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.488] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01237_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94dcc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01237_.GIF", lpUsedDefaultChar=0x0) returned 12 [0096.488] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0096.489] CharToOemA (in: pSrc="WB01237_.GIF", pDst=0x3b94c4c | out: pDst="WB01237_.GIF") returned 1 [0096.489] WriteFile (in: hFile=0x158, lpBuffer=0x3b94c4c*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x3b94c4c*, lpNumberOfBytesWritten=0x18e048*=0xc, lpOverlapped=0x0) returned 1 [0096.490] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0096.490] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0096.490] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0096.490] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=21675342923) returned 1 [0096.490] ReadFile (in: hFile=0x11c, lpBuffer=0x3b09480, nNumberOfBytesToRead=0x16b, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b09480*, lpNumberOfBytesRead=0x18dd7c*=0x16b, lpOverlapped=0x0) returned 1 [0096.491] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0096.491] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=21675490090) returned 1 [0096.502] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b438*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b5b438*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0096.503] ReadFile (in: hFile=0x11c, lpBuffer=0x3b09480, nNumberOfBytesToRead=0x16b, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3b09480*, lpNumberOfBytesRead=0x18de38*=0x16b, lpOverlapped=0x0) returned 1 [0096.503] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x47 [0096.503] WriteFile (in: hFile=0x158, lpBuffer=0x3b09600*, nNumberOfBytesToWrite=0x16b, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3b09600*, lpNumberOfBytesWritten=0x18de10*=0x16b, lpOverlapped=0x0) returned 1 [0096.503] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x1b2 [0096.503] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0096.503] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0096.503] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0096.503] SetFilePointer (in: hFile=0x158, lDistanceToMove=12, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2a [0096.503] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x1bc [0096.503] CloseHandle (hObject=0x11c) returned 1 [0096.504] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1bc [0096.504] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1bc [0096.504] SetFilePointer (in: hFile=0x158, lDistanceToMove=444, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1bc [0096.504] SetFilePointer (in: hFile=0x158, lDistanceToMove=444, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x1bc [0096.504] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1bc [0096.504] SetFilePointer (in: hFile=0x158, lDistanceToMove=444, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x1bc [0096.504] SetEndOfFile (hFile=0x158) returned 1 [0096.504] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1bc [0096.504] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1bc [0096.504] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01237_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.504] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01237_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94dcc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01237_.GIF", lpUsedDefaultChar=0x0) returned 12 [0096.505] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01237_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.505] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01237_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94dec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01237_.GIF", lpUsedDefaultChar=0x0) returned 12 [0096.505] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3b94dec, cbMultiByte=12, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="WB01237_.GIFꞗ@涤(\x18믉`믑`") returned 12 [0096.505] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01237_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.505] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01237_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94dcc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01237_.GIF", lpUsedDefaultChar=0x0) returned 12 [0096.505] WriteFile (in: hFile=0x158, lpBuffer=0x3ad5738*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5738*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0096.505] CharToOemA (in: pSrc="WB01237_.GIF", pDst=0x3b94dec | out: pDst="WB01237_.GIF") returned 1 [0096.505] WriteFile (in: hFile=0x158, lpBuffer=0x3b94dec*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3b94dec*, lpNumberOfBytesWritten=0x18efcc*=0xc, lpOverlapped=0x0) returned 1 [0096.505] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b350*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x3b5b350*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0096.505] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0096.505] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0096.505] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x201 [0096.506] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x201 [0096.506] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0096.506] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0096.506] DeleteFileW (lpFileName="") returned 0 [0096.506] GetLastError () returned 0x3 [0096.506] GetFileAttributesW (lpFileName="") returned 0xffffffff [0096.506] SetLastError (dwErrCode=0x3) [0096.506] FlushFileBuffers (hFile=0x158) returned 1 [0096.509] GetCurrentThreadId () returned 0x970 [0096.509] GetCurrentThreadId () returned 0x970 [0096.509] GetCurrentThreadId () returned 0x970 [0096.509] GetCurrentThreadId () returned 0x970 [0096.509] GetCurrentThreadId () returned 0x970 [0096.509] GetCurrentThreadId () returned 0x970 [0096.509] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x2b8 [0096.509] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x2b8 [0096.509] SetFilePointer (in: hFile=0x158, lDistanceToMove=696, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x2b8 [0096.509] CloseHandle (hObject=0x158) returned 1 [0096.509] GetCurrentThreadId () returned 0x970 [0096.509] GetCurrentThreadId () returned 0x970 [0096.509] GetCurrentThreadId () returned 0x970 [0096.510] GetCurrentThreadId () returned 0x970 [0096.510] GetCurrentThreadId () returned 0x970 [0096.510] GetCurrentThreadId () returned 0x970 [0096.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [WB01237_.GIF].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [wb01237_.gif].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0096.510] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2b8 [0096.510] SetFilePointer (in: hFile=0x158, lDistanceToMove=568, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x238 [0096.510] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0096.510] GetFileType (hFile=0x158) returned 0x1 [0096.510] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2b, wMilliseconds=0x30b)) [0096.510] GetCurrentThreadId () returned 0x970 [0096.510] GetCurrentThreadId () returned 0x970 [0096.510] GetCurrentThreadId () returned 0x970 [0096.510] GetCurrentThreadId () returned 0x970 [0096.510] GetCurrentThreadId () returned 0x970 [0096.510] GetCurrentThreadId () returned 0x970 [0096.510] GetCurrentThreadId () returned 0x970 [0096.510] GetCurrentThreadId () returned 0x970 [0096.510] GetCurrentThreadId () returned 0x970 [0096.510] GetCurrentThreadId () returned 0x970 [0096.510] GetCurrentThreadId () returned 0x970 [0096.510] GetCurrentThreadId () returned 0x970 [0096.510] GetCurrentThreadId () returned 0x970 [0096.511] GetCurrentThreadId () returned 0x970 [0096.511] GetCurrentThreadId () returned 0x970 [0096.511] GetCurrentThreadId () returned 0x970 [0096.511] GetCurrentThreadId () returned 0x970 [0096.511] GetCurrentThreadId () returned 0x970 [0096.511] GetCurrentThreadId () returned 0x970 [0096.511] GetCurrentThreadId () returned 0x970 [0096.511] GetCurrentThreadId () returned 0x970 [0096.511] GetCurrentThreadId () returned 0x970 [0096.511] GetCurrentThreadId () returned 0x970 [0096.511] GetCurrentThreadId () returned 0x970 [0096.511] GetCurrentThreadId () returned 0x970 [0096.511] GetCurrentThreadId () returned 0x970 [0096.511] GetCurrentThreadId () returned 0x970 [0096.511] GetCurrentThreadId () returned 0x970 [0096.511] GetCurrentThreadId () returned 0x970 [0096.511] GetCurrentThreadId () returned 0x970 [0096.511] GetCurrentThreadId () returned 0x970 [0096.511] GetCurrentThreadId () returned 0x970 [0096.511] GetCurrentThreadId () returned 0x970 [0096.511] GetCurrentThreadId () returned 0x970 [0096.511] GetCurrentThreadId () returned 0x970 [0096.511] GetCurrentThreadId () returned 0x970 [0096.511] GetCurrentThreadId () returned 0x970 [0096.511] GetCurrentThreadId () returned 0x970 [0096.511] GetCurrentThreadId () returned 0x970 [0096.511] GetCurrentThreadId () returned 0x970 [0096.511] GetCurrentThreadId () returned 0x970 [0096.511] GetCurrentThreadId () returned 0x970 [0096.511] GetCurrentThreadId () returned 0x970 [0096.511] GetCurrentThreadId () returned 0x970 [0096.511] GetCurrentThreadId () returned 0x970 [0096.511] GetCurrentThreadId () returned 0x970 [0096.511] GetCurrentThreadId () returned 0x970 [0096.511] GetCurrentThreadId () returned 0x970 [0096.511] GetCurrentThreadId () returned 0x970 [0096.512] GetCurrentThreadId () returned 0x970 [0096.512] GetCurrentThreadId () returned 0x970 [0096.512] GetCurrentThreadId () returned 0x970 [0096.512] GetCurrentThreadId () returned 0x970 [0096.512] GetCurrentThreadId () returned 0x970 [0096.512] GetCurrentThreadId () returned 0x970 [0096.512] GetCurrentThreadId () returned 0x970 [0096.512] GetCurrentThreadId () returned 0x970 [0096.512] GetCurrentThreadId () returned 0x970 [0096.512] GetCurrentThreadId () returned 0x970 [0096.512] GetCurrentThreadId () returned 0x970 [0096.512] GetCurrentThreadId () returned 0x970 [0096.512] GetCurrentThreadId () returned 0x970 [0096.512] GetCurrentThreadId () returned 0x970 [0096.512] GetCurrentThreadId () returned 0x970 [0096.512] GetCurrentThreadId () returned 0x970 [0096.512] GetCurrentThreadId () returned 0x970 [0096.512] GetCurrentThreadId () returned 0x970 [0096.512] GetCurrentThreadId () returned 0x970 [0096.512] GetCurrentThreadId () returned 0x970 [0096.512] GetCurrentThreadId () returned 0x970 [0096.512] GetCurrentThreadId () returned 0x970 [0096.512] GetCurrentThreadId () returned 0x970 [0096.512] GetCurrentThreadId () returned 0x970 [0096.512] GetCurrentThreadId () returned 0x970 [0096.512] GetCurrentThreadId () returned 0x970 [0096.512] GetCurrentThreadId () returned 0x970 [0096.512] GetCurrentThreadId () returned 0x970 [0096.512] GetCurrentThreadId () returned 0x970 [0096.512] GetCurrentThreadId () returned 0x970 [0096.512] GetCurrentThreadId () returned 0x970 [0096.512] GetCurrentThreadId () returned 0x970 [0096.512] GetCurrentThreadId () returned 0x970 [0096.512] GetCurrentThreadId () returned 0x970 [0096.512] GetCurrentThreadId () returned 0x970 [0096.513] GetCurrentThreadId () returned 0x970 [0096.513] GetCurrentThreadId () returned 0x970 [0096.513] GetCurrentThreadId () returned 0x970 [0096.513] GetCurrentThreadId () returned 0x970 [0096.513] GetCurrentThreadId () returned 0x970 [0096.513] GetCurrentThreadId () returned 0x970 [0096.513] GetCurrentThreadId () returned 0x970 [0096.513] GetCurrentThreadId () returned 0x970 [0096.513] GetCurrentThreadId () returned 0x970 [0096.513] GetCurrentThreadId () returned 0x970 [0096.513] GetCurrentThreadId () returned 0x970 [0096.513] GetCurrentThreadId () returned 0x970 [0096.513] GetCurrentThreadId () returned 0x970 [0096.513] GetCurrentThreadId () returned 0x970 [0096.513] GetCurrentThreadId () returned 0x970 [0096.513] GetCurrentThreadId () returned 0x970 [0096.513] GetCurrentThreadId () returned 0x970 [0096.513] GetCurrentThreadId () returned 0x970 [0096.513] GetCurrentThreadId () returned 0x970 [0096.513] GetCurrentThreadId () returned 0x970 [0096.513] GetCurrentThreadId () returned 0x970 [0096.513] GetCurrentThreadId () returned 0x970 [0096.513] GetCurrentThreadId () returned 0x970 [0096.513] GetCurrentThreadId () returned 0x970 [0096.513] GetCurrentThreadId () returned 0x970 [0096.513] GetCurrentThreadId () returned 0x970 [0096.513] GetCurrentThreadId () returned 0x970 [0096.513] GetCurrentThreadId () returned 0x970 [0096.513] GetCurrentThreadId () returned 0x970 [0096.513] GetCurrentThreadId () returned 0x970 [0096.513] GetCurrentThreadId () returned 0x970 [0096.513] GetCurrentThreadId () returned 0x970 [0096.513] GetCurrentThreadId () returned 0x970 [0096.513] GetCurrentThreadId () returned 0x970 [0096.513] GetCurrentThreadId () returned 0x970 [0096.514] GetCurrentThreadId () returned 0x970 [0096.514] GetCurrentThreadId () returned 0x970 [0096.514] GetCurrentThreadId () returned 0x970 [0096.514] GetCurrentThreadId () returned 0x970 [0096.514] GetCurrentThreadId () returned 0x970 [0096.514] GetCurrentThreadId () returned 0x970 [0096.514] GetCurrentThreadId () returned 0x970 [0096.514] GetCurrentThreadId () returned 0x970 [0096.514] GetCurrentThreadId () returned 0x970 [0096.514] GetCurrentThreadId () returned 0x970 [0096.514] GetCurrentThreadId () returned 0x970 [0096.514] GetCurrentThreadId () returned 0x970 [0096.514] GetCurrentThreadId () returned 0x970 [0096.514] GetCurrentThreadId () returned 0x970 [0096.514] GetCurrentThreadId () returned 0x970 [0096.514] GetCurrentThreadId () returned 0x970 [0096.514] GetCurrentThreadId () returned 0x970 [0096.514] GetCurrentThreadId () returned 0x970 [0096.514] GetCurrentThreadId () returned 0x970 [0096.514] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.514] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.514] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b61e90, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0096.514] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.514] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.514] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b61e90, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0096.514] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.514] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.514] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b548, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0096.514] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.514] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.514] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b548, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0096.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b61ef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0096.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b61ef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0096.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b61ef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0096.515] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2b, wMilliseconds=0x30b)) [0096.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="V>E\\r1x$2Y$=m!jQbKlna2LAV4v=mKv\\", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0096.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="V>E\\r1x$2Y$=m!jQbKlna2LAV4v=mKv\\", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0096.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="V>E\\r1x$2Y$=m!jQbKlna2LAV4v=mKv\\", cchWideChar=32, lpMultiByteStr=0x3b57d58, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="V>E\\r1x$2Y$=m!jQbKlna2LAV4v=mKv\\", lpUsedDefaultChar=0x0) returned 32 [0096.515] GetCurrentThreadId () returned 0x970 [0096.515] GetCurrentThreadId () returned 0x970 [0096.515] GetCurrentThreadId () returned 0x970 [0096.515] GetCurrentThreadId () returned 0x970 [0096.515] GetCurrentThreadId () returned 0x970 [0096.515] GetCurrentThreadId () returned 0x970 [0096.525] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0096.525] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0096.525] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3b159e8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0096.525] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0096.525] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAAmP6+PFEa8BgH9ghqGw3f+5L2kV6Rhun3tnUzDIHSp+wgqk1fsQEycyIw9u21TuqWDq1SLeSsheYpvILew1ZgkGU6SLLmiBglcTnnSCc0FgbKn+zM7t3zOozCMe5JD2y1D3abXY3yLjTgUPCz8fq4NgBUfJOQyr2L31ntr9xk0g0h4WiD6Ee+0olIt+/hxepZPdjbBR6zOvymrEivZGmgC54bNZFqJsqQ==") returned 232 [0096.525] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2b, wMilliseconds=0x31a)) [0096.525] GetCurrentThreadId () returned 0x970 [0096.525] GetCurrentThreadId () returned 0x970 [0096.525] GetCurrentThreadId () returned 0x970 [0096.525] GetCurrentThreadId () returned 0x970 [0096.525] GetCurrentThreadId () returned 0x970 [0096.525] GetCurrentThreadId () returned 0x970 [0096.525] GetCurrentThreadId () returned 0x970 [0096.525] GetCurrentThreadId () returned 0x970 [0096.525] GetCurrentThreadId () returned 0x970 [0096.525] GetCurrentThreadId () returned 0x970 [0096.525] GetCurrentThreadId () returned 0x970 [0096.525] GetCurrentThreadId () returned 0x970 [0096.525] GetCurrentThreadId () returned 0x970 [0096.526] GetCurrentThreadId () returned 0x970 [0096.526] GetCurrentThreadId () returned 0x970 [0096.526] GetCurrentThreadId () returned 0x970 [0096.526] GetCurrentThreadId () returned 0x970 [0096.526] GetCurrentThreadId () returned 0x970 [0096.526] GetCurrentThreadId () returned 0x970 [0096.526] GetCurrentThreadId () returned 0x970 [0096.526] GetCurrentThreadId () returned 0x970 [0096.526] GetCurrentThreadId () returned 0x970 [0096.526] GetCurrentThreadId () returned 0x970 [0096.526] GetCurrentThreadId () returned 0x970 [0096.526] GetCurrentThreadId () returned 0x970 [0096.526] GetCurrentThreadId () returned 0x970 [0096.526] GetCurrentThreadId () returned 0x970 [0096.526] GetCurrentThreadId () returned 0x970 [0096.526] GetCurrentThreadId () returned 0x970 [0096.526] GetCurrentThreadId () returned 0x970 [0096.526] GetCurrentThreadId () returned 0x970 [0096.526] GetCurrentThreadId () returned 0x970 [0096.526] GetCurrentThreadId () returned 0x970 [0096.526] GetCurrentThreadId () returned 0x970 [0096.526] GetCurrentThreadId () returned 0x970 [0096.526] GetCurrentThreadId () returned 0x970 [0096.526] GetCurrentThreadId () returned 0x970 [0096.526] GetCurrentThreadId () returned 0x970 [0096.526] GetCurrentThreadId () returned 0x970 [0096.526] GetCurrentThreadId () returned 0x970 [0096.526] GetCurrentThreadId () returned 0x970 [0096.526] GetCurrentThreadId () returned 0x970 [0096.526] GetCurrentThreadId () returned 0x970 [0096.526] GetCurrentThreadId () returned 0x970 [0096.526] GetCurrentThreadId () returned 0x970 [0096.526] GetCurrentThreadId () returned 0x970 [0096.526] GetCurrentThreadId () returned 0x970 [0096.526] GetCurrentThreadId () returned 0x970 [0096.526] GetCurrentThreadId () returned 0x970 [0096.526] GetCurrentThreadId () returned 0x970 [0096.527] GetCurrentThreadId () returned 0x970 [0096.527] GetCurrentThreadId () returned 0x970 [0096.527] GetCurrentThreadId () returned 0x970 [0096.527] GetCurrentThreadId () returned 0x970 [0096.527] GetCurrentThreadId () returned 0x970 [0096.527] GetCurrentThreadId () returned 0x970 [0096.527] GetCurrentThreadId () returned 0x970 [0096.527] GetCurrentThreadId () returned 0x970 [0096.527] GetCurrentThreadId () returned 0x970 [0096.527] GetCurrentThreadId () returned 0x970 [0096.527] GetCurrentThreadId () returned 0x970 [0096.527] GetCurrentThreadId () returned 0x970 [0096.527] GetCurrentThreadId () returned 0x970 [0096.527] GetCurrentThreadId () returned 0x970 [0096.527] GetCurrentThreadId () returned 0x970 [0096.527] GetCurrentThreadId () returned 0x970 [0096.527] GetCurrentThreadId () returned 0x970 [0096.527] GetCurrentThreadId () returned 0x970 [0096.527] GetCurrentThreadId () returned 0x970 [0096.527] GetCurrentThreadId () returned 0x970 [0096.527] GetCurrentThreadId () returned 0x970 [0096.527] GetCurrentThreadId () returned 0x970 [0096.527] GetCurrentThreadId () returned 0x970 [0096.527] GetCurrentThreadId () returned 0x970 [0096.527] GetCurrentThreadId () returned 0x970 [0096.527] GetCurrentThreadId () returned 0x970 [0096.527] GetCurrentThreadId () returned 0x970 [0096.527] GetCurrentThreadId () returned 0x970 [0096.527] GetCurrentThreadId () returned 0x970 [0096.527] GetCurrentThreadId () returned 0x970 [0096.527] GetCurrentThreadId () returned 0x970 [0096.527] GetCurrentThreadId () returned 0x970 [0096.527] GetCurrentThreadId () returned 0x970 [0096.527] GetCurrentThreadId () returned 0x970 [0096.527] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAAmP6+PFEa8BgH9ghqGw3f+5L2kV6Rhun3tnUzDIHSp+wgqk1fsQEycyIw9u21TuqWDq1SLeSsheYpvILew1ZgkGU6SLLmiBglcTnnSCc0FgbKn+zM7t3zOozCMe5JD2y1D3abXY3yLjTgUPCz8fq4NgBUfJOQyr2L31ntr9xk0g0h4WiD6Ee+0olIt+/hxepZPdjbBR6zOvymrEivZGmgC54bNZFqJsqQ==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0096.528] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAAmP6+PFEa8BgH9ghqGw3f+5L2kV6Rhun3tnUzDIHSp+wgqk1fsQEycyIw9u21TuqWDq1SLeSsheYpvILew1ZgkGU6SLLmiBglcTnnSCc0FgbKn+zM7t3zOozCMe5JD2y1D3abXY3yLjTgUPCz8fq4NgBUfJOQyr2L31ntr9xk0g0h4WiD6Ee+0olIt+/hxepZPdjbBR6zOvymrEivZGmgC54bNZFqJsqQ==", cchWideChar=245, lpMultiByteStr=0x3b4d08c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAAmP6+PFEa8BgH9ghqGw3f+5L2kV6Rhun3tnUzDIHSp+wgqk1fsQEycyIw9u21TuqWDq1SLeSsheYpvILew1ZgkGU6SLLmiBglcTnnSCc0FgbKn+zM7t3zOozCMe5JD2y1D3abXY3yLjTgUPCz8fq4NgBUfJOQyr2L31ntr9xk0g0h4WiD6Ee+0olIt+/hxepZPdjbBR6zOvymrEivZGmgC54bNZFqJsqQ==", lpUsedDefaultChar=0x0) returned 245 [0096.528] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0096.528] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0096.528] CloseHandle (hObject=0x158) returned 1 [0096.528] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01237_.gif")) returned 1 [0096.529] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=21679291250) returned 1 [0096.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [WB01238_.GIF].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [wb01238_.gif].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0096.532] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0096.532] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0096.532] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0096.532] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0096.532] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0096.532] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0096.532] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0096.532] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0096.532] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0096.532] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0096.532] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0096.533] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0096.533] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0096.533] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0096.533] SetEndOfFile (hFile=0x158) returned 1 [0096.533] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0096.533] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0096.533] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0096.533] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0096.533] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0096.534] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0096.534] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Q(SucouJOt,T^irGvCXOj)ZPboZdB,nO", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0096.534] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Q(SucouJOt,T^irGvCXOj)ZPboZdB,nO", cchWideChar=32, lpMultiByteStr=0x203dfb4, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Q(SucouJOt,T^irGvCXOj)ZPboZdB,nO", lpUsedDefaultChar=0x0) returned 32 [0096.534] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0096.535] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0096.535] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe368b800, ftCreationTime.dwHighDateTime=0x1bd4e6b, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe368b800, ftLastWriteTime.dwHighDateTime=0x1bd4e6b, nFileSizeHigh=0x0, nFileSizeLow=0x167, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01238_.GIF", cAlternateFileName="")) returned 0x295098 [0096.535] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0096.535] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0096.535] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01238_.gif")) returned 0x20 [0096.535] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01238_.gif")) returned 0x20 [0096.535] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01238_.gif")) returned 0x20 [0096.535] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01238_.gif")) returned 0x20 [0096.536] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01238_.gif"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe368b800, ftCreationTime.dwHighDateTime=0x1bd4e6b, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe368b800, ftLastWriteTime.dwHighDateTime=0x1bd4e6b, nFileSizeHigh=0x0, nFileSizeLow=0x167)) returned 1 [0096.536] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0096.536] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0096.536] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01238_.gif")) returned 0x20 [0096.536] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01238_.gif")) returned 0x20 [0096.536] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0096.536] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0096.536] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0096.536] SetEndOfFile (hFile=0x158) returned 1 [0096.537] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01238_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.537] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01238_.GIF", cchWideChar=12, lpMultiByteStr=0x3b9494c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01238_.GIF", lpUsedDefaultChar=0x0) returned 12 [0096.537] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01238_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.537] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01238_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94b4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01238_.GIF", lpUsedDefaultChar=0x0) returned 12 [0096.538] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3b94b4c, cbMultiByte=12, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="WB01238_.GIFg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0096.538] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01238_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.538] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01238_.GIF", cchWideChar=12, lpMultiByteStr=0x3b9494c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01238_.GIF", lpUsedDefaultChar=0x0) returned 12 [0096.538] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01238_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0096.538] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0096.538] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x167 [0096.538] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0096.539] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0096.539] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0096.539] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01238_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.539] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01238_.GIF", cchWideChar=12, lpMultiByteStr=0x3b9494c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01238_.GIF", lpUsedDefaultChar=0x0) returned 12 [0096.539] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01238_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.539] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01238_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94b4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01238_.GIF", lpUsedDefaultChar=0x0) returned 12 [0096.539] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3b94b4c, cbMultiByte=12, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="WB01238_.GIF8_.GIFg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0096.539] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01238_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.539] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01238_.GIF", cchWideChar=12, lpMultiByteStr=0x3b9494c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01238_.GIF", lpUsedDefaultChar=0x0) returned 12 [0096.539] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0096.540] CharToOemA (in: pSrc="WB01238_.GIF", pDst=0x3b94b4c | out: pDst="WB01238_.GIF") returned 1 [0096.540] WriteFile (in: hFile=0x158, lpBuffer=0x3b94b4c*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x3b94b4c*, lpNumberOfBytesWritten=0x18e048*=0xc, lpOverlapped=0x0) returned 1 [0096.540] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0096.540] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0096.541] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0096.541] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=21680418963) returned 1 [0096.541] ReadFile (in: hFile=0x11c, lpBuffer=0x3b09600, nNumberOfBytesToRead=0x167, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b09600*, lpNumberOfBytesRead=0x18dd7c*=0x167, lpOverlapped=0x0) returned 1 [0096.542] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0096.542] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=21680551497) returned 1 [0096.553] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b420*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b5b420*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0096.553] ReadFile (in: hFile=0x11c, lpBuffer=0x3b09600, nNumberOfBytesToRead=0x167, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3b09600*, lpNumberOfBytesRead=0x18de38*=0x167, lpOverlapped=0x0) returned 1 [0096.553] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x47 [0096.553] WriteFile (in: hFile=0x158, lpBuffer=0x3b09780*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3b09780*, lpNumberOfBytesWritten=0x18de10*=0x167, lpOverlapped=0x0) returned 1 [0096.553] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x1ae [0096.553] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0096.553] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0096.554] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0096.554] SetFilePointer (in: hFile=0x158, lDistanceToMove=12, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2a [0096.554] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x1b8 [0096.554] CloseHandle (hObject=0x11c) returned 1 [0096.554] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1b8 [0096.554] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1b8 [0096.554] SetFilePointer (in: hFile=0x158, lDistanceToMove=440, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1b8 [0096.554] SetFilePointer (in: hFile=0x158, lDistanceToMove=440, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x1b8 [0096.554] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1b8 [0096.554] SetFilePointer (in: hFile=0x158, lDistanceToMove=440, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x1b8 [0096.554] SetEndOfFile (hFile=0x158) returned 1 [0096.554] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1b8 [0096.555] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1b8 [0096.555] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01238_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.555] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01238_.GIF", cchWideChar=12, lpMultiByteStr=0x3b9494c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01238_.GIF", lpUsedDefaultChar=0x0) returned 12 [0096.555] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01238_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.555] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01238_.GIF", cchWideChar=12, lpMultiByteStr=0x3b9498c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01238_.GIF", lpUsedDefaultChar=0x0) returned 12 [0096.555] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3b9498c, cbMultiByte=12, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="WB01238_.GIFꞗ@涤(\x18믉`믑`") returned 12 [0096.555] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01238_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.555] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01238_.GIF", cchWideChar=12, lpMultiByteStr=0x3b9494c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01238_.GIF", lpUsedDefaultChar=0x0) returned 12 [0096.555] WriteFile (in: hFile=0x158, lpBuffer=0x3ad5738*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5738*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0096.555] CharToOemA (in: pSrc="WB01238_.GIF", pDst=0x3b9498c | out: pDst="WB01238_.GIF") returned 1 [0096.555] WriteFile (in: hFile=0x158, lpBuffer=0x3b9498c*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3b9498c*, lpNumberOfBytesWritten=0x18efcc*=0xc, lpOverlapped=0x0) returned 1 [0096.555] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b3b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x3b5b3b0*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0096.555] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0096.555] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0096.556] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1fd [0096.556] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1fd [0096.556] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0096.556] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0096.556] DeleteFileW (lpFileName="") returned 0 [0096.556] GetLastError () returned 0x3 [0096.556] GetFileAttributesW (lpFileName="") returned 0xffffffff [0096.556] SetLastError (dwErrCode=0x3) [0096.556] FlushFileBuffers (hFile=0x158) returned 1 [0096.558] GetCurrentThreadId () returned 0x970 [0096.559] GetCurrentThreadId () returned 0x970 [0096.559] GetCurrentThreadId () returned 0x970 [0096.559] GetCurrentThreadId () returned 0x970 [0096.559] GetCurrentThreadId () returned 0x970 [0096.559] GetCurrentThreadId () returned 0x970 [0096.559] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x2b4 [0096.559] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x2b4 [0096.559] SetFilePointer (in: hFile=0x158, lDistanceToMove=692, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x2b4 [0096.559] CloseHandle (hObject=0x158) returned 1 [0096.559] GetCurrentThreadId () returned 0x970 [0096.559] GetCurrentThreadId () returned 0x970 [0096.559] GetCurrentThreadId () returned 0x970 [0096.559] GetCurrentThreadId () returned 0x970 [0096.559] GetCurrentThreadId () returned 0x970 [0096.559] GetCurrentThreadId () returned 0x970 [0096.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [WB01238_.GIF].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [wb01238_.gif].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0096.559] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2b4 [0096.559] SetFilePointer (in: hFile=0x158, lDistanceToMove=564, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x234 [0096.559] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0096.559] GetFileType (hFile=0x158) returned 0x1 [0096.560] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2b, wMilliseconds=0x33a)) [0096.560] GetCurrentThreadId () returned 0x970 [0096.560] GetCurrentThreadId () returned 0x970 [0096.560] GetCurrentThreadId () returned 0x970 [0096.560] GetCurrentThreadId () returned 0x970 [0096.560] GetCurrentThreadId () returned 0x970 [0096.560] GetCurrentThreadId () returned 0x970 [0096.560] GetCurrentThreadId () returned 0x970 [0096.560] GetCurrentThreadId () returned 0x970 [0096.560] GetCurrentThreadId () returned 0x970 [0096.560] GetCurrentThreadId () returned 0x970 [0096.560] GetCurrentThreadId () returned 0x970 [0096.560] GetCurrentThreadId () returned 0x970 [0096.560] GetCurrentThreadId () returned 0x970 [0096.560] GetCurrentThreadId () returned 0x970 [0096.560] GetCurrentThreadId () returned 0x970 [0096.560] GetCurrentThreadId () returned 0x970 [0096.560] GetCurrentThreadId () returned 0x970 [0096.560] GetCurrentThreadId () returned 0x970 [0096.560] GetCurrentThreadId () returned 0x970 [0096.560] GetCurrentThreadId () returned 0x970 [0096.560] GetCurrentThreadId () returned 0x970 [0096.560] GetCurrentThreadId () returned 0x970 [0096.560] GetCurrentThreadId () returned 0x970 [0096.560] GetCurrentThreadId () returned 0x970 [0096.560] GetCurrentThreadId () returned 0x970 [0096.560] GetCurrentThreadId () returned 0x970 [0096.560] GetCurrentThreadId () returned 0x970 [0096.560] GetCurrentThreadId () returned 0x970 [0096.560] GetCurrentThreadId () returned 0x970 [0096.560] GetCurrentThreadId () returned 0x970 [0096.560] GetCurrentThreadId () returned 0x970 [0096.560] GetCurrentThreadId () returned 0x970 [0096.560] GetCurrentThreadId () returned 0x970 [0096.560] GetCurrentThreadId () returned 0x970 [0096.560] GetCurrentThreadId () returned 0x970 [0096.560] GetCurrentThreadId () returned 0x970 [0096.560] GetCurrentThreadId () returned 0x970 [0096.560] GetCurrentThreadId () returned 0x970 [0096.560] GetCurrentThreadId () returned 0x970 [0096.560] GetCurrentThreadId () returned 0x970 [0096.560] GetCurrentThreadId () returned 0x970 [0096.560] GetCurrentThreadId () returned 0x970 [0096.561] GetCurrentThreadId () returned 0x970 [0096.561] GetCurrentThreadId () returned 0x970 [0096.561] GetCurrentThreadId () returned 0x970 [0096.561] GetCurrentThreadId () returned 0x970 [0096.561] GetCurrentThreadId () returned 0x970 [0096.561] GetCurrentThreadId () returned 0x970 [0096.561] GetCurrentThreadId () returned 0x970 [0096.561] GetCurrentThreadId () returned 0x970 [0096.561] GetCurrentThreadId () returned 0x970 [0096.561] GetCurrentThreadId () returned 0x970 [0096.561] GetCurrentThreadId () returned 0x970 [0096.561] GetCurrentThreadId () returned 0x970 [0096.561] GetCurrentThreadId () returned 0x970 [0096.561] GetCurrentThreadId () returned 0x970 [0096.561] GetCurrentThreadId () returned 0x970 [0096.561] GetCurrentThreadId () returned 0x970 [0096.561] GetCurrentThreadId () returned 0x970 [0096.561] GetCurrentThreadId () returned 0x970 [0096.561] GetCurrentThreadId () returned 0x970 [0096.561] GetCurrentThreadId () returned 0x970 [0096.561] GetCurrentThreadId () returned 0x970 [0096.561] GetCurrentThreadId () returned 0x970 [0096.561] GetCurrentThreadId () returned 0x970 [0096.561] GetCurrentThreadId () returned 0x970 [0096.561] GetCurrentThreadId () returned 0x970 [0096.561] GetCurrentThreadId () returned 0x970 [0096.561] GetCurrentThreadId () returned 0x970 [0096.561] GetCurrentThreadId () returned 0x970 [0096.561] GetCurrentThreadId () returned 0x970 [0096.561] GetCurrentThreadId () returned 0x970 [0096.561] GetCurrentThreadId () returned 0x970 [0096.561] GetCurrentThreadId () returned 0x970 [0096.561] GetCurrentThreadId () returned 0x970 [0096.561] GetCurrentThreadId () returned 0x970 [0096.561] GetCurrentThreadId () returned 0x970 [0096.561] GetCurrentThreadId () returned 0x970 [0096.561] GetCurrentThreadId () returned 0x970 [0096.561] GetCurrentThreadId () returned 0x970 [0096.561] GetCurrentThreadId () returned 0x970 [0096.561] GetCurrentThreadId () returned 0x970 [0096.561] GetCurrentThreadId () returned 0x970 [0096.561] GetCurrentThreadId () returned 0x970 [0096.562] GetCurrentThreadId () returned 0x970 [0096.562] GetCurrentThreadId () returned 0x970 [0096.562] GetCurrentThreadId () returned 0x970 [0096.562] GetCurrentThreadId () returned 0x970 [0096.562] GetCurrentThreadId () returned 0x970 [0096.562] GetCurrentThreadId () returned 0x970 [0096.562] GetCurrentThreadId () returned 0x970 [0096.562] GetCurrentThreadId () returned 0x970 [0096.562] GetCurrentThreadId () returned 0x970 [0096.562] GetCurrentThreadId () returned 0x970 [0096.562] GetCurrentThreadId () returned 0x970 [0096.562] GetCurrentThreadId () returned 0x970 [0096.562] GetCurrentThreadId () returned 0x970 [0096.562] GetCurrentThreadId () returned 0x970 [0096.562] GetCurrentThreadId () returned 0x970 [0096.562] GetCurrentThreadId () returned 0x970 [0096.562] GetCurrentThreadId () returned 0x970 [0096.562] GetCurrentThreadId () returned 0x970 [0096.562] GetCurrentThreadId () returned 0x970 [0096.562] GetCurrentThreadId () returned 0x970 [0096.562] GetCurrentThreadId () returned 0x970 [0096.562] GetCurrentThreadId () returned 0x970 [0096.562] GetCurrentThreadId () returned 0x970 [0096.562] GetCurrentThreadId () returned 0x970 [0096.562] GetCurrentThreadId () returned 0x970 [0096.562] GetCurrentThreadId () returned 0x970 [0096.562] GetCurrentThreadId () returned 0x970 [0096.562] GetCurrentThreadId () returned 0x970 [0096.562] GetCurrentThreadId () returned 0x970 [0096.562] GetCurrentThreadId () returned 0x970 [0096.562] GetCurrentThreadId () returned 0x970 [0096.562] GetCurrentThreadId () returned 0x970 [0096.562] GetCurrentThreadId () returned 0x970 [0096.562] GetCurrentThreadId () returned 0x970 [0096.563] GetCurrentThreadId () returned 0x970 [0096.563] GetCurrentThreadId () returned 0x970 [0096.563] GetCurrentThreadId () returned 0x970 [0096.563] GetCurrentThreadId () returned 0x970 [0096.563] GetCurrentThreadId () returned 0x970 [0096.563] GetCurrentThreadId () returned 0x970 [0096.563] GetCurrentThreadId () returned 0x970 [0096.563] GetCurrentThreadId () returned 0x970 [0096.563] GetCurrentThreadId () returned 0x970 [0096.563] GetCurrentThreadId () returned 0x970 [0096.563] GetCurrentThreadId () returned 0x970 [0096.563] GetCurrentThreadId () returned 0x970 [0096.563] GetCurrentThreadId () returned 0x970 [0096.563] GetCurrentThreadId () returned 0x970 [0096.563] GetCurrentThreadId () returned 0x970 [0096.563] GetCurrentThreadId () returned 0x970 [0096.563] GetCurrentThreadId () returned 0x970 [0096.563] GetCurrentThreadId () returned 0x970 [0096.563] GetCurrentThreadId () returned 0x970 [0096.563] GetCurrentThreadId () returned 0x970 [0096.563] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.563] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.563] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b61ef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0096.563] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.563] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.563] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b61ef0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0096.563] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.563] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.563] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b530, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0096.563] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.563] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.563] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b530, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0096.563] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.563] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.563] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b61f50, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0096.563] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.563] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.564] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b61f50, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0096.564] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.564] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.564] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b61f50, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0096.564] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2b, wMilliseconds=0x349)) [0096.564] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Q(SucouJOt,T^irGvCXOj)ZPboZdB,nO", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0096.564] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Q(SucouJOt,T^irGvCXOj)ZPboZdB,nO", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0096.564] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Q(SucouJOt,T^irGvCXOj)ZPboZdB,nO", cchWideChar=32, lpMultiByteStr=0x3b57d88, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Q(SucouJOt,T^irGvCXOj)ZPboZdB,nO", lpUsedDefaultChar=0x0) returned 32 [0096.564] GetCurrentThreadId () returned 0x970 [0096.564] GetCurrentThreadId () returned 0x970 [0096.564] GetCurrentThreadId () returned 0x970 [0096.564] GetCurrentThreadId () returned 0x970 [0096.564] GetCurrentThreadId () returned 0x970 [0096.564] GetCurrentThreadId () returned 0x970 [0096.571] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0096.571] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0096.571] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3b15ad8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0096.571] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0096.571] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAHH+/PfV+7G1oz4fg2sAl2wBgP44lW5GLhB4syQ7VfIVYnmrQJwMgxoMiqBjF2s/HsKaJi7UpYR36ajByShXVyxmCHo4GkKANDT44R/5pzsToFP+RWnXCX8Oxs8jbnq6nR1of/fz7XXlPHBBYQoDaQIIwWtRLnqXAg70a9H3H4aWSW/u2dng2iXf8BdZW8S5ULx1ZKloUoyX5VnSKS1aIj/0K6y7VmwR6w==") returned 232 [0096.571] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2b, wMilliseconds=0x349)) [0096.572] GetCurrentThreadId () returned 0x970 [0096.572] GetCurrentThreadId () returned 0x970 [0096.572] GetCurrentThreadId () returned 0x970 [0096.572] GetCurrentThreadId () returned 0x970 [0096.572] GetCurrentThreadId () returned 0x970 [0096.572] GetCurrentThreadId () returned 0x970 [0096.572] GetCurrentThreadId () returned 0x970 [0096.572] GetCurrentThreadId () returned 0x970 [0096.572] GetCurrentThreadId () returned 0x970 [0096.572] GetCurrentThreadId () returned 0x970 [0096.572] GetCurrentThreadId () returned 0x970 [0096.572] GetCurrentThreadId () returned 0x970 [0096.572] GetCurrentThreadId () returned 0x970 [0096.572] GetCurrentThreadId () returned 0x970 [0096.572] GetCurrentThreadId () returned 0x970 [0096.572] GetCurrentThreadId () returned 0x970 [0096.572] GetCurrentThreadId () returned 0x970 [0096.572] GetCurrentThreadId () returned 0x970 [0096.572] GetCurrentThreadId () returned 0x970 [0096.572] GetCurrentThreadId () returned 0x970 [0096.572] GetCurrentThreadId () returned 0x970 [0096.572] GetCurrentThreadId () returned 0x970 [0096.572] GetCurrentThreadId () returned 0x970 [0096.572] GetCurrentThreadId () returned 0x970 [0096.572] GetCurrentThreadId () returned 0x970 [0096.572] GetCurrentThreadId () returned 0x970 [0096.572] GetCurrentThreadId () returned 0x970 [0096.572] GetCurrentThreadId () returned 0x970 [0096.572] GetCurrentThreadId () returned 0x970 [0096.572] GetCurrentThreadId () returned 0x970 [0096.572] GetCurrentThreadId () returned 0x970 [0096.572] GetCurrentThreadId () returned 0x970 [0096.572] GetCurrentThreadId () returned 0x970 [0096.572] GetCurrentThreadId () returned 0x970 [0096.572] GetCurrentThreadId () returned 0x970 [0096.572] GetCurrentThreadId () returned 0x970 [0096.572] GetCurrentThreadId () returned 0x970 [0096.572] GetCurrentThreadId () returned 0x970 [0096.572] GetCurrentThreadId () returned 0x970 [0096.572] GetCurrentThreadId () returned 0x970 [0096.572] GetCurrentThreadId () returned 0x970 [0096.572] GetCurrentThreadId () returned 0x970 [0096.572] GetCurrentThreadId () returned 0x970 [0096.572] GetCurrentThreadId () returned 0x970 [0096.572] GetCurrentThreadId () returned 0x970 [0096.573] GetCurrentThreadId () returned 0x970 [0096.573] GetCurrentThreadId () returned 0x970 [0096.573] GetCurrentThreadId () returned 0x970 [0096.573] GetCurrentThreadId () returned 0x970 [0096.573] GetCurrentThreadId () returned 0x970 [0096.573] GetCurrentThreadId () returned 0x970 [0096.573] GetCurrentThreadId () returned 0x970 [0096.573] GetCurrentThreadId () returned 0x970 [0096.573] GetCurrentThreadId () returned 0x970 [0096.573] GetCurrentThreadId () returned 0x970 [0096.573] GetCurrentThreadId () returned 0x970 [0096.573] GetCurrentThreadId () returned 0x970 [0096.573] GetCurrentThreadId () returned 0x970 [0096.573] GetCurrentThreadId () returned 0x970 [0096.573] GetCurrentThreadId () returned 0x970 [0096.573] GetCurrentThreadId () returned 0x970 [0096.573] GetCurrentThreadId () returned 0x970 [0096.573] GetCurrentThreadId () returned 0x970 [0096.573] GetCurrentThreadId () returned 0x970 [0096.573] GetCurrentThreadId () returned 0x970 [0096.573] GetCurrentThreadId () returned 0x970 [0096.573] GetCurrentThreadId () returned 0x970 [0096.573] GetCurrentThreadId () returned 0x970 [0096.573] GetCurrentThreadId () returned 0x970 [0096.573] GetCurrentThreadId () returned 0x970 [0096.573] GetCurrentThreadId () returned 0x970 [0096.573] GetCurrentThreadId () returned 0x970 [0096.573] GetCurrentThreadId () returned 0x970 [0096.573] GetCurrentThreadId () returned 0x970 [0096.573] GetCurrentThreadId () returned 0x970 [0096.573] GetCurrentThreadId () returned 0x970 [0096.573] GetCurrentThreadId () returned 0x970 [0096.573] GetCurrentThreadId () returned 0x970 [0096.573] GetCurrentThreadId () returned 0x970 [0096.573] GetCurrentThreadId () returned 0x970 [0096.573] GetCurrentThreadId () returned 0x970 [0096.573] GetCurrentThreadId () returned 0x970 [0096.573] GetCurrentThreadId () returned 0x970 [0096.573] GetCurrentThreadId () returned 0x970 [0096.573] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAHH+/PfV+7G1oz4fg2sAl2wBgP44lW5GLhB4syQ7VfIVYnmrQJwMgxoMiqBjF2s/HsKaJi7UpYR36ajByShXVyxmCHo4GkKANDT44R/5pzsToFP+RWnXCX8Oxs8jbnq6nR1of/fz7XXlPHBBYQoDaQIIwWtRLnqXAg70a9H3H4aWSW/u2dng2iXf8BdZW8S5ULx1ZKloUoyX5VnSKS1aIj/0K6y7VmwR6w==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0096.573] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAHH+/PfV+7G1oz4fg2sAl2wBgP44lW5GLhB4syQ7VfIVYnmrQJwMgxoMiqBjF2s/HsKaJi7UpYR36ajByShXVyxmCHo4GkKANDT44R/5pzsToFP+RWnXCX8Oxs8jbnq6nR1of/fz7XXlPHBBYQoDaQIIwWtRLnqXAg70a9H3H4aWSW/u2dng2iXf8BdZW8S5ULx1ZKloUoyX5VnSKS1aIj/0K6y7VmwR6w==", cchWideChar=245, lpMultiByteStr=0x3b4d08c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAHH+/PfV+7G1oz4fg2sAl2wBgP44lW5GLhB4syQ7VfIVYnmrQJwMgxoMiqBjF2s/HsKaJi7UpYR36ajByShXVyxmCHo4GkKANDT44R/5pzsToFP+RWnXCX8Oxs8jbnq6nR1of/fz7XXlPHBBYQoDaQIIwWtRLnqXAg70a9H3H4aWSW/u2dng2iXf8BdZW8S5ULx1ZKloUoyX5VnSKS1aIj/0K6y7VmwR6w==", lpUsedDefaultChar=0x0) returned 245 [0096.574] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0096.574] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0096.574] CloseHandle (hObject=0x158) returned 1 [0096.574] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01238_.gif")) returned 1 [0096.575] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=21683828091) returned 1 [0096.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [WB01239_.GIF].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [wb01239_.gif].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0096.576] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0096.576] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0096.576] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0096.576] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0096.576] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0096.576] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0096.576] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0096.576] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0096.576] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0096.576] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0096.576] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0096.576] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0096.576] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0096.576] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0096.576] SetEndOfFile (hFile=0x158) returned 1 [0096.577] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0096.577] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0096.577] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0096.577] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0096.577] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0096.578] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0096.578] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="rJ*H:czSSdc{$Ow.8+.o*aI9zvbb$Lv*", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0096.578] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="rJ*H:czSSdc{$Ow.8+.o*aI9zvbb$Lv*", cchWideChar=32, lpMultiByteStr=0x203dfec, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rJ*H:czSSdc{$Ow.8+.o*aI9zvbb$Lv*", lpUsedDefaultChar=0x0) returned 32 [0096.578] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0096.578] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0096.578] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbfa57200, ftCreationTime.dwHighDateTime=0x1bd4e6b, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbfa57200, ftLastWriteTime.dwHighDateTime=0x1bd4e6b, nFileSizeHigh=0x0, nFileSizeLow=0x19a, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01239_.GIF", cAlternateFileName="")) returned 0x295098 [0096.578] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0096.578] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0096.578] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01239_.gif")) returned 0x20 [0096.578] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01239_.gif")) returned 0x20 [0096.579] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01239_.gif")) returned 0x20 [0096.579] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01239_.gif")) returned 0x20 [0096.579] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01239_.gif"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbfa57200, ftCreationTime.dwHighDateTime=0x1bd4e6b, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbfa57200, ftLastWriteTime.dwHighDateTime=0x1bd4e6b, nFileSizeHigh=0x0, nFileSizeLow=0x19a)) returned 1 [0096.579] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0096.579] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0096.579] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01239_.gif")) returned 0x20 [0096.579] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01239_.gif")) returned 0x20 [0096.579] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0096.579] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0096.579] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0096.579] SetEndOfFile (hFile=0x158) returned 1 [0096.580] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01239_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.580] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01239_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94d2c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01239_.GIF", lpUsedDefaultChar=0x0) returned 12 [0096.580] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01239_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.580] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01239_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94c0c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01239_.GIF", lpUsedDefaultChar=0x0) returned 12 [0096.580] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3b94c0c, cbMultiByte=12, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="WB01239_.GIFg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0096.580] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01239_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.580] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01239_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94d2c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01239_.GIF", lpUsedDefaultChar=0x0) returned 12 [0096.580] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01239_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0096.581] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0096.581] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x19a [0096.581] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0096.581] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0096.581] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0096.581] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01239_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.581] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01239_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94d2c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01239_.GIF", lpUsedDefaultChar=0x0) returned 12 [0096.581] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01239_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.581] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01239_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94c0c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01239_.GIF", lpUsedDefaultChar=0x0) returned 12 [0096.581] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3b94c0c, cbMultiByte=12, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="WB01239_.GIF9_.GIFg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0096.581] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01239_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.581] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01239_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94d2c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01239_.GIF", lpUsedDefaultChar=0x0) returned 12 [0096.581] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0096.582] CharToOemA (in: pSrc="WB01239_.GIF", pDst=0x3b94c0c | out: pDst="WB01239_.GIF") returned 1 [0096.582] WriteFile (in: hFile=0x158, lpBuffer=0x3b94c0c*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x3b94c0c*, lpNumberOfBytesWritten=0x18e048*=0xc, lpOverlapped=0x0) returned 1 [0096.582] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0096.583] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0096.583] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0096.583] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=21684619120) returned 1 [0096.583] ReadFile (in: hFile=0x11c, lpBuffer=0x1fcd490, nNumberOfBytesToRead=0x19a, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fcd490*, lpNumberOfBytesRead=0x18dd7c*=0x19a, lpOverlapped=0x0) returned 1 [0096.584] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0096.584] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=21684715176) returned 1 [0096.593] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b3d8*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b5b3d8*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0096.593] ReadFile (in: hFile=0x11c, lpBuffer=0x1fcd490, nNumberOfBytesToRead=0x19a, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x1fcd490*, lpNumberOfBytesRead=0x18de38*=0x19a, lpOverlapped=0x0) returned 1 [0096.593] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x47 [0096.593] WriteFile (in: hFile=0x158, lpBuffer=0x1fcd630*, nNumberOfBytesToWrite=0x19a, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1fcd630*, lpNumberOfBytesWritten=0x18de10*=0x19a, lpOverlapped=0x0) returned 1 [0096.594] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x1e1 [0096.594] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0096.594] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0096.594] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0096.594] SetFilePointer (in: hFile=0x158, lDistanceToMove=12, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2a [0096.594] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x1eb [0096.594] CloseHandle (hObject=0x11c) returned 1 [0096.594] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1eb [0096.594] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1eb [0096.594] SetFilePointer (in: hFile=0x158, lDistanceToMove=491, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1eb [0096.594] SetFilePointer (in: hFile=0x158, lDistanceToMove=491, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x1eb [0096.594] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1eb [0096.594] SetFilePointer (in: hFile=0x158, lDistanceToMove=491, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x1eb [0096.594] SetEndOfFile (hFile=0x158) returned 1 [0096.595] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1eb [0096.595] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1eb [0096.595] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01239_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.595] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01239_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94d2c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01239_.GIF", lpUsedDefaultChar=0x0) returned 12 [0096.595] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01239_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.595] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01239_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94dec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01239_.GIF", lpUsedDefaultChar=0x0) returned 12 [0096.595] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3b94dec, cbMultiByte=12, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="WB01239_.GIFꞗ@涤(\x18믉`믑`") returned 12 [0096.595] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01239_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.595] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01239_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94d2c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01239_.GIF", lpUsedDefaultChar=0x0) returned 12 [0096.595] WriteFile (in: hFile=0x158, lpBuffer=0x3ad5738*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5738*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0096.595] CharToOemA (in: pSrc="WB01239_.GIF", pDst=0x3b94dec | out: pDst="WB01239_.GIF") returned 1 [0096.596] WriteFile (in: hFile=0x158, lpBuffer=0x3b94dec*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3b94dec*, lpNumberOfBytesWritten=0x18efcc*=0xc, lpOverlapped=0x0) returned 1 [0096.596] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b470*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x3b5b470*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0096.596] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0096.596] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0096.596] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x230 [0096.596] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x230 [0096.596] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0096.596] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0096.596] DeleteFileW (lpFileName="") returned 0 [0096.596] GetLastError () returned 0x3 [0096.596] GetFileAttributesW (lpFileName="") returned 0xffffffff [0096.596] SetLastError (dwErrCode=0x3) [0096.596] FlushFileBuffers (hFile=0x158) returned 1 [0096.600] GetCurrentThreadId () returned 0x970 [0096.600] GetCurrentThreadId () returned 0x970 [0096.600] GetCurrentThreadId () returned 0x970 [0096.600] GetCurrentThreadId () returned 0x970 [0096.600] GetCurrentThreadId () returned 0x970 [0096.600] GetCurrentThreadId () returned 0x970 [0096.600] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x2e7 [0096.600] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x2e7 [0096.600] SetFilePointer (in: hFile=0x158, lDistanceToMove=743, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x2e7 [0096.600] CloseHandle (hObject=0x158) returned 1 [0096.600] GetCurrentThreadId () returned 0x970 [0096.600] GetCurrentThreadId () returned 0x970 [0096.600] GetCurrentThreadId () returned 0x970 [0096.600] GetCurrentThreadId () returned 0x970 [0096.601] GetCurrentThreadId () returned 0x970 [0096.601] GetCurrentThreadId () returned 0x970 [0096.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [WB01239_.GIF].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [wb01239_.gif].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0096.601] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2e7 [0096.601] SetFilePointer (in: hFile=0x158, lDistanceToMove=615, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x267 [0096.601] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0096.601] GetFileType (hFile=0x158) returned 0x1 [0096.601] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2b, wMilliseconds=0x368)) [0096.601] GetCurrentThreadId () returned 0x970 [0096.601] GetCurrentThreadId () returned 0x970 [0096.601] GetCurrentThreadId () returned 0x970 [0096.601] GetCurrentThreadId () returned 0x970 [0096.601] GetCurrentThreadId () returned 0x970 [0096.601] GetCurrentThreadId () returned 0x970 [0096.601] GetCurrentThreadId () returned 0x970 [0096.601] GetCurrentThreadId () returned 0x970 [0096.601] GetCurrentThreadId () returned 0x970 [0096.601] GetCurrentThreadId () returned 0x970 [0096.601] GetCurrentThreadId () returned 0x970 [0096.601] GetCurrentThreadId () returned 0x970 [0096.601] GetCurrentThreadId () returned 0x970 [0096.601] GetCurrentThreadId () returned 0x970 [0096.601] GetCurrentThreadId () returned 0x970 [0096.601] GetCurrentThreadId () returned 0x970 [0096.601] GetCurrentThreadId () returned 0x970 [0096.601] GetCurrentThreadId () returned 0x970 [0096.601] GetCurrentThreadId () returned 0x970 [0096.601] GetCurrentThreadId () returned 0x970 [0096.601] GetCurrentThreadId () returned 0x970 [0096.602] GetCurrentThreadId () returned 0x970 [0096.602] GetCurrentThreadId () returned 0x970 [0096.602] GetCurrentThreadId () returned 0x970 [0096.602] GetCurrentThreadId () returned 0x970 [0096.602] GetCurrentThreadId () returned 0x970 [0096.602] GetCurrentThreadId () returned 0x970 [0096.602] GetCurrentThreadId () returned 0x970 [0096.602] GetCurrentThreadId () returned 0x970 [0096.602] GetCurrentThreadId () returned 0x970 [0096.602] GetCurrentThreadId () returned 0x970 [0096.602] GetCurrentThreadId () returned 0x970 [0096.602] GetCurrentThreadId () returned 0x970 [0096.602] GetCurrentThreadId () returned 0x970 [0096.602] GetCurrentThreadId () returned 0x970 [0096.602] GetCurrentThreadId () returned 0x970 [0096.602] GetCurrentThreadId () returned 0x970 [0096.602] GetCurrentThreadId () returned 0x970 [0096.602] GetCurrentThreadId () returned 0x970 [0096.602] GetCurrentThreadId () returned 0x970 [0096.602] GetCurrentThreadId () returned 0x970 [0096.602] GetCurrentThreadId () returned 0x970 [0096.602] GetCurrentThreadId () returned 0x970 [0096.602] GetCurrentThreadId () returned 0x970 [0096.602] GetCurrentThreadId () returned 0x970 [0096.602] GetCurrentThreadId () returned 0x970 [0096.602] GetCurrentThreadId () returned 0x970 [0096.602] GetCurrentThreadId () returned 0x970 [0096.602] GetCurrentThreadId () returned 0x970 [0096.602] GetCurrentThreadId () returned 0x970 [0096.602] GetCurrentThreadId () returned 0x970 [0096.602] GetCurrentThreadId () returned 0x970 [0096.602] GetCurrentThreadId () returned 0x970 [0096.602] GetCurrentThreadId () returned 0x970 [0096.602] GetCurrentThreadId () returned 0x970 [0096.602] GetCurrentThreadId () returned 0x970 [0096.602] GetCurrentThreadId () returned 0x970 [0096.602] GetCurrentThreadId () returned 0x970 [0096.602] GetCurrentThreadId () returned 0x970 [0096.602] GetCurrentThreadId () returned 0x970 [0096.602] GetCurrentThreadId () returned 0x970 [0096.603] GetCurrentThreadId () returned 0x970 [0096.603] GetCurrentThreadId () returned 0x970 [0096.603] GetCurrentThreadId () returned 0x970 [0096.603] GetCurrentThreadId () returned 0x970 [0096.603] GetCurrentThreadId () returned 0x970 [0096.603] GetCurrentThreadId () returned 0x970 [0096.603] GetCurrentThreadId () returned 0x970 [0096.603] GetCurrentThreadId () returned 0x970 [0096.603] GetCurrentThreadId () returned 0x970 [0096.603] GetCurrentThreadId () returned 0x970 [0096.603] GetCurrentThreadId () returned 0x970 [0096.603] GetCurrentThreadId () returned 0x970 [0096.603] GetCurrentThreadId () returned 0x970 [0096.603] GetCurrentThreadId () returned 0x970 [0096.603] GetCurrentThreadId () returned 0x970 [0096.603] GetCurrentThreadId () returned 0x970 [0096.603] GetCurrentThreadId () returned 0x970 [0096.603] GetCurrentThreadId () returned 0x970 [0096.603] GetCurrentThreadId () returned 0x970 [0096.603] GetCurrentThreadId () returned 0x970 [0096.603] GetCurrentThreadId () returned 0x970 [0096.603] GetCurrentThreadId () returned 0x970 [0096.603] GetCurrentThreadId () returned 0x970 [0096.603] GetCurrentThreadId () returned 0x970 [0096.603] GetCurrentThreadId () returned 0x970 [0096.603] GetCurrentThreadId () returned 0x970 [0096.603] GetCurrentThreadId () returned 0x970 [0096.603] GetCurrentThreadId () returned 0x970 [0096.603] GetCurrentThreadId () returned 0x970 [0096.603] GetCurrentThreadId () returned 0x970 [0096.603] GetCurrentThreadId () returned 0x970 [0096.603] GetCurrentThreadId () returned 0x970 [0096.603] GetCurrentThreadId () returned 0x970 [0096.603] GetCurrentThreadId () returned 0x970 [0096.603] GetCurrentThreadId () returned 0x970 [0096.603] GetCurrentThreadId () returned 0x970 [0096.603] GetCurrentThreadId () returned 0x970 [0096.603] GetCurrentThreadId () returned 0x970 [0096.603] GetCurrentThreadId () returned 0x970 [0096.603] GetCurrentThreadId () returned 0x970 [0096.603] GetCurrentThreadId () returned 0x970 [0096.603] GetCurrentThreadId () returned 0x970 [0096.603] GetCurrentThreadId () returned 0x970 [0096.603] GetCurrentThreadId () returned 0x970 [0096.603] GetCurrentThreadId () returned 0x970 [0096.604] GetCurrentThreadId () returned 0x970 [0096.604] GetCurrentThreadId () returned 0x970 [0096.604] GetCurrentThreadId () returned 0x970 [0096.604] GetCurrentThreadId () returned 0x970 [0096.604] GetCurrentThreadId () returned 0x970 [0096.604] GetCurrentThreadId () returned 0x970 [0096.604] GetCurrentThreadId () returned 0x970 [0096.604] GetCurrentThreadId () returned 0x970 [0096.604] GetCurrentThreadId () returned 0x970 [0096.604] GetCurrentThreadId () returned 0x970 [0096.604] GetCurrentThreadId () returned 0x970 [0096.604] GetCurrentThreadId () returned 0x970 [0096.604] GetCurrentThreadId () returned 0x970 [0096.604] GetCurrentThreadId () returned 0x970 [0096.604] GetCurrentThreadId () returned 0x970 [0096.604] GetCurrentThreadId () returned 0x970 [0096.604] GetCurrentThreadId () returned 0x970 [0096.604] GetCurrentThreadId () returned 0x970 [0096.604] GetCurrentThreadId () returned 0x970 [0096.604] GetCurrentThreadId () returned 0x970 [0096.604] GetCurrentThreadId () returned 0x970 [0096.604] GetCurrentThreadId () returned 0x970 [0096.604] GetCurrentThreadId () returned 0x970 [0096.604] GetCurrentThreadId () returned 0x970 [0096.604] GetCurrentThreadId () returned 0x970 [0096.604] GetCurrentThreadId () returned 0x970 [0096.604] GetCurrentThreadId () returned 0x970 [0096.604] GetCurrentThreadId () returned 0x970 [0096.604] GetCurrentThreadId () returned 0x970 [0096.604] GetCurrentThreadId () returned 0x970 [0096.604] GetCurrentThreadId () returned 0x970 [0096.604] GetCurrentThreadId () returned 0x970 [0096.604] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.604] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.604] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b61f50, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0096.604] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.604] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.604] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b61f50, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0096.604] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.604] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.604] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b548, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0096.605] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.605] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.605] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b548, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0096.605] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.605] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.605] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b61fb0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0096.605] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.605] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.605] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b61fb0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0096.605] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.605] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.605] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b61fb0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0096.605] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2b, wMilliseconds=0x368)) [0096.605] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rJ*H:czSSdc{$Ow.8+.o*aI9zvbb$Lv*", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0096.605] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rJ*H:czSSdc{$Ow.8+.o*aI9zvbb$Lv*", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0096.605] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rJ*H:czSSdc{$Ow.8+.o*aI9zvbb$Lv*", cchWideChar=32, lpMultiByteStr=0x3b57db8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rJ*H:czSSdc{$Ow.8+.o*aI9zvbb$Lv*", lpUsedDefaultChar=0x0) returned 32 [0096.605] GetCurrentThreadId () returned 0x970 [0096.605] GetCurrentThreadId () returned 0x970 [0096.605] GetCurrentThreadId () returned 0x970 [0096.605] GetCurrentThreadId () returned 0x970 [0096.605] GetCurrentThreadId () returned 0x970 [0096.605] GetCurrentThreadId () returned 0x970 [0096.613] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0096.613] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0096.613] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3b15bc8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0096.613] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0096.613] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAFvcmv+M6ClBN/KJWZDoSvBXvCfo/LYyFtWMcqlxBqJLRDUYArzyQbTs/+eQW62BYTVAHEM4H55rpqYdowkTfYwUXyib2jF32VJ6IipuKTAOcAgs5GKFjJ76THV7RgQy1TdYfXQovqCOetlQvwLJ5LUHxZHZ26L78HObNGDMwgSUXcik0EGyOPz4XwuyFtJIf44MxcAccBnziosWGpB6bYZyHcVzKgcFGQ==") returned 232 [0096.613] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2b, wMilliseconds=0x378)) [0096.613] GetCurrentThreadId () returned 0x970 [0096.613] GetCurrentThreadId () returned 0x970 [0096.613] GetCurrentThreadId () returned 0x970 [0096.613] GetCurrentThreadId () returned 0x970 [0096.613] GetCurrentThreadId () returned 0x970 [0096.613] GetCurrentThreadId () returned 0x970 [0096.613] GetCurrentThreadId () returned 0x970 [0096.613] GetCurrentThreadId () returned 0x970 [0096.613] GetCurrentThreadId () returned 0x970 [0096.613] GetCurrentThreadId () returned 0x970 [0096.613] GetCurrentThreadId () returned 0x970 [0096.613] GetCurrentThreadId () returned 0x970 [0096.613] GetCurrentThreadId () returned 0x970 [0096.613] GetCurrentThreadId () returned 0x970 [0096.613] GetCurrentThreadId () returned 0x970 [0096.613] GetCurrentThreadId () returned 0x970 [0096.613] GetCurrentThreadId () returned 0x970 [0096.613] GetCurrentThreadId () returned 0x970 [0096.613] GetCurrentThreadId () returned 0x970 [0096.613] GetCurrentThreadId () returned 0x970 [0096.613] GetCurrentThreadId () returned 0x970 [0096.613] GetCurrentThreadId () returned 0x970 [0096.613] GetCurrentThreadId () returned 0x970 [0096.613] GetCurrentThreadId () returned 0x970 [0096.613] GetCurrentThreadId () returned 0x970 [0096.613] GetCurrentThreadId () returned 0x970 [0096.614] GetCurrentThreadId () returned 0x970 [0096.614] GetCurrentThreadId () returned 0x970 [0096.614] GetCurrentThreadId () returned 0x970 [0096.614] GetCurrentThreadId () returned 0x970 [0096.614] GetCurrentThreadId () returned 0x970 [0096.614] GetCurrentThreadId () returned 0x970 [0096.614] GetCurrentThreadId () returned 0x970 [0096.614] GetCurrentThreadId () returned 0x970 [0096.614] GetCurrentThreadId () returned 0x970 [0096.614] GetCurrentThreadId () returned 0x970 [0096.614] GetCurrentThreadId () returned 0x970 [0096.614] GetCurrentThreadId () returned 0x970 [0096.614] GetCurrentThreadId () returned 0x970 [0096.614] GetCurrentThreadId () returned 0x970 [0096.614] GetCurrentThreadId () returned 0x970 [0096.614] GetCurrentThreadId () returned 0x970 [0096.614] GetCurrentThreadId () returned 0x970 [0096.614] GetCurrentThreadId () returned 0x970 [0096.614] GetCurrentThreadId () returned 0x970 [0096.614] GetCurrentThreadId () returned 0x970 [0096.614] GetCurrentThreadId () returned 0x970 [0096.614] GetCurrentThreadId () returned 0x970 [0096.614] GetCurrentThreadId () returned 0x970 [0096.614] GetCurrentThreadId () returned 0x970 [0096.614] GetCurrentThreadId () returned 0x970 [0096.614] GetCurrentThreadId () returned 0x970 [0096.614] GetCurrentThreadId () returned 0x970 [0096.614] GetCurrentThreadId () returned 0x970 [0096.614] GetCurrentThreadId () returned 0x970 [0096.614] GetCurrentThreadId () returned 0x970 [0096.614] GetCurrentThreadId () returned 0x970 [0096.614] GetCurrentThreadId () returned 0x970 [0096.614] GetCurrentThreadId () returned 0x970 [0096.614] GetCurrentThreadId () returned 0x970 [0096.614] GetCurrentThreadId () returned 0x970 [0096.614] GetCurrentThreadId () returned 0x970 [0096.614] GetCurrentThreadId () returned 0x970 [0096.614] GetCurrentThreadId () returned 0x970 [0096.614] GetCurrentThreadId () returned 0x970 [0096.614] GetCurrentThreadId () returned 0x970 [0096.614] GetCurrentThreadId () returned 0x970 [0096.614] GetCurrentThreadId () returned 0x970 [0096.614] GetCurrentThreadId () returned 0x970 [0096.614] GetCurrentThreadId () returned 0x970 [0096.614] GetCurrentThreadId () returned 0x970 [0096.614] GetCurrentThreadId () returned 0x970 [0096.615] GetCurrentThreadId () returned 0x970 [0096.615] GetCurrentThreadId () returned 0x970 [0096.615] GetCurrentThreadId () returned 0x970 [0096.615] GetCurrentThreadId () returned 0x970 [0096.615] GetCurrentThreadId () returned 0x970 [0096.615] GetCurrentThreadId () returned 0x970 [0096.615] GetCurrentThreadId () returned 0x970 [0096.615] GetCurrentThreadId () returned 0x970 [0096.615] GetCurrentThreadId () returned 0x970 [0096.615] GetCurrentThreadId () returned 0x970 [0096.615] GetCurrentThreadId () returned 0x970 [0096.615] GetCurrentThreadId () returned 0x970 [0096.615] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAFvcmv+M6ClBN/KJWZDoSvBXvCfo/LYyFtWMcqlxBqJLRDUYArzyQbTs/+eQW62BYTVAHEM4H55rpqYdowkTfYwUXyib2jF32VJ6IipuKTAOcAgs5GKFjJ76THV7RgQy1TdYfXQovqCOetlQvwLJ5LUHxZHZ26L78HObNGDMwgSUXcik0EGyOPz4XwuyFtJIf44MxcAccBnziosWGpB6bYZyHcVzKgcFGQ==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0096.615] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAFvcmv+M6ClBN/KJWZDoSvBXvCfo/LYyFtWMcqlxBqJLRDUYArzyQbTs/+eQW62BYTVAHEM4H55rpqYdowkTfYwUXyib2jF32VJ6IipuKTAOcAgs5GKFjJ76THV7RgQy1TdYfXQovqCOetlQvwLJ5LUHxZHZ26L78HObNGDMwgSUXcik0EGyOPz4XwuyFtJIf44MxcAccBnziosWGpB6bYZyHcVzKgcFGQ==", cchWideChar=245, lpMultiByteStr=0x3b4d08c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAFvcmv+M6ClBN/KJWZDoSvBXvCfo/LYyFtWMcqlxBqJLRDUYArzyQbTs/+eQW62BYTVAHEM4H55rpqYdowkTfYwUXyib2jF32VJ6IipuKTAOcAgs5GKFjJ76THV7RgQy1TdYfXQovqCOetlQvwLJ5LUHxZHZ26L78HObNGDMwgSUXcik0EGyOPz4XwuyFtJIf44MxcAccBnziosWGpB6bYZyHcVzKgcFGQ==", lpUsedDefaultChar=0x0) returned 245 [0096.615] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0096.615] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0096.615] CloseHandle (hObject=0x158) returned 1 [0096.615] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01239_.gif")) returned 1 [0096.616] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=21687957909) returned 1 [0096.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [WB01240_.GIF].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [wb01240_.gif].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0096.617] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0096.617] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0096.617] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0096.617] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0096.617] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0096.617] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0096.617] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0096.617] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0096.617] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0096.617] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0096.617] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0096.617] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0096.618] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0096.618] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0096.618] SetEndOfFile (hFile=0x158) returned 1 [0096.618] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0096.618] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0096.618] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0096.618] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0096.618] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0096.619] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0096.619] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="j$Y&Z5XBGJ!kz3Ed&f2v*zLk97M8!u!Q", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0096.619] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="j$Y&Z5XBGJ!kz3Ed&f2v*zLk97M8!u!Q", cchWideChar=32, lpMultiByteStr=0x203e024, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="j$Y&Z5XBGJ!kz3Ed&f2v*zLk97M8!u!Q", lpUsedDefaultChar=0x0) returned 32 [0096.619] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0096.619] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0096.619] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1d80d00, ftCreationTime.dwHighDateTime=0x1bd4e6b, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa1d80d00, ftLastWriteTime.dwHighDateTime=0x1bd4e6b, nFileSizeHigh=0x0, nFileSizeLow=0x14d, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01240_.GIF", cAlternateFileName="")) returned 0x295098 [0096.619] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0096.619] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0096.619] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01240_.gif")) returned 0x20 [0096.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01240_.gif")) returned 0x20 [0096.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01240_.gif")) returned 0x20 [0096.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01240_.gif")) returned 0x20 [0096.620] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01240_.gif"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1d80d00, ftCreationTime.dwHighDateTime=0x1bd4e6b, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa1d80d00, ftLastWriteTime.dwHighDateTime=0x1bd4e6b, nFileSizeHigh=0x0, nFileSizeLow=0x14d)) returned 1 [0096.620] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0096.620] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0096.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01240_.gif")) returned 0x20 [0096.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01240_.gif")) returned 0x20 [0096.620] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0096.620] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0096.620] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0096.620] SetEndOfFile (hFile=0x158) returned 1 [0096.621] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01240_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.621] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01240_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94a4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01240_.GIF", lpUsedDefaultChar=0x0) returned 12 [0096.621] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01240_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.621] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01240_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94b6c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01240_.GIF", lpUsedDefaultChar=0x0) returned 12 [0096.621] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3b94b6c, cbMultiByte=12, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="WB01240_.GIFg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0096.621] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01240_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.621] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01240_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94a4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01240_.GIF", lpUsedDefaultChar=0x0) returned 12 [0096.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01240_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0096.622] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0096.622] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x14d [0096.622] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0096.622] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0096.622] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0096.622] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01240_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.622] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01240_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94a4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01240_.GIF", lpUsedDefaultChar=0x0) returned 12 [0096.622] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01240_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.622] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01240_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94b6c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01240_.GIF", lpUsedDefaultChar=0x0) returned 12 [0096.622] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3b94b6c, cbMultiByte=12, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="WB01240_.GIF0_.GIFg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0096.622] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01240_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.622] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01240_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94a4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01240_.GIF", lpUsedDefaultChar=0x0) returned 12 [0096.622] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0096.623] CharToOemA (in: pSrc="WB01240_.GIF", pDst=0x3b94b6c | out: pDst="WB01240_.GIF") returned 1 [0096.623] WriteFile (in: hFile=0x158, lpBuffer=0x3b94b6c*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x3b94b6c*, lpNumberOfBytesWritten=0x18e048*=0xc, lpOverlapped=0x0) returned 1 [0096.623] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0096.624] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0096.624] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0096.624] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=21688729444) returned 1 [0096.632] ReadFile (in: hFile=0x11c, lpBuffer=0x356c140, nNumberOfBytesToRead=0x14d, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x356c140*, lpNumberOfBytesRead=0x18dd7c*=0x14d, lpOverlapped=0x0) returned 1 [0096.633] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0096.633] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=21689674130) returned 1 [0096.642] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b3c0*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b5b3c0*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0096.643] ReadFile (in: hFile=0x11c, lpBuffer=0x356c140, nNumberOfBytesToRead=0x14d, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x356c140*, lpNumberOfBytesRead=0x18de38*=0x14d, lpOverlapped=0x0) returned 1 [0096.643] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x47 [0096.643] WriteFile (in: hFile=0x158, lpBuffer=0x356c2a0*, nNumberOfBytesToWrite=0x14d, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x356c2a0*, lpNumberOfBytesWritten=0x18de10*=0x14d, lpOverlapped=0x0) returned 1 [0096.643] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x194 [0096.643] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0096.643] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0096.643] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0096.643] SetFilePointer (in: hFile=0x158, lDistanceToMove=12, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2a [0096.643] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x19e [0096.643] CloseHandle (hObject=0x11c) returned 1 [0096.643] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x19e [0096.644] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x19e [0096.644] SetFilePointer (in: hFile=0x158, lDistanceToMove=414, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x19e [0096.644] SetFilePointer (in: hFile=0x158, lDistanceToMove=414, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x19e [0096.644] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x19e [0096.644] SetFilePointer (in: hFile=0x158, lDistanceToMove=414, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x19e [0096.644] SetEndOfFile (hFile=0x158) returned 1 [0096.644] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x19e [0096.644] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x19e [0096.644] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01240_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.644] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01240_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94a4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01240_.GIF", lpUsedDefaultChar=0x0) returned 12 [0096.644] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01240_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.644] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01240_.GIF", cchWideChar=12, lpMultiByteStr=0x3b9498c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01240_.GIF", lpUsedDefaultChar=0x0) returned 12 [0096.644] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3b9498c, cbMultiByte=12, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="WB01240_.GIFꞗ@涤(\x18믉`믑`") returned 12 [0096.644] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01240_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.644] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01240_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94a4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01240_.GIF", lpUsedDefaultChar=0x0) returned 12 [0096.644] WriteFile (in: hFile=0x158, lpBuffer=0x3ad5738*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5738*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0096.645] CharToOemA (in: pSrc="WB01240_.GIF", pDst=0x3b9498c | out: pDst="WB01240_.GIF") returned 1 [0096.645] WriteFile (in: hFile=0x158, lpBuffer=0x3b9498c*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3b9498c*, lpNumberOfBytesWritten=0x18efcc*=0xc, lpOverlapped=0x0) returned 1 [0096.645] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b350*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x3b5b350*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0096.645] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0096.645] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0096.645] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1e3 [0096.645] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1e3 [0096.645] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0096.645] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0096.645] DeleteFileW (lpFileName="") returned 0 [0096.645] GetLastError () returned 0x3 [0096.645] GetFileAttributesW (lpFileName="") returned 0xffffffff [0096.645] SetLastError (dwErrCode=0x3) [0096.645] FlushFileBuffers (hFile=0x158) returned 1 [0096.648] GetCurrentThreadId () returned 0x970 [0096.648] GetCurrentThreadId () returned 0x970 [0096.648] GetCurrentThreadId () returned 0x970 [0096.648] GetCurrentThreadId () returned 0x970 [0096.648] GetCurrentThreadId () returned 0x970 [0096.648] GetCurrentThreadId () returned 0x970 [0096.648] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x29a [0096.648] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x29a [0096.648] SetFilePointer (in: hFile=0x158, lDistanceToMove=666, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x29a [0096.648] CloseHandle (hObject=0x158) returned 1 [0096.648] GetCurrentThreadId () returned 0x970 [0096.648] GetCurrentThreadId () returned 0x970 [0096.648] GetCurrentThreadId () returned 0x970 [0096.648] GetCurrentThreadId () returned 0x970 [0096.648] GetCurrentThreadId () returned 0x970 [0096.648] GetCurrentThreadId () returned 0x970 [0096.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [WB01240_.GIF].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [wb01240_.gif].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0096.648] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x29a [0096.648] SetFilePointer (in: hFile=0x158, lDistanceToMove=538, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x21a [0096.648] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0096.648] GetFileType (hFile=0x158) returned 0x1 [0096.649] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2b, wMilliseconds=0x397)) [0096.649] GetCurrentThreadId () returned 0x970 [0096.649] GetCurrentThreadId () returned 0x970 [0096.649] GetCurrentThreadId () returned 0x970 [0096.649] GetCurrentThreadId () returned 0x970 [0096.649] GetCurrentThreadId () returned 0x970 [0096.649] GetCurrentThreadId () returned 0x970 [0096.649] GetCurrentThreadId () returned 0x970 [0096.649] GetCurrentThreadId () returned 0x970 [0096.649] GetCurrentThreadId () returned 0x970 [0096.649] GetCurrentThreadId () returned 0x970 [0096.649] GetCurrentThreadId () returned 0x970 [0096.649] GetCurrentThreadId () returned 0x970 [0096.649] GetCurrentThreadId () returned 0x970 [0096.649] GetCurrentThreadId () returned 0x970 [0096.649] GetCurrentThreadId () returned 0x970 [0096.649] GetCurrentThreadId () returned 0x970 [0096.649] GetCurrentThreadId () returned 0x970 [0096.649] GetCurrentThreadId () returned 0x970 [0096.649] GetCurrentThreadId () returned 0x970 [0096.649] GetCurrentThreadId () returned 0x970 [0096.649] GetCurrentThreadId () returned 0x970 [0096.649] GetCurrentThreadId () returned 0x970 [0096.649] GetCurrentThreadId () returned 0x970 [0096.649] GetCurrentThreadId () returned 0x970 [0096.649] GetCurrentThreadId () returned 0x970 [0096.649] GetCurrentThreadId () returned 0x970 [0096.649] GetCurrentThreadId () returned 0x970 [0096.649] GetCurrentThreadId () returned 0x970 [0096.649] GetCurrentThreadId () returned 0x970 [0096.649] GetCurrentThreadId () returned 0x970 [0096.649] GetCurrentThreadId () returned 0x970 [0096.649] GetCurrentThreadId () returned 0x970 [0096.649] GetCurrentThreadId () returned 0x970 [0096.649] GetCurrentThreadId () returned 0x970 [0096.649] GetCurrentThreadId () returned 0x970 [0096.649] GetCurrentThreadId () returned 0x970 [0096.649] GetCurrentThreadId () returned 0x970 [0096.649] GetCurrentThreadId () returned 0x970 [0096.649] GetCurrentThreadId () returned 0x970 [0096.649] GetCurrentThreadId () returned 0x970 [0096.649] GetCurrentThreadId () returned 0x970 [0096.650] GetCurrentThreadId () returned 0x970 [0096.650] GetCurrentThreadId () returned 0x970 [0096.650] GetCurrentThreadId () returned 0x970 [0096.650] GetCurrentThreadId () returned 0x970 [0096.650] GetCurrentThreadId () returned 0x970 [0096.650] GetCurrentThreadId () returned 0x970 [0096.650] GetCurrentThreadId () returned 0x970 [0096.650] GetCurrentThreadId () returned 0x970 [0096.650] GetCurrentThreadId () returned 0x970 [0096.650] GetCurrentThreadId () returned 0x970 [0096.650] GetCurrentThreadId () returned 0x970 [0096.650] GetCurrentThreadId () returned 0x970 [0096.650] GetCurrentThreadId () returned 0x970 [0096.650] GetCurrentThreadId () returned 0x970 [0096.650] GetCurrentThreadId () returned 0x970 [0096.650] GetCurrentThreadId () returned 0x970 [0096.650] GetCurrentThreadId () returned 0x970 [0096.650] GetCurrentThreadId () returned 0x970 [0096.650] GetCurrentThreadId () returned 0x970 [0096.650] GetCurrentThreadId () returned 0x970 [0096.650] GetCurrentThreadId () returned 0x970 [0096.650] GetCurrentThreadId () returned 0x970 [0096.650] GetCurrentThreadId () returned 0x970 [0096.650] GetCurrentThreadId () returned 0x970 [0096.650] GetCurrentThreadId () returned 0x970 [0096.650] GetCurrentThreadId () returned 0x970 [0096.650] GetCurrentThreadId () returned 0x970 [0096.650] GetCurrentThreadId () returned 0x970 [0096.650] GetCurrentThreadId () returned 0x970 [0096.650] GetCurrentThreadId () returned 0x970 [0096.650] GetCurrentThreadId () returned 0x970 [0096.650] GetCurrentThreadId () returned 0x970 [0096.650] GetCurrentThreadId () returned 0x970 [0096.650] GetCurrentThreadId () returned 0x970 [0096.650] GetCurrentThreadId () returned 0x970 [0096.650] GetCurrentThreadId () returned 0x970 [0096.650] GetCurrentThreadId () returned 0x970 [0096.650] GetCurrentThreadId () returned 0x970 [0096.650] GetCurrentThreadId () returned 0x970 [0096.650] GetCurrentThreadId () returned 0x970 [0096.650] GetCurrentThreadId () returned 0x970 [0096.650] GetCurrentThreadId () returned 0x970 [0096.650] GetCurrentThreadId () returned 0x970 [0096.650] GetCurrentThreadId () returned 0x970 [0096.650] GetCurrentThreadId () returned 0x970 [0096.651] GetCurrentThreadId () returned 0x970 [0096.651] GetCurrentThreadId () returned 0x970 [0096.651] GetCurrentThreadId () returned 0x970 [0096.651] GetCurrentThreadId () returned 0x970 [0096.651] GetCurrentThreadId () returned 0x970 [0096.651] GetCurrentThreadId () returned 0x970 [0096.651] GetCurrentThreadId () returned 0x970 [0096.651] GetCurrentThreadId () returned 0x970 [0096.651] GetCurrentThreadId () returned 0x970 [0096.651] GetCurrentThreadId () returned 0x970 [0096.651] GetCurrentThreadId () returned 0x970 [0096.651] GetCurrentThreadId () returned 0x970 [0096.651] GetCurrentThreadId () returned 0x970 [0096.651] GetCurrentThreadId () returned 0x970 [0096.651] GetCurrentThreadId () returned 0x970 [0096.651] GetCurrentThreadId () returned 0x970 [0096.651] GetCurrentThreadId () returned 0x970 [0096.651] GetCurrentThreadId () returned 0x970 [0096.651] GetCurrentThreadId () returned 0x970 [0096.651] GetCurrentThreadId () returned 0x970 [0096.651] GetCurrentThreadId () returned 0x970 [0096.651] GetCurrentThreadId () returned 0x970 [0096.651] GetCurrentThreadId () returned 0x970 [0096.651] GetCurrentThreadId () returned 0x970 [0096.651] GetCurrentThreadId () returned 0x970 [0096.651] GetCurrentThreadId () returned 0x970 [0096.651] GetCurrentThreadId () returned 0x970 [0096.651] GetCurrentThreadId () returned 0x970 [0096.651] GetCurrentThreadId () returned 0x970 [0096.651] GetCurrentThreadId () returned 0x970 [0096.651] GetCurrentThreadId () returned 0x970 [0096.651] GetCurrentThreadId () returned 0x970 [0096.651] GetCurrentThreadId () returned 0x970 [0096.651] GetCurrentThreadId () returned 0x970 [0096.651] GetCurrentThreadId () returned 0x970 [0096.651] GetCurrentThreadId () returned 0x970 [0096.651] GetCurrentThreadId () returned 0x970 [0096.651] GetCurrentThreadId () returned 0x970 [0096.651] GetCurrentThreadId () returned 0x970 [0096.651] GetCurrentThreadId () returned 0x970 [0096.651] GetCurrentThreadId () returned 0x970 [0096.651] GetCurrentThreadId () returned 0x970 [0096.651] GetCurrentThreadId () returned 0x970 [0096.651] GetCurrentThreadId () returned 0x970 [0096.651] GetCurrentThreadId () returned 0x970 [0096.652] GetCurrentThreadId () returned 0x970 [0096.652] GetCurrentThreadId () returned 0x970 [0096.652] GetCurrentThreadId () returned 0x970 [0096.652] GetCurrentThreadId () returned 0x970 [0096.652] GetCurrentThreadId () returned 0x970 [0096.652] GetCurrentThreadId () returned 0x970 [0096.652] GetCurrentThreadId () returned 0x970 [0096.652] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.652] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.652] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b61fb0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0096.652] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.652] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.652] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b61fb0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0096.652] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.652] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.652] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b530, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0096.652] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.652] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.652] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b530, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0096.652] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.652] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.652] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b62010, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0096.652] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.652] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.652] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b62010, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0096.652] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.652] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.652] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b62010, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0096.652] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2b, wMilliseconds=0x397)) [0096.652] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="j$Y&Z5XBGJ!kz3Ed&f2v*zLk97M8!u!Q", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0096.652] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="j$Y&Z5XBGJ!kz3Ed&f2v*zLk97M8!u!Q", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0096.652] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="j$Y&Z5XBGJ!kz3Ed&f2v*zLk97M8!u!Q", cchWideChar=32, lpMultiByteStr=0x3b57de8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="j$Y&Z5XBGJ!kz3Ed&f2v*zLk97M8!u!Q", lpUsedDefaultChar=0x0) returned 32 [0096.653] GetCurrentThreadId () returned 0x970 [0096.653] GetCurrentThreadId () returned 0x970 [0096.653] GetCurrentThreadId () returned 0x970 [0096.653] GetCurrentThreadId () returned 0x970 [0096.653] GetCurrentThreadId () returned 0x970 [0096.653] GetCurrentThreadId () returned 0x970 [0096.660] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0096.660] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0096.660] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3b15cb8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0096.660] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0096.660] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAGjfUtY5wBIsWo9UDW/VK6gkfm4s33Z8qTHv2XyzbxV4R+njvxXP9g7V2oTB4X1QicJztwD2rvVjFbw3E7cQmYDNOOOzTQYd0HpHJUNuRodT6Ls3+WlgizqTcQ3LcBljtluqGRXTOMRu0l16HSgnN5bbo6/CT14BPvUiCzAXH1IqGIBWBFKFkL0F+3sP1U+kgThWZk0lhIGo3OjElRKpGtdzTVMehVGY2A==") returned 232 [0096.660] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2b, wMilliseconds=0x3a7)) [0096.660] GetCurrentThreadId () returned 0x970 [0096.660] GetCurrentThreadId () returned 0x970 [0096.660] GetCurrentThreadId () returned 0x970 [0096.660] GetCurrentThreadId () returned 0x970 [0096.660] GetCurrentThreadId () returned 0x970 [0096.660] GetCurrentThreadId () returned 0x970 [0096.660] GetCurrentThreadId () returned 0x970 [0096.660] GetCurrentThreadId () returned 0x970 [0096.660] GetCurrentThreadId () returned 0x970 [0096.661] GetCurrentThreadId () returned 0x970 [0096.661] GetCurrentThreadId () returned 0x970 [0096.661] GetCurrentThreadId () returned 0x970 [0096.661] GetCurrentThreadId () returned 0x970 [0096.661] GetCurrentThreadId () returned 0x970 [0096.661] GetCurrentThreadId () returned 0x970 [0096.661] GetCurrentThreadId () returned 0x970 [0096.661] GetCurrentThreadId () returned 0x970 [0096.661] GetCurrentThreadId () returned 0x970 [0096.661] GetCurrentThreadId () returned 0x970 [0096.661] GetCurrentThreadId () returned 0x970 [0096.661] GetCurrentThreadId () returned 0x970 [0096.661] GetCurrentThreadId () returned 0x970 [0096.661] GetCurrentThreadId () returned 0x970 [0096.661] GetCurrentThreadId () returned 0x970 [0096.661] GetCurrentThreadId () returned 0x970 [0096.661] GetCurrentThreadId () returned 0x970 [0096.661] GetCurrentThreadId () returned 0x970 [0096.661] GetCurrentThreadId () returned 0x970 [0096.661] GetCurrentThreadId () returned 0x970 [0096.661] GetCurrentThreadId () returned 0x970 [0096.661] GetCurrentThreadId () returned 0x970 [0096.661] GetCurrentThreadId () returned 0x970 [0096.661] GetCurrentThreadId () returned 0x970 [0096.661] GetCurrentThreadId () returned 0x970 [0096.661] GetCurrentThreadId () returned 0x970 [0096.661] GetCurrentThreadId () returned 0x970 [0096.661] GetCurrentThreadId () returned 0x970 [0096.661] GetCurrentThreadId () returned 0x970 [0096.661] GetCurrentThreadId () returned 0x970 [0096.661] GetCurrentThreadId () returned 0x970 [0096.661] GetCurrentThreadId () returned 0x970 [0096.661] GetCurrentThreadId () returned 0x970 [0096.661] GetCurrentThreadId () returned 0x970 [0096.661] GetCurrentThreadId () returned 0x970 [0096.661] GetCurrentThreadId () returned 0x970 [0096.661] GetCurrentThreadId () returned 0x970 [0096.661] GetCurrentThreadId () returned 0x970 [0096.661] GetCurrentThreadId () returned 0x970 [0096.661] GetCurrentThreadId () returned 0x970 [0096.661] GetCurrentThreadId () returned 0x970 [0096.661] GetCurrentThreadId () returned 0x970 [0096.661] GetCurrentThreadId () returned 0x970 [0096.661] GetCurrentThreadId () returned 0x970 [0096.661] GetCurrentThreadId () returned 0x970 [0096.662] GetCurrentThreadId () returned 0x970 [0096.662] GetCurrentThreadId () returned 0x970 [0096.662] GetCurrentThreadId () returned 0x970 [0096.662] GetCurrentThreadId () returned 0x970 [0096.662] GetCurrentThreadId () returned 0x970 [0096.662] GetCurrentThreadId () returned 0x970 [0096.662] GetCurrentThreadId () returned 0x970 [0096.662] GetCurrentThreadId () returned 0x970 [0096.662] GetCurrentThreadId () returned 0x970 [0096.662] GetCurrentThreadId () returned 0x970 [0096.662] GetCurrentThreadId () returned 0x970 [0096.662] GetCurrentThreadId () returned 0x970 [0096.662] GetCurrentThreadId () returned 0x970 [0096.662] GetCurrentThreadId () returned 0x970 [0096.662] GetCurrentThreadId () returned 0x970 [0096.662] GetCurrentThreadId () returned 0x970 [0096.662] GetCurrentThreadId () returned 0x970 [0096.662] GetCurrentThreadId () returned 0x970 [0096.662] GetCurrentThreadId () returned 0x970 [0096.662] GetCurrentThreadId () returned 0x970 [0096.662] GetCurrentThreadId () returned 0x970 [0096.662] GetCurrentThreadId () returned 0x970 [0096.662] GetCurrentThreadId () returned 0x970 [0096.662] GetCurrentThreadId () returned 0x970 [0096.662] GetCurrentThreadId () returned 0x970 [0096.662] GetCurrentThreadId () returned 0x970 [0096.662] GetCurrentThreadId () returned 0x970 [0096.662] GetCurrentThreadId () returned 0x970 [0096.662] GetCurrentThreadId () returned 0x970 [0096.662] GetCurrentThreadId () returned 0x970 [0096.662] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAGjfUtY5wBIsWo9UDW/VK6gkfm4s33Z8qTHv2XyzbxV4R+njvxXP9g7V2oTB4X1QicJztwD2rvVjFbw3E7cQmYDNOOOzTQYd0HpHJUNuRodT6Ls3+WlgizqTcQ3LcBljtluqGRXTOMRu0l16HSgnN5bbo6/CT14BPvUiCzAXH1IqGIBWBFKFkL0F+3sP1U+kgThWZk0lhIGo3OjElRKpGtdzTVMehVGY2A==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0096.662] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAGjfUtY5wBIsWo9UDW/VK6gkfm4s33Z8qTHv2XyzbxV4R+njvxXP9g7V2oTB4X1QicJztwD2rvVjFbw3E7cQmYDNOOOzTQYd0HpHJUNuRodT6Ls3+WlgizqTcQ3LcBljtluqGRXTOMRu0l16HSgnN5bbo6/CT14BPvUiCzAXH1IqGIBWBFKFkL0F+3sP1U+kgThWZk0lhIGo3OjElRKpGtdzTVMehVGY2A==", cchWideChar=245, lpMultiByteStr=0x3b4d08c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAGjfUtY5wBIsWo9UDW/VK6gkfm4s33Z8qTHv2XyzbxV4R+njvxXP9g7V2oTB4X1QicJztwD2rvVjFbw3E7cQmYDNOOOzTQYd0HpHJUNuRodT6Ls3+WlgizqTcQ3LcBljtluqGRXTOMRu0l16HSgnN5bbo6/CT14BPvUiCzAXH1IqGIBWBFKFkL0F+3sP1U+kgThWZk0lhIGo3OjElRKpGtdzTVMehVGY2A==", lpUsedDefaultChar=0x0) returned 245 [0096.662] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0096.676] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0096.676] CloseHandle (hObject=0x158) returned 1 [0096.676] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01240_.gif")) returned 1 [0096.680] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=21694379252) returned 1 [0096.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [WB01241_.GIF].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [wb01241_.gif].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0096.681] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0096.681] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0096.681] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0096.681] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0096.681] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0096.681] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0096.681] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0096.682] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0096.682] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0096.682] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0096.682] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0096.682] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0096.682] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0096.682] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0096.682] SetEndOfFile (hFile=0x158) returned 1 [0096.682] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0096.682] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0096.682] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0096.682] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0096.682] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0096.683] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0096.683] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="\"kh6pXz3OlE:sSfN\"y:XBN\\H==s}TR*Q", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0096.683] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="\"kh6pXz3OlE:sSfN\"y:XBN\\H==s}TR*Q", cchWideChar=32, lpMultiByteStr=0x203e05c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\"kh6pXz3OlE:sSfN\"y:XBN\\H==s}TR*Q", lpUsedDefaultChar=0x0) returned 32 [0096.683] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0096.683] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0096.683] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x866d0200, ftCreationTime.dwHighDateTime=0x1bd4e6b, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x866d0200, ftLastWriteTime.dwHighDateTime=0x1bd4e6b, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01241_.GIF", cAlternateFileName="")) returned 0x295098 [0096.684] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0096.684] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0096.684] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01241_.gif")) returned 0x20 [0096.684] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01241_.gif")) returned 0x20 [0096.684] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01241_.gif")) returned 0x20 [0096.684] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01241_.gif")) returned 0x20 [0096.684] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01241_.gif"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x866d0200, ftCreationTime.dwHighDateTime=0x1bd4e6b, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x866d0200, ftLastWriteTime.dwHighDateTime=0x1bd4e6b, nFileSizeHigh=0x0, nFileSizeLow=0x182)) returned 1 [0096.684] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0096.684] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0096.684] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01241_.gif")) returned 0x20 [0096.684] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01241_.gif")) returned 0x20 [0096.684] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0096.685] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0096.685] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0096.685] SetEndOfFile (hFile=0x158) returned 1 [0096.685] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01241_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.685] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01241_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94dcc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01241_.GIF", lpUsedDefaultChar=0x0) returned 12 [0096.686] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01241_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.686] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01241_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94bec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01241_.GIF", lpUsedDefaultChar=0x0) returned 12 [0096.686] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3b94bec, cbMultiByte=12, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="WB01241_.GIFg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0096.686] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01241_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.686] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01241_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94dcc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01241_.GIF", lpUsedDefaultChar=0x0) returned 12 [0096.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01241_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0096.686] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0096.686] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x182 [0096.686] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0096.686] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0096.686] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0096.686] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01241_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.687] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01241_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94dcc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01241_.GIF", lpUsedDefaultChar=0x0) returned 12 [0096.687] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01241_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.687] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01241_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94bec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01241_.GIF", lpUsedDefaultChar=0x0) returned 12 [0096.687] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3b94bec, cbMultiByte=12, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="WB01241_.GIF1_.GIFg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0096.687] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01241_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.687] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01241_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94dcc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01241_.GIF", lpUsedDefaultChar=0x0) returned 12 [0096.688] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0096.688] CharToOemA (in: pSrc="WB01241_.GIF", pDst=0x3b94bec | out: pDst="WB01241_.GIF") returned 1 [0096.688] WriteFile (in: hFile=0x158, lpBuffer=0x3b94bec*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x3b94bec*, lpNumberOfBytesWritten=0x18e048*=0xc, lpOverlapped=0x0) returned 1 [0096.688] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0096.689] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0096.689] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0096.689] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=21695227004) returned 1 [0096.689] ReadFile (in: hFile=0x11c, lpBuffer=0x1fcd490, nNumberOfBytesToRead=0x182, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fcd490*, lpNumberOfBytesRead=0x18dd7c*=0x182, lpOverlapped=0x0) returned 1 [0096.690] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0096.690] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=21695327642) returned 1 [0096.698] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b450*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b5b450*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0096.699] ReadFile (in: hFile=0x11c, lpBuffer=0x1fcd490, nNumberOfBytesToRead=0x182, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x1fcd490*, lpNumberOfBytesRead=0x18de38*=0x182, lpOverlapped=0x0) returned 1 [0096.699] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x47 [0096.699] WriteFile (in: hFile=0x158, lpBuffer=0x1fcd630*, nNumberOfBytesToWrite=0x182, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1fcd630*, lpNumberOfBytesWritten=0x18de10*=0x182, lpOverlapped=0x0) returned 1 [0096.699] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x1c9 [0096.699] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0096.699] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0096.699] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0096.699] SetFilePointer (in: hFile=0x158, lDistanceToMove=12, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2a [0096.699] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x1d3 [0096.699] CloseHandle (hObject=0x11c) returned 1 [0096.699] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1d3 [0096.699] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1d3 [0096.699] SetFilePointer (in: hFile=0x158, lDistanceToMove=467, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1d3 [0096.700] SetFilePointer (in: hFile=0x158, lDistanceToMove=467, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x1d3 [0096.700] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1d3 [0096.700] SetFilePointer (in: hFile=0x158, lDistanceToMove=467, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x1d3 [0096.700] SetEndOfFile (hFile=0x158) returned 1 [0096.700] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1d3 [0096.700] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1d3 [0096.700] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01241_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.700] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01241_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94dcc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01241_.GIF", lpUsedDefaultChar=0x0) returned 12 [0096.700] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01241_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.700] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01241_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94dec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01241_.GIF", lpUsedDefaultChar=0x0) returned 12 [0096.700] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3b94dec, cbMultiByte=12, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="WB01241_.GIFꞗ@涤(\x18믉`믑`") returned 12 [0096.700] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01241_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.700] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01241_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94dcc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01241_.GIF", lpUsedDefaultChar=0x0) returned 12 [0096.700] WriteFile (in: hFile=0x158, lpBuffer=0x3ad5738*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5738*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0096.700] CharToOemA (in: pSrc="WB01241_.GIF", pDst=0x3b94dec | out: pDst="WB01241_.GIF") returned 1 [0096.700] WriteFile (in: hFile=0x158, lpBuffer=0x3b94dec*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3b94dec*, lpNumberOfBytesWritten=0x18efcc*=0xc, lpOverlapped=0x0) returned 1 [0096.701] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b3b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x3b5b3b0*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0096.701] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0096.701] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0096.701] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x218 [0096.701] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x218 [0096.701] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0096.701] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0096.701] DeleteFileW (lpFileName="") returned 0 [0096.701] GetLastError () returned 0x3 [0096.701] GetFileAttributesW (lpFileName="") returned 0xffffffff [0096.701] SetLastError (dwErrCode=0x3) [0096.701] FlushFileBuffers (hFile=0x158) returned 1 [0096.704] GetCurrentThreadId () returned 0x970 [0096.704] GetCurrentThreadId () returned 0x970 [0096.704] GetCurrentThreadId () returned 0x970 [0096.704] GetCurrentThreadId () returned 0x970 [0096.704] GetCurrentThreadId () returned 0x970 [0096.704] GetCurrentThreadId () returned 0x970 [0096.704] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x2cf [0096.705] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x2cf [0096.705] SetFilePointer (in: hFile=0x158, lDistanceToMove=719, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x2cf [0096.705] CloseHandle (hObject=0x158) returned 1 [0096.705] GetCurrentThreadId () returned 0x970 [0096.705] GetCurrentThreadId () returned 0x970 [0096.705] GetCurrentThreadId () returned 0x970 [0096.705] GetCurrentThreadId () returned 0x970 [0096.705] GetCurrentThreadId () returned 0x970 [0096.705] GetCurrentThreadId () returned 0x970 [0096.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [WB01241_.GIF].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [wb01241_.gif].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0096.705] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2cf [0096.705] SetFilePointer (in: hFile=0x158, lDistanceToMove=591, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x24f [0096.705] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0096.705] GetFileType (hFile=0x158) returned 0x1 [0096.705] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2b, wMilliseconds=0x3d6)) [0096.705] GetCurrentThreadId () returned 0x970 [0096.705] GetCurrentThreadId () returned 0x970 [0096.705] GetCurrentThreadId () returned 0x970 [0096.705] GetCurrentThreadId () returned 0x970 [0096.705] GetCurrentThreadId () returned 0x970 [0096.705] GetCurrentThreadId () returned 0x970 [0096.705] GetCurrentThreadId () returned 0x970 [0096.705] GetCurrentThreadId () returned 0x970 [0096.706] GetCurrentThreadId () returned 0x970 [0096.706] GetCurrentThreadId () returned 0x970 [0096.706] GetCurrentThreadId () returned 0x970 [0096.706] GetCurrentThreadId () returned 0x970 [0096.706] GetCurrentThreadId () returned 0x970 [0096.706] GetCurrentThreadId () returned 0x970 [0096.706] GetCurrentThreadId () returned 0x970 [0096.706] GetCurrentThreadId () returned 0x970 [0096.706] GetCurrentThreadId () returned 0x970 [0096.706] GetCurrentThreadId () returned 0x970 [0096.706] GetCurrentThreadId () returned 0x970 [0096.706] GetCurrentThreadId () returned 0x970 [0096.706] GetCurrentThreadId () returned 0x970 [0096.706] GetCurrentThreadId () returned 0x970 [0096.706] GetCurrentThreadId () returned 0x970 [0096.706] GetCurrentThreadId () returned 0x970 [0096.706] GetCurrentThreadId () returned 0x970 [0096.706] GetCurrentThreadId () returned 0x970 [0096.706] GetCurrentThreadId () returned 0x970 [0096.706] GetCurrentThreadId () returned 0x970 [0096.706] GetCurrentThreadId () returned 0x970 [0096.706] GetCurrentThreadId () returned 0x970 [0096.706] GetCurrentThreadId () returned 0x970 [0096.706] GetCurrentThreadId () returned 0x970 [0096.706] GetCurrentThreadId () returned 0x970 [0096.706] GetCurrentThreadId () returned 0x970 [0096.706] GetCurrentThreadId () returned 0x970 [0096.706] GetCurrentThreadId () returned 0x970 [0096.706] GetCurrentThreadId () returned 0x970 [0096.706] GetCurrentThreadId () returned 0x970 [0096.706] GetCurrentThreadId () returned 0x970 [0096.706] GetCurrentThreadId () returned 0x970 [0096.706] GetCurrentThreadId () returned 0x970 [0096.706] GetCurrentThreadId () returned 0x970 [0096.706] GetCurrentThreadId () returned 0x970 [0096.706] GetCurrentThreadId () returned 0x970 [0096.706] GetCurrentThreadId () returned 0x970 [0096.706] GetCurrentThreadId () returned 0x970 [0096.706] GetCurrentThreadId () returned 0x970 [0096.706] GetCurrentThreadId () returned 0x970 [0096.706] GetCurrentThreadId () returned 0x970 [0096.706] GetCurrentThreadId () returned 0x970 [0096.706] GetCurrentThreadId () returned 0x970 [0096.706] GetCurrentThreadId () returned 0x970 [0096.706] GetCurrentThreadId () returned 0x970 [0096.707] GetCurrentThreadId () returned 0x970 [0096.707] GetCurrentThreadId () returned 0x970 [0096.707] GetCurrentThreadId () returned 0x970 [0096.707] GetCurrentThreadId () returned 0x970 [0096.707] GetCurrentThreadId () returned 0x970 [0096.707] GetCurrentThreadId () returned 0x970 [0096.707] GetCurrentThreadId () returned 0x970 [0096.707] GetCurrentThreadId () returned 0x970 [0096.707] GetCurrentThreadId () returned 0x970 [0096.707] GetCurrentThreadId () returned 0x970 [0096.707] GetCurrentThreadId () returned 0x970 [0096.707] GetCurrentThreadId () returned 0x970 [0096.707] GetCurrentThreadId () returned 0x970 [0096.707] GetCurrentThreadId () returned 0x970 [0096.707] GetCurrentThreadId () returned 0x970 [0096.707] GetCurrentThreadId () returned 0x970 [0096.707] GetCurrentThreadId () returned 0x970 [0096.707] GetCurrentThreadId () returned 0x970 [0096.707] GetCurrentThreadId () returned 0x970 [0096.707] GetCurrentThreadId () returned 0x970 [0096.707] GetCurrentThreadId () returned 0x970 [0096.707] GetCurrentThreadId () returned 0x970 [0096.707] GetCurrentThreadId () returned 0x970 [0096.707] GetCurrentThreadId () returned 0x970 [0096.707] GetCurrentThreadId () returned 0x970 [0096.707] GetCurrentThreadId () returned 0x970 [0096.707] GetCurrentThreadId () returned 0x970 [0096.707] GetCurrentThreadId () returned 0x970 [0096.707] GetCurrentThreadId () returned 0x970 [0096.707] GetCurrentThreadId () returned 0x970 [0096.707] GetCurrentThreadId () returned 0x970 [0096.707] GetCurrentThreadId () returned 0x970 [0096.707] GetCurrentThreadId () returned 0x970 [0096.707] GetCurrentThreadId () returned 0x970 [0096.707] GetCurrentThreadId () returned 0x970 [0096.707] GetCurrentThreadId () returned 0x970 [0096.707] GetCurrentThreadId () returned 0x970 [0096.707] GetCurrentThreadId () returned 0x970 [0096.707] GetCurrentThreadId () returned 0x970 [0096.707] GetCurrentThreadId () returned 0x970 [0096.707] GetCurrentThreadId () returned 0x970 [0096.707] GetCurrentThreadId () returned 0x970 [0096.707] GetCurrentThreadId () returned 0x970 [0096.707] GetCurrentThreadId () returned 0x970 [0096.707] GetCurrentThreadId () returned 0x970 [0096.707] GetCurrentThreadId () returned 0x970 [0096.708] GetCurrentThreadId () returned 0x970 [0096.708] GetCurrentThreadId () returned 0x970 [0096.708] GetCurrentThreadId () returned 0x970 [0096.708] GetCurrentThreadId () returned 0x970 [0096.708] GetCurrentThreadId () returned 0x970 [0096.708] GetCurrentThreadId () returned 0x970 [0096.708] GetCurrentThreadId () returned 0x970 [0096.708] GetCurrentThreadId () returned 0x970 [0096.708] GetCurrentThreadId () returned 0x970 [0096.708] GetCurrentThreadId () returned 0x970 [0096.708] GetCurrentThreadId () returned 0x970 [0096.708] GetCurrentThreadId () returned 0x970 [0096.708] GetCurrentThreadId () returned 0x970 [0096.708] GetCurrentThreadId () returned 0x970 [0096.708] GetCurrentThreadId () returned 0x970 [0096.708] GetCurrentThreadId () returned 0x970 [0096.708] GetCurrentThreadId () returned 0x970 [0096.708] GetCurrentThreadId () returned 0x970 [0096.708] GetCurrentThreadId () returned 0x970 [0096.708] GetCurrentThreadId () returned 0x970 [0096.708] GetCurrentThreadId () returned 0x970 [0096.708] GetCurrentThreadId () returned 0x970 [0096.708] GetCurrentThreadId () returned 0x970 [0096.708] GetCurrentThreadId () returned 0x970 [0096.708] GetCurrentThreadId () returned 0x970 [0096.708] GetCurrentThreadId () returned 0x970 [0096.708] GetCurrentThreadId () returned 0x970 [0096.708] GetCurrentThreadId () returned 0x970 [0096.708] GetCurrentThreadId () returned 0x970 [0096.708] GetCurrentThreadId () returned 0x970 [0096.708] GetCurrentThreadId () returned 0x970 [0096.708] GetCurrentThreadId () returned 0x970 [0096.708] GetCurrentThreadId () returned 0x970 [0096.708] GetCurrentThreadId () returned 0x970 [0096.708] GetCurrentThreadId () returned 0x970 [0096.708] GetCurrentThreadId () returned 0x970 [0096.708] GetCurrentThreadId () returned 0x970 [0096.708] GetCurrentThreadId () returned 0x970 [0096.708] GetCurrentThreadId () returned 0x970 [0096.708] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.708] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.708] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b62010, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0096.708] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.709] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.709] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b62010, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0096.709] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.709] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.709] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b548, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0096.709] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.709] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.709] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b548, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0096.709] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.709] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.709] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b62070, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0096.709] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.709] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.709] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b62070, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0096.709] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.709] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.709] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b62070, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0096.709] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2b, wMilliseconds=0x3d6)) [0096.709] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="\"kh6pXz3OlE:sSfN\"y:XBN\\H==s}TR*Q", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0096.709] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="\"kh6pXz3OlE:sSfN\"y:XBN\\H==s}TR*Q", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0096.709] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="\"kh6pXz3OlE:sSfN\"y:XBN\\H==s}TR*Q", cchWideChar=32, lpMultiByteStr=0x3b57e18, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\"kh6pXz3OlE:sSfN\"y:XBN\\H==s}TR*Q", lpUsedDefaultChar=0x0) returned 32 [0096.709] GetCurrentThreadId () returned 0x970 [0096.709] GetCurrentThreadId () returned 0x970 [0096.709] GetCurrentThreadId () returned 0x970 [0096.709] GetCurrentThreadId () returned 0x970 [0096.709] GetCurrentThreadId () returned 0x970 [0096.709] GetCurrentThreadId () returned 0x970 [0096.717] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0096.717] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0096.717] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3b15da8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0096.717] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0096.717] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAABlsPsG6pRuD7wiCnJro3LcZKrq10U/a9cke1w779QhZQS9coDuaqWdgLST3GX8ud9X7uoZLPUOwzWzNF5vvZXGqnsyJY+UVIr5VUV/iXnKeHzyKeg3+KwmyfYrgpHcloqpVdEEj5Wh40rxw1TCKc1Z3iRSeGyzJLDm08gSaVmmsm97F0/AvM8yAzSvnXHkWt2v6Vm/jq54lOXSxGAbPNs7ORDdqwQvj1A==") returned 232 [0096.717] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2b, wMilliseconds=0x3d6)) [0096.717] GetCurrentThreadId () returned 0x970 [0096.717] GetCurrentThreadId () returned 0x970 [0096.717] GetCurrentThreadId () returned 0x970 [0096.717] GetCurrentThreadId () returned 0x970 [0096.717] GetCurrentThreadId () returned 0x970 [0096.717] GetCurrentThreadId () returned 0x970 [0096.717] GetCurrentThreadId () returned 0x970 [0096.717] GetCurrentThreadId () returned 0x970 [0096.717] GetCurrentThreadId () returned 0x970 [0096.717] GetCurrentThreadId () returned 0x970 [0096.717] GetCurrentThreadId () returned 0x970 [0096.717] GetCurrentThreadId () returned 0x970 [0096.717] GetCurrentThreadId () returned 0x970 [0096.717] GetCurrentThreadId () returned 0x970 [0096.717] GetCurrentThreadId () returned 0x970 [0096.717] GetCurrentThreadId () returned 0x970 [0096.717] GetCurrentThreadId () returned 0x970 [0096.717] GetCurrentThreadId () returned 0x970 [0096.717] GetCurrentThreadId () returned 0x970 [0096.717] GetCurrentThreadId () returned 0x970 [0096.717] GetCurrentThreadId () returned 0x970 [0096.717] GetCurrentThreadId () returned 0x970 [0096.717] GetCurrentThreadId () returned 0x970 [0096.717] GetCurrentThreadId () returned 0x970 [0096.717] GetCurrentThreadId () returned 0x970 [0096.717] GetCurrentThreadId () returned 0x970 [0096.717] GetCurrentThreadId () returned 0x970 [0096.718] GetCurrentThreadId () returned 0x970 [0096.718] GetCurrentThreadId () returned 0x970 [0096.718] GetCurrentThreadId () returned 0x970 [0096.718] GetCurrentThreadId () returned 0x970 [0096.718] GetCurrentThreadId () returned 0x970 [0096.718] GetCurrentThreadId () returned 0x970 [0096.718] GetCurrentThreadId () returned 0x970 [0096.718] GetCurrentThreadId () returned 0x970 [0096.718] GetCurrentThreadId () returned 0x970 [0096.718] GetCurrentThreadId () returned 0x970 [0096.718] GetCurrentThreadId () returned 0x970 [0096.718] GetCurrentThreadId () returned 0x970 [0096.718] GetCurrentThreadId () returned 0x970 [0096.718] GetCurrentThreadId () returned 0x970 [0096.718] GetCurrentThreadId () returned 0x970 [0096.718] GetCurrentThreadId () returned 0x970 [0096.718] GetCurrentThreadId () returned 0x970 [0096.718] GetCurrentThreadId () returned 0x970 [0096.718] GetCurrentThreadId () returned 0x970 [0096.718] GetCurrentThreadId () returned 0x970 [0096.718] GetCurrentThreadId () returned 0x970 [0096.718] GetCurrentThreadId () returned 0x970 [0096.718] GetCurrentThreadId () returned 0x970 [0096.718] GetCurrentThreadId () returned 0x970 [0096.718] GetCurrentThreadId () returned 0x970 [0096.718] GetCurrentThreadId () returned 0x970 [0096.718] GetCurrentThreadId () returned 0x970 [0096.718] GetCurrentThreadId () returned 0x970 [0096.718] GetCurrentThreadId () returned 0x970 [0096.718] GetCurrentThreadId () returned 0x970 [0096.718] GetCurrentThreadId () returned 0x970 [0096.718] GetCurrentThreadId () returned 0x970 [0096.718] GetCurrentThreadId () returned 0x970 [0096.718] GetCurrentThreadId () returned 0x970 [0096.718] GetCurrentThreadId () returned 0x970 [0096.718] GetCurrentThreadId () returned 0x970 [0096.718] GetCurrentThreadId () returned 0x970 [0096.719] GetCurrentThreadId () returned 0x970 [0096.719] GetCurrentThreadId () returned 0x970 [0096.719] GetCurrentThreadId () returned 0x970 [0096.719] GetCurrentThreadId () returned 0x970 [0096.719] GetCurrentThreadId () returned 0x970 [0096.719] GetCurrentThreadId () returned 0x970 [0096.719] GetCurrentThreadId () returned 0x970 [0096.719] GetCurrentThreadId () returned 0x970 [0096.719] GetCurrentThreadId () returned 0x970 [0096.719] GetCurrentThreadId () returned 0x970 [0096.719] GetCurrentThreadId () returned 0x970 [0096.719] GetCurrentThreadId () returned 0x970 [0096.719] GetCurrentThreadId () returned 0x970 [0096.719] GetCurrentThreadId () returned 0x970 [0096.719] GetCurrentThreadId () returned 0x970 [0096.719] GetCurrentThreadId () returned 0x970 [0096.719] GetCurrentThreadId () returned 0x970 [0096.719] GetCurrentThreadId () returned 0x970 [0096.719] GetCurrentThreadId () returned 0x970 [0096.719] GetCurrentThreadId () returned 0x970 [0096.719] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAABlsPsG6pRuD7wiCnJro3LcZKrq10U/a9cke1w779QhZQS9coDuaqWdgLST3GX8ud9X7uoZLPUOwzWzNF5vvZXGqnsyJY+UVIr5VUV/iXnKeHzyKeg3+KwmyfYrgpHcloqpVdEEj5Wh40rxw1TCKc1Z3iRSeGyzJLDm08gSaVmmsm97F0/AvM8yAzSvnXHkWt2v6Vm/jq54lOXSxGAbPNs7ORDdqwQvj1A==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0096.719] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAABlsPsG6pRuD7wiCnJro3LcZKrq10U/a9cke1w779QhZQS9coDuaqWdgLST3GX8ud9X7uoZLPUOwzWzNF5vvZXGqnsyJY+UVIr5VUV/iXnKeHzyKeg3+KwmyfYrgpHcloqpVdEEj5Wh40rxw1TCKc1Z3iRSeGyzJLDm08gSaVmmsm97F0/AvM8yAzSvnXHkWt2v6Vm/jq54lOXSxGAbPNs7ORDdqwQvj1A==", cchWideChar=245, lpMultiByteStr=0x3b4d08c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAABlsPsG6pRuD7wiCnJro3LcZKrq10U/a9cke1w779QhZQS9coDuaqWdgLST3GX8ud9X7uoZLPUOwzWzNF5vvZXGqnsyJY+UVIr5VUV/iXnKeHzyKeg3+KwmyfYrgpHcloqpVdEEj5Wh40rxw1TCKc1Z3iRSeGyzJLDm08gSaVmmsm97F0/AvM8yAzSvnXHkWt2v6Vm/jq54lOXSxGAbPNs7ORDdqwQvj1A==", lpUsedDefaultChar=0x0) returned 245 [0096.719] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0096.719] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0096.719] CloseHandle (hObject=0x158) returned 1 [0096.719] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01241_.gif")) returned 1 [0096.720] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=21698371455) returned 1 [0096.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [WB01242_.GIF].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [wb01242_.gif].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0096.721] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0096.721] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0096.721] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0096.721] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0096.721] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0096.721] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0096.721] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0096.721] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0096.721] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0096.722] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0096.722] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0096.722] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0096.722] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0096.722] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0096.722] SetEndOfFile (hFile=0x158) returned 1 [0096.722] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0096.722] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0096.722] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0096.722] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0096.722] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0096.723] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0096.723] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="RR%VYt+*ME!4d5~)w%Z3Ag53?*Tmn3Om", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0096.723] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="RR%VYt+*ME!4d5~)w%Z3Ag53?*Tmn3Om", cchWideChar=32, lpMultiByteStr=0x203e094, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RR%VYt+*ME!4d5~)w%Z3Ag53?*Tmn3Om", lpUsedDefaultChar=0x0) returned 32 [0096.723] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0096.723] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0096.723] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e14c700, ftCreationTime.dwHighDateTime=0x1bd4e6b, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7e14c700, ftLastWriteTime.dwHighDateTime=0x1bd4e6b, nFileSizeHigh=0x0, nFileSizeLow=0x158, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01242_.GIF", cAlternateFileName="")) returned 0x295098 [0096.723] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0096.723] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0096.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01242_.gif")) returned 0x20 [0096.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01242_.gif")) returned 0x20 [0096.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01242_.gif")) returned 0x20 [0096.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01242_.gif")) returned 0x20 [0096.724] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01242_.gif"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e14c700, ftCreationTime.dwHighDateTime=0x1bd4e6b, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7e14c700, ftLastWriteTime.dwHighDateTime=0x1bd4e6b, nFileSizeHigh=0x0, nFileSizeLow=0x158)) returned 1 [0096.724] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0096.724] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0096.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01242_.gif")) returned 0x20 [0096.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01242_.gif")) returned 0x20 [0096.724] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0096.724] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0096.724] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0096.724] SetEndOfFile (hFile=0x158) returned 1 [0096.725] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01242_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.725] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01242_.GIF", cchWideChar=12, lpMultiByteStr=0x3b9494c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01242_.GIF", lpUsedDefaultChar=0x0) returned 12 [0096.725] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01242_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.725] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01242_.GIF", cchWideChar=12, lpMultiByteStr=0x3b949ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01242_.GIF", lpUsedDefaultChar=0x0) returned 12 [0096.725] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3b949ec, cbMultiByte=12, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="WB01242_.GIFg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0096.725] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01242_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.725] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01242_.GIF", cchWideChar=12, lpMultiByteStr=0x3b9494c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01242_.GIF", lpUsedDefaultChar=0x0) returned 12 [0096.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01242_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0096.726] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0096.726] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x158 [0096.726] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0096.726] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0096.726] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0096.726] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01242_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.726] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01242_.GIF", cchWideChar=12, lpMultiByteStr=0x3b9494c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01242_.GIF", lpUsedDefaultChar=0x0) returned 12 [0096.726] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01242_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.726] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01242_.GIF", cchWideChar=12, lpMultiByteStr=0x3b949ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01242_.GIF", lpUsedDefaultChar=0x0) returned 12 [0096.726] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3b949ec, cbMultiByte=12, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="WB01242_.GIF2_.GIFg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0096.726] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01242_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.726] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01242_.GIF", cchWideChar=12, lpMultiByteStr=0x3b9494c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01242_.GIF", lpUsedDefaultChar=0x0) returned 12 [0096.727] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0096.727] CharToOemA (in: pSrc="WB01242_.GIF", pDst=0x3b949ec | out: pDst="WB01242_.GIF") returned 1 [0096.727] WriteFile (in: hFile=0x158, lpBuffer=0x3b949ec*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x3b949ec*, lpNumberOfBytesWritten=0x18e048*=0xc, lpOverlapped=0x0) returned 1 [0096.727] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0096.728] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0096.728] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0096.728] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=21699118131) returned 1 [0096.728] ReadFile (in: hFile=0x11c, lpBuffer=0x356c140, nNumberOfBytesToRead=0x158, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x356c140*, lpNumberOfBytesRead=0x18dd7c*=0x158, lpOverlapped=0x0) returned 1 [0096.729] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0096.729] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=21699215433) returned 1 [0096.737] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b438*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b5b438*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0096.737] ReadFile (in: hFile=0x11c, lpBuffer=0x356c140, nNumberOfBytesToRead=0x158, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x356c140*, lpNumberOfBytesRead=0x18de38*=0x158, lpOverlapped=0x0) returned 1 [0096.738] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x47 [0096.738] WriteFile (in: hFile=0x158, lpBuffer=0x356c2a0*, nNumberOfBytesToWrite=0x158, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x356c2a0*, lpNumberOfBytesWritten=0x18de10*=0x158, lpOverlapped=0x0) returned 1 [0096.738] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x19f [0096.738] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0096.738] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0096.738] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0096.738] SetFilePointer (in: hFile=0x158, lDistanceToMove=12, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2a [0096.738] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x1a9 [0096.738] CloseHandle (hObject=0x11c) returned 1 [0096.738] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1a9 [0096.738] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1a9 [0096.738] SetFilePointer (in: hFile=0x158, lDistanceToMove=425, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1a9 [0096.738] SetFilePointer (in: hFile=0x158, lDistanceToMove=425, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x1a9 [0096.738] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1a9 [0096.739] SetFilePointer (in: hFile=0x158, lDistanceToMove=425, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x1a9 [0096.739] SetEndOfFile (hFile=0x158) returned 1 [0096.739] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1a9 [0096.739] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1a9 [0096.739] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01242_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.739] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01242_.GIF", cchWideChar=12, lpMultiByteStr=0x3b9494c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01242_.GIF", lpUsedDefaultChar=0x0) returned 12 [0096.739] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01242_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.739] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01242_.GIF", cchWideChar=12, lpMultiByteStr=0x3b9498c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01242_.GIF", lpUsedDefaultChar=0x0) returned 12 [0096.739] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3b9498c, cbMultiByte=12, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="WB01242_.GIFꞗ@涤(\x18믉`믑`") returned 12 [0096.739] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01242_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.739] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01242_.GIF", cchWideChar=12, lpMultiByteStr=0x3b9494c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01242_.GIF", lpUsedDefaultChar=0x0) returned 12 [0096.739] WriteFile (in: hFile=0x158, lpBuffer=0x3ad5738*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5738*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0096.739] CharToOemA (in: pSrc="WB01242_.GIF", pDst=0x3b9498c | out: pDst="WB01242_.GIF") returned 1 [0096.739] WriteFile (in: hFile=0x158, lpBuffer=0x3b9498c*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3b9498c*, lpNumberOfBytesWritten=0x18efcc*=0xc, lpOverlapped=0x0) returned 1 [0096.739] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b470*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x3b5b470*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0096.740] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0096.740] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0096.740] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1ee [0096.740] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1ee [0096.740] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0096.740] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0096.740] DeleteFileW (lpFileName="") returned 0 [0096.740] GetLastError () returned 0x3 [0096.740] GetFileAttributesW (lpFileName="") returned 0xffffffff [0096.740] SetLastError (dwErrCode=0x3) [0096.740] FlushFileBuffers (hFile=0x158) returned 1 [0096.742] GetCurrentThreadId () returned 0x970 [0096.742] GetCurrentThreadId () returned 0x970 [0096.742] GetCurrentThreadId () returned 0x970 [0096.742] GetCurrentThreadId () returned 0x970 [0096.742] GetCurrentThreadId () returned 0x970 [0096.742] GetCurrentThreadId () returned 0x970 [0096.742] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x2a5 [0096.742] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x2a5 [0096.743] SetFilePointer (in: hFile=0x158, lDistanceToMove=677, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x2a5 [0096.743] CloseHandle (hObject=0x158) returned 1 [0096.743] GetCurrentThreadId () returned 0x970 [0096.743] GetCurrentThreadId () returned 0x970 [0096.743] GetCurrentThreadId () returned 0x970 [0096.743] GetCurrentThreadId () returned 0x970 [0096.743] GetCurrentThreadId () returned 0x970 [0096.743] GetCurrentThreadId () returned 0x970 [0096.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [WB01242_.GIF].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [wb01242_.gif].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0096.743] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2a5 [0096.743] SetFilePointer (in: hFile=0x158, lDistanceToMove=549, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x225 [0096.743] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0096.743] GetFileType (hFile=0x158) returned 0x1 [0096.743] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2c, wMilliseconds=0xd)) [0096.743] GetCurrentThreadId () returned 0x970 [0096.743] GetCurrentThreadId () returned 0x970 [0096.743] GetCurrentThreadId () returned 0x970 [0096.743] GetCurrentThreadId () returned 0x970 [0096.743] GetCurrentThreadId () returned 0x970 [0096.743] GetCurrentThreadId () returned 0x970 [0096.743] GetCurrentThreadId () returned 0x970 [0096.743] GetCurrentThreadId () returned 0x970 [0096.743] GetCurrentThreadId () returned 0x970 [0096.743] GetCurrentThreadId () returned 0x970 [0096.743] GetCurrentThreadId () returned 0x970 [0096.744] GetCurrentThreadId () returned 0x970 [0096.744] GetCurrentThreadId () returned 0x970 [0096.744] GetCurrentThreadId () returned 0x970 [0096.744] GetCurrentThreadId () returned 0x970 [0096.744] GetCurrentThreadId () returned 0x970 [0096.744] GetCurrentThreadId () returned 0x970 [0096.744] GetCurrentThreadId () returned 0x970 [0096.744] GetCurrentThreadId () returned 0x970 [0096.744] GetCurrentThreadId () returned 0x970 [0096.744] GetCurrentThreadId () returned 0x970 [0096.744] GetCurrentThreadId () returned 0x970 [0096.744] GetCurrentThreadId () returned 0x970 [0096.744] GetCurrentThreadId () returned 0x970 [0096.744] GetCurrentThreadId () returned 0x970 [0096.744] GetCurrentThreadId () returned 0x970 [0096.744] GetCurrentThreadId () returned 0x970 [0096.744] GetCurrentThreadId () returned 0x970 [0096.744] GetCurrentThreadId () returned 0x970 [0096.744] GetCurrentThreadId () returned 0x970 [0096.744] GetCurrentThreadId () returned 0x970 [0096.744] GetCurrentThreadId () returned 0x970 [0096.744] GetCurrentThreadId () returned 0x970 [0096.744] GetCurrentThreadId () returned 0x970 [0096.744] GetCurrentThreadId () returned 0x970 [0096.744] GetCurrentThreadId () returned 0x970 [0096.744] GetCurrentThreadId () returned 0x970 [0096.744] GetCurrentThreadId () returned 0x970 [0096.744] GetCurrentThreadId () returned 0x970 [0096.744] GetCurrentThreadId () returned 0x970 [0096.744] GetCurrentThreadId () returned 0x970 [0096.744] GetCurrentThreadId () returned 0x970 [0096.744] GetCurrentThreadId () returned 0x970 [0096.744] GetCurrentThreadId () returned 0x970 [0096.744] GetCurrentThreadId () returned 0x970 [0096.744] GetCurrentThreadId () returned 0x970 [0096.744] GetCurrentThreadId () returned 0x970 [0096.744] GetCurrentThreadId () returned 0x970 [0096.744] GetCurrentThreadId () returned 0x970 [0096.744] GetCurrentThreadId () returned 0x970 [0096.744] GetCurrentThreadId () returned 0x970 [0096.744] GetCurrentThreadId () returned 0x970 [0096.744] GetCurrentThreadId () returned 0x970 [0096.744] GetCurrentThreadId () returned 0x970 [0096.745] GetCurrentThreadId () returned 0x970 [0096.745] GetCurrentThreadId () returned 0x970 [0096.745] GetCurrentThreadId () returned 0x970 [0096.745] GetCurrentThreadId () returned 0x970 [0096.745] GetCurrentThreadId () returned 0x970 [0096.745] GetCurrentThreadId () returned 0x970 [0096.745] GetCurrentThreadId () returned 0x970 [0096.745] GetCurrentThreadId () returned 0x970 [0096.745] GetCurrentThreadId () returned 0x970 [0096.745] GetCurrentThreadId () returned 0x970 [0096.745] GetCurrentThreadId () returned 0x970 [0096.745] GetCurrentThreadId () returned 0x970 [0096.745] GetCurrentThreadId () returned 0x970 [0096.745] GetCurrentThreadId () returned 0x970 [0096.745] GetCurrentThreadId () returned 0x970 [0096.745] GetCurrentThreadId () returned 0x970 [0096.745] GetCurrentThreadId () returned 0x970 [0096.745] GetCurrentThreadId () returned 0x970 [0096.745] GetCurrentThreadId () returned 0x970 [0096.745] GetCurrentThreadId () returned 0x970 [0096.745] GetCurrentThreadId () returned 0x970 [0096.745] GetCurrentThreadId () returned 0x970 [0096.745] GetCurrentThreadId () returned 0x970 [0096.745] GetCurrentThreadId () returned 0x970 [0096.745] GetCurrentThreadId () returned 0x970 [0096.745] GetCurrentThreadId () returned 0x970 [0096.745] GetCurrentThreadId () returned 0x970 [0096.745] GetCurrentThreadId () returned 0x970 [0096.745] GetCurrentThreadId () returned 0x970 [0096.745] GetCurrentThreadId () returned 0x970 [0096.745] GetCurrentThreadId () returned 0x970 [0096.745] GetCurrentThreadId () returned 0x970 [0096.745] GetCurrentThreadId () returned 0x970 [0096.745] GetCurrentThreadId () returned 0x970 [0096.745] GetCurrentThreadId () returned 0x970 [0096.745] GetCurrentThreadId () returned 0x970 [0096.745] GetCurrentThreadId () returned 0x970 [0096.745] GetCurrentThreadId () returned 0x970 [0096.745] GetCurrentThreadId () returned 0x970 [0096.745] GetCurrentThreadId () returned 0x970 [0096.745] GetCurrentThreadId () returned 0x970 [0096.745] GetCurrentThreadId () returned 0x970 [0096.745] GetCurrentThreadId () returned 0x970 [0096.745] GetCurrentThreadId () returned 0x970 [0096.746] GetCurrentThreadId () returned 0x970 [0096.746] GetCurrentThreadId () returned 0x970 [0096.746] GetCurrentThreadId () returned 0x970 [0096.746] GetCurrentThreadId () returned 0x970 [0096.746] GetCurrentThreadId () returned 0x970 [0096.746] GetCurrentThreadId () returned 0x970 [0096.746] GetCurrentThreadId () returned 0x970 [0096.746] GetCurrentThreadId () returned 0x970 [0096.746] GetCurrentThreadId () returned 0x970 [0096.746] GetCurrentThreadId () returned 0x970 [0096.746] GetCurrentThreadId () returned 0x970 [0096.746] GetCurrentThreadId () returned 0x970 [0096.746] GetCurrentThreadId () returned 0x970 [0096.746] GetCurrentThreadId () returned 0x970 [0096.746] GetCurrentThreadId () returned 0x970 [0096.746] GetCurrentThreadId () returned 0x970 [0096.746] GetCurrentThreadId () returned 0x970 [0096.746] GetCurrentThreadId () returned 0x970 [0096.746] GetCurrentThreadId () returned 0x970 [0096.746] GetCurrentThreadId () returned 0x970 [0096.746] GetCurrentThreadId () returned 0x970 [0096.746] GetCurrentThreadId () returned 0x970 [0096.746] GetCurrentThreadId () returned 0x970 [0096.746] GetCurrentThreadId () returned 0x970 [0096.746] GetCurrentThreadId () returned 0x970 [0096.746] GetCurrentThreadId () returned 0x970 [0096.746] GetCurrentThreadId () returned 0x970 [0096.746] GetCurrentThreadId () returned 0x970 [0096.746] GetCurrentThreadId () returned 0x970 [0096.746] GetCurrentThreadId () returned 0x970 [0096.746] GetCurrentThreadId () returned 0x970 [0096.746] GetCurrentThreadId () returned 0x970 [0096.746] GetCurrentThreadId () returned 0x970 [0096.746] GetCurrentThreadId () returned 0x970 [0096.746] GetCurrentThreadId () returned 0x970 [0096.746] GetCurrentThreadId () returned 0x970 [0096.746] GetCurrentThreadId () returned 0x970 [0096.746] GetCurrentThreadId () returned 0x970 [0096.746] GetCurrentThreadId () returned 0x970 [0096.746] GetCurrentThreadId () returned 0x970 [0096.746] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.746] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.746] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b62070, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0096.747] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.747] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.747] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b62070, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0096.747] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.747] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.747] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b530, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0096.747] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.747] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.747] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b530, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0096.747] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.747] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.747] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b620d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0096.747] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.747] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.747] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b620d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0096.747] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.747] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.747] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b620d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0096.747] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2c, wMilliseconds=0xd)) [0096.747] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RR%VYt+*ME!4d5~)w%Z3Ag53?*Tmn3Om", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0096.747] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RR%VYt+*ME!4d5~)w%Z3Ag53?*Tmn3Om", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0096.747] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RR%VYt+*ME!4d5~)w%Z3Ag53?*Tmn3Om", cchWideChar=32, lpMultiByteStr=0x3b57e48, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RR%VYt+*ME!4d5~)w%Z3Ag53?*Tmn3Om", lpUsedDefaultChar=0x0) returned 32 [0096.747] GetCurrentThreadId () returned 0x970 [0096.747] GetCurrentThreadId () returned 0x970 [0096.747] GetCurrentThreadId () returned 0x970 [0096.747] GetCurrentThreadId () returned 0x970 [0096.747] GetCurrentThreadId () returned 0x970 [0096.747] GetCurrentThreadId () returned 0x970 [0096.755] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0096.755] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0096.755] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3b15e98, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0096.755] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0096.755] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAADrMvYZ9ox+V5b2ufb/zf8AI/i3kZMKyi/eKXa8rUXrYe64Uc29qOyq1Sg1Ea/f5uN4PAVT9pS/9UGQXV+PtFiBVGUL5ATntSPlLtuDMBy6e5OgPsoj4hIBo5CuaZwhUwozLMwnpHmN5JiMGTKbalbGF+zMm/6/guz4C8keJsXfDQ3Jq+aufX6ck2kCQJH4GIUDjc1+jI5mAT8/Z3gM/0pPplHmco6+Sww==") returned 232 [0096.755] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2c, wMilliseconds=0x1c)) [0096.755] GetCurrentThreadId () returned 0x970 [0096.755] GetCurrentThreadId () returned 0x970 [0096.756] GetCurrentThreadId () returned 0x970 [0096.756] GetCurrentThreadId () returned 0x970 [0096.756] GetCurrentThreadId () returned 0x970 [0096.756] GetCurrentThreadId () returned 0x970 [0096.756] GetCurrentThreadId () returned 0x970 [0096.756] GetCurrentThreadId () returned 0x970 [0096.756] GetCurrentThreadId () returned 0x970 [0096.756] GetCurrentThreadId () returned 0x970 [0096.756] GetCurrentThreadId () returned 0x970 [0096.756] GetCurrentThreadId () returned 0x970 [0096.756] GetCurrentThreadId () returned 0x970 [0096.756] GetCurrentThreadId () returned 0x970 [0096.756] GetCurrentThreadId () returned 0x970 [0096.756] GetCurrentThreadId () returned 0x970 [0096.756] GetCurrentThreadId () returned 0x970 [0096.756] GetCurrentThreadId () returned 0x970 [0096.756] GetCurrentThreadId () returned 0x970 [0096.756] GetCurrentThreadId () returned 0x970 [0096.756] GetCurrentThreadId () returned 0x970 [0096.756] GetCurrentThreadId () returned 0x970 [0096.756] GetCurrentThreadId () returned 0x970 [0096.756] GetCurrentThreadId () returned 0x970 [0096.756] GetCurrentThreadId () returned 0x970 [0096.756] GetCurrentThreadId () returned 0x970 [0096.756] GetCurrentThreadId () returned 0x970 [0096.756] GetCurrentThreadId () returned 0x970 [0096.756] GetCurrentThreadId () returned 0x970 [0096.756] GetCurrentThreadId () returned 0x970 [0096.756] GetCurrentThreadId () returned 0x970 [0096.756] GetCurrentThreadId () returned 0x970 [0096.756] GetCurrentThreadId () returned 0x970 [0096.756] GetCurrentThreadId () returned 0x970 [0096.756] GetCurrentThreadId () returned 0x970 [0096.756] GetCurrentThreadId () returned 0x970 [0096.756] GetCurrentThreadId () returned 0x970 [0096.756] GetCurrentThreadId () returned 0x970 [0096.756] GetCurrentThreadId () returned 0x970 [0096.756] GetCurrentThreadId () returned 0x970 [0096.756] GetCurrentThreadId () returned 0x970 [0096.756] GetCurrentThreadId () returned 0x970 [0096.756] GetCurrentThreadId () returned 0x970 [0096.756] GetCurrentThreadId () returned 0x970 [0096.757] GetCurrentThreadId () returned 0x970 [0096.757] GetCurrentThreadId () returned 0x970 [0096.757] GetCurrentThreadId () returned 0x970 [0096.757] GetCurrentThreadId () returned 0x970 [0096.757] GetCurrentThreadId () returned 0x970 [0096.757] GetCurrentThreadId () returned 0x970 [0096.757] GetCurrentThreadId () returned 0x970 [0096.757] GetCurrentThreadId () returned 0x970 [0096.757] GetCurrentThreadId () returned 0x970 [0096.757] GetCurrentThreadId () returned 0x970 [0096.757] GetCurrentThreadId () returned 0x970 [0096.757] GetCurrentThreadId () returned 0x970 [0096.757] GetCurrentThreadId () returned 0x970 [0096.757] GetCurrentThreadId () returned 0x970 [0096.757] GetCurrentThreadId () returned 0x970 [0096.757] GetCurrentThreadId () returned 0x970 [0096.757] GetCurrentThreadId () returned 0x970 [0096.757] GetCurrentThreadId () returned 0x970 [0096.757] GetCurrentThreadId () returned 0x970 [0096.757] GetCurrentThreadId () returned 0x970 [0096.757] GetCurrentThreadId () returned 0x970 [0096.757] GetCurrentThreadId () returned 0x970 [0096.757] GetCurrentThreadId () returned 0x970 [0096.757] GetCurrentThreadId () returned 0x970 [0096.757] GetCurrentThreadId () returned 0x970 [0096.757] GetCurrentThreadId () returned 0x970 [0096.757] GetCurrentThreadId () returned 0x970 [0096.757] GetCurrentThreadId () returned 0x970 [0096.757] GetCurrentThreadId () returned 0x970 [0096.757] GetCurrentThreadId () returned 0x970 [0096.757] GetCurrentThreadId () returned 0x970 [0096.757] GetCurrentThreadId () returned 0x970 [0096.757] GetCurrentThreadId () returned 0x970 [0096.757] GetCurrentThreadId () returned 0x970 [0096.757] GetCurrentThreadId () returned 0x970 [0096.757] GetCurrentThreadId () returned 0x970 [0096.757] GetCurrentThreadId () returned 0x970 [0096.757] GetCurrentThreadId () returned 0x970 [0096.757] GetCurrentThreadId () returned 0x970 [0096.757] GetCurrentThreadId () returned 0x970 [0096.757] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAADrMvYZ9ox+V5b2ufb/zf8AI/i3kZMKyi/eKXa8rUXrYe64Uc29qOyq1Sg1Ea/f5uN4PAVT9pS/9UGQXV+PtFiBVGUL5ATntSPlLtuDMBy6e5OgPsoj4hIBo5CuaZwhUwozLMwnpHmN5JiMGTKbalbGF+zMm/6/guz4C8keJsXfDQ3Jq+aufX6ck2kCQJH4GIUDjc1+jI5mAT8/Z3gM/0pPplHmco6+Sww==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0096.757] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAADrMvYZ9ox+V5b2ufb/zf8AI/i3kZMKyi/eKXa8rUXrYe64Uc29qOyq1Sg1Ea/f5uN4PAVT9pS/9UGQXV+PtFiBVGUL5ATntSPlLtuDMBy6e5OgPsoj4hIBo5CuaZwhUwozLMwnpHmN5JiMGTKbalbGF+zMm/6/guz4C8keJsXfDQ3Jq+aufX6ck2kCQJH4GIUDjc1+jI5mAT8/Z3gM/0pPplHmco6+Sww==", cchWideChar=245, lpMultiByteStr=0x3b4d08c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAADrMvYZ9ox+V5b2ufb/zf8AI/i3kZMKyi/eKXa8rUXrYe64Uc29qOyq1Sg1Ea/f5uN4PAVT9pS/9UGQXV+PtFiBVGUL5ATntSPlLtuDMBy6e5OgPsoj4hIBo5CuaZwhUwozLMwnpHmN5JiMGTKbalbGF+zMm/6/guz4C8keJsXfDQ3Jq+aufX6ck2kCQJH4GIUDjc1+jI5mAT8/Z3gM/0pPplHmco6+Sww==", lpUsedDefaultChar=0x0) returned 245 [0096.758] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0096.758] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0096.758] CloseHandle (hObject=0x158) returned 1 [0096.758] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01242_.gif")) returned 1 [0096.759] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=21702239388) returned 1 [0096.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [WB01243_.GIF].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [wb01243_.gif].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0096.760] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0096.760] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0096.760] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0096.760] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0096.760] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0096.760] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0096.760] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0096.760] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0096.760] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0096.760] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0096.760] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0096.760] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0096.760] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0096.760] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0096.761] SetEndOfFile (hFile=0x158) returned 1 [0096.761] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0096.761] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0096.761] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0096.761] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0096.761] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0096.762] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0096.762] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="uhzz\"hg8VN8-@j>UUUUUUU(}TZ6jaKK$tj{#sdO+A=!9aQ<", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0096.963] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="~mZ~D%>(}TZ6jaKK$tj{#sdO+A=!9aQ<", cchWideChar=32, lpMultiByteStr=0x203e1ac, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="~mZ~D%>(}TZ6jaKK$tj{#sdO+A=!9aQ<", lpUsedDefaultChar=0x0) returned 32 [0096.963] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0096.963] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0096.963] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d7f5e00, ftCreationTime.dwHighDateTime=0x1bd4e68, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d7f5e00, ftLastWriteTime.dwHighDateTime=0x1bd4e68, nFileSizeHigh=0x0, nFileSizeLow=0xff7, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01253_.GIF", cAlternateFileName="")) returned 0x295098 [0096.963] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0096.963] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0096.963] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01253_.gif")) returned 0x20 [0096.964] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01253_.gif")) returned 0x20 [0096.964] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01253_.gif")) returned 0x20 [0096.964] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01253_.gif")) returned 0x20 [0096.964] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01253_.gif"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d7f5e00, ftCreationTime.dwHighDateTime=0x1bd4e68, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d7f5e00, ftLastWriteTime.dwHighDateTime=0x1bd4e68, nFileSizeHigh=0x0, nFileSizeLow=0xff7)) returned 1 [0096.964] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0096.964] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0096.964] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01253_.gif")) returned 0x20 [0096.964] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01253_.gif")) returned 0x20 [0096.964] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0096.964] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0096.964] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0096.964] SetEndOfFile (hFile=0x158) returned 1 [0096.965] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01253_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.965] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01253_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94d2c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01253_.GIF", lpUsedDefaultChar=0x0) returned 12 [0096.965] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01253_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.965] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01253_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94c6c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01253_.GIF", lpUsedDefaultChar=0x0) returned 12 [0096.965] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3b94c6c, cbMultiByte=12, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="WB01253_.GIFg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0096.965] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01253_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.965] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01253_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94d2c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01253_.GIF", lpUsedDefaultChar=0x0) returned 12 [0096.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01253_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0096.966] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0096.966] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0xff7 [0096.966] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0096.966] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0096.966] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0096.966] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01253_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.966] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01253_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94d2c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01253_.GIF", lpUsedDefaultChar=0x0) returned 12 [0096.966] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01253_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.966] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01253_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94c6c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01253_.GIF", lpUsedDefaultChar=0x0) returned 12 [0096.966] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3b94c6c, cbMultiByte=12, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="WB01253_.GIF3_.GIFg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0096.967] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01253_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.967] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01253_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94d2c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01253_.GIF", lpUsedDefaultChar=0x0) returned 12 [0096.967] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0096.968] CharToOemA (in: pSrc="WB01253_.GIF", pDst=0x3b94c6c | out: pDst="WB01253_.GIF") returned 1 [0096.968] WriteFile (in: hFile=0x158, lpBuffer=0x3b94c6c*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x3b94c6c*, lpNumberOfBytesWritten=0x18e048*=0xc, lpOverlapped=0x0) returned 1 [0096.968] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0096.968] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0096.968] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0096.968] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=21723144303) returned 1 [0096.968] ReadFile (in: hFile=0x11c, lpBuffer=0x3af1c60, nNumberOfBytesToRead=0xff7, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3af1c60*, lpNumberOfBytesRead=0x18dd7c*=0xff7, lpOverlapped=0x0) returned 1 [0096.969] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0096.969] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=21723293119) returned 1 [0096.978] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b438*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b5b438*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0096.978] ReadFile (in: hFile=0x11c, lpBuffer=0x3af1c60, nNumberOfBytesToRead=0xff7, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3af1c60*, lpNumberOfBytesRead=0x18de38*=0xff7, lpOverlapped=0x0) returned 1 [0096.979] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x47 [0096.979] WriteFile (in: hFile=0x158, lpBuffer=0x3b043f0*, nNumberOfBytesToWrite=0xff7, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3b043f0*, lpNumberOfBytesWritten=0x18de10*=0xff7, lpOverlapped=0x0) returned 1 [0096.979] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x103e [0096.979] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0096.979] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0096.979] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0096.979] SetFilePointer (in: hFile=0x158, lDistanceToMove=12, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2a [0096.979] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x1048 [0096.979] CloseHandle (hObject=0x11c) returned 1 [0096.979] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1048 [0096.980] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1048 [0096.980] SetFilePointer (in: hFile=0x158, lDistanceToMove=4168, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1048 [0096.980] SetFilePointer (in: hFile=0x158, lDistanceToMove=4168, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x1048 [0096.980] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1048 [0096.980] SetFilePointer (in: hFile=0x158, lDistanceToMove=4168, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x1048 [0096.980] SetEndOfFile (hFile=0x158) returned 1 [0096.980] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1048 [0096.980] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1048 [0096.980] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01253_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.980] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01253_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94d2c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01253_.GIF", lpUsedDefaultChar=0x0) returned 12 [0096.980] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01253_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.980] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01253_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94dec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01253_.GIF", lpUsedDefaultChar=0x0) returned 12 [0096.980] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3b94dec, cbMultiByte=12, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="WB01253_.GIFꞗ@涤(\x18믉`믑`") returned 12 [0096.980] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01253_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0096.980] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01253_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94d2c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01253_.GIF", lpUsedDefaultChar=0x0) returned 12 [0096.980] WriteFile (in: hFile=0x158, lpBuffer=0x3ad5738*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5738*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0096.981] CharToOemA (in: pSrc="WB01253_.GIF", pDst=0x3b94dec | out: pDst="WB01253_.GIF") returned 1 [0096.981] WriteFile (in: hFile=0x158, lpBuffer=0x3b94dec*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3b94dec*, lpNumberOfBytesWritten=0x18efcc*=0xc, lpOverlapped=0x0) returned 1 [0096.981] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b3b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x3b5b3b0*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0096.981] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0096.981] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0096.981] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x108d [0096.981] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x108d [0096.981] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0096.981] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0096.981] DeleteFileW (lpFileName="") returned 0 [0096.981] GetLastError () returned 0x3 [0096.981] GetFileAttributesW (lpFileName="") returned 0xffffffff [0096.981] SetLastError (dwErrCode=0x3) [0096.981] FlushFileBuffers (hFile=0x158) returned 1 [0096.985] GetCurrentThreadId () returned 0x970 [0096.985] GetCurrentThreadId () returned 0x970 [0096.985] GetCurrentThreadId () returned 0x970 [0096.985] GetCurrentThreadId () returned 0x970 [0096.985] GetCurrentThreadId () returned 0x970 [0096.985] GetCurrentThreadId () returned 0x970 [0096.985] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x1144 [0096.985] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x1144 [0096.985] SetFilePointer (in: hFile=0x158, lDistanceToMove=4420, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x1144 [0096.985] CloseHandle (hObject=0x158) returned 1 [0096.986] GetCurrentThreadId () returned 0x970 [0096.986] GetCurrentThreadId () returned 0x970 [0096.986] GetCurrentThreadId () returned 0x970 [0096.986] GetCurrentThreadId () returned 0x970 [0096.986] GetCurrentThreadId () returned 0x970 [0096.986] GetCurrentThreadId () returned 0x970 [0096.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [WB01253_.GIF].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [wb01253_.gif].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0096.986] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1144 [0096.986] SetFilePointer (in: hFile=0x158, lDistanceToMove=4292, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x10c4 [0096.986] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0096.986] GetFileType (hFile=0x158) returned 0x1 [0096.986] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2c, wMilliseconds=0x106)) [0096.986] GetCurrentThreadId () returned 0x970 [0096.986] GetCurrentThreadId () returned 0x970 [0096.986] GetCurrentThreadId () returned 0x970 [0096.986] GetCurrentThreadId () returned 0x970 [0096.986] GetCurrentThreadId () returned 0x970 [0096.986] GetCurrentThreadId () returned 0x970 [0096.986] GetCurrentThreadId () returned 0x970 [0096.986] GetCurrentThreadId () returned 0x970 [0096.986] GetCurrentThreadId () returned 0x970 [0096.986] GetCurrentThreadId () returned 0x970 [0096.986] GetCurrentThreadId () returned 0x970 [0096.986] GetCurrentThreadId () returned 0x970 [0096.986] GetCurrentThreadId () returned 0x970 [0096.986] GetCurrentThreadId () returned 0x970 [0096.986] GetCurrentThreadId () returned 0x970 [0096.986] GetCurrentThreadId () returned 0x970 [0096.986] GetCurrentThreadId () returned 0x970 [0096.986] GetCurrentThreadId () returned 0x970 [0096.987] GetCurrentThreadId () returned 0x970 [0096.987] GetCurrentThreadId () returned 0x970 [0096.987] GetCurrentThreadId () returned 0x970 [0096.987] GetCurrentThreadId () returned 0x970 [0096.987] GetCurrentThreadId () returned 0x970 [0096.987] GetCurrentThreadId () returned 0x970 [0096.987] GetCurrentThreadId () returned 0x970 [0096.987] GetCurrentThreadId () returned 0x970 [0096.987] GetCurrentThreadId () returned 0x970 [0096.987] GetCurrentThreadId () returned 0x970 [0096.987] GetCurrentThreadId () returned 0x970 [0096.987] GetCurrentThreadId () returned 0x970 [0096.987] GetCurrentThreadId () returned 0x970 [0096.987] GetCurrentThreadId () returned 0x970 [0096.987] GetCurrentThreadId () returned 0x970 [0096.987] GetCurrentThreadId () returned 0x970 [0096.987] GetCurrentThreadId () returned 0x970 [0096.987] GetCurrentThreadId () returned 0x970 [0096.987] GetCurrentThreadId () returned 0x970 [0096.987] GetCurrentThreadId () returned 0x970 [0096.987] GetCurrentThreadId () returned 0x970 [0096.987] GetCurrentThreadId () returned 0x970 [0096.987] GetCurrentThreadId () returned 0x970 [0096.987] GetCurrentThreadId () returned 0x970 [0096.987] GetCurrentThreadId () returned 0x970 [0096.987] GetCurrentThreadId () returned 0x970 [0096.987] GetCurrentThreadId () returned 0x970 [0096.987] GetCurrentThreadId () returned 0x970 [0096.987] GetCurrentThreadId () returned 0x970 [0096.987] GetCurrentThreadId () returned 0x970 [0096.987] GetCurrentThreadId () returned 0x970 [0096.987] GetCurrentThreadId () returned 0x970 [0096.987] GetCurrentThreadId () returned 0x970 [0096.987] GetCurrentThreadId () returned 0x970 [0096.987] GetCurrentThreadId () returned 0x970 [0096.987] GetCurrentThreadId () returned 0x970 [0096.987] GetCurrentThreadId () returned 0x970 [0096.987] GetCurrentThreadId () returned 0x970 [0096.987] GetCurrentThreadId () returned 0x970 [0096.987] GetCurrentThreadId () returned 0x970 [0096.987] GetCurrentThreadId () returned 0x970 [0096.987] GetCurrentThreadId () returned 0x970 [0096.987] GetCurrentThreadId () returned 0x970 [0096.988] GetCurrentThreadId () returned 0x970 [0096.988] GetCurrentThreadId () returned 0x970 [0096.988] GetCurrentThreadId () returned 0x970 [0096.988] GetCurrentThreadId () returned 0x970 [0096.988] GetCurrentThreadId () returned 0x970 [0096.988] GetCurrentThreadId () returned 0x970 [0096.988] GetCurrentThreadId () returned 0x970 [0096.988] GetCurrentThreadId () returned 0x970 [0096.988] GetCurrentThreadId () returned 0x970 [0096.988] GetCurrentThreadId () returned 0x970 [0096.988] GetCurrentThreadId () returned 0x970 [0096.988] GetCurrentThreadId () returned 0x970 [0096.988] GetCurrentThreadId () returned 0x970 [0096.988] GetCurrentThreadId () returned 0x970 [0096.988] GetCurrentThreadId () returned 0x970 [0096.988] GetCurrentThreadId () returned 0x970 [0096.988] GetCurrentThreadId () returned 0x970 [0096.988] GetCurrentThreadId () returned 0x970 [0096.988] GetCurrentThreadId () returned 0x970 [0096.988] GetCurrentThreadId () returned 0x970 [0096.988] GetCurrentThreadId () returned 0x970 [0096.988] GetCurrentThreadId () returned 0x970 [0096.988] GetCurrentThreadId () returned 0x970 [0096.988] GetCurrentThreadId () returned 0x970 [0096.988] GetCurrentThreadId () returned 0x970 [0096.988] GetCurrentThreadId () returned 0x970 [0096.988] GetCurrentThreadId () returned 0x970 [0096.988] GetCurrentThreadId () returned 0x970 [0096.988] GetCurrentThreadId () returned 0x970 [0096.988] GetCurrentThreadId () returned 0x970 [0096.988] GetCurrentThreadId () returned 0x970 [0096.988] GetCurrentThreadId () returned 0x970 [0096.988] GetCurrentThreadId () returned 0x970 [0096.988] GetCurrentThreadId () returned 0x970 [0096.988] GetCurrentThreadId () returned 0x970 [0096.988] GetCurrentThreadId () returned 0x970 [0096.988] GetCurrentThreadId () returned 0x970 [0096.988] GetCurrentThreadId () returned 0x970 [0096.988] GetCurrentThreadId () returned 0x970 [0096.989] GetCurrentThreadId () returned 0x970 [0096.989] GetCurrentThreadId () returned 0x970 [0096.989] GetCurrentThreadId () returned 0x970 [0096.989] GetCurrentThreadId () returned 0x970 [0096.989] GetCurrentThreadId () returned 0x970 [0096.989] GetCurrentThreadId () returned 0x970 [0096.989] GetCurrentThreadId () returned 0x970 [0096.989] GetCurrentThreadId () returned 0x970 [0096.989] GetCurrentThreadId () returned 0x970 [0096.989] GetCurrentThreadId () returned 0x970 [0096.989] GetCurrentThreadId () returned 0x970 [0096.989] GetCurrentThreadId () returned 0x970 [0096.989] GetCurrentThreadId () returned 0x970 [0096.989] GetCurrentThreadId () returned 0x970 [0096.989] GetCurrentThreadId () returned 0x970 [0096.989] GetCurrentThreadId () returned 0x970 [0096.989] GetCurrentThreadId () returned 0x970 [0096.989] GetCurrentThreadId () returned 0x970 [0096.989] GetCurrentThreadId () returned 0x970 [0096.989] GetCurrentThreadId () returned 0x970 [0096.989] GetCurrentThreadId () returned 0x970 [0096.989] GetCurrentThreadId () returned 0x970 [0096.989] GetCurrentThreadId () returned 0x970 [0096.989] GetCurrentThreadId () returned 0x970 [0096.989] GetCurrentThreadId () returned 0x970 [0096.989] GetCurrentThreadId () returned 0x970 [0096.989] GetCurrentThreadId () returned 0x970 [0096.989] GetCurrentThreadId () returned 0x970 [0096.989] GetCurrentThreadId () returned 0x970 [0096.989] GetCurrentThreadId () returned 0x970 [0096.989] GetCurrentThreadId () returned 0x970 [0096.989] GetCurrentThreadId () returned 0x970 [0096.989] GetCurrentThreadId () returned 0x970 [0096.989] GetCurrentThreadId () returned 0x970 [0096.989] GetCurrentThreadId () returned 0x970 [0096.989] GetCurrentThreadId () returned 0x970 [0096.989] GetCurrentThreadId () returned 0x970 [0096.989] GetCurrentThreadId () returned 0x970 [0096.989] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.989] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.989] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b62250, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0096.990] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.990] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.990] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b62250, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0096.990] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.990] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.990] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b548, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0096.990] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.990] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.990] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b548, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0096.990] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.990] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.990] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b622b0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0096.990] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.990] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.990] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b622b0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0096.990] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.990] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0096.990] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b622b0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0096.990] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2c, wMilliseconds=0x106)) [0096.990] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="~mZ~D%>(}TZ6jaKK$tj{#sdO+A=!9aQ<", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0096.990] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="~mZ~D%>(}TZ6jaKK$tj{#sdO+A=!9aQ<", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0096.990] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="~mZ~D%>(}TZ6jaKK$tj{#sdO+A=!9aQ<", cchWideChar=32, lpMultiByteStr=0x3b57f38, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="~mZ~D%>(}TZ6jaKK$tj{#sdO+A=!9aQ<", lpUsedDefaultChar=0x0) returned 32 [0096.991] GetCurrentThreadId () returned 0x970 [0096.991] GetCurrentThreadId () returned 0x970 [0096.991] GetCurrentThreadId () returned 0x970 [0096.991] GetCurrentThreadId () returned 0x970 [0096.991] GetCurrentThreadId () returned 0x970 [0096.991] GetCurrentThreadId () returned 0x970 [0096.998] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0096.998] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0096.998] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3b16348, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0096.998] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0096.998] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAHnuTkWzCRgfVzKo0YiOMW0ebNi6ItnGD+aJjiW9PxZ5fBrrzYhLUFxGTl8fTDADBnj/D3+eaw/jwk57UnEZ+myMH9q3D3PoG0aAURRJilyzmWgWAtsSvVm3DFWm8/7QjaH4AKxK5TpgMmMHgqMH0fC560sUM2kEhDhHY8GtsAzo1PhMiaU/EEtQaA55OVr9kH8oTU4GNY7E7D3f5YKB0Wd5CfOBYfT+Kw==") returned 232 [0096.998] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2c, wMilliseconds=0x106)) [0096.998] GetCurrentThreadId () returned 0x970 [0096.998] GetCurrentThreadId () returned 0x970 [0096.998] GetCurrentThreadId () returned 0x970 [0096.999] GetCurrentThreadId () returned 0x970 [0096.999] GetCurrentThreadId () returned 0x970 [0096.999] GetCurrentThreadId () returned 0x970 [0096.999] GetCurrentThreadId () returned 0x970 [0096.999] GetCurrentThreadId () returned 0x970 [0096.999] GetCurrentThreadId () returned 0x970 [0096.999] GetCurrentThreadId () returned 0x970 [0096.999] GetCurrentThreadId () returned 0x970 [0096.999] GetCurrentThreadId () returned 0x970 [0096.999] GetCurrentThreadId () returned 0x970 [0096.999] GetCurrentThreadId () returned 0x970 [0096.999] GetCurrentThreadId () returned 0x970 [0096.999] GetCurrentThreadId () returned 0x970 [0096.999] GetCurrentThreadId () returned 0x970 [0096.999] GetCurrentThreadId () returned 0x970 [0096.999] GetCurrentThreadId () returned 0x970 [0096.999] GetCurrentThreadId () returned 0x970 [0096.999] GetCurrentThreadId () returned 0x970 [0096.999] GetCurrentThreadId () returned 0x970 [0096.999] GetCurrentThreadId () returned 0x970 [0096.999] GetCurrentThreadId () returned 0x970 [0096.999] GetCurrentThreadId () returned 0x970 [0096.999] GetCurrentThreadId () returned 0x970 [0096.999] GetCurrentThreadId () returned 0x970 [0096.999] GetCurrentThreadId () returned 0x970 [0096.999] GetCurrentThreadId () returned 0x970 [0096.999] GetCurrentThreadId () returned 0x970 [0096.999] GetCurrentThreadId () returned 0x970 [0096.999] GetCurrentThreadId () returned 0x970 [0096.999] GetCurrentThreadId () returned 0x970 [0096.999] GetCurrentThreadId () returned 0x970 [0096.999] GetCurrentThreadId () returned 0x970 [0096.999] GetCurrentThreadId () returned 0x970 [0096.999] GetCurrentThreadId () returned 0x970 [0096.999] GetCurrentThreadId () returned 0x970 [0096.999] GetCurrentThreadId () returned 0x970 [0096.999] GetCurrentThreadId () returned 0x970 [0096.999] GetCurrentThreadId () returned 0x970 [0096.999] GetCurrentThreadId () returned 0x970 [0096.999] GetCurrentThreadId () returned 0x970 [0096.999] GetCurrentThreadId () returned 0x970 [0096.999] GetCurrentThreadId () returned 0x970 [0097.000] GetCurrentThreadId () returned 0x970 [0097.000] GetCurrentThreadId () returned 0x970 [0097.000] GetCurrentThreadId () returned 0x970 [0097.000] GetCurrentThreadId () returned 0x970 [0097.000] GetCurrentThreadId () returned 0x970 [0097.000] GetCurrentThreadId () returned 0x970 [0097.000] GetCurrentThreadId () returned 0x970 [0097.000] GetCurrentThreadId () returned 0x970 [0097.000] GetCurrentThreadId () returned 0x970 [0097.000] GetCurrentThreadId () returned 0x970 [0097.000] GetCurrentThreadId () returned 0x970 [0097.000] GetCurrentThreadId () returned 0x970 [0097.000] GetCurrentThreadId () returned 0x970 [0097.000] GetCurrentThreadId () returned 0x970 [0097.000] GetCurrentThreadId () returned 0x970 [0097.000] GetCurrentThreadId () returned 0x970 [0097.000] GetCurrentThreadId () returned 0x970 [0097.000] GetCurrentThreadId () returned 0x970 [0097.000] GetCurrentThreadId () returned 0x970 [0097.000] GetCurrentThreadId () returned 0x970 [0097.000] GetCurrentThreadId () returned 0x970 [0097.000] GetCurrentThreadId () returned 0x970 [0097.000] GetCurrentThreadId () returned 0x970 [0097.000] GetCurrentThreadId () returned 0x970 [0097.000] GetCurrentThreadId () returned 0x970 [0097.000] GetCurrentThreadId () returned 0x970 [0097.000] GetCurrentThreadId () returned 0x970 [0097.000] GetCurrentThreadId () returned 0x970 [0097.000] GetCurrentThreadId () returned 0x970 [0097.000] GetCurrentThreadId () returned 0x970 [0097.000] GetCurrentThreadId () returned 0x970 [0097.000] GetCurrentThreadId () returned 0x970 [0097.000] GetCurrentThreadId () returned 0x970 [0097.000] GetCurrentThreadId () returned 0x970 [0097.000] GetCurrentThreadId () returned 0x970 [0097.000] GetCurrentThreadId () returned 0x970 [0097.000] GetCurrentThreadId () returned 0x970 [0097.000] GetCurrentThreadId () returned 0x970 [0097.000] GetCurrentThreadId () returned 0x970 [0097.000] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAHnuTkWzCRgfVzKo0YiOMW0ebNi6ItnGD+aJjiW9PxZ5fBrrzYhLUFxGTl8fTDADBnj/D3+eaw/jwk57UnEZ+myMH9q3D3PoG0aAURRJilyzmWgWAtsSvVm3DFWm8/7QjaH4AKxK5TpgMmMHgqMH0fC560sUM2kEhDhHY8GtsAzo1PhMiaU/EEtQaA55OVr9kH8oTU4GNY7E7D3f5YKB0Wd5CfOBYfT+Kw==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0097.000] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAHnuTkWzCRgfVzKo0YiOMW0ebNi6ItnGD+aJjiW9PxZ5fBrrzYhLUFxGTl8fTDADBnj/D3+eaw/jwk57UnEZ+myMH9q3D3PoG0aAURRJilyzmWgWAtsSvVm3DFWm8/7QjaH4AKxK5TpgMmMHgqMH0fC560sUM2kEhDhHY8GtsAzo1PhMiaU/EEtQaA55OVr9kH8oTU4GNY7E7D3f5YKB0Wd5CfOBYfT+Kw==", cchWideChar=245, lpMultiByteStr=0x3b4d08c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAHnuTkWzCRgfVzKo0YiOMW0ebNi6ItnGD+aJjiW9PxZ5fBrrzYhLUFxGTl8fTDADBnj/D3+eaw/jwk57UnEZ+myMH9q3D3PoG0aAURRJilyzmWgWAtsSvVm3DFWm8/7QjaH4AKxK5TpgMmMHgqMH0fC560sUM2kEhDhHY8GtsAzo1PhMiaU/EEtQaA55OVr9kH8oTU4GNY7E7D3f5YKB0Wd5CfOBYfT+Kw==", lpUsedDefaultChar=0x0) returned 245 [0097.000] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0097.001] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0097.001] CloseHandle (hObject=0x158) returned 1 [0097.001] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01253_.gif")) returned 1 [0097.002] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=21726532926) returned 1 [0097.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [WB01268_.GIF].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [wb01268_.gif].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0097.003] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0097.003] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0097.003] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0097.003] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0097.003] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0097.003] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0097.003] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0097.003] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0097.003] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0097.003] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0097.003] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0097.003] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0097.003] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0097.003] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0097.003] SetEndOfFile (hFile=0x158) returned 1 [0097.004] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0097.004] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0097.004] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0097.004] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0097.004] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0097.005] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0097.005] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=")9EMH/cL@k:g{J*RSz#zw!RciCQoJTO$", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0097.005] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=")9EMH/cL@k:g{J*RSz#zw!RciCQoJTO$", cchWideChar=32, lpMultiByteStr=0x203e1e4, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=")9EMH/cL@k:g{J*RSz#zw!RciCQoJTO$", lpUsedDefaultChar=0x0) returned 32 [0097.005] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0097.005] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0097.005] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9550b600, ftCreationTime.dwHighDateTime=0x1bd4e65, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9550b600, ftLastWriteTime.dwHighDateTime=0x1bd4e65, nFileSizeHigh=0x0, nFileSizeLow=0x1ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01268_.GIF", cAlternateFileName="")) returned 0x295098 [0097.005] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0097.005] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0097.005] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01268_.gif")) returned 0x20 [0097.005] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01268_.gif")) returned 0x20 [0097.005] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01268_.gif")) returned 0x20 [0097.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01268_.gif")) returned 0x20 [0097.006] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01268_.gif"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9550b600, ftCreationTime.dwHighDateTime=0x1bd4e65, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9550b600, ftLastWriteTime.dwHighDateTime=0x1bd4e65, nFileSizeHigh=0x0, nFileSizeLow=0x1ab)) returned 1 [0097.006] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0097.006] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0097.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01268_.gif")) returned 0x20 [0097.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01268_.gif")) returned 0x20 [0097.006] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0097.006] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0097.006] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0097.006] SetEndOfFile (hFile=0x158) returned 1 [0097.007] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01268_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0097.007] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01268_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94a4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01268_.GIF", lpUsedDefaultChar=0x0) returned 12 [0097.007] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01268_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0097.007] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01268_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94b2c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01268_.GIF", lpUsedDefaultChar=0x0) returned 12 [0097.007] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3b94b2c, cbMultiByte=12, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="WB01268_.GIFg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0097.007] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01268_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0097.007] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01268_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94a4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01268_.GIF", lpUsedDefaultChar=0x0) returned 12 [0097.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01268_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0097.008] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0097.008] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x1ab [0097.008] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0097.008] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0097.008] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0097.008] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01268_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0097.008] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01268_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94a4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01268_.GIF", lpUsedDefaultChar=0x0) returned 12 [0097.008] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01268_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0097.008] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01268_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94b2c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01268_.GIF", lpUsedDefaultChar=0x0) returned 12 [0097.008] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3b94b2c, cbMultiByte=12, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="WB01268_.GIF8_.GIFg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0097.008] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01268_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0097.008] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01268_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94a4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01268_.GIF", lpUsedDefaultChar=0x0) returned 12 [0097.009] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0097.009] CharToOemA (in: pSrc="WB01268_.GIF", pDst=0x3b94b2c | out: pDst="WB01268_.GIF") returned 1 [0097.009] WriteFile (in: hFile=0x158, lpBuffer=0x3b94b2c*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x3b94b2c*, lpNumberOfBytesWritten=0x18e048*=0xc, lpOverlapped=0x0) returned 1 [0097.010] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0097.010] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0097.010] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0097.010] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=21727326462) returned 1 [0097.010] ReadFile (in: hFile=0x11c, lpBuffer=0x3af1c80, nNumberOfBytesToRead=0x1ab, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3af1c80*, lpNumberOfBytesRead=0x18dd7c*=0x1ab, lpOverlapped=0x0) returned 1 [0097.011] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0097.011] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=21727429068) returned 1 [0097.020] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b420*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b5b420*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0097.020] ReadFile (in: hFile=0x11c, lpBuffer=0x3af1c80, nNumberOfBytesToRead=0x1ab, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3af1c80*, lpNumberOfBytesRead=0x18de38*=0x1ab, lpOverlapped=0x0) returned 1 [0097.020] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x47 [0097.020] WriteFile (in: hFile=0x158, lpBuffer=0x3af1e40*, nNumberOfBytesToWrite=0x1ab, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3af1e40*, lpNumberOfBytesWritten=0x18de10*=0x1ab, lpOverlapped=0x0) returned 1 [0097.020] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x1f2 [0097.020] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0097.020] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0097.020] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0097.020] SetFilePointer (in: hFile=0x158, lDistanceToMove=12, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2a [0097.021] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x1fc [0097.021] CloseHandle (hObject=0x11c) returned 1 [0097.021] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1fc [0097.021] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1fc [0097.021] SetFilePointer (in: hFile=0x158, lDistanceToMove=508, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1fc [0097.021] SetFilePointer (in: hFile=0x158, lDistanceToMove=508, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x1fc [0097.021] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1fc [0097.021] SetFilePointer (in: hFile=0x158, lDistanceToMove=508, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x1fc [0097.021] SetEndOfFile (hFile=0x158) returned 1 [0097.021] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1fc [0097.021] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1fc [0097.021] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01268_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0097.021] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01268_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94a4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01268_.GIF", lpUsedDefaultChar=0x0) returned 12 [0097.021] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01268_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0097.021] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01268_.GIF", cchWideChar=12, lpMultiByteStr=0x3b9498c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01268_.GIF", lpUsedDefaultChar=0x0) returned 12 [0097.022] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3b9498c, cbMultiByte=12, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="WB01268_.GIFꞗ@涤(\x18믉`믑`") returned 12 [0097.022] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01268_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0097.022] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01268_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94a4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01268_.GIF", lpUsedDefaultChar=0x0) returned 12 [0097.022] WriteFile (in: hFile=0x158, lpBuffer=0x3ad5738*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5738*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0097.022] CharToOemA (in: pSrc="WB01268_.GIF", pDst=0x3b9498c | out: pDst="WB01268_.GIF") returned 1 [0097.022] WriteFile (in: hFile=0x158, lpBuffer=0x3b9498c*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3b9498c*, lpNumberOfBytesWritten=0x18efcc*=0xc, lpOverlapped=0x0) returned 1 [0097.022] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b470*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x3b5b470*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0097.022] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0097.022] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0097.022] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x241 [0097.022] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x241 [0097.022] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0097.022] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0097.023] DeleteFileW (lpFileName="") returned 0 [0097.023] GetLastError () returned 0x3 [0097.023] GetFileAttributesW (lpFileName="") returned 0xffffffff [0097.023] SetLastError (dwErrCode=0x3) [0097.023] FlushFileBuffers (hFile=0x158) returned 1 [0097.026] GetCurrentThreadId () returned 0x970 [0097.026] GetCurrentThreadId () returned 0x970 [0097.026] GetCurrentThreadId () returned 0x970 [0097.026] GetCurrentThreadId () returned 0x970 [0097.026] GetCurrentThreadId () returned 0x970 [0097.026] GetCurrentThreadId () returned 0x970 [0097.026] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x2f8 [0097.026] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x2f8 [0097.026] SetFilePointer (in: hFile=0x158, lDistanceToMove=760, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x2f8 [0097.026] CloseHandle (hObject=0x158) returned 1 [0097.026] GetCurrentThreadId () returned 0x970 [0097.026] GetCurrentThreadId () returned 0x970 [0097.026] GetCurrentThreadId () returned 0x970 [0097.026] GetCurrentThreadId () returned 0x970 [0097.026] GetCurrentThreadId () returned 0x970 [0097.026] GetCurrentThreadId () returned 0x970 [0097.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [WB01268_.GIF].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [wb01268_.gif].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0097.027] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2f8 [0097.027] SetFilePointer (in: hFile=0x158, lDistanceToMove=632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x278 [0097.027] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0097.027] GetFileType (hFile=0x158) returned 0x1 [0097.027] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2c, wMilliseconds=0x126)) [0097.027] GetCurrentThreadId () returned 0x970 [0097.027] GetCurrentThreadId () returned 0x970 [0097.027] GetCurrentThreadId () returned 0x970 [0097.027] GetCurrentThreadId () returned 0x970 [0097.027] GetCurrentThreadId () returned 0x970 [0097.027] GetCurrentThreadId () returned 0x970 [0097.027] GetCurrentThreadId () returned 0x970 [0097.027] GetCurrentThreadId () returned 0x970 [0097.027] GetCurrentThreadId () returned 0x970 [0097.027] GetCurrentThreadId () returned 0x970 [0097.027] GetCurrentThreadId () returned 0x970 [0097.027] GetCurrentThreadId () returned 0x970 [0097.027] GetCurrentThreadId () returned 0x970 [0097.027] GetCurrentThreadId () returned 0x970 [0097.027] GetCurrentThreadId () returned 0x970 [0097.027] GetCurrentThreadId () returned 0x970 [0097.027] GetCurrentThreadId () returned 0x970 [0097.027] GetCurrentThreadId () returned 0x970 [0097.027] GetCurrentThreadId () returned 0x970 [0097.027] GetCurrentThreadId () returned 0x970 [0097.027] GetCurrentThreadId () returned 0x970 [0097.027] GetCurrentThreadId () returned 0x970 [0097.027] GetCurrentThreadId () returned 0x970 [0097.027] GetCurrentThreadId () returned 0x970 [0097.027] GetCurrentThreadId () returned 0x970 [0097.027] GetCurrentThreadId () returned 0x970 [0097.027] GetCurrentThreadId () returned 0x970 [0097.027] GetCurrentThreadId () returned 0x970 [0097.027] GetCurrentThreadId () returned 0x970 [0097.027] GetCurrentThreadId () returned 0x970 [0097.028] GetCurrentThreadId () returned 0x970 [0097.028] GetCurrentThreadId () returned 0x970 [0097.028] GetCurrentThreadId () returned 0x970 [0097.028] GetCurrentThreadId () returned 0x970 [0097.028] GetCurrentThreadId () returned 0x970 [0097.028] GetCurrentThreadId () returned 0x970 [0097.028] GetCurrentThreadId () returned 0x970 [0097.028] GetCurrentThreadId () returned 0x970 [0097.028] GetCurrentThreadId () returned 0x970 [0097.028] GetCurrentThreadId () returned 0x970 [0097.028] GetCurrentThreadId () returned 0x970 [0097.028] GetCurrentThreadId () returned 0x970 [0097.028] GetCurrentThreadId () returned 0x970 [0097.028] GetCurrentThreadId () returned 0x970 [0097.028] GetCurrentThreadId () returned 0x970 [0097.028] GetCurrentThreadId () returned 0x970 [0097.028] GetCurrentThreadId () returned 0x970 [0097.028] GetCurrentThreadId () returned 0x970 [0097.028] GetCurrentThreadId () returned 0x970 [0097.028] GetCurrentThreadId () returned 0x970 [0097.028] GetCurrentThreadId () returned 0x970 [0097.028] GetCurrentThreadId () returned 0x970 [0097.028] GetCurrentThreadId () returned 0x970 [0097.028] GetCurrentThreadId () returned 0x970 [0097.028] GetCurrentThreadId () returned 0x970 [0097.028] GetCurrentThreadId () returned 0x970 [0097.028] GetCurrentThreadId () returned 0x970 [0097.028] GetCurrentThreadId () returned 0x970 [0097.028] GetCurrentThreadId () returned 0x970 [0097.028] GetCurrentThreadId () returned 0x970 [0097.028] GetCurrentThreadId () returned 0x970 [0097.028] GetCurrentThreadId () returned 0x970 [0097.028] GetCurrentThreadId () returned 0x970 [0097.028] GetCurrentThreadId () returned 0x970 [0097.028] GetCurrentThreadId () returned 0x970 [0097.028] GetCurrentThreadId () returned 0x970 [0097.028] GetCurrentThreadId () returned 0x970 [0097.028] GetCurrentThreadId () returned 0x970 [0097.028] GetCurrentThreadId () returned 0x970 [0097.028] GetCurrentThreadId () returned 0x970 [0097.028] GetCurrentThreadId () returned 0x970 [0097.028] GetCurrentThreadId () returned 0x970 [0097.028] GetCurrentThreadId () returned 0x970 [0097.028] GetCurrentThreadId () returned 0x970 [0097.029] GetCurrentThreadId () returned 0x970 [0097.029] GetCurrentThreadId () returned 0x970 [0097.029] GetCurrentThreadId () returned 0x970 [0097.029] GetCurrentThreadId () returned 0x970 [0097.029] GetCurrentThreadId () returned 0x970 [0097.029] GetCurrentThreadId () returned 0x970 [0097.029] GetCurrentThreadId () returned 0x970 [0097.029] GetCurrentThreadId () returned 0x970 [0097.029] GetCurrentThreadId () returned 0x970 [0097.029] GetCurrentThreadId () returned 0x970 [0097.029] GetCurrentThreadId () returned 0x970 [0097.029] GetCurrentThreadId () returned 0x970 [0097.029] GetCurrentThreadId () returned 0x970 [0097.029] GetCurrentThreadId () returned 0x970 [0097.029] GetCurrentThreadId () returned 0x970 [0097.029] GetCurrentThreadId () returned 0x970 [0097.029] GetCurrentThreadId () returned 0x970 [0097.029] GetCurrentThreadId () returned 0x970 [0097.029] GetCurrentThreadId () returned 0x970 [0097.029] GetCurrentThreadId () returned 0x970 [0097.029] GetCurrentThreadId () returned 0x970 [0097.029] GetCurrentThreadId () returned 0x970 [0097.029] GetCurrentThreadId () returned 0x970 [0097.029] GetCurrentThreadId () returned 0x970 [0097.029] GetCurrentThreadId () returned 0x970 [0097.029] GetCurrentThreadId () returned 0x970 [0097.029] GetCurrentThreadId () returned 0x970 [0097.029] GetCurrentThreadId () returned 0x970 [0097.029] GetCurrentThreadId () returned 0x970 [0097.029] GetCurrentThreadId () returned 0x970 [0097.029] GetCurrentThreadId () returned 0x970 [0097.029] GetCurrentThreadId () returned 0x970 [0097.029] GetCurrentThreadId () returned 0x970 [0097.029] GetCurrentThreadId () returned 0x970 [0097.029] GetCurrentThreadId () returned 0x970 [0097.029] GetCurrentThreadId () returned 0x970 [0097.029] GetCurrentThreadId () returned 0x970 [0097.029] GetCurrentThreadId () returned 0x970 [0097.030] GetCurrentThreadId () returned 0x970 [0097.030] GetCurrentThreadId () returned 0x970 [0097.030] GetCurrentThreadId () returned 0x970 [0097.030] GetCurrentThreadId () returned 0x970 [0097.030] GetCurrentThreadId () returned 0x970 [0097.030] GetCurrentThreadId () returned 0x970 [0097.030] GetCurrentThreadId () returned 0x970 [0097.030] GetCurrentThreadId () returned 0x970 [0097.030] GetCurrentThreadId () returned 0x970 [0097.030] GetCurrentThreadId () returned 0x970 [0097.030] GetCurrentThreadId () returned 0x970 [0097.030] GetCurrentThreadId () returned 0x970 [0097.030] GetCurrentThreadId () returned 0x970 [0097.030] GetCurrentThreadId () returned 0x970 [0097.030] GetCurrentThreadId () returned 0x970 [0097.030] GetCurrentThreadId () returned 0x970 [0097.030] GetCurrentThreadId () returned 0x970 [0097.030] GetCurrentThreadId () returned 0x970 [0097.030] GetCurrentThreadId () returned 0x970 [0097.030] GetCurrentThreadId () returned 0x970 [0097.030] GetCurrentThreadId () returned 0x970 [0097.030] GetCurrentThreadId () returned 0x970 [0097.030] GetCurrentThreadId () returned 0x970 [0097.030] GetCurrentThreadId () returned 0x970 [0097.030] GetCurrentThreadId () returned 0x970 [0097.030] GetCurrentThreadId () returned 0x970 [0097.030] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.031] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.031] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b622b0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0097.031] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.031] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.031] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b622b0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0097.031] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.031] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.031] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b530, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0097.031] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.031] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.031] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b530, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0097.031] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.031] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.031] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b62310, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0097.031] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.031] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.031] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b62310, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0097.031] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.031] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.031] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b62310, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0097.031] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2c, wMilliseconds=0x135)) [0097.031] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr=")9EMH/cL@k:g{J*RSz#zw!RciCQoJTO$", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0097.031] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr=")9EMH/cL@k:g{J*RSz#zw!RciCQoJTO$", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0097.031] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr=")9EMH/cL@k:g{J*RSz#zw!RciCQoJTO$", cchWideChar=32, lpMultiByteStr=0x3b57f68, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=")9EMH/cL@k:g{J*RSz#zw!RciCQoJTO$", lpUsedDefaultChar=0x0) returned 32 [0097.031] GetCurrentThreadId () returned 0x970 [0097.031] GetCurrentThreadId () returned 0x970 [0097.031] GetCurrentThreadId () returned 0x970 [0097.031] GetCurrentThreadId () returned 0x970 [0097.031] GetCurrentThreadId () returned 0x970 [0097.031] GetCurrentThreadId () returned 0x970 [0097.039] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0097.039] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0097.039] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3b16438, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0097.039] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0097.039] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAFvMUwFN9xPUxE2dBstt5bkzbU1eqnwy6Nk7hIdx5Yd6JDwJtL9RWuCfRtqchlFdeL//kqRy28TcBCY+vNLJkrDQp+3rL70GkSWpNCzZw+fPoprpx4Z6M2O6ff7Ix1MCJz5S6l7d+hwdyd0X0/qwtyHlF5K5msKMgtQ3u0Pmt07KDBRZXOwCecjIT7igfS+5F+UvAj4cS4Z1IJ+lOybhA3HwPXrM3448lQ==") returned 232 [0097.039] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2c, wMilliseconds=0x135)) [0097.039] GetCurrentThreadId () returned 0x970 [0097.039] GetCurrentThreadId () returned 0x970 [0097.039] GetCurrentThreadId () returned 0x970 [0097.039] GetCurrentThreadId () returned 0x970 [0097.039] GetCurrentThreadId () returned 0x970 [0097.039] GetCurrentThreadId () returned 0x970 [0097.039] GetCurrentThreadId () returned 0x970 [0097.039] GetCurrentThreadId () returned 0x970 [0097.039] GetCurrentThreadId () returned 0x970 [0097.039] GetCurrentThreadId () returned 0x970 [0097.039] GetCurrentThreadId () returned 0x970 [0097.039] GetCurrentThreadId () returned 0x970 [0097.039] GetCurrentThreadId () returned 0x970 [0097.039] GetCurrentThreadId () returned 0x970 [0097.040] GetCurrentThreadId () returned 0x970 [0097.040] GetCurrentThreadId () returned 0x970 [0097.040] GetCurrentThreadId () returned 0x970 [0097.040] GetCurrentThreadId () returned 0x970 [0097.040] GetCurrentThreadId () returned 0x970 [0097.040] GetCurrentThreadId () returned 0x970 [0097.040] GetCurrentThreadId () returned 0x970 [0097.040] GetCurrentThreadId () returned 0x970 [0097.040] GetCurrentThreadId () returned 0x970 [0097.040] GetCurrentThreadId () returned 0x970 [0097.040] GetCurrentThreadId () returned 0x970 [0097.040] GetCurrentThreadId () returned 0x970 [0097.040] GetCurrentThreadId () returned 0x970 [0097.040] GetCurrentThreadId () returned 0x970 [0097.040] GetCurrentThreadId () returned 0x970 [0097.040] GetCurrentThreadId () returned 0x970 [0097.040] GetCurrentThreadId () returned 0x970 [0097.040] GetCurrentThreadId () returned 0x970 [0097.040] GetCurrentThreadId () returned 0x970 [0097.040] GetCurrentThreadId () returned 0x970 [0097.040] GetCurrentThreadId () returned 0x970 [0097.040] GetCurrentThreadId () returned 0x970 [0097.040] GetCurrentThreadId () returned 0x970 [0097.040] GetCurrentThreadId () returned 0x970 [0097.040] GetCurrentThreadId () returned 0x970 [0097.040] GetCurrentThreadId () returned 0x970 [0097.040] GetCurrentThreadId () returned 0x970 [0097.040] GetCurrentThreadId () returned 0x970 [0097.040] GetCurrentThreadId () returned 0x970 [0097.040] GetCurrentThreadId () returned 0x970 [0097.040] GetCurrentThreadId () returned 0x970 [0097.040] GetCurrentThreadId () returned 0x970 [0097.040] GetCurrentThreadId () returned 0x970 [0097.040] GetCurrentThreadId () returned 0x970 [0097.040] GetCurrentThreadId () returned 0x970 [0097.040] GetCurrentThreadId () returned 0x970 [0097.040] GetCurrentThreadId () returned 0x970 [0097.040] GetCurrentThreadId () returned 0x970 [0097.040] GetCurrentThreadId () returned 0x970 [0097.040] GetCurrentThreadId () returned 0x970 [0097.040] GetCurrentThreadId () returned 0x970 [0097.040] GetCurrentThreadId () returned 0x970 [0097.040] GetCurrentThreadId () returned 0x970 [0097.040] GetCurrentThreadId () returned 0x970 [0097.041] GetCurrentThreadId () returned 0x970 [0097.041] GetCurrentThreadId () returned 0x970 [0097.041] GetCurrentThreadId () returned 0x970 [0097.041] GetCurrentThreadId () returned 0x970 [0097.041] GetCurrentThreadId () returned 0x970 [0097.041] GetCurrentThreadId () returned 0x970 [0097.041] GetCurrentThreadId () returned 0x970 [0097.041] GetCurrentThreadId () returned 0x970 [0097.041] GetCurrentThreadId () returned 0x970 [0097.041] GetCurrentThreadId () returned 0x970 [0097.041] GetCurrentThreadId () returned 0x970 [0097.041] GetCurrentThreadId () returned 0x970 [0097.041] GetCurrentThreadId () returned 0x970 [0097.041] GetCurrentThreadId () returned 0x970 [0097.041] GetCurrentThreadId () returned 0x970 [0097.041] GetCurrentThreadId () returned 0x970 [0097.041] GetCurrentThreadId () returned 0x970 [0097.041] GetCurrentThreadId () returned 0x970 [0097.041] GetCurrentThreadId () returned 0x970 [0097.041] GetCurrentThreadId () returned 0x970 [0097.041] GetCurrentThreadId () returned 0x970 [0097.041] GetCurrentThreadId () returned 0x970 [0097.041] GetCurrentThreadId () returned 0x970 [0097.041] GetCurrentThreadId () returned 0x970 [0097.041] GetCurrentThreadId () returned 0x970 [0097.041] GetCurrentThreadId () returned 0x970 [0097.041] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAFvMUwFN9xPUxE2dBstt5bkzbU1eqnwy6Nk7hIdx5Yd6JDwJtL9RWuCfRtqchlFdeL//kqRy28TcBCY+vNLJkrDQp+3rL70GkSWpNCzZw+fPoprpx4Z6M2O6ff7Ix1MCJz5S6l7d+hwdyd0X0/qwtyHlF5K5msKMgtQ3u0Pmt07KDBRZXOwCecjIT7igfS+5F+UvAj4cS4Z1IJ+lOybhA3HwPXrM3448lQ==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0097.041] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAFvMUwFN9xPUxE2dBstt5bkzbU1eqnwy6Nk7hIdx5Yd6JDwJtL9RWuCfRtqchlFdeL//kqRy28TcBCY+vNLJkrDQp+3rL70GkSWpNCzZw+fPoprpx4Z6M2O6ff7Ix1MCJz5S6l7d+hwdyd0X0/qwtyHlF5K5msKMgtQ3u0Pmt07KDBRZXOwCecjIT7igfS+5F+UvAj4cS4Z1IJ+lOybhA3HwPXrM3448lQ==", cchWideChar=245, lpMultiByteStr=0x3b4d08c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAFvMUwFN9xPUxE2dBstt5bkzbU1eqnwy6Nk7hIdx5Yd6JDwJtL9RWuCfRtqchlFdeL//kqRy28TcBCY+vNLJkrDQp+3rL70GkSWpNCzZw+fPoprpx4Z6M2O6ff7Ix1MCJz5S6l7d+hwdyd0X0/qwtyHlF5K5msKMgtQ3u0Pmt07KDBRZXOwCecjIT7igfS+5F+UvAj4cS4Z1IJ+lOybhA3HwPXrM3448lQ==", lpUsedDefaultChar=0x0) returned 245 [0097.041] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0097.041] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0097.041] CloseHandle (hObject=0x158) returned 1 [0097.042] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01268_.gif")) returned 1 [0097.043] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=21730601272) returned 1 [0097.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [WB01292_.GIF].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [wb01292_.gif].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0097.043] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0097.043] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0097.043] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0097.043] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0097.044] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0097.044] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0097.044] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0097.044] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0097.044] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0097.044] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0097.044] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0097.044] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0097.044] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0097.044] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0097.044] SetEndOfFile (hFile=0x158) returned 1 [0097.044] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0097.044] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0097.044] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0097.044] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0097.044] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0097.045] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0097.046] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="igDIke%$j#=r^:I9HQ@0}4/G(bUn+-0:", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0097.046] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="igDIke%$j#=r^:I9HQ@0}4/G(bUn+-0:", cchWideChar=32, lpMultiByteStr=0x203e21c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="igDIke%$j#=r^:I9HQ@0}4/G(bUn+-0:", lpUsedDefaultChar=0x0) returned 32 [0097.046] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0097.046] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0097.046] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc336fa00, ftCreationTime.dwHighDateTime=0x1bd4e67, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc336fa00, ftLastWriteTime.dwHighDateTime=0x1bd4e67, nFileSizeHigh=0x0, nFileSizeLow=0x255, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01292_.GIF", cAlternateFileName="")) returned 0x295098 [0097.046] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0097.046] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0097.046] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01292_.gif")) returned 0x20 [0097.047] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01292_.gif")) returned 0x20 [0097.047] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01292_.gif")) returned 0x20 [0097.047] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01292_.gif")) returned 0x20 [0097.047] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01292_.gif"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc336fa00, ftCreationTime.dwHighDateTime=0x1bd4e67, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc336fa00, ftLastWriteTime.dwHighDateTime=0x1bd4e67, nFileSizeHigh=0x0, nFileSizeLow=0x255)) returned 1 [0097.047] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0097.047] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0097.047] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01292_.gif")) returned 0x20 [0097.047] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01292_.gif")) returned 0x20 [0097.047] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0097.047] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0097.047] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0097.047] SetEndOfFile (hFile=0x158) returned 1 [0097.048] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01292_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0097.048] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01292_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94dcc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01292_.GIF", lpUsedDefaultChar=0x0) returned 12 [0097.048] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01292_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0097.048] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01292_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94b8c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01292_.GIF", lpUsedDefaultChar=0x0) returned 12 [0097.048] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3b94b8c, cbMultiByte=12, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="WB01292_.GIFg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0097.048] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01292_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0097.048] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01292_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94dcc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01292_.GIF", lpUsedDefaultChar=0x0) returned 12 [0097.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01292_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0097.049] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0097.049] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x255 [0097.049] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0097.049] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0097.049] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0097.049] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01292_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0097.049] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01292_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94dcc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01292_.GIF", lpUsedDefaultChar=0x0) returned 12 [0097.049] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01292_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0097.049] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01292_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94b8c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01292_.GIF", lpUsedDefaultChar=0x0) returned 12 [0097.049] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3b94b8c, cbMultiByte=12, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="WB01292_.GIF2_.GIFg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0097.050] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01292_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0097.050] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01292_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94dcc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01292_.GIF", lpUsedDefaultChar=0x0) returned 12 [0097.050] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0097.051] CharToOemA (in: pSrc="WB01292_.GIF", pDst=0x3b94b8c | out: pDst="WB01292_.GIF") returned 1 [0097.051] WriteFile (in: hFile=0x158, lpBuffer=0x3b94b8c*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x3b94b8c*, lpNumberOfBytesWritten=0x18e048*=0xc, lpOverlapped=0x0) returned 1 [0097.051] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0097.051] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0097.051] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0097.051] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=21731665981) returned 1 [0097.053] ReadFile (in: hFile=0x11c, lpBuffer=0x3af1c80, nNumberOfBytesToRead=0x255, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3af1c80*, lpNumberOfBytesRead=0x18dd7c*=0x255, lpOverlapped=0x0) returned 1 [0097.054] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0097.054] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=21731775968) returned 1 [0097.063] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b3d8*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b5b3d8*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0097.063] ReadFile (in: hFile=0x11c, lpBuffer=0x3af1c80, nNumberOfBytesToRead=0x255, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3af1c80*, lpNumberOfBytesRead=0x18de38*=0x255, lpOverlapped=0x0) returned 1 [0097.064] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x47 [0097.064] WriteFile (in: hFile=0x158, lpBuffer=0x3af1ef0*, nNumberOfBytesToWrite=0x255, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3af1ef0*, lpNumberOfBytesWritten=0x18de10*=0x255, lpOverlapped=0x0) returned 1 [0097.064] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x29c [0097.064] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0097.064] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0097.064] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0097.064] SetFilePointer (in: hFile=0x158, lDistanceToMove=12, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2a [0097.064] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x2a6 [0097.064] CloseHandle (hObject=0x11c) returned 1 [0097.064] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x2a6 [0097.064] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x2a6 [0097.064] SetFilePointer (in: hFile=0x158, lDistanceToMove=678, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x2a6 [0097.065] SetFilePointer (in: hFile=0x158, lDistanceToMove=678, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x2a6 [0097.065] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x2a6 [0097.065] SetFilePointer (in: hFile=0x158, lDistanceToMove=678, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x2a6 [0097.065] SetEndOfFile (hFile=0x158) returned 1 [0097.065] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x2a6 [0097.065] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x2a6 [0097.065] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01292_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0097.065] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01292_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94dcc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01292_.GIF", lpUsedDefaultChar=0x0) returned 12 [0097.065] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01292_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0097.065] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01292_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94dec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01292_.GIF", lpUsedDefaultChar=0x0) returned 12 [0097.065] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3b94dec, cbMultiByte=12, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="WB01292_.GIFꞗ@涤(\x18믉`믑`") returned 12 [0097.065] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01292_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0097.065] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01292_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94dcc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01292_.GIF", lpUsedDefaultChar=0x0) returned 12 [0097.065] WriteFile (in: hFile=0x158, lpBuffer=0x3ad5738*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5738*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0097.065] CharToOemA (in: pSrc="WB01292_.GIF", pDst=0x3b94dec | out: pDst="WB01292_.GIF") returned 1 [0097.066] WriteFile (in: hFile=0x158, lpBuffer=0x3b94dec*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3b94dec*, lpNumberOfBytesWritten=0x18efcc*=0xc, lpOverlapped=0x0) returned 1 [0097.066] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b350*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x3b5b350*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0097.066] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0097.066] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0097.066] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x2eb [0097.066] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x2eb [0097.066] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0097.066] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0097.066] DeleteFileW (lpFileName="") returned 0 [0097.066] GetLastError () returned 0x3 [0097.066] GetFileAttributesW (lpFileName="") returned 0xffffffff [0097.066] SetLastError (dwErrCode=0x3) [0097.066] FlushFileBuffers (hFile=0x158) returned 1 [0097.069] GetCurrentThreadId () returned 0x970 [0097.069] GetCurrentThreadId () returned 0x970 [0097.069] GetCurrentThreadId () returned 0x970 [0097.069] GetCurrentThreadId () returned 0x970 [0097.069] GetCurrentThreadId () returned 0x970 [0097.069] GetCurrentThreadId () returned 0x970 [0097.069] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x3a2 [0097.069] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x3a2 [0097.069] SetFilePointer (in: hFile=0x158, lDistanceToMove=930, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x3a2 [0097.069] CloseHandle (hObject=0x158) returned 1 [0097.069] GetCurrentThreadId () returned 0x970 [0097.069] GetCurrentThreadId () returned 0x970 [0097.069] GetCurrentThreadId () returned 0x970 [0097.069] GetCurrentThreadId () returned 0x970 [0097.069] GetCurrentThreadId () returned 0x970 [0097.069] GetCurrentThreadId () returned 0x970 [0097.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [WB01292_.GIF].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [wb01292_.gif].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0097.070] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3a2 [0097.070] SetFilePointer (in: hFile=0x158, lDistanceToMove=802, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x322 [0097.070] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0097.070] GetFileType (hFile=0x158) returned 0x1 [0097.070] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2c, wMilliseconds=0x154)) [0097.070] GetCurrentThreadId () returned 0x970 [0097.070] GetCurrentThreadId () returned 0x970 [0097.070] GetCurrentThreadId () returned 0x970 [0097.070] GetCurrentThreadId () returned 0x970 [0097.070] GetCurrentThreadId () returned 0x970 [0097.070] GetCurrentThreadId () returned 0x970 [0097.070] GetCurrentThreadId () returned 0x970 [0097.070] GetCurrentThreadId () returned 0x970 [0097.070] GetCurrentThreadId () returned 0x970 [0097.070] GetCurrentThreadId () returned 0x970 [0097.070] GetCurrentThreadId () returned 0x970 [0097.070] GetCurrentThreadId () returned 0x970 [0097.070] GetCurrentThreadId () returned 0x970 [0097.070] GetCurrentThreadId () returned 0x970 [0097.070] GetCurrentThreadId () returned 0x970 [0097.070] GetCurrentThreadId () returned 0x970 [0097.070] GetCurrentThreadId () returned 0x970 [0097.070] GetCurrentThreadId () returned 0x970 [0097.070] GetCurrentThreadId () returned 0x970 [0097.070] GetCurrentThreadId () returned 0x970 [0097.070] GetCurrentThreadId () returned 0x970 [0097.070] GetCurrentThreadId () returned 0x970 [0097.070] GetCurrentThreadId () returned 0x970 [0097.070] GetCurrentThreadId () returned 0x970 [0097.070] GetCurrentThreadId () returned 0x970 [0097.070] GetCurrentThreadId () returned 0x970 [0097.070] GetCurrentThreadId () returned 0x970 [0097.070] GetCurrentThreadId () returned 0x970 [0097.070] GetCurrentThreadId () returned 0x970 [0097.070] GetCurrentThreadId () returned 0x970 [0097.070] GetCurrentThreadId () returned 0x970 [0097.071] GetCurrentThreadId () returned 0x970 [0097.071] GetCurrentThreadId () returned 0x970 [0097.071] GetCurrentThreadId () returned 0x970 [0097.071] GetCurrentThreadId () returned 0x970 [0097.071] GetCurrentThreadId () returned 0x970 [0097.071] GetCurrentThreadId () returned 0x970 [0097.071] GetCurrentThreadId () returned 0x970 [0097.071] GetCurrentThreadId () returned 0x970 [0097.071] GetCurrentThreadId () returned 0x970 [0097.071] GetCurrentThreadId () returned 0x970 [0097.071] GetCurrentThreadId () returned 0x970 [0097.071] GetCurrentThreadId () returned 0x970 [0097.071] GetCurrentThreadId () returned 0x970 [0097.071] GetCurrentThreadId () returned 0x970 [0097.071] GetCurrentThreadId () returned 0x970 [0097.071] GetCurrentThreadId () returned 0x970 [0097.071] GetCurrentThreadId () returned 0x970 [0097.071] GetCurrentThreadId () returned 0x970 [0097.071] GetCurrentThreadId () returned 0x970 [0097.071] GetCurrentThreadId () returned 0x970 [0097.071] GetCurrentThreadId () returned 0x970 [0097.071] GetCurrentThreadId () returned 0x970 [0097.071] GetCurrentThreadId () returned 0x970 [0097.071] GetCurrentThreadId () returned 0x970 [0097.071] GetCurrentThreadId () returned 0x970 [0097.071] GetCurrentThreadId () returned 0x970 [0097.071] GetCurrentThreadId () returned 0x970 [0097.071] GetCurrentThreadId () returned 0x970 [0097.071] GetCurrentThreadId () returned 0x970 [0097.071] GetCurrentThreadId () returned 0x970 [0097.071] GetCurrentThreadId () returned 0x970 [0097.071] GetCurrentThreadId () returned 0x970 [0097.071] GetCurrentThreadId () returned 0x970 [0097.071] GetCurrentThreadId () returned 0x970 [0097.071] GetCurrentThreadId () returned 0x970 [0097.071] GetCurrentThreadId () returned 0x970 [0097.071] GetCurrentThreadId () returned 0x970 [0097.071] GetCurrentThreadId () returned 0x970 [0097.071] GetCurrentThreadId () returned 0x970 [0097.071] GetCurrentThreadId () returned 0x970 [0097.071] GetCurrentThreadId () returned 0x970 [0097.071] GetCurrentThreadId () returned 0x970 [0097.071] GetCurrentThreadId () returned 0x970 [0097.072] GetCurrentThreadId () returned 0x970 [0097.072] GetCurrentThreadId () returned 0x970 [0097.072] GetCurrentThreadId () returned 0x970 [0097.072] GetCurrentThreadId () returned 0x970 [0097.072] GetCurrentThreadId () returned 0x970 [0097.072] GetCurrentThreadId () returned 0x970 [0097.072] GetCurrentThreadId () returned 0x970 [0097.072] GetCurrentThreadId () returned 0x970 [0097.072] GetCurrentThreadId () returned 0x970 [0097.072] GetCurrentThreadId () returned 0x970 [0097.072] GetCurrentThreadId () returned 0x970 [0097.072] GetCurrentThreadId () returned 0x970 [0097.072] GetCurrentThreadId () returned 0x970 [0097.072] GetCurrentThreadId () returned 0x970 [0097.072] GetCurrentThreadId () returned 0x970 [0097.072] GetCurrentThreadId () returned 0x970 [0097.072] GetCurrentThreadId () returned 0x970 [0097.072] GetCurrentThreadId () returned 0x970 [0097.072] GetCurrentThreadId () returned 0x970 [0097.072] GetCurrentThreadId () returned 0x970 [0097.072] GetCurrentThreadId () returned 0x970 [0097.072] GetCurrentThreadId () returned 0x970 [0097.072] GetCurrentThreadId () returned 0x970 [0097.072] GetCurrentThreadId () returned 0x970 [0097.072] GetCurrentThreadId () returned 0x970 [0097.072] GetCurrentThreadId () returned 0x970 [0097.072] GetCurrentThreadId () returned 0x970 [0097.072] GetCurrentThreadId () returned 0x970 [0097.072] GetCurrentThreadId () returned 0x970 [0097.072] GetCurrentThreadId () returned 0x970 [0097.072] GetCurrentThreadId () returned 0x970 [0097.072] GetCurrentThreadId () returned 0x970 [0097.072] GetCurrentThreadId () returned 0x970 [0097.072] GetCurrentThreadId () returned 0x970 [0097.072] GetCurrentThreadId () returned 0x970 [0097.072] GetCurrentThreadId () returned 0x970 [0097.072] GetCurrentThreadId () returned 0x970 [0097.072] GetCurrentThreadId () returned 0x970 [0097.072] GetCurrentThreadId () returned 0x970 [0097.072] GetCurrentThreadId () returned 0x970 [0097.072] GetCurrentThreadId () returned 0x970 [0097.072] GetCurrentThreadId () returned 0x970 [0097.072] GetCurrentThreadId () returned 0x970 [0097.073] GetCurrentThreadId () returned 0x970 [0097.073] GetCurrentThreadId () returned 0x970 [0097.073] GetCurrentThreadId () returned 0x970 [0097.073] GetCurrentThreadId () returned 0x970 [0097.073] GetCurrentThreadId () returned 0x970 [0097.073] GetCurrentThreadId () returned 0x970 [0097.073] GetCurrentThreadId () returned 0x970 [0097.073] GetCurrentThreadId () returned 0x970 [0097.073] GetCurrentThreadId () returned 0x970 [0097.073] GetCurrentThreadId () returned 0x970 [0097.073] GetCurrentThreadId () returned 0x970 [0097.073] GetCurrentThreadId () returned 0x970 [0097.073] GetCurrentThreadId () returned 0x970 [0097.073] GetCurrentThreadId () returned 0x970 [0097.073] GetCurrentThreadId () returned 0x970 [0097.073] GetCurrentThreadId () returned 0x970 [0097.073] GetCurrentThreadId () returned 0x970 [0097.073] GetCurrentThreadId () returned 0x970 [0097.073] GetCurrentThreadId () returned 0x970 [0097.073] GetCurrentThreadId () returned 0x970 [0097.073] GetCurrentThreadId () returned 0x970 [0097.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b62310, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0097.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b62310, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0097.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b548, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0097.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b548, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0097.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b62370, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0097.074] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.074] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.074] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b62370, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0097.074] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.074] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.074] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b62370, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0097.074] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2c, wMilliseconds=0x154)) [0097.074] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="igDIke%$j#=r^:I9HQ@0}4/G(bUn+-0:", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0097.074] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="igDIke%$j#=r^:I9HQ@0}4/G(bUn+-0:", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0097.074] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="igDIke%$j#=r^:I9HQ@0}4/G(bUn+-0:", cchWideChar=32, lpMultiByteStr=0x3b57f98, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="igDIke%$j#=r^:I9HQ@0}4/G(bUn+-0:", lpUsedDefaultChar=0x0) returned 32 [0097.074] GetCurrentThreadId () returned 0x970 [0097.074] GetCurrentThreadId () returned 0x970 [0097.074] GetCurrentThreadId () returned 0x970 [0097.074] GetCurrentThreadId () returned 0x970 [0097.074] GetCurrentThreadId () returned 0x970 [0097.074] GetCurrentThreadId () returned 0x970 [0097.082] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0097.082] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0097.082] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3b16528, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0097.082] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0097.082] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAEv8ri/jVYHhVPNWvBmsCeC1c1VoSDHdzvPl7cYsp0kRrEr1cBWKVlmXgYpaEpYnBXG2YBaqYWvTqsZ27klWgbbUiB5qtBSgNjhRY8n5wKF/6IqqzMKG9UDgJWo2aW95ha6So6dYwLK3yuAoE64GrE3cUPAhw+cdRjVXAVxQcBLeOJUT42RmvbL5Sg8pV0Usre4qcbG4583BnG8FASfreiZafYypyPyE9A==") returned 232 [0097.082] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2c, wMilliseconds=0x164)) [0097.082] GetCurrentThreadId () returned 0x970 [0097.082] GetCurrentThreadId () returned 0x970 [0097.082] GetCurrentThreadId () returned 0x970 [0097.082] GetCurrentThreadId () returned 0x970 [0097.082] GetCurrentThreadId () returned 0x970 [0097.082] GetCurrentThreadId () returned 0x970 [0097.082] GetCurrentThreadId () returned 0x970 [0097.082] GetCurrentThreadId () returned 0x970 [0097.082] GetCurrentThreadId () returned 0x970 [0097.082] GetCurrentThreadId () returned 0x970 [0097.082] GetCurrentThreadId () returned 0x970 [0097.082] GetCurrentThreadId () returned 0x970 [0097.082] GetCurrentThreadId () returned 0x970 [0097.082] GetCurrentThreadId () returned 0x970 [0097.082] GetCurrentThreadId () returned 0x970 [0097.082] GetCurrentThreadId () returned 0x970 [0097.082] GetCurrentThreadId () returned 0x970 [0097.082] GetCurrentThreadId () returned 0x970 [0097.082] GetCurrentThreadId () returned 0x970 [0097.082] GetCurrentThreadId () returned 0x970 [0097.082] GetCurrentThreadId () returned 0x970 [0097.082] GetCurrentThreadId () returned 0x970 [0097.082] GetCurrentThreadId () returned 0x970 [0097.082] GetCurrentThreadId () returned 0x970 [0097.083] GetCurrentThreadId () returned 0x970 [0097.083] GetCurrentThreadId () returned 0x970 [0097.083] GetCurrentThreadId () returned 0x970 [0097.083] GetCurrentThreadId () returned 0x970 [0097.083] GetCurrentThreadId () returned 0x970 [0097.083] GetCurrentThreadId () returned 0x970 [0097.083] GetCurrentThreadId () returned 0x970 [0097.083] GetCurrentThreadId () returned 0x970 [0097.083] GetCurrentThreadId () returned 0x970 [0097.083] GetCurrentThreadId () returned 0x970 [0097.083] GetCurrentThreadId () returned 0x970 [0097.083] GetCurrentThreadId () returned 0x970 [0097.083] GetCurrentThreadId () returned 0x970 [0097.083] GetCurrentThreadId () returned 0x970 [0097.083] GetCurrentThreadId () returned 0x970 [0097.083] GetCurrentThreadId () returned 0x970 [0097.083] GetCurrentThreadId () returned 0x970 [0097.083] GetCurrentThreadId () returned 0x970 [0097.083] GetCurrentThreadId () returned 0x970 [0097.083] GetCurrentThreadId () returned 0x970 [0097.083] GetCurrentThreadId () returned 0x970 [0097.083] GetCurrentThreadId () returned 0x970 [0097.083] GetCurrentThreadId () returned 0x970 [0097.083] GetCurrentThreadId () returned 0x970 [0097.083] GetCurrentThreadId () returned 0x970 [0097.083] GetCurrentThreadId () returned 0x970 [0097.083] GetCurrentThreadId () returned 0x970 [0097.083] GetCurrentThreadId () returned 0x970 [0097.083] GetCurrentThreadId () returned 0x970 [0097.083] GetCurrentThreadId () returned 0x970 [0097.083] GetCurrentThreadId () returned 0x970 [0097.083] GetCurrentThreadId () returned 0x970 [0097.083] GetCurrentThreadId () returned 0x970 [0097.083] GetCurrentThreadId () returned 0x970 [0097.083] GetCurrentThreadId () returned 0x970 [0097.083] GetCurrentThreadId () returned 0x970 [0097.083] GetCurrentThreadId () returned 0x970 [0097.083] GetCurrentThreadId () returned 0x970 [0097.083] GetCurrentThreadId () returned 0x970 [0097.083] GetCurrentThreadId () returned 0x970 [0097.083] GetCurrentThreadId () returned 0x970 [0097.083] GetCurrentThreadId () returned 0x970 [0097.083] GetCurrentThreadId () returned 0x970 [0097.084] GetCurrentThreadId () returned 0x970 [0097.084] GetCurrentThreadId () returned 0x970 [0097.084] GetCurrentThreadId () returned 0x970 [0097.084] GetCurrentThreadId () returned 0x970 [0097.084] GetCurrentThreadId () returned 0x970 [0097.084] GetCurrentThreadId () returned 0x970 [0097.084] GetCurrentThreadId () returned 0x970 [0097.084] GetCurrentThreadId () returned 0x970 [0097.084] GetCurrentThreadId () returned 0x970 [0097.084] GetCurrentThreadId () returned 0x970 [0097.084] GetCurrentThreadId () returned 0x970 [0097.084] GetCurrentThreadId () returned 0x970 [0097.084] GetCurrentThreadId () returned 0x970 [0097.084] GetCurrentThreadId () returned 0x970 [0097.084] GetCurrentThreadId () returned 0x970 [0097.084] GetCurrentThreadId () returned 0x970 [0097.084] GetCurrentThreadId () returned 0x970 [0097.084] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAEv8ri/jVYHhVPNWvBmsCeC1c1VoSDHdzvPl7cYsp0kRrEr1cBWKVlmXgYpaEpYnBXG2YBaqYWvTqsZ27klWgbbUiB5qtBSgNjhRY8n5wKF/6IqqzMKG9UDgJWo2aW95ha6So6dYwLK3yuAoE64GrE3cUPAhw+cdRjVXAVxQcBLeOJUT42RmvbL5Sg8pV0Usre4qcbG4583BnG8FASfreiZafYypyPyE9A==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0097.084] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAEv8ri/jVYHhVPNWvBmsCeC1c1VoSDHdzvPl7cYsp0kRrEr1cBWKVlmXgYpaEpYnBXG2YBaqYWvTqsZ27klWgbbUiB5qtBSgNjhRY8n5wKF/6IqqzMKG9UDgJWo2aW95ha6So6dYwLK3yuAoE64GrE3cUPAhw+cdRjVXAVxQcBLeOJUT42RmvbL5Sg8pV0Usre4qcbG4583BnG8FASfreiZafYypyPyE9A==", cchWideChar=245, lpMultiByteStr=0x3b4d08c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAEv8ri/jVYHhVPNWvBmsCeC1c1VoSDHdzvPl7cYsp0kRrEr1cBWKVlmXgYpaEpYnBXG2YBaqYWvTqsZ27klWgbbUiB5qtBSgNjhRY8n5wKF/6IqqzMKG9UDgJWo2aW95ha6So6dYwLK3yuAoE64GrE3cUPAhw+cdRjVXAVxQcBLeOJUT42RmvbL5Sg8pV0Usre4qcbG4583BnG8FASfreiZafYypyPyE9A==", lpUsedDefaultChar=0x0) returned 245 [0097.084] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0097.084] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0097.084] CloseHandle (hObject=0x158) returned 1 [0097.085] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01292_.gif")) returned 1 [0097.086] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=21734899263) returned 1 [0097.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [WB01293_.GIF].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [wb01293_.gif].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0097.086] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0097.086] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0097.086] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0097.086] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0097.087] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0097.087] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0097.087] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0097.087] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0097.087] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0097.087] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0097.087] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0097.087] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0097.087] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0097.087] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0097.087] SetEndOfFile (hFile=0x158) returned 1 [0097.087] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0097.087] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0097.087] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0097.087] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0097.087] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0097.088] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0097.088] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="/CU7!BUi{gR&MAo#i&-Uc.q@re\\1K&r,", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0097.089] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="/CU7!BUi{gR&MAo#i&-Uc.q@re\\1K&r,", cchWideChar=32, lpMultiByteStr=0x203e254, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="/CU7!BUi{gR&MAo#i&-Uc.q@re\\1K&r,", lpUsedDefaultChar=0x0) returned 32 [0097.089] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0097.089] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0097.089] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc0fec00, ftCreationTime.dwHighDateTime=0x1bd4e67, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc0fec00, ftLastWriteTime.dwHighDateTime=0x1bd4e67, nFileSizeHigh=0x0, nFileSizeLow=0x2a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01293_.GIF", cAlternateFileName="")) returned 0x295098 [0097.089] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0097.089] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0097.089] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01293_.gif")) returned 0x20 [0097.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01293_.gif")) returned 0x20 [0097.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01293_.gif")) returned 0x20 [0097.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01293_.gif")) returned 0x20 [0097.090] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01293_.gif"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc0fec00, ftCreationTime.dwHighDateTime=0x1bd4e67, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc0fec00, ftLastWriteTime.dwHighDateTime=0x1bd4e67, nFileSizeHigh=0x0, nFileSizeLow=0x2a7)) returned 1 [0097.090] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0097.090] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0097.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01293_.gif")) returned 0x20 [0097.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01293_.gif")) returned 0x20 [0097.090] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0097.090] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0097.090] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0097.090] SetEndOfFile (hFile=0x158) returned 1 [0097.091] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01293_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0097.091] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01293_.GIF", cchWideChar=12, lpMultiByteStr=0x3b9494c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01293_.GIF", lpUsedDefaultChar=0x0) returned 12 [0097.091] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01293_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0097.091] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01293_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94bcc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01293_.GIF", lpUsedDefaultChar=0x0) returned 12 [0097.091] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3b94bcc, cbMultiByte=12, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="WB01293_.GIFg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0097.092] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01293_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0097.092] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01293_.GIF", cchWideChar=12, lpMultiByteStr=0x3b9494c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01293_.GIF", lpUsedDefaultChar=0x0) returned 12 [0097.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01293_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0097.092] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0097.092] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2a7 [0097.092] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0097.092] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0097.092] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0097.092] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01293_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0097.092] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01293_.GIF", cchWideChar=12, lpMultiByteStr=0x3b9494c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01293_.GIF", lpUsedDefaultChar=0x0) returned 12 [0097.093] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01293_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0097.093] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01293_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94bcc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01293_.GIF", lpUsedDefaultChar=0x0) returned 12 [0097.093] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3b94bcc, cbMultiByte=12, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="WB01293_.GIF3_.GIFg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0097.093] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01293_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0097.093] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01293_.GIF", cchWideChar=12, lpMultiByteStr=0x3b9494c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01293_.GIF", lpUsedDefaultChar=0x0) returned 12 [0097.093] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0097.094] CharToOemA (in: pSrc="WB01293_.GIF", pDst=0x3b94bcc | out: pDst="WB01293_.GIF") returned 1 [0097.094] WriteFile (in: hFile=0x158, lpBuffer=0x3b94bcc*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x3b94bcc*, lpNumberOfBytesWritten=0x18e048*=0xc, lpOverlapped=0x0) returned 1 [0097.094] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0097.094] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0097.094] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0097.094] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=21735757299) returned 1 [0097.094] ReadFile (in: hFile=0x11c, lpBuffer=0x1fc46c0, nNumberOfBytesToRead=0x2a7, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fc46c0*, lpNumberOfBytesRead=0x18dd7c*=0x2a7, lpOverlapped=0x0) returned 1 [0097.095] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0097.095] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=21735857596) returned 1 [0097.104] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b3c0*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b5b3c0*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0097.104] ReadFile (in: hFile=0x11c, lpBuffer=0x1fc46c0, nNumberOfBytesToRead=0x2a7, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x1fc46c0*, lpNumberOfBytesRead=0x18de38*=0x2a7, lpOverlapped=0x0) returned 1 [0097.104] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x47 [0097.104] WriteFile (in: hFile=0x158, lpBuffer=0x1fc49a0*, nNumberOfBytesToWrite=0x2a7, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1fc49a0*, lpNumberOfBytesWritten=0x18de10*=0x2a7, lpOverlapped=0x0) returned 1 [0097.105] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x2ee [0097.105] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0097.105] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0097.105] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0097.105] SetFilePointer (in: hFile=0x158, lDistanceToMove=12, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2a [0097.105] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x2f8 [0097.105] CloseHandle (hObject=0x11c) returned 1 [0097.105] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x2f8 [0097.105] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x2f8 [0097.105] SetFilePointer (in: hFile=0x158, lDistanceToMove=760, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x2f8 [0097.105] SetFilePointer (in: hFile=0x158, lDistanceToMove=760, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x2f8 [0097.105] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x2f8 [0097.105] SetFilePointer (in: hFile=0x158, lDistanceToMove=760, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x2f8 [0097.105] SetEndOfFile (hFile=0x158) returned 1 [0097.106] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x2f8 [0097.106] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x2f8 [0097.106] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01293_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0097.106] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01293_.GIF", cchWideChar=12, lpMultiByteStr=0x3b9494c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01293_.GIF", lpUsedDefaultChar=0x0) returned 12 [0097.106] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01293_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0097.106] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01293_.GIF", cchWideChar=12, lpMultiByteStr=0x3b9498c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01293_.GIF", lpUsedDefaultChar=0x0) returned 12 [0097.106] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3b9498c, cbMultiByte=12, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="WB01293_.GIFꞗ@涤(\x18믉`믑`") returned 12 [0097.106] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01293_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0097.106] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01293_.GIF", cchWideChar=12, lpMultiByteStr=0x3b9494c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01293_.GIF", lpUsedDefaultChar=0x0) returned 12 [0097.106] WriteFile (in: hFile=0x158, lpBuffer=0x3ad5738*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5738*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0097.106] CharToOemA (in: pSrc="WB01293_.GIF", pDst=0x3b9498c | out: pDst="WB01293_.GIF") returned 1 [0097.106] WriteFile (in: hFile=0x158, lpBuffer=0x3b9498c*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3b9498c*, lpNumberOfBytesWritten=0x18efcc*=0xc, lpOverlapped=0x0) returned 1 [0097.106] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b3b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x3b5b3b0*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0097.106] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0097.106] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0097.106] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x33d [0097.107] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x33d [0097.107] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0097.107] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0097.107] DeleteFileW (lpFileName="") returned 0 [0097.107] GetLastError () returned 0x3 [0097.107] GetFileAttributesW (lpFileName="") returned 0xffffffff [0097.107] SetLastError (dwErrCode=0x3) [0097.107] FlushFileBuffers (hFile=0x158) returned 1 [0097.109] GetCurrentThreadId () returned 0x970 [0097.109] GetCurrentThreadId () returned 0x970 [0097.109] GetCurrentThreadId () returned 0x970 [0097.109] GetCurrentThreadId () returned 0x970 [0097.109] GetCurrentThreadId () returned 0x970 [0097.109] GetCurrentThreadId () returned 0x970 [0097.110] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x3f4 [0097.110] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x3f4 [0097.110] SetFilePointer (in: hFile=0x158, lDistanceToMove=1012, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x3f4 [0097.110] CloseHandle (hObject=0x158) returned 1 [0097.110] GetCurrentThreadId () returned 0x970 [0097.110] GetCurrentThreadId () returned 0x970 [0097.110] GetCurrentThreadId () returned 0x970 [0097.110] GetCurrentThreadId () returned 0x970 [0097.110] GetCurrentThreadId () returned 0x970 [0097.110] GetCurrentThreadId () returned 0x970 [0097.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [WB01293_.GIF].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [wb01293_.gif].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0097.110] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3f4 [0097.110] SetFilePointer (in: hFile=0x158, lDistanceToMove=884, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x374 [0097.110] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0097.110] GetFileType (hFile=0x158) returned 0x1 [0097.110] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2c, wMilliseconds=0x183)) [0097.110] GetCurrentThreadId () returned 0x970 [0097.110] GetCurrentThreadId () returned 0x970 [0097.110] GetCurrentThreadId () returned 0x970 [0097.110] GetCurrentThreadId () returned 0x970 [0097.110] GetCurrentThreadId () returned 0x970 [0097.111] GetCurrentThreadId () returned 0x970 [0097.111] GetCurrentThreadId () returned 0x970 [0097.111] GetCurrentThreadId () returned 0x970 [0097.111] GetCurrentThreadId () returned 0x970 [0097.111] GetCurrentThreadId () returned 0x970 [0097.111] GetCurrentThreadId () returned 0x970 [0097.111] GetCurrentThreadId () returned 0x970 [0097.111] GetCurrentThreadId () returned 0x970 [0097.111] GetCurrentThreadId () returned 0x970 [0097.111] GetCurrentThreadId () returned 0x970 [0097.111] GetCurrentThreadId () returned 0x970 [0097.111] GetCurrentThreadId () returned 0x970 [0097.111] GetCurrentThreadId () returned 0x970 [0097.111] GetCurrentThreadId () returned 0x970 [0097.111] GetCurrentThreadId () returned 0x970 [0097.111] GetCurrentThreadId () returned 0x970 [0097.111] GetCurrentThreadId () returned 0x970 [0097.111] GetCurrentThreadId () returned 0x970 [0097.111] GetCurrentThreadId () returned 0x970 [0097.111] GetCurrentThreadId () returned 0x970 [0097.111] GetCurrentThreadId () returned 0x970 [0097.111] GetCurrentThreadId () returned 0x970 [0097.111] GetCurrentThreadId () returned 0x970 [0097.111] GetCurrentThreadId () returned 0x970 [0097.111] GetCurrentThreadId () returned 0x970 [0097.111] GetCurrentThreadId () returned 0x970 [0097.111] GetCurrentThreadId () returned 0x970 [0097.111] GetCurrentThreadId () returned 0x970 [0097.111] GetCurrentThreadId () returned 0x970 [0097.111] GetCurrentThreadId () returned 0x970 [0097.111] GetCurrentThreadId () returned 0x970 [0097.111] GetCurrentThreadId () returned 0x970 [0097.111] GetCurrentThreadId () returned 0x970 [0097.111] GetCurrentThreadId () returned 0x970 [0097.111] GetCurrentThreadId () returned 0x970 [0097.111] GetCurrentThreadId () returned 0x970 [0097.111] GetCurrentThreadId () returned 0x970 [0097.111] GetCurrentThreadId () returned 0x970 [0097.111] GetCurrentThreadId () returned 0x970 [0097.111] GetCurrentThreadId () returned 0x970 [0097.111] GetCurrentThreadId () returned 0x970 [0097.111] GetCurrentThreadId () returned 0x970 [0097.111] GetCurrentThreadId () returned 0x970 [0097.111] GetCurrentThreadId () returned 0x970 [0097.112] GetCurrentThreadId () returned 0x970 [0097.112] GetCurrentThreadId () returned 0x970 [0097.112] GetCurrentThreadId () returned 0x970 [0097.112] GetCurrentThreadId () returned 0x970 [0097.112] GetCurrentThreadId () returned 0x970 [0097.112] GetCurrentThreadId () returned 0x970 [0097.112] GetCurrentThreadId () returned 0x970 [0097.112] GetCurrentThreadId () returned 0x970 [0097.112] GetCurrentThreadId () returned 0x970 [0097.112] GetCurrentThreadId () returned 0x970 [0097.112] GetCurrentThreadId () returned 0x970 [0097.112] GetCurrentThreadId () returned 0x970 [0097.112] GetCurrentThreadId () returned 0x970 [0097.112] GetCurrentThreadId () returned 0x970 [0097.112] GetCurrentThreadId () returned 0x970 [0097.112] GetCurrentThreadId () returned 0x970 [0097.112] GetCurrentThreadId () returned 0x970 [0097.112] GetCurrentThreadId () returned 0x970 [0097.112] GetCurrentThreadId () returned 0x970 [0097.112] GetCurrentThreadId () returned 0x970 [0097.112] GetCurrentThreadId () returned 0x970 [0097.112] GetCurrentThreadId () returned 0x970 [0097.112] GetCurrentThreadId () returned 0x970 [0097.112] GetCurrentThreadId () returned 0x970 [0097.112] GetCurrentThreadId () returned 0x970 [0097.112] GetCurrentThreadId () returned 0x970 [0097.112] GetCurrentThreadId () returned 0x970 [0097.112] GetCurrentThreadId () returned 0x970 [0097.112] GetCurrentThreadId () returned 0x970 [0097.112] GetCurrentThreadId () returned 0x970 [0097.112] GetCurrentThreadId () returned 0x970 [0097.112] GetCurrentThreadId () returned 0x970 [0097.112] GetCurrentThreadId () returned 0x970 [0097.112] GetCurrentThreadId () returned 0x970 [0097.112] GetCurrentThreadId () returned 0x970 [0097.112] GetCurrentThreadId () returned 0x970 [0097.112] GetCurrentThreadId () returned 0x970 [0097.112] GetCurrentThreadId () returned 0x970 [0097.112] GetCurrentThreadId () returned 0x970 [0097.112] GetCurrentThreadId () returned 0x970 [0097.112] GetCurrentThreadId () returned 0x970 [0097.112] GetCurrentThreadId () returned 0x970 [0097.112] GetCurrentThreadId () returned 0x970 [0097.112] GetCurrentThreadId () returned 0x970 [0097.113] GetCurrentThreadId () returned 0x970 [0097.113] GetCurrentThreadId () returned 0x970 [0097.113] GetCurrentThreadId () returned 0x970 [0097.113] GetCurrentThreadId () returned 0x970 [0097.113] GetCurrentThreadId () returned 0x970 [0097.113] GetCurrentThreadId () returned 0x970 [0097.113] GetCurrentThreadId () returned 0x970 [0097.113] GetCurrentThreadId () returned 0x970 [0097.113] GetCurrentThreadId () returned 0x970 [0097.113] GetCurrentThreadId () returned 0x970 [0097.113] GetCurrentThreadId () returned 0x970 [0097.113] GetCurrentThreadId () returned 0x970 [0097.113] GetCurrentThreadId () returned 0x970 [0097.113] GetCurrentThreadId () returned 0x970 [0097.113] GetCurrentThreadId () returned 0x970 [0097.113] GetCurrentThreadId () returned 0x970 [0097.113] GetCurrentThreadId () returned 0x970 [0097.113] GetCurrentThreadId () returned 0x970 [0097.113] GetCurrentThreadId () returned 0x970 [0097.113] GetCurrentThreadId () returned 0x970 [0097.113] GetCurrentThreadId () returned 0x970 [0097.113] GetCurrentThreadId () returned 0x970 [0097.113] GetCurrentThreadId () returned 0x970 [0097.113] GetCurrentThreadId () returned 0x970 [0097.113] GetCurrentThreadId () returned 0x970 [0097.113] GetCurrentThreadId () returned 0x970 [0097.113] GetCurrentThreadId () returned 0x970 [0097.113] GetCurrentThreadId () returned 0x970 [0097.113] GetCurrentThreadId () returned 0x970 [0097.113] GetCurrentThreadId () returned 0x970 [0097.113] GetCurrentThreadId () returned 0x970 [0097.113] GetCurrentThreadId () returned 0x970 [0097.113] GetCurrentThreadId () returned 0x970 [0097.113] GetCurrentThreadId () returned 0x970 [0097.113] GetCurrentThreadId () returned 0x970 [0097.113] GetCurrentThreadId () returned 0x970 [0097.113] GetCurrentThreadId () returned 0x970 [0097.113] GetCurrentThreadId () returned 0x970 [0097.113] GetCurrentThreadId () returned 0x970 [0097.113] GetCurrentThreadId () returned 0x970 [0097.113] GetCurrentThreadId () returned 0x970 [0097.113] GetCurrentThreadId () returned 0x970 [0097.114] GetCurrentThreadId () returned 0x970 [0097.114] GetCurrentThreadId () returned 0x970 [0097.114] GetCurrentThreadId () returned 0x970 [0097.114] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.114] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.114] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b62370, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0097.114] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.114] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.114] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b62370, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0097.114] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.114] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.114] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b530, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0097.114] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.114] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.114] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b530, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0097.114] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.114] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.114] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b623d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0097.114] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.114] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.114] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b623d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0097.114] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.114] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.114] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b623d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0097.114] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2c, wMilliseconds=0x183)) [0097.114] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="/CU7!BUi{gR&MAo#i&-Uc.q@re\\1K&r,", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0097.114] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="/CU7!BUi{gR&MAo#i&-Uc.q@re\\1K&r,", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0097.114] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="/CU7!BUi{gR&MAo#i&-Uc.q@re\\1K&r,", cchWideChar=32, lpMultiByteStr=0x3b57fc8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="/CU7!BUi{gR&MAo#i&-Uc.q@re\\1K&r,", lpUsedDefaultChar=0x0) returned 32 [0097.114] GetCurrentThreadId () returned 0x970 [0097.114] GetCurrentThreadId () returned 0x970 [0097.115] GetCurrentThreadId () returned 0x970 [0097.115] GetCurrentThreadId () returned 0x970 [0097.115] GetCurrentThreadId () returned 0x970 [0097.115] GetCurrentThreadId () returned 0x970 [0097.122] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0097.122] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0097.122] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3b16618, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0097.122] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0097.122] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAABptrOJbrPSR2rERurZxkjlocfX0vivHfpEUEdp00pB42ugYQoWDhjWwqxV1TSLJ82QxIzMgkl5QRNTRHNi7XEBVphH96ElsTNIavI/cDhfHMDhNK39cd9bbJ6PP/Fw1ORUdV3hfXySvA3UnH12+CfpVatYtHJw2TntRYgtjjuu6h3fLXG394xR58w9FS6gBDoGSwlVI5RSUcz88+erXgszlxN9RZTFW9w==") returned 232 [0097.122] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2c, wMilliseconds=0x183)) [0097.122] GetCurrentThreadId () returned 0x970 [0097.122] GetCurrentThreadId () returned 0x970 [0097.122] GetCurrentThreadId () returned 0x970 [0097.122] GetCurrentThreadId () returned 0x970 [0097.122] GetCurrentThreadId () returned 0x970 [0097.122] GetCurrentThreadId () returned 0x970 [0097.122] GetCurrentThreadId () returned 0x970 [0097.122] GetCurrentThreadId () returned 0x970 [0097.122] GetCurrentThreadId () returned 0x970 [0097.122] GetCurrentThreadId () returned 0x970 [0097.122] GetCurrentThreadId () returned 0x970 [0097.122] GetCurrentThreadId () returned 0x970 [0097.123] GetCurrentThreadId () returned 0x970 [0097.123] GetCurrentThreadId () returned 0x970 [0097.123] GetCurrentThreadId () returned 0x970 [0097.123] GetCurrentThreadId () returned 0x970 [0097.123] GetCurrentThreadId () returned 0x970 [0097.123] GetCurrentThreadId () returned 0x970 [0097.123] GetCurrentThreadId () returned 0x970 [0097.123] GetCurrentThreadId () returned 0x970 [0097.123] GetCurrentThreadId () returned 0x970 [0097.123] GetCurrentThreadId () returned 0x970 [0097.123] GetCurrentThreadId () returned 0x970 [0097.123] GetCurrentThreadId () returned 0x970 [0097.123] GetCurrentThreadId () returned 0x970 [0097.123] GetCurrentThreadId () returned 0x970 [0097.123] GetCurrentThreadId () returned 0x970 [0097.123] GetCurrentThreadId () returned 0x970 [0097.123] GetCurrentThreadId () returned 0x970 [0097.123] GetCurrentThreadId () returned 0x970 [0097.123] GetCurrentThreadId () returned 0x970 [0097.123] GetCurrentThreadId () returned 0x970 [0097.123] GetCurrentThreadId () returned 0x970 [0097.123] GetCurrentThreadId () returned 0x970 [0097.123] GetCurrentThreadId () returned 0x970 [0097.123] GetCurrentThreadId () returned 0x970 [0097.123] GetCurrentThreadId () returned 0x970 [0097.123] GetCurrentThreadId () returned 0x970 [0097.123] GetCurrentThreadId () returned 0x970 [0097.123] GetCurrentThreadId () returned 0x970 [0097.123] GetCurrentThreadId () returned 0x970 [0097.123] GetCurrentThreadId () returned 0x970 [0097.123] GetCurrentThreadId () returned 0x970 [0097.123] GetCurrentThreadId () returned 0x970 [0097.123] GetCurrentThreadId () returned 0x970 [0097.123] GetCurrentThreadId () returned 0x970 [0097.123] GetCurrentThreadId () returned 0x970 [0097.123] GetCurrentThreadId () returned 0x970 [0097.123] GetCurrentThreadId () returned 0x970 [0097.123] GetCurrentThreadId () returned 0x970 [0097.123] GetCurrentThreadId () returned 0x970 [0097.123] GetCurrentThreadId () returned 0x970 [0097.124] GetCurrentThreadId () returned 0x970 [0097.124] GetCurrentThreadId () returned 0x970 [0097.124] GetCurrentThreadId () returned 0x970 [0097.124] GetCurrentThreadId () returned 0x970 [0097.124] GetCurrentThreadId () returned 0x970 [0097.124] GetCurrentThreadId () returned 0x970 [0097.124] GetCurrentThreadId () returned 0x970 [0097.124] GetCurrentThreadId () returned 0x970 [0097.124] GetCurrentThreadId () returned 0x970 [0097.124] GetCurrentThreadId () returned 0x970 [0097.124] GetCurrentThreadId () returned 0x970 [0097.124] GetCurrentThreadId () returned 0x970 [0097.124] GetCurrentThreadId () returned 0x970 [0097.124] GetCurrentThreadId () returned 0x970 [0097.124] GetCurrentThreadId () returned 0x970 [0097.124] GetCurrentThreadId () returned 0x970 [0097.124] GetCurrentThreadId () returned 0x970 [0097.124] GetCurrentThreadId () returned 0x970 [0097.124] GetCurrentThreadId () returned 0x970 [0097.124] GetCurrentThreadId () returned 0x970 [0097.124] GetCurrentThreadId () returned 0x970 [0097.124] GetCurrentThreadId () returned 0x970 [0097.124] GetCurrentThreadId () returned 0x970 [0097.124] GetCurrentThreadId () returned 0x970 [0097.124] GetCurrentThreadId () returned 0x970 [0097.124] GetCurrentThreadId () returned 0x970 [0097.124] GetCurrentThreadId () returned 0x970 [0097.124] GetCurrentThreadId () returned 0x970 [0097.124] GetCurrentThreadId () returned 0x970 [0097.124] GetCurrentThreadId () returned 0x970 [0097.124] GetCurrentThreadId () returned 0x970 [0097.124] GetCurrentThreadId () returned 0x970 [0097.124] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAABptrOJbrPSR2rERurZxkjlocfX0vivHfpEUEdp00pB42ugYQoWDhjWwqxV1TSLJ82QxIzMgkl5QRNTRHNi7XEBVphH96ElsTNIavI/cDhfHMDhNK39cd9bbJ6PP/Fw1ORUdV3hfXySvA3UnH12+CfpVatYtHJw2TntRYgtjjuu6h3fLXG394xR58w9FS6gBDoGSwlVI5RSUcz88+erXgszlxN9RZTFW9w==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0097.124] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAABptrOJbrPSR2rERurZxkjlocfX0vivHfpEUEdp00pB42ugYQoWDhjWwqxV1TSLJ82QxIzMgkl5QRNTRHNi7XEBVphH96ElsTNIavI/cDhfHMDhNK39cd9bbJ6PP/Fw1ORUdV3hfXySvA3UnH12+CfpVatYtHJw2TntRYgtjjuu6h3fLXG394xR58w9FS6gBDoGSwlVI5RSUcz88+erXgszlxN9RZTFW9w==", cchWideChar=245, lpMultiByteStr=0x3b4d08c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAABptrOJbrPSR2rERurZxkjlocfX0vivHfpEUEdp00pB42ugYQoWDhjWwqxV1TSLJ82QxIzMgkl5QRNTRHNi7XEBVphH96ElsTNIavI/cDhfHMDhNK39cd9bbJ6PP/Fw1ORUdV3hfXySvA3UnH12+CfpVatYtHJw2TntRYgtjjuu6h3fLXG394xR58w9FS6gBDoGSwlVI5RSUcz88+erXgszlxN9RZTFW9w==", lpUsedDefaultChar=0x0) returned 245 [0097.124] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0097.125] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0097.125] CloseHandle (hObject=0x158) returned 1 [0097.125] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01293_.gif")) returned 1 [0097.126] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=21738916751) returned 1 [0097.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [WB01294_.GIF].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [wb01294_.gif].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0097.126] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0097.127] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0097.127] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0097.127] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0097.127] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0097.127] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0097.127] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0097.127] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0097.127] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0097.127] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0097.127] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0097.127] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0097.127] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0097.127] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0097.127] SetEndOfFile (hFile=0x158) returned 1 [0097.127] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0097.127] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0097.128] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0097.128] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0097.128] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0097.129] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0097.129] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ku~XpC6M:\"&/L7>9\"/ei^>R?^&gITP62", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0097.129] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ku~XpC6M:\"&/L7>9\"/ei^>R?^&gITP62", cchWideChar=32, lpMultiByteStr=0x203e28c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ku~XpC6M:\"&/L7>9\"/ei^>R?^&gITP62", lpUsedDefaultChar=0x0) returned 32 [0097.129] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0097.129] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0097.129] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0242a00, ftCreationTime.dwHighDateTime=0x1bd4e67, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0242a00, ftLastWriteTime.dwHighDateTime=0x1bd4e67, nFileSizeHigh=0x0, nFileSizeLow=0x2ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01294_.GIF", cAlternateFileName="")) returned 0x295098 [0097.129] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0097.129] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0097.129] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01294_.gif")) returned 0x20 [0097.129] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01294_.gif")) returned 0x20 [0097.129] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01294_.gif")) returned 0x20 [0097.129] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01294_.gif")) returned 0x20 [0097.129] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01294_.gif"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0242a00, ftCreationTime.dwHighDateTime=0x1bd4e67, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0242a00, ftLastWriteTime.dwHighDateTime=0x1bd4e67, nFileSizeHigh=0x0, nFileSizeLow=0x2ad)) returned 1 [0097.129] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0097.129] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0097.130] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01294_.gif")) returned 0x20 [0097.130] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01294_.gif")) returned 0x20 [0097.130] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0097.130] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0097.130] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0097.130] SetEndOfFile (hFile=0x158) returned 1 [0097.131] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01294_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0097.131] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01294_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94d2c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01294_.GIF", lpUsedDefaultChar=0x0) returned 12 [0097.131] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01294_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0097.131] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01294_.GIF", cchWideChar=12, lpMultiByteStr=0x3b949cc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01294_.GIF", lpUsedDefaultChar=0x0) returned 12 [0097.131] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3b949cc, cbMultiByte=12, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="WB01294_.GIFg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0097.131] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01294_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0097.131] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01294_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94d2c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01294_.GIF", lpUsedDefaultChar=0x0) returned 12 [0097.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01294_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0097.131] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0097.131] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2ad [0097.132] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0097.132] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0097.132] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0097.132] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01294_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0097.132] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01294_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94d2c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01294_.GIF", lpUsedDefaultChar=0x0) returned 12 [0097.132] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01294_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0097.132] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01294_.GIF", cchWideChar=12, lpMultiByteStr=0x3b949cc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01294_.GIF", lpUsedDefaultChar=0x0) returned 12 [0097.132] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3b949cc, cbMultiByte=12, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="WB01294_.GIF4_.GIFg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0097.132] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01294_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0097.132] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01294_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94d2c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01294_.GIF", lpUsedDefaultChar=0x0) returned 12 [0097.132] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0097.133] CharToOemA (in: pSrc="WB01294_.GIF", pDst=0x3b949cc | out: pDst="WB01294_.GIF") returned 1 [0097.133] WriteFile (in: hFile=0x158, lpBuffer=0x3b949cc*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x3b949cc*, lpNumberOfBytesWritten=0x18e048*=0xc, lpOverlapped=0x0) returned 1 [0097.133] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0097.133] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0097.133] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0097.133] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=21739683462) returned 1 [0097.133] ReadFile (in: hFile=0x11c, lpBuffer=0x1fc46c0, nNumberOfBytesToRead=0x2ad, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x1fc46c0*, lpNumberOfBytesRead=0x18dd7c*=0x2ad, lpOverlapped=0x0) returned 1 [0097.134] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0097.134] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=21739782938) returned 1 [0097.143] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b450*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b5b450*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0097.143] ReadFile (in: hFile=0x11c, lpBuffer=0x1fc46c0, nNumberOfBytesToRead=0x2ad, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x1fc46c0*, lpNumberOfBytesRead=0x18de38*=0x2ad, lpOverlapped=0x0) returned 1 [0097.143] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x47 [0097.144] WriteFile (in: hFile=0x158, lpBuffer=0x1fc49a0*, nNumberOfBytesToWrite=0x2ad, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1fc49a0*, lpNumberOfBytesWritten=0x18de10*=0x2ad, lpOverlapped=0x0) returned 1 [0097.144] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x2f4 [0097.144] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0097.144] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0097.144] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0097.144] SetFilePointer (in: hFile=0x158, lDistanceToMove=12, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2a [0097.144] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x2fe [0097.144] CloseHandle (hObject=0x11c) returned 1 [0097.144] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x2fe [0097.144] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x2fe [0097.144] SetFilePointer (in: hFile=0x158, lDistanceToMove=766, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x2fe [0097.144] SetFilePointer (in: hFile=0x158, lDistanceToMove=766, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x2fe [0097.144] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x2fe [0097.145] SetFilePointer (in: hFile=0x158, lDistanceToMove=766, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x2fe [0097.145] SetEndOfFile (hFile=0x158) returned 1 [0097.145] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x2fe [0097.145] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x2fe [0097.145] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01294_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0097.145] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01294_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94d2c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01294_.GIF", lpUsedDefaultChar=0x0) returned 12 [0097.145] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01294_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0097.145] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01294_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94dec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01294_.GIF", lpUsedDefaultChar=0x0) returned 12 [0097.145] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3b94dec, cbMultiByte=12, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="WB01294_.GIFꞗ@涤(\x18믉`믑`") returned 12 [0097.145] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01294_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0097.145] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01294_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94d2c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01294_.GIF", lpUsedDefaultChar=0x0) returned 12 [0097.145] WriteFile (in: hFile=0x158, lpBuffer=0x3ad5738*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5738*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0097.145] CharToOemA (in: pSrc="WB01294_.GIF", pDst=0x3b94dec | out: pDst="WB01294_.GIF") returned 1 [0097.145] WriteFile (in: hFile=0x158, lpBuffer=0x3b94dec*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3b94dec*, lpNumberOfBytesWritten=0x18efcc*=0xc, lpOverlapped=0x0) returned 1 [0097.145] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b470*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x3b5b470*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0097.146] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0097.146] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0097.146] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x343 [0097.146] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x343 [0097.146] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0097.146] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0097.146] DeleteFileW (lpFileName="") returned 0 [0097.146] GetLastError () returned 0x3 [0097.146] GetFileAttributesW (lpFileName="") returned 0xffffffff [0097.146] SetLastError (dwErrCode=0x3) [0097.146] FlushFileBuffers (hFile=0x158) returned 1 [0097.148] GetCurrentThreadId () returned 0x970 [0097.148] GetCurrentThreadId () returned 0x970 [0097.148] GetCurrentThreadId () returned 0x970 [0097.148] GetCurrentThreadId () returned 0x970 [0097.148] GetCurrentThreadId () returned 0x970 [0097.148] GetCurrentThreadId () returned 0x970 [0097.148] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x3fa [0097.149] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x3fa [0097.149] SetFilePointer (in: hFile=0x158, lDistanceToMove=1018, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x3fa [0097.149] CloseHandle (hObject=0x158) returned 1 [0097.149] GetCurrentThreadId () returned 0x970 [0097.149] GetCurrentThreadId () returned 0x970 [0097.149] GetCurrentThreadId () returned 0x970 [0097.149] GetCurrentThreadId () returned 0x970 [0097.149] GetCurrentThreadId () returned 0x970 [0097.149] GetCurrentThreadId () returned 0x970 [0097.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [WB01294_.GIF].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [wb01294_.gif].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0097.149] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3fa [0097.149] SetFilePointer (in: hFile=0x158, lDistanceToMove=890, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x37a [0097.149] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0097.149] GetFileType (hFile=0x158) returned 0x1 [0097.149] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2c, wMilliseconds=0x1a2)) [0097.149] GetCurrentThreadId () returned 0x970 [0097.149] GetCurrentThreadId () returned 0x970 [0097.149] GetCurrentThreadId () returned 0x970 [0097.149] GetCurrentThreadId () returned 0x970 [0097.149] GetCurrentThreadId () returned 0x970 [0097.149] GetCurrentThreadId () returned 0x970 [0097.149] GetCurrentThreadId () returned 0x970 [0097.149] GetCurrentThreadId () returned 0x970 [0097.150] GetCurrentThreadId () returned 0x970 [0097.150] GetCurrentThreadId () returned 0x970 [0097.150] GetCurrentThreadId () returned 0x970 [0097.150] GetCurrentThreadId () returned 0x970 [0097.150] GetCurrentThreadId () returned 0x970 [0097.150] GetCurrentThreadId () returned 0x970 [0097.150] GetCurrentThreadId () returned 0x970 [0097.150] GetCurrentThreadId () returned 0x970 [0097.150] GetCurrentThreadId () returned 0x970 [0097.150] GetCurrentThreadId () returned 0x970 [0097.150] GetCurrentThreadId () returned 0x970 [0097.150] GetCurrentThreadId () returned 0x970 [0097.150] GetCurrentThreadId () returned 0x970 [0097.150] GetCurrentThreadId () returned 0x970 [0097.150] GetCurrentThreadId () returned 0x970 [0097.150] GetCurrentThreadId () returned 0x970 [0097.150] GetCurrentThreadId () returned 0x970 [0097.150] GetCurrentThreadId () returned 0x970 [0097.150] GetCurrentThreadId () returned 0x970 [0097.150] GetCurrentThreadId () returned 0x970 [0097.150] GetCurrentThreadId () returned 0x970 [0097.150] GetCurrentThreadId () returned 0x970 [0097.150] GetCurrentThreadId () returned 0x970 [0097.150] GetCurrentThreadId () returned 0x970 [0097.150] GetCurrentThreadId () returned 0x970 [0097.150] GetCurrentThreadId () returned 0x970 [0097.150] GetCurrentThreadId () returned 0x970 [0097.150] GetCurrentThreadId () returned 0x970 [0097.150] GetCurrentThreadId () returned 0x970 [0097.150] GetCurrentThreadId () returned 0x970 [0097.150] GetCurrentThreadId () returned 0x970 [0097.150] GetCurrentThreadId () returned 0x970 [0097.150] GetCurrentThreadId () returned 0x970 [0097.150] GetCurrentThreadId () returned 0x970 [0097.150] GetCurrentThreadId () returned 0x970 [0097.150] GetCurrentThreadId () returned 0x970 [0097.150] GetCurrentThreadId () returned 0x970 [0097.150] GetCurrentThreadId () returned 0x970 [0097.150] GetCurrentThreadId () returned 0x970 [0097.150] GetCurrentThreadId () returned 0x970 [0097.150] GetCurrentThreadId () returned 0x970 [0097.150] GetCurrentThreadId () returned 0x970 [0097.150] GetCurrentThreadId () returned 0x970 [0097.151] GetCurrentThreadId () returned 0x970 [0097.151] GetCurrentThreadId () returned 0x970 [0097.151] GetCurrentThreadId () returned 0x970 [0097.151] GetCurrentThreadId () returned 0x970 [0097.151] GetCurrentThreadId () returned 0x970 [0097.151] GetCurrentThreadId () returned 0x970 [0097.151] GetCurrentThreadId () returned 0x970 [0097.151] GetCurrentThreadId () returned 0x970 [0097.151] GetCurrentThreadId () returned 0x970 [0097.151] GetCurrentThreadId () returned 0x970 [0097.151] GetCurrentThreadId () returned 0x970 [0097.151] GetCurrentThreadId () returned 0x970 [0097.151] GetCurrentThreadId () returned 0x970 [0097.151] GetCurrentThreadId () returned 0x970 [0097.151] GetCurrentThreadId () returned 0x970 [0097.151] GetCurrentThreadId () returned 0x970 [0097.151] GetCurrentThreadId () returned 0x970 [0097.151] GetCurrentThreadId () returned 0x970 [0097.151] GetCurrentThreadId () returned 0x970 [0097.151] GetCurrentThreadId () returned 0x970 [0097.151] GetCurrentThreadId () returned 0x970 [0097.151] GetCurrentThreadId () returned 0x970 [0097.151] GetCurrentThreadId () returned 0x970 [0097.151] GetCurrentThreadId () returned 0x970 [0097.151] GetCurrentThreadId () returned 0x970 [0097.151] GetCurrentThreadId () returned 0x970 [0097.151] GetCurrentThreadId () returned 0x970 [0097.151] GetCurrentThreadId () returned 0x970 [0097.151] GetCurrentThreadId () returned 0x970 [0097.151] GetCurrentThreadId () returned 0x970 [0097.151] GetCurrentThreadId () returned 0x970 [0097.151] GetCurrentThreadId () returned 0x970 [0097.151] GetCurrentThreadId () returned 0x970 [0097.151] GetCurrentThreadId () returned 0x970 [0097.151] GetCurrentThreadId () returned 0x970 [0097.151] GetCurrentThreadId () returned 0x970 [0097.151] GetCurrentThreadId () returned 0x970 [0097.151] GetCurrentThreadId () returned 0x970 [0097.151] GetCurrentThreadId () returned 0x970 [0097.151] GetCurrentThreadId () returned 0x970 [0097.151] GetCurrentThreadId () returned 0x970 [0097.151] GetCurrentThreadId () returned 0x970 [0097.151] GetCurrentThreadId () returned 0x970 [0097.151] GetCurrentThreadId () returned 0x970 [0097.152] GetCurrentThreadId () returned 0x970 [0097.152] GetCurrentThreadId () returned 0x970 [0097.152] GetCurrentThreadId () returned 0x970 [0097.152] GetCurrentThreadId () returned 0x970 [0097.152] GetCurrentThreadId () returned 0x970 [0097.152] GetCurrentThreadId () returned 0x970 [0097.152] GetCurrentThreadId () returned 0x970 [0097.152] GetCurrentThreadId () returned 0x970 [0097.152] GetCurrentThreadId () returned 0x970 [0097.152] GetCurrentThreadId () returned 0x970 [0097.152] GetCurrentThreadId () returned 0x970 [0097.152] GetCurrentThreadId () returned 0x970 [0097.152] GetCurrentThreadId () returned 0x970 [0097.152] GetCurrentThreadId () returned 0x970 [0097.152] GetCurrentThreadId () returned 0x970 [0097.152] GetCurrentThreadId () returned 0x970 [0097.152] GetCurrentThreadId () returned 0x970 [0097.152] GetCurrentThreadId () returned 0x970 [0097.152] GetCurrentThreadId () returned 0x970 [0097.152] GetCurrentThreadId () returned 0x970 [0097.152] GetCurrentThreadId () returned 0x970 [0097.152] GetCurrentThreadId () returned 0x970 [0097.152] GetCurrentThreadId () returned 0x970 [0097.152] GetCurrentThreadId () returned 0x970 [0097.152] GetCurrentThreadId () returned 0x970 [0097.152] GetCurrentThreadId () returned 0x970 [0097.152] GetCurrentThreadId () returned 0x970 [0097.152] GetCurrentThreadId () returned 0x970 [0097.152] GetCurrentThreadId () returned 0x970 [0097.152] GetCurrentThreadId () returned 0x970 [0097.152] GetCurrentThreadId () returned 0x970 [0097.152] GetCurrentThreadId () returned 0x970 [0097.152] GetCurrentThreadId () returned 0x970 [0097.152] GetCurrentThreadId () returned 0x970 [0097.152] GetCurrentThreadId () returned 0x970 [0097.152] GetCurrentThreadId () returned 0x970 [0097.152] GetCurrentThreadId () returned 0x970 [0097.152] GetCurrentThreadId () returned 0x970 [0097.152] GetCurrentThreadId () returned 0x970 [0097.152] GetCurrentThreadId () returned 0x970 [0097.152] GetCurrentThreadId () returned 0x970 [0097.152] GetCurrentThreadId () returned 0x970 [0097.152] GetCurrentThreadId () returned 0x970 [0097.153] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.153] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.153] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b623d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0097.153] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.153] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.153] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b623d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0097.153] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.153] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.153] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b548, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0097.153] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.153] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.153] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b548, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0097.153] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.153] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.153] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b62430, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0097.153] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.153] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.153] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b62430, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0097.153] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.153] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.153] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b62430, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0097.153] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2c, wMilliseconds=0x1a2)) [0097.153] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ku~XpC6M:\"&/L7>9\"/ei^>R?^&gITP62", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0097.153] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ku~XpC6M:\"&/L7>9\"/ei^>R?^&gITP62", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0097.153] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ku~XpC6M:\"&/L7>9\"/ei^>R?^&gITP62", cchWideChar=32, lpMultiByteStr=0x3b57ff8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ku~XpC6M:\"&/L7>9\"/ei^>R?^&gITP62", lpUsedDefaultChar=0x0) returned 32 [0097.153] GetCurrentThreadId () returned 0x970 [0097.153] GetCurrentThreadId () returned 0x970 [0097.153] GetCurrentThreadId () returned 0x970 [0097.153] GetCurrentThreadId () returned 0x970 [0097.153] GetCurrentThreadId () returned 0x970 [0097.154] GetCurrentThreadId () returned 0x970 [0097.161] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0097.161] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0097.162] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3b16708, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0097.162] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0097.162] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAC+H0KBinq2MlCy5fbyZFCP7DI8xt4ahZsiSSNlkg+KQbXf7h6rxK9pamJVhvorz2k9F2yFJjujNreLAH8ME/Zf0udDKeo08bFOUtPPoF9RxuH8S8EzZZQGbPHvnaeoFu1aV0yPajDoWz0QHZlFbNtZhT0Q2oHWAQkU7gmPhcJ7GkCc8DD+Iay1ejUixn7AmuC0CL8S8QCljJjGQb2D6StabV6PWe/MySQ==") returned 232 [0097.162] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2c, wMilliseconds=0x1b2)) [0097.162] GetCurrentThreadId () returned 0x970 [0097.162] GetCurrentThreadId () returned 0x970 [0097.162] GetCurrentThreadId () returned 0x970 [0097.162] GetCurrentThreadId () returned 0x970 [0097.162] GetCurrentThreadId () returned 0x970 [0097.162] GetCurrentThreadId () returned 0x970 [0097.162] GetCurrentThreadId () returned 0x970 [0097.162] GetCurrentThreadId () returned 0x970 [0097.162] GetCurrentThreadId () returned 0x970 [0097.162] GetCurrentThreadId () returned 0x970 [0097.162] GetCurrentThreadId () returned 0x970 [0097.162] GetCurrentThreadId () returned 0x970 [0097.162] GetCurrentThreadId () returned 0x970 [0097.162] GetCurrentThreadId () returned 0x970 [0097.162] GetCurrentThreadId () returned 0x970 [0097.162] GetCurrentThreadId () returned 0x970 [0097.162] GetCurrentThreadId () returned 0x970 [0097.162] GetCurrentThreadId () returned 0x970 [0097.162] GetCurrentThreadId () returned 0x970 [0097.162] GetCurrentThreadId () returned 0x970 [0097.162] GetCurrentThreadId () returned 0x970 [0097.162] GetCurrentThreadId () returned 0x970 [0097.162] GetCurrentThreadId () returned 0x970 [0097.162] GetCurrentThreadId () returned 0x970 [0097.162] GetCurrentThreadId () returned 0x970 [0097.162] GetCurrentThreadId () returned 0x970 [0097.162] GetCurrentThreadId () returned 0x970 [0097.162] GetCurrentThreadId () returned 0x970 [0097.162] GetCurrentThreadId () returned 0x970 [0097.162] GetCurrentThreadId () returned 0x970 [0097.162] GetCurrentThreadId () returned 0x970 [0097.162] GetCurrentThreadId () returned 0x970 [0097.162] GetCurrentThreadId () returned 0x970 [0097.162] GetCurrentThreadId () returned 0x970 [0097.162] GetCurrentThreadId () returned 0x970 [0097.162] GetCurrentThreadId () returned 0x970 [0097.162] GetCurrentThreadId () returned 0x970 [0097.162] GetCurrentThreadId () returned 0x970 [0097.163] GetCurrentThreadId () returned 0x970 [0097.163] GetCurrentThreadId () returned 0x970 [0097.163] GetCurrentThreadId () returned 0x970 [0097.163] GetCurrentThreadId () returned 0x970 [0097.163] GetCurrentThreadId () returned 0x970 [0097.163] GetCurrentThreadId () returned 0x970 [0097.163] GetCurrentThreadId () returned 0x970 [0097.163] GetCurrentThreadId () returned 0x970 [0097.163] GetCurrentThreadId () returned 0x970 [0097.163] GetCurrentThreadId () returned 0x970 [0097.163] GetCurrentThreadId () returned 0x970 [0097.163] GetCurrentThreadId () returned 0x970 [0097.163] GetCurrentThreadId () returned 0x970 [0097.163] GetCurrentThreadId () returned 0x970 [0097.163] GetCurrentThreadId () returned 0x970 [0097.163] GetCurrentThreadId () returned 0x970 [0097.163] GetCurrentThreadId () returned 0x970 [0097.163] GetCurrentThreadId () returned 0x970 [0097.163] GetCurrentThreadId () returned 0x970 [0097.163] GetCurrentThreadId () returned 0x970 [0097.163] GetCurrentThreadId () returned 0x970 [0097.163] GetCurrentThreadId () returned 0x970 [0097.163] GetCurrentThreadId () returned 0x970 [0097.163] GetCurrentThreadId () returned 0x970 [0097.163] GetCurrentThreadId () returned 0x970 [0097.163] GetCurrentThreadId () returned 0x970 [0097.163] GetCurrentThreadId () returned 0x970 [0097.163] GetCurrentThreadId () returned 0x970 [0097.163] GetCurrentThreadId () returned 0x970 [0097.163] GetCurrentThreadId () returned 0x970 [0097.163] GetCurrentThreadId () returned 0x970 [0097.163] GetCurrentThreadId () returned 0x970 [0097.163] GetCurrentThreadId () returned 0x970 [0097.163] GetCurrentThreadId () returned 0x970 [0097.163] GetCurrentThreadId () returned 0x970 [0097.163] GetCurrentThreadId () returned 0x970 [0097.163] GetCurrentThreadId () returned 0x970 [0097.163] GetCurrentThreadId () returned 0x970 [0097.163] GetCurrentThreadId () returned 0x970 [0097.163] GetCurrentThreadId () returned 0x970 [0097.163] GetCurrentThreadId () returned 0x970 [0097.163] GetCurrentThreadId () returned 0x970 [0097.164] GetCurrentThreadId () returned 0x970 [0097.164] GetCurrentThreadId () returned 0x970 [0097.164] GetCurrentThreadId () returned 0x970 [0097.164] GetCurrentThreadId () returned 0x970 [0097.164] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAC+H0KBinq2MlCy5fbyZFCP7DI8xt4ahZsiSSNlkg+KQbXf7h6rxK9pamJVhvorz2k9F2yFJjujNreLAH8ME/Zf0udDKeo08bFOUtPPoF9RxuH8S8EzZZQGbPHvnaeoFu1aV0yPajDoWz0QHZlFbNtZhT0Q2oHWAQkU7gmPhcJ7GkCc8DD+Iay1ejUixn7AmuC0CL8S8QCljJjGQb2D6StabV6PWe/MySQ==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0097.164] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAC+H0KBinq2MlCy5fbyZFCP7DI8xt4ahZsiSSNlkg+KQbXf7h6rxK9pamJVhvorz2k9F2yFJjujNreLAH8ME/Zf0udDKeo08bFOUtPPoF9RxuH8S8EzZZQGbPHvnaeoFu1aV0yPajDoWz0QHZlFbNtZhT0Q2oHWAQkU7gmPhcJ7GkCc8DD+Iay1ejUixn7AmuC0CL8S8QCljJjGQb2D6StabV6PWe/MySQ==", cchWideChar=245, lpMultiByteStr=0x3b4d08c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAC+H0KBinq2MlCy5fbyZFCP7DI8xt4ahZsiSSNlkg+KQbXf7h6rxK9pamJVhvorz2k9F2yFJjujNreLAH8ME/Zf0udDKeo08bFOUtPPoF9RxuH8S8EzZZQGbPHvnaeoFu1aV0yPajDoWz0QHZlFbNtZhT0Q2oHWAQkU7gmPhcJ7GkCc8DD+Iay1ejUixn7AmuC0CL8S8QCljJjGQb2D6StabV6PWe/MySQ==", lpUsedDefaultChar=0x0) returned 245 [0097.164] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0097.164] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0097.164] CloseHandle (hObject=0x158) returned 1 [0097.164] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01294_.gif")) returned 1 [0097.165] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=21742844507) returned 1 [0097.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [WB01295_.GIF].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [wb01295_.gif].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0097.166] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0097.166] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0097.166] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0097.166] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0097.166] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0097.166] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0097.166] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0097.166] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0097.166] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0097.166] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0097.166] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0097.166] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0097.167] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0097.167] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0097.167] SetEndOfFile (hFile=0x158) returned 1 [0097.167] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0097.167] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0097.167] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0097.167] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0097.167] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0097.168] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0097.168] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-BEkdp@IL@qJg%Cer$?07@fe$Kus~E2U", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0097.168] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-BEkdp@IL@qJg%Cer$?07@fe$Kus~E2U", cchWideChar=32, lpMultiByteStr=0x203e2c4, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-BEkdp@IL@qJg%Cer$?07@fe$Kus~E2U", lpUsedDefaultChar=0x0) returned 32 [0097.168] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0097.168] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0097.168] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3725d200, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3725d200, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x161, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01295_.GIF", cAlternateFileName="")) returned 0x295098 [0097.168] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0097.168] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0097.168] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01295_.gif")) returned 0x20 [0097.169] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01295_.gif")) returned 0x20 [0097.169] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01295_.gif")) returned 0x20 [0097.169] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01295_.gif")) returned 0x20 [0097.169] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01295_.gif"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3725d200, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3725d200, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x161)) returned 1 [0097.169] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0097.169] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0097.169] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01295_.gif")) returned 0x20 [0097.169] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01295_.gif")) returned 0x20 [0097.169] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0097.169] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0097.169] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0097.169] SetEndOfFile (hFile=0x158) returned 1 [0097.170] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01295_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0097.170] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01295_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94a4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01295_.GIF", lpUsedDefaultChar=0x0) returned 12 [0097.170] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01295_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0097.170] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01295_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94d0c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01295_.GIF", lpUsedDefaultChar=0x0) returned 12 [0097.170] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3b94d0c, cbMultiByte=12, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="WB01295_.GIFg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0097.170] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01295_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0097.170] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01295_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94a4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01295_.GIF", lpUsedDefaultChar=0x0) returned 12 [0097.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01295_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0097.171] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0097.171] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x161 [0097.171] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0097.171] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0097.171] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0097.171] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01295_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0097.171] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01295_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94a4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01295_.GIF", lpUsedDefaultChar=0x0) returned 12 [0097.171] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01295_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0097.171] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01295_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94d0c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01295_.GIF", lpUsedDefaultChar=0x0) returned 12 [0097.171] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3b94d0c, cbMultiByte=12, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="WB01295_.GIF5_.GIFg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0097.171] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01295_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0097.171] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01295_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94a4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01295_.GIF", lpUsedDefaultChar=0x0) returned 12 [0097.171] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0097.172] CharToOemA (in: pSrc="WB01295_.GIF", pDst=0x3b94d0c | out: pDst="WB01295_.GIF") returned 1 [0097.172] WriteFile (in: hFile=0x158, lpBuffer=0x3b94d0c*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x3b94d0c*, lpNumberOfBytesWritten=0x18e048*=0xc, lpOverlapped=0x0) returned 1 [0097.172] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0097.173] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0097.173] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0097.173] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=21743618117) returned 1 [0097.173] ReadFile (in: hFile=0x11c, lpBuffer=0x3b0ab00, nNumberOfBytesToRead=0x161, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b0ab00*, lpNumberOfBytesRead=0x18dd7c*=0x161, lpOverlapped=0x0) returned 1 [0097.174] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0097.174] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=21743716480) returned 1 [0097.182] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b438*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b5b438*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0097.182] ReadFile (in: hFile=0x11c, lpBuffer=0x3b0ab00, nNumberOfBytesToRead=0x161, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3b0ab00*, lpNumberOfBytesRead=0x18de38*=0x161, lpOverlapped=0x0) returned 1 [0097.183] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x47 [0097.183] WriteFile (in: hFile=0x158, lpBuffer=0x3b0ac80*, nNumberOfBytesToWrite=0x161, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3b0ac80*, lpNumberOfBytesWritten=0x18de10*=0x161, lpOverlapped=0x0) returned 1 [0097.183] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x1a8 [0097.183] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0097.183] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0097.183] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0097.183] SetFilePointer (in: hFile=0x158, lDistanceToMove=12, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2a [0097.183] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x1b2 [0097.183] CloseHandle (hObject=0x11c) returned 1 [0097.183] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1b2 [0097.183] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1b2 [0097.183] SetFilePointer (in: hFile=0x158, lDistanceToMove=434, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1b2 [0097.183] SetFilePointer (in: hFile=0x158, lDistanceToMove=434, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x1b2 [0097.183] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1b2 [0097.184] SetFilePointer (in: hFile=0x158, lDistanceToMove=434, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x1b2 [0097.184] SetEndOfFile (hFile=0x158) returned 1 [0097.184] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1b2 [0097.184] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x1b2 [0097.184] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01295_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0097.184] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01295_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94a4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01295_.GIF", lpUsedDefaultChar=0x0) returned 12 [0097.184] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01295_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0097.184] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01295_.GIF", cchWideChar=12, lpMultiByteStr=0x3b9498c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01295_.GIF", lpUsedDefaultChar=0x0) returned 12 [0097.184] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3b9498c, cbMultiByte=12, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="WB01295_.GIFꞗ@涤(\x18믉`믑`") returned 12 [0097.184] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01295_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0097.184] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01295_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94a4c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01295_.GIF", lpUsedDefaultChar=0x0) returned 12 [0097.184] WriteFile (in: hFile=0x158, lpBuffer=0x3ad5738*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5738*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0097.184] CharToOemA (in: pSrc="WB01295_.GIF", pDst=0x3b9498c | out: pDst="WB01295_.GIF") returned 1 [0097.184] WriteFile (in: hFile=0x158, lpBuffer=0x3b9498c*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3b9498c*, lpNumberOfBytesWritten=0x18efcc*=0xc, lpOverlapped=0x0) returned 1 [0097.184] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b350*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x3b5b350*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0097.184] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0097.185] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0097.185] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1f7 [0097.185] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x1f7 [0097.185] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0097.185] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0097.185] DeleteFileW (lpFileName="") returned 0 [0097.185] GetLastError () returned 0x3 [0097.185] GetFileAttributesW (lpFileName="") returned 0xffffffff [0097.185] SetLastError (dwErrCode=0x3) [0097.185] FlushFileBuffers (hFile=0x158) returned 1 [0097.187] GetCurrentThreadId () returned 0x970 [0097.187] GetCurrentThreadId () returned 0x970 [0097.187] GetCurrentThreadId () returned 0x970 [0097.187] GetCurrentThreadId () returned 0x970 [0097.187] GetCurrentThreadId () returned 0x970 [0097.187] GetCurrentThreadId () returned 0x970 [0097.187] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x2ae [0097.188] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x2ae [0097.188] SetFilePointer (in: hFile=0x158, lDistanceToMove=686, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x2ae [0097.188] CloseHandle (hObject=0x158) returned 1 [0097.188] GetCurrentThreadId () returned 0x970 [0097.188] GetCurrentThreadId () returned 0x970 [0097.188] GetCurrentThreadId () returned 0x970 [0097.188] GetCurrentThreadId () returned 0x970 [0097.188] GetCurrentThreadId () returned 0x970 [0097.188] GetCurrentThreadId () returned 0x970 [0097.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [WB01295_.GIF].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [wb01295_.gif].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0097.188] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2ae [0097.188] SetFilePointer (in: hFile=0x158, lDistanceToMove=558, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x22e [0097.188] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0097.188] GetFileType (hFile=0x158) returned 0x1 [0097.188] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2c, wMilliseconds=0x1d1)) [0097.188] GetCurrentThreadId () returned 0x970 [0097.188] GetCurrentThreadId () returned 0x970 [0097.188] GetCurrentThreadId () returned 0x970 [0097.188] GetCurrentThreadId () returned 0x970 [0097.188] GetCurrentThreadId () returned 0x970 [0097.188] GetCurrentThreadId () returned 0x970 [0097.188] GetCurrentThreadId () returned 0x970 [0097.188] GetCurrentThreadId () returned 0x970 [0097.188] GetCurrentThreadId () returned 0x970 [0097.188] GetCurrentThreadId () returned 0x970 [0097.189] GetCurrentThreadId () returned 0x970 [0097.189] GetCurrentThreadId () returned 0x970 [0097.189] GetCurrentThreadId () returned 0x970 [0097.189] GetCurrentThreadId () returned 0x970 [0097.189] GetCurrentThreadId () returned 0x970 [0097.189] GetCurrentThreadId () returned 0x970 [0097.189] GetCurrentThreadId () returned 0x970 [0097.189] GetCurrentThreadId () returned 0x970 [0097.189] GetCurrentThreadId () returned 0x970 [0097.189] GetCurrentThreadId () returned 0x970 [0097.189] GetCurrentThreadId () returned 0x970 [0097.189] GetCurrentThreadId () returned 0x970 [0097.189] GetCurrentThreadId () returned 0x970 [0097.189] GetCurrentThreadId () returned 0x970 [0097.189] GetCurrentThreadId () returned 0x970 [0097.189] GetCurrentThreadId () returned 0x970 [0097.189] GetCurrentThreadId () returned 0x970 [0097.189] GetCurrentThreadId () returned 0x970 [0097.189] GetCurrentThreadId () returned 0x970 [0097.189] GetCurrentThreadId () returned 0x970 [0097.189] GetCurrentThreadId () returned 0x970 [0097.189] GetCurrentThreadId () returned 0x970 [0097.189] GetCurrentThreadId () returned 0x970 [0097.189] GetCurrentThreadId () returned 0x970 [0097.189] GetCurrentThreadId () returned 0x970 [0097.189] GetCurrentThreadId () returned 0x970 [0097.189] GetCurrentThreadId () returned 0x970 [0097.189] GetCurrentThreadId () returned 0x970 [0097.189] GetCurrentThreadId () returned 0x970 [0097.189] GetCurrentThreadId () returned 0x970 [0097.189] GetCurrentThreadId () returned 0x970 [0097.189] GetCurrentThreadId () returned 0x970 [0097.189] GetCurrentThreadId () returned 0x970 [0097.189] GetCurrentThreadId () returned 0x970 [0097.189] GetCurrentThreadId () returned 0x970 [0097.189] GetCurrentThreadId () returned 0x970 [0097.189] GetCurrentThreadId () returned 0x970 [0097.189] GetCurrentThreadId () returned 0x970 [0097.189] GetCurrentThreadId () returned 0x970 [0097.189] GetCurrentThreadId () returned 0x970 [0097.189] GetCurrentThreadId () returned 0x970 [0097.189] GetCurrentThreadId () returned 0x970 [0097.189] GetCurrentThreadId () returned 0x970 [0097.189] GetCurrentThreadId () returned 0x970 [0097.189] GetCurrentThreadId () returned 0x970 [0097.190] GetCurrentThreadId () returned 0x970 [0097.190] GetCurrentThreadId () returned 0x970 [0097.190] GetCurrentThreadId () returned 0x970 [0097.190] GetCurrentThreadId () returned 0x970 [0097.190] GetCurrentThreadId () returned 0x970 [0097.190] GetCurrentThreadId () returned 0x970 [0097.190] GetCurrentThreadId () returned 0x970 [0097.190] GetCurrentThreadId () returned 0x970 [0097.190] GetCurrentThreadId () returned 0x970 [0097.190] GetCurrentThreadId () returned 0x970 [0097.190] GetCurrentThreadId () returned 0x970 [0097.190] GetCurrentThreadId () returned 0x970 [0097.190] GetCurrentThreadId () returned 0x970 [0097.190] GetCurrentThreadId () returned 0x970 [0097.190] GetCurrentThreadId () returned 0x970 [0097.190] GetCurrentThreadId () returned 0x970 [0097.190] GetCurrentThreadId () returned 0x970 [0097.190] GetCurrentThreadId () returned 0x970 [0097.190] GetCurrentThreadId () returned 0x970 [0097.190] GetCurrentThreadId () returned 0x970 [0097.190] GetCurrentThreadId () returned 0x970 [0097.190] GetCurrentThreadId () returned 0x970 [0097.190] GetCurrentThreadId () returned 0x970 [0097.190] GetCurrentThreadId () returned 0x970 [0097.190] GetCurrentThreadId () returned 0x970 [0097.190] GetCurrentThreadId () returned 0x970 [0097.190] GetCurrentThreadId () returned 0x970 [0097.190] GetCurrentThreadId () returned 0x970 [0097.190] GetCurrentThreadId () returned 0x970 [0097.190] GetCurrentThreadId () returned 0x970 [0097.190] GetCurrentThreadId () returned 0x970 [0097.190] GetCurrentThreadId () returned 0x970 [0097.190] GetCurrentThreadId () returned 0x970 [0097.190] GetCurrentThreadId () returned 0x970 [0097.190] GetCurrentThreadId () returned 0x970 [0097.190] GetCurrentThreadId () returned 0x970 [0097.190] GetCurrentThreadId () returned 0x970 [0097.190] GetCurrentThreadId () returned 0x970 [0097.190] GetCurrentThreadId () returned 0x970 [0097.190] GetCurrentThreadId () returned 0x970 [0097.190] GetCurrentThreadId () returned 0x970 [0097.190] GetCurrentThreadId () returned 0x970 [0097.190] GetCurrentThreadId () returned 0x970 [0097.190] GetCurrentThreadId () returned 0x970 [0097.191] GetCurrentThreadId () returned 0x970 [0097.191] GetCurrentThreadId () returned 0x970 [0097.191] GetCurrentThreadId () returned 0x970 [0097.191] GetCurrentThreadId () returned 0x970 [0097.191] GetCurrentThreadId () returned 0x970 [0097.191] GetCurrentThreadId () returned 0x970 [0097.191] GetCurrentThreadId () returned 0x970 [0097.191] GetCurrentThreadId () returned 0x970 [0097.191] GetCurrentThreadId () returned 0x970 [0097.191] GetCurrentThreadId () returned 0x970 [0097.191] GetCurrentThreadId () returned 0x970 [0097.191] GetCurrentThreadId () returned 0x970 [0097.191] GetCurrentThreadId () returned 0x970 [0097.191] GetCurrentThreadId () returned 0x970 [0097.191] GetCurrentThreadId () returned 0x970 [0097.191] GetCurrentThreadId () returned 0x970 [0097.191] GetCurrentThreadId () returned 0x970 [0097.191] GetCurrentThreadId () returned 0x970 [0097.191] GetCurrentThreadId () returned 0x970 [0097.191] GetCurrentThreadId () returned 0x970 [0097.191] GetCurrentThreadId () returned 0x970 [0097.191] GetCurrentThreadId () returned 0x970 [0097.191] GetCurrentThreadId () returned 0x970 [0097.191] GetCurrentThreadId () returned 0x970 [0097.191] GetCurrentThreadId () returned 0x970 [0097.191] GetCurrentThreadId () returned 0x970 [0097.191] GetCurrentThreadId () returned 0x970 [0097.191] GetCurrentThreadId () returned 0x970 [0097.191] GetCurrentThreadId () returned 0x970 [0097.191] GetCurrentThreadId () returned 0x970 [0097.191] GetCurrentThreadId () returned 0x970 [0097.191] GetCurrentThreadId () returned 0x970 [0097.191] GetCurrentThreadId () returned 0x970 [0097.191] GetCurrentThreadId () returned 0x970 [0097.191] GetCurrentThreadId () returned 0x970 [0097.191] GetCurrentThreadId () returned 0x970 [0097.191] GetCurrentThreadId () returned 0x970 [0097.191] GetCurrentThreadId () returned 0x970 [0097.191] GetCurrentThreadId () returned 0x970 [0097.191] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.191] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.191] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b62430, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0097.191] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.192] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.192] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b62430, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0097.192] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.192] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.192] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b530, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0097.192] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.192] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.192] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b530, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0097.192] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.192] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.192] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b62490, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0097.192] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.192] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.192] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b62490, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0097.192] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.192] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.192] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b62490, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0097.192] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2c, wMilliseconds=0x1d1)) [0097.192] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="-BEkdp@IL@qJg%Cer$?07@fe$Kus~E2U", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0097.192] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="-BEkdp@IL@qJg%Cer$?07@fe$Kus~E2U", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0097.192] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="-BEkdp@IL@qJg%Cer$?07@fe$Kus~E2U", cchWideChar=32, lpMultiByteStr=0x3b58028, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-BEkdp@IL@qJg%Cer$?07@fe$Kus~E2U", lpUsedDefaultChar=0x0) returned 32 [0097.192] GetCurrentThreadId () returned 0x970 [0097.192] GetCurrentThreadId () returned 0x970 [0097.192] GetCurrentThreadId () returned 0x970 [0097.192] GetCurrentThreadId () returned 0x970 [0097.192] GetCurrentThreadId () returned 0x970 [0097.192] GetCurrentThreadId () returned 0x970 [0097.200] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0097.200] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0097.200] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3b167f8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0097.200] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0097.200] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAHXLossNsHGWHdczeOjI6Yv5AWCvoRgD/wfGXFAIKwmb28OGHMst75JJ9wpshBRRX+BNuv6ISj5BBJBKGRRm4s7YIpgrVW4wZFaHTBthjD7i9ZUcPz0gNJtRDukEPIt2YZ+808FK8qHQXMUE8qtIxNo6Bmy0fyZmQhlUJbu2leUyjhHPs/vqTDiYcU4kugeiw15lUsReRqKLUdg8TWa1cLA+kZ6ES0mGlw==") returned 232 [0097.200] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2c, wMilliseconds=0x1d1)) [0097.200] GetCurrentThreadId () returned 0x970 [0097.200] GetCurrentThreadId () returned 0x970 [0097.200] GetCurrentThreadId () returned 0x970 [0097.200] GetCurrentThreadId () returned 0x970 [0097.200] GetCurrentThreadId () returned 0x970 [0097.200] GetCurrentThreadId () returned 0x970 [0097.200] GetCurrentThreadId () returned 0x970 [0097.200] GetCurrentThreadId () returned 0x970 [0097.200] GetCurrentThreadId () returned 0x970 [0097.200] GetCurrentThreadId () returned 0x970 [0097.200] GetCurrentThreadId () returned 0x970 [0097.200] GetCurrentThreadId () returned 0x970 [0097.200] GetCurrentThreadId () returned 0x970 [0097.200] GetCurrentThreadId () returned 0x970 [0097.200] GetCurrentThreadId () returned 0x970 [0097.200] GetCurrentThreadId () returned 0x970 [0097.200] GetCurrentThreadId () returned 0x970 [0097.200] GetCurrentThreadId () returned 0x970 [0097.200] GetCurrentThreadId () returned 0x970 [0097.200] GetCurrentThreadId () returned 0x970 [0097.200] GetCurrentThreadId () returned 0x970 [0097.200] GetCurrentThreadId () returned 0x970 [0097.201] GetCurrentThreadId () returned 0x970 [0097.201] GetCurrentThreadId () returned 0x970 [0097.201] GetCurrentThreadId () returned 0x970 [0097.201] GetCurrentThreadId () returned 0x970 [0097.201] GetCurrentThreadId () returned 0x970 [0097.201] GetCurrentThreadId () returned 0x970 [0097.201] GetCurrentThreadId () returned 0x970 [0097.201] GetCurrentThreadId () returned 0x970 [0097.201] GetCurrentThreadId () returned 0x970 [0097.201] GetCurrentThreadId () returned 0x970 [0097.201] GetCurrentThreadId () returned 0x970 [0097.201] GetCurrentThreadId () returned 0x970 [0097.201] GetCurrentThreadId () returned 0x970 [0097.201] GetCurrentThreadId () returned 0x970 [0097.201] GetCurrentThreadId () returned 0x970 [0097.201] GetCurrentThreadId () returned 0x970 [0097.201] GetCurrentThreadId () returned 0x970 [0097.201] GetCurrentThreadId () returned 0x970 [0097.201] GetCurrentThreadId () returned 0x970 [0097.201] GetCurrentThreadId () returned 0x970 [0097.201] GetCurrentThreadId () returned 0x970 [0097.201] GetCurrentThreadId () returned 0x970 [0097.201] GetCurrentThreadId () returned 0x970 [0097.201] GetCurrentThreadId () returned 0x970 [0097.201] GetCurrentThreadId () returned 0x970 [0097.201] GetCurrentThreadId () returned 0x970 [0097.201] GetCurrentThreadId () returned 0x970 [0097.201] GetCurrentThreadId () returned 0x970 [0097.201] GetCurrentThreadId () returned 0x970 [0097.201] GetCurrentThreadId () returned 0x970 [0097.201] GetCurrentThreadId () returned 0x970 [0097.201] GetCurrentThreadId () returned 0x970 [0097.201] GetCurrentThreadId () returned 0x970 [0097.201] GetCurrentThreadId () returned 0x970 [0097.201] GetCurrentThreadId () returned 0x970 [0097.201] GetCurrentThreadId () returned 0x970 [0097.201] GetCurrentThreadId () returned 0x970 [0097.201] GetCurrentThreadId () returned 0x970 [0097.201] GetCurrentThreadId () returned 0x970 [0097.201] GetCurrentThreadId () returned 0x970 [0097.201] GetCurrentThreadId () returned 0x970 [0097.201] GetCurrentThreadId () returned 0x970 [0097.202] GetCurrentThreadId () returned 0x970 [0097.202] GetCurrentThreadId () returned 0x970 [0097.202] GetCurrentThreadId () returned 0x970 [0097.202] GetCurrentThreadId () returned 0x970 [0097.202] GetCurrentThreadId () returned 0x970 [0097.202] GetCurrentThreadId () returned 0x970 [0097.202] GetCurrentThreadId () returned 0x970 [0097.202] GetCurrentThreadId () returned 0x970 [0097.202] GetCurrentThreadId () returned 0x970 [0097.202] GetCurrentThreadId () returned 0x970 [0097.202] GetCurrentThreadId () returned 0x970 [0097.202] GetCurrentThreadId () returned 0x970 [0097.202] GetCurrentThreadId () returned 0x970 [0097.202] GetCurrentThreadId () returned 0x970 [0097.202] GetCurrentThreadId () returned 0x970 [0097.202] GetCurrentThreadId () returned 0x970 [0097.202] GetCurrentThreadId () returned 0x970 [0097.202] GetCurrentThreadId () returned 0x970 [0097.202] GetCurrentThreadId () returned 0x970 [0097.202] GetCurrentThreadId () returned 0x970 [0097.202] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAHXLossNsHGWHdczeOjI6Yv5AWCvoRgD/wfGXFAIKwmb28OGHMst75JJ9wpshBRRX+BNuv6ISj5BBJBKGRRm4s7YIpgrVW4wZFaHTBthjD7i9ZUcPz0gNJtRDukEPIt2YZ+808FK8qHQXMUE8qtIxNo6Bmy0fyZmQhlUJbu2leUyjhHPs/vqTDiYcU4kugeiw15lUsReRqKLUdg8TWa1cLA+kZ6ES0mGlw==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0097.202] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAHXLossNsHGWHdczeOjI6Yv5AWCvoRgD/wfGXFAIKwmb28OGHMst75JJ9wpshBRRX+BNuv6ISj5BBJBKGRRm4s7YIpgrVW4wZFaHTBthjD7i9ZUcPz0gNJtRDukEPIt2YZ+808FK8qHQXMUE8qtIxNo6Bmy0fyZmQhlUJbu2leUyjhHPs/vqTDiYcU4kugeiw15lUsReRqKLUdg8TWa1cLA+kZ6ES0mGlw==", cchWideChar=245, lpMultiByteStr=0x3b4d08c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAHXLossNsHGWHdczeOjI6Yv5AWCvoRgD/wfGXFAIKwmb28OGHMst75JJ9wpshBRRX+BNuv6ISj5BBJBKGRRm4s7YIpgrVW4wZFaHTBthjD7i9ZUcPz0gNJtRDukEPIt2YZ+808FK8qHQXMUE8qtIxNo6Bmy0fyZmQhlUJbu2leUyjhHPs/vqTDiYcU4kugeiw15lUsReRqKLUdg8TWa1cLA+kZ6ES0mGlw==", lpUsedDefaultChar=0x0) returned 245 [0097.202] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0097.202] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0097.202] CloseHandle (hObject=0x158) returned 1 [0097.202] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01295_.gif")) returned 1 [0097.203] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=21746684016) returned 1 [0097.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [WB01296_.GIF].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [wb01296_.gif].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0097.204] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0097.204] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0097.204] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0097.204] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0097.204] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0097.204] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0097.204] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0097.204] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0097.205] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0097.205] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0097.205] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0097.205] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0097.205] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0097.205] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0097.205] SetEndOfFile (hFile=0x158) returned 1 [0097.205] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0097.205] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0097.205] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0097.205] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0097.205] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0097.206] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0097.206] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=">Y6L0%=(Q&ApE.S+{CNFuK$UbtrwD.If", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0097.206] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=">Y6L0%=(Q&ApE.S+{CNFuK$UbtrwD.If", cchWideChar=32, lpMultiByteStr=0x203e2fc, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=">Y6L0%=(Q&ApE.S+{CNFuK$UbtrwD.If", lpUsedDefaultChar=0x0) returned 32 [0097.206] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0097.206] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0097.206] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x997dd300, ftCreationTime.dwHighDateTime=0x1bd4e67, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x997dd300, ftLastWriteTime.dwHighDateTime=0x1bd4e67, nFileSizeHigh=0x0, nFileSizeLow=0x1ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01296_.GIF", cAlternateFileName="")) returned 0x295098 [0097.207] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0097.207] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0097.207] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01296_.gif")) returned 0x20 [0097.207] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01296_.gif")) returned 0x20 [0097.207] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01296_.gif")) returned 0x20 [0097.207] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01296_.gif")) returned 0x20 [0097.207] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01296_.gif"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x997dd300, ftCreationTime.dwHighDateTime=0x1bd4e67, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x997dd300, ftLastWriteTime.dwHighDateTime=0x1bd4e67, nFileSizeHigh=0x0, nFileSizeLow=0x1ef)) returned 1 [0097.207] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0097.207] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0097.207] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01296_.gif")) returned 0x20 [0097.207] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01296_.gif")) returned 0x20 [0097.207] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0097.207] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0097.207] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0097.207] SetEndOfFile (hFile=0x158) returned 1 [0097.208] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01296_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0097.208] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01296_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94dcc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01296_.GIF", lpUsedDefaultChar=0x0) returned 12 [0097.208] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01296_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0097.208] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01296_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94aac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01296_.GIF", lpUsedDefaultChar=0x0) returned 12 [0097.209] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3b94aac, cbMultiByte=12, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="WB01296_.GIFg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0097.209] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01296_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0097.209] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01296_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94dcc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01296_.GIF", lpUsedDefaultChar=0x0) returned 12 [0097.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01296_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0097.209] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0097.209] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x1ef [0097.209] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0097.209] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0097.209] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0097.209] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01296_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0097.209] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01296_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94dcc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01296_.GIF", lpUsedDefaultChar=0x0) returned 12 [0097.210] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01296_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0097.210] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01296_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94aac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01296_.GIF", lpUsedDefaultChar=0x0) returned 12 [0097.210] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3b94aac, cbMultiByte=12, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="WB01296_.GIF6_.GIFg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0097.210] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01296_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0097.210] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01296_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94dcc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01296_.GIF", lpUsedDefaultChar=0x0) returned 12 [0097.210] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0097.211] CharToOemA (in: pSrc="WB01296_.GIF", pDst=0x3b94aac | out: pDst="WB01296_.GIF") returned 1 [0097.211] WriteFile (in: hFile=0x158, lpBuffer=0x3b94aac*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x3b94aac*, lpNumberOfBytesWritten=0x18e048*=0xc, lpOverlapped=0x0) returned 1 [0097.211] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0097.211] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0097.211] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0097.211] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=21747483734) returned 1 [0097.211] ReadFile (in: hFile=0x11c, lpBuffer=0x34e2690, nNumberOfBytesToRead=0x1ef, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x34e2690*, lpNumberOfBytesRead=0x18dd7c*=0x1ef, lpOverlapped=0x0) returned 1 [0097.212] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0097.212] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=21747581466) returned 1 [0097.221] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b420*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b5b420*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0097.221] ReadFile (in: hFile=0x11c, lpBuffer=0x34e2690, nNumberOfBytesToRead=0x1ef, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x34e2690*, lpNumberOfBytesRead=0x18de38*=0x1ef, lpOverlapped=0x0) returned 1 [0097.221] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x47 [0097.222] WriteFile (in: hFile=0x158, lpBuffer=0x34e28a0*, nNumberOfBytesToWrite=0x1ef, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x34e28a0*, lpNumberOfBytesWritten=0x18de10*=0x1ef, lpOverlapped=0x0) returned 1 [0097.222] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x236 [0097.222] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff1010*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0097.222] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0097.222] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0097.222] SetFilePointer (in: hFile=0x158, lDistanceToMove=12, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2a [0097.222] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x240 [0097.222] CloseHandle (hObject=0x11c) returned 1 [0097.222] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x240 [0097.222] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x240 [0097.222] SetFilePointer (in: hFile=0x158, lDistanceToMove=576, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x240 [0097.222] SetFilePointer (in: hFile=0x158, lDistanceToMove=576, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x240 [0097.222] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x240 [0097.223] SetFilePointer (in: hFile=0x158, lDistanceToMove=576, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x240 [0097.223] SetEndOfFile (hFile=0x158) returned 1 [0097.223] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x240 [0097.223] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x240 [0097.223] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01296_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0097.223] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01296_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94dcc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01296_.GIF", lpUsedDefaultChar=0x0) returned 12 [0097.223] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01296_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0097.223] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01296_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94dec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01296_.GIF", lpUsedDefaultChar=0x0) returned 12 [0097.223] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3b94dec, cbMultiByte=12, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="WB01296_.GIFꞗ@涤(\x18믉`믑`") returned 12 [0097.223] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01296_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0097.223] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01296_.GIF", cchWideChar=12, lpMultiByteStr=0x3b94dcc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01296_.GIF", lpUsedDefaultChar=0x0) returned 12 [0097.223] WriteFile (in: hFile=0x158, lpBuffer=0x3ad5738*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5738*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0097.223] CharToOemA (in: pSrc="WB01296_.GIF", pDst=0x3b94dec | out: pDst="WB01296_.GIF") returned 1 [0097.223] WriteFile (in: hFile=0x158, lpBuffer=0x3b94dec*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3b94dec*, lpNumberOfBytesWritten=0x18efcc*=0xc, lpOverlapped=0x0) returned 1 [0097.223] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b3b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x3b5b3b0*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0097.224] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fd0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fd0*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0097.224] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0097.224] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x285 [0097.224] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x285 [0097.224] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0097.224] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0097.224] DeleteFileW (lpFileName="") returned 0 [0097.224] GetLastError () returned 0x3 [0097.224] GetFileAttributesW (lpFileName="") returned 0xffffffff [0097.224] SetLastError (dwErrCode=0x3) [0097.224] FlushFileBuffers (hFile=0x158) returned 1 [0097.227] GetCurrentThreadId () returned 0x970 [0097.227] GetCurrentThreadId () returned 0x970 [0097.227] GetCurrentThreadId () returned 0x970 [0097.227] GetCurrentThreadId () returned 0x970 [0097.227] GetCurrentThreadId () returned 0x970 [0097.227] GetCurrentThreadId () returned 0x970 [0097.227] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x33c [0097.227] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x33c [0097.227] SetFilePointer (in: hFile=0x158, lDistanceToMove=828, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x33c [0097.227] CloseHandle (hObject=0x158) returned 1 [0097.227] GetCurrentThreadId () returned 0x970 [0097.227] GetCurrentThreadId () returned 0x970 [0097.227] GetCurrentThreadId () returned 0x970 [0097.227] GetCurrentThreadId () returned 0x970 [0097.227] GetCurrentThreadId () returned 0x970 [0097.227] GetCurrentThreadId () returned 0x970 [0097.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [WB01296_.GIF].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [wb01296_.gif].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0097.228] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x33c [0097.228] SetFilePointer (in: hFile=0x158, lDistanceToMove=700, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2bc [0097.228] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0097.228] GetFileType (hFile=0x158) returned 0x1 [0097.228] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2c, wMilliseconds=0x1f0)) [0097.228] GetCurrentThreadId () returned 0x970 [0097.228] GetCurrentThreadId () returned 0x970 [0097.228] GetCurrentThreadId () returned 0x970 [0097.228] GetCurrentThreadId () returned 0x970 [0097.228] GetCurrentThreadId () returned 0x970 [0097.228] GetCurrentThreadId () returned 0x970 [0097.228] GetCurrentThreadId () returned 0x970 [0097.228] GetCurrentThreadId () returned 0x970 [0097.228] GetCurrentThreadId () returned 0x970 [0097.228] GetCurrentThreadId () returned 0x970 [0097.228] GetCurrentThreadId () returned 0x970 [0097.228] GetCurrentThreadId () returned 0x970 [0097.228] GetCurrentThreadId () returned 0x970 [0097.228] GetCurrentThreadId () returned 0x970 [0097.228] GetCurrentThreadId () returned 0x970 [0097.228] GetCurrentThreadId () returned 0x970 [0097.228] GetCurrentThreadId () returned 0x970 [0097.228] GetCurrentThreadId () returned 0x970 [0097.228] GetCurrentThreadId () returned 0x970 [0097.228] GetCurrentThreadId () returned 0x970 [0097.228] GetCurrentThreadId () returned 0x970 [0097.228] GetCurrentThreadId () returned 0x970 [0097.228] GetCurrentThreadId () returned 0x970 [0097.228] GetCurrentThreadId () returned 0x970 [0097.228] GetCurrentThreadId () returned 0x970 [0097.228] GetCurrentThreadId () returned 0x970 [0097.228] GetCurrentThreadId () returned 0x970 [0097.228] GetCurrentThreadId () returned 0x970 [0097.228] GetCurrentThreadId () returned 0x970 [0097.229] GetCurrentThreadId () returned 0x970 [0097.229] GetCurrentThreadId () returned 0x970 [0097.229] GetCurrentThreadId () returned 0x970 [0097.229] GetCurrentThreadId () returned 0x970 [0097.229] GetCurrentThreadId () returned 0x970 [0097.229] GetCurrentThreadId () returned 0x970 [0097.229] GetCurrentThreadId () returned 0x970 [0097.229] GetCurrentThreadId () returned 0x970 [0097.229] GetCurrentThreadId () returned 0x970 [0097.229] GetCurrentThreadId () returned 0x970 [0097.229] GetCurrentThreadId () returned 0x970 [0097.229] GetCurrentThreadId () returned 0x970 [0097.229] GetCurrentThreadId () returned 0x970 [0097.229] GetCurrentThreadId () returned 0x970 [0097.229] GetCurrentThreadId () returned 0x970 [0097.229] GetCurrentThreadId () returned 0x970 [0097.229] GetCurrentThreadId () returned 0x970 [0097.229] GetCurrentThreadId () returned 0x970 [0097.229] GetCurrentThreadId () returned 0x970 [0097.229] GetCurrentThreadId () returned 0x970 [0097.229] GetCurrentThreadId () returned 0x970 [0097.229] GetCurrentThreadId () returned 0x970 [0097.229] GetCurrentThreadId () returned 0x970 [0097.229] GetCurrentThreadId () returned 0x970 [0097.229] GetCurrentThreadId () returned 0x970 [0097.229] GetCurrentThreadId () returned 0x970 [0097.229] GetCurrentThreadId () returned 0x970 [0097.229] GetCurrentThreadId () returned 0x970 [0097.229] GetCurrentThreadId () returned 0x970 [0097.229] GetCurrentThreadId () returned 0x970 [0097.229] GetCurrentThreadId () returned 0x970 [0097.229] GetCurrentThreadId () returned 0x970 [0097.229] GetCurrentThreadId () returned 0x970 [0097.229] GetCurrentThreadId () returned 0x970 [0097.229] GetCurrentThreadId () returned 0x970 [0097.229] GetCurrentThreadId () returned 0x970 [0097.229] GetCurrentThreadId () returned 0x970 [0097.229] GetCurrentThreadId () returned 0x970 [0097.230] GetCurrentThreadId () returned 0x970 [0097.230] GetCurrentThreadId () returned 0x970 [0097.230] GetCurrentThreadId () returned 0x970 [0097.230] GetCurrentThreadId () returned 0x970 [0097.230] GetCurrentThreadId () returned 0x970 [0097.230] GetCurrentThreadId () returned 0x970 [0097.230] GetCurrentThreadId () returned 0x970 [0097.230] GetCurrentThreadId () returned 0x970 [0097.230] GetCurrentThreadId () returned 0x970 [0097.230] GetCurrentThreadId () returned 0x970 [0097.230] GetCurrentThreadId () returned 0x970 [0097.230] GetCurrentThreadId () returned 0x970 [0097.230] GetCurrentThreadId () returned 0x970 [0097.230] GetCurrentThreadId () returned 0x970 [0097.230] GetCurrentThreadId () returned 0x970 [0097.230] GetCurrentThreadId () returned 0x970 [0097.230] GetCurrentThreadId () returned 0x970 [0097.230] GetCurrentThreadId () returned 0x970 [0097.230] GetCurrentThreadId () returned 0x970 [0097.230] GetCurrentThreadId () returned 0x970 [0097.230] GetCurrentThreadId () returned 0x970 [0097.230] GetCurrentThreadId () returned 0x970 [0097.230] GetCurrentThreadId () returned 0x970 [0097.230] GetCurrentThreadId () returned 0x970 [0097.230] GetCurrentThreadId () returned 0x970 [0097.230] GetCurrentThreadId () returned 0x970 [0097.230] GetCurrentThreadId () returned 0x970 [0097.230] GetCurrentThreadId () returned 0x970 [0097.230] GetCurrentThreadId () returned 0x970 [0097.230] GetCurrentThreadId () returned 0x970 [0097.230] GetCurrentThreadId () returned 0x970 [0097.230] GetCurrentThreadId () returned 0x970 [0097.230] GetCurrentThreadId () returned 0x970 [0097.230] GetCurrentThreadId () returned 0x970 [0097.230] GetCurrentThreadId () returned 0x970 [0097.230] GetCurrentThreadId () returned 0x970 [0097.230] GetCurrentThreadId () returned 0x970 [0097.231] GetCurrentThreadId () returned 0x970 [0097.231] GetCurrentThreadId () returned 0x970 [0097.231] GetCurrentThreadId () returned 0x970 [0097.231] GetCurrentThreadId () returned 0x970 [0097.231] GetCurrentThreadId () returned 0x970 [0097.231] GetCurrentThreadId () returned 0x970 [0097.231] GetCurrentThreadId () returned 0x970 [0097.231] GetCurrentThreadId () returned 0x970 [0097.231] GetCurrentThreadId () returned 0x970 [0097.231] GetCurrentThreadId () returned 0x970 [0097.231] GetCurrentThreadId () returned 0x970 [0097.231] GetCurrentThreadId () returned 0x970 [0097.231] GetCurrentThreadId () returned 0x970 [0097.231] GetCurrentThreadId () returned 0x970 [0097.231] GetCurrentThreadId () returned 0x970 [0097.231] GetCurrentThreadId () returned 0x970 [0097.231] GetCurrentThreadId () returned 0x970 [0097.231] GetCurrentThreadId () returned 0x970 [0097.231] GetCurrentThreadId () returned 0x970 [0097.231] GetCurrentThreadId () returned 0x970 [0097.231] GetCurrentThreadId () returned 0x970 [0097.231] GetCurrentThreadId () returned 0x970 [0097.231] GetCurrentThreadId () returned 0x970 [0097.231] GetCurrentThreadId () returned 0x970 [0097.231] GetCurrentThreadId () returned 0x970 [0097.231] GetCurrentThreadId () returned 0x970 [0097.231] GetCurrentThreadId () returned 0x970 [0097.231] GetCurrentThreadId () returned 0x970 [0097.231] GetCurrentThreadId () returned 0x970 [0097.231] GetCurrentThreadId () returned 0x970 [0097.231] GetCurrentThreadId () returned 0x970 [0097.231] GetCurrentThreadId () returned 0x970 [0097.231] GetCurrentThreadId () returned 0x970 [0097.231] GetCurrentThreadId () returned 0x970 [0097.231] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.231] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.231] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b62490, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0097.231] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.232] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.232] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b62490, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0097.232] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.232] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.232] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b548, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0097.232] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.232] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.232] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b548, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0097.232] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.232] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.232] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b624f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0097.232] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.232] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.232] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b624f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0097.232] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.232] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.232] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b624f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0097.232] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2c, wMilliseconds=0x1f0)) [0097.232] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr=">Y6L0%=(Q&ApE.S+{CNFuK$UbtrwD.If", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0097.232] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr=">Y6L0%=(Q&ApE.S+{CNFuK$UbtrwD.If", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0097.232] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr=">Y6L0%=(Q&ApE.S+{CNFuK$UbtrwD.If", cchWideChar=32, lpMultiByteStr=0x3b58058, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=">Y6L0%=(Q&ApE.S+{CNFuK$UbtrwD.If", lpUsedDefaultChar=0x0) returned 32 [0097.232] GetCurrentThreadId () returned 0x970 [0097.232] GetCurrentThreadId () returned 0x970 [0097.232] GetCurrentThreadId () returned 0x970 [0097.232] GetCurrentThreadId () returned 0x970 [0097.232] GetCurrentThreadId () returned 0x970 [0097.232] GetCurrentThreadId () returned 0x970 [0097.240] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0097.240] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0097.240] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3b168e8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0097.240] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0097.240] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAADAPflLUBOR71NU2BTadNjf9GeSLwIhctfwz1PnY5XS2mhbYUuLDI1fB6niZDKN+GyhSg9O4v+JsC9imvILnIYoid7QkJbyc7DQsyWZRgzYrv/HGLGH7Qsaspzzlva7mVpbXqZWEIDrP+lOZAjXcyuQPR4Vg4xWNCkeRfCufNdGBsSgpPCYOXeTk/7nLA+zRiUbzGJwu7ty1nXLMCgaFuVT459TboMWXhA==") returned 232 [0097.240] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2c, wMilliseconds=0x200)) [0097.240] GetCurrentThreadId () returned 0x970 [0097.240] GetCurrentThreadId () returned 0x970 [0097.240] GetCurrentThreadId () returned 0x970 [0097.240] GetCurrentThreadId () returned 0x970 [0097.240] GetCurrentThreadId () returned 0x970 [0097.240] GetCurrentThreadId () returned 0x970 [0097.240] GetCurrentThreadId () returned 0x970 [0097.240] GetCurrentThreadId () returned 0x970 [0097.240] GetCurrentThreadId () returned 0x970 [0097.240] GetCurrentThreadId () returned 0x970 [0097.240] GetCurrentThreadId () returned 0x970 [0097.240] GetCurrentThreadId () returned 0x970 [0097.240] GetCurrentThreadId () returned 0x970 [0097.240] GetCurrentThreadId () returned 0x970 [0097.240] GetCurrentThreadId () returned 0x970 [0097.240] GetCurrentThreadId () returned 0x970 [0097.240] GetCurrentThreadId () returned 0x970 [0097.241] GetCurrentThreadId () returned 0x970 [0097.241] GetCurrentThreadId () returned 0x970 [0097.241] GetCurrentThreadId () returned 0x970 [0097.241] GetCurrentThreadId () returned 0x970 [0097.241] GetCurrentThreadId () returned 0x970 [0097.241] GetCurrentThreadId () returned 0x970 [0097.241] GetCurrentThreadId () returned 0x970 [0097.241] GetCurrentThreadId () returned 0x970 [0097.241] GetCurrentThreadId () returned 0x970 [0097.241] GetCurrentThreadId () returned 0x970 [0097.241] GetCurrentThreadId () returned 0x970 [0097.241] GetCurrentThreadId () returned 0x970 [0097.241] GetCurrentThreadId () returned 0x970 [0097.241] GetCurrentThreadId () returned 0x970 [0097.241] GetCurrentThreadId () returned 0x970 [0097.241] GetCurrentThreadId () returned 0x970 [0097.241] GetCurrentThreadId () returned 0x970 [0097.241] GetCurrentThreadId () returned 0x970 [0097.241] GetCurrentThreadId () returned 0x970 [0097.241] GetCurrentThreadId () returned 0x970 [0097.241] GetCurrentThreadId () returned 0x970 [0097.241] GetCurrentThreadId () returned 0x970 [0097.241] GetCurrentThreadId () returned 0x970 [0097.241] GetCurrentThreadId () returned 0x970 [0097.241] GetCurrentThreadId () returned 0x970 [0097.241] GetCurrentThreadId () returned 0x970 [0097.241] GetCurrentThreadId () returned 0x970 [0097.241] GetCurrentThreadId () returned 0x970 [0097.241] GetCurrentThreadId () returned 0x970 [0097.241] GetCurrentThreadId () returned 0x970 [0097.241] GetCurrentThreadId () returned 0x970 [0097.241] GetCurrentThreadId () returned 0x970 [0097.241] GetCurrentThreadId () returned 0x970 [0097.241] GetCurrentThreadId () returned 0x970 [0097.241] GetCurrentThreadId () returned 0x970 [0097.241] GetCurrentThreadId () returned 0x970 [0097.241] GetCurrentThreadId () returned 0x970 [0097.241] GetCurrentThreadId () returned 0x970 [0097.241] GetCurrentThreadId () returned 0x970 [0097.241] GetCurrentThreadId () returned 0x970 [0097.241] GetCurrentThreadId () returned 0x970 [0097.241] GetCurrentThreadId () returned 0x970 [0097.241] GetCurrentThreadId () returned 0x970 [0097.241] GetCurrentThreadId () returned 0x970 [0097.242] GetCurrentThreadId () returned 0x970 [0097.242] GetCurrentThreadId () returned 0x970 [0097.242] GetCurrentThreadId () returned 0x970 [0097.242] GetCurrentThreadId () returned 0x970 [0097.242] GetCurrentThreadId () returned 0x970 [0097.242] GetCurrentThreadId () returned 0x970 [0097.242] GetCurrentThreadId () returned 0x970 [0097.242] GetCurrentThreadId () returned 0x970 [0097.242] GetCurrentThreadId () returned 0x970 [0097.242] GetCurrentThreadId () returned 0x970 [0097.242] GetCurrentThreadId () returned 0x970 [0097.242] GetCurrentThreadId () returned 0x970 [0097.242] GetCurrentThreadId () returned 0x970 [0097.242] GetCurrentThreadId () returned 0x970 [0097.242] GetCurrentThreadId () returned 0x970 [0097.242] GetCurrentThreadId () returned 0x970 [0097.242] GetCurrentThreadId () returned 0x970 [0097.242] GetCurrentThreadId () returned 0x970 [0097.242] GetCurrentThreadId () returned 0x970 [0097.242] GetCurrentThreadId () returned 0x970 [0097.242] GetCurrentThreadId () returned 0x970 [0097.242] GetCurrentThreadId () returned 0x970 [0097.242] GetCurrentThreadId () returned 0x970 [0097.242] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAADAPflLUBOR71NU2BTadNjf9GeSLwIhctfwz1PnY5XS2mhbYUuLDI1fB6niZDKN+GyhSg9O4v+JsC9imvILnIYoid7QkJbyc7DQsyWZRgzYrv/HGLGH7Qsaspzzlva7mVpbXqZWEIDrP+lOZAjXcyuQPR4Vg4xWNCkeRfCufNdGBsSgpPCYOXeTk/7nLA+zRiUbzGJwu7ty1nXLMCgaFuVT459TboMWXhA==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0097.242] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAADAPflLUBOR71NU2BTadNjf9GeSLwIhctfwz1PnY5XS2mhbYUuLDI1fB6niZDKN+GyhSg9O4v+JsC9imvILnIYoid7QkJbyc7DQsyWZRgzYrv/HGLGH7Qsaspzzlva7mVpbXqZWEIDrP+lOZAjXcyuQPR4Vg4xWNCkeRfCufNdGBsSgpPCYOXeTk/7nLA+zRiUbzGJwu7ty1nXLMCgaFuVT459TboMWXhA==", cchWideChar=245, lpMultiByteStr=0x3b4d08c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAADAPflLUBOR71NU2BTadNjf9GeSLwIhctfwz1PnY5XS2mhbYUuLDI1fB6niZDKN+GyhSg9O4v+JsC9imvILnIYoid7QkJbyc7DQsyWZRgzYrv/HGLGH7Qsaspzzlva7mVpbXqZWEIDrP+lOZAjXcyuQPR4Vg4xWNCkeRfCufNdGBsSgpPCYOXeTk/7nLA+zRiUbzGJwu7ty1nXLMCgaFuVT459TboMWXhA==", lpUsedDefaultChar=0x0) returned 245 [0097.242] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0097.242] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0097.242] CloseHandle (hObject=0x158) returned 1 [0097.242] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01296_.gif")) returned 1 [0097.243] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=21750688964) returned 1 [0097.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [WB01297_.GIF].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [wb01297_.gif].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0097.244] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0097.244] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0097.244] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0097.244] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0097.244] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0097.245] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0097.245] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0097.245] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0097.245] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0097.245] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0097.245] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0097.245] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0097.245] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0097.245] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0097.245] SetEndOfFile (hFile=0x158) returned 1 [0097.245] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0097.245] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0097.245] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0097.245] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0097.245] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0097.246] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0097.246] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=",2qRBocMmYF&Q&XQ!Dmur%&zI\"bHo603", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0097.246] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=",2qRBocMmYF&Q&XQ!Dmur%&zI\"bHo603", cchWideChar=32, lpMultiByteStr=0x203e334, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=",2qRBocMmYF&Q&XQ!Dmur%&zI\"bHo603", lpUsedDefaultChar=0x0) returned 32 [0097.247] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0097.247] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0097.247] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF", lpFindFileData=0x18fa20 | out: lpFindFileData=0x18fa20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9387f200, ftCreationTime.dwHighDateTime=0x1bd4e67, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9387f200, ftLastWriteTime.dwHighDateTime=0x1bd4e67, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01297_.GIF", cAlternateFileName="")) returned 0x295098 [0097.247] FileTimeToLocalFileTime (in: lpFileTime=0x18fa34, lpLocalFileTime=0x18f970 | out: lpLocalFileTime=0x18f970) returned 1 [0097.247] FileTimeToDosDateTime (in: lpFileTime=0x18f970, lpFatDate=0x18fa02, lpFatTime=0x18fa00 | out: lpFatDate=0x18fa02, lpFatTime=0x18fa00) returned 1 [0097.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01297_.gif")) returned 0x20 [0097.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01297_.gif")) returned 0x20 [0097.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01297_.gif")) returned 0x20 [0097.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01297_.gif")) returned 0x20 [0097.247] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01297_.gif"), fInfoLevelId=0x0, lpFileInformation=0x18f488 | out: lpFileInformation=0x18f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9387f200, ftCreationTime.dwHighDateTime=0x1bd4e67, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9387f200, ftLastWriteTime.dwHighDateTime=0x1bd4e67, nFileSizeHigh=0x0, nFileSizeLow=0x37e)) returned 1 [0097.247] FileTimeToLocalFileTime (in: lpFileTime=0x18f49c, lpLocalFileTime=0x18f4d4 | out: lpLocalFileTime=0x18f4d4) returned 1 [0097.247] FileTimeToDosDateTime (in: lpFileTime=0x18f4d4, lpFatDate=0x18f4de, lpFatTime=0x18f4dc | out: lpFatDate=0x18f4de, lpFatTime=0x18f4dc) returned 1 [0097.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01297_.gif")) returned 0x20 [0097.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01297_.gif")) returned 0x20 [0097.248] FindClose (in: hFindFile=0x295098 | out: hFindFile=0x295098) returned 1 [0097.248] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f114*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f114*=0) returned 0x0 [0097.248] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f100*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f100*=0) returned 0x0 [0097.248] SetEndOfFile (hFile=0x158) returned 1 [0097.248] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01297_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0097.248] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01297_.GIF", cchWideChar=12, lpMultiByteStr=0x3b9494c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01297_.GIF", lpUsedDefaultChar=0x0) returned 12 [0097.249] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01297_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0097.249] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01297_.GIF", cchWideChar=12, lpMultiByteStr=0x3b949ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01297_.GIF", lpUsedDefaultChar=0x0) returned 12 [0097.249] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3b949ac, cbMultiByte=12, lpWideCharStr=0x18cf34, cchWideChar=2047 | out: lpWideCharStr="WB01297_.GIFg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0097.249] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01297_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0097.249] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01297_.GIF", cchWideChar=12, lpMultiByteStr=0x3b9494c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01297_.GIF", lpUsedDefaultChar=0x0) returned 12 [0097.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01297_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0097.250] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0097.250] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x37e [0097.250] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x0 [0097.250] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e034*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e034*=0) returned 0x0 [0097.250] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e030*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e030*=0) returned 0x0 [0097.250] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01297_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0097.250] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01297_.GIF", cchWideChar=12, lpMultiByteStr=0x3b9494c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01297_.GIF", lpUsedDefaultChar=0x0) returned 12 [0097.250] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01297_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0097.250] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01297_.GIF", cchWideChar=12, lpMultiByteStr=0x3b949ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01297_.GIF", lpUsedDefaultChar=0x0) returned 12 [0097.250] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3b949ac, cbMultiByte=12, lpWideCharStr=0x18cf28, cchWideChar=2047 | out: lpWideCharStr="WB01297_.GIF7_.GIFg5.pngbpicture.pngre.pngpng.pngpng?ǒ弼f๜͝暀䫅?ǒ") returned 12 [0097.251] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01297_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0097.251] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01297_.GIF", cchWideChar=12, lpMultiByteStr=0x3b9494c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01297_.GIF", lpUsedDefaultChar=0x0) returned 12 [0097.251] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0097.251] CharToOemA (in: pSrc="WB01297_.GIF", pDst=0x3b949ac | out: pDst="WB01297_.GIF") returned 1 [0097.252] WriteFile (in: hFile=0x158, lpBuffer=0x3b949ac*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x3b949ac*, lpNumberOfBytesWritten=0x18e048*=0xc, lpOverlapped=0x0) returned 1 [0097.252] WriteFile (in: hFile=0x158, lpBuffer=0x18f0c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x18f0c0*, lpNumberOfBytesWritten=0x18e030*=0x4, lpOverlapped=0x0) returned 1 [0097.252] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18e030, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18e030*=0x7, lpOverlapped=0x0) returned 1 [0097.252] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18deb8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18deb8*=0) returned 0x0 [0097.252] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd88 | out: lpPerformanceCount=0x18dd88*=21751535434) returned 1 [0097.252] ReadFile (in: hFile=0x11c, lpBuffer=0x3b23770, nNumberOfBytesToRead=0x37e, lpNumberOfBytesRead=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b23770*, lpNumberOfBytesRead=0x18dd7c*=0x37e, lpOverlapped=0x0) returned 1 [0097.253] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18dd3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18dd3c*=0) returned 0x0 [0097.253] QueryPerformanceCounter (in: lpPerformanceCount=0x18dd34 | out: lpPerformanceCount=0x18dd34*=21751684076) returned 1 [0097.262] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b3d8*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18dd7c, lpOverlapped=0x0 | out: lpBuffer=0x3b5b3d8*, lpNumberOfBytesWritten=0x18dd7c*=0x12, lpOverlapped=0x0) returned 1 [0097.262] ReadFile (in: hFile=0x11c, lpBuffer=0x3b23770, nNumberOfBytesToRead=0x37e, lpNumberOfBytesRead=0x18de38, lpOverlapped=0x0 | out: lpBuffer=0x3b23770*, lpNumberOfBytesRead=0x18de38*=0x37e, lpOverlapped=0x0) returned 1 [0097.262] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x47 [0097.262] WriteFile (in: hFile=0x158, lpBuffer=0x3b23b30*, nNumberOfBytesToWrite=0x37e, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x3b23b30*, lpNumberOfBytesWritten=0x18de10*=0x37e, lpOverlapped=0x0) returned 1 [0097.263] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ddf0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ddf0*=0) returned 0x3c5 [0097.263] WriteFile (in: hFile=0x158, lpBuffer=0x1ff0fc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18de10, lpOverlapped=0x0 | out: lpBuffer=0x1ff0fc0*, lpNumberOfBytesWritten=0x18de10*=0xa, lpOverlapped=0x0) returned 1 [0097.263] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e024*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18e024*=0) returned 0x0 [0097.263] WriteFile (in: hFile=0x158, lpBuffer=0x18f08a*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x18e048, lpOverlapped=0x0 | out: lpBuffer=0x18f08a*, lpNumberOfBytesWritten=0x18e048*=0x1e, lpOverlapped=0x0) returned 1 [0097.263] SetFilePointer (in: hFile=0x158, lDistanceToMove=12, lpDistanceToMoveHigh=0x18e01c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18e01c*=0) returned 0x2a [0097.263] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18e008*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18e008*=0) returned 0x3cf [0097.263] CloseHandle (hObject=0x11c) returned 1 [0097.263] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x3cf [0097.263] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x3cf [0097.263] SetFilePointer (in: hFile=0x158, lDistanceToMove=975, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x3cf [0097.263] SetFilePointer (in: hFile=0x158, lDistanceToMove=975, lpDistanceToMoveHigh=0x18f020*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f020*=0) returned 0x3cf [0097.263] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x3cf [0097.263] SetFilePointer (in: hFile=0x158, lDistanceToMove=975, lpDistanceToMoveHigh=0x18f00c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f00c*=0) returned 0x3cf [0097.263] SetEndOfFile (hFile=0x158) returned 1 [0097.264] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x3cf [0097.264] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f018*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f018*=0) returned 0x3cf [0097.264] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01297_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0097.264] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01297_.GIF", cchWideChar=12, lpMultiByteStr=0x3b9494c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01297_.GIF", lpUsedDefaultChar=0x0) returned 12 [0097.264] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01297_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0097.264] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01297_.GIF", cchWideChar=12, lpMultiByteStr=0x3b9498c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01297_.GIF", lpUsedDefaultChar=0x0) returned 12 [0097.264] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3b9498c, cbMultiByte=12, lpWideCharStr=0x18df18, cchWideChar=2047 | out: lpWideCharStr="WB01297_.GIFꞗ@涤(\x18믉`믑`") returned 12 [0097.264] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01297_.GIF", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0097.264] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01297_.GIF", cchWideChar=12, lpMultiByteStr=0x3b9494c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WB01297_.GIF", lpUsedDefaultChar=0x0) returned 12 [0097.264] WriteFile (in: hFile=0x158, lpBuffer=0x3ad5738*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5738*, lpNumberOfBytesWritten=0x18efcc*=0x2e, lpOverlapped=0x0) returned 1 [0097.265] CharToOemA (in: pSrc="WB01297_.GIF", pDst=0x3b9498c | out: pDst="WB01297_.GIF") returned 1 [0097.265] WriteFile (in: hFile=0x158, lpBuffer=0x3b9498c*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x3b9498c*, lpNumberOfBytesWritten=0x18efcc*=0xc, lpOverlapped=0x0) returned 1 [0097.265] WriteFile (in: hFile=0x158, lpBuffer=0x3b5b470*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x3b5b470*, lpNumberOfBytesWritten=0x18ee44*=0x4, lpOverlapped=0x0) returned 1 [0097.265] WriteFile (in: hFile=0x158, lpBuffer=0x1ff1020*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18ee44, lpOverlapped=0x0 | out: lpBuffer=0x1ff1020*, lpNumberOfBytesWritten=0x18ee44*=0x7, lpOverlapped=0x0) returned 1 [0097.265] WriteFile (in: hFile=0x158, lpBuffer=0x40b010*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18efcc, lpOverlapped=0x0 | out: lpBuffer=0x40b010*, lpNumberOfBytesWritten=0x18efcc*=0x0, lpOverlapped=0x0) returned 1 [0097.265] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x414 [0097.265] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f024*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f024*=0) returned 0x414 [0097.265] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18f02c*=0x16, lpOverlapped=0x0) returned 1 [0097.265] WriteFile (in: hFile=0x158, lpBuffer=0x35f041c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18f02c, lpOverlapped=0x0 | out: lpBuffer=0x35f041c*, lpNumberOfBytesWritten=0x18f02c*=0xa1, lpOverlapped=0x0) returned 1 [0097.265] DeleteFileW (lpFileName="") returned 0 [0097.265] GetLastError () returned 0x3 [0097.265] GetFileAttributesW (lpFileName="") returned 0xffffffff [0097.265] SetLastError (dwErrCode=0x3) [0097.265] FlushFileBuffers (hFile=0x158) returned 1 [0097.268] GetCurrentThreadId () returned 0x970 [0097.268] GetCurrentThreadId () returned 0x970 [0097.268] GetCurrentThreadId () returned 0x970 [0097.268] GetCurrentThreadId () returned 0x970 [0097.268] GetCurrentThreadId () returned 0x970 [0097.268] GetCurrentThreadId () returned 0x970 [0097.268] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x4cb [0097.268] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x4cb [0097.268] SetFilePointer (in: hFile=0x158, lDistanceToMove=1227, lpDistanceToMoveHigh=0x18fd00*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fd00*=0) returned 0x4cb [0097.268] CloseHandle (hObject=0x158) returned 1 [0097.269] GetCurrentThreadId () returned 0x970 [0097.269] GetCurrentThreadId () returned 0x970 [0097.269] GetCurrentThreadId () returned 0x970 [0097.269] GetCurrentThreadId () returned 0x970 [0097.269] GetCurrentThreadId () returned 0x970 [0097.269] GetCurrentThreadId () returned 0x970 [0097.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [WB01297_.GIF].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [wb01297_.gif].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0097.269] GetFileSize (in: hFile=0x158, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4cb [0097.269] SetFilePointer (in: hFile=0x158, lDistanceToMove=1099, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x44b [0097.269] ReadFile (in: hFile=0x158, lpBuffer=0x67f2c8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18fd8c, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesRead=0x18fd8c*=0x80, lpOverlapped=0x0) returned 1 [0097.269] GetFileType (hFile=0x158) returned 0x1 [0097.269] GetLocalTime (in: lpSystemTime=0x18fd30 | out: lpSystemTime=0x18fd30*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2c, wMilliseconds=0x21f)) [0097.269] GetCurrentThreadId () returned 0x970 [0097.269] GetCurrentThreadId () returned 0x970 [0097.269] GetCurrentThreadId () returned 0x970 [0097.269] GetCurrentThreadId () returned 0x970 [0097.269] GetCurrentThreadId () returned 0x970 [0097.269] GetCurrentThreadId () returned 0x970 [0097.269] GetCurrentThreadId () returned 0x970 [0097.269] GetCurrentThreadId () returned 0x970 [0097.269] GetCurrentThreadId () returned 0x970 [0097.269] GetCurrentThreadId () returned 0x970 [0097.269] GetCurrentThreadId () returned 0x970 [0097.269] GetCurrentThreadId () returned 0x970 [0097.269] GetCurrentThreadId () returned 0x970 [0097.270] GetCurrentThreadId () returned 0x970 [0097.270] GetCurrentThreadId () returned 0x970 [0097.270] GetCurrentThreadId () returned 0x970 [0097.270] GetCurrentThreadId () returned 0x970 [0097.270] GetCurrentThreadId () returned 0x970 [0097.270] GetCurrentThreadId () returned 0x970 [0097.270] GetCurrentThreadId () returned 0x970 [0097.270] GetCurrentThreadId () returned 0x970 [0097.270] GetCurrentThreadId () returned 0x970 [0097.270] GetCurrentThreadId () returned 0x970 [0097.270] GetCurrentThreadId () returned 0x970 [0097.270] GetCurrentThreadId () returned 0x970 [0097.270] GetCurrentThreadId () returned 0x970 [0097.270] GetCurrentThreadId () returned 0x970 [0097.270] GetCurrentThreadId () returned 0x970 [0097.270] GetCurrentThreadId () returned 0x970 [0097.270] GetCurrentThreadId () returned 0x970 [0097.270] GetCurrentThreadId () returned 0x970 [0097.270] GetCurrentThreadId () returned 0x970 [0097.270] GetCurrentThreadId () returned 0x970 [0097.270] GetCurrentThreadId () returned 0x970 [0097.270] GetCurrentThreadId () returned 0x970 [0097.270] GetCurrentThreadId () returned 0x970 [0097.270] GetCurrentThreadId () returned 0x970 [0097.270] GetCurrentThreadId () returned 0x970 [0097.270] GetCurrentThreadId () returned 0x970 [0097.270] GetCurrentThreadId () returned 0x970 [0097.270] GetCurrentThreadId () returned 0x970 [0097.270] GetCurrentThreadId () returned 0x970 [0097.270] GetCurrentThreadId () returned 0x970 [0097.270] GetCurrentThreadId () returned 0x970 [0097.270] GetCurrentThreadId () returned 0x970 [0097.270] GetCurrentThreadId () returned 0x970 [0097.270] GetCurrentThreadId () returned 0x970 [0097.270] GetCurrentThreadId () returned 0x970 [0097.270] GetCurrentThreadId () returned 0x970 [0097.270] GetCurrentThreadId () returned 0x970 [0097.270] GetCurrentThreadId () returned 0x970 [0097.270] GetCurrentThreadId () returned 0x970 [0097.270] GetCurrentThreadId () returned 0x970 [0097.270] GetCurrentThreadId () returned 0x970 [0097.270] GetCurrentThreadId () returned 0x970 [0097.270] GetCurrentThreadId () returned 0x970 [0097.270] GetCurrentThreadId () returned 0x970 [0097.271] GetCurrentThreadId () returned 0x970 [0097.271] GetCurrentThreadId () returned 0x970 [0097.271] GetCurrentThreadId () returned 0x970 [0097.271] GetCurrentThreadId () returned 0x970 [0097.271] GetCurrentThreadId () returned 0x970 [0097.271] GetCurrentThreadId () returned 0x970 [0097.271] GetCurrentThreadId () returned 0x970 [0097.271] GetCurrentThreadId () returned 0x970 [0097.271] GetCurrentThreadId () returned 0x970 [0097.271] GetCurrentThreadId () returned 0x970 [0097.271] GetCurrentThreadId () returned 0x970 [0097.271] GetCurrentThreadId () returned 0x970 [0097.271] GetCurrentThreadId () returned 0x970 [0097.271] GetCurrentThreadId () returned 0x970 [0097.271] GetCurrentThreadId () returned 0x970 [0097.271] GetCurrentThreadId () returned 0x970 [0097.271] GetCurrentThreadId () returned 0x970 [0097.271] GetCurrentThreadId () returned 0x970 [0097.271] GetCurrentThreadId () returned 0x970 [0097.271] GetCurrentThreadId () returned 0x970 [0097.271] GetCurrentThreadId () returned 0x970 [0097.271] GetCurrentThreadId () returned 0x970 [0097.271] GetCurrentThreadId () returned 0x970 [0097.271] GetCurrentThreadId () returned 0x970 [0097.271] GetCurrentThreadId () returned 0x970 [0097.271] GetCurrentThreadId () returned 0x970 [0097.271] GetCurrentThreadId () returned 0x970 [0097.271] GetCurrentThreadId () returned 0x970 [0097.271] GetCurrentThreadId () returned 0x970 [0097.271] GetCurrentThreadId () returned 0x970 [0097.271] GetCurrentThreadId () returned 0x970 [0097.271] GetCurrentThreadId () returned 0x970 [0097.271] GetCurrentThreadId () returned 0x970 [0097.271] GetCurrentThreadId () returned 0x970 [0097.271] GetCurrentThreadId () returned 0x970 [0097.271] GetCurrentThreadId () returned 0x970 [0097.271] GetCurrentThreadId () returned 0x970 [0097.271] GetCurrentThreadId () returned 0x970 [0097.271] GetCurrentThreadId () returned 0x970 [0097.271] GetCurrentThreadId () returned 0x970 [0097.271] GetCurrentThreadId () returned 0x970 [0097.271] GetCurrentThreadId () returned 0x970 [0097.271] GetCurrentThreadId () returned 0x970 [0097.271] GetCurrentThreadId () returned 0x970 [0097.272] GetCurrentThreadId () returned 0x970 [0097.272] GetCurrentThreadId () returned 0x970 [0097.272] GetCurrentThreadId () returned 0x970 [0097.272] GetCurrentThreadId () returned 0x970 [0097.272] GetCurrentThreadId () returned 0x970 [0097.272] GetCurrentThreadId () returned 0x970 [0097.272] GetCurrentThreadId () returned 0x970 [0097.272] GetCurrentThreadId () returned 0x970 [0097.272] GetCurrentThreadId () returned 0x970 [0097.272] GetCurrentThreadId () returned 0x970 [0097.272] GetCurrentThreadId () returned 0x970 [0097.272] GetCurrentThreadId () returned 0x970 [0097.272] GetCurrentThreadId () returned 0x970 [0097.272] GetCurrentThreadId () returned 0x970 [0097.272] GetCurrentThreadId () returned 0x970 [0097.272] GetCurrentThreadId () returned 0x970 [0097.272] GetCurrentThreadId () returned 0x970 [0097.272] GetCurrentThreadId () returned 0x970 [0097.272] GetCurrentThreadId () returned 0x970 [0097.272] GetCurrentThreadId () returned 0x970 [0097.272] GetCurrentThreadId () returned 0x970 [0097.272] GetCurrentThreadId () returned 0x970 [0097.272] GetCurrentThreadId () returned 0x970 [0097.272] GetCurrentThreadId () returned 0x970 [0097.272] GetCurrentThreadId () returned 0x970 [0097.272] GetCurrentThreadId () returned 0x970 [0097.272] GetCurrentThreadId () returned 0x970 [0097.272] GetCurrentThreadId () returned 0x970 [0097.272] GetCurrentThreadId () returned 0x970 [0097.272] GetCurrentThreadId () returned 0x970 [0097.272] GetCurrentThreadId () returned 0x970 [0097.272] GetCurrentThreadId () returned 0x970 [0097.272] GetCurrentThreadId () returned 0x970 [0097.272] GetCurrentThreadId () returned 0x970 [0097.272] GetCurrentThreadId () returned 0x970 [0097.272] GetCurrentThreadId () returned 0x970 [0097.272] GetCurrentThreadId () returned 0x970 [0097.272] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.272] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.272] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b624f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0097.272] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.273] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.273] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b624f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0097.273] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.273] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.273] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b530, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0097.273] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.273] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.273] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b5b530, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0097.273] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.273] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.273] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b62550, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0097.273] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.273] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.273] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b62550, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0097.273] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.273] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0097.273] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="N\nLockBox3", cchWideChar=10, lpMultiByteStr=0x3b62550, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N\nLockBox3", lpUsedDefaultChar=0x0) returned 10 [0097.273] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2c, wMilliseconds=0x21f)) [0097.273] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr=",2qRBocMmYF&Q&XQ!Dmur%&zI\"bHo603", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0097.273] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr=",2qRBocMmYF&Q&XQ!Dmur%&zI\"bHo603", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0097.273] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr=",2qRBocMmYF&Q&XQ!Dmur%&zI\"bHo603", cchWideChar=32, lpMultiByteStr=0x3b58088, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=",2qRBocMmYF&Q&XQ!Dmur%&zI\"bHo603", lpUsedDefaultChar=0x0) returned 32 [0097.273] GetCurrentThreadId () returned 0x970 [0097.273] GetCurrentThreadId () returned 0x970 [0097.273] GetCurrentThreadId () returned 0x970 [0097.273] GetCurrentThreadId () returned 0x970 [0097.273] GetCurrentThreadId () returned 0x970 [0097.273] GetCurrentThreadId () returned 0x970 [0097.281] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0097.281] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0097.281] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", cchWideChar=64, lpMultiByteStr=0x3b169d8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", lpUsedDefaultChar=0x0) returned 64 [0097.281] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 232 [0097.281] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x34ee248, cbMultiByte=232, lpWideCharStr=0x34e206c, cchWideChar=232 | out: lpWideCharStr="IAAAAGIuoNJcKMPzSxNjlc7GDSjcQ7iLGSkrp9iD6XUzJTGiQccs2Dryhk1okNW6uEgsB9c1NMA72N2TO+Na7Q6AnCZp/rvp42R9QLZgZHMHWQQHUw8g4AGRuud94qwNjrn0T7tQwpdMg4EoSuUvBpAq+PC0rASGQOa+Y3J2H7BonhDC0UoPpmLl8rn44Z3l6+ZFFa8vVAWfl3vws3L5JV0d1Pm4Z3Xg3TLMag==") returned 232 [0097.281] GetLocalTime (in: lpSystemTime=0x18fd44 | out: lpSystemTime=0x18fd44*(wYear=0x7e3, wMonth=0xb, wDayOfWeek=0x0, wDay=0x18, wHour=0x15, wMinute=0x28, wSecond=0x2c, wMilliseconds=0x22f)) [0097.281] GetCurrentThreadId () returned 0x970 [0097.281] GetCurrentThreadId () returned 0x970 [0097.282] GetCurrentThreadId () returned 0x970 [0097.282] GetCurrentThreadId () returned 0x970 [0097.282] GetCurrentThreadId () returned 0x970 [0097.282] GetCurrentThreadId () returned 0x970 [0097.282] GetCurrentThreadId () returned 0x970 [0097.282] GetCurrentThreadId () returned 0x970 [0097.282] GetCurrentThreadId () returned 0x970 [0097.282] GetCurrentThreadId () returned 0x970 [0097.282] GetCurrentThreadId () returned 0x970 [0097.282] GetCurrentThreadId () returned 0x970 [0097.282] GetCurrentThreadId () returned 0x970 [0097.282] GetCurrentThreadId () returned 0x970 [0097.282] GetCurrentThreadId () returned 0x970 [0097.282] GetCurrentThreadId () returned 0x970 [0097.282] GetCurrentThreadId () returned 0x970 [0097.282] GetCurrentThreadId () returned 0x970 [0097.282] GetCurrentThreadId () returned 0x970 [0097.282] GetCurrentThreadId () returned 0x970 [0097.282] GetCurrentThreadId () returned 0x970 [0097.282] GetCurrentThreadId () returned 0x970 [0097.282] GetCurrentThreadId () returned 0x970 [0097.282] GetCurrentThreadId () returned 0x970 [0097.282] GetCurrentThreadId () returned 0x970 [0097.282] GetCurrentThreadId () returned 0x970 [0097.282] GetCurrentThreadId () returned 0x970 [0097.282] GetCurrentThreadId () returned 0x970 [0097.282] GetCurrentThreadId () returned 0x970 [0097.282] GetCurrentThreadId () returned 0x970 [0097.282] GetCurrentThreadId () returned 0x970 [0097.282] GetCurrentThreadId () returned 0x970 [0097.282] GetCurrentThreadId () returned 0x970 [0097.282] GetCurrentThreadId () returned 0x970 [0097.282] GetCurrentThreadId () returned 0x970 [0097.282] GetCurrentThreadId () returned 0x970 [0097.282] GetCurrentThreadId () returned 0x970 [0097.282] GetCurrentThreadId () returned 0x970 [0097.282] GetCurrentThreadId () returned 0x970 [0097.282] GetCurrentThreadId () returned 0x970 [0097.282] GetCurrentThreadId () returned 0x970 [0097.282] GetCurrentThreadId () returned 0x970 [0097.282] GetCurrentThreadId () returned 0x970 [0097.282] GetCurrentThreadId () returned 0x970 [0097.282] GetCurrentThreadId () returned 0x970 [0097.282] GetCurrentThreadId () returned 0x970 [0097.283] GetCurrentThreadId () returned 0x970 [0097.283] GetCurrentThreadId () returned 0x970 [0097.283] GetCurrentThreadId () returned 0x970 [0097.283] GetCurrentThreadId () returned 0x970 [0097.283] GetCurrentThreadId () returned 0x970 [0097.283] GetCurrentThreadId () returned 0x970 [0097.283] GetCurrentThreadId () returned 0x970 [0097.283] GetCurrentThreadId () returned 0x970 [0097.283] GetCurrentThreadId () returned 0x970 [0097.283] GetCurrentThreadId () returned 0x970 [0097.283] GetCurrentThreadId () returned 0x970 [0097.283] GetCurrentThreadId () returned 0x970 [0097.283] GetCurrentThreadId () returned 0x970 [0097.283] GetCurrentThreadId () returned 0x970 [0097.283] GetCurrentThreadId () returned 0x970 [0097.283] GetCurrentThreadId () returned 0x970 [0097.283] GetCurrentThreadId () returned 0x970 [0097.283] GetCurrentThreadId () returned 0x970 [0097.283] GetCurrentThreadId () returned 0x970 [0097.283] GetCurrentThreadId () returned 0x970 [0097.283] GetCurrentThreadId () returned 0x970 [0097.283] GetCurrentThreadId () returned 0x970 [0097.283] GetCurrentThreadId () returned 0x970 [0097.283] GetCurrentThreadId () returned 0x970 [0097.283] GetCurrentThreadId () returned 0x970 [0097.283] GetCurrentThreadId () returned 0x970 [0097.283] GetCurrentThreadId () returned 0x970 [0097.283] GetCurrentThreadId () returned 0x970 [0097.283] GetCurrentThreadId () returned 0x970 [0097.283] GetCurrentThreadId () returned 0x970 [0097.283] GetCurrentThreadId () returned 0x970 [0097.283] GetCurrentThreadId () returned 0x970 [0097.283] GetCurrentThreadId () returned 0x970 [0097.283] GetCurrentThreadId () returned 0x970 [0097.283] GetCurrentThreadId () returned 0x970 [0097.283] GetCurrentThreadId () returned 0x970 [0097.283] GetCurrentThreadId () returned 0x970 [0097.283] GetCurrentThreadId () returned 0x970 [0097.283] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAGIuoNJcKMPzSxNjlc7GDSjcQ7iLGSkrp9iD6XUzJTGiQccs2Dryhk1okNW6uEgsB9c1NMA72N2TO+Na7Q6AnCZp/rvp42R9QLZgZHMHWQQHUw8g4AGRuud94qwNjrn0T7tQwpdMg4EoSuUvBpAq+PC0rASGQOa+Y3J2H7BonhDC0UoPpmLl8rn44Z3l6+ZFFa8vVAWfl3vws3L5JV0d1Pm4Z3Xg3TLMag==", cchWideChar=245, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 245 [0097.283] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ulitochkimoi:IAAAAGIuoNJcKMPzSxNjlc7GDSjcQ7iLGSkrp9iD6XUzJTGiQccs2Dryhk1okNW6uEgsB9c1NMA72N2TO+Na7Q6AnCZp/rvp42R9QLZgZHMHWQQHUw8g4AGRuud94qwNjrn0T7tQwpdMg4EoSuUvBpAq+PC0rASGQOa+Y3J2H7BonhDC0UoPpmLl8rn44Z3l6+ZFFa8vVAWfl3vws3L5JV0d1Pm4Z3Xg3TLMag==", cchWideChar=245, lpMultiByteStr=0x3b4d08c, cbMultiByte=245, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ulitochkimoi:IAAAAGIuoNJcKMPzSxNjlc7GDSjcQ7iLGSkrp9iD6XUzJTGiQccs2Dryhk1okNW6uEgsB9c1NMA72N2TO+Na7Q6AnCZp/rvp42R9QLZgZHMHWQQHUw8g4AGRuud94qwNjrn0T7tQwpdMg4EoSuUvBpAq+PC0rASGQOa+Y3J2H7BonhDC0UoPpmLl8rn44Z3l6+ZFFa8vVAWfl3vws3L5JV0d1Pm4Z3Xg3TLMag==", lpUsedDefaultChar=0x0) returned 245 [0097.283] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fd60, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd60*=0x80, lpOverlapped=0x0) returned 1 [0097.284] WriteFile (in: hFile=0x158, lpBuffer=0x67f2c8*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18fd94, lpOverlapped=0x0 | out: lpBuffer=0x67f2c8*, lpNumberOfBytesWritten=0x18fd94*=0x77, lpOverlapped=0x0) returned 1 [0097.284] CloseHandle (hObject=0x158) returned 1 [0097.284] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01297_.gif")) returned 1 [0097.285] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd7c | out: lpPerformanceCount=0x18fd7c*=21754837281) returned 1 [0097.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\Файл зашифрован [WB01298_.GIF].wannacash .zip" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\Файл зашифрован [wb01298_.gif].wannacash .zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0097.286] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0097.286] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0097.286] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbd8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbd8*=0) returned 0x0 [0097.286] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0097.286] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0097.286] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0097.286] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fbe0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fbe0*=0) returned 0x0 [0097.286] ReadFile (in: hFile=0x158, lpBuffer=0x0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fbf4, lpOverlapped=0x0 | out: lpBuffer=0x0*, lpNumberOfBytesRead=0x18fbf4*=0x0, lpOverlapped=0x0) returned 1 [0097.286] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0097.286] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0097.286] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0097.286] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc34*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc34*=0) returned 0x0 [0097.286] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0097.286] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc20*=0) returned 0x0 [0097.287] SetEndOfFile (hFile=0x158) returned 1 [0097.287] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0097.287] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc2c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc2c*=0) returned 0x0 [0097.287] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0097.287] SetFilePointer (in: hFile=0x158, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc38*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc38*=0) returned 0x0 [0097.287] WriteFile (in: hFile=0x158, lpBuffer=0x3777198*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x3777198*, lpNumberOfBytesWritten=0x18fc40*=0x16, lpOverlapped=0x0) returned 1 [0097.288] WriteFile (in: hFile=0x158, lpBuffer=0x35f059c*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18fc40, lpOverlapped=0x0 | out: lpBuffer=0x35f059c*, lpNumberOfBytesWritten=0x18fc40*=0xa1, lpOverlapped=0x0) returned 1 [0097.288] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="48GUGn#I3f